SNOW-945927 SNOW-945928 Fix Snyk vulnerabilities #641
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sfc-gh-lsembera
requested review from
sfc-gh-tzhang and
a team
as code owners
|
Is snowflake-jdbc-fips not updated to a newer version of bc-fips yet? Should we just wait for them to upgrade? snowflakedb/snowflake-jdbc#1449 |
|
@sfc-gh-xhuang It does not hurt to update on our side, as well. This project is anyway just testing compatibility with fips. The customer would be defining which |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR resolves the following Snyk findings:
bc-fips- In our e2e-jar-test project we depend onsnowflake-jdbc-fips, which transitively depends on a vulnerable version ofbc-fips. We explicitly pull in a newer version.protobuf-java- SDK contains vulnerable transitive dependency pull in byhadoop-common. This PR marksprotobuf-javaas a direct dependency, so version specified by the SDK will be pulled in.Closes #610
Closes #611
Closes #612
Closes #613
Closes #614
Closes #615
Closes #616
Closes #617
Closes #618
Closes #622
Closes #623
Closes #624
Closes #625