exclude msgpack to clear CVE-2022-41719 (#84)

* exclude msgpack to clear CVE-2022-41719 * add comment about CVE
yetanalytics · Nov 16, 2022 · 0138710 · 0138710
1 parent 9a1e9be
commit 0138710
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/deps.edn b/deps.edn
@@ -14,7 +14,9 @@
         {:mvn/version "0.8.1"
          :exclusions [org.clojure/clojurescript]}
         org.clojure/data.json {:mvn/version "2.4.0"}
-        com.cognitect/transit-clj {:mvn/version "1.0.324"}
+        com.cognitect/transit-clj {:mvn/version "1.0.324"
+                                   ;; clears CVE-2022-41719
+                                   :exclusions [org.msgpack/msgpack]}
         cheshire/cheshire {:mvn/version "5.11.0"}}
  :aliases
  {:cli {:extra-paths ["src/cli"]