Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

9.4.0 has an incorrect dependency #1016

Closed
sebphil opened this issue Oct 10, 2024 · 3 comments · Fixed by #1022 · May be fixed by #1018
Closed

9.4.0 has an incorrect dependency #1016

sebphil opened this issue Oct 10, 2024 · 3 comments · Fixed by #1022 · May be fixed by #1018
Labels
needs-triage

Comments

@sebphil
Copy link

sebphil commented Oct 10, 2024

The 9.4.0 release has a dependency to org.mock-server:mockserver-junit-rule-no-dependencies:5.14.0 which is lacking the 'test' scope, therefore it is pulled alongside the firebase-admin dependency. This causes an issue with the SLF4J library because of the org.slf4j.helpers.NOPLoggerFactory included in this incorrect dependency taking precedence over the Logback LoggerFactory.
@google-oss-bot
Copy link

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

@kmagnusjohansson
Copy link

I agree this wrongly scoped dependency should be removed and a new release should be created asap.. not only is it in the wrong scope it is also flagged with a CVE stopping our local pipelines (CVE-2021-32827) , how did it even get through?

@fatso83 fatso83 mentioned this issue Oct 12, 2024
Closed
timpeeters added a commit to timpeeters/firebase-admin-java that referenced this issue Oct 12, 2024
@timpeeters
Move mockserver-junit-rule-no-dependencies to test scope
9acf7d1 
Fixes firebase#1016 by defining mockserver-junit-rule-no-dependencies as a test scoped dependency.
@timpeeters timpeeters mentioned this issue Oct 12, 2024
Open
@timpeeters
Copy link

I've created #1018 to (at least) move it to test scope already.

@jonathanedey jonathanedey mentioned this issue Oct 15, 2024
Merged
@jonathanedey jonathanedey mentioned this issue Oct 15, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
needs-triage
Projects
None yet
Milestone
No milestone
4 participants
@sebphil @kmagnusjohansson @timpeeters @google-oss-bot