chore: upgrade org.yaml:snakeyaml #10
Draft
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Upgrade
org.yaml:snakeyamlfrom1.21to2.0This pull request upgrades
org.yaml:snakeyamlfrom version1.21to2.0to address multiple security vulnerabilities and ensure compliance with security best practices. The upgrade has been tested locally to confirm compatibility with existing functionality.Vulnerabilities Addressed
| CVE-2022-38749 | snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Write. snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Write |
| CVE-2022-25857 | Uncontrolled Resource Consumption in snakeyaml. Uncontrolled Resource Consumption in snakeyaml |
| CVE-2022-38751 | snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Write. snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Write |
| CVE-2022-38750 | snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Write. snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Write |
| CVE-2022-38752 | snakeYAML before 1.32 vulnerable to Denial of Service due to Out-of-bounds Write. snakeYAML before 1.32 vulnerable to Denial of Service due to Out-of-bounds Write |
| CVE-2022-41854 | Snakeyaml vulnerable to Stack overflow leading to denial of service. Snakeyaml vulnerable to Stack overflow leading to denial of service |
| CVE-2022-1471 | SnakeYaml Constructor Deserialization Remote Code Execution. SnakeYaml Constructor Deserialization Remote Code Execution |
This upgrade enhances the security and stability of the
org.yaml:snakeyamldependency.