jetty9 nvd suppressions

factorhouse · Dec 9, 2024 · 983049d · 983049d
1 parent 6561b57
commit 983049d
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 8 deletions.
diff --git a/slipway-jetty9/dependency-check-suppressions.xml b/slipway-jetty9/dependency-check-suppressions.xml
@@ -1,10 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
-    <suppress>
-        <notes><![CDATA[
-   file name: slipway-jetty9-1.1.5-standalone.jar (shaded: commons-fileupload:commons-fileupload:1.4)
-   ]]></notes>
-        <packageUrl regex="true">^pkg:maven/commons\-fileupload/commons\-fileupload@.*$</packageUrl>
-        <cve>CVE-2023-24998</cve>
-    </suppress>
+
+    <!-- Only include legitimate suppressions of false-positives in this file -->
+
 </suppressions>
diff --git a/slipway-jetty9/project.clj b/slipway-jetty9/project.clj
@@ -23,7 +23,8 @@
 
   :dependencies [[org.clojure/clojure "1.12.0"]
                  [org.clojure/tools.logging "1.3.0"]
-                 [ring/ring-servlet "1.9.6"]
+                 [ring/ring-servlet "1.10.0"]
+                 [commons-io "2.16.1"]                      ;; replaces old version with CVE in ring-servlet, remove when ring bumped to latest
                  [com.taoensso/sente "1.17.0"]
                  [org.eclipse.jetty/jetty-server "9.4.56.v20240826"]
                  [org.eclipse.jetty.websocket/websocket-server "9.4.56.v20240826"]