If you are submitting a bug, please include the following:
If you're just submitting a feature request or question, no need for the above.
Summary
An accidental discovery: making Spotless a dependency instead of a plugin (yes, it was a mistake) turned up multiple CVEs from DependencyCheck. This tells me 2 things:
- DependencyCheck is not checking plugins
- Spotless has outdated dependencies for the plugins
Obviously, this is a user goof, however, it tells me that Spotless may need to refresh/update dependencies for the plugins.
On the other hand, some of these may be build-only dependencies for the plugin? Either way, there are some outdated dependencies in the plugin.
CVEs with 2.43.0:
My issue post focuses on the Maven plugin. I haven't tried doing the same with the Gradle plugin.
Maven version
3.9.6
Spotless version
2.43.0
OS version
Not relevant, however "Linux Hobbiton 5.15.146.1-microsoft-standard-WSL2 #1 SMP Thu Jan 11 04:09:03 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux" running Ubuntu under WSL2 on Windows 11.
Spotless configuration block
No configuration block provided.
Console output
I wanted to paste the full ./mvnw -X verify output, however two problems:
- Lots of useless stuff non-specific to the problem at hand
- Posting the full output gave GitHub a heartburn, and it complained that this issue exceeded the character limit
If you are submitting a bug, please include the following:
gradlew spotless[Apply/Check] --stacktraceIf you're just submitting a feature request or question, no need for the above.
Summary
An accidental discovery: making Spotless a dependency instead of a plugin (yes, it was a mistake) turned up multiple CVEs from DependencyCheck. This tells me 2 things:
Obviously, this is a user goof, however, it tells me that Spotless may need to refresh/update dependencies for the plugins.
On the other hand, some of these may be build-only dependencies for the plugin? Either way, there are some outdated dependencies in the plugin.
CVEs with 2.43.0:
My issue post focuses on the Maven plugin. I haven't tried doing the same with the Gradle plugin.
Maven version
3.9.6
Spotless version
2.43.0
OS version
Not relevant, however "Linux Hobbiton 5.15.146.1-microsoft-standard-WSL2 #1 SMP Thu Jan 11 04:09:03 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux" running Ubuntu under WSL2 on Windows 11.
Spotless configuration block
No configuration block provided.
Console output
I wanted to paste the full
./mvnw -X verifyoutput, however two problems: