apache/incubator-seata

[TODO] Check the dependency libs of all repositories, fix CVEs from them.

Open

#5,945 opened on Oct 21, 2023

View on GitHub
 (3 comments) (3 reactions) (1 assignee)Java (8,878 forks)batch import
good first issuetask: help-wanted

Repository metrics

Stars
 (25,960 stars)
PR merge metrics
 (Avg merge 20d 17h) (27 merged PRs in 30d)

Description

This was mentioned through the ASF incubator voting. I think it would be better if we could track it.

One minor nit - the dependency list in
https://cwiki.apache.org/confluence/display/INCUBATOR/Seata+Proposal
has a great deal out of outdated dependencies - with a large number of
CVEs associated with them.

Let's scan them and fix them soon.

Contributor guide

Research direction
Investigate the current dependency list in the Seata project, likely in pom.xml files. Use tools like OWASP Dependency Check or Snyk to identify outdated dependencies with known CVEs. Focus on high and critical severity CVEs first. Review comments in the issue for any specific dependencies mentioned. The assignee may have a plan; check linked work or comments for guidance.
Tech stack
java
Domain
security
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
3-5 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
JavaMaven/Gradledependency management
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30