Security: upgraded vulnerable hl7 transitive dependencies to 6.4.0#1842
Open
LiamStanziani wants to merge 2 commits intomaintenancefrom
Open
Security: upgraded vulnerable hl7 transitive dependencies to 6.4.0#1842LiamStanziani wants to merge 2 commits intomaintenancefrom
LiamStanziani wants to merge 2 commits intomaintenancefrom
Conversation
Reviewer's guide (collapsed on small PRs)Reviewer's GuidePins vulnerable org.hl7.fhir.core transitive dependencies to explicit, secure 6.4.0 versions in the Maven build and refreshes dependency lock files accordingly to address an XXE vulnerability in XSLT parsing. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
📝 WalkthroughWalkthroughThree files updated to bump HL7 FHIR library versions from 5.6.881 to 6.4.0, addressing security vulnerabilities. Changes include updated integrity hashes in two lockfiles and new dependency management declarations in Maven configuration. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Comment |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. OpenSSF Scorecard
Scanned Files
|
LiamStanziani
changed the title
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- Consider extracting the
6.4.0HL7/FHIR version into a Maven property (e.g.hl7.fhir.version) so that future upgrades only require changing it in one place.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider extracting the `6.4.0` HL7/FHIR version into a Maven property (e.g. `hl7.fhir.version`) so that future upgrades only require changing it in one place.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
3 tasks
Collaborator
|
@LiamStanziani when you get a chance, would you be able to either:
Thanks! 🧉 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In this PR, I have:
I have tested this by:
Summary by Sourcery
Pin vulnerable org.hl7.fhir.core transitive dependencies to secure versions to address an XXE vulnerability in XSLT parsing.
Bug Fixes:
Build:
Summary by cubic
Upgraded HL7 FHIR transitive dependencies to 6.4.0 to fix an XXE vulnerability in XSLT parsing. Forces secure versions to ensure safe builds.
Written for commit 87110ba. Summary will update on new commits.
Summary by Sourcery
Update HL7 FHIR dependencies to secure versions to address a known XXE vulnerability.
Bug Fixes:
Build:
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.