Critical CVE-2024-1597 in dependencies

[wyohm]

There is a current dependency on postgresql v42.5.1. That version has a critical CVE ( CVE-2024-1597 ). The issue is fixed in patch version 42.5.5 (and in other minor versions).

[davecramer]

where is this a dependency ?

[wyohm]

In the POM.

[davecramer]

It's only used for testing it is not shipped in the jar

[wyohm]

Ah, yes, I see that. It's listed as a "Vulnerability from dependencies" for HikariCP, but because it's just a test dependency, doesn't seem to show as a vulnerability for downstream projects.
Can close as far as I'm concerned. Or leave open to fix for test dependencies.

[davecramer]

Well you can always create a PR

[Vladimir-Goncharov21]

I think I can do it, if the PR only requires upgrading the version