[THRIFT-5512] CVEs notified on Maven Central (through deps)

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 0.15.0
• Fix Version/s: 0.16.0
• Component/s: Java - Library
• Assignee: Yuxuan Wang
• Reporter: Divye Kapoor
• Created: 08/Feb/22 00:38
• Updated: 15/Feb/22 21:41
• Resolved: 09/Feb/22 16:59

Description

Consider fixing the dep versions and doing a minor release.

Maven central identifies indirect CVEs:

https://mvnrepository.com/artifact/org.apache.thrift/libthrift/0.15.0

Issue Links

• links to: GitHub Pull Request #2519