Play 3.0.0 upgrade & vulnerabilty fixes #114
Conversation
…via direct dependencies
`play-git-hub` makes use of internal OkHttp APIs which have been removed in 4.x
AshCorr
force-pushed
the
ash/VulnFixes
branch
from
a2ad7de
to
5e317bf
Compare
This upgrade was prompted by guardian/prout#114, where Ash noted that updating to OkHttp 4 was blocked by `play-git-hub`s use of OkHttp 's internal `HttpDate` class. Thankfully the `java.time` package offers the `RFC_1123_DATE_TIME` date time formatter, which looks to be a good substitute for parsing the `Date` header returned by the GitHub API. https://docs.oracle.com/javase/8/docs/api/java/time/format/DateTimeFormatter.html#RFC_1123_DATE_TIME
|
Hi @AshCorr thanks so much for this! I guess the list of vulnerabilities we're looking at here is coming from https://app.snyk.io/org/guardian-devtools/project/1bc32f14-0b81-428e-b01b-9942ba45885c, is that right?
I've prepared rtyley/play-git-hub#7 to get Regarding Play 2.9, it looks like there's a bit of a question about whether this is officially 'released' or not yet?
I can see that it's coming, and I definitely want to upgrade to it when it is, but has there been a proper release statement yet? Is adopting 2.9 this week, rather than next week, a bit early - or is this driven by a Snyk vuln fixed by Play 2.9? |
This upgrade was prompted by guardian/prout#114, where Ash noted that updating to OkHttp 4 was blocked by `play-git-hub`s use of OkHttp 's internal `HttpDate` class. Thankfully the `java.time` package offers the `RFC_1123_DATE_TIME` date time formatter, which looks to be a good substitute for parsing the `Date` header returned by the GitHub API. https://docs.oracle.com/javase/8/docs/api/java/time/format/DateTimeFormatter.html#RFC_1123_DATE_TIME
This upgrade was prompted by guardian/prout#114, where Ash noted that updating to OkHttp 4 was blocked by `play-git-hub`s use of OkHttp 's internal `HttpDate` class. Thankfully the `java.time` package offers the `RFC_1123_DATE_TIME` date time formatter, which looks to be a good substitute for parsing the `Date` header returned by the GitHub API. https://docs.oracle.com/javase/8/docs/api/java/time/format/DateTimeFormatter.html#RFC_1123_DATE_TIME
This upgrade was prompted by guardian/prout#114, where Ash noted that updating to OkHttp 4 was blocked by `play-git-hub`s use of OkHttp 's internal `HttpDate` class. Thankfully the `java.time` package offers the `RFC_1123_DATE_TIME` date time formatter, which looks to be a good substitute for parsing the `Date` header returned by the GitHub API. https://docs.oracle.com/javase/8/docs/api/java/time/format/DateTimeFormatter.html#RFC_1123_DATE_TIME
Sounds like its a stable release, just no release statement yet. Should hopefully come out today if we want to wait for merging this PR! EDIT: It's out! |
|
This is working well on PROD! https://prout-bot.herokuapp.com/view/guardian/prout
|
What does this change?
The last vuln is a total pain to fix - it involves updating okhttp to 4.x from 3.x, this should have been easy but
com.madgag.play-git-hubmakes use of an internal OkHttp package which isn't available anymore in okhttp 4.xHow to test
sbt compilecompiles fine.snyk testbefore:snyk testafter: