Skip to content

Commit 1167bbe

Browse files
authored
Upgrade kotlin-reflect from 1.6.10 to 2.2.0 (#6984)
kotlin-compiler-embeddable declares a transitive dependency on kotlin-reflect 1.6.10, which is flagged for CVE-2020-29582 (insecure temp file permissions). Adding an explicit kotlin-reflect dependency at the same version as the rest of the Kotlin dependencies (2.2.0) causes Gradle's conflict resolution to select the newer version. This resolves the vulnerability across all 47 downstream recipe repos that transitively depend on rewrite-kotlin. See moderneinc/dependency-vulnerability-reports#1010
1 parent 78ee4c1 commit 1167bbe

1 file changed

Lines changed: 1 addition & 0 deletions

File tree

rewrite-kotlin/build.gradle.kts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ dependencies {
1414
implementation(project(":rewrite-java"))
1515

1616
implementation(kotlin("compiler-embeddable", kotlinVersion))
17+
implementation(kotlin("reflect", kotlinVersion))
1718
implementation(kotlin("stdlib", kotlinVersion))
1819

1920
testImplementation("org.junit-pioneer:junit-pioneer:latest.release")

0 commit comments

Comments
 (0)