Commit 1167bbe
authored
Upgrade kotlin-reflect from 1.6.10 to 2.2.0 (#6984)
kotlin-compiler-embeddable declares a transitive dependency on
kotlin-reflect 1.6.10, which is flagged for CVE-2020-29582 (insecure
temp file permissions). Adding an explicit kotlin-reflect dependency at
the same version as the rest of the Kotlin dependencies (2.2.0) causes
Gradle's conflict resolution to select the newer version.
This resolves the vulnerability across all 47 downstream recipe repos
that transitively depend on rewrite-kotlin.
See moderneinc/dependency-vulnerability-reports#10101 parent 78ee4c1 commit 1167bbe
1 file changed
Lines changed: 1 addition & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
14 | 14 | | |
15 | 15 | | |
16 | 16 | | |
| 17 | + | |
17 | 18 | | |
18 | 19 | | |
19 | 20 | | |
| |||
0 commit comments