CVEs caused by dependency check gradle plugin itself?

[ghost]

I am using the gradle plugin in version 8.2.1. The task dependencyCheckAnalyze gives me three CVEs, which all seem to be transitive dependencies of the plugin itself:

• guava-31.1-jre.jar (CVE-2020-8908)
• h2-2.1.214.jar (CVE-2022-45868)
• snakeyaml-1.33.jar (CVE-2022-1471)

[jeremylong]

sorry for the delayed reply - yes, I know about the CVEs. Some of them have been fixed and I do not believe any of them actually affect the security of ODC. We are still working on the h2 issue - it will be a breaking change when 11.0 is released.