[JIRA] (JSCRIPTING-15) Review dependencies

[Ian Young (Jira)]

Ian Young ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3Ae127cb03-43ed-473d-b6ba-592949cb4be8 ) *commented* on JSCRIPTING-15 ( https://shibboleth.atlassian.net/browse/JSCRIPTING-15?atlOrigin=eyJpIjoiOTM4ZGZlNDg4OGFiNGM2ZTgwNTAwZWIzODcwNGFjM2YiLCJwIjoiaiJ9 )

Re: Review dependencies ( https://shibboleth.atlassian.net/browse/JSCRIPTING-15?atlOrigin=eyJpIjoiOTM4ZGZlNDg4OGFiNGM2ZTgwNTAwZWIzODcwNGFjM2YiLCJwIjoiaiJ9 )

Cherry-picking only dependency updates addressing security issues would require a nearly omniscient level of knowledge of everything in the ecosystem. My approach to date has been to have a bias towards always updating to the latest revision of any dependency pinned by the parent POM (and therefore called out by Maven’s display-dependency-updates) that is within semantic versioning for the release we’re working on (so, no updating from v14 to v15 of a dependency unless we’re also working on a major).

This catches known security issues in dependencies as well as unknown ones. Sometimes the latter are deliberate omissions in release notes to allow people to update before telling the bad guys.

I do not look at transient dependencies at all, except for the key question. If our named dependency X references Y but that’s not pinned by us, we just take X’s word for which version of Y to use. I don’t see an alternative to this.

( https://shibboleth.atlassian.net/browse/JSCRIPTING-15#add-comment?atlOrigin=eyJpIjoiOTM4ZGZlNDg4OGFiNGM2ZTgwNTAwZWIzODcwNGFjM2YiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JSCRIPTING-15#add-comment?atlOrigin=eyJpIjoiOTM4ZGZlNDg4OGFiNGM2ZTgwNTAwZWIzODcwNGFjM2YiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100227- sha1:6a5b8c4 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230622/1e5f5eed/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-efd58042-a0d1-4ad9-a302-7839afab501d
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230622/1e5f5eed/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-1281438e-1954-4692-a930-bf291fbed15a
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230622/1e5f5eed/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-0f7a2337-a300-40f7-8d0c-bbb3cabe80ed
Type: image/png
Size: 484 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230622/1e5f5eed/attachment-0005.png>