<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0"> <base href="https://shibboleth.atlassian.net">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429;">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0;" bgcolor="#f5f5f5"><!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="border-collapse: collapse; padding: 10px 20px;">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0;">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px;" width="32"><img id="header-avatar-image" class="image_fix" src="https://secure.gravatar.com/avatar/167faa998823987c7bf0c77a91008340?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FIY-6.png" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top;"></td>
<td id="header-text-container" valign="middle" style="padding: 0; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px;"><a class="user-hover" rel="557058:e127cb03-43ed-473d-b6ba-592949cb4be8" style="color: #3b73af; text-decoration: none;" id="email_557058:e127cb03-43ed-473d-b6ba-592949cb4be8" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3Ae127cb03-43ed-473d-b6ba-592949cb4be8"> Ian Young </a> <strong>commented</strong> on <a href="https://shibboleth.atlassian.net/browse/JSCRIPTING-15?atlOrigin=eyJpIjoiOTM4ZGZlNDg4OGFiNGM2ZTgwNTAwZWIzODcwNGFjM2YiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none;"><img src="cid:jira-generated-image-avatar-0f7a2337-a300-40f7-8d0c-bbb3cabe80ed" height="16" width="16" border="0" align="absmiddle" alt="Task"> JSCRIPTING-15</a></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="email-content-container" style="border-collapse: collapse; padding: 0 20px;">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="mso-table-lspace: 0; mso-table-rspace: 0; border-spacing: 0; border-collapse: separate;">
<tbody>
<tr><!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="border-collapse: collapse; color: #ffffff; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly;" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff;" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0;">
<tbody>
<tr>
<td style="vertical-align: top; padding: 0; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly;" class="page-title-pattern-header-container"><span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle;"> <a href="https://shibboleth.atlassian.net/browse/JSCRIPTING-15?atlOrigin=eyJpIjoiOTM4ZGZlNDg4OGFiNGM2ZTgwNTAwZWIzODcwNGFjM2YiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none;">Re: Review dependencies</a> </span></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="text-paragraph-pattern-top" class="email-content-main mobile-expand comment-top-pattern" style="border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; padding: 0 15px 0 16px; background-color: #ffffff; border-bottom: none; padding-bottom: 0;" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px;">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="border-collapse: collapse; padding: 0 0 10px;"><p style="margin: 10px 0 0; margin-top: 0;">Cherry-picking only dependency updates addressing security issues would require a nearly omniscient level of knowledge of everything in the ecosystem. My approach to date has been to have a bias towards always updating to the latest revision of any dependency pinned by the parent POM (and therefore called out by Maven’s display-dependency-updates) that is within semantic versioning for the release we’re working on (so, no updating from v14 to v15 of a dependency unless we’re also working on a major).</p> <p style="margin: 10px 0 0;">This catches known security issues in dependencies as well as unknown ones. Sometimes the latter are deliberate omissions in release notes to allow people to update before telling the bad guys.</p> <p style="margin: 10px 0 0;">I do not look at transient dependencies at all, except for the key question. If our named dependency X references Y but that’s not pinned by us, we just take X’s word for which version of Y to use. I don’t see an alternative to this.</p></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff;" bgcolor="#ffffff"><script type="application/ld+json">
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"description": "View Issue",
"potentialAction": {
"@type": "ViewAction",
"target": "https://shibboleth.atlassian.net/browse/JSCRIPTING-15?inbox=true&focusedCommentId=35188&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-35188",
"name": "View Comment"
},
"publisher": {
"@type": "Organization",
"name": "Atlassian",
"url": "https://www.atlassian.com"
}
}
</script>
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px;">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0;">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0;">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle;"><a href="https://shibboleth.atlassian.net/browse/JSCRIPTING-15#add-comment?atlOrigin=eyJpIjoiOTM4ZGZlNDg4OGFiNGM2ZTgwNTAwZWIzODcwNGFjM2YiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none;"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-efd58042-a0d1-4ad9-a302-7839afab501d" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle;"> </a></td>
<td class="actions-pattern-action-text-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px;"><a href="https://shibboleth.atlassian.net/browse/JSCRIPTING-15#add-comment?atlOrigin=eyJpIjoiOTM4ZGZlNDg4OGFiNGM2ZTgwNTAwZWIzODcwNGFjM2YiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none;">Add Comment</a></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table></td>
</tr> <!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly;" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="footer-pattern" style="border-collapse: collapse; padding: 12px 20px;">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0;">
<tbody>
<tr>
<td id="footer-pattern-mobile-separated-links" class="mobile-resize-text" width="100%" colspan="2" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px;">Get Jira notifications on your phone! Download the Jira Cloud app for <a href="https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail" style="color: #3b73af; text-decoration: none;">Android</a> or <a href="https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8" style="color: #3b73af; text-decoration: none;">iOS</a>
<hr></td>
</tr>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px;">This message was sent by Atlassian Jira <span id="footer-build-information">(v1001.0.0-SNAPSHOT#100227-<span title="6a5b8c4a331b2f147517227fefb7002793b864d8" data-commit-id="6a5b8c4a331b2f147517227fefb7002793b864d8}">sha1:6a5b8c4</span>)</span></td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0; border-collapse: collapse; padding-left: 20px; vertical-align: top;">
<table style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0;">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0; border-collapse: collapse; padding-top: 3px; opacity: 0.150;"><img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-1281438e-1954-4692-a930-bf291fbed15a" alt="Atlassian logo" title="Atlassian logo" width="192" height="24" class="image_fix"></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table>
</body>
</html>