Vulnerable Dependencies in Latest version 21.7.1

[tyler-32]

The latest v21.7.1 release is from 4 years ago & has several open security vulnerabilities (which appear to have been fixed in master already). Just need a new release created & uploaded to mvnrepository to resolve the vulnerabilities.

v21.7.1 CVE	v21.7.1 problem dependency	master version
CVE-2014-4043	org.web3j:core:4.6.0 > jnr-posix-3.0.47.jar autobahn-java/autobahn/build.gradle Line 34 in d9a591c implementation 'org.web3j:core:4.6.0'	YES? - org.web3j:core:4.11.0 > no more jnr-posix-3.0.47.jar autobahn-java/autobahn/build.gradle Line 35 in 5f13baa implementation 'org.web3j:core:4.11.0'
CVE-2020-28052	org.web3j:core:4.6.0 > org.java-websocket:Java-WebSocket:jar:1.3.8	YES? - org.web3j:core:4.11.0 > org.java-websocket:Java-WebSocket:jar:1.5.3

For reference, here are some related prior issues regarding security vulnerabilities / release process which I found:

• Bump version and release v21.5.1 #521
• Vulnerable Dependencies #489
• Document release process #493

[tuancoltech]

Hey @tyler-32
I've released a new version including all latest changes on master here
You can refer to this guide on how to use it.

[tyler-32]

Hey @tyler-32 I've released a new version including all latest changes on master here You can refer to this guide on how to use it.

Thank you @tuancoltech! Any chance you could upload latest 21.7.3 to mvnrepository as well?

edit: ah I see that is your fork so you probably don't have access to upload to the mvnrepository link; I'll try yours out - thanks for sharing

[oberstet]

yeah, it's a fork by @tuancoltech , cool & absolutely fine of course! but it should be renamed. it cannot be AutobahnXXX (trademarks are with Crossbar.io, today typedef int GmbH). thanks a lot!

[tuancoltech]

it cannot be AutobahnXXX (trademarks are with Crossbar.io, today typedef int GmbH)

@oberstet Oh thanks for your reminder.
I'll be renaming the repository as well as the artifact name, to avoid using trademarked autobahn prefix then.

[oberstet]

@tuancoltech thanks a lot! this avoids confusion for users and you can fully claim/promote your work while still associating origin. if you then like to have it listed on https://wamp-proto.org/implementations.html, just file an issue on the repo there, we'll add it!