High Vulnerability Issue of Dependency classgraph 4.8.60

[dsubelman]

The dependency classgraph version 4.8.60 has been reported to have a high-severity vulnerability.

References:

• OSS Index - [CVE-2021-47621] CWE-611: Improper Restriction of XML External Entity Reference ('XXE')
• Release classgraph 4.8.112
• Pull Request #539

It appears that release 4.8.112 addresses and fixes this issue.

[dsubelman]

Hi, have you been able to see this?

[ccleva]

Hi @dsubelman, I released a maintenance version with this fixed. Details are in this discussion #1261

[benmccann]

It looks like this was fixed awhile back and just never released. I'll cut a release of this project. No need to fork it

tablesaw/core/pom.xml

Line 109 in 7dd4097

<version>4.8.168</version>

Closing in favor of #1251

[dsubelman]

@benmccann thanks for the update. When are you planning to release the new version?

[benmccann]

Soon. Please follow #1251

Hopefully it will be today, but I need to check on some of the other PRs to try to get them in as well

[dsubelman]

@benmccann thanks again for the rapid response.