Skip to content

Commit d518078

Browse files
chore: change annotation library (#492)
context: As part of our security scanning efforts, we are using BlackDuck to scan for Vulnerabilities in the libraries we are using. Recently, this tool flagged the Statsig Java Backend SDK as containing a vulnerability in both versions 1.25.0 and the latest 3.0.0. The vulnerability originates in the referenced Tomcat annotations-api:
1 parent c103caf commit d518078

File tree

2 files changed

+6
-3
lines changed

2 files changed

+6
-3
lines changed

build.gradle.kts

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ dependencies {
5151
implementation("io.grpc:grpc-netty-shaded:1.71.0")
5252
implementation("io.grpc:grpc-stub:1.71.0")
5353
implementation("io.grpc:grpc-protobuf:1.71.0")
54-
implementation("org.apache.tomcat:annotations-api:6.0.53")
54+
implementation("jakarta.annotation:jakarta.annotation-api:2.1.1")
5555
}
5656

5757
val sourcesJar by tasks.registering(Jar::class) {
@@ -109,7 +109,9 @@ protobuf {
109109
generateProtoTasks {
110110
all().forEach { task ->
111111
task.plugins {
112-
id("grpc")
112+
id("grpc") {
113+
option("@generated=omit")
114+
}
113115
}
114116
task.doLast {
115117
val outputPath = task.outputs.files.getAsPath()

src/main/java/grpc/generated/statsig_forward_proxy/StatsigForwardProxyGrpc.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,11 @@
11
package grpc.generated.statsig_forward_proxy;
22

33
import static io.grpc.MethodDescriptor.generateFullMethodName;
4+
import jakarta.annotation.Generated;
45

56
/**
67
*/
7-
@javax.annotation.Generated(
8+
@Generated(
89
value = "by gRPC proto compiler (version 1.66.0)",
910
comments = "Source: statsig_forward_proxy.proto")
1011
@io.grpc.stub.annotations.GrpcGenerated

0 commit comments

Comments
 (0)