Bump libthrift to 0.15.0 (close #539)

snowplow · Dec 19, 2021 · 1b66adf · 1b66adf
1 parent 6d4c0e4
commit 1b66adf
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/build.sbt b/build.sbt
@@ -59,6 +59,7 @@ lazy val common = project
       Dependencies.Libraries.snowplowRawEvent,
       Dependencies.Libraries.collectorPayload,
       Dependencies.Libraries.schemaSniffer,
+      Dependencies.Libraries.thrift,
       Dependencies.Libraries.specs2,
       Dependencies.Libraries.specs2Cats,
       Dependencies.Libraries.specs2Scalacheck,

diff --git a/project/Dependencies.scala b/project/Dependencies.scala
@@ -42,6 +42,7 @@ object Dependencies {
     val guava            = "28.1-jre"
     val slf4j            = "1.7.32"
     val log4j            = "2.17.0" // CVE-2021-44228
+    val thrift           = "0.15.0" // override transitive dependency to mitigate security vulnerabilities
 
     val refererParser    = "1.1.0"
     val maxmindIplookups = "0.7.1"
@@ -132,6 +133,7 @@ object Dependencies {
     val collectorPayload = "com.snowplowanalytics"      %  "collector-payload-1"           % V.collectorPayload
     val schemaSniffer    = "com.snowplowanalytics"      %  "schema-sniffer-1"              % V.schemaSniffer
     val iabClient        = "com.snowplowanalytics"      %  "iab-spiders-and-robots-client" % V.iabClient
+    val thrift           = "org.apache.thrift"          % "libthrift"                      % V.thrift
 
     val specs2           = "org.specs2"                 %% "specs2-core"                   % V.specs2                    % Test
     val specs2Cats       = "org.specs2"                 %% "specs2-cats"                   % V.specs2                    % Test