-
Improvement
-
Resolution: Unresolved
-
Minor
-
None
ivy version 2.4.0 used by groovy-event-listener plugin contains security vulnerabilities.
Request is to Bump org.apache.ivy:ivy from 2.4.0 to 2.5.2
https://github.com/jenkinsci/groovy-events-listener-plugin/pull/78
priyank_s the Dependabot pull request proposing that upgrade has been open since Oct 2023 without any action from the plugin maintainers. The pull request has failing tests that someone will need to investigate.
If your organization depends on the groovy events listener plugin, then you should propose to your organization that they allow you to spend some time maintaining that plugin. You can fix the failing tests in that pull request, test with Apache Ivy 2.5.2, and prepare it for a release. The plugin has already received most of the improvements suggested in "Improve a plugin", so it is in a good place for another person to help with the plugin.