duo-universal-sdk v1.1.3 dependencies with vulnerabilities

[SandraABM]

I am using Java duo-universal-sdk v1.1.3 and getting vulnerabilities reported from dependencies.

Vulnerabilities I get reported in IntelliJ, and with syft/grype are:

com.fasterxml.jackson.core:jackson-core:2.3.2
com.fasterxml.jackson.core:jackson-databind:2.3.2
com.squareup.okhttp3:okhttp:3.14.19
com.squareup.okio:okio:1.17.2

Can you please investigate?

[AaronAtDuo]

The good news is, we have investigated those vulnerabilities and determined that we are not impacted by them.

The tricky part is that we inherit those dependencies via retrofit (they are not direct dependencies), so we rely on their dependency versioning. It looks like they recently put out a release after four years without one, so we need to see if it's feasible to update.

[wfhoehn]

Any update on this?