Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

influxdb-java.git/pom.xml references no longer maintained com.dkanejs.maven.plugins #999

Open
jdstrand opened this issue Feb 16, 2024 · 0 comments

Comments

@jdstrand
Copy link
Contributor

Recent security research discussed problems in the maven ecosystem where the DNS of a no longer maintained project expires and is taken over. mathieucarbou/license-maven-plugin#715 discussed some specifics around maven central which make this less of a problem since they use a formal process for transfers, which influxdb-java seems to be using.

All said, I'm filing this less as a security problem and more for awareness that a component is being used that is no longer maintained.

$ whois dkanejs.com   # shows it is expired
No match for domain "DKANEJS.COM".
>>> Last update of whois database: 2024-02-16T15:50:52Z <<<

NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar.  Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.
...

$ grep -r com.dkanejs ./influxdb-java.git
./pom.xml:            <groupId>com.dkanejs.maven.plugins</groupId>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant