[BUG] com.google.code.findbugs/ version problem about fabric8-analytics-vscode-extension

[ruromero]

Hi @rubensa
It's also available in the GA repository

You have to add the GA Red Hat Repository to your Maven repositories in the settings.xml file, you can find the instructions here

[rubensa]

@ruromero Thanks for the info

But the thing is, why the extension is proposing a fix for a 0 vulnerabilities package and the proposed package is not from maven central but from other repository (whereas the original one is in maven central)?
And, where is the source code and changeset for the proposed Red Hat package version to check if that change makes sense or not?

[ruromero]

Hi @rubensa
It's a recommendation of a Red Hat alternative that will bring you better support and more frequent patches. You can expect vulnerabilities to be reported earlier in RH supported packages and be notified about vulnerable packages from the Red Hat security data feeds.
Besides, packages pushed to the RH repository have been certified and signed by RH whereas Maven Central can host any package from any developer.
The source code is also available in the RH repository but we're not providing the specific changeset that justifies in any way any functional benefit of using it.

That's why it is underlined in blue, meaning that it's just a suggestion.

[rubensa]

@ruromero
Thank you for the info.

Could you provide me the URL for the RH repository with the source code?

[ruromero]

Definitely! In the same Maven repository you can find all the sources.
This is the source code of the artifact mentioned in the issue com.google.findbugs:jsr305:3.0.2.redhat-00018

[rubensa]

Thanks @ruromero but was meaning the source code repository (GitHub or something?) 😓

[ruromero]

For this specific package I honestly don't know. The pom says the source control management is at http://findbugs.googlecode.com/svn/trunk/ but this link is not working.

[rubensa]

I think that is cause the code in googlecode repository is now archived: https://code.google.com/archive/p/findbugs/source/default/source

It was, at sometime, moved to GitHub: https://github.com/findbugsproject/findbugs

But currently, the development is done in new GitHub project: https://github.com/spotbugs/spotbugs

The thing here is that, all those source code repositories, are for the original project code, not the RedHat "modified" code...