Security scans findings about grpc-spring

[ST-DDT]

Thanks for bringing this to our attention.

The dependency is marked as optional runtime dependency.

<dependency>
      <groupId>org.springframework.cloud</groupId>
      <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
      <version>4.1.0</version>
      <scope>runtime</scope>
      <exclusions>...</exclusions>
      <optional>true</optional>
</dependency>

So AFAIK unless you add them yourself it won't show up in the final application.

Unfortunately, there isn't a patched version of the eureka client lib available, that uses a newer version of that library, so there isn't much we can do here.
Could you please report this to the eureka client lib, so they can fix that?

[dranzey-hub]

Thanks for the response.

We will exclude all of those optional dependencies and scan again. I'll let you know the results.

[dranzey-hub]

Thanks, there seemed to be problems on the Blackduck scan that were fixed and now the optional dependencies do not show up so we are good.