Skip to content

milvus-lite uses severely outdated and vulnerable dependencies #307

@mgorny

Description

@mgorny

Many of the dependencies listed in conanfile.py seem severely outdated, dating back to 2023. Besides making it really hard to build the project on a modern system (especially with a modern compiler version), they are likely to contain bugs and vulnerabilities. While I haven't looked in detail at other dependencies, at least the OpenSSL version is very worrying:

"openssl/1.1.1t",

OpenSSL 1.1.1 series are not maintained since Sep 2023. The used 1.1.1t version has at least 9 reported vulnerabilities, including some rated "high". That said, this number is likely underestimated, because the 1.1.1 branch is no longer maintained, and new OpenSSL vulnerabilities are no longer tested or marked against that version.

Could you please look into updating the dependencies used to newer versions that are secure, supported and compatible with modern systems?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions