jruby: CVEs in transitive dependencies for snakeyaml 2.10

[mohamedhafez]

See https://mvnrepository.com/artifact/org.snakeyaml/snakeyaml-engine/2.10

Hoping for a version bump if theres a chance those might affect JRuby users of psych!

[headius]

Just closing the loop on this issue a little bit..

The dependency in question is only used by snakeyaml at test time, and does not affect regular runtime use of the library. The remaining motivation to upgrade here would be to have a clean dependency graph for security auditing tools.

[chadlwilson]

No real world tool looks at transitive test scope dependencies, because they can never be on your classpath unless you consume test-jars dependencies (aka test fixtures in Gradle world) - which snakeyaml-engine doesn't even publish.

This is just a terrible (wrong) design decision from mvnrepository to highlight completely irrelevant CVEs on a consuming dependency and create even more completely unnecessary FUD than the world of dependency security is already plagued with :(

These dependencies are clear on scans from all actual security tools. I implore everyone to ignore mvnrepository. Please. 🙏

Maybe ill get the energy to contact the mvnrepository person, as I've seen this cause noise on half a dozen occasions now in projects I maintain or contribute to.