security: bump snakeyaml dep to 2.0

[jmini]

Fixes: #81

[jmini]

This PR is a minimal change to eliminate the CVE-2022-1471, but in my opinion it would be better to remove the runtime dependency as I did with #83

[davideberlein]

@bpossolo can we please have this merged and released? This is causing critical vulnerability alerts on this lib

[abstractj]

@mattrobenolt could you please review those changes so we can eliminate a CVE?

[mattrobenolt]

@mattrobenolt could you please review those changes so we can eliminate a CVE?

What. I don't know Java. Not sure why I got pinged for this.

[orgads]

Can anyone please approve this?

[olamy]

done in a fork and released here https://github.com/olamy/uap-java

[dcolazin]

Seems that with the version bump, there is no deprecation of the methods used, and the tests are passing. The only concern might be a performance benchmark between the old and the new version. Anyway, even this should be an quick and easy check.

I will be blunt. I don't understand why such a simple fix of a critical/high cve in a widely used library (we can discuss if the score is accurate, but marking this as fp is not worth the time to discuss with security teams) is taking so long. This project needs more maintainers! @mattrobenolt you were pinged probably because you appear as the sole person in the ua-parser organization.

Yes, it is possible to do something like the following, but some vulnerability checkers will also read the uap-java pom and still consider it vulnerable.

<dependency>
	<groupId>com.github.ua-parser</groupId>
	<artifactId>uap-java</artifactId>
	<exclusions>
		<exclusion>
			<groupId>org.yaml</groupId>
			<artifactId>snakeyaml</artifactId>
		</exclusion>
	</exclusions>
</dependency>
<dependency>
	<groupId>org.yaml</groupId>
	<artifactId>snakeyaml</artifactId>
	<version>2.0</version>
</dependency>

[jmini]

The only concern might be a performance benchmark between the old and the new version.

About performance:
We are now using a SnakeYaml free version since months now.
The yaml is converted to Java code at build time.
See #83 (comment)

[dcolazin]

About performance: We are now using a SnakeYaml free version since months now. The yaml is converted to Java code at build time. See #83 (comment)

It would be great to have a bump fix or a radical fix like yours in an official release.

@bpossolo could you check this issue?

[bpossolo]

snakeyml has been updated to 2.2 and is included in uap-java release 1.6.0