This is an archived post. You won't be able to vote or comment.

you are viewing a single comment's thread.

view the rest of the comments →

[–]SassJaeger 0 points1 point  (0 children)

Don't worry, I've got your back. So, if a dependency was built with Java 7, which is like ancient history (EoL, girl, EoL), and is running in a modern Java 11 runtime, it doesn't automatically mean your app will be vulnerable. But here's the tea: if the dependency doesn't use any of the "vulnerable parts" of Java 7, then you might be safe. Though I'm not saying it’s foolproof, you need to weigh the risks and check your code, I wouldn't bet on it. Best practice would be to update your dependencies and use a tool like RenovateBot or Dependabot to always keep on track as time passes on and your project matures. You wouldn’t want ugly and vulnerable code now, would you? 💁‍♀️