[FIXED] Is it safe to use artifact that has vulnerability on test dependency?

Issue

I'm trying to use artifact that is on mvnrepository

https://mvnrepository.com/artifact/org.apache.commons/commons-collections4/4.4

As you can see [test dependencies], JUnit 4.12 has a vulnerability and has red warning sign.

I've downloaded this artifact via Gradle and inspected the external library. I found that pom.xml on commons-collections4 has test dependency for JUnit 4.12 actually.

Is it safe to use an artifact that has vulnerability on test dependency?

Solution

1. you see "red warning sign" just because commons-collections exposes to much information about their build process when publishing artifacts
2. it is not a good idea to check dependencies manually, OWASP developed a nice plugin for both gradle and maven - do not waste your time on manual checks

Answered By - Andrey B. Panfilov
Answer Checked By - Marie Seifert (JavaFixing Admin)