Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On a recent call, a security lead walked us through two rules his team enforces on every build. Both are sensible. Together, they left his developers with a red pipeline and no version of a library they were allowed to use. The first rule is a cooldown. A new open source release cannot enter the build until it has been public for a set number of days. The second rule blocks any library version with a known high or critical vulnerability.

Jansi is the small Java package that makes colored console output work everywhere, including the Windows terminals that never understood ANSI escape codes. You may not have heard of it, but if you build Java, you almost certainly have it on disk: the Apache Maven 3.9.16 distribution puts jansi-2.4.3.jar in its lib/ directory, and Maven's pom.xml declares it as a dependency.

Apache Axis 1.x is a SOAP engine whose last release came out in 2006. Twenty years later deps.dev counts 384 packages that still depend on 1.4, 83 of them directly, and that single version carries five published advisories. The worst of them turns the client-side service factory into a remote code execution primitive (tracked as CVE-2023-40743, NVD CVSS 9.8, critical).