`jsoup` needs to be updated btw. <github.com/advis...

# dokka

[Edoardo Luppi]

jsoup needs to be updated btw. github.com/advisories/GHSA-pmhh-3w7g-xqp8

[Oleg Yukhnevich]

Thanks! I will take a look at it!
We do use a pretty old version though... Hope there were no big changes there.

[Edoardo Luppi]

In the meantime I'm attempting to override it with a constraint, but well, not going as planned, at least for a Dokka dependency declared in buildSrc

[Oleg Yukhnevich]

So, we previously had similar problems with Jackson, and here are my recommendations for enforcing newer versions there.
• github.com/Kotlin/dokka/issues/3472#… - uses resolutionStrategy
• github.com/Kotlin/dokka/issues/3194#… - uses BOM, not sure if jsoup has one
Hope this helps you!

[Oleg Yukhnevich]

Note that jsoup is used only during Dokka execution, and should not be used in the Dokka Gradle Plugin, so you need only to enforce it for dokka* configurations.

[Edoardo Luppi]

Perfect, I'll give this a go. The vulnerability policies we have now are extremely strict, so anything the scanner finds must be remediated.

[Oleg Yukhnevich]

Or, you might also just add dependency on newer version of jsoup into dokkaPlugin configuration:

dependencies {
  dokkaPlugin("org.jsoup:jsoup:XXX")
}

it might also work as intended

[Edoardo Luppi]

Probably the configurations approach is better, I don't want to pollute all the modules.

[Oleg Yukhnevich]

This is the configuration used to resolve plugins and their dependencies, so hopefully Gradle is smart enough to select the correct version here.

[Oleg Yukhnevich]

> Probably the configurations approach is better, I don't want to pollute all the modules.
But you need this configuration in all projects (with Dokka) anyway (as stated in #3194), because dependencies are resolved per subproject during Dokka execution.
If you have a dokka convention plugin (which I hope you have), you can put it there.

[Edoardo Luppi]

If you have a dokka convention plugin

I have a Plugin under buildSrc, not a convention one : (

[Oleg Yukhnevich]

That's also fine!
You can use the same approach there with dependencies:

project.dependencies.add("dokkaPlugin", "org.jsoup:jsoup:XXX")

[Edoardo Luppi]

So basically:

project.apply<DokkaPlugin>()
project.dependencies.add("dokkaPlugin", "org.jsoup:jsoup:1.23.1")

Seems like it is working. I'll see whether Mend still reports it.

[Oleg Yukhnevich]

yeah, like this! 🤞