Possible vulnerability in Jcommander version 1.35

[JosuaCarl]

Importing testImplementation "io.nextflow:nextflow:24.10.5" results in the following warning from IntelliJ:

Dependency maven:com.beust:jcommander:1.35 is vulnerable

With the details:

WS-2019-0490, Score: 8.1
Inclusion of Functionality from Untrusted Control Sphere vulnerability found in jcommander before 1.75. jcommander resolving dependencies over HTTP instead of HTTPS.
Details

The following corresponding code is found currently in Nextflow:

nextflow/modules/nextflow/build.gradle

Line 40 in ac71280

api "com.beust:jcommander:1.35"

The suggested fix is a version bump to 1.75 as a safe version.

[pditommaso]

Provided We should look into solving this, unfortunately it's not an simple drop-in replacement since this that version brings some braking changes.

Worth also noting that's (was) a building time issue, not a run-time one.