JUnit version used is flagged as having a CVE

[alangdundee]

It may be a recent addition to mvnrepository (don't recall seeing previously) but projects with CVEs in their dependencies are being flagged and highlighted as having vulnerabilities, albeit not prominently if it is in a dependency.

https://mvnrepository.com/artifact/org.pitest/pitest/1.9.5

You can see info on the CVE here: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15250 and it appears bumping JUnit to 4.13.1 would mitigate it.

[hcoles]

Thanks @alangdundee, this was a bit of a phantom issue as pitest sets junit to provided, so it is the end project that determines the version used rather than pitest. Fix merged in now, will be in the next release.