Upgrade com.esotericsoftware:kryo-shaded:jar:4.0.2 to avoid security risk

[zhudaxi]

In currently latest version of twitter::chill, kryo-shaded 4.0.2 is used, which has security vulnerability BDSA-2016-1151: Allows DoS via Java Serialization API. And this security risk is fixed in kryo 5.3.0.
Is this possible to upgrade using the higher version kryo?

[rogern]

+1

[chiavennasca]

Any updates here? This is showing up in our static analysis security scans.

[johnynek]

a PR was begun but abandoned:

#514

PRs are accepted and if the CI can be made green we merge. Unfortunately, this basically a community effort at this time, and my role (note: I left Twitter 7 years ago) is to contribute some time reviewing.