Exposed to vulnerabilities ? about tnm4j HOT 1 CLOSED

If you look at pom.xml you'll see that the CVEs you mention apply to libraries that are not required to use the library itself. One of the CVEs applies to JUnit which is used when running unit tests, the other is used when running the demos. Neither of them need to be on the runtime class path. If, in using the library, you want to use logback, you could use any later version, since Tnm4j integrates logging through slf4j rather than using logback directly.

That said, neither of these vulnerabilities is particularly difficult to fix (just version bumps to later versions). I just updated master to use a later version of the parent POM which should version bump those dependencies to versions that aren't vulnerable to those CVEs.

from tnm4j.