Repository: google/closure-compiler (language: java)

Issue:
Unshaded jar contains bogus "/" entry
The unshaded jar contains a bogus "/" directory entry. While this isn't a problem for using it, it does cause trouble with [DependencyCheck's](https://github.com/jeremylong/DependencyCheck) archive analyzer which fails with the following error when it runs into it:

    Archive contains a file (/) that would be extracted outside of the target directory.


Discussion / hints:
Thanks for the report.

I doubt we'll get around to fixing this ourselves, but It looks like that's built by bazel defined here: https://github.com/google/closure-compiler/blob/master/BUILD.bazel#L39 in case anyone else wants to take a crack at fixing it.

Fix patch:
diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel
index 76937dfc0ba..db99a54a6f7 100644
--- a/WORKSPACE.bazel
+++ b/WORKSPACE.bazel
@@ -2,8 +2,8 @@ workspace(name = "com_google_javascript_jscomp")
 
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-RULES_JVM_EXTERNAL_TAG = "4.2"
-RULES_JVM_EXTERNAL_SHA = "cd1a77b7b02e8e008439ca76fd34f5b07aecb8c752961f9640dea15e9e5ba1ca"
+RULES_JVM_EXTERNAL_TAG = "4.5"
+RULES_JVM_EXTERNAL_SHA = "b17d7388feb9bfa7f2fa09031b32707df529f26c91ab9e5d909eb1676badd9a6"
 
 http_archive(
     name = "rules_jvm_external",


Test patch: