Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Chore/#463 update dependencies #860

Merged
merged 10 commits into from
Apr 10, 2024
Merged

Chore/#463 update dependencies #860

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
f6d1eeb
chore(deps):[#463] Bump io.minio:minio to 8.5.9
ds-jhartmann Apr 10, 2024
513b00b
chore(deps):[#463] Manually update org.apache.commons:commons-compres…
ds-jhartmann Apr 10, 2024
ae60c03
chore(deps):[#463] Update dependencies
ds-jhartmann Apr 10, 2024
0a24a51
chore(deps):[#463] Revert dependency update
ds-jhartmann Apr 10, 2024
736b8e6
chore(deps):[#463] Manually update nimbus-jose-jwt to fix CVE
ds-jhartmann Apr 10, 2024
d601490
chore(ci):[#463] Fix quality check scan issue
ds-jhartmann Apr 10, 2024
e55f33e
chore(workflows):[#463] Cleanup trivyignore
ds-jhartmann Apr 10, 2024
7f748b8
chore(workflows):[#463] Cleanup trivyignore
ds-jhartmann Apr 10, 2024
969dbaf
chore(workflows):[#463] Cleanup trivyignore
ds-jhartmann Apr 10, 2024
d4977cd
chore(workflows):[#463] Cleanup trivyignore
ds-jhartmann Apr 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 0 additions & 8 deletions .config/.trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +0,0 @@
# Only relevant if UNWRAP_SINGLE_VALUE_ARRAYS is activated, which is not the case here.
CVE-2022-42003

# HttpInvokerServiceExporter is not loaded as a bean in the IRS.
CVE-2016-1000027

# Vulnerability method not in IRS codebase (Files.createTempDir from guava). https://github.com/google/guava/issues/2575
CVE-2023-2976
65 changes: 36 additions & 29 deletions DEPENDENCIES
View file
Open in desktop

Large diffs are not rendered by default.

5 changes: 1 addition & 4 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,14 +51,11 @@ RUN --mount=type=cache,target=/root/.m2 mvn -B clean package -pl :$BUILD_TARGET
# Copy the jar and build image
FROM eclipse-temurin:17-jre-alpine AS irs-api

ARG UID=10000
ARG GID=3000

WORKDIR /app

COPY --chmod=755 --from=maven /build/irs-api/target/irs-api-*-exec.jar app.jar

USER ${UID}:${GID}
USER 10000:3000

ENTRYPOINT ["java", "-Djava.util.logging.config.file=./logging.properties", "-jar", "app.jar"]

Expand Down
14 changes: 10 additions & 4 deletions irs-api/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,10 +46,6 @@
<groupId>io.minio</groupId>
<artifactId>minio</artifactId>
</dependency>
<dependency>
<groupId>org.xerial.snappy</groupId>
<artifactId>snappy-java</artifactId>
</dependency>
<dependency>
<groupId>com.squareup.okhttp3</groupId>
<artifactId>okhttp</artifactId>
Expand Down Expand Up @@ -100,8 +96,18 @@
<artifactId>json-smart</artifactId>
<groupId>net.minidev</groupId>
</exclusion>
<exclusion>
<artifactId>nimbus-jose-jwt</artifactId>
<groupId>com.nimbusds</groupId>
</exclusion>
</exclusions>
</dependency>
<!-- Update nimbus-jose-jwt manually to avoid vulnerability CVE-2023-52428; can be removed after Spring updates their dependency -->
<dependency>
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
<version>9.37.3</version>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
Expand Down
4 changes: 0 additions & 4 deletions irs-common/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,10 +67,6 @@
<groupId>io.minio</groupId>
<artifactId>minio</artifactId>
</dependency>
<dependency>
<groupId>org.xerial.snappy</groupId>
<artifactId>snappy-java</artifactId>
</dependency>
<dependency>
<groupId>com.squareup.okio</groupId>
<artifactId>okio-jvm</artifactId>
Expand Down
4 changes: 0 additions & 4 deletions irs-policy-store/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,10 +38,6 @@
<groupId>io.minio</groupId>
<artifactId>minio</artifactId>
</dependency>
<dependency>
<groupId>org.xerial.snappy</groupId>
<artifactId>snappy-java</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
Expand Down
12 changes: 12 additions & 0 deletions irs-testing/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,18 @@
<dependency>
<groupId>org.testcontainers</groupId>
<artifactId>testcontainers</artifactId>
<exclusions>
<exclusion>
<artifactId>commons-compress</artifactId>
<groupId>org.apache.commons</groupId>
</exclusion>
</exclusions>
</dependency>
<!-- Update commons-compress manually to avoid vulnerability CVE-2024-26308, CVE-2024-25710; can be removed after testcontainers updates their dependency -->
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-compress</artifactId>
<version>${commons-compress.version}</version>
</dependency>
<dependency>
<groupId>org.testcontainers</groupId>
Expand Down
37 changes: 11 additions & 26 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,31 +80,31 @@
<springdoc.version>2.2.0</springdoc.version>
<micrometer.version>1.11.4</micrometer.version>
<datafaker.version>1.9.0</datafaker.version>
<json-unit-assertj.version>2.36.1</json-unit-assertj.version>
<json-unit-assertj.version>3.2.7</json-unit-assertj.version>
<gatling.version>3.9.5</gatling.version>
<resilience4j.version>2.1.0</resilience4j.version>
<minio.version>8.5.6</minio.version>
<minio.version>8.5.9</minio.version>
<rest-assured.version>5.4.0</rest-assured.version>
<awaitility.version>4.2.0</awaitility.version>
<jsonassert.version>1.5.1</jsonassert.version>
<junit-bom.version>5.9.2</junit-bom.version>
<cucumber-bom.version>7.11.1</cucumber-bom.version>
<snakeyaml.version>2.0</snakeyaml.version>
<commons-validator.version>1.7</commons-validator.version>
<swagger-annotations.version>2.2.16</swagger-annotations.version>
<commons-validator.version>1.8.0</commons-validator.version>
<swagger-annotations.version>2.2.18</swagger-annotations.version>
<edc.version>0.2.1</edc.version>
<okio-jvm.version>3.5.0</okio-jvm.version>
<bc-jdk18on.version>1.76</bc-jdk18on.version>
<wiremock-standalone.version>3.3.1</wiremock-standalone.version>
<jsoup.version>1.16.1</jsoup.version>
<wiremock-standalone.version>3.5.2</wiremock-standalone.version>
<jsoup.version>1.17.2</jsoup.version>
<jsonschemafriend.version>0.12.4</jsonschemafriend.version>
<commons-io.version>2.14.0</commons-io.version>
<commons-io.version>2.16.1</commons-io.version>
<commons-lang3.version>3.12.0</commons-lang3.version>
<okhttp.version>4.10.0</okhttp.version>
<okhttp.version>4.12.0</okhttp.version>
<jackson-databind.version>2.15.1</jackson-databind.version>
<junit-jupiter-engine.version>5.9.2</junit-jupiter-engine.version>
<json-smart.version>2.4.10</json-smart.version>
<testcontainers-bom.version>1.19.1</testcontainers-bom.version>
<json-smart.version>2.5.1</json-smart.version>
<testcontainers-bom.version>1.19.7</testcontainers-bom.version>

<!-- Plugins -->
<findsecbugs-plugin.version>1.12.0</findsecbugs-plugin.version>
Expand All @@ -123,6 +123,7 @@
<maven-gpg-plugin.version>3.1.0</maven-gpg-plugin.version>
<license-tool-plugin.version>1.1.0</license-tool-plugin.version>
<snappy-java.version>1.1.10.5</snappy-java.version>
<commons-compress.version>1.26.1</commons-compress.version>
</properties>

<dependencyManagement>
Expand All @@ -136,22 +137,6 @@
<groupId>io.minio</groupId>
<artifactId>minio</artifactId>
<version>${minio.version}</version>
<exclusions>
<exclusion>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk15on</artifactId>
</exclusion>
<exclusion>
<artifactId>snappy-java</artifactId>
<groupId>org.xerial.snappy</groupId>
</exclusion>
</exclusions>
</dependency>
<!-- Update snappy-java manually to avoid vulnerability CVE-2023-43642; can be removed after Minio updates their dependency -->
<dependency>
<groupId>org.xerial.snappy</groupId>
<artifactId>snappy-java</artifactId>
<version>${snappy-java.version}</version>
</dependency>
</dependencies>
</dependencyManagement>
Expand Down