Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Chore/tracefoxx xxx fix high dependency vulnerability #831

Merged
merged 6 commits into from
Dec 8, 2023
Merged

Chore/tracefoxx xxx fix high dependency vulnerability #831

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b6a366c
chore: TRACEFOSS-XXX override ch.qos.logback dependencies with no vul…
ds-lcapellino Dec 8, 2023
8811ad1
chore: TRACEFOSS-XXX update Springboot version to fix high vulnerability
ds-lcapellino Dec 8, 2023
c98c890
chore: TRACEFOSS-XXX update Springcore version to fix high vulnerability
ds-lcapellino Dec 8, 2023
a6298ad
chore: TRACEFOSS-XXX update tomcat-embed-core version to fix high vul…
ds-lcapellino Dec 8, 2023
233392d
chore: TRACEFOSS-XXX update tomcat-embed-core version to fix high vul…
ds-lcapellino Dec 8, 2023
632e664
chore: TRACEFOSS-XXX update CHANGELOG.md
ds-lcapellino Dec 8, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,10 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
- Parts autocomplete API now is case insensitive when using "startWith" parameter
- changed mapping for manufacturerName when syncing assets_as_planned so it is being resolved when assets are resolved
- Behaviour of auto complete toggle selections
- Updated springboot version from 3.1.3 to 3.1.6
- updated spring core version from 6.0.13 to 6.0.14
- Update tomcat-embed-websocket from 10.0.15 to 10.0.16
- Update logback-classic and logback-core version to 1.4.14 to mitigate high finding

### Removed
- removed asset filters ( qualityInvestigationIdsInStatusActive, qualityInvestigationIdsInStatusActive )
Expand Down
4 changes: 2 additions & 2 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,8 @@ SPDX-License-Identifier: Apache-2.0
</modules>

<properties>
<springboot.version>3.1.3</springboot.version>
<spring-core.version>6.0.13</spring-core.version>
<springboot.version>3.1.6</springboot.version>
<spring-core.version>6.0.14</spring-core.version>
<spring-security-config.version>6.1.3</spring-security-config.version>
<java.version>17</java.version>
<maven.compiler.source>${java.version}</maven.compiler.source>
Expand Down
30 changes: 18 additions & 12 deletions tx-backend/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,9 +50,8 @@ SPDX-License-Identifier: Apache-2.0
<!-- https://mvnrepository.com/artifact/org.eclipse.jetty.websocket/websocket-parent -->



<dependencies>
<!-- IRS Client for decentral registry approach -->
<!-- IRS Client for decentral registry approach -->
<dependency>
<groupId>org.eclipse.tractusx.irs</groupId>
<artifactId>irs-registry-client</artifactId>
Expand All @@ -63,6 +62,10 @@ SPDX-License-Identifier: Apache-2.0
<groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-http</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-websocket</artifactId>
</exclusion>
</exclusions>
</dependency>

Expand Down Expand Up @@ -186,25 +189,16 @@ SPDX-License-Identifier: Apache-2.0
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
<exclusions>
<exclusion>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-core</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-websocket</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-core</artifactId>
<version>10.1.15</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-websocket</artifactId>
<version>10.1.15</version>
<version>10.1.16</version>
</dependency>
<dependency>
<groupId>org.springframework.cloud</groupId>
Expand Down Expand Up @@ -436,6 +430,18 @@ SPDX-License-Identifier: Apache-2.0
<version>1.1.0</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<version>1.4.14</version>
</dependency>
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-core</artifactId>
<version>1.4.14</version>
</dependency>


</dependencies>

<pluginRepositories>
Expand Down
30 changes: 12 additions & 18 deletions tx-models/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,26 +53,8 @@ SPDX-License-Identifier: Apache-2.0
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
<exclusions>
<exclusion>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-core</artifactId>
</exclusion>
<exclusion>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-websocket</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-core</artifactId>
<version>10.1.15</version>
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-websocket</artifactId>
<version>10.1.15</version>
</dependency>

<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
Expand All @@ -90,6 +72,18 @@ SPDX-License-Identifier: Apache-2.0
<version>${springdoc.version}</version>
</dependency>


<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<version>1.4.14</version>
</dependency>
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-core</artifactId>
<version>1.4.14</version>
</dependency>

</dependencies>
</project>