From 736b8e63e4805120858af84fd136880d9652f062 Mon Sep 17 00:00:00 2001 From: Jaro Hartmann Date: Wed, 10 Apr 2024 14:25:19 +0200 Subject: [PATCH] chore(deps):[#463] Manually update nimbus-jose-jwt to fix CVE --- DEPENDENCIES | 22 +++++++++++----------- irs-api/pom.xml | 10 ++++++++++ 2 files changed, 21 insertions(+), 11 deletions(-) diff --git a/DEPENDENCIES b/DEPENDENCIES index 4eafbb6309..8fd1e3d811 100644 --- a/DEPENDENCIES +++ b/DEPENDENCIES @@ -18,8 +18,8 @@ maven/mavencentral/com.fasterxml.jackson.core/jackson-core/2.16.1, Apache-2.0 AN maven/mavencentral/com.fasterxml.jackson.core/jackson-databind/2.15.1, Apache-2.0, approved, #7934 maven/mavencentral/com.fasterxml.jackson.core/jackson-databind/2.15.4, Apache-2.0, approved, #7934 maven/mavencentral/com.fasterxml.jackson.core/jackson-databind/2.16.1, Apache-2.0, approved, #11605 +maven/mavencentral/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml/2.15.1, Apache-2.0, approved, #8802 maven/mavencentral/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml/2.15.4, Apache-2.0, approved, #8802 -maven/mavencentral/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml/2.16.2, Apache-2.0, approved, #11855 maven/mavencentral/com.fasterxml.jackson.datatype/jackson-datatype-jakarta-jsonp/2.15.2, Apache-2.0, approved, #9179 maven/mavencentral/com.fasterxml.jackson.datatype/jackson-datatype-jakarta-jsonp/2.15.4, Apache-2.0, approved, #9179 maven/mavencentral/com.fasterxml.jackson.datatype/jackson-datatype-jdk8/2.15.4, Apache-2.0, approved, #8808 @@ -49,7 +49,7 @@ maven/mavencentral/com.ibm.icu/icu4j/74.2, , approved, #11936 maven/mavencentral/com.jayway.jsonpath/json-path/2.9.0, Apache-2.0, approved, clearlydefined maven/mavencentral/com.nimbusds/content-type/2.2, Apache-2.0, approved, clearlydefined maven/mavencentral/com.nimbusds/lang-tag/1.7, Apache-2.0, approved, clearlydefined -maven/mavencentral/com.nimbusds/nimbus-jose-jwt/9.24.4, Apache-2.0, approved, clearlydefined +maven/mavencentral/com.nimbusds/nimbus-jose-jwt/9.37.3, Apache-2.0, approved, #11701 maven/mavencentral/com.nimbusds/oauth2-oidc-sdk/9.43.3, Apache-2.0, approved, clearlydefined maven/mavencentral/com.softwaremill.quicklens/quicklens_2.13/1.9.3, Apache-2.0, approved, #9635 maven/mavencentral/com.squareup.okhttp3/okhttp-dnsoverhttps/4.10.0, Apache-2.0, approved, clearlydefined @@ -175,10 +175,10 @@ maven/mavencentral/io.rest-assured/rest-assured/5.4.0, Apache-2.0, approved, #12 maven/mavencentral/io.rest-assured/xml-path/5.3.2, Apache-2.0, approved, #9267 maven/mavencentral/io.rest-assured/xml-path/5.4.0, Apache-2.0, approved, #12038 maven/mavencentral/io.suzaku/boopickle_2.13/1.3.3, Apache-2.0, approved, clearlydefined -maven/mavencentral/io.swagger.core.v3/swagger-annotations-jakarta/2.2.21, Apache-2.0, approved, #5947 +maven/mavencentral/io.swagger.core.v3/swagger-annotations-jakarta/2.2.15, Apache-2.0, approved, #5947 maven/mavencentral/io.swagger.core.v3/swagger-annotations/2.2.18, Apache-2.0, approved, #11362 -maven/mavencentral/io.swagger.core.v3/swagger-core-jakarta/2.2.21, Apache-2.0, approved, #5929 -maven/mavencentral/io.swagger.core.v3/swagger-models-jakarta/2.2.21, Apache-2.0, approved, #5919 +maven/mavencentral/io.swagger.core.v3/swagger-core-jakarta/2.2.15, Apache-2.0, approved, #5929 +maven/mavencentral/io.swagger.core.v3/swagger-models-jakarta/2.2.15, Apache-2.0, approved, #5919 maven/mavencentral/jakarta.activation/jakarta.activation-api/2.1.3, EPL-2.0 OR BSD-3-Clause OR GPL-2.0-only with Classpath-exception-2.0, approved, ee4j.jaf maven/mavencentral/jakarta.annotation/jakarta.annotation-api/2.1.1, EPL-2.0 OR GPL-2.0-only with Classpath-exception-2.0, approved, ee4j.ca maven/mavencentral/jakarta.inject/jakarta.inject-api/2.0.1, Apache-2.0, approved, ee4j.cdi @@ -196,7 +196,7 @@ maven/mavencentral/net.bytebuddy/byte-buddy-agent/1.14.12, Apache-2.0, approved, maven/mavencentral/net.bytebuddy/byte-buddy-agent/1.14.4, Apache-2.0, approved, #7164 maven/mavencentral/net.bytebuddy/byte-buddy/1.12.21, Apache-2.0 AND BSD-3-Clause, approved, #1811 maven/mavencentral/net.bytebuddy/byte-buddy/1.14.12, Apache-2.0 AND BSD-3-Clause, approved, #7163 -maven/mavencentral/net.datafaker/datafaker/2.1.0, , restricted, clearlydefined +maven/mavencentral/net.datafaker/datafaker/1.9.0, Apache-2.0, approved, #8797 maven/mavencentral/net.debasishg/redisclient_2.13/3.42, Apache-2.0, approved, clearlydefined maven/mavencentral/net.java.dev.jna/jna/5.12.1, Apache-2.0 OR LGPL-2.1-or-later, approved, #3217 maven/mavencentral/net.java.dev.jna/jna/5.13.0, Apache-2.0 AND LGPL-2.1-or-later, approved, #6709 @@ -430,9 +430,9 @@ maven/mavencentral/org.simpleflatmapper/sfm-util/8.2.3, MIT, approved, clearlyde maven/mavencentral/org.skyscreamer/jsonassert/1.5.1, Apache-2.0, approved, clearlydefined maven/mavencentral/org.slf4j/jul-to-slf4j/2.0.12, MIT, approved, #7698 maven/mavencentral/org.slf4j/slf4j-api/2.0.12, MIT, approved, #5915 -maven/mavencentral/org.springdoc/springdoc-openapi-starter-common/2.5.0, , restricted, clearlydefined -maven/mavencentral/org.springdoc/springdoc-openapi-starter-webmvc-api/2.5.0, , restricted, clearlydefined -maven/mavencentral/org.springdoc/springdoc-openapi-starter-webmvc-ui/2.5.0, , restricted, clearlydefined +maven/mavencentral/org.springdoc/springdoc-openapi-starter-common/2.2.0, Apache-2.0, approved, clearlydefined +maven/mavencentral/org.springdoc/springdoc-openapi-starter-webmvc-api/2.2.0, Apache-2.0, approved, clearlydefined +maven/mavencentral/org.springdoc/springdoc-openapi-starter-webmvc-ui/2.2.0, Apache-2.0, approved, clearlydefined maven/mavencentral/org.springframework.boot/spring-boot-actuator-autoconfigure/3.1.10, Apache-2.0, approved, #9348 maven/mavencentral/org.springframework.boot/spring-boot-actuator/3.1.10, Apache-2.0, approved, #9342 maven/mavencentral/org.springframework.boot/spring-boot-autoconfigure/3.1.10, Apache-2.0, approved, #9341 @@ -477,8 +477,8 @@ maven/mavencentral/org.testcontainers/testcontainers/1.18.3, MIT, approved, #793 maven/mavencentral/org.testcontainers/testcontainers/1.19.7, Apache-2.0 AND MIT, approved, #10347 maven/mavencentral/org.typelevel/spire-macros_2.13/0.17.0, MIT, approved, clearlydefined maven/mavencentral/org.unbescape/unbescape/1.1.6.RELEASE, Apache-2.0, approved, CQ18904 -maven/mavencentral/org.webjars/swagger-ui/5.13.0, , restricted, clearlydefined -maven/mavencentral/org.wiremock/wiremock-standalone/3.5.2, , restricted, clearlydefined +maven/mavencentral/org.webjars/swagger-ui/5.2.0, Apache-2.0, approved, #10221 +maven/mavencentral/org.wiremock/wiremock-standalone/3.5.2, MIT AND Apache-2.0, approved, #14258 maven/mavencentral/org.xerial.snappy/snappy-java/1.1.10.5, Apache-2.0 AND (Apache-2.0 AND BSD-3-Clause), approved, #9098 maven/mavencentral/org.xmlunit/xmlunit-core/2.9.1, Apache-2.0, approved, #6272 maven/mavencentral/org.yaml/snakeyaml/1.33, Apache-2.0, approved, clearlydefined diff --git a/irs-api/pom.xml b/irs-api/pom.xml index 049bd3a511..f5fc91b2b0 100644 --- a/irs-api/pom.xml +++ b/irs-api/pom.xml @@ -96,8 +96,18 @@ json-smart net.minidev + + nimbus-jose-jwt + com.nimbusds + + + + com.nimbusds + nimbus-jose-jwt + 9.37.3 + org.springframework.boot spring-boot-starter-security