-
Notifications
You must be signed in to change notification settings - Fork 41
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[MOSIP-37071] updating vulnerable libraries #127
base: develop
Are you sure you want to change the base?
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-8309135 - https://snyk.io/vuln/SNYK-JAVA-ORGBITBUCKETBC-6139942 - https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-6457293 - https://snyk.io/vuln/SNYK-JAVA-COMNIMBUSDS-6247633 - https://snyk.io/vuln/SNYK-JAVA-ORGBITBUCKETBC-5488281 - https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-6444790 - https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-7687447 - https://snyk.io/vuln/SNYK-JAVA-ORGBITBUCKETBC-6036303 - https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-6597980 - https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-8230364 - https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-8230365 - https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-8230366 Signed-off-by: rajapandi.m <[email protected]>
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-8309135 - https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORKSECURITY-6457293 - https://snyk.io/vuln/SNYK-JAVA-COMNIMBUSDS-6247633 - https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-32236 - https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-1015415 - https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-6597980 - https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-5710356 Signed-off-by: rajapandi.m <[email protected]>
d99d75f
to
4192a7a
Compare
<jose4j.version>0.6.5</jose4j.version> | ||
<jose4j.version>0.9.4</jose4j.version> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
https://deps.dev/maven/org.bitbucket.b_c%3Ajose4j/0.7.6/compare?v2=0.9.6
TODO: Analysis required if this is even used.
<commons.validator.version>1.7</commons.validator.version> | ||
<google.guava.version>18.0</google.guava.version> | ||
<google.guava.version>32.0.0-android</google.guava.version> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
<google.guava.version>32.0.0-android</google.guava.version> | |
<google.guava.version>32.0.0-jre</google.guava.version> |
https://deps.dev/maven/com.google.guava%3Aguava/18.0/compare?v2=32.0.0-jre
We are using a really old version of guava, we should upgrade but at the same time evaluate iff anything is breaks or conflicts within other MOSIP components due to other usage of Google Guava.
<springdoc-openapi-webmvc-ui-version>2.5.0</springdoc-openapi-webmvc-ui-version> | ||
<springdoc-openapi-webmvc-ui-version>2.6.0</springdoc-openapi-webmvc-ui-version> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is unused at the moment among other dependencies, we'll clean it up as a separate PR.
$ mvn dependency:analyze
...
[WARNING] Used undeclared dependencies found:
[WARNING] org.springframework:spring-context:jar:6.1.4:compile
[WARNING] org.springframework:spring-core:jar:6.1.4:compile
[WARNING] org.springframework.data:spring-data-redis:jar:3.2.3:compile
[WARNING] org.springframework.boot:spring-boot-autoconfigure:jar:3.2.3:compile
[WARNING] junit:junit:jar:4.13.2:compile
[WARNING] org.springframework.security:spring-security-core:jar:6.2.2:compile
[WARNING] org.springframework:spring-beans:jar:6.1.4:compile
[WARNING] org.springframework:spring-webmvc:jar:6.1.4:compile
[WARNING] com.fasterxml.jackson.core:jackson-annotations:jar:2.15.4:compile
[WARNING] org.slf4j:slf4j-api:jar:2.0.12:compile
[WARNING] com.nimbusds:nimbus-jose-jwt:jar:9.24.4:compile
[WARNING] jakarta.validation:jakarta.validation-api:jar:3.0.2:compile
[WARNING] org.springframework.security:spring-security-web:jar:6.2.2:compile
[WARNING] Unused declared dependencies found:
[WARNING] org.springdoc:springdoc-openapi-starter-webmvc-ui:jar:2.5.0:compile
[WARNING] com.h2database:h2:jar:2.2.224:test
[WARNING] org.springframework.boot:spring-boot-starter-data-redis:jar:3.2.3:compile
[WARNING] org.springframework.boot:spring-boot-starter-cache:jar:3.2.3:compile
[WARNING] org.apache.velocity:velocity:jar:1.7:compile
[WARNING] org.apache.velocity.tools:velocity-tools-generic:jar:3.1:compile
[WARNING] org.springframework.boot:spring-boot-starter-data-jpa:jar:3.2.3:compile
[WARNING] org.springframework.boot:spring-boot-test:jar:3.2.3:test
[WARNING] org.springframework.boot:spring-boot-starter-validation:jar:3.2.3:compile
[WARNING] org.springframework.boot:spring-boot-starter-oauth2-resource-server:jar:3.2.3:compile
[WARNING] org.bitbucket.b_c:jose4j:jar:0.6.5:compile
[WARNING] org.projectlombok:lombok:jar:1.18.30:compile
[WARNING] com.vaadin.external.google:android-json:jar:0.0.20131108.vaadin1:compile
[WARNING] org.junit.vintage:junit-vintage-engine:jar:5.10.2:compile
[WARNING] Non-test scoped test only dependencies found:
[WARNING] junit:junit:jar:4.13.2:compile
No description provided.