Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

upgrade Spring Framework, Bouncy Castle, and Joda Time #801

Merged
merged 5 commits into from
Apr 16, 2024
Merged

upgrade Spring Framework, Bouncy Castle, and Joda Time #801

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
4b89d61
upgrade Spring Framework (6.1.6), Bouncy Castle (1.78), and Joda Time…
labkey-willm Apr 13, 2024
cf5e4cb
force jodaTimeVersion for cloud
labkey-willm Apr 13, 2024
a3c120f
bump springBootVersion to 3.2.4
labkey-willm Apr 14, 2024
ef3722b
suppress jodaTime warning on CVE-2024-23080
labkey-willm Apr 14, 2024
dc2bc7d
revert springBootVersion to 3.2.3, but force spring-web to use spring…
labkey-willm Apr 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -322,6 +322,9 @@ allprojects {
// Force snappy-java version for CVE-2023-43642. Remove once HTSJDK bumps its preferred version.
force "org.xerial.snappy:snappy-java:${snappyJavaVersion}"

// Force consistency for dependencies from cloud
force "joda-time:joda-time:${jodaTimeVersion}"

dependencySubstitution {
// Because the client api artifact name is not the same as the directory structure, we use
// Gradle's dependency substitution so the dependency will appear correctly in the pom files that
Expand Down
11 changes: 11 additions & 0 deletions dependencyCheckSuppression.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,5 +168,16 @@
<cpe>cpe:/a:apache:tomcat</cpe>
</suppress>

<!--
suppress CVE-2024-23080 after jodaTime upgrade to 2.12.7, as still detected as 2.12.5
-->
<suppress>
<notes><![CDATA[
file name: joda-time-2.12.7.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/joda\-time/joda\-time@.*$</packageUrl>
<vulnerabilityName>CVE-2024-23080</vulnerabilityName>
</suppress>

</suppressions>

8 changes: 4 additions & 4 deletions gradle.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,8 +114,8 @@ asmVersion=9.6
batikVersion=1.17

# sync with Tika version (or later)
bouncycastlePgpVersion=1.77
bouncycastleVersion=1.77
bouncycastlePgpVersion=1.78
bouncycastleVersion=1.78

cglibNodepVersion=2.2.3

Expand Down Expand Up @@ -214,7 +214,7 @@ jfreechartVersion=1.0.19

jmockVersion=2.6.0

jodaTimeVersion=2.8.1
jodaTimeVersion=2.12.7

# brought in transitively from guava and other google packages. Need to resolve consistently
jsr305Version=3.0.2
Expand Down Expand Up @@ -287,7 +287,7 @@ springBootVersion=3.2.3
# Also, keep this in sync with apacheTomcatVersion above
springBootTomcatVersion=10.1.19

springVersion=6.1.4
springVersion=6.1.6

sqliteJdbcVersion=3.45.1.0

Expand Down
7 changes: 6 additions & 1 deletion server/embedded/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,12 @@ dependencies {
implementation "org.springframework.boot:spring-boot-starter-actuator:${springBootVersion}"
implementation "org.springframework.boot:spring-boot-starter-validation:${springBootVersion}"
// implementation "org.springframework.boot:spring-boot-starter-log4j2:${springBootVersion}"

// Force to use latest springVersion for CVE-2024-22262
implementation('org.springframework:spring-web') {
version {
strictly "${springVersion}"
}
}
// Force to the latest Tomcat version until Spring Boot 2.7.17 is released and we can adopt it
implementation('org.apache.tomcat.embed:tomcat-embed-core') {
version {
Expand Down