Skip to content

Commit d46ded5

Browse files
Jan-MJan-M
authored
Merge pull request #108 from chanakadkb/fix-cves-and-dependency-issues
Fix vulnerability issues by upgrading/replacing some dependencies and upgrading java version to 21
2 parents 822ae09 + 88abac0 commit d46ded5

File tree

15 files changed

+63
-97
lines changed

15 files changed

+63
-97
lines changed

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,11 @@ jobs:
3939

4040
steps:
4141
- name: Checkout repository
42-
uses: actions/checkout@v2
42+
uses: actions/checkout@v3
4343

4444
# Initializes the CodeQL tools for scanning.
4545
- name: Initialize CodeQL
46-
uses: github/codeql-action/init@v1
46+
uses: github/codeql-action/init@v3
4747
with:
4848
languages: ${{ matrix.language }}
4949
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -54,7 +54,7 @@ jobs:
5454
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
5555
# If this step fails, then you should remove it and run the build manually (see below)
5656
- name: Autobuild
57-
uses: github/codeql-action/autobuild@v1
57+
uses: github/codeql-action/autobuild@v3
5858

5959
# ℹ️ Command-line programs to run using the OS shell.
6060
# 📚 https://git.io/JvXDl
@@ -68,4 +68,4 @@ jobs:
6868
# make release
6969

7070
- name: Perform CodeQL Analysis
71-
uses: github/codeql-action/analyze@v1
71+
uses: github/codeql-action/analyze@v3

‎.github/workflows/workflow.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515

1616
services:
1717
postgres:
18-
image: postgres:13
18+
image: postgres:17
1919
env:
2020
POSTGRES_PASSWORD: postgres
2121
# Set health checks to wait until postgres has started
@@ -28,13 +28,14 @@ jobs:
2828
- 5432:5432
2929

3030
steps:
31-
- uses: actions/checkout@v2
31+
- uses: actions/checkout@v4
3232
- name: Set up JDK
33-
uses: actions/setup-java@v1
33+
uses: actions/setup-java@v4
3434
with:
35-
java-version: 8
35+
distribution: 'temurin'
36+
java-version: '17'
3637
- name: Cache local Maven repository
37-
uses: actions/cache@v2
38+
uses: actions/cache@v4
3839
with:
3940
path: ~/.m2/repository
4041
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

‎.zappr.yaml‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,12 @@
11
approvals:
2-
pattern: "^(:\\+1:|👍|\\+1|:thumbsup:|[Ll][Gg][Tt][Mm])$"
3-
minimum: 1
4-
from:
5-
orgs:
6-
- zalando
7-
- zalando-stups
8-
collaborators: true
2+
groups:
3+
zalando:
4+
minimum: 1
5+
from:
6+
orgs:
7+
- "zalando"
8+
- "zalando-stups"
9+
X-Zalando-Type: code
10+
X-Zalando-Team: acid
11+
12+

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,7 @@ EXPORT global.value.transformer.search.namespace="my.package;another.package;thi
145145
Prerequisites
146146
-------------
147147

148-
* Java 11
148+
* Java 17
149149
* To compile, one should use [Maven](http://maven.apache.org/) 3.0.0 or above
150150

151151
Dependencies

‎cve-suppressions.xml‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎docker-compose.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
version: '3'
22
services:
33
db:
4-
image: 'postgres:13'
4+
image: 'postgres:17'
55
environment:
66
POSTGRES_PASSWORD: 'postgres'
77
ports:

‎pom.xml‎

Lines changed: 19 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<groupId>org.zalando</groupId>
88
<artifactId>zalando-sprocwrapper</artifactId>
9-
<version>3.2.2-SNAPSHOT</version>
9+
<version>4.0.0-SNAPSHOT</version>
1010

1111
<name>Stored Procedure Wrapper</name>
1212
<description>Library to make PostgreSQL stored procedures available through simple Java "*SProcService" interfaces
@@ -59,11 +59,10 @@
5959

6060
<properties>
6161
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
62-
<maven.compiler.source>8</maven.compiler.source>
63-
<maven.compiler.target>8</maven.compiler.target>
64-
<spring.version>5.3.23</spring.version>
65-
<postgresql.version>42.5.1</postgresql.version>
66-
<dependency-check-maven.version>7.2.1</dependency-check-maven.version>
62+
<maven.compiler.source>17</maven.compiler.source>
63+
<maven.compiler.target>17</maven.compiler.target>
64+
<spring.version>6.2.0</spring.version>
65+
<postgresql.version>42.7.4</postgresql.version>
6766
</properties>
6867

6968
<dependencies>
@@ -83,31 +82,21 @@
8382
<version>${postgresql.version}</version>
8483
</dependency>
8584
<dependency>
86-
<groupId>commons-lang</groupId>
87-
<artifactId>commons-lang</artifactId>
88-
<version>2.6</version>
89-
</dependency>
90-
<dependency>
91-
<groupId>commons-beanutils</groupId>
92-
<artifactId>commons-beanutils</artifactId>
93-
<version>1.9.4</version>
94-
<exclusions>
95-
<exclusion>
96-
<groupId>commons-logging</groupId>
97-
<artifactId>commons-logging</artifactId>
98-
</exclusion>
99-
</exclusions>
85+
<groupId>org.apache.commons</groupId>
86+
<artifactId>commons-lang3</artifactId>
87+
<version>3.17.0</version>
10088
</dependency>
10189
<dependency>
10290
<groupId>org.hibernate.validator</groupId>
10391
<artifactId>hibernate-validator</artifactId>
104-
<version>6.1.5.Final</version>
92+
<version>9.0.0.Beta3</version>
10593
</dependency>
10694
<dependency>
10795
<groupId>org.glassfish</groupId>
108-
<artifactId>javax.el</artifactId>
109-
<version>3.0.1-b08</version>
96+
<artifactId>jakarta.el</artifactId>
97+
<version>5.0.0-M1</version>
11098
</dependency>
99+
111100
<dependency>
112101
<groupId>org.reflections</groupId>
113102
<artifactId>reflections</artifactId>
@@ -117,7 +106,7 @@
117106
<dependency>
118107
<groupId>com.google.guava</groupId>
119108
<artifactId>guava</artifactId>
120-
<version>30.1-jre</version>
109+
<version>33.3.1-jre</version>
121110
</dependency>
122111
<dependency>
123112
<groupId>javax.persistence</groupId>
@@ -143,6 +132,11 @@
143132
<version>${spring.version}</version>
144133
<scope>test</scope>
145134
</dependency>
135+
<dependency>
136+
<groupId>org.springframework</groupId>
137+
<artifactId>spring-beans</artifactId>
138+
<version>${spring.version}</version>
139+
</dependency>
146140
<dependency>
147141
<groupId>org.springframework</groupId>
148142
<artifactId>spring-test</artifactId>
@@ -197,24 +191,6 @@
197191
</execution>
198192
</executions>
199193
</plugin>
200-
<plugin>
201-
<groupId>org.owasp</groupId>
202-
<artifactId>dependency-check-maven</artifactId>
203-
<version>${dependency-check-maven.version}</version>
204-
<executions>
205-
<execution>
206-
<goals>
207-
<goal>check</goal>
208-
</goals>
209-
</execution>
210-
</executions>
211-
<configuration>
212-
<failBuildOnAnyVulnerability>true</failBuildOnAnyVulnerability>
213-
<suppressionFiles>
214-
<suppressionFile>cve-suppressions.xml</suppressionFile>
215-
</suppressionFiles>
216-
</configuration>
217-
</plugin>
218194
<plugin>
219195
<groupId>org.basepom.maven</groupId>
220196
<artifactId>duplicate-finder-maven-plugin</artifactId>
@@ -272,7 +248,7 @@
272248
<plugin>
273249
<groupId>org.jacoco</groupId>
274250
<artifactId>jacoco-maven-plugin</artifactId>
275-
<version>0.8.4</version>
251+
<version>0.8.12</version>
276252
<executions>
277253
<execution>
278254
<id>prepare-agent</id>

‎src/main/java/org/zalando/sprocwrapper/dsprovider/BitmapShardDataSourceProvider.java‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
import com.google.common.base.Strings;
44
import com.google.common.collect.Lists;
55
import com.google.common.collect.Sets;
6-
import org.apache.commons.beanutils.BeanUtils;
6+
import org.springframework.beans.BeanWrapperImpl;
77
import org.slf4j.Logger;
88
import org.slf4j.LoggerFactory;
99

@@ -89,18 +89,19 @@ public BitmapShardDataSourceProvider(final Class<? extends DataSource> dataSourc
8989

9090
for (final Entry<String, String> entry : connectionUrls.entrySet()) {
9191
final DataSource ds = dataSourceClass.getDeclaredConstructor().newInstance();
92+
var dsBeanWrapper = new BeanWrapperImpl(ds);
9293
for (final Entry<String, String> prop : commonDataSourceProperties.entrySet()) {
93-
BeanUtils.setProperty(ds, prop.getKey(), prop.getValue());
94+
dsBeanWrapper.setPropertyValue(prop.getKey(), prop.getValue());
9495
}
9596

9697
final String[] parts = entry.getValue().split("\\|");
9798

98-
BeanUtils.setProperty(ds, "jdbcUrl", parts[0]);
99+
dsBeanWrapper.setPropertyValue("jdbcUrl", parts[0]);
99100

100101
if (parts.length > 1) {
101102

102103
// a little bit hacky, because "initSQL" is boneCP-specific
103-
BeanUtils.setProperty(ds, "initSQL", parts[1]);
104+
dsBeanWrapper.setPropertyValue("initSQL", parts[1]);
104105
}
105106

106107
for (int i = 0; i < dataSources.length; i++) {

‎src/main/java/org/zalando/sprocwrapper/proxy/executors/ValidationExecutorWrapper.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@
66
import org.slf4j.LoggerFactory;
77

88
import javax.sql.DataSource;
9-
import javax.validation.ConstraintViolation;
10-
import javax.validation.ConstraintViolationException;
11-
import javax.validation.Validation;
12-
import javax.validation.Validator;
13-
import javax.validation.ValidatorFactory;
9+
import jakarta.validation.ConstraintViolation;
10+
import jakarta.validation.ConstraintViolationException;
11+
import jakarta.validation.Validation;
12+
import jakarta.validation.Validator;
13+
import jakarta.validation.ValidatorFactory;
1414
import java.util.Set;
1515

1616
/**

‎src/main/java/org/zalando/sprocwrapper/util/NameUtils.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
import java.util.Locale;
66

7-
import static org.apache.commons.lang.StringUtils.splitByCharacterTypeCamelCase;
7+
import static org.apache.commons.lang3.StringUtils.splitByCharacterTypeCamelCase;
88

99
/**
1010
* Static utility methods for naming conventions.

0 commit comments

Comments
 (0)