[Snyk] Security upgrade com.github.tomakehurst:wiremock from 1.58 to 3.0.0#26

Open

KoukiHama wants to merge 44 commits intomainfrom

snyk-fix-848fa14008c7ac5824f4d79792ec7b6e

KoukiHama commented Jul 27, 2024

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

backend/src/src-vmcomponents/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Denial of Service (DoS) SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538	721	com.github.tomakehurst:wiremock: `1.58` -> `3.0.0` `Major version upgrade` `No Known Exploit`

Important

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)

heliocastro added 30 commits

May 30, 2024 15:51


          refactor(project): Remove liferay frontend

4743d31

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(java): Move to Java 17

86bbd27

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(project): Adjust dependencies for Java 17 and Liferay removal

0e69da3

- Thrift updated to version 2020s compatible with Java 17+
- Set the default Tomcat base to be used now
- Removed Liferay and Java version specifics

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(project): Remove flatten maven plugin

425da38

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(project): Remove log4j-osgi-support

6839d36

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(project): Remove liferay properties

819c2c5

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(project): Remove unused Jenkins build files

0ed5a12

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(datahandler): Update for modern thrift and Java 17

8d02ed2

- Change Thrift code to use httpclient5
- Remove OSGI bn

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          fix(deps): Remove duplicate json dependency version

5e046ea

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(thirdparty): Remove old couchdb-lucene

7e5c60e

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(scripts): Set default to newer Thrift

876945b

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(project): Move enforcer plugin to proper location

aff9aff

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(linter): Remove spotless as not used

c073cd6

Spotless was a good idea, but never been properly used or implemented.
The solution should be revisited as the new codebase is active.

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(project): Remove jacoco maven plugin

bb385fa

Data of code coverage is not used all and should be better represented
on the next codebase.

Related to discussion on eclipse-sw360#2452

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(project): Remove unused buildnumber maven plugin

c626191

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(project): Remove unused versions maven plugin

1e1bc29

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(frontend): Remove frontend references

681ab69

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(libraries): Remove OSGI bundle from CommonIO

f0ee317

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(libraries): Remove OSGI bundle from exporters

3d54efb

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(libraries): Remove OSGI bundle from importers

9979a85

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(project): Remove OSGI bundle plugin

3083c2d

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(project): Start transition to Jakarta API

3e69647

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(project): Add maven-git-versioning extension

9e13651

Ref: https://github.com/qoomon/maven-git-versioning-extension

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(docker): Initial docker refactor with Tomcat only

4b891be

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          chore(vscode): Improve Java buildsystem handling

4f79c63

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(rest): Make old authorization-server compile

8d32e8f

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(workflows): Build new codebase

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          feat(docker): Add couchdb-test properties

c80ddfc

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(project): Remove pontual build references on Liferay

d8cabf8

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(readme): Remove some liferay references

fa9c857

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>

dependabot bot and others added 14 commits

May 30, 2024 20:23


          build(deps): bump org.apache.commons:commons-compress

b523c6e

Bumps org.apache.commons:commons-compress from 1.21 to 1.26.0.

---
updated-dependencies:
- dependency-name: org.apache.commons:commons-compress
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>


          feat(workflow): Upload test results in case of failure

330c1be

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          fix(tests): Make partial importer tests pass

88b0c05

- Refactored exceptions

- Commented testImportOnEmptyDb, void testImportTwiceWithOnlyAPart,
testImportTwiceIsANoOp as need to be refactored

- Add Siemens no-liferay branch fixes

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(project): Disable client library temporary

4e2377f

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(couchdb): Remove old lucene patch

d168113

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          refactor(docker): Enable new codebase

21e31e5

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          fix(tests): Fix codebase to match springboot series 2.x

5c272bb

- Upgrade to latest series 2.x springboot release
- Revert the rest functionality to javax required by the current
  codebase

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          fix(project): Normalize version and deploy properties

9012a62

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          fix(project): Adjust version to match maven requirements

c1c5307

Version is set now by git versioning plugin, but maven requires a static
defined entry to validate builds. Fixed on 18.99.0 as mark for post 18
development.

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          fix(project): Adjust to use properties in main pom.xml

30851ec

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          fix(tests): Update to Java 17 compatible libraries

01ecf1f

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          fix(tests): Temporary disable client tests

7f3241a

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          chore(project): Ignore/exclude git-versioned

30b714f

Signed-off-by: Helio Chissini de Castro <heliocastro@gmail.com>


          fix: backend/src/src-vmcomponents/pom.xml to reduce vulnerabilities

4c02547

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538

hoangnt2 force-pushed the main branch from 30b714f to 308ce54 Compare

August 6, 2024 03:41

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet