fix: mitigate some CVE's in dependencies.

eclipse-tractusx · Apr 25, 2024 · 3290298 · 3290298
1 parent 7120f2e
commit 3290298
Show file tree

Hide file tree

Showing 3 changed files with 36 additions and 9 deletions.
diff --git a/agent-plane/agent-plane-protocol/pom.xml b/agent-plane/agent-plane-protocol/pom.xml
@@ -384,12 +384,45 @@
             <version>${netty.nio.core-http2.version}</version>
         </dependency>
 
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-resolver-dns</artifactId>
+            <version>${netty.nio.core-http2.version}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-handler-proxy</artifactId>
+            <version>${netty.nio.core-http2.version}</version>
+        </dependency>
+
+        <dependency>
+           <groupId>io.netty</groupId>
+            <artifactId>netty-resolver-dns-native-macos</artifactId>
+            <version>${netty.nio.core-http2.version}</version>
+            <classifier>osx-x86_64</classifier>
+        </dependency>
+
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-transport-native-kqueue</artifactId>
+            <version>${netty.nio.core-http2.version}</version>
+            <classifier>osx-x86_64</classifier>
+        </dependency>
+
+
         <dependency>
             <groupId>io.netty</groupId>
             <artifactId>netty-handler</artifactId>
             <version>${netty.nio.core-http2.version}</version>
         </dependency>
 
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-transport-classes-epoll</artifactId>
+            <version>${netty.nio.core-http2.version}</version>
+        </dependency>
+
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-compress</artifactId>

diff --git a/agent-plane/agentplane-azure-vault/pom.xml b/agent-plane/agentplane-azure-vault/pom.xml
@@ -163,12 +163,6 @@
             </exclusions>
         </dependency>
 
-        <!--<dependency>
-            <groupId>com.fasterxml.jackson.datatype</groupId>
-            <artifactId>jackson-datatype-jsr310</artifactId>
-            <version>${jackson.version}</version>
-        </dependency>-->
-
         <dependency>
             <groupId>org.yaml</groupId>
             <artifactId>snakeyaml</artifactId>

diff --git a/pom.xml b/pom.xml
@@ -59,10 +59,10 @@
         <org.reactivestreams.version>1.0.4</org.reactivestreams.version>
         <jetbrains.kotlin.version>1.9.10</jetbrains.kotlin.version>
         <io.micrometer.version>1.12.5</io.micrometer.version>
-        <netty.nio.core-http2.version>4.1.101.Final</netty.nio.core-http2.version>
-        <commons.compress.version>1.24.0</commons.compress.version>
+        <netty.nio.core-http2.version>4.1.108.Final</netty.nio.core-http2.version>
+        <commons.compress.version>1.26.0</commons.compress.version>
         <jetty.version>11.0.20</jetty.version>
-        <reactor.netty.version>1.0.40</reactor.netty.version>
+        <reactor.netty.version>1.0.44</reactor.netty.version>
         <awssdk.version>2.24.10</awssdk.version>
 
         <!-- Source characteristics -->