Updates for release v1.0.9

- Update java runtime libraries to address security vulnerabilities

Author: tabdunabi

CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 =======
 
+## [1.0.9] - 2024-05-16
+
+### Update
+
+- Updated java runtime libraries to patch vulnerabilities
+
 ## [1.0.8] - 2024-05-14
 
 ### Fixed

source/infrastructure/test/mock-lambda-func/java-lambda/pom.xml

@@ -36,16 +36,28 @@
             <groupId>software.amazon.awssdk</groupId>
             <artifactId>dynamodb</artifactId>
         </dependency>
+        <dependency>
+            <groupId>com.amazonaws</groupId>
+            <artifactId>aws-java-sdk-xray</artifactId>
+            <version>1.12.722</version>
+        </dependency>
         <dependency>
             <groupId>software.amazon.lambda</groupId>
             <artifactId>powertools-tracing</artifactId>
             <version>1.18.0</version>
+            <exclusions>
+                <!--  upgrading to new version of x-ray sdk to address ion-java CVE -->
+                <exclusion>
+                    <groupId>com.amazonaws</groupId>
+                    <artifactId>aws-java-sdk-xray</artifactId>
+                </exclusion>
+            </exclusions>      
         </dependency>
         <dependency>
             <groupId>software.amazon.lambda</groupId>
             <artifactId>powertools-metrics</artifactId>
             <version>1.18.0</version>
-        </dependency>
+        </dependency>     
         <dependency>
             <groupId>com.amazonaws</groupId>
             <artifactId>aws-lambda-java-core</artifactId>

source/lambda/layers/custom-java-sdk-config/pom.xml

@@ -38,10 +38,22 @@
         </dependencies>
     </dependencyManagement>
     <dependencies>
+        <dependency>
+            <groupId>com.amazonaws</groupId>
+            <artifactId>aws-java-sdk-xray</artifactId>
+            <version>1.12.722</version>
+        </dependency>
         <dependency>
             <groupId>software.amazon.lambda</groupId>
             <artifactId>powertools-tracing</artifactId>
             <version>1.18.0</version>
+            <exclusions>
+                <!--  upgrading to new version of x-ray sdk to address ion-java CVE -->
+                <exclusion>
+                    <groupId>com.amazonaws</groupId>
+                    <artifactId>aws-java-sdk-xray</artifactId>
+                </exclusion>
+            </exclusions>            
         </dependency>
         <dependency>
             <groupId>software.amazon.lambda</groupId>

source/ui/public/index.html

@@ -11,7 +11,7 @@
   <link rel="icon" href="%PUBLIC_URL%/favicon.png" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <meta name="theme-color" content="#000000" />
-  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; base-uri 'none'; upgrade-insecure-requests; img-src 'self' data: http://*.cloudfront.net https://*.amazonaws.com; script-src 'self' http://*.cloudfront.net https://*.amazonaws.com;
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; base-uri 'none'; upgrade-insecure-requests; img-src 'self' data: https://*.cloudfront.net https://*.amazonaws.com; script-src 'self' https://*.cloudfront.net https://*.amazonaws.com;
   style-src 'self' https://*.amazonaws.com; object-src 'none'; font-src 'self' https: data:;
   manifest-src 'self'; connect-src 'self' https://*.amazonaws.com" />
   <title>Enhanced Document Understanding on AWS</title>