Skip to content

Commit 623efea

Browse files
emilie-robichaudemilie-robichaud
committed
Upgrade vulnerable dependencies (ignoring transitive vulnerabilities), and make code changes to fix build breaks from upgrade
Signed-off-by: Emilie <emilie.robichaud@bny.com>
1 parent 4e92eb8 commit 623efea

File tree

10 files changed

+102
-67
lines changed

10 files changed

+102
-67
lines changed

‎spring-boot-with-admin/admin/pom.xml‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,16 +35,16 @@
3535
<maven.compiler.source>11</maven.compiler.source>
3636
<maven.compiler.target>11</maven.compiler.target>
3737

38-
<spring-boot-admin.version>2.6.7</spring-boot-admin.version>
39-
<spring-cloud.version>3.1.2</spring-cloud.version>
38+
<spring-boot-admin.version>3.4.5</spring-boot-admin.version>
39+
<spring-cloud.version>4.2.1</spring-cloud.version>
4040
</properties>
4141

4242
<dependencyManagement>
4343
<dependencies>
4444
<dependency>
4545
<groupId>org.springframework.boot</groupId>
4646
<artifactId>spring-boot-starter-parent</artifactId>
47-
<version>2.6.7</version>
47+
<version>3.4.5</version>
4848
<type>pom</type>
4949
<scope>import</scope>
5050
</dependency>
@@ -91,5 +91,16 @@
9191
<artifactId>spring-boot-starter-test</artifactId>
9292
<scope>test</scope>
9393
</dependency>
94+
<dependency>
95+
<groupId>org.springframework.security</groupId>
96+
<artifactId>spring-security-config</artifactId>
97+
<version>6.4.5</version>
98+
</dependency>
99+
<dependency>
100+
<groupId>javax.servlet</groupId>
101+
<artifactId>javax.servlet-api</artifactId>
102+
<version>4.0.1</version>
103+
<scope>provided</scope>
104+
</dependency>
94105
</dependencies>
95106
</project>

‎spring-boot-with-admin/admin/src/main/java/bny/training/spring/boot/admin/config/SecurityConfiguration.java‎

Lines changed: 21 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -18,20 +18,23 @@
1818

1919
import de.codecentric.boot.admin.server.config.AdminServerProperties;
2020
import org.springframework.boot.autoconfigure.security.SecurityProperties;
21+
import org.springframework.context.annotation.Bean;
2122
import org.springframework.context.annotation.Configuration;
2223
import org.springframework.http.HttpMethod;
2324
import org.springframework.security.config.Customizer;
24-
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
2525
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
26-
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
26+
import org.springframework.security.core.userdetails.User;
27+
import org.springframework.security.core.userdetails.UserDetails;
28+
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
29+
import org.springframework.security.web.SecurityFilterChain;
2730
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
2831
import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
2932
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
3033

3134
import java.util.UUID;
3235

3336
@Configuration(proxyBeanMethods = false)
34-
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
37+
public class SecurityConfiguration {
3538

3639
// TODO: https://codecentric.github.io/spring-boot-admin/current/#_securing_spring_boot_admin_server
3740
// This configuration is not customized to our apps and provides basic authentication.
@@ -46,17 +49,17 @@ public SecurityConfiguration(AdminServerProperties adminServer, SecurityProperti
4649
this.security = security;
4750
}
4851

49-
@Override
50-
protected void configure(HttpSecurity http) throws Exception {
52+
@Bean
53+
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
5154
SavedRequestAwareAuthenticationSuccessHandler successHandler = new SavedRequestAwareAuthenticationSuccessHandler();
5255
successHandler.setTargetUrlParameter("redirectTo");
5356
successHandler.setDefaultTargetUrl(this.adminServer.path("/"));
5457

5558
http.authorizeRequests(
56-
authorizeRequests -> authorizeRequests.antMatchers(this.adminServer.path("/assets/**")).permitAll()
57-
.antMatchers(this.adminServer.path("/actuator/info")).permitAll()
58-
.antMatchers(this.adminServer.path("/actuator/health")).permitAll()
59-
.antMatchers(this.adminServer.path("/login")).permitAll().anyRequest().authenticated()
59+
authorizeRequests -> authorizeRequests.requestMatchers(this.adminServer.path("/assets/**")).permitAll()
60+
.requestMatchers(this.adminServer.path("/actuator/info")).permitAll()
61+
.requestMatchers(this.adminServer.path("/actuator/health")).permitAll()
62+
.requestMatchers(this.adminServer.path("/login")).permitAll().anyRequest().authenticated()
6063
).formLogin(
6164
formLogin -> formLogin.loginPage(this.adminServer.path("/login")).successHandler(successHandler).and()
6265
).logout(logout -> logout.logoutUrl(this.adminServer.path("/logout"))).httpBasic(Customizer.withDefaults())
@@ -69,12 +72,17 @@ protected void configure(HttpSecurity http) throws Exception {
6972
new AntPathRequestMatcher(this.adminServer.path("/actuator/**"))
7073
))
7174
.rememberMe(rememberMe -> rememberMe.key(UUID.randomUUID().toString()).tokenValiditySeconds(1209600));
75+
return http.build();
7276
}
7377

7478
// Required to provide UserDetailsService for "remember functionality"
75-
@Override
76-
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
77-
auth.inMemoryAuthentication().withUser(security.getUser().getName())
78-
.password("{noop}" + security.getUser().getPassword()).roles("USER");
79+
@Bean
80+
protected InMemoryUserDetailsManager userDetailsService() {
81+
UserDetails user = User.withDefaultPasswordEncoder()
82+
.username(security.getUser().getName())
83+
.password(security.getUser().getPassword())
84+
.roles("USER")
85+
.build();
86+
return new InMemoryUserDetailsManager(user);
7987
}
8088
}

‎spring-boot-with-admin/notification/pom.xml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,8 @@
3535
<maven.compiler.source>11</maven.compiler.source>
3636
<maven.compiler.target>11</maven.compiler.target>
3737

38-
<log4j2.version>2.17.1</log4j2.version>
39-
<spring-cloud.version>2021.0.0</spring-cloud.version>
40-
<swagger2.version>2.6.0</swagger2.version>
38+
<log4j2.version>2.24.3</log4j2.version>
39+
<spring-cloud.version>2024.0.1</spring-cloud.version>
4140
</properties>
4241

4342
<dependencyManagement>
@@ -52,7 +51,7 @@
5251
<dependency>
5352
<groupId>org.springframework.boot</groupId>
5453
<artifactId>spring-boot-starter-parent</artifactId>
55-
<version>2.6.3</version>
54+
<version>3.4.5</version>
5655
<type>pom</type>
5756
<scope>import</scope>
5857
</dependency>
@@ -107,7 +106,7 @@
107106
<groupId>io.projectreactor</groupId>
108107
<artifactId>reactor-test</artifactId>
109108
<scope>test</scope>
110-
<version>3.4.18</version>
109+
<version>3.7.5</version>
111110
</dependency>
112111

113112
</dependencies>

‎spring-boot-with-admin/registry/pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,15 +35,15 @@
3535
<maven.compiler.source>11</maven.compiler.source>
3636
<maven.compiler.target>11</maven.compiler.target>
3737

38-
<spring-cloud.version>2021.0.0</spring-cloud.version>
38+
<spring-cloud.version>2024.0.1</spring-cloud.version>
3939
</properties>
4040

4141
<dependencyManagement>
4242
<dependencies>
4343
<dependency>
4444
<groupId>org.springframework.boot</groupId>
4545
<artifactId>spring-boot-starter-parent</artifactId>
46-
<version>2.6.3</version>
46+
<version>3.4.5</version>
4747
<type>pom</type>
4848
<scope>import</scope>
4949
</dependency>

‎spring-boot/todo/pom.xml‎

Lines changed: 28 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -35,18 +35,14 @@
3535
<maven.compiler.source>11</maven.compiler.source>
3636
<maven.compiler.target>11</maven.compiler.target>
3737

38-
<log4j2.version>2.17.1</log4j2.version>
39-
<logback-core.version>1.1.7</logback-core.version>
40-
<commons-lang3.version>3.11</commons-lang3.version>
38+
<log4j2.version>2.24.3</log4j2.version>
39+
<logback-core.version>1.5.18</logback-core.version>
40+
<commons-lang3.version>3.17.0</commons-lang3.version>
4141

42-
<swagger2.version>2.6.0</swagger2.version>
42+
<springfox.version>3.0.0</springfox.version>
4343

44-
<jackson.version>2.21.1</jackson.version>
45-
46-
<dbunit.version>2.7.0</dbunit.version>
44+
<dbunit.version>3.0.0</dbunit.version>
4745
<spring-test-dbunit.version>1.3.0</spring-test-dbunit.version>
48-
49-
<rest-assured.version>3.0.3</rest-assured.version>
5046
</properties>
5147

5248
<dependencyManagement>
@@ -61,7 +57,7 @@
6157
<dependency>
6258
<groupId>org.springframework.boot</groupId>
6359
<artifactId>spring-boot-starter-parent</artifactId>
64-
<version>2.4.2</version>
60+
<version>3.4.5</version>
6561
<type>pom</type>
6662
<scope>import</scope>
6763
</dependency>
@@ -123,17 +119,17 @@
123119
<dependency>
124120
<groupId>io.springfox</groupId>
125121
<artifactId>springfox-core</artifactId>
126-
<version>${swagger2.version}</version>
122+
<version>${springfox.version}</version>
127123
</dependency>
128124
<dependency>
129125
<groupId>io.springfox</groupId>
130126
<artifactId>springfox-swagger2</artifactId>
131-
<version>${swagger2.version}</version>
127+
<version>${springfox.version}</version>
132128
</dependency>
133129
<dependency>
134130
<groupId>io.springfox</groupId>
135131
<artifactId>springfox-swagger-ui</artifactId>
136-
<version>${swagger2.version}</version>
132+
<version>${springfox.version}</version>
137133
</dependency>
138134

139135
<!-- Embedded database -->
@@ -163,12 +159,12 @@
163159
<dependency>
164160
<groupId>io.rest-assured</groupId>
165161
<artifactId>rest-assured</artifactId>
166-
<version>4.3.3</version>
162+
<version>5.5.1</version>
167163
</dependency>
168164
<dependency>
169165
<groupId>io.rest-assured</groupId>
170166
<artifactId>json-path</artifactId>
171-
<version>4.3.3</version>
167+
<version>5.5.1</version>
172168
</dependency>
173169

174170
<dependency>
@@ -182,7 +178,23 @@
182178
</exclusion>
183179
</exclusions>
184180
</dependency>
185-
181+
<dependency>
182+
<groupId>javax.servlet</groupId>
183+
<artifactId>servlet-api</artifactId>
184+
<version>2.5</version>
185+
<scope>compile</scope>
186+
</dependency>
187+
<dependency>
188+
<groupId>jakarta.validation</groupId>
189+
<artifactId>jakarta.validation-api</artifactId>
190+
<version>2.0.2</version>
191+
</dependency>
192+
<dependency>
193+
<groupId>javax.persistence</groupId>
194+
<artifactId>javax.persistence-api</artifactId>
195+
<version>2.2</version>
196+
<scope>compile</scope>
197+
</dependency>
186198
</dependencies>
187199

188200
<build>

‎spring-boot/todo/src/test/java/bny/training/spring/boot/todo/AbstractTodoMockSetupTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,9 @@
2525

2626
import java.util.Arrays;
2727

28+
import static org.mockito.ArgumentMatchers.any;
29+
import static org.mockito.ArgumentMatchers.eq;
2830
import static org.mockito.ArgumentMatchers.isNull;
29-
import static org.mockito.Matchers.any;
30-
import static org.mockito.Matchers.eq;
3131
import static org.mockito.Mockito.mock;
3232
import static org.mockito.Mockito.when;
3333

‎spring-framework/ch06_spring-jpa/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@
9999
<dependency>
100100
<groupId>org.hibernate</groupId>
101101
<artifactId>hibernate-entitymanager</artifactId>
102-
<version>5.6.15.Final</version>
102+
<version>6.0.0.Alpha7</version>
103103
</dependency>
104104

105105
<!-- H2 DB -->

‎spring-framework/ch06_spring-jpa/src/main/java/bny/training/spring/framework/dao/ColoredShapeDaoImpl.java‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,10 @@
1717
package bny.training.spring.framework.dao;
1818

1919
import bny.training.spring.framework.model.ColoredShape;
20-
import jakarta.persistence.EntityManager;
21-
import jakarta.persistence.PersistenceContext;
22-
20+
import java.util.Objects;
21+
import org.hibernate.Session;
22+
import org.hibernate.SessionFactory;
23+
import org.springframework.beans.factory.annotation.Autowired;
2324
import org.springframework.stereotype.Repository;
2425
import org.springframework.transaction.annotation.Propagation;
2526
import org.springframework.transaction.annotation.Transactional;
@@ -28,24 +29,28 @@
2829
@Transactional(readOnly = true)
2930
public class ColoredShapeDaoImpl implements ColoredShapeDao {
3031

31-
@PersistenceContext
32-
private EntityManager em;
32+
@Autowired
33+
private SessionFactory sessionFactory;
34+
35+
protected Session getSession() {
3336

37+
return this.sessionFactory.getCurrentSession();
38+
}
3439

3540
@Override
3641
public ColoredShape findById(final Long id) {
3742

38-
return (ColoredShape) em
39-
.createQuery("SELECT c FROM ColoredShape c WHERE c.id LIKE :id")
40-
.setParameter("id", id)
41-
.setMaxResults(1)
42-
.getResultList().get(0);
43+
return getSession().get(ColoredShape.class, id);
4344
}
4445

4546
@Override
4647
@Transactional(readOnly = false, propagation = Propagation.REQUIRES_NEW)
4748
public void save(final ColoredShape coloredShape) {
4849

49-
em.merge(coloredShape);
50+
if (Objects.isNull(getSession().find(ColoredShape.class, coloredShape.getId()))) {
51+
getSession().persist(coloredShape);
52+
} else {
53+
getSession().merge(coloredShape);
54+
}
5055
}
5156
}

‎spring-framework/ch08_spring-rest/pom.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -106,17 +106,17 @@
106106
<dependency>
107107
<groupId>io.springfox</groupId>
108108
<artifactId>springfox-core</artifactId>
109-
<version>${swagger2.version}</version>
109+
<version>${springfox.version}</version>
110110
</dependency>
111111
<dependency>
112112
<groupId>io.springfox</groupId>
113113
<artifactId>springfox-swagger2</artifactId>
114-
<version>${swagger2.version}</version>
114+
<version>${springfox.version}</version>
115115
</dependency>
116116
<dependency>
117117
<groupId>io.springfox</groupId>
118118
<artifactId>springfox-swagger-ui</artifactId>
119-
<version>${swagger2.version}</version>
119+
<version>${springfox.version}</version>
120120
</dependency>
121121

122122

‎spring-framework/pom.xml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -38,21 +38,21 @@
3838
<maven.compiler.source>17</maven.compiler.source>
3939
<maven.compiler.target>17</maven.compiler.target>
4040

41-
<spring-framework.version>6.0.8</spring-framework.version>
42-
<spring-data.jpa>3.0.5</spring-data.jpa>
41+
<spring-framework.version>6.2.6</spring-framework.version>
42+
<spring-data.jpa>3.4.5</spring-data.jpa>
4343

44-
<junit5.version>5.9.3</junit5.version>
44+
<junit5.version>5.12.2</junit5.version>
4545

46-
<logback.version>1.4.6</logback.version>
46+
<logback.version>1.5.18</logback.version>
4747

48-
<h2-database.version>2.1.214</h2-database.version>
49-
<hibernate.version>6.1.7.Final</hibernate.version>
50-
<jcl-over-slf4j.version>2.0.5</jcl-over-slf4j.version>
48+
<h2-database.version>2.3.232</h2-database.version>
49+
<hibernate.version>6.6.13.Final</hibernate.version>
50+
<jcl-over-slf4j.version>2.0.17</jcl-over-slf4j.version>
5151

52-
<jackson.version>2.4.0</jackson.version>
53-
<jaxb-api.version>4.0.0</jaxb-api.version>
52+
<jackson.version>2.19.0</jackson.version>
53+
<jaxb-api.version>4.0.2</jaxb-api.version>
5454

55-
<swagger2.version>2.6.0</swagger2.version>
55+
<springfox.version>3.0.0</springfox.version>
5656
</properties>
5757

5858
<modules>
@@ -78,7 +78,7 @@
7878
<dependency>
7979
<groupId>jakarta.persistence</groupId>
8080
<artifactId>jakarta.persistence-api</artifactId>
81-
<version>3.1.0</version>
81+
<version>3.2.0</version>
8282
</dependency>
8383
</dependencies>
8484
</dependencyManagement>

0 commit comments

Comments
 (0)