Skip to content

Commit 8194ba4

Browse files
DovOpsDovOps
authored
Fix build issues and address CVEs (#265)
* Fix .net core build in security job * Adding dependency bumps to address CVE scan and freshen dependencies * fixing a docker issue encountered when running security action * Attempt to find non CVE version of Json * suppress CVE for json * More Vuln Fixes * fixed gradle builds * update docker build action * Fixed docker build * Fixed acct * Upgraded Spring Boot and Fixed Builds * More dependency fixes * Address okhttp vulnerability * okhttp
1 parent 08f3de9 commit 8194ba4

File tree

11 files changed

+124
-89
lines changed

11 files changed

+124
-89
lines changed

‎.github/dotnet-cve-ignore-list.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,10 @@
66
<filePath regex="true">.*\bSerilog\.Sinks\.Async\.dll</filePath>
77
<cve>CVE-2021-43138</cve>
88
</suppress>
9+
10+
<suppress>
11+
<notes><![CDATA[System.Text.Json is used in a safe context - see https://nvd.nist.gov/vuln/detail/CVE-2024-43485]]></notes>
12+
<filePath regex="true">.*\bPeopleService\.Core\.csproj</filePath>
13+
<cve>CVE-2024-43485</cve>
14+
</suppress>
915
</suppressions>

‎.github/workflows/security.yml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,10 @@ jobs:
7070
steps:
7171
- name: Checkout
7272
uses: actions/checkout@v4
73+
- name: Setup .NET
74+
uses: actions/setup-dotnet@v4
75+
with:
76+
dotnet-version: 9.0.x
7377
- name: Build project with dotnet
7478
run: dotnet build --configuration Release
7579
working-directory: ${{ matrix.module-folder }}
@@ -157,7 +161,12 @@ jobs:
157161
'reference-data']
158162
steps:
159163
- uses: actions/checkout@v4
160-
- uses: docker-practice/actions-setup-docker@master
164+
- name: Set up Docker Buildx
165+
uses: docker/setup-buildx-action@v2
166+
- name: Configure Docker Daemon
167+
run: |
168+
echo '{"experimental": true}' | sudo tee /etc/docker/daemon.json
169+
sudo systemctl restart docker
161170
- name: Build
162171
run: docker build -f Dockerfile -t user/app:latest .
163172
working-directory: ${{ matrix.module-folder }}

‎account-service/build.gradle‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,29 +7,30 @@
77

88
plugins {
99
id 'java'
10-
id 'org.springframework.boot' version '3.3.7'
10+
id 'org.springframework.boot' version '3.4.4'
1111
id 'io.spring.dependency-management' version '1.1.7'
1212
}
1313

1414
group = 'finos.traderx.account-service'
1515
version = '0.0.1-SNAPSHOT'
1616

17-
java{
18-
sourceCompatibility = JavaVersion.VERSION_21
17+
java {
18+
sourceCompatibility = JavaVersion.VERSION_21
1919
}
2020

2121
dependencies {
2222

23-
implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
24-
implementation 'org.springframework.boot:spring-boot-starter-web'
25-
implementation 'com.h2database:h2:2.2.224'
26-
implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.6.0'
23+
implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
24+
implementation 'org.springframework.boot:spring-boot-starter-web'
25+
implementation 'com.h2database:h2:2.2.224'
2726

28-
implementation ('ch.qos.logback:logback-core:1.5.15'){
29-
because 'version brought in by spring boot 3.3.7 affected by CVE-2024-12798'
30-
}
27+
implementation ('org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.6')
28+
29+
// Add compatible logback-classic version
30+
implementation 'ch.qos.logback:logback-core:1.5.15'
31+
implementation 'ch.qos.logback:logback-classic:1.5.15' // Ensure compatibility
3132

32-
testImplementation 'org.springframework.boot:spring-boot-starter-test'
33+
testImplementation 'org.springframework.boot:spring-boot-starter-test'
3334
}
3435

3536
tasks.withType(Test).configureEach {

‎people-service/PeopleService.Core/PeopleService.Core.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
<PackageReference Include="FluentValidation.AspNetCore" Version="11.3.0" /> <!-- Updated version -->
1313
<PackageReference Include="JetBrains.Annotations" Version="2024.3.0" />
1414
<PackageReference Include="MediatR" Version="12.4.1" />
15-
<PackageReference Include="System.Text.Json" Version="9.0.2" />
15+
<PackageReference Include="System.Text.Json" Version="9.0.3" />
1616
</ItemGroup>
1717

1818
</Project>

‎people-service/PeopleService.WebApi/PeopleService.WebApi.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
<PackageReference Include="MediatR" Version="12.4.1" />
1414
<PackageReference Include="Serilog.AspNetCore" Version="9.0.0" />
1515
<PackageReference Include="Serilog.Extensions.Logging.File" Version="3.0.0" />
16-
<PackageReference Include="Swashbuckle.AspNetCore" Version="7.3.1" />
16+
<PackageReference Include="Swashbuckle.AspNetCore" Version="8.0.0" />
1717
</ItemGroup>
1818

1919
<ItemGroup>

‎position-service/build.gradle‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,29 +7,30 @@
77

88
plugins {
99
id 'java'
10-
id 'org.springframework.boot' version '3.3.7'
10+
id 'org.springframework.boot' version '3.4.4'
1111
id 'io.spring.dependency-management' version '1.1.7'
1212
}
1313

1414
group = 'finos.traderx.position-service'
1515
version = '0.0.1-SNAPSHOT'
1616

17-
java{
18-
sourceCompatibility = JavaVersion.VERSION_21
17+
java {
18+
sourceCompatibility = JavaVersion.VERSION_21
1919
}
2020

2121
dependencies {
2222

23-
implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
24-
implementation 'org.springframework.boot:spring-boot-starter-web'
25-
implementation 'com.h2database:h2:2.2.224'
26-
implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.6.0'
23+
implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
24+
implementation 'org.springframework.boot:spring-boot-starter-web'
25+
implementation 'com.h2database:h2:2.2.224'
26+
implementation ('org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.6')
2727

28-
implementation ('ch.qos.logback:logback-core:1.5.15'){
29-
because 'version brought in by spring boot 3.3.7 affected by CVE-2024-12798'
30-
}
28+
implementation ('ch.qos.logback:logback-core:1.5.15') {
29+
because 'version brought in by spring boot 3.3.7 affected by CVE-2024-12798'
30+
}
31+
implementation 'ch.qos.logback:logback-classic:1.5.15' // Ensure compatibility
3132

32-
testImplementation 'org.springframework.boot:spring-boot-starter-test'
33+
testImplementation 'org.springframework.boot:spring-boot-starter-test'
3334
}
3435

3536
tasks.withType(Test).configureEach {

‎reference-data/Dockerfile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ FROM --platform=$BUILDPLATFORM node:23 AS builder
22
WORKDIR /usr/src/app
33
COPY package*.json ./
44
RUN npm install --only=production
5+
RUN npm install @nestjs/cli
6+
57
COPY . .
68
RUN npm run build
79

‎reference-data/package.json‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -20,39 +20,39 @@
2020
"test:e2e": "jest --config ./test/jest-e2e.json"
2121
},
2222
"dependencies": {
23-
"@nestjs/common": "^10.4.15",
24-
"@nestjs/core": "^10.4.15",
25-
"@nestjs/platform-express": "^10.4.15",
26-
"@nestjs/swagger": "^8.1.0",
27-
"@nestjs/terminus": "^10.2.3",
23+
"@nestjs/common": "^11.0.12",
24+
"@nestjs/core": "^11.0.12",
25+
"@nestjs/platform-express": "^11.0.12",
26+
"@nestjs/swagger": "^11.1.0",
27+
"@nestjs/terminus": "^11.0.0",
2828
"csv-reader": "^1.0.12",
29-
"npm-check-updates": "^17.1.13",
29+
"npm-check-updates": "^17.1.16",
3030
"reflect-metadata": "^0.2.2",
31-
"rxjs": "^7.8.1"
31+
"rxjs": "^7.8.2"
3232
},
3333
"devDependencies": {
34-
"@nestjs/cli": "^10.4.9",
35-
"@nestjs/schematics": "^10.2.3",
36-
"@nestjs/testing": "^10.4.15",
37-
"@tsconfig/node20": "20.1.4",
38-
"@types/express": "^5.0.0",
34+
"@nestjs/cli": "^11.0.5",
35+
"@nestjs/schematics": "^11.0.2",
36+
"@nestjs/testing": "^11.0.12",
37+
"@tsconfig/node20": "20.1.5",
38+
"@types/express": "^5.0.1",
3939
"@types/jest": "29.5.14",
40-
"@types/node": "22.10.2",
41-
"@types/supertest": "^6.0.2",
42-
"@typescript-eslint/eslint-plugin": "^8.19.0",
43-
"@typescript-eslint/parser": "^8.19.0",
44-
"eslint": "^9.17.0",
45-
"eslint-config-prettier": "^9.1.0",
46-
"eslint-plugin-prettier": "^5.2.1",
40+
"@types/node": "22.13.14",
41+
"@types/supertest": "^6.0.3",
42+
"@typescript-eslint/eslint-plugin": "^8.28.0",
43+
"@typescript-eslint/parser": "^8.28.0",
44+
"eslint": "^9.23.0",
45+
"eslint-config-prettier": "^10.1.1",
46+
"eslint-plugin-prettier": "^5.2.5",
4747
"jest": "29.7.0",
48-
"prettier": "^3.4.2",
48+
"prettier": "^3.5.3",
4949
"source-map-support": "^0.5.21",
50-
"supertest": "^7.0.0",
51-
"ts-jest": "29.2.5",
52-
"ts-loader": "^9.5.1",
50+
"supertest": "^7.1.0",
51+
"ts-jest": "29.3.0",
52+
"ts-loader": "^9.5.2",
5353
"ts-node": "^10.9.2",
5454
"tsconfig-paths": "4.2.0",
55-
"typescript": "^5.7.2"
55+
"typescript": "^5.8.2"
5656
},
5757
"jest": {
5858
"moduleFileExtensions": [

‎trade-feed/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"dependencies": {
1313
"cors": "^2.8.5",
1414
"express": "^5.0.1",
15-
"npm-check-updates": "^17.1.13",
15+
"npm-check-updates": "^17.1.16",
1616
"socket.io": "^4.8.1",
1717
"winston": "^3.17.0"
1818
}

‎trade-processor/build.gradle‎

Lines changed: 30 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -7,36 +7,45 @@
77

88
plugins {
99
id 'java'
10-
id 'org.springframework.boot' version '3.3.7'
10+
id 'org.springframework.boot' version '3.4.4'
1111
id 'io.spring.dependency-management' version '1.1.7'
1212
}
1313

1414
group = 'finos.traderx.trade-processor'
1515
version = '0.0.1-SNAPSHOT'
1616

17-
java{
18-
sourceCompatibility = JavaVersion.VERSION_21
17+
java {
18+
sourceCompatibility = JavaVersion.VERSION_21
1919
}
2020

2121
dependencies {
22-
23-
implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
24-
implementation 'org.springframework.boot:spring-boot-starter-web'
25-
implementation 'com.h2database:h2:2.2.224'
26-
implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.6.0'
27-
28-
implementation('org.json:json:20240303') {
29-
because 'previous versions are affected by multiple CVE'
30-
}
31-
implementation ('io.socket:socket.io-client:2.1.1'){
32-
exclude group: 'org.json', module: 'json'
33-
}
34-
35-
implementation ('ch.qos.logback:logback-core:1.5.15'){
36-
because 'version brought in by spring boot 3.3.7 affected by CVE-2024-12798'
37-
}
38-
39-
testImplementation 'org.springframework.boot:spring-boot-starter-test'
22+
23+
implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
24+
implementation 'org.springframework.boot:spring-boot-starter-web'
25+
implementation 'com.h2database:h2:2.2.224'
26+
implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.6.0'
27+
28+
implementation('org.json:json:20240303') {
29+
because 'previous versions are affected by multiple CVE'
30+
}
31+
implementation ('io.socket:socket.io-client:2.1.2') {
32+
exclude group: 'org.json', module: 'json'
33+
}
34+
35+
implementation ('org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.6')
36+
implementation ('org.springframework.boot:spring-boot-starter-web')
37+
38+
// Override okhttp and okio versions to address vulnerabilities
39+
implementation 'com.squareup.okhttp3:okhttp:4.12.0' // Suggested version
40+
// implementation 'com.squareup.okio:okio:1.17.5' // Latest compatible version for okhttp 3.14.9
41+
42+
// Add compatible logback-classic version
43+
implementation ('ch.qos.logback:logback-core:1.5.15') {
44+
because 'version brought in by spring boot 3.3.7 affected by CVE-2024-12798'
45+
}
46+
implementation 'ch.qos.logback:logback-classic:1.5.15' // Ensure compatibility
47+
48+
testImplementation 'org.springframework.boot:spring-boot-starter-test'
4049
}
4150

4251
tasks.withType(Test).configureEach {

0 commit comments

Comments
 (0)