Update versions for CVE mitigation.

spring-cloud · Sep 14, 2023 · 9cb9ba3 · 9cb9ba3
1 parent e2e48ad
commit 9cb9ba3
Show file tree

Hide file tree

Showing 4 changed files with 59 additions and 6 deletions.
diff --git a/spring-cloud-dataflow-single-step-batch-job/pom.xml b/spring-cloud-dataflow-single-step-batch-job/pom.xml
@@ -17,6 +17,20 @@
 		<spring-cloud-dataflow-apps-metadata-plugin.version>1.0.7</spring-cloud-dataflow-apps-metadata-plugin.version>
 		<failIfNoTests>true</failIfNoTests>
 	</properties>
+	<dependencyManagement>
+		<dependencies>
+			<dependency>
+				<groupId>org.springframework.kafka</groupId>
+				<artifactId>spring-kafka</artifactId>
+				<version>[2.9.11,3.0)</version>
+			</dependency>
+			<dependency>
+				<groupId>com.h2database</groupId>
+				<artifactId>h2</artifactId>
+				<version>[2.2.222,3.0)</version>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
 	<dependencies>
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
@@ -38,6 +52,7 @@
 		<dependency>
 			<groupId>com.h2database</groupId>
 			<artifactId>h2</artifactId>
+			<version>2.2.222</version>
 		</dependency>
 		<dependency>
 			<groupId>org.mariadb.jdbc</groupId>

diff --git a/spring-cloud-skipper/spring-cloud-skipper-server/pom.xml b/spring-cloud-skipper/spring-cloud-skipper-server/pom.xml
@@ -12,6 +12,45 @@
 		<version>2.11.0-SNAPSHOT</version>
 		<relativePath>../../spring-cloud-dataflow-parent</relativePath>
 	</parent>
+	<dependencyManagement>
+		<dependencies>
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-core</artifactId>
+				<version>2.13.5</version>
+			</dependency>
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-databind</artifactId>
+				<version>2.13.5</version>
+			</dependency>
+			<dependency>
+				<groupId>com.fasterxml.jackson.dataformat</groupId>
+				<artifactId>jackson-dataformat-yaml</artifactId>
+				<version>2.13.5</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>1.76</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>1.75</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcutil-jdk18on</artifactId>
+				<version>1.75</version>
+			</dependency>
+			<dependency>
+				<groupId>org.mariadb.jdbc</groupId>
+				<artifactId>mariadb-java-client</artifactId>
+				<version>[3.1.2,)</version>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
 	<dependencies>
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
@@ -63,22 +102,18 @@
 		<dependency>
 			<groupId>org.bouncycastle</groupId>
 			<artifactId>bcprov-jdk18on</artifactId>
-			<version>1.76</version>
 		</dependency>
 		<dependency>
 			<groupId>org.bouncycastle</groupId>
 			<artifactId>bcpkix-jdk18on</artifactId>
-			<version>1.75</version>
 		</dependency>
 		<dependency>
 			<groupId>org.bouncycastle</groupId>
 			<artifactId>bcutil-jdk18on</artifactId>
-			<version>1.75</version>
 		</dependency>
 		<dependency>
 			<groupId>org.mariadb.jdbc</groupId>
 			<artifactId>mariadb-java-client</artifactId>
-			<version>[3.1.2,)</version>
 		</dependency>
 		<dependency>
 			<groupId>org.springframework.boot</groupId>

diff --git a/src/deploy/images/build-grafana-image.sh b/src/deploy/images/build-grafana-image.sh
@@ -6,5 +6,8 @@ pushd $PROJECT_DIR || exit
         SCDF_VER=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
     else
         SCDF_VER=$DATAFLOW_VERSION
-    docker build -f "src/grafana/prometheus/docker/grafana" "springcloud/spring-cloud-dataflow-grafana-prometheus:$SCDF_VER"
+    fi
+    pushd src/grafana/prometheus/docker/grafana || exit 1
+        docker build -t "springcloud/spring-cloud-dataflow-grafana-prometheus:$SCDF_VER" .
+    popd || exit 1
 popd || exit
diff --git a/src/grafana/prometheus/docker/grafana/Dockerfile b/src/grafana/prometheus/docker/grafana/Dockerfile
@@ -1,4 +1,4 @@
-FROM grafana/grafana:8.0.2
+FROM grafana/grafana:8.5.27
 ADD ./provisioning /etc/grafana/provisioning
 ADD ./config.ini /etc/grafana/config.ini
 ADD ./dashboards /var/lib/grafana/dashboards