Consolidated dependency updates #2725

melba-lopez · 2023-05-03T02:55:38Z

Description

Consolidated dependency updates

Package	Type	Update	Change
'~~mysql:mysql-connector-java '~~	compile	patch	'~~8.0.29 -> 8.0.33 '~~
org.glassfish.jaxb:jaxb-runtime (source)	compile	patch	2.3.6 -> 2.3.8
org.postgresql:postgresql (source)	compile	minor	42.5.1 -> 42.6.0
eclipse-temurin	stage	patch	17.0.6_10-jre-focal -> 17.0.7_7-jre-focal
com.microsoft.sqlserver:mssql-jdbc	compile	major	11.2.3.jre17 -> 12.2.0.jre11
'~~jekyll '~~		major	'~~3.8 -> 4.0 '~~
'~~org.eclipse.jetty:jetty-maven-plugin (source) '~~	build	major	'~~10.0.15 -> 11.0.15 '~~

Addressed Issue

Additional Details

Upgrades not compatible at this time:

mysql:mysql-connector-java
org.eclipse.jetty:jetty-maven-plugin

Postponed:

jekyll per Consolidated dependency updates #2725 (comment)

Checklist

I have read and understand the contributing guidelines
This PR fixes a defect, and I have provided tests to verify that the fix is effective
This PR implements an enhancement, and I have provided tests to verify that it works as intended
This PR introduces changes to the database model, and I have added corresponding update logic
This PR introduces new or alters existing behavior, and I have updated the documentation accordingly

stevespringett · 2023-05-03T03:29:54Z

The upgrade to Jetty 11 Maven plugin will likely break development environments due to the migration of javax to jakarta. DT still relies on Jetty 10. We should likely have a dedicated story specific to the upgrade of Jetty and migration from javax to jakarta. This will impact both DT and Java Alpine.

melba-lopez · 2023-05-03T13:49:55Z

The upgrade to Jetty 11 Maven plugin will likely break development environments due to the migration of javax to jakarta. DT still relies on Jetty 10. We should likely have a dedicated story specific to the upgrade of Jetty and migration from javax to jakarta. This will impact both DT and Java Alpine.

@stevespringett I can remove the jetty upgrade for now and make a comment inline.

nscuro · 2023-05-03T13:55:51Z

The Jekyll update needs to be tested by building the docs: https://github.com/DependencyTrack/dependency-track/blob/master/DEVELOPING.md#documentation

We'll also need to make sure GitHub pages continues to work.

We should likely have a dedicated story specific to the upgrade of Jetty and migration from javax to jakarta. This will impact both DT and Java Alpine.

For Alpine there's stevespringett/Alpine#402 already.

@melba-lopez Please make sure you sign-off your commits. If you click on "Details" of the DCO check it will show you what to do.

melba-lopez · 2023-05-03T14:47:22Z

The Jekyll update needs to be tested by building the docs: https://github.com/DependencyTrack/dependency-track/blob/master/DEVELOPING.md#documentation

We'll also need to make sure GitHub pages continues to work.

Will attempt testing it now

@melba-lopez Please make sure you sign-off your commits. If you click on "Details" of the DCO check it will show you what to do.

(Done)

melba-lopez · 2023-05-03T15:12:40Z

We'll also need to make sure GitHub pages continues to work.

I don't know how to test the github pages. Can you point me in the right direction?

The Jekyll update needs to be tested by building the docs: https://github.com/DependencyTrack/dependency-track/blob/master/DEVELOPING.md#documentation

Just tested on local machine and it appears to be working. Also, should we update this command in the docs? https://github.com/DependencyTrack/dependency-track/blob/master/DEVELOPING.md#documentation

docker run --rm -it --name jekyll -p "127.0.0.1:4000:4000" -v "$(pwd)/docs:/srv/jekyll:Z" jekyll/jekyll:4.0 jekyll serve

nscuro · 2023-05-07T20:55:27Z

I don't know how to test the github pages. Can you point me in the right direction?

Only way I know is actually deploying it. I think you can do it in your fork such that it's available under https://melba-lopez.github.io/dependency-track. Here's how it's currently set up for us:

I also found this dedicated website for dependency versions in GitHub pages: https://pages.github.com/versions/

it says it's using Jekyll 3.9.3, but I am not 100% if that means depending on Jekyll 4.x will break things.

nscuro · 2023-06-12T18:34:40Z

@melba-lopez For the sake of moving this forward, maybe we can just drop the Jekyll update for now, and investigate on this separately?

melba-lopez · 2023-06-12T18:47:02Z

Sounds good to me. @nscuro -- been out sick (myself/family) so have not had time to do much in this space. I got back last week. Not sure if this still is applicable given the 4.8 release that happened afterwards. I can always add extra packages if you'd like or just use this PR as a test only.

nscuro · 2023-06-13T08:30:45Z

Just stumbled over this again: #1970 (comment)

There is a problem with mysql-connector-java > 8.0.29 that we did not have time to investigate further. Unfortunately we did not update the comment in pom.xml... So for now it may also be better to not update this dependency also.

melba-lopez · 2023-06-20T01:28:05Z

@nscuro once the checks pass, this should be good to go!

Signed-off-by: Florian Heubeck <heubeck@mediamarktsaturn.com> Signed-off-by: Melba Lopez <Melba.Lopez@ibm.com>

Additionally: * Only fetch existing tests when reimport is actually enabled * Add proper tests that verify the entirety of the integration instead of only individual parts * Add test case for manual testing against a local DefectDojo instance Fixes DependencyTrack#2707 Signed-off-by: nscuro <nscuro@protonmail.com> Signed-off-by: Melba Lopez <Melba.Lopez@ibm.com>

Signed-off-by: Jakub Rak <rakjak2@gmail.com> Signed-off-by: Melba Lopez <Melba.Lopez@ibm.com>

### Description Consolidated dependency updates | Package | Type | Update | Change | |---|---|---|---| |org.glassfish.jaxb:jaxb-runtime (source) | compile | patch | 2.3.6 -> 2.3.8 | |com.microsoft.sqlserver:mssql-jdbc | compile | major | 11.2.3.jre17 -> 12.2.0.jre11 | |mysql:mysql-connector-java | compile | patch | 8.0.29 -> 8.0.33 | |org.postgresql:postgresql (source) | compile | minor | 42.5.1 -> 42.6.0 | |org.eclipse.jetty:jetty-maven-plugin (source) | build | major | 10.0.15 -> 11.0.15 | ### Addressed Issue ### Additional Details ### Checklist - [x ] This PR fixes a defect, and I have provided tests to verify that the fix is effective Signed-off-by: Melba Lopez <Melba.Lopez@ibm.com>

Signed-off-by: Melba Lopez <Melba.Lopez@ibm.com>

sonatype-lift · 2023-06-20T04:02:18Z

src/main/java/org/dependencytrack/persistence/PolicyQueryManager.java

        if (orderBy == null) {
            query.setOrdering("timestamp desc, component.name, component.version");
        }
-        final PaginatedResult result = execute(query, project.getId());
+        if (filter != null) {
+            query.setFilter(projectFilter + " && (policyCondition.policy.name.toLowerCase().matches(:filter) || component.name.toLowerCase().matches(:filter))");


SQL_INJECTION_JDO: This use of javax/jdo/Query.setFilter(Ljava/lang/String;)V can be vulnerable to SQL/JDOQL injection (with JDO)

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

melba-lopez mentioned this pull request May 3, 2023

upgrade to Jetty 11 Maven plugin #2727

Closed

melba-lopez force-pushed the ml-bump-deps branch from 4a507ec to 889e738 Compare May 3, 2023 14:43

heubeck and others added 7 commits June 19, 2023 22:55

Issue DependencyTrack#2695: Add externalReferences to PATCH project

73ef2ca

Signed-off-by: Florian Heubeck <heubeck@mediamarktsaturn.com> Signed-off-by: Melba Lopez <Melba.Lopez@ibm.com>

Fix policy violation search

06d8527

Signed-off-by: Jakub Rak <rakjak2@gmail.com> Signed-off-by: Melba Lopez <Melba.Lopez@ibm.com>

reverting jetty to 10.0.15

ff26901

Signed-off-by: Melba Lopez <Melba.Lopez@ibm.com>

melba-lopez force-pushed the ml-bump-deps branch from 9bf7f14 to ff26901 Compare June 20, 2023 03:55

sonatype-lift bot reviewed Jun 20, 2023

View reviewed changes

melba-lopez mentioned this pull request Jun 20, 2023

Consolidated Dependency Updates (Take2) #2832

Merged

5 tasks

melba-lopez closed this Jun 20, 2023

github-actions bot locked as resolved and limited conversation to collaborators Jul 20, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Consolidated dependency updates #2725

Consolidated dependency updates #2725

melba-lopez commented May 3, 2023 •

edited

Loading

stevespringett commented May 3, 2023

melba-lopez commented May 3, 2023 •

edited

Loading

nscuro commented May 3, 2023

melba-lopez commented May 3, 2023 •

edited

Loading

melba-lopez commented May 3, 2023 •

edited

Loading

nscuro commented May 7, 2023

nscuro commented Jun 12, 2023

melba-lopez commented Jun 12, 2023

nscuro commented Jun 13, 2023

melba-lopez commented Jun 20, 2023

sonatype-lift bot Jun 20, 2023

Command	Usage
`@sonatype-lift ignore`	Leave out the above finding from this PR
`@sonatype-lift ignoreall`	Leave out all the existing findings from this PR
`@sonatype-lift exclude <file\|issue\|path\|tool>`	Exclude specified `file\|issue\|path\|tool` from Lift findings by updating your config.toml file

Consolidated dependency updates #2725

Consolidated dependency updates #2725

Conversation

melba-lopez commented May 3, 2023 • edited Loading

Description

Addressed Issue

Additional Details

Checklist

stevespringett commented May 3, 2023

melba-lopez commented May 3, 2023 • edited Loading

nscuro commented May 3, 2023

melba-lopez commented May 3, 2023 • edited Loading

melba-lopez commented May 3, 2023 • edited Loading

nscuro commented May 7, 2023

nscuro commented Jun 12, 2023

melba-lopez commented Jun 12, 2023

nscuro commented Jun 13, 2023

melba-lopez commented Jun 20, 2023

sonatype-lift bot Jun 20, 2023

Choose a reason for hiding this comment

melba-lopez commented May 3, 2023 •

edited

Loading

melba-lopez commented May 3, 2023 •

edited

Loading

melba-lopez commented May 3, 2023 •

edited

Loading

melba-lopez commented May 3, 2023 •

edited

Loading