From 9a54e08a1b37087879d0c1ac07c0b5ac69cf02d1 Mon Sep 17 00:00:00 2001 From: Shailesh Mishra Date: Fri, 15 Sep 2023 21:56:25 +0530 Subject: [PATCH 1/6] * Updated all dependencies to the latest one. * Few of them contains transitive vulnerability. that we are keeping track --- pom.xml | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/pom.xml b/pom.xml index 3546ec2..0e21327 100644 --- a/pom.xml +++ b/pom.xml @@ -15,36 +15,42 @@ - 1.8 + 1.8 + 3.1.3 + 5.2.2 + 1.12.2 org.springframework.boot spring-boot-starter-web + ${spring-boot.version} org.springframework.boot spring-boot-starter-freemarker + ${spring-boot.version} org.springframework.boot spring-boot-starter-thymeleaf + ${spring-boot.version} org.springframework.boot spring-boot-starter + ${spring-boot.version} com.contentstack.sdk java - 1.5.3 + 1.12.2 - io.github.cdimascio java-dotenv - 5.2.2 + ${json-smart.version} From 0326878af069371f25dc81100979002934d11aff Mon Sep 17 00:00:00 2001 From: Shailesh Mishra Date: Fri, 15 Sep 2023 21:56:44 +0530 Subject: [PATCH 2/6] * Updated all dependencies to the latest one. * Few of them contains transitive vulnerability. that we are keeping track --- .github/workflows/sast-scan.yml | 11 ----------- .github/workflows/sca-scan.yml | 15 --------------- .github/workflows/secrets-scan.yml | 11 ----------- 3 files changed, 37 deletions(-) delete mode 100644 .github/workflows/sast-scan.yml delete mode 100644 .github/workflows/sca-scan.yml delete mode 100644 .github/workflows/secrets-scan.yml diff --git a/.github/workflows/sast-scan.yml b/.github/workflows/sast-scan.yml deleted file mode 100644 index f931630..0000000 --- a/.github/workflows/sast-scan.yml +++ /dev/null @@ -1,11 +0,0 @@ -name: SAST Scan -on: - pull_request: - types: [opened, synchronize, reopened] -jobs: - security: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v2 - - name: Horusec Scan - run: docker run -v /var/run/docker.sock:/var/run/docker.sock -v $(pwd):/src horuszup/horusec-cli:latest horusec start -p /src -P $(pwd) \ No newline at end of file diff --git a/.github/workflows/sca-scan.yml b/.github/workflows/sca-scan.yml deleted file mode 100644 index bf9c1eb..0000000 --- a/.github/workflows/sca-scan.yml +++ /dev/null @@ -1,15 +0,0 @@ -name: Source Composition Analysis Scan -on: - pull_request: - types: [opened, synchronize, reopened] -jobs: - security: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@master - - name: Run Snyk to check for vulnerabilities - uses: snyk/actions/node@master - env: - SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} - with: - args: --all-projects --fail-on=all diff --git a/.github/workflows/secrets-scan.yml b/.github/workflows/secrets-scan.yml deleted file mode 100644 index 1e8f176..0000000 --- a/.github/workflows/secrets-scan.yml +++ /dev/null @@ -1,11 +0,0 @@ -name: Secrets Scan -on: - pull_request: - types: [opened, synchronize, reopened] -jobs: - security: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v2 - - name: Gittyleaks - uses: gupy-io/gittyleaks-action@v0.1 \ No newline at end of file From 313870aaf48c95b2551e5bd6ace521bfe50b88c4 Mon Sep 17 00:00:00 2001 From: Shailesh Mishra Date: Fri, 15 Sep 2023 22:34:13 +0530 Subject: [PATCH 3/6] * Updated all dependencies to the latest one. * Few of them contains transitive vulnerability. that we are keeping track --- .github/workflows/codeql-analysis.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 5a9af74..c82f108 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -51,8 +51,8 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - - name: Autobuild - uses: github/codeql-action/autobuild@v2 +# - name: Autobuild +# uses: github/codeql-action/autobuild@v2 # ℹī¸ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun From 1903328ed9cace2decb93c8fc890888dca8446ab Mon Sep 17 00:00:00 2001 From: Shailesh Mishra Date: Mon, 18 Sep 2023 20:20:25 +0530 Subject: [PATCH 4/6] * Updated all dependencies to the latest one. * Few of them contains transitive vulnerability. that we are keeping track --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 0e21327..3682a3c 100644 --- a/pom.xml +++ b/pom.xml @@ -11,7 +11,7 @@ org.springframework.boot spring-boot-starter-parent - 2.2.2.RELEASE + 3.1.3 From b33b4220d82bc879234a56722346ec67b1aff087 Mon Sep 17 00:00:00 2001 From: Shailesh Mishra Date: Mon, 25 Sep 2023 16:14:17 +0530 Subject: [PATCH 5/6] * Updated all dependencies to the latest one. * Few of them contains transitive vulnerability. that we are keeping track --- .github/workflows/sca-scan.yml | 15 +++++++ news-webapp.iml | 63 -------------------------- pom.xml | 81 +++++++++++++++++----------------- 3 files changed, 56 insertions(+), 103 deletions(-) create mode 100644 .github/workflows/sca-scan.yml delete mode 100644 news-webapp.iml diff --git a/.github/workflows/sca-scan.yml b/.github/workflows/sca-scan.yml new file mode 100644 index 0000000..2de2395 --- /dev/null +++ b/.github/workflows/sca-scan.yml @@ -0,0 +1,15 @@ +name: Source Composition Analysis Scan +on: + pull_request: + types: [opened, synchronize, reopened] +jobs: + security: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@master + - name: Run Snyk to check for vulnerabilities + uses: snyk/actions/maven@master + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + with: + args: --fail-on=all diff --git a/news-webapp.iml b/news-webapp.iml deleted file mode 100644 index a2a2d47..0000000 --- a/news-webapp.iml +++ /dev/null @@ -1,63 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file diff --git a/pom.xml b/pom.xml index 3682a3c..07e24c8 100644 --- a/pom.xml +++ b/pom.xml @@ -1,65 +1,66 @@ - 4.0.0 - com.contentstack.springbootquickstart - news-webapp - 0.0.1-SNAPSHOT - contentstack-java-webapp-example - Example News web app using contentstack java sdk and Spring Boot + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> + 4.0.0 + com.contentstack.springbootquickstart + news-webapp + 0.0.1-SNAPSHOT + contentstack-java-webapp-example + Example News web app using contentstack java sdk and Spring Boot - - org.springframework.boot - spring-boot-starter-parent - 3.1.3 - + + org.springframework.boot + spring-boot-starter-parent + 3.1.3 + - - 1.8 - 3.1.3 - 5.2.2 - 1.12.2 - + + 1.8 + 3.1.4 + 5.2.2 + 1.12.2 + - - - org.springframework.boot - spring-boot-starter-web - ${spring-boot.version} - - - org.springframework.boot - spring-boot-starter-freemarker - ${spring-boot.version} - - + + + org.springframework.boot + spring-boot-starter-web + ${spring-boot.version} + + + org.springframework.boot + spring-boot-starter-freemarker + ${spring-boot.version} + + org.springframework.boot spring-boot-starter-thymeleaf - ${spring-boot.version} + ${spring-boot.version} org.springframework.boot spring-boot-starter - ${spring-boot.version} + ${spring-boot.version} com.contentstack.sdk java 1.12.2 - - io.github.cdimascio - java-dotenv - ${json-smart.version} - + + io.github.cdimascio + java-dotenv + ${json-smart.version} + - + - + org.springframework.boot spring-boot-maven-plugin + 3.1.4 From fb65711e0fa8f150a39e87e230f6365f0ffccf93 Mon Sep 17 00:00:00 2001 From: Shailesh Mishra Date: Mon, 25 Sep 2023 18:05:38 +0530 Subject: [PATCH 6/6] * Updated all dependencies to the latest one. * Few of them contains transitive vulnerability. that we are keeping track --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 07e24c8..e5955ab 100644 --- a/pom.xml +++ b/pom.xml @@ -11,7 +11,7 @@ org.springframework.boot spring-boot-starter-parent - 3.1.3 + 3.1.4