feat: Update dependencies in hale-platform to resolve security issues

[emanuelaepure10]

update slf4jAndLogback from 1.0.13 to 1.2.12

ING-4067

[stempler]

Did you perform any tests using an update site your changes for hale studio? What were the results?

Generally the main part of the process of updating/changing the dependencies in the platform is testing these changes in hale studio and applying the related changes/fixes the both the platform and hale studio.

Before merging changes here we need to make sure they have been validated with hale studio. Otherwise we end up with a state in hale-platform that someone else could not work with without resolving the related issues first.

[stempler]

Did changing logback to 1.2.12 cause any problems?

[emanuelaepure10]

Why should I change it to a lower version?

[stempler]

The first version is the SLF4J version, with you changes at 1.7.25, the second version is the logback version, now at 1.0.13.

[emanuelaepure10]

Did you perform any tests using an update site your changes for hale studio? What were the results?

I haven't. As I couldn't conclude successfully the process of updating the resource bundles.
To have an update site changed with this changes I should have a commit in bnb platform. Can I just create a Pr for testing proposes?

[stempler]

@emanuelaepure10

To have an update site changed with this changes I should have a commit in bnb platform. Can I just create a Pr for testing proposes?

Do you mean hale-build-support?
If you want to do tests with commits there then please create a fork of the repository in GitLab and push your changes to a branch there. That way we can avoid changes used for testing to make it into the main repository, which is already quite big.
A faster way is usually still to test directly in Eclipse. What I always do is the following:

1. Perform the hale-platform build
2. Rename the updatesite folder in hale-platform/build to something unique (e.g. append date and an increasing number each time), to avoid any issues with Eclipse caching for the location
3. Replace the target platform update site in the .target file with the local renamed updatesite folder (file:/ url) and load the target platform from there
4. Validate HALE.product to look for problems and look into Target Platform state view for details

[emanuelaepure10]

Right! I can use a local folder. I'll do that.
Thank you for the workflow.

[emanuelaepure10]

L.E. I have it
I forgot to check

1. build successful
2. rename folder to updatesite20231107
3. change .target to

<repository location="file:/C:/Users/EmanuelaEpure/Documents/GitHub/hale-platform-update/hale-platform/build/updatesite20231107"/>
<unit id="eu.esdihumboldt.hale.platform.feature.group" version="4.1.0.i20231107"/>

Not sure how to change the version...if I just change the date I get

@stempler also with a 5 i still see the problem

Any thoughts on what should I change?
Thank you

[stempler]

Any thoughts on what should I change?

@emanuelaepure10 When you use the Eclipse editor for the target file (not editing the source XML) you should be able to edit the update site entry, and in the dialog that opens then select the item that is actually contained in the update site.

[emanuelaepure10]

@stempler Thank you.
I wrote the later update...that I have forgot to select the HALE target platform libraries.

[emanuelaepure10]

Open points where I would need help to solve them:

1. upgrading jetty from jettyVersion = '9.2.1.v20140609' to ''9.4.53.v20231009'. Also this in the bundleArtifactMap.json should be changed?

2. remove commons-fileupload, openid4java, recaptcha4j and everything related to Wicket

3. Upgrade (or maybe follow up tickets)

modules/shared/orientdb.gradle
modules/shared/spring.gradle
modules/shared/postgis.gradle

which are giving problems.

4. How to solve the following:

4.1. // force package export versions for hsqldb
bnd group: 'org.hsqldb', name: 'hsqldb', {
instruction 'Export-Package', ";version=$version"
}
4.2. // force correct package export versions for sqlite-jdbc
bnd group: 'org.xerial', name: 'sqlite-jdbc', {
instruction 'Export-Package', ";version=$version"
}
4.3.// make OSGi JDBC service import optional
bnd group: 'com.h2database', name: 'h2', {
optionalImport 'org.osgi.service.jdbc'
}
4.4.// security
bundle 'org.jasig.cas:cas-client:3.1.10'

5. and last but the most important springframework

Thank you

[stempler]

Can you please again include the update to logback from 1.0.13 to 1.2.12? Thank you