mirror of
https://github.com/open-metadata/OpenMetadata
synced 2026-05-24 09:39:11 +00:00
339b3dfb18
* fix(security): upgrade Java dependencies to resolve CRITICAL and HIGH CVEs
- jetty-http: 12.1.6 → 12.1.7 (HTTP Request Smuggling, CRITICAL)
- bcpkix/bcprov/bcutil-jdk18on: 1.80 → 1.84 (Crypto Signature Bypass + Timing Attack)
- postgresql: 42.7.7 → 42.7.11 (SCRAM-SHA-256 DoS)
- httpcore5-h2: pinned to 5.3.5 (HTTP/2 stream reset DoS)
- commons-compress: pinned to 1.26.0 (Infinite Loop DoS)
- jackson-core: 2.18.6 → 2.19.0 (async parser resource exhaustion)
- maven-shade-plugin: 3.5.1 → 3.6.0 (supports Java 22 MR-JAR in jackson-core 2.19.0)
- openapi-generator template override: jackson-version 2.17.1 → 2.19.0 in generated swagger pom
* fix(security): upgrade spring-web 6.2.11 → 6.2.18
* fix(security): align jackson-dataformat-yaml, feign, gson, logback versions
- jackson-dataformat-yaml: 2.17.2 → ${jackson.version} (2.19.0)
- feign-core: 13.2.1 → 13.5 (in openapi-gen template)
- gson: 2.10.1 → 2.11.0 (in openapi-gen template)
- logback-classic: 1.3.13 → 1.5.25 (in openapi-gen template)
* fix(security): use jackson 2.18.7 — highest clean 2.x with full ecosystem
2.19.0-2.21.0 all carry a HIGH (CVSS 8.7) vulnerability per Sonatype.
2.18.7 is the latest clean patch where all Jackson modules are released.
* fix(security): remove hardcoded jackson 2.17.2 override in k8s-operator, inherit 2.18.7 from root
* fix(security): upgrade gson 2.11.0 → 2.13.1 (Medium CVE)
* fix(security): replace 436-line pom.mustache with minimal stub
The openapi-generator-maven-plugin writes target/generated-sources/swagger/pom.xml
at build time with hardcoded jackson 2.17.1. Snyk --all-projects picks up every
pom.xml on disk and flags it as HIGH.
The generated pom.xml is never packaged into any JAR or Docker image — it is a
generator artefact. The actual runtime jackson version comes from the module pom
inheriting jackson.version=2.18.7 from the root. Replace the 436-line verbatim
upstream template (maintained just to change 2 version lines) with a 10-line
coordinate-only stub. The generated pom.xml will have no <dependencies> block,
so Snyk finds nothing to flag.
268 lines
11 KiB
XML
268 lines
11 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
|
|
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
|
|
<parent>
|
|
<artifactId>openmetadata-clients</artifactId>
|
|
<groupId>org.open-metadata</groupId>
|
|
<version>1.12.0-SNAPSHOT</version>
|
|
</parent>
|
|
<modelVersion>4.0.0</modelVersion>
|
|
|
|
<artifactId>openmetadata-java-client</artifactId>
|
|
<name>OpenMetadata Java Client</name>
|
|
<properties>
|
|
<java.version>21</java.version>
|
|
<maven.compiler.source>${java.version}</maven.compiler.source>
|
|
<maven.compiler.target>${java.version}</maven.compiler.target>
|
|
<springfox-version>2.7.0</springfox-version>
|
|
<feign-version>13.5</feign-version>
|
|
<jackson-databind-nullable-version>0.2.6</jackson-databind-nullable-version>
|
|
<scribejava-apis-version>8.3.3</scribejava-apis-version>
|
|
<swagger-parser-version>2.1.23</swagger-parser-version>
|
|
<jakarta-annotation-version>1.3.5</jakarta-annotation-version>
|
|
<maven-javadoc-plugin.version>3.6.0</maven-javadoc-plugin.version>
|
|
<maven-source-plugin.version>3.3.1</maven-source-plugin.version>
|
|
<sonar.skip>true</sonar.skip>
|
|
</properties>
|
|
<dependencies>
|
|
<dependency>
|
|
<groupId>org.open-metadata</groupId>
|
|
<artifactId>openmetadata-spec</artifactId>
|
|
<version>${project.version}</version>
|
|
</dependency>
|
|
<!-- FEIGN DEPENDENCY-->
|
|
<dependency>
|
|
<groupId>io.github.openfeign</groupId>
|
|
<artifactId>feign-core</artifactId>
|
|
<version>${feign-version}</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>io.github.openfeign</groupId>
|
|
<artifactId>feign-jackson</artifactId>
|
|
<version>${feign-version}</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>io.github.openfeign</groupId>
|
|
<artifactId>feign-slf4j</artifactId>
|
|
<version>${feign-version}</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>io.github.openfeign</groupId>
|
|
<artifactId>feign-okhttp</artifactId>
|
|
<version>${feign-version}</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>io.github.openfeign.form</groupId>
|
|
<artifactId>feign-form</artifactId>
|
|
<version>3.8.0</version>
|
|
</dependency>
|
|
<!-- FEIGN DEPENDENCY END -->
|
|
<dependency>
|
|
<groupId>org.openapitools</groupId>
|
|
<artifactId>jackson-databind-nullable</artifactId>
|
|
<version>${jackson-databind-nullable-version}</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>jakarta.annotation</groupId>
|
|
<artifactId>jakarta.annotation-api</artifactId>
|
|
<version>${jakarta-annotation-version}</version>
|
|
<scope>provided</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>io.swagger.parser.v3</groupId>
|
|
<artifactId>swagger-parser</artifactId>
|
|
<version>${swagger-parser-version}</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.github.scribejava</groupId>
|
|
<artifactId>scribejava-apis</artifactId>
|
|
<version>${scribejava-apis-version}</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.google.auth</groupId>
|
|
<artifactId>google-auth-library-oauth2-http</artifactId>
|
|
<version>1.29.0</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.microsoft.azure</groupId>
|
|
<artifactId>msal4j</artifactId>
|
|
<version>1.17.2</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.projectlombok</groupId>
|
|
<artifactId>lombok</artifactId>
|
|
</dependency>
|
|
<!-- TEST -->
|
|
<dependency>
|
|
<groupId>junit</groupId>
|
|
<artifactId>junit</artifactId>
|
|
<version>4.13.2</version>
|
|
</dependency>
|
|
|
|
<!--avoid security issue https://security.snyk.io/vuln/SNYK-JAVA-ORGMOZILLA-1314295-->
|
|
<dependency>
|
|
<groupId>org.mozilla</groupId>
|
|
<artifactId>rhino</artifactId>
|
|
<version>1.7.15.1</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.junit.jupiter</groupId>
|
|
<artifactId>junit-jupiter-api</artifactId>
|
|
<version>${org.junit.jupiter.version}</version>
|
|
<scope>compile</scope>
|
|
</dependency>
|
|
</dependencies>
|
|
|
|
<profiles>
|
|
<profile>
|
|
<id>release</id>
|
|
<build>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-source-plugin</artifactId>
|
|
<version>${maven-source-plugin.version}</version>
|
|
<executions>
|
|
<execution>
|
|
<id>attach-sources</id>
|
|
<goals>
|
|
<goal>jar-no-fork</goal>
|
|
</goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-javadoc-plugin</artifactId>
|
|
<version>${maven-javadoc-plugin.version}</version>
|
|
<configuration>
|
|
<doclint>none</doclint>
|
|
</configuration>
|
|
<executions>
|
|
<execution>
|
|
<id>attach-javadocs</id>
|
|
<goals>
|
|
<goal>jar</goal>
|
|
</goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-gpg-plugin</artifactId>
|
|
<version>3.0.1</version>
|
|
<executions>
|
|
<execution>
|
|
<id>sign-artifacts</id>
|
|
<phase>verify</phase>
|
|
<goals>
|
|
<goal>sign</goal>
|
|
</goals>
|
|
<configuration>
|
|
<gpgArguments>
|
|
<arg>--pinentry-mode</arg>
|
|
<arg>loopback</arg>
|
|
</gpgArguments>
|
|
</configuration>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
</profile>
|
|
</profiles>
|
|
|
|
<build>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-dependency-plugin</artifactId>
|
|
<executions>
|
|
<execution>
|
|
<id>analyze</id>
|
|
<goals>
|
|
<goal>analyze-only</goal>
|
|
</goals>
|
|
<configuration>
|
|
<ignoredDependencies>
|
|
<ignoredDependency>org.projectlombok:lombok</ignoredDependency>
|
|
</ignoredDependencies>
|
|
</configuration>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<!--Reformat Code to comply with Google Java Style -->
|
|
<plugin>
|
|
<groupId>com.theoryinpractise</groupId>
|
|
<artifactId>googleformatter-maven-plugin</artifactId>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-source-plugin</artifactId>
|
|
<version>${maven-source-plugin.version}</version>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.codehaus.mojo</groupId>
|
|
<artifactId>buildnumber-maven-plugin</artifactId>
|
|
<version>3.0.0</version>
|
|
<configuration>
|
|
<doCheck>false</doCheck>
|
|
<doUpdate>false</doUpdate>
|
|
<outputDirectory>${project.build.directory}/classes/catalog</outputDirectory>
|
|
<outputName>VERSION</outputName>
|
|
</configuration>
|
|
<executions>
|
|
<execution>
|
|
<phase>generate-resources</phase>
|
|
<goals>
|
|
<goal>create-metadata</goal>
|
|
</goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.openapitools</groupId>
|
|
<artifactId>openapi-generator-maven-plugin</artifactId>
|
|
<version>7.13.0</version>
|
|
<executions>
|
|
<execution>
|
|
<goals>
|
|
<goal>generate</goal>
|
|
</goals>
|
|
<configuration>
|
|
<inputSpec>${project.basedir}/../../openmetadata-service/target/classes/assets/swagger.yaml</inputSpec>
|
|
<generatorName>java</generatorName>
|
|
<library>feign</library>
|
|
<apiPackage>org.openmetadata.client.api</apiPackage>
|
|
<modelPackage>org.openmetadata.client.model</modelPackage>
|
|
<output>
|
|
${project.build.directory}/generated-sources/swagger
|
|
</output>
|
|
<skipOperationExample>true</skipOperationExample>
|
|
<skipValidateSpec>true</skipValidateSpec>
|
|
<templateDirectory>${project.basedir}/src/main/openapi-templates</templateDirectory>
|
|
</configuration>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<artifactId>maven-assembly-plugin</artifactId>
|
|
<executions>
|
|
<execution>
|
|
<phase>package</phase>
|
|
<goals>
|
|
<goal>single</goal>
|
|
</goals>
|
|
</execution>
|
|
</executions>
|
|
<configuration>
|
|
<descriptorRefs>
|
|
<descriptorRef>jar-with-dependencies</descriptorRef>
|
|
</descriptorRefs>
|
|
</configuration>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
|
|
</project>
|