Skip to content

Commit f7ca3b8

Browse files
lucy66hwlucy66hw
committed
Upgrade dependencies to address security vulnerabilities
Signed-off-by: xil <fridalu66@gmail.com>
1 parent 4a4f73e commit f7ca3b8

3 files changed

Lines changed: 134 additions & 14 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,4 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
1515
### Fixed
1616

1717
### Security
18+
- Upgrade dependencies to address security vulnerabilities ([#368](https://github.com/opensearch-project/opensearch-protobufs/pull/368))

‎WORKSPACE‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -136,20 +136,23 @@ load("@io_grpc_grpc_java//:repositories.bzl", "IO_GRPC_GRPC_JAVA_ARTIFACTS", "IO
136136

137137
maven_install(
138138
artifacts = IO_GRPC_GRPC_JAVA_ARTIFACTS + [
139-
# Security fixes: Force newer Netty versions to address vulnerabilities
140-
"io.netty:netty-common:4.1.118.Final",
141-
"io.netty:netty-buffer:4.1.125.Final",
142-
"io.netty:netty-codec:4.1.125.Final",
143-
"io.netty:netty-codec-http:4.1.125.Final",
144-
"io.netty:netty-codec-http2:4.1.125.Final",
145-
"io.netty:netty-codec-socks:4.1.125.Final",
146-
"io.netty:netty-handler:4.1.118.Final",
147-
"io.netty:netty-handler-proxy:4.1.125.Final",
148-
"io.netty:netty-resolver:4.1.125.Final",
149-
"io.netty:netty-transport:4.1.125.Final",
150-
"io.netty:netty-transport-native-unix-common:4.1.125.Final",
151-
# Force secure Guava version
152-
"com.google.guava:guava:32.0.1-android",
139+
"io.netty:netty-common:4.1.127.Final",
140+
"io.netty:netty-buffer:4.1.127.Final",
141+
"io.netty:netty-codec:4.1.127.Final",
142+
"io.netty:netty-codec-http:4.1.127.Final",
143+
"io.netty:netty-codec-http2:4.1.127.Final",
144+
"io.netty:netty-codec-socks:4.1.127.Final",
145+
"io.netty:netty-handler:4.1.127.Final",
146+
"io.netty:netty-handler-proxy:4.1.127.Final",
147+
"io.netty:netty-resolver:4.1.127.Final",
148+
"io.netty:netty-transport:4.1.127.Final",
149+
"io.netty:netty-transport-native-unix-common:4.1.127.Final",
150+
"com.squareup.okio:okio:3.9.1",
151+
"com.squareup.okio:okio-jvm:3.9.1",
152+
"com.google.auth:google-auth-library-oauth2-http:1.30.0",
153+
"com.google.auth:google-auth-library-credentials:1.30.0",
154+
"junit:junit:4.13.2",
155+
"com.google.guava:guava:33.2.1-jre",
153156
],
154157
generate_compat_repositories = True,
155158
override_targets = IO_GRPC_GRPC_JAVA_OVERRIDE_TARGETS,

‎pom.xml‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
This pom.xml is used for dependency scanning by security tools (Mend, Dependabot).
4+
The actual build uses Bazel (WORKSPACE file). Keep versions in sync with WORKSPACE.
5+
-->
6+
<project xmlns="http://maven.apache.org/POM/4.0.0"
7+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
8+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
9+
<modelVersion>4.0.0</modelVersion>
10+
<groupId>org.opensearch</groupId>
11+
<artifactId>opensearch-protobufs-deps</artifactId>
12+
<version>1.0.0</version>
13+
<packaging>pom</packaging>
14+
<name>OpenSearch Protobufs Dependencies</name>
15+
<description>Dependency declarations for security scanning - actual build uses Bazel</description>
16+
17+
<properties>
18+
<netty.version>4.1.127.Final</netty.version>
19+
<grpc.version>1.70.0</grpc.version>
20+
<protobuf.version>3.25.8</protobuf.version>
21+
<guava.version>33.2.1-jre</guava.version>
22+
<okio.version>3.9.1</okio.version>
23+
<google-auth.version>1.30.0</google-auth.version>
24+
<junit.version>4.13.2</junit.version>
25+
</properties>
26+
27+
<dependencyManagement>
28+
<dependencies>
29+
<!-- Netty - pinned to fix CVE-2024-47535 -->
30+
<dependency>
31+
<groupId>io.netty</groupId>
32+
<artifactId>netty-bom</artifactId>
33+
<version>${netty.version}</version>
34+
<type>pom</type>
35+
<scope>import</scope>
36+
</dependency>
37+
</dependencies>
38+
</dependencyManagement>
39+
40+
<dependencies>
41+
<!-- gRPC -->
42+
<dependency>
43+
<groupId>io.grpc</groupId>
44+
<artifactId>grpc-stub</artifactId>
45+
<version>${grpc.version}</version>
46+
</dependency>
47+
<dependency>
48+
<groupId>io.grpc</groupId>
49+
<artifactId>grpc-protobuf</artifactId>
50+
<version>${grpc.version}</version>
51+
</dependency>
52+
<dependency>
53+
<groupId>io.grpc</groupId>
54+
<artifactId>grpc-netty</artifactId>
55+
<version>${grpc.version}</version>
56+
</dependency>
57+
58+
<!-- Protobuf -->
59+
<dependency>
60+
<groupId>com.google.protobuf</groupId>
61+
<artifactId>protobuf-java</artifactId>
62+
<version>${protobuf.version}</version>
63+
</dependency>
64+
65+
<!-- Guava -->
66+
<dependency>
67+
<groupId>com.google.guava</groupId>
68+
<artifactId>guava</artifactId>
69+
<version>${guava.version}</version>
70+
</dependency>
71+
72+
<!-- Okio - pinned to fix CVE-2023-3635 -->
73+
<dependency>
74+
<groupId>com.squareup.okio</groupId>
75+
<artifactId>okio</artifactId>
76+
<version>${okio.version}</version>
77+
</dependency>
78+
79+
<!-- Google Auth - pinned to fix multiple CVEs -->
80+
<dependency>
81+
<groupId>com.google.auth</groupId>
82+
<artifactId>google-auth-library-oauth2-http</artifactId>
83+
<version>${google-auth.version}</version>
84+
</dependency>
85+
<dependency>
86+
<groupId>com.google.auth</groupId>
87+
<artifactId>google-auth-library-credentials</artifactId>
88+
<version>${google-auth.version}</version>
89+
</dependency>
90+
91+
<!-- JUnit - pinned to fix CVE-2020-15250 -->
92+
<dependency>
93+
<groupId>junit</groupId>
94+
<artifactId>junit</artifactId>
95+
<version>${junit.version}</version>
96+
<scope>test</scope>
97+
</dependency>
98+
99+
<!-- Netty components explicitly declared -->
100+
<dependency>
101+
<groupId>io.netty</groupId>
102+
<artifactId>netty-codec-http</artifactId>
103+
<version>${netty.version}</version>
104+
</dependency>
105+
<dependency>
106+
<groupId>io.netty</groupId>
107+
<artifactId>netty-codec-http2</artifactId>
108+
<version>${netty.version}</version>
109+
</dependency>
110+
<dependency>
111+
<groupId>io.netty</groupId>
112+
<artifactId>netty-handler</artifactId>
113+
<version>${netty.version}</version>
114+
</dependency>
115+
</dependencies>
116+
</project>

0 commit comments

Comments
 (0)