Skip to content
This repository was archived by the owner on Apr 22, 2025. It is now read-only.

Commit 861bd9b

Browse files
bestbeforetodaybestbeforetoday
authored
Dependency vulnerability scan in nightly build (#104)
- Update dependencies to latest versions. - Required Java 11+ to run checkstyle as v10 is not compatible with earlier Java versions. - Add testing with Java 17. Signed-off-by: Mark S. Lewis <[email protected]>
1 parent b57fa41 commit 861bd9b

File tree

3 files changed

+91
-32
lines changed

3 files changed

+91
-32
lines changed

‎azure-pipelines.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,9 @@ stages:
7070
Java11:
7171
versionSpec: '1.11'
7272
sslProvider: 'JDK'
73+
Java17:
74+
versionSpec: '17'
75+
sslProvider: 'JDK'
7376
steps:
7477
- task: Maven@3
7578
displayName: Maven build and run tests
@@ -109,3 +112,23 @@ stages:
109112
PROJECT_DIR: "$(Build.Repository.LocalPath)"
110113
STAGING_DIR: "$(Build.StagingDirectory)/gh-pages"
111114
SOURCE_BRANCH: "$(Build.SourceBranchName)"
115+
116+
# Only run security vulnerability scan on scheduled builds
117+
- stage: Scan
118+
dependsOn: []
119+
condition: eq(variables['Build.Reason'], 'Schedule')
120+
jobs:
121+
- job: ScanDependencies
122+
pool:
123+
vmImage: ubuntu-20.04
124+
dependsOn: []
125+
timeoutInMinutes: 60
126+
steps:
127+
- task: Maven@3
128+
displayName: 'Maven dependency-check'
129+
inputs:
130+
mavenPomFile: 'pom.xml'
131+
goals: '-P owasp dependency-check:check'
132+
- publish: $(System.DefaultWorkingDirectory)/target/dependency-check-report.html
133+
artifact: DependencyCheck
134+
displayName: 'Upload dependency-check report'

‎dependency-suppressions.xml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ Copyright 2022 IBM All Rights Reserved.
4+
~
5+
~ SPDX-License-Identifier: Apache-2.0
6+
-->
7+
8+
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
9+
<suppress>
10+
<notes><![CDATA[
11+
CVE was reported against @grpc/grpc-js npm package, not Java
12+
]]></notes>
13+
<packageUrl regex="true">^pkg:maven/io\.opentelemetry\.instrumentation/opentelemetry\-grpc\-1\.6@.*$</packageUrl>
14+
<cve>CVE-2020-7768</cve>
15+
</suppress>
16+
<suppress>
17+
<notes><![CDATA[
18+
CVE was reported in version 1.4-M1 to 1.4-RC and fixed in version 1.4.0
19+
]]></notes>
20+
<packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin\-stdlib\-common@1\.4\.0$</packageUrl>
21+
<cve>CVE-2020-15824</cve>
22+
</suppress>
23+
</suppressions>

‎pom.xml‎

Lines changed: 45 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@
9191
<dependency>
9292
<groupId>org.mockito</groupId>
9393
<artifactId>mockito-core</artifactId>
94-
<version>4.3.1</version>
94+
<version>4.4.0</version>
9595
<scope>test</scope>
9696
</dependency>
9797
<dependency>
@@ -114,7 +114,7 @@
114114
<dependency>
115115
<groupId>com.ibm.cloud</groupId>
116116
<artifactId>cloudant</artifactId>
117-
<version>0.0.34</version>
117+
<version>0.0.36</version>
118118
</dependency>
119119
</dependencies>
120120

@@ -260,35 +260,6 @@
260260
</execution>
261261
</executions>
262262
</plugin>
263-
<plugin>
264-
<groupId>org.apache.maven.plugins</groupId>
265-
<artifactId>maven-checkstyle-plugin</artifactId>
266-
<version>3.1.2</version>
267-
<configuration>
268-
<configLocation>checkstyle.xml</configLocation>
269-
<encoding>UTF-8</encoding>
270-
<consoleOutput>true</consoleOutput>
271-
<failsOnError>true</failsOnError>
272-
<linkXRef>false</linkXRef>
273-
<propertyExpansion>basedir=${project.basedir}</propertyExpansion>
274-
</configuration>
275-
<dependencies>
276-
<dependency>
277-
<groupId>com.puppycrawl.tools</groupId>
278-
<artifactId>checkstyle</artifactId>
279-
<version>9.3</version>
280-
</dependency>
281-
</dependencies>
282-
<executions>
283-
<execution>
284-
<id>compile</id>
285-
<phase>compile</phase>
286-
<goals>
287-
<goal>check</goal>
288-
</goals>
289-
</execution>
290-
</executions>
291-
</plugin>
292263
</plugins>
293264
</build>
294265

@@ -307,19 +278,61 @@
307278
</snapshotRepository>
308279
</distributionManagement>
309280
<profiles>
281+
<profile>
282+
<id>checkstyle</id>
283+
<activation>
284+
<jdk>[11,)</jdk>
285+
</activation>
286+
<build>
287+
<plugins>
288+
<plugin>
289+
<groupId>org.apache.maven.plugins</groupId>
290+
<artifactId>maven-checkstyle-plugin</artifactId>
291+
<version>3.1.2</version>
292+
<configuration>
293+
<configLocation>checkstyle.xml</configLocation>
294+
<encoding>UTF-8</encoding>
295+
<consoleOutput>true</consoleOutput>
296+
<failsOnError>true</failsOnError>
297+
<linkXRef>false</linkXRef>
298+
<propertyExpansion>basedir=${project.basedir}</propertyExpansion>
299+
</configuration>
300+
<dependencies>
301+
<dependency>
302+
<groupId>com.puppycrawl.tools</groupId>
303+
<artifactId>checkstyle</artifactId>
304+
<version>10.0</version>
305+
</dependency>
306+
</dependencies>
307+
<executions>
308+
<execution>
309+
<id>compile</id>
310+
<phase>compile</phase>
311+
<goals>
312+
<goal>check</goal>
313+
</goals>
314+
</execution>
315+
</executions>
316+
</plugin>
317+
</plugins>
318+
</build>
319+
</profile>
310320
<profile>
311321
<id>owasp</id>
312322
<build>
313323
<plugins>
314324
<plugin>
315325
<groupId>org.owasp</groupId>
316326
<artifactId>dependency-check-maven</artifactId>
317-
<version>6.5.2</version>
327+
<version>7.0.1</version>
318328
<configuration>
319329
<skipProvidedScope>true</skipProvidedScope>
320330
<skipTestScope>true</skipTestScope>
321331
<skipSystemScope>true</skipSystemScope>
322332
<failBuildOnCVSS>7</failBuildOnCVSS>
333+
<suppressionFiles>
334+
<suppressionFile>dependency-suppressions.xml</suppressionFile>
335+
</suppressionFiles>
323336
</configuration>
324337
<executions>
325338
<execution>

0 commit comments

Comments
 (0)