Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix| new dependabot multiple security issue fix #163

Merged
merged 12 commits into from
May 27, 2024
Merged
5 changes: 5 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,11 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),

## [Unreleased]

### Added
- Support Portal autosetup latest workflow.
- Support SDE, Digital twin, EDC 7 support 24/05 release.

### Fixed
- Dependabot reported security issues fixed.

Expand Down
48 changes: 43 additions & 5 deletions DEPENDENCIES
Original file line number Diff line number Diff line change
Expand Up @@ -11,11 +11,17 @@ maven/mavencentral/com.fasterxml.jackson.module/jackson-module-parameter-names/2
maven/mavencentral/com.fasterxml/classmate/1.6.0, Apache-2.0, approved, clearlydefined
maven/mavencentral/com.github.stephenc.jcip/jcip-annotations/1.0-1, Apache-2.0, approved, CQ21949
maven/mavencentral/com.google.code.gson/gson/2.10.1, Apache-2.0, approved, #6159
maven/mavencentral/com.h2database/h2/2.2.224, (EPL-1.0 OR MPL-2.0) AND (LGPL-3.0-or-later OR EPL-1.0 OR MPL-2.0), approved, #9322
maven/mavencentral/com.jayway.jsonpath/json-path/2.9.0, Apache-2.0, approved, clearlydefined
maven/mavencentral/com.nimbusds/content-type/2.2, Apache-2.0, approved, clearlydefined
maven/mavencentral/com.nimbusds/lang-tag/1.7, Apache-2.0, approved, clearlydefined
maven/mavencentral/com.nimbusds/nimbus-jose-jwt/9.24.4, Apache-2.0, approved, clearlydefined
maven/mavencentral/com.nimbusds/oauth2-oidc-sdk/9.43.3, Apache-2.0, approved, clearlydefined
maven/mavencentral/com.sun.istack/istack-commons-runtime/4.1.2, BSD-3-Clause, approved, #2590
maven/mavencentral/com.sun.mail/javax.mail/1.6.2, CDDL-1.0 AND Apache-2.0, approved, CQ18739
maven/mavencentral/com.sun.xml.bind/jaxb-core/4.0.5, BSD-3-Clause, approved, ee4j.jaxb-impl
maven/mavencentral/com.sun.xml.bind/jaxb-xjc/4.0.5, BSD-3-Clause, approved, ee4j.jaxb-impl
maven/mavencentral/com.vaadin.external.google/android-json/0.0.20131108.vaadin1, Apache-2.0, approved, CQ21310
maven/mavencentral/com.zaxxer/HikariCP/5.0.1, Apache-2.0, approved, clearlydefined
maven/mavencentral/commons-codec/commons-codec/1.16.1, Apache-2.0 AND (Apache-2.0 AND BSD-3-Clause), approved, #9157
maven/mavencentral/commons-fileupload/commons-fileupload/1.5, Apache-2.0, approved, #7109
Expand All @@ -26,16 +32,20 @@ maven/mavencentral/io.github.openfeign/feign-core/13.2.1, Apache-2.0, approved,
maven/mavencentral/io.github.openfeign/feign-slf4j/13.2.1, Apache-2.0, approved, clearlydefined
maven/mavencentral/io.micrometer/micrometer-commons/1.12.5, Apache-2.0 AND (Apache-2.0 AND MIT), approved, #11679
maven/mavencentral/io.micrometer/micrometer-observation/1.12.5, Apache-2.0, approved, #11680
maven/mavencentral/io.smallrye/jandex/3.1.2, Apache-2.0, approved, clearlydefined
maven/mavencentral/io.swagger.core.v3/swagger-annotations-jakarta/2.2.21, Apache-2.0, approved, #5947
maven/mavencentral/io.swagger.core.v3/swagger-core-jakarta/2.2.21, Apache-2.0, approved, #5929
maven/mavencentral/io.swagger.core.v3/swagger-models-jakarta/2.2.21, Apache-2.0, approved, #5919
maven/mavencentral/jakarta.activation/jakarta.activation-api/2.1.2, EPL-2.0 OR BSD-3-Clause OR GPL-2.0-only with Classpath-exception-2.0, approved, ee4j.jaf
maven/mavencentral/jakarta.annotation/jakarta.annotation-api/2.1.1, EPL-2.0 OR GPL-2.0-only with Classpath-exception-2.0, approved, ee4j.ca
maven/mavencentral/jakarta.inject/jakarta.inject-api/2.0.1, Apache-2.0, approved, ee4j.cdi
maven/mavencentral/jakarta.persistence/jakarta.persistence-api/3.1.0, EPL-2.0 OR BSD-3-Clause, approved, ee4j.jpa
maven/mavencentral/jakarta.transaction/jakarta.transaction-api/2.0.1, EPL-2.0 OR GPL-2.0-only with Classpath-exception-2.0, approved, ee4j.jta
maven/mavencentral/jakarta.validation/jakarta.validation-api/3.0.2, Apache-2.0, approved, ee4j.validation
maven/mavencentral/jakarta.xml.bind/jakarta.xml.bind-api/4.0.2, BSD-3-Clause, approved, ee4j.jaxb
maven/mavencentral/javax.activation/activation/1.1, CDDL-1.0, approved, CQ134
maven/mavencentral/net.bytebuddy/byte-buddy-agent/1.14.13, Apache-2.0, approved, #7164
maven/mavencentral/net.bytebuddy/byte-buddy/1.14.13, Apache-2.0 AND BSD-3-Clause, approved, #7163
maven/mavencentral/net.minidev/accessors-smart/2.5.1, Apache-2.0, approved, clearlydefined
maven/mavencentral/net.minidev/json-smart/2.5.1, Apache-2.0, approved, clearlydefined
maven/mavencentral/org.antlr/antlr4-runtime/4.13.0, BSD-3-Clause, approved, #10767
Expand All @@ -46,27 +56,50 @@ maven/mavencentral/org.apache.logging.log4j/log4j-to-slf4j/2.17.1, Apache-2.0, a
maven/mavencentral/org.apache.tomcat.embed/tomcat-embed-core/10.1.20, Apache-2.0 AND (EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0) AND (CDDL-1.0 OR GPL-2.0-only WITH Classpath-exception-2.0) AND W3C AND CC0-1.0, approved, #5949
maven/mavencentral/org.apache.tomcat.embed/tomcat-embed-el/10.1.20, Apache-2.0, approved, #6997
maven/mavencentral/org.apache.tomcat.embed/tomcat-embed-websocket/10.1.20, Apache-2.0, approved, #7920
maven/mavencentral/org.apiguardian/apiguardian-api/1.1.2, Apache-2.0, approved, clearlydefined
maven/mavencentral/org.aspectj/aspectjweaver/1.9.22, Apache-2.0 AND BSD-3-Clause AND EPL-1.0 AND BSD-3-Clause AND Apache-1.1, approved, #7695
maven/mavencentral/org.bouncycastle/bcpkix-jdk18on/1.77, MIT, approved, #11593
maven/mavencentral/org.bouncycastle/bcprov-jdk18on/1.77, MIT AND CC0-1.0, approved, #11595
maven/mavencentral/org.bouncycastle/bcutil-jdk18on/1.77, MIT, approved, #11596
maven/mavencentral/org.eclipse.persistence/eclipselink/3.0.3, EPL-2.0 OR BSD-3-Clause, approved, ee4j.eclipselink

maven/mavencentral/org.assertj/assertj-core/3.24.2, Apache-2.0, approved, #6161
maven/mavencentral/org.awaitility/awaitility/4.2.1, Apache-2.0, approved, #14178
maven/mavencentral/org.bouncycastle/bcpkix-jdk18on/1.78.1, MIT, approved, #14434
maven/mavencentral/org.bouncycastle/bcprov-jdk18on/1.78.1, MIT AND CC0-1.0, approved, #14433
maven/mavencentral/org.bouncycastle/bcutil-jdk18on/1.78.1, MIT, approved, #14435
maven/mavencentral/org.checkerframework/checker-qual/3.42.0, MIT, approved, clearlydefined
maven/mavencentral/org.eclipse.angus/angus-activation/2.0.2, EPL-2.0 OR GPL-2.0-only with Classpath-exception-2.0, approved, ee4j.angus
maven/mavencentral/org.eclipse.persistence/eclipselink/4.0.3, EPL-2.0 OR BSD-3-Clause, approved, ee4j.eclipselink
maven/mavencentral/org.flywaydb/flyway-core/9.22.3, Apache-2.0, approved, #10349
maven/mavencentral/org.freemarker/freemarker/2.3.32, Apache-2.0, approved, #6764
maven/mavencentral/org.glassfish.jaxb/jaxb-core/4.0.5, BSD-3-Clause, approved, ee4j.jaxb-impl
maven/mavencentral/org.glassfish.jaxb/jaxb-runtime/4.0.5, BSD-3-Clause, approved, ee4j.jaxb-impl
maven/mavencentral/org.glassfish.jaxb/txw2/4.0.5, BSD-3-Clause, approved, ee4j.jaxb-impl
maven/mavencentral/org.hamcrest/hamcrest/2.2, BSD-3-Clause, approved, clearlydefined
maven/mavencentral/org.hibernate.common/hibernate-commons-annotations/6.0.6.Final, LGPL-2.1-only, approved, #6962
maven/mavencentral/org.hibernate.orm/hibernate-core/6.4.4.Final, LGPL-2.1-or-later AND (EPL-2.0 OR BSD-3-Clause) AND MIT, approved, #12490
maven/mavencentral/org.hibernate.validator/hibernate-validator/8.0.1.Final, Apache-2.0, approved, clearlydefined
maven/mavencentral/org.jboss.logging/jboss-logging/3.5.3.Final, Apache-2.0, approved, #9471
maven/mavencentral/org.mapstruct/mapstruct/1.4.2.Final, Apache-2.0, approved, #2483
maven/mavencentral/org.junit.jupiter/junit-jupiter-api/5.10.2, EPL-2.0, approved, #9714
maven/mavencentral/org.junit.jupiter/junit-jupiter-engine/5.10.2, EPL-2.0, approved, #9711
maven/mavencentral/org.junit.jupiter/junit-jupiter-params/5.10.2, EPL-2.0, approved, #9708
maven/mavencentral/org.junit.jupiter/junit-jupiter/5.10.2, EPL-2.0, approved, #13393
maven/mavencentral/org.junit.platform/junit-platform-commons/1.10.2, EPL-2.0, approved, #9715
maven/mavencentral/org.junit.platform/junit-platform-engine/1.10.2, EPL-2.0, approved, #9709
maven/mavencentral/org.mapstruct/mapstruct/1.5.5.Final, Apache-2.0, approved, #6277
maven/mavencentral/org.mockito/mockito-core/5.7.0, MIT AND (Apache-2.0 AND MIT) AND Apache-2.0, approved, #11424
maven/mavencentral/org.mockito/mockito-junit-jupiter/5.7.0, MIT, approved, #11423
maven/mavencentral/org.objenesis/objenesis/3.3, Apache-2.0, approved, clearlydefined
maven/mavencentral/org.opentest4j/opentest4j/1.3.0, Apache-2.0, approved, #9713
maven/mavencentral/org.ow2.asm/asm/9.6, BSD-3-Clause, approved, #10776
maven/mavencentral/org.postgresql/postgresql/42.7.3, BSD-2-Clause AND Apache-2.0, approved, #11681
maven/mavencentral/org.projectlombok/lombok/1.18.32, MIT AND LicenseRef-Public-Domain, approved, CQ23907
maven/mavencentral/org.skyscreamer/jsonassert/1.5.1, Apache-2.0, approved, clearlydefined
maven/mavencentral/org.slf4j/jul-to-slf4j/2.0.13, MIT, approved, #7698
maven/mavencentral/org.slf4j/slf4j-api/2.0.13, MIT, approved, #5915
maven/mavencentral/org.springdoc/springdoc-openapi-starter-common/2.5.0, Apache-2.0, approved, clearlydefined
maven/mavencentral/org.springdoc/springdoc-openapi-starter-webmvc-api/2.5.0, Apache-2.0, approved, clearlydefined
maven/mavencentral/org.springdoc/springdoc-openapi-starter-webmvc-ui/2.5.0, Apache-2.0, approved, clearlydefined
maven/mavencentral/org.springframework.boot/spring-boot-autoconfigure/3.2.5, Apache-2.0, approved, #11751
maven/mavencentral/org.springframework.boot/spring-boot-configuration-processor/3.2.5, Apache-2.0, approved, #12915
maven/mavencentral/org.springframework.boot/spring-boot-devtools/3.2.5, Apache-2.0, approved, clearlydefined
maven/mavencentral/org.springframework.boot/spring-boot-starter-aop/3.2.5, Apache-2.0, approved, #11928
maven/mavencentral/org.springframework.boot/spring-boot-starter-data-jpa/3.2.5, Apache-2.0, approved, #11926
maven/mavencentral/org.springframework.boot/spring-boot-starter-freemarker/3.1.6, Apache-2.0, approved, clearlydefined
Expand All @@ -76,10 +109,13 @@ maven/mavencentral/org.springframework.boot/spring-boot-starter-logging/3.2.5, A
maven/mavencentral/org.springframework.boot/spring-boot-starter-oauth2-client/3.2.5, Apache-2.0, approved, #12587
maven/mavencentral/org.springframework.boot/spring-boot-starter-oauth2-resource-server/3.2.5, Apache-2.0, approved, #11931
maven/mavencentral/org.springframework.boot/spring-boot-starter-security/3.2.5, Apache-2.0, approved, #12069
maven/mavencentral/org.springframework.boot/spring-boot-starter-test/3.2.5, Apache-2.0, approved, #12917
maven/mavencentral/org.springframework.boot/spring-boot-starter-tomcat/3.2.5, Apache-2.0, approved, #11923
maven/mavencentral/org.springframework.boot/spring-boot-starter-validation/3.2.5, Apache-2.0, approved, #12921
maven/mavencentral/org.springframework.boot/spring-boot-starter-web/3.2.5, Apache-2.0, approved, #11916
maven/mavencentral/org.springframework.boot/spring-boot-starter/3.2.5, Apache-2.0, approved, #11935
maven/mavencentral/org.springframework.boot/spring-boot-test-autoconfigure/3.2.5, Apache-2.0, approved, #12920
maven/mavencentral/org.springframework.boot/spring-boot-test/3.2.5, Apache-2.0, approved, #12916
maven/mavencentral/org.springframework.boot/spring-boot/3.2.5, Apache-2.0, approved, #11752
maven/mavencentral/org.springframework.cloud/spring-cloud-commons/4.1.2, Apache-2.0, approved, #13495
maven/mavencentral/org.springframework.cloud/spring-cloud-context/4.1.2, Apache-2.0, approved, #13494
Expand Down Expand Up @@ -108,8 +144,10 @@ maven/mavencentral/org.springframework/spring-expression/6.1.6, Apache-2.0, appr
maven/mavencentral/org.springframework/spring-jcl/6.1.6, Apache-2.0, approved, #11749
maven/mavencentral/org.springframework/spring-jdbc/6.1.6, Apache-2.0, approved, #11897
maven/mavencentral/org.springframework/spring-orm/6.1.6, Apache-2.0, approved, #11924
maven/mavencentral/org.springframework/spring-test/6.1.6, Apache-2.0, approved, #12919
maven/mavencentral/org.springframework/spring-tx/6.1.6, Apache-2.0, approved, #11901
maven/mavencentral/org.springframework/spring-web/6.1.6, Apache-2.0, approved, #11748
maven/mavencentral/org.springframework/spring-webmvc/6.1.6, Apache-2.0, approved, #11879
maven/mavencentral/org.webjars/swagger-ui/5.13.0, Apache-2.0, approved, #14547
maven/mavencentral/org.xmlunit/xmlunit-core/2.9.1, Apache-2.0, approved, #6272
maven/mavencentral/org.yaml/snakeyaml/2.2, Apache-2.0 AND (Apache-2.0 OR BSD-3-Clause OR EPL-1.0 OR GPL-2.0-or-later OR LGPL-2.1-or-later), approved, #10232
48 changes: 25 additions & 23 deletions pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -38,16 +38,16 @@
<properties>
<java.version>17</java.version>
<spring-cloud.version>4.1.1</spring-cloud.version>
<org.mapstruct.version>1.4.2.Final</org.mapstruct.version>
<org.mapstruct.processor.version>1.4.2.Final
<org.mapstruct.version>1.5.5.Final</org.mapstruct.version>
<org.mapstruct.processor.version>1.5.5.Final
</org.mapstruct.processor.version>
<log4j2.version>2.17.1</log4j2.version>
</properties>
<dependencies>
<dependency>
<groupId>org.eclipse.persistence</groupId>
<artifactId>eclipselink</artifactId>
<version>3.0.3</version>
<version>4.0.3</version>
<exclusions>
<exclusion>
<groupId>org.eclipse.persistence</groupId>
Expand Down Expand Up @@ -187,7 +187,6 @@
<artifactId>bcpkix-jdk18on</artifactId>
</dependency>
</dependencies>

<dependencyManagement>
<dependencies>
<dependency>
Expand All @@ -213,17 +212,17 @@
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk18on</artifactId>
<version>1.77</version>
<version>1.78.1</version>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk18on</artifactId>
<version>1.77</version>
<version>1.78.1</version>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-compress</artifactId>
<version>1.26.1</version>
<version>1.26.2</version>
</dependency>
<dependency>
<groupId>commons-io</groupId>
Expand Down Expand Up @@ -319,22 +318,25 @@
</configuration>
</plugin>
<plugin>
<groupId>org.eclipse.dash</groupId>
<artifactId>license-tool-plugin</artifactId>
<version>1.0.3-SNAPSHOT</version>
<executions>
<execution>
<id>license-check</id>
<goals>
<goal>license-check</goal>
</goals>
</execution>
</executions>
<configuration>
<projectId>automotive.tractusx</projectId>
<summary>DEPENDENCIES</summary>
</configuration>
</plugin>
<groupId>org.eclipse.dash</groupId>
<artifactId>license-tool-plugin</artifactId>
<version>1.1.1-SNAPSHOT</version>
<configuration>
<projectId>automotive.tractusx</projectId>
<!-- name of dependencies file -->
<summary>DEPENDENCIES</summary>
<!-- include test dependencies -->
<includeScope>test</includeScope>
</configuration>
<executions>
<execution>
<id>license-check</id>
<goals>
<goal>license-check</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
<repositories>
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
/********************************************************************************
#* Copyright (c) 2022, 2023 T-Systems International GmbH
#* Copyright (c) 2022, 2023 Contributors to the Eclipse Foundation
#* Copyright (c) 2022,2024 T-Systems International GmbH
#* Copyright (c) 2022,2024 Contributors to the Eclipse Foundation
#*
#* See the NOTICE file(s) distributed with this work for additional
#* information regarding copyright ownership.
Expand All @@ -20,44 +20,30 @@
package org.eclipse.tractusx.autosetup.config;

import java.util.Properties;

import javax.mail.PasswordAuthentication;
import javax.mail.Session;
import javax.mail.internet.MimeMessage;
import org.springframework.beans.factory.annotation.Value;

import org.eclipse.tractusx.autosetup.constant.EmailConfigurationProperty;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import lombok.RequiredArgsConstructor;

@Configuration
@RequiredArgsConstructor
public class EmailConfiguration {

@Value("${mail.smtp.host}")
private String host;

@Value("${mail.smtp.port}")
private String port;

@Value("${mail.from.address}")
private String fromAddress;

@Value("${mail.smtp.starttls.enable}")
private Boolean startTlsEnable;

@Value("${mail.smtp.username}")
private String username;

@Value("${mail.smtp.password}")
private String password;

@Value("${mail.smtp.auth}")
private Boolean auth;
private final EmailConfigurationProperty emailConfigurationProperty;

@Bean
public MimeMessage mimeMessage() {

Session session = Session.getInstance(properties(), new javax.mail.Authenticator() {
@Override
protected PasswordAuthentication getPasswordAuthentication() {
return new PasswordAuthentication(username, password);
return new PasswordAuthentication(emailConfigurationProperty.getUsername(), emailConfigurationProperty.getPassword());
}
});
return new MimeMessage(session);
Expand All @@ -66,11 +52,11 @@ protected PasswordAuthentication getPasswordAuthentication() {
@Bean
public Properties properties() {
Properties props = new Properties();
props.put("mail.smtp.user", username);
props.put("mail.smtp.host", host);
props.put("mail.smtp.port", port);
props.put("mail.smtp.starttls.enable", startTlsEnable);
props.put("mail.smtp.auth", auth);
props.put("mail.smtp.user", emailConfigurationProperty.getUsername());
props.put("mail.smtp.host", emailConfigurationProperty.getHost());
props.put("mail.smtp.port", emailConfigurationProperty.getPort());
props.put("mail.smtp.starttls.enable", emailConfigurationProperty.getStartTlsEnable());
props.put("mail.smtp.auth", emailConfigurationProperty.getAuth());
return props;
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
/********************************************************************************
* Copyright (c) 2024 T-Systems International GmbH
* Copyright (c) 2024 Contributors to the Eclipse Foundation
*
* See the NOTICE file(s) distributed with this work for additional
* information regarding copyright ownership.
*
* This program and the accompanying materials are made available under the
* terms of the Apache License, Version 2.0 which is available at
* https://www.apache.org/licenses/LICENSE-2.0.
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
* License for the specific language governing permissions and limitations
* under the License.
*
* SPDX-License-Identifier: Apache-2.0
********************************************************************************/

package org.eclipse.tractusx.autosetup.constant;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Configuration;

import lombok.Data;

@Configuration
@Data
public class EmailConfigurationProperty {

@Value("${mail.smtp.host}")
private String host;

@Value("${mail.smtp.port}")
private String port;

@Value("${mail.from.address}")
private String fromAddress;

@Value("${mail.smtp.starttls.enable}")
private Boolean startTlsEnable;

@Value("${mail.smtp.username}")
private String username;

@Value("${mail.smtp.password}")
private String password;

@Value("${mail.smtp.auth}")
private Boolean auth;

@Value("${mail.replyto.address}")
private String replytoAddress;

}
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
/********************************************************************************
#* Copyright (c) 2022, 2023 T-Systems International GmbH
#* Copyright (c) 2022, 2023 Contributors to the Eclipse Foundation
#* Copyright (c) 2022,2024 T-Systems International GmbH
#* Copyright (c) 2022,2024 Contributors to the Eclipse Foundation
#*
#* See the NOTICE file(s) distributed with this work for additional
#* information regarding copyright ownership.
Expand Down Expand Up @@ -58,4 +58,8 @@ public class SDEConfigurationProperty {
private String discoveryClientId;
private String discoveryClientSecret;

private String bpdmProviderEdcDataspaceApi;
private String bpdmProviderBpnl;
private String bpdmProviderEdcPublicApi;

}
Loading