resolve jetty CVE check by using latest 9.x version. revert using pla…

…tform Signed-off-by: Haidong <[email protected]>
wanghd89 · Oct 7, 2023 · 45d97ae · 45d97ae
1 parent 926dd1a
commit 45d97ae
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 5 deletions.
diff --git a/build.gradle b/build.gradle
@@ -89,7 +89,6 @@ subprojects {
     }
     dependencies {
         implementation platform('com.fasterxml.jackson:jackson-bom:2.15.0')
-        implementation platform('org.eclipse.jetty:jetty-bom:9.4.52.v20230823')
         implementation platform('io.micrometer:micrometer-bom:1.10.5')
         implementation libs.guava.core
         implementation libs.slf4j.api
@@ -146,6 +145,18 @@ subprojects {
                 }
                 because 'CVE from transitive dependencies'
             }
+            implementation('org.eclipse.jetty:jetty-http') {
+                version {
+                    require '9.4.52.v20230823'
+                }
+                because 'CVE from transitive dependencies, please use 9.x version for kafka connect plugin.'
+            }
+            implementation('org.eclipse.jetty:jetty-server') {
+                version {
+                    require '9.4.52.v20230823'
+                }
+                because 'CVE from transitive dependencies, please use 9.x version for kafka connect plugin.'
+            }
             implementation('org.jetbrains.kotlin:kotlin-stdlib') {
                 version {
                     require '1.8.21'

diff --git a/data-prepper-plugins/kafka-connect-plugins/build.gradle b/data-prepper-plugins/kafka-connect-plugins/build.gradle
@@ -20,10 +20,10 @@ dependencies {
     implementation 'javax.validation:validation-api:2.0.1.Final'
     implementation libs.reflections.core
     implementation 'io.micrometer:micrometer-core'
-    implementation 'org.eclipse.jetty:jetty-server:9.4.51.v20230217'
-    implementation 'org.eclipse.jetty:jetty-servlet:9.4.51.v20230217'
-    implementation 'org.eclipse.jetty:jetty-servlets:9.4.51.v20230217'
-    implementation 'org.eclipse.jetty:jetty-client:9.4.51.v20230217'
+    implementation 'org.eclipse.jetty:jetty-server:9.4.52.v20230823'
+    implementation 'org.eclipse.jetty:jetty-servlet:9.4.52.v20230823'
+    implementation 'org.eclipse.jetty:jetty-servlets:9.4.52.v20230823'
+    implementation 'org.eclipse.jetty:jetty-client:9.4.52.v20230823'
     implementation ('io.confluent:kafka-schema-registry:7.5.0') {
         exclude group: 'org.glassfish.jersey.containers', module: 'jersey-container-servlet'
         exclude group: 'org.glassfish.jersey.inject', module: 'jersey-hk2'