Skip to content

Commit a3a8a4f

Browse files
chrislin22weideng1hhughes
authored
added Snyk monitor and snyk clean up after PR closed/merged (#1646)
* added snyk monitor and clean up * used jdk 11 and add options * Update snyk-cli-scan.yml added explicit mvn package prepare for snyk * Update snyk-cli-scan.yml * use jdk 8 * added .snyk.ignore.example and .snyk * triggered by branch 4.x * address a few high CVEs identified by snyk scan * ignore graal-sdk CVE for now until we can move off java8 * clean up snyk yaml files * JAVA-3050: Upgrade Netty 4.1.94 to address recent CVEs osgi-tests/BundleOptions.java - since netty-4.1.78, netty-handler additionally depends on netty-transport-native-unix-common so we need to pull that in when configuring pax exam --------- Co-authored-by: weideng1 <weideng1@users.noreply.github.com> Co-authored-by: Henry Hughes <henry.hughes@datastax.com>
1 parent 5d3968b commit a3a8a4f

6 files changed

Lines changed: 97 additions & 5 deletions

File tree

‎.github/workflows/snyk-cli-scan.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: 🔬 Snyk cli SCA
2+
3+
on:
4+
push:
5+
branches: [ 4.x ]
6+
pull_request:
7+
branches: [ 4.x ]
8+
workflow_dispatch:
9+
10+
env:
11+
SNYK_SEVERITY_THRESHOLD_LEVEL: high
12+
13+
jobs:
14+
snyk-cli-scan:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Git checkout
18+
uses: actions/checkout@v3
19+
20+
- name: prepare for snyk scan
21+
uses: datastax/shared-github-actions/actions/snyk-prepare@main
22+
23+
- name: Set up JDK 8
24+
uses: actions/setup-java@v3
25+
with:
26+
distribution: 'temurin'
27+
java-version: '8'
28+
cache: maven
29+
30+
- name: run maven install prepare for snyk
31+
run: |
32+
mvn -B -V install -DskipTests -Dmaven.javadoc.skip=true
33+
34+
- name: snyk scan java
35+
uses: datastax/shared-github-actions/actions/snyk-scan-java@main
36+
with:
37+
directories: .
38+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
39+
SNYK_ORG_ID: ${{ secrets.SNYK_ORG_ID }}
40+
extra-snyk-options: "-DskipTests -Dmaven.javadoc.skip=true"
41+
42+
- name: Snyk scan result
43+
uses: datastax/shared-github-actions/actions/snyk-process-scan-results@main
44+
with:
45+
gh_repo_token: ${{ secrets.GITHUB_TOKEN }}
46+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
47+
SNYK_ORG_ID: ${{ secrets.SNYK_ORG_ID }}

‎.github/workflows/snyk-pr-cleanup.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: 🗑️ Snyk PR cleanup - merged/closed
2+
3+
on:
4+
pull_request:
5+
types:
6+
- closed
7+
branches:
8+
- snyk-monitor
9+
workflow_dispatch:
10+
11+
jobs:
12+
snyk_project_cleanup_when_pr_closed:
13+
uses: datastax/shared-github-actions/.github/workflows/snyk-pr-cleanup.yml@main
14+
secrets:
15+
snyk_token: ${{ secrets.SNYK_TOKEN }}
16+
snyk_org_id: ${{ secrets.SNYK_ORG_ID }}

‎.snyk‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
2+
version: v1.22.2
3+
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
4+
ignore:
5+
SNYK-JAVA-ORGGRAALVMSDK-2767964:
6+
- '*':
7+
reason: cannot upgrade to graal-sdk 22.1.0+ until we move off Java8, which is slated for later this year
8+
expires: 2024-01-10T00:00:00.000Z
9+
created: 2023-06-21T00:00:00.000Z
10+
SNYK-JAVA-ORGGRAALVMSDK-2769618:
11+
- '*':
12+
reason: cannot upgrade to graal-sdk 22.1.0+ until we move off Java8, which is slated for later this year
13+
expires: 2024-01-10T00:00:00.000Z
14+
created: 2023-06-21T00:00:00.000Z
15+
SNYK-JAVA-ORGGRAALVMSDK-5457933:
16+
- '*':
17+
reason: cannot upgrade to graal-sdk 22.1.0+ until we move off Java8, which is slated for later this year
18+
expires: 2024-01-10T00:00:00.000Z
19+
created: 2023-06-21T00:00:00.000Z

‎.snyk.ignore.example‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
2+
version: v1.22.2
3+
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
4+
ignore:
5+
SNYK-PYTHON-URLLIB3-1533435:
6+
- '*':
7+
reason: state your ignore reason here
8+
expires: 2030-01-01T00:00:00.000Z
9+
created: 2022-03-21T00:00:00.000Z

‎osgi-tests/src/test/java/com/datastax/oss/driver/internal/osgi/support/BundleOptions.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,7 @@ public static CompositeOption nettyBundles() {
9191
mavenBundle("io.netty", "netty-codec").versionAsInProject(),
9292
mavenBundle("io.netty", "netty-common").versionAsInProject(),
9393
mavenBundle("io.netty", "netty-transport").versionAsInProject(),
94+
mavenBundle("io.netty", "netty-transport-native-unix-common").versionAsInProject(),
9495
mavenBundle("io.netty", "netty-resolver").versionAsInProject());
9596
}
9697

‎pom.xml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -47,21 +47,21 @@
4747
<config.version>1.4.1</config.version>
4848
<hdrhistogram.version>2.1.12</hdrhistogram.version>
4949
<metrics.version>4.1.18</metrics.version>
50-
<netty.version>4.1.77.Final</netty.version>
50+
<netty.version>4.1.94.Final</netty.version>
5151
<esri.version>1.2.1</esri.version>
5252
<!--
5353
When upgrading TinkerPop please upgrade the version matrix in
5454
manual/core/integration/README.md
5555
-->
56-
<tinkerpop.version>3.5.3</tinkerpop.version>
56+
<tinkerpop.version>3.5.6</tinkerpop.version>
5757
<slf4j.version>1.7.26</slf4j.version>
5858
<reactive-streams.version>1.0.3</reactive-streams.version>
59-
<json.version>20210307</json.version>
59+
<json.version>20230227</json.version>
6060
<jackson.version>2.13.2</jackson.version>
6161
<jackson-databind.version>2.13.2.2</jackson-databind.version>
6262
<legacy-jackson.version>1.9.12</legacy-jackson.version>
6363
<!-- optional dependencies -->
64-
<snappy.version>1.1.7.3</snappy.version>
64+
<snappy.version>1.1.10.1</snappy.version>
6565
<lz4.version>1.7.1</lz4.version>
6666
<!-- test dependencies -->
6767
<assertj.version>3.19.0</assertj.version>
@@ -73,7 +73,7 @@
7373
<pax-exam.version>4.13.4</pax-exam.version>
7474
<simulacron.version>0.11.0</simulacron.version>
7575
<jsr353-api.version>1.1.4</jsr353-api.version>
76-
<jersey.version>2.28</jersey.version>
76+
<jersey.version>2.31</jersey.version>
7777
<hk2.version>2.5.0</hk2.version>
7878
<jax-rs.version>2.1.1</jax-rs.version>
7979
<jsr353-ri.version>1.1.4</jsr353-ri.version>

0 commit comments

Comments
 (0)