From 9cb9ba3413f89cc4920e26c19dc80966b5121a7c Mon Sep 17 00:00:00 2001
From: Corneil du Plessis <pcorneil@vmware.com>
Date: Thu, 14 Sep 2023 12:22:28 +0200
Subject: [PATCH] Update versions for CVE mitigation.

---
 .../pom.xml                                   | 15 +++++++
 .../spring-cloud-skipper-server/pom.xml       | 43 +++++++++++++++++--
 src/deploy/images/build-grafana-image.sh      |  5 ++-
 .../prometheus/docker/grafana/Dockerfile      |  2 +-
 4 files changed, 59 insertions(+), 6 deletions(-)

diff --git a/spring-cloud-dataflow-single-step-batch-job/pom.xml b/spring-cloud-dataflow-single-step-batch-job/pom.xml
index c3ef6aea4c..6442c3262f 100644
--- a/spring-cloud-dataflow-single-step-batch-job/pom.xml
+++ b/spring-cloud-dataflow-single-step-batch-job/pom.xml
@@ -17,6 +17,20 @@
 		<spring-cloud-dataflow-apps-metadata-plugin.version>1.0.7</spring-cloud-dataflow-apps-metadata-plugin.version>
 		<failIfNoTests>true</failIfNoTests>
 	</properties>
+	<dependencyManagement>
+		<dependencies>
+			<dependency>
+				<groupId>org.springframework.kafka</groupId>
+				<artifactId>spring-kafka</artifactId>
+				<version>[2.9.11,3.0)</version>
+			</dependency>
+			<dependency>
+				<groupId>com.h2database</groupId>
+				<artifactId>h2</artifactId>
+				<version>[2.2.222,3.0)</version>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
 	<dependencies>
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
@@ -38,6 +52,7 @@
 		<dependency>
 			<groupId>com.h2database</groupId>
 			<artifactId>h2</artifactId>
+			<version>2.2.222</version>
 		</dependency>
 		<dependency>
 			<groupId>org.mariadb.jdbc</groupId>
diff --git a/spring-cloud-skipper/spring-cloud-skipper-server/pom.xml b/spring-cloud-skipper/spring-cloud-skipper-server/pom.xml
index 2b4673eb15..3c0305a5b1 100644
--- a/spring-cloud-skipper/spring-cloud-skipper-server/pom.xml
+++ b/spring-cloud-skipper/spring-cloud-skipper-server/pom.xml
@@ -12,6 +12,45 @@
 		<version>2.11.0-SNAPSHOT</version>
 		<relativePath>../../spring-cloud-dataflow-parent</relativePath>
 	</parent>
+	<dependencyManagement>
+		<dependencies>
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-core</artifactId>
+				<version>2.13.5</version>
+			</dependency>
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-databind</artifactId>
+				<version>2.13.5</version>
+			</dependency>
+			<dependency>
+				<groupId>com.fasterxml.jackson.dataformat</groupId>
+				<artifactId>jackson-dataformat-yaml</artifactId>
+				<version>2.13.5</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcprov-jdk18on</artifactId>
+				<version>1.76</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcpkix-jdk18on</artifactId>
+				<version>1.75</version>
+			</dependency>
+			<dependency>
+				<groupId>org.bouncycastle</groupId>
+				<artifactId>bcutil-jdk18on</artifactId>
+				<version>1.75</version>
+			</dependency>
+			<dependency>
+				<groupId>org.mariadb.jdbc</groupId>
+				<artifactId>mariadb-java-client</artifactId>
+				<version>[3.1.2,)</version>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
 	<dependencies>
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
@@ -63,22 +102,18 @@
 		<dependency>
 			<groupId>org.bouncycastle</groupId>
 			<artifactId>bcprov-jdk18on</artifactId>
-			<version>1.76</version>
 		</dependency>
 		<dependency>
 			<groupId>org.bouncycastle</groupId>
 			<artifactId>bcpkix-jdk18on</artifactId>
-			<version>1.75</version>
 		</dependency>
 		<dependency>
 			<groupId>org.bouncycastle</groupId>
 			<artifactId>bcutil-jdk18on</artifactId>
-			<version>1.75</version>
 		</dependency>
 		<dependency>
 			<groupId>org.mariadb.jdbc</groupId>
 			<artifactId>mariadb-java-client</artifactId>
-			<version>[3.1.2,)</version>
 		</dependency>
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
diff --git a/src/deploy/images/build-grafana-image.sh b/src/deploy/images/build-grafana-image.sh
index 1b06bd52ea..80fd4474ba 100755
--- a/src/deploy/images/build-grafana-image.sh
+++ b/src/deploy/images/build-grafana-image.sh
@@ -6,5 +6,8 @@ pushd $PROJECT_DIR || exit
         SCDF_VER=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
     else
         SCDF_VER=$DATAFLOW_VERSION
-    docker build -f "src/grafana/prometheus/docker/grafana" "springcloud/spring-cloud-dataflow-grafana-prometheus:$SCDF_VER"
+    fi
+    pushd src/grafana/prometheus/docker/grafana || exit 1
+        docker build -t "springcloud/spring-cloud-dataflow-grafana-prometheus:$SCDF_VER" .
+    popd || exit 1
 popd || exit
diff --git a/src/grafana/prometheus/docker/grafana/Dockerfile b/src/grafana/prometheus/docker/grafana/Dockerfile
index 40fd7e6cba..c7c3e533f7 100644
--- a/src/grafana/prometheus/docker/grafana/Dockerfile
+++ b/src/grafana/prometheus/docker/grafana/Dockerfile
@@ -1,4 +1,4 @@
-FROM grafana/grafana:8.0.2
+FROM grafana/grafana:8.5.27
 ADD ./provisioning /etc/grafana/provisioning
 ADD ./config.ini /etc/grafana/config.ini
 ADD ./dashboards /var/lib/grafana/dashboards