Update dependencies for latest CVEs

[onobc]

            <dependency>
                <groupId>org.yaml</groupId>
                <artifactId>snakeyaml</artifactId>
                <version>1.33</version>
            </dependency>
            <dependency>
                <groupId>org.xerial.snappy</groupId>
                <artifactId>snappy-java</artifactId>
                <version>1.1.10.4</version>
            </dependency>
            <dependency>
                <groupId>net.minidev</groupId>
                <artifactId>json-smart</artifactId>
                <version>2.4.11</version>
            </dependency>
            <dependency>
                <groupId>com.nimbusds</groupId>
                <artifactId>nimbus-jose-jwt</artifactId>
                <version>9.31</version>
            </dependency>

[onobc]

I ran the following commands:

• ./mvnw dependency:tree -Dincludes='com.nimbusds:nimbus-jose-jwt' > nimbus.txt
• ./mvnw dependency:tree -Dincludes='net.minidev:json-smart' > json-smart.txt
• ./mvnw dependency:tree -Dincludes='org.xerial.snappy:snappy-java' > snappy.txt
• ./mvnw dependency:tree -Dincludes='org.yaml:snakeyaml' > snakeyml.txt

The resulting files (attached) show ZERO signs of the problematic versions:

Dep	Bad Version	Good Version
com.nimbusds:nimbus-jose-jwt	9.22	9.31
net.minidev:json-smart	2.4.8	2.4.11
org.xerial.snappy:snappy-java	1.1.10.1	1.1.10.4
org.yaml:snakeyaml	1.31	1.33

[onobc]

Another good command(s) to run in a repo to see a consolidated view of what the versions in the questionable libraries is:

./mvnw dependency:tree -Dincludes='net.minidev:json-smart' | grep -E 'net.minidev:json-smart'
./mvnw dependency:tree -Dincludes='com.nimbusds:nimbus-jose-jwt' | grep -E 'com.nimbusds:nimbus-jose-jwt'
./mvnw dependency:tree -Dincludes='org.xerial.snappy:snappy-java' | grep -E 'org.xerial.snappy:snappy-java'
./mvnw dependency:tree -Dincludes='org.yaml:snakeyaml' | grep -E 'org.yaml:snakeyaml'

[Risae]

@onobc What about flyway? As far as i can tell the current version is

spring-cloud-dataflow/spring-cloud-dataflow-common/spring-cloud-dataflow-common-flyway/pom.xml

	<properties>
		<flyway.version>8.5.11
		</flyway.version> <!-- have to repeat this here in order for filtering in src/main/resources/ -->
	</properties>

And this old version has quite a lot of CVEs, which are patched in later versions?

https://documentation.red-gate.com/fd/release-notes-for-flyway-engine-179732572.html

[onobc]

Hi @Risae ,

We align w/ the Spring Boot BOM for dependency versions. Dataflow 2.11.1 is using Spring Boot 2.7.16 which uses Flyway 8.5.13 for Flyway. In Dataflow 2.11.2 we will update to Spring Boot 2.7.17 (which is still using Flyway 8.5.13). At that time we are planning to bump from Flyway 8.5.11 to 8.5.13.

The major update from 8.x to 9.x Flyway does not occur until Boot 3.x. As such, Dataflow 2.x will remain on Flyway 8.x for its lifespan. We are planning a Dataflow 3.x that will use Boot 3.x and at that time we will move to Flyway 9.x.

Also note that the 2 CVEs that show up for the version of Flyway we are using originate in the Postgres driver which is an optional dependency.
See: https://mvnrepository.com/artifact/org.flywaydb/flyway-core/8.5.11

[Risae]

Hi @Risae ,

We align w/ the Spring Boot BOM for dependency versions. Dataflow 2.11.1 is using Spring Boot 2.7.16 which uses Flyway 8.5.13 for Flyway. In Dataflow 2.11.2 we will update to Spring Boot 2.7.17 (which is still using Flyway 8.5.13). At that time we are planning to bump from Flyway 8.5.11 to 8.5.13.

The major update from 8.x to 9.x Flyway does not occur until Boot 3.x. As such, Dataflow 2.x will remain on Flyway 8.x for its lifespan. We are planning a Dataflow 3.x that will use Boot 3.x and at that time we will move to Flyway 9.x.

Also note that the 2 CVEs that show up for the version of Flyway we are using originate in the Postgres driver which is an optional dependency. See: https://mvnrepository.com/artifact/org.flywaydb/flyway-core/8.5.11

Got it, thank you!

[onobc]

The issue tracking the updates in 2.11.2 is #5522