Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Snyk July Review #7895

Merged
merged 7 commits into from
Jul 23, 2024
Merged

Snyk July Review #7895

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
91fefb5
updated packages for frontend and backend
shanice-skylight Jul 10, 2024
500436d
ran yarn add babel-jest to fix error Jest encountered an unexpected t…
shanice-skylight Jul 10, 2024
52dba2e
fixed syntax error
shanice-skylight Jul 10, 2024
64a635e
updated the dependency axios for smartystreets-javascript-sdk package…
shanice-skylight Jul 10, 2024
fa896b3
added transformIgnorePattern for axios, there is a known issue with …
shanice-skylight Jul 10, 2024
1ce3748
downgraded smartystreets and its dependencies down to original versions
shanice-skylight Jul 15, 2024
7abad21
removed axios ignore and moved axios and babel-jest under devDependen…
shanice-skylight Jul 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions backend/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ dependencies {
implementation 'org.springframework.boot:spring-boot-actuator-autoconfigure'

// graphql
implementation 'org.springframework.boot:spring-boot-starter-graphql'
implementation 'org.springframework.boot:spring-boot-starter-graphql:3.1.10'
testImplementation 'org.springframework:spring-webflux'
testImplementation 'org.springframework.graphql:spring-graphql-test'
// graphql-java-extended-validation schema directives
Expand All @@ -56,12 +56,15 @@ dependencies {
* Please do NOT scatter packages elsewhere around the file. Scattered packages make it easy for pins to become
* stale.
*
* DevSecOps verifies these packages at least once per month. LAST VERIFIED: 15 Feb 2024.
* DevSecOps verifies these packages at least once per month. LAST VERIFIED: 10 July 2024.
*/
implementation 'com.squareup.okio:okio:3.9.0'
implementation 'org.springframework:spring-core:6.0.16'
implementation 'org.springframework.security:spring-security-core:6.1.8'
implementation 'org.springframework.security:spring-security-oauth2-client:6.3.1'
implementation 'org.apache.tomcat.embed:tomcat-embed-core:10.1.25'
implementation 'org.apache.tomcat.embed:tomcat-embed-websocket:10.1.19'
implementation 'org.springframework.security:spring-security-web:6.1.7'
Comment on lines +65 to +67
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I haven't done a Snyk PR before so just to make sure I understand: are we pinning these dependencies to specific versions because others have vulnerabilities? or do these just need to be upgraded?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Based on the Snyk scans the previous version of these packages introduced vulnerabilities, so we are upgrading them to to fix the vulnerability. See references below that explain each vulnerability:

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moving forward I'll add the reference to the vulnerability in the description to provide more context


// non-pinned security dependencies
implementation 'org.owasp.encoder:encoder:1.2'
Expand Down
9 changes: 5 additions & 4 deletions backend/gradle.lockfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,9 +144,10 @@ org.apache.httpcomponents:httpclient:4.5.13=compileClasspath,runtimeClasspath
org.apache.httpcomponents:httpcore:4.4.16=compileClasspath,runtimeClasspath
org.apache.logging.log4j:log4j-api:2.20.0=compileClasspath,runtimeClasspath
org.apache.logging.log4j:log4j-to-slf4j:2.20.0=compileClasspath,runtimeClasspath
org.apache.tomcat.embed:tomcat-embed-core:10.1.17=compileClasspath,runtimeClasspath
org.apache.tomcat.embed:tomcat-embed-core:10.1.25=compileClasspath,runtimeClasspath
org.apache.tomcat.embed:tomcat-embed-el:10.1.17=compileClasspath,runtimeClasspath
org.apache.tomcat.embed:tomcat-embed-websocket:10.1.17=compileClasspath,runtimeClasspath
org.apache.tomcat.embed:tomcat-embed-websocket:10.1.19=compileClasspath,runtimeClasspath
org.apache.tomcat:tomcat-annotations-api:10.1.17=compileClasspath,runtimeClasspath
org.aspectj:aspectjweaver:1.9.21=compileClasspath,runtimeClasspath
org.attoparser:attoparser:2.0.7.RELEASE=compileClasspath,runtimeClasspath
org.bouncycastle:bcpkix-jdk18on:1.73=compileClasspath
Expand Down Expand Up @@ -188,7 +189,7 @@ org.springframework.boot:spring-boot-devtools:3.1.7=runtimeClasspath
org.springframework.boot:spring-boot-starter-aop:3.1.7=compileClasspath,runtimeClasspath
org.springframework.boot:spring-boot-starter-cache:3.1.7=compileClasspath,runtimeClasspath
org.springframework.boot:spring-boot-starter-data-jpa:3.1.7=compileClasspath,runtimeClasspath
org.springframework.boot:spring-boot-starter-graphql:3.1.7=compileClasspath,runtimeClasspath
org.springframework.boot:spring-boot-starter-graphql:3.1.10=compileClasspath,runtimeClasspath
org.springframework.boot:spring-boot-starter-jdbc:3.1.7=compileClasspath,runtimeClasspath
org.springframework.boot:spring-boot-starter-json:3.1.7=compileClasspath,runtimeClasspath
org.springframework.boot:spring-boot-starter-logging:3.1.7=compileClasspath,runtimeClasspath
Expand Down Expand Up @@ -218,7 +219,7 @@ org.springframework.security:spring-security-oauth2-core:6.1.6=compileClasspath,
org.springframework.security:spring-security-oauth2-jose:6.1.6=compileClasspath,runtimeClasspath
org.springframework.security:spring-security-oauth2-resource-server:6.1.6=compileClasspath,runtimeClasspath
org.springframework.security:spring-security-rsa:1.0.12.RELEASE=compileClasspath,runtimeClasspath
org.springframework.security:spring-security-web:6.1.6=compileClasspath,runtimeClasspath
org.springframework.security:spring-security-web:6.1.7=compileClasspath,runtimeClasspath
org.springframework.session:spring-session-core:3.1.4=runtimeClasspath
org.springframework.session:spring-session-jdbc:3.1.4=runtimeClasspath
org.springframework:spring-aop:6.0.15=compileClasspath,runtimeClasspath
Expand Down
4 changes: 3 additions & 1 deletion frontend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -229,7 +229,9 @@
"stylelint": "^13.13.1",
"stylelint-config-standard": "^22.0.0",
"typescript": "^5.3.2",
"webpack": "^5.76.0"
"webpack": "^5.76.0",
"axios": "^1.7.2",
"babel-jest": "^29.7.0"
},
"resolutions": {
"http-cache-semantics": "4.1.1",
Expand Down
30 changes: 22 additions & 8 deletions frontend/yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6107,9 +6107,9 @@
"@types/node" "*"

"@types/smartystreets-javascript-sdk@^1.6.4":
version "1.6.6"
resolved "https://registry.yarnpkg.com/@types/smartystreets-javascript-sdk/-/smartystreets-javascript-sdk-1.6.6.tgz#89cec045f1dc30a91f096eaa263d7f56d56e1bbf"
integrity sha512-/+2rUeAcy8zy4tOPd+IfD2XKv8lLGHebxoo5skClW1NUYoIfcttbTF1yYitaGxMTXMDzUlzGw3i6PzxiEv7jVg==
version "1.6.10"
resolved "https://registry.yarnpkg.com/@types/smartystreets-javascript-sdk/-/smartystreets-javascript-sdk-1.6.10.tgz#d22d037d582091c28caf549424ee582636311773"
integrity sha512-WFbVCaojrbtyD81Pr7jM+R5lPQOhr2SjnF1jIDBw+FiRnYelYE3TXuRXF51KA7eOwnLT+kZsQ/ywdQHLp0ZcPA==
dependencies:
"@types/express" "*"

Expand Down Expand Up @@ -7418,6 +7418,15 @@ axios@^0.26.1:
dependencies:
follow-redirects "^1.14.8"

axios@^1.7.2:
version "1.7.2"
resolved "https://registry.yarnpkg.com/axios/-/axios-1.7.2.tgz#b625db8a7051fbea61c35a3cbb3a1daa7b9c7621"
integrity sha512-2A8QhOMrbomlDuiLeK9XibIBzuHeRcqqNOHp0Cyp5EoJ1IFDh+XZH3A6BkXtv0K4gFGCI0Y4BM7B1wOEi0Rmgw==
dependencies:
follow-redirects "^1.15.6"
form-data "^4.0.0"
proxy-from-env "^1.1.0"

axobject-query@^2.2.0:
version "2.2.0"
resolved "https://registry.yarnpkg.com/axobject-query/-/axobject-query-2.2.0.tgz#943d47e10c0b704aa42275e20edf3722648989be"
Expand Down Expand Up @@ -10470,7 +10479,7 @@ focus-trap@^7.5.4:
dependencies:
tabbable "^6.2.0"

follow-redirects@^1.0.0, follow-redirects@^1.14.8:
follow-redirects@^1.0.0, follow-redirects@^1.14.8, follow-redirects@^1.15.6:
version "1.15.6"
resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.6.tgz#7f815c0cda4249c74ff09e95ef97c23b5fd0399b"
integrity sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==
Expand Down Expand Up @@ -10527,7 +10536,7 @@ fork-ts-checker-webpack-plugin@^8.0.0:
semver "^7.3.5"
tapable "^2.2.1"

[email protected]:
[email protected], form-data@^4.0.0:
version "4.0.0"
resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.0.tgz#93919daeaf361ee529584b9b31664dc12c9fa452"
integrity sha512-ETEklSGi5t0QMZuiXoA/Q6vcnxcLQP5vdugSpuAyi6SVGi2clPPp+xgEhuMaHC+zGgn31Kd235W35f7Hykkaww==
Expand Down Expand Up @@ -15305,6 +15314,11 @@ proxy-addr@~2.0.7:
forwarded "0.2.0"
ipaddr.js "1.9.1"

proxy-from-env@^1.1.0:
version "1.1.0"
resolved "https://registry.yarnpkg.com/proxy-from-env/-/proxy-from-env-1.1.0.tgz#e102f16ca355424865755d2c9e8ea4f24d58c3e2"
integrity sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==

psl@^1.1.33:
version "1.9.0"
resolved "https://registry.yarnpkg.com/psl/-/psl-1.9.0.tgz#d0df2a137f00794565fcaf3b2c00cd09f8d5a5a7"
Expand Down Expand Up @@ -16636,9 +16650,9 @@ slice-ansi@^4.0.0:
is-fullwidth-code-point "^3.0.0"

smartystreets-javascript-sdk@^3.2.0:
version "3.2.0"
resolved "https://registry.yarnpkg.com/smartystreets-javascript-sdk/-/smartystreets-javascript-sdk-3.2.0.tgz#1f6f0e9353298a5f87755cb3fe1dd523fd033257"
integrity sha512-+67s2ISG9vivWMwduOl9d4Vba72ooqxw3TPf5KMXY4GUU4YbLF2/XMSBSM62Aou0GMrwjEHGAjC21k1F54lkQg==
version "3.3.0"
resolved "https://registry.yarnpkg.com/smartystreets-javascript-sdk/-/smartystreets-javascript-sdk-3.3.0.tgz#759d2e2af5dc785cbe683185826c597f02d24fce"
integrity sha512-GnQsELshuVTmDIsnptU+1ubluXHcvxICIIOO2jFHso06PQvB6Ql9iQnJxptpx46kyCSH/zoeCcUsKeHjrdj0ZA==
dependencies:
axios "^0.26.1"
axios-retry "3.2.0"
Expand Down
Loading