diff --git a/.github/workflows/.trivyignore b/.github/workflows/.trivyignore index 992fc09..df30eee 100644 --- a/.github/workflows/.trivyignore +++ b/.github/workflows/.trivyignore @@ -1,4 +1,3 @@ -# Date: June 16, 2023 -# Issue: snappy-java high issue, https://www.cvedetails.com/cve/CVE-2023-34453/ -# Solution: Spring needs to update its version -CVE-2023-34455 \ No newline at end of file +# April 18 2024 +# Spring boot needs to update its version of spring +CVE-2024-22262 \ No newline at end of file diff --git a/Dockerfile b/Dockerfile index a29ab48..c6312d6 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ ARG JAR_FILE=target/*.jar COPY ${JAR_FILE} application.jar RUN java -Djarmode=layertools -jar application.jar extract -FROM eclipse-temurin:17-jre-alpine +FROM eclipse-temurin:17-jdk-alpine RUN adduser -D -u 1000 java WORKDIR application COPY --chown=java:java --from=builder application/dependencies/ ./ diff --git a/pom.xml b/pom.xml index b2f368a..6f4ec7c 100644 --- a/pom.xml +++ b/pom.xml @@ -6,7 +6,7 @@ org.springframework.boot spring-boot-starter-parent - 3.1.0 + 3.2.4 eu.dissco.core @@ -16,8 +16,7 @@ DiSSCo core consumer for event provenance records 17 - 2.0 - 1.17.6 + 1.19.7 dissco https://sonarcloud.io ../app-it/target/site/jacoco-aggregate/jacoco.xml @@ -67,7 +66,14 @@ com.fasterxml.jackson.datatype jackson-datatype-jsr310 - + + org.springframework.boot + spring-boot-starter-actuator + + + spring-boot-starter-web + org.springframework.boot + org.springframework.boot