From 127571b4273b30d4fee6c8c3c0944646c166e9ac Mon Sep 17 00:00:00 2001 From: Stefan Wiedemann Date: Wed, 3 Jul 2024 09:35:45 +0200 Subject: [PATCH 1/7] fix: src/envoy-configmap-updater/Dockerfile to reduce vulnerabilities (#171) The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-ALPINE317-OPENSSL-6032385 - https://snyk.io/vuln/SNYK-ALPINE317-OPENSSL-6032385 - https://snyk.io/vuln/SNYK-ALPINE317-BUSYBOX-7254940 - https://snyk.io/vuln/SNYK-ALPINE317-BUSYBOX-7254941 - https://snyk.io/vuln/SNYK-ALPINE317-BUSYBOX-7254942 Co-authored-by: snyk-bot --- src/envoy-configmap-updater/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/envoy-configmap-updater/Dockerfile b/src/envoy-configmap-updater/Dockerfile index ecc2d33b..bf09e06b 100644 --- a/src/envoy-configmap-updater/Dockerfile +++ b/src/envoy-configmap-updater/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.20.3-alpine +FROM golang:1.21.12-alpine ENV PROXY_CONFIG_FOLDER="/proxy-config" ENV PROXY_CONFIG_MAP="envoy-config" From c4c04924ce0cf9422f6f69aec263fdd23a2bc892 Mon Sep 17 00:00:00 2001 From: Stefan Wiedemann Date: Wed, 3 Jul 2024 10:46:28 +0200 Subject: [PATCH 2/7] fix: integration-test/integration-test/pom.xml to reduce vulnerabilities (#121) The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-COMSQUAREUPOKIO-5773320 - https://snyk.io/vuln/SNYK-JAVA-COMSQUAREUPOKIO-5820002 - https://snyk.io/vuln/SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744 Co-authored-by: snyk-bot --- integration-test/integration-test/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration-test/integration-test/pom.xml b/integration-test/integration-test/pom.xml index 1a60f25a..09082115 100644 --- a/integration-test/integration-test/pom.xml +++ b/integration-test/integration-test/pom.xml @@ -20,7 +20,7 @@ 2.2.1 1.6.10 - 4.11.0 + 4.12.0 1.6.8 2.10.1 1.8.5 From 7c1c6af132b285003a6e43343bb490ab30e2669f Mon Sep 17 00:00:00 2001 From: Stefan Wiedemann Date: Wed, 3 Jul 2024 11:10:23 +0200 Subject: [PATCH 3/7] fix: upgrade org.projectlombok:lombok from 1.18.26 to 1.18.28 (#98) Snyk has created this PR to upgrade org.projectlombok:lombok from 1.18.26 to 1.18.28. See this package in Maven Repository: https://mvnrepository.com/artifact/org.projectlombok/lombok/ See this project in Snyk: https://app.snyk.io/org/wistefan/project/94da27cf-400b-4e11-af62-96e18e733713?utm_source=github&utm_medium=referral&page=upgrade-pr Co-authored-by: snyk-bot --- integration-test/echo-server/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration-test/echo-server/pom.xml b/integration-test/echo-server/pom.xml index 5f1d4606..cc7aecc8 100644 --- a/integration-test/echo-server/pom.xml +++ b/integration-test/echo-server/pom.xml @@ -55,7 +55,7 @@ - 1.18.26 + 1.18.28 1.2.3 From 009f74b0a67c75b95227420eec7dcf07b21f5a5a Mon Sep 17 00:00:00 2001 From: Stefan Wiedemann Date: Wed, 3 Jul 2024 11:18:18 +0200 Subject: [PATCH 4/7] fix: upgrade com.fasterxml.jackson.core:jackson-databind from 2.15.0 to 2.15.1 (#97) Snyk has created this PR to upgrade com.fasterxml.jackson.core:jackson-databind from 2.15.0 to 2.15.1. See this package in Maven Repository: https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind/ See this project in Snyk: https://app.snyk.io/org/wistefan/project/ac4cbf4f-5c6b-418b-801b-f6c2d0cfbb2c?utm_source=github&utm_medium=referral&page=upgrade-pr Co-authored-by: snyk-bot --- integration-test/integration-test/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration-test/integration-test/pom.xml b/integration-test/integration-test/pom.xml index 09082115..14e38376 100644 --- a/integration-test/integration-test/pom.xml +++ b/integration-test/integration-test/pom.xml @@ -29,7 +29,7 @@ 3.0.2 1.3.2 3.12.0 - 2.15.0 + 2.15.1 1.18.26 From 1e9cc25cab551d5136391163ca340d2cfb13528e Mon Sep 17 00:00:00 2001 From: Stefan Wiedemann Date: Wed, 3 Jul 2024 11:25:35 +0200 Subject: [PATCH 5/7] fix: src/envoy-resource-updater/Dockerfile to reduce vulnerabilities (#172) The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-ALPINE317-OPENSSL-6032385 - https://snyk.io/vuln/SNYK-ALPINE317-OPENSSL-6032385 - https://snyk.io/vuln/SNYK-ALPINE317-BUSYBOX-7254940 - https://snyk.io/vuln/SNYK-ALPINE317-BUSYBOX-7254941 - https://snyk.io/vuln/SNYK-ALPINE317-BUSYBOX-7254942 Co-authored-by: snyk-bot --- src/envoy-resource-updater/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/envoy-resource-updater/Dockerfile b/src/envoy-resource-updater/Dockerfile index e99f45aa..21adffda 100644 --- a/src/envoy-resource-updater/Dockerfile +++ b/src/envoy-resource-updater/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.20.3-alpine +FROM golang:1.21.12-alpine ENV PROXY_CONFIG_FOLDER="/proxy-config" ENV CONFIG_MAP_FOLDER="/configmap-folder" From a5522787619e28c742db9f891ff9aa06a8169556 Mon Sep 17 00:00:00 2001 From: Stefan Wiedemann Date: Wed, 3 Jul 2024 11:32:48 +0200 Subject: [PATCH 6/7] fix: upgrade io.swagger:swagger-annotations from 1.6.10 to 1.6.11 (#96) Snyk has created this PR to upgrade io.swagger:swagger-annotations from 1.6.10 to 1.6.11. See this package in Maven Repository: https://mvnrepository.com/artifact/io.swagger/swagger-annotations/ See this project in Snyk: https://app.snyk.io/org/wistefan/project/ac4cbf4f-5c6b-418b-801b-f6c2d0cfbb2c?utm_source=github&utm_medium=referral&page=upgrade-pr Co-authored-by: snyk-bot --- integration-test/integration-test/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/integration-test/integration-test/pom.xml b/integration-test/integration-test/pom.xml index 14e38376..488aa40f 100644 --- a/integration-test/integration-test/pom.xml +++ b/integration-test/integration-test/pom.xml @@ -19,7 +19,7 @@ 5.1.0 2.2.1 - 1.6.10 + 1.6.11 4.12.0 1.6.8 2.10.1 From 500ed3c8d5f5e40ad1ed1cfb930aed3a338c1cf8 Mon Sep 17 00:00:00 2001 From: Stefan Wiedemann Date: Wed, 3 Jul 2024 11:42:12 +0200 Subject: [PATCH 7/7] fix: upgrade org.mapstruct:mapstruct from 1.5.4.Final to 1.5.5.Final (#94) Snyk has created this PR to upgrade org.mapstruct:mapstruct from 1.5.4.Final to 1.5.5.Final. See this package in Maven Repository: https://mvnrepository.com/artifact/org.mapstruct/mapstruct/ See this project in Snyk: https://app.snyk.io/org/wistefan/project/2ba265d4-3327-4f98-8cd6-25a952f95260?utm_source=github&utm_medium=referral&page=upgrade-pr Co-authored-by: snyk-bot --- src/endpoint-configuration-service/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/endpoint-configuration-service/pom.xml b/src/endpoint-configuration-service/pom.xml index 0f3cc099..dd558f52 100644 --- a/src/endpoint-configuration-service/pom.xml +++ b/src/endpoint-configuration-service/pom.xml @@ -56,7 +56,7 @@ 1.18.26 - 1.5.4.Final + 1.5.5.Final 1.2.3