NIFI-12276 Addressed Dependency Check Findings

- Added dependency-check GitHub workflow - Upgraded Janino Commons Compiler from 3.1.9 to 3.1.10 - Upgraded Azure SDK BOM from 1.2.16 to 1.2.17 - Upgraded GCP SDK BOM from 26.17.0 to 26.25.0 - Upgraded AWS SDK from 1.12.550 to 1.12.573 - Upgraded Hazelcast from 5.3.2 to 5.3.5 - Upgraded Jersey from 2.40 to 2.41 - Upgraded Camel Salesforce from 3.14.5 to 3.14.9 - Unified ZooKeeper versioning on 3.9.1 - Applied Groovy 2.4.21 to Hive 3 and Iceberg components - Applied gRPC version 1.59.0 to Asana components - Applied Jettison 1.5.4 to Atlas and Hive 3 components - Managed JUnit 4 version to 4.13.2 for MockWebServer - Excluded HBase libraries from Hive 3 following Iceberg approach - Excluded Htrace from HBase components - Upgraded OWASP Dependency Check from 8.4.0 to 8.4.2 - Removed non-applicable dependency check suppressions - Added dependency check suppressions for non-applicable findings
exceptionfactory · Oct 27, 2023 · 2f9e8df · 2f9e8df
1 parent 880770f
commit 2f9e8df
Show file tree

Hide file tree

Showing 31 changed files with 516 additions and 179 deletions.
diff --git a/.github/workflows/dependency-check.yml b/.github/workflows/dependency-check.yml
@@ -0,0 +1,70 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+name: dependency-check
+
+on:
+  schedule:
+    - cron: "0 3 * * *"
+  push:
+    paths:
+      - '**/pom.xml'
+  pull_request:
+    paths:
+      - '**/pom.xml'
+
+env:
+  DEFAULT_MAVEN_OPTS: >-
+    -Dorg.slf4j.simpleLogger.defaultLogLevel=WARN
+    -Daether.connector.http.retryHandler.count=5
+    -Daether.connector.http.connectionMaxTtl=30
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    name: Dependency Check
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+      - name: Set up Java Zulu 21
+        uses: actions/setup-java@v3
+        with:
+          distribution: 'zulu'
+          java-version: 21
+          cache: 'maven'
+      - name: Run Dependency Check
+        env:
+          MAVEN_OPTS: >-
+            ${{ env.DEFAULT_MAVEN_OPTS }}
+        run: >
+          ./mvnw
+          --no-transfer-progress
+          --activate-profiles dependency-check
+          validate
+      - name: Upload Report
+        uses: actions/upload-artifact@v3
+        with:
+          name: dependency-check-report
+          path: |
+            target/dependency-check-report.html
+          retention-days: 7
diff --git a/README.md b/README.md
@@ -18,6 +18,7 @@
 [![system-tests](https://github.com/apache/nifi/workflows/system-tests/badge.svg)](https://github.com/apache/nifi/actions/workflows/system-tests.yml)
 [![integration-tests](https://github.com/apache/nifi/actions/workflows/integration-tests.yml/badge.svg)](https://github.com/apache/nifi/actions/workflows/integration-tests.yml)
 [![docker-tests](https://github.com/apache/nifi/actions/workflows/docker-tests.yml/badge.svg)](https://github.com/apache/nifi/actions/workflows/docker-tests.yml)
+[![dependency-check](https://github.com/apache/nifi/workflows/dependency-check/badge.svg)](https://github.com/apache/nifi/actions/workflows/dependency-check.yml)
 [![Docker pulls](https://img.shields.io/docker/pulls/apache/nifi.svg)](https://hub.docker.com/r/apache/nifi/)
 [![Version](https://img.shields.io/maven-central/v/org.apache.nifi/nifi-utils.svg)](https://nifi.apache.org/download.html)
 [![Slack](https://img.shields.io/badge/chat-on%20Slack-brightgreen.svg)](https://s.apache.org/nifi-community-slack)

diff --git a/minifi/minifi-c2/minifi-c2-assembly/pom.xml b/minifi/minifi-c2/minifi-c2-assembly/pom.xml
@@ -155,6 +155,13 @@ limitations under the License.
         <dependency>
             <groupId>org.glassfish.jersey.containers</groupId>
             <artifactId>jersey-container-jetty-http</artifactId>
+            <exclusions>
+                <!-- jetty-continuation is not included in Jetty 10 -->
+                <exclusion>
+                    <groupId>org.eclipse.jetty</groupId>
+                    <artifactId>jetty-continuation</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.glassfish.jersey.containers</groupId>

diff --git a/minifi/pom.xml b/minifi/pom.xml
@@ -451,6 +451,18 @@ limitations under the License.
                 <artifactId>guava</artifactId>
                 <version>32.1.2-jre</version>
             </dependency>
+
+            <!-- Override Commons Compiler 3.1.9 from calcite-core -->
+            <dependency>
+                <groupId>org.codehaus.janino</groupId>
+                <artifactId>commons-compiler</artifactId>
+                <version>3.1.10</version>
+            </dependency>
+            <dependency>
+                <groupId>org.codehaus.janino</groupId>
+                <artifactId>janino</artifactId>
+                <version>3.1.10</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 </project>
diff --git a/nifi-commons/nifi-calcite-utils/pom.xml b/nifi-commons/nifi-calcite-utils/pom.xml
@@ -25,6 +25,22 @@
     <artifactId>nifi-calcite-utils</artifactId>
     <name>nifi-calcite-utils</name>
 
+    <dependencyManagement>
+        <dependencies>
+            <!-- Override Commons Compiler 3.1.9 from calcite-core -->
+            <dependency>
+                <groupId>org.codehaus.janino</groupId>
+                <artifactId>commons-compiler</artifactId>
+                <version>3.1.10</version>
+            </dependency>
+            <dependency>
+                <groupId>org.codehaus.janino</groupId>
+                <artifactId>janino</artifactId>
+                <version>3.1.10</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <dependencies>
         <dependency>
             <groupId>org.apache.nifi</groupId>

diff --git a/nifi-commons/nifi-property-protection-azure/pom.xml b/nifi-commons/nifi-property-protection-azure/pom.xml
@@ -26,7 +26,7 @@
             <dependency>
                 <groupId>com.azure</groupId>
                 <artifactId>azure-sdk-bom</artifactId>
-                <version>1.2.16</version>
+                <version>1.2.17</version>
                 <scope>import</scope>
                 <type>pom</type>
             </dependency>

diff --git a/nifi-commons/nifi-property-protection-gcp/pom.xml b/nifi-commons/nifi-property-protection-gcp/pom.xml
@@ -22,7 +22,7 @@
     </parent>
     <artifactId>nifi-property-protection-gcp</artifactId>
     <properties>
-        <gcp.sdk.version>26.17.0</gcp.sdk.version>
+        <gcp.sdk.version>26.25.0</gcp.sdk.version>
         <guava.version>32.1.2-jre</guava.version>
     </properties>
     <dependencyManagement>