chore: upgrade some versions because of CVEs

eclipse-tractusx · Oct 4, 2024 · a26078e · a26078e
1 parent f41f5b8
commit a26078e
Show file tree

Hide file tree

Showing 3 changed files with 26 additions and 3 deletions.
diff --git a/pom.xml b/pom.xml
@@ -44,6 +44,8 @@
         <okhttp.version>4.12.0</okhttp.version>
         <rdf4j.version>4.3.8</rdf4j.version>
         <faaast.version>1.0.1</faaast.version>
+        <protobuf.version>3.25.5</protobuf.version>
+        <bouncycastle.version>1.78</bouncycastle.version>
 
         <!-- Source characteristics -->
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -129,6 +131,7 @@
                                 <workingDirectory>${project.basedir}</workingDirectory>
                                 <arguments>
                                     <argument>build</argument>
+                                    <argument>--load</argument>
                                     <argument>--platform</argument>
                                     <argument>${platform}</argument>
                                     <argument>-f</argument>

diff --git a/sparql-aas/pom.xml b/sparql-aas/pom.xml
@@ -143,6 +143,26 @@
             <artifactId>dom4j</artifactId>
             <version>2.1.3</version>
         </dependency>
+        <dependency>
+            <groupId>com.google.protobuf</groupId>
+            <artifactId>protobuf-java</artifactId>
+            <version>${protobuf.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcprov-jdk18on</artifactId>
+            <version>${bouncycastle.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcpkix-jdk18on</artifactId>
+            <version>${bouncycastle.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcutil-jdk18on</artifactId>
+            <version>${bouncycastle.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.squareup.okhttp3</groupId>
             <artifactId>mockwebserver</artifactId>

diff --git a/sparql-aas/src/main/docker/Dockerfile b/sparql-aas/src/main/docker/Dockerfile
@@ -18,16 +18,16 @@
 # SPDX-License-Identifier: Apache-2.0
 
 
-FROM alpine:3.19.1 AS otel
+FROM alpine:3.20.2 AS otel
 
 ENV OTEL_AGENT_LOCATION "https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases/download/v1.27.0/opentelemetry-javaagent.jar"
 
 HEALTHCHECK NONE
 
-RUN apk update && apk add curl=8.9.0-r0 --no-cache
+RUN apk update && apk add curl=8.10.1-r0 --no-cache
 RUN curl -L --proto "=https" -sSf ${OTEL_AGENT_LOCATION} --output /tmp/opentelemetry-javaagent.jar
 
-FROM eclipse-temurin:22_36-jre-alpine
+FROM eclipse-temurin:22-jre-alpine
 
 ARG APP_USER=faaast
 ARG APP_UID=10100