From 4e5971dfad8fc1e04a3ff65624344c6764252e9b Mon Sep 17 00:00:00 2001 From: Alexey Zavialov <> Date: Thu, 22 Feb 2024 00:30:33 +0300 Subject: [PATCH 1/8] CVE fixes, closes #133 --- pom.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pom.xml b/pom.xml index 46a6b246a..997c90810 100644 --- a/pom.xml +++ b/pom.xml @@ -38,17 +38,17 @@ 3.1.0 3.0.13 2.14.0 - 3.5.0 + 3.5.2 1.5.5.Final 1.18.30 3.23.3 2.13.9 2.0 - 3.1.3 + 3.1.6 1.0.0 0.1.17 0.1.39 - 20230227 + 20231013 0.3.0 31.0.1-jre From 4d210d17d13a8f77e3cba90afb1c23500d971313 Mon Sep 17 00:00:00 2001 From: Alexey Zavialov <> Date: Sat, 2 Mar 2024 20:49:36 +0300 Subject: [PATCH 2/8] CVE fixes, closes #133 --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 997c90810..81d1f43eb 100644 --- a/pom.xml +++ b/pom.xml @@ -32,7 +32,7 @@ 4.12.0 2.12.0 3.25.3 - 1.11.1 + 1.11.3 1.12.19 7.4.0 3.1.0 @@ -44,7 +44,7 @@ 3.23.3 2.13.9 2.0 - 3.1.6 + 3.1.9 1.0.0 0.1.17 0.1.39 From e8830fccd01f0567d9507a9d3b71eff788801d86 Mon Sep 17 00:00:00 2001 From: Alexey Zavialov <> Date: Sat, 2 Mar 2024 21:39:16 +0300 Subject: [PATCH 3/8] CVE fixes, closes #133 --- api/pom.xml | 21 +++++++++++++++++++++ pom.xml | 6 ++++-- 2 files changed, 25 insertions(+), 2 deletions(-) diff --git a/api/pom.xml b/api/pom.xml index 79dcba395..b72ceb387 100644 --- a/api/pom.xml +++ b/api/pom.xml @@ -253,6 +253,27 @@ dev.cel cel + + + ch.qos.logback + logback-classic + ${logback.version} + + + ch.qos.logback + logback-core + ${logback.version} + + + com.squareup.okhttp3 + logging-interceptor + ${squareup.okhttp3.version} + + + org.apache.commons + commons-compress + ${commons.compress.version} + diff --git a/pom.xml b/pom.xml index 8f9481131..09291b02c 100644 --- a/pom.xml +++ b/pom.xml @@ -51,11 +51,13 @@ 20231013 0.3.0 33.0.0-jre - + 1.26.0 + 1.4.12 + 4.12.0 5.9.1 5.3.1 - 4.10.0 + 4.12.0 1.19.5 From e0512feb46f1739c18fd176a550a992bbe0bb821 Mon Sep 17 00:00:00 2001 From: Alexey Zavialov <> Date: Sun, 3 Mar 2024 23:02:56 +0300 Subject: [PATCH 4/8] CVE fixes, closes #133 --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 09291b02c..e87a2c074 100644 --- a/pom.xml +++ b/pom.xml @@ -34,7 +34,7 @@ 3.25.3 1.11.3 1.12.19 - 7.4.0 + 7.4.4 3.1.0 3.0.13 2.14.0 From 52c67b3b8ead5ac5b6479f39963c084d33614675 Mon Sep 17 00:00:00 2001 From: Alexey Zavialov <> Date: Mon, 4 Mar 2024 00:15:45 +0300 Subject: [PATCH 5/8] CVE fixes, closes #133 --- api/Dockerfile | 2 +- documentation/compose/postgres/Dockerfile | 4 +--- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/api/Dockerfile b/api/Dockerfile index 463ce22f3..422c020de 100644 --- a/api/Dockerfile +++ b/api/Dockerfile @@ -1,5 +1,5 @@ #FROM azul/zulu-openjdk-alpine:17-jre-headless -FROM azul/zulu-openjdk-alpine@sha256:a36679ac0d28cb835e2a8c00e1e0d95509c6c51c5081c7782b85edb1f37a771a +FROM azul/zulu-openjdk-alpine@sha256:d59f1266db40341318e563fd76c21b2880ffa5d371f0c097c29d33f89c3a0010 RUN apk add --no-cache \ # snappy codec diff --git a/documentation/compose/postgres/Dockerfile b/documentation/compose/postgres/Dockerfile index c737c43a7..0723a3f33 100644 --- a/documentation/compose/postgres/Dockerfile +++ b/documentation/compose/postgres/Dockerfile @@ -2,8 +2,6 @@ ARG image FROM ${image} -MAINTAINER Kafbat Team - -ADD data.sql /docker-entrypoint-initdb.d +COPY data.sql /docker-entrypoint-initdb.d EXPOSE 5432 From e2cde5b470b03b18403ac863e84e643e5ae7c078 Mon Sep 17 00:00:00 2001 From: Roman Zabaluev Date: Thu, 7 Mar 2024 20:03:25 +0700 Subject: [PATCH 6/8] Update CVE checks workflow name --- .github/workflows/cve.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cve.yml b/.github/workflows/cve.yml index d53913521..2a8bfbc59 100644 --- a/.github/workflows/cve.yml +++ b/.github/workflows/cve.yml @@ -1,4 +1,4 @@ -name: CVE checks docker main +name: "Infra: CVE checks" on: workflow_dispatch: schedule: From 043df7b8ac148dff991c6c2a5406018293e88dcd Mon Sep 17 00:00:00 2001 From: Alexey Zavialov <> Date: Tue, 12 Mar 2024 01:35:54 +0300 Subject: [PATCH 7/8] CVE fixes, closes #133 --- api/pom.xml | 13 ++++++++----- .../kafbat/ui/serdes/builtin/ProtobufFileSerde.java | 7 ++++++- documentation/compose/postgres/Dockerfile | 2 ++ 3 files changed, 16 insertions(+), 6 deletions(-) diff --git a/api/pom.xml b/api/pom.xml index b72ceb387..c945dcc37 100644 --- a/api/pom.xml +++ b/api/pom.xml @@ -253,26 +253,29 @@ dev.cel cel - + ch.qos.logback logback-classic - ${logback.version} + 1.4.12 + ch.qos.logback logback-core - ${logback.version} + 1.4.12 + com.squareup.okhttp3 logging-interceptor - ${squareup.okhttp3.version} + 4.12.0 + org.apache.commons commons-compress - ${commons.compress.version} + 1.26.0 diff --git a/api/src/main/java/io/kafbat/ui/serdes/builtin/ProtobufFileSerde.java b/api/src/main/java/io/kafbat/ui/serdes/builtin/ProtobufFileSerde.java index 371002696..e2fc105b9 100644 --- a/api/src/main/java/io/kafbat/ui/serdes/builtin/ProtobufFileSerde.java +++ b/api/src/main/java/io/kafbat/ui/serdes/builtin/ProtobufFileSerde.java @@ -365,7 +365,8 @@ private Map knownProtoFiles() { loadKnownProtoFile("google/protobuf/struct.proto", StructProto.getDescriptor()), loadKnownProtoFile("google/protobuf/timestamp.proto", TimestampProto.getDescriptor()), loadKnownProtoFile("google/protobuf/type.proto", TypeProto.getDescriptor()), - loadKnownProtoFile("google/protobuf/wrappers.proto", WrappersProto.getDescriptor()) + loadKnownProtoFile("google/protobuf/wrappers.proto", WrappersProto.getDescriptor()), + loadKnownProtoFile("wire/extensions.proto") ).collect(Collectors.toMap(p -> p.getLocation().getPath(), p -> p)); } @@ -382,6 +383,10 @@ private ProtoFile loadKnownProtoFile(String path, Descriptors.FileDescriptor fil return ProtoFile.Companion.get(ProtoParser.Companion.parse(Location.get(path), protoFileString)); } + private ProtoFile loadKnownProtoFile(String path) { + return ProtoFile.Companion.get(ProtoFileElement.empty(path)); + } + private Loader createFilesLoader(Map files) { return new Loader() { @Override diff --git a/documentation/compose/postgres/Dockerfile b/documentation/compose/postgres/Dockerfile index 0723a3f33..399a9dbe3 100644 --- a/documentation/compose/postgres/Dockerfile +++ b/documentation/compose/postgres/Dockerfile @@ -2,6 +2,8 @@ ARG image FROM ${image} +LABEL maintainer="Kafbat Team" + COPY data.sql /docker-entrypoint-initdb.d EXPOSE 5432 From a46c9145b4f206a047defa96cc5d1276895694d5 Mon Sep 17 00:00:00 2001 From: Roman Zabaluev Date: Sun, 17 Mar 2024 02:55:28 +0700 Subject: [PATCH 8/8] Remove unused props --- pom.xml | 3 --- 1 file changed, 3 deletions(-) diff --git a/pom.xml b/pom.xml index e87a2c074..26eeaf215 100644 --- a/pom.xml +++ b/pom.xml @@ -51,9 +51,6 @@ 20231013 0.3.0 33.0.0-jre - 1.26.0 - 1.4.12 - 4.12.0 5.9.1 5.3.1