diff --git a/.github/workflows/cron-job-its.yml b/.github/workflows/cron-job-its.yml index f0c9ad40843..b32a6d1c745 100644 --- a/.github/workflows/cron-job-its.yml +++ b/.github/workflows/cron-job-its.yml @@ -18,6 +18,10 @@ on: schedule: # Runs by default on master branch - cron: '0 3 * * *' # Runs every day at 3:00 AM UTC + pull_request: + paths: + 'owasp-dependency-check-suppressions.xml' + jobs: integration-index-tests-middleManager: strategy: @@ -86,7 +90,7 @@ jobs: env: HADOOP_PROFILE: ${{ matrix.HADOOP_PROFILE }} run: | - ${MVN} dependency-check:purge dependency-check:check ${HADOOP_PROFILE} || { echo " + mvn dependency-check:purge dependency-check:check ${HADOOP_PROFILE} || { echo " The OWASP dependency check has found security vulnerabilities. Please use a newer version of the dependency that does not have vulnerabilities. To see a report run `mvn dependency-check:check` diff --git a/LABELS b/LABELS index aff82855d8a..f989cee812f 100644 --- a/LABELS +++ b/LABELS @@ -37,7 +37,7 @@ This product bundles JSR311 API version 1.1.1, copyright Oracle and/or its affil This product bundles Expression Language 3.0 version 3.0.0., copyright Oracle and/or its affiliates., which is available under the CDDL 1.1. For details, see licenses/bin/javax.CDDL11 * https://github.com/javaee/el-spec - * org.glassfish:javax.el + * org.glassfish:jakarta.el This product bundles Jersey version 1.9, copyright Oracle and/or its affiliates., which is available under the CDDL 1.1. For details, see licenses/bin/jersey.CDDL11 diff --git a/owasp-dependency-check-suppressions.xml b/owasp-dependency-check-suppressions.xml index bf8f858e34e..c5e8efea71e 100644 --- a/owasp-dependency-check-suppressions.xml +++ b/owasp-dependency-check-suppressions.xml @@ -68,6 +68,9 @@ ~ dependency on hadoop 2.8.5 is blocking us from updating this dependency. Not a major concern since Druid ~ eats uncaught exceptions, and only displays them in logs. This issue also should only affect ingestion ~ jobs which can only be run by admin type users. + + ~ CVE-2022-45688: + ~ We do not use XML, so not impact that by this CVE --> ^pkg:maven/net\.minidev/json\-smart@.*$ CVE-2021-27568 CVE-2021-31684 + CVE-2022-45688 + CVE-2023-1370 + + + + ^pkg:maven/net\.minidev/json\-path@.*$ + CVE-2022-45688 + + + CVE-2020-36518 + CVE-2022-45688 diff --git a/pom.xml b/pom.xml index c6766d6acef..b9d264fbefb 100644 --- a/pom.xml +++ b/pom.xml @@ -526,8 +526,8 @@ org.glassfish - javax.el - 3.0.0 + jakarta.el + 3.0.4 org.glassfish.grizzly diff --git a/processing/pom.xml b/processing/pom.xml index a6889a5739b..4f093d51945 100644 --- a/processing/pom.xml +++ b/processing/pom.xml @@ -146,7 +146,7 @@ org.glassfish - javax.el + jakarta.el runtime