Tried to Fix Some Vulnerability Issues

Change-Id: I240abe1ccb8c50d10069c083a0e6ceb0f5bf49c0
Issue-ID: HOLMES-345
Signed-off-by: GuangrongFu <fu.guangrong@zte.com.cn>

1 files changed, 72 insertions, 9 deletions

diff --git a/pom.xml b/pom.xml
index 07b5f60..cb7bf34 100644
--- a/pom.xml
+++ b/pom.xml
@@ -14,7 +14,8 @@
   ~ See the License for the specific language governing permissions and

   ~ limitations under the License.

   -->

-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

     <modelVersion>4.0.0</modelVersion>

     <parent>

         <groupId>org.onap.oparent</groupId>

@@ -45,8 +46,8 @@
         <bundle.name>${project.artifactId}-${project.version}</bundle.name>

 

         <powermock.version>2.0.7</powermock.version>

-        <dropwizard.version>2.0.9</dropwizard.version>

-        <jersey.version>2.30.1</jersey.version>

+        <dropwizard.version>2.0.10</dropwizard.version>

+        <jersey.version>2.31</jersey.version>

         <jacoco.version>0.8.5</jacoco.version>

         <slf4j.version>1.7.25</slf4j.version>

 

@@ -59,6 +60,18 @@
         </sonar.coverage.jacoco.xmlReportPaths>

     </properties>

 

+    <dependencyManagement>

+        <dependencies>

+            <dependency>

+                <groupId>org.glassfish.jersey</groupId>

+                <artifactId>jersey-bom</artifactId>

+                <version>${jersey.version}</version>

+                <type>pom</type>

+                <scope>import</scope>

+            </dependency>

+        </dependencies>

+    </dependencyManagement>

+

     <dependencies>

         <dependency>

             <groupId>ch.qos.logback</groupId>

@@ -90,6 +103,10 @@
                     <groupId>org.eclipse.jetty</groupId>

                     <artifactId>jetty-server</artifactId>

                 </exclusion>

+                <exclusion>

+                    <groupId>org.checkerframework</groupId>

+                    <artifactId>checker-qual</artifactId>

+                </exclusion>

             </exclusions>

         </dependency>

         <dependency>

@@ -100,7 +117,7 @@
         <dependency>

             <groupId>org.onap.holmes.common</groupId>

             <artifactId>holmes-actions</artifactId>

-            <version>1.2.13</version>

+            <version>1.3.0</version>

             <exclusions>

                 <exclusion>

                     <groupId>org.glassfish.jersey.containers</groupId>

@@ -155,7 +172,7 @@
         <dependency>

             <groupId>org.postgresql</groupId>

             <artifactId>postgresql</artifactId>

-            <version>42.2.5</version>

+            <version>42.2.13</version>

         </dependency>

         <dependency>

             <groupId>junit</groupId>

@@ -183,7 +200,7 @@
         <dependency>

             <groupId>io.swagger</groupId>

             <artifactId>swagger-jersey2-jaxrs</artifactId>

-            <version>1.5.3</version>

+            <version>1.6.1</version>

             <exclusions>

                 <exclusion>

                     <groupId>com.fasterxml.jackson.core</groupId>

@@ -205,6 +222,14 @@
                     <groupId>org.glassfish.jersey.containers</groupId>

                     <artifactId>jersey-container-servlet-core</artifactId>

                 </exclusion>

+                <exclusion>

+                    <groupId>com.fasterxml.jackson.jaxrs</groupId>

+                    <artifactId>jackson-jaxrs-json-provider</artifactId>

+                </exclusion>

+                <exclusion>

+                    <groupId>com.fasterxml.jackson.jaxrs</groupId>

+                    <artifactId>jackson-datatype-joda</artifactId>

+                </exclusion>

             </exclusions>

             <scope>provided</scope>

         </dependency>

@@ -295,7 +320,6 @@
         <dependency>

             <groupId>org.glassfish.jersey.core</groupId>

             <artifactId>jersey-server</artifactId>

-            <version>${jersey.version}</version>

             <exclusions>

                 <exclusion>

                     <groupId>javax.validation</groupId>

@@ -306,18 +330,57 @@
         <dependency>

             <groupId>org.glassfish.jersey.core</groupId>

             <artifactId>jersey-client</artifactId>

-            <version>${jersey.version}</version>

         </dependency>

         <dependency>

             <groupId>org.glassfish.jersey.core</groupId>

             <artifactId>jersey-common</artifactId>

-            <version>${jersey.version}</version>

+        </dependency>

+        <dependency>

+            <groupId>javax.annotation</groupId>

+            <artifactId>javax.annotation-api</artifactId>

+            <version>1.3.2</version>

+        </dependency>

+        <dependency>

+            <groupId>javax.xml.bind</groupId>

+            <artifactId>jaxb-api</artifactId>

+            <version>2.4.0-b180725.0427</version>

+        </dependency>

+        <dependency>

+            <groupId>org.glassfish.jaxb</groupId>

+            <artifactId>jaxb-runtime</artifactId>

+            <version>2.4.0-b180725.0644</version>

         </dependency>

     </dependencies>

 

     <build>

         <plugins>

             <plugin>

+                <groupId>org.apache.maven.plugins</groupId>

+                <artifactId>maven-compiler-plugin</artifactId>

+                <version>3.8.0</version>

+                <configuration>

+                    <release>11</release>

+                </configuration>

+            </plugin>

+<!--            <plugin>-->

+<!--                <groupId>org.apache.maven.plugins</groupId>-->

+<!--                <artifactId>maven-enforcer-plugin</artifactId>-->

+<!--                <version>1.4.1</version>-->

+<!--                <executions>-->

+<!--                    <execution>-->

+<!--                        <id>enforce</id>-->

+<!--                        <configuration>-->

+<!--                            <rules>-->

+<!--                                <dependencyConvergence/>-->

+<!--                            </rules>-->

+<!--                        </configuration>-->

+<!--                        <goals>-->

+<!--                            <goal>enforce</goal>-->

+<!--                        </goals>-->

+<!--                    </execution>-->

+<!--                </executions>-->

+<!--            </plugin>-->

+            <plugin>

                 <groupId>org.jacoco</groupId>

                 <artifactId>jacoco-maven-plugin</artifactId>

                 <version>${jacoco.version}</version>