From 4fd4c2c076eecbda58f69d82f7a5061c69250584 Mon Sep 17 00:00:00 2001 From: Manish Jangid <msjangid@amazon.com> Date: Tue, 24 Jan 2023 12:08:06 -0600 Subject: [PATCH] Update core common lib version and fix vulnerable libs --- NOTICE | 74 +++++++++++++++------------------------------------------- 1 file changed, 19 insertions(+), 55 deletions(-) diff --git a/NOTICE b/NOTICE index ccb4241fa..5d438117e 100644 --- a/NOTICE +++ b/NOTICE @@ -3,13 +3,6 @@ Generated by fossa-cli (https://github.com/fossas/fossa-cli). Formatted by fossa-with-cache (https://community.opengroup.org/divido/fossa-with-cache). This software includes the following software and licenses: -======================================================================== -AML -======================================================================== -The following software have components provided under the terms of this license: - -- SnakeYAML (from http://code.google.com/p/snakeyaml/, http://www.snakeyaml.org, https://bitbucket.org/snakeyaml/snakeyaml) - ======================================================================== Android-Sdk ======================================================================== @@ -32,7 +25,6 @@ The following software have components provided under the terms of this license: - Microsoft Application Insights Log4j 2 Appender (from https://github.com/Microsoft/ApplicationInsights-Java) - Proton-J (from https://repo1.maven.org/maven2/org/apache/qpid/proton-j) - QpidJMS Client (from https://repo1.maven.org/maven2/org/apache/qpid/qpid-jms-client) -- tomcat-embed-el (from http://tomcat.apache.org/, https://tomcat.apache.org/) ======================================================================== Apache-2.0 @@ -95,7 +87,6 @@ The following software have components provided under the terms of this license: - Commons Digester (from http://commons.apache.org/digester/) - Converter: Jackson (from https://github.com/square/retrofit, https://repo1.maven.org/maven2/com/squareup/retrofit2/converter-jackson) - Core functionality for the Reactor Netty library (from https://github.com/reactor/reactor-netty) -- Expression Language 3.0 (from http://el-spec.java.net, http://uel.java.net, https://projects.eclipse.org/projects/ee4j.el) - FindBugs-jsr305 (from http://findbugs.sourceforge.net/) - GSON extensions to the Google HTTP Client Library for Java. (from https://repo1.maven.org/maven2/com/google/http-client/google-http-client-gson) - Google APIs Client Library for Java (from https://repo1.maven.org/maven2/com/google/api-client/google-api-client) @@ -148,7 +139,7 @@ The following software have components provided under the terms of this license: - Jackson-dataformat-YAML (from https://github.com/FasterXML/jackson, https://github.com/FasterXML/jackson-dataformats-text) - Jackson-module-parameter-names (from https://repo1.maven.org/maven2/com/fasterxml/jackson/module/jackson-module-parameter-names) - Jakarta Bean Validation API (from https://beanvalidation.org) -- Jakarta Servlet (from https://javaee.github.io/servlet-spec/, https://projects.eclipse.org/projects/ee4j.servlet) +- Jakarta Servlet (from https://projects.eclipse.org/projects/ee4j.servlet) - Jakarta XML Binding API (from https://repo1.maven.org/maven2/jakarta/xml/bind/jakarta.xml.bind-api, https://repo1.maven.org/maven2/org/jboss/spec/javax/xml/bind/jboss-jaxb-api_2.3_spec) - Java Architecture for XML Binding (from http://jaxb.java.net/, https://repo1.maven.org/maven2/javax/xml/bind/jaxb-api) - Java Native Access (from https://github.com/java-native-access/jna, https://github.com/twall/jna) @@ -171,7 +162,6 @@ The following software have components provided under the terms of this license: - Kotlin Stdlib Jdk8 (from https://kotlinlang.org/) - LatencyUtils (from http://latencyutils.github.io/LatencyUtils/) - Lucene Core (from https://repo1.maven.org/maven2/org/apache/lucene/lucene-core) -- MapStruct Core (from http://mapstruct.org/mapstruct/, https://repo1.maven.org/maven2/org/mapstruct/mapstruct) - Metrics Core (from https://repo1.maven.org/maven2/io/dropwizard/metrics/metrics-core) - Microsoft Application Insights Java Agent (from https://github.com/Microsoft/ApplicationInsights-Java) - Microsoft Application Insights Java SDK Spring Boot starter (from https://github.com/Microsoft/ApplicationInsights-Java) @@ -197,7 +187,6 @@ The following software have components provided under the terms of this license: - Netty/Resolver (from https://repo1.maven.org/maven2/io/netty/netty-resolver) - Netty/Resolver/DNS (from https://repo1.maven.org/maven2/io/netty/netty-resolver-dns) - Netty/Resolver/DNS/Classes/MacOS (from https://repo1.maven.org/maven2/io/netty/netty-resolver-dns-classes-macos) -- Netty/TomcatNative [BoringSSL - Static] (from https://github.com/netty/netty-tcnative/netty-tcnative-boringssl-static/) - Netty/Transport (from https://repo1.maven.org/maven2/io/netty/netty-transport) - Netty/Transport/Classes/Epoll (from https://repo1.maven.org/maven2/io/netty/netty-transport-classes-epoll) - Netty/Transport/Classes/KQueue (from https://repo1.maven.org/maven2/io/netty/netty-transport-classes-kqueue) @@ -274,6 +263,7 @@ The following software have components provided under the terms of this license: - Spring Web (from http://www.springframework.org, https://github.com/spring-projects/spring-framework, https://repo1.maven.org/maven2/org/springframework/spring-web) - Spring Web MVC (from https://github.com/spring-projects/spring-framework, https://repo1.maven.org/maven2/org/springframework/spring-webmvc) - Spring WebFlux (from https://github.com/spring-projects/spring-framework) +- Swagger UI (from http://webjars.org) - Undertow Core (from https://repo1.maven.org/maven2/io/undertow/undertow-core) - Undertow Servlet (from https://repo1.maven.org/maven2/io/undertow/undertow-servlet) - Undertow WebSockets JSR356 implementations (from https://repo1.maven.org/maven2/io/undertow/undertow-websockets-jsr) @@ -327,19 +317,9 @@ The following software have components provided under the terms of this license: - resilience4j (from https://github.com/resilience4j/resilience4j, https://resilience4j.readme.io, ttps://resilience4j.readme.io) - spring-boot-starter-undertow (from https://spring.io/projects/spring-boot) - spring-security-crypto (from http://spring.io/spring-security, https://spring.io/projects/spring-security, https://spring.io/spring-security) -- springfox-bean-validators (from https://github.com/springfox/springfox) -- springfox-boot-starter (from https://github.com/springfox/springfox) -- springfox-core (from https://github.com/springfox/springfox) -- springfox-data-rest (from https://github.com/springfox/springfox) -- springfox-oas (from https://github.com/springfox/springfox) -- springfox-schema (from https://github.com/springfox/springfox) -- springfox-spi (from https://github.com/springfox/springfox) -- springfox-spring-web (from https://github.com/springfox/springfox) -- springfox-spring-webflux (from https://github.com/springfox/springfox) -- springfox-spring-webmvc (from https://github.com/springfox/springfox) -- springfox-swagger-common (from https://github.com/springfox/springfox) -- springfox-swagger-ui (from https://github.com/springfox/springfox) -- springfox-swagger2 (from https://github.com/springfox/springfox) +- springdoc-openapi-common (from https://repo1.maven.org/maven2/org/springdoc/springdoc-openapi-common) +- springdoc-openapi-ui (from https://repo1.maven.org/maven2/org/springdoc/springdoc-openapi-ui) +- springdoc-openapi-webmvc-core (from https://repo1.maven.org/maven2/org/springdoc/springdoc-openapi-webmvc-core) - swagger-annotations (from https://repo1.maven.org/maven2/io/swagger/core/v3/swagger-annotations, https://repo1.maven.org/maven2/io/swagger/swagger-annotations) - swagger-core (from https://repo1.maven.org/maven2/io/swagger/core/v3/swagger-core, https://repo1.maven.org/maven2/io/swagger/swagger-core) - swagger-jaxrs (from https://repo1.maven.org/maven2/io/swagger/swagger-jaxrs) @@ -360,7 +340,6 @@ The following software have components provided under the terms of this license: - GAX (Google Api eXtensions) for Java (gRPC) (from https://repo1.maven.org/maven2/com/google/api/gax-grpc) - Hamcrest (from http://hamcrest.org/JavaHamcrest/) - Hamcrest Core (from http://hamcrest.org/, http://hamcrest.org/JavaHamcrest/, https://repo1.maven.org/maven2/org/hamcrest/hamcrest-core) -- Hamcrest Library (from http://hamcrest.org/JavaHamcrest/) - HdrHistogram (from http://hdrhistogram.github.io/HdrHistogram/) - Jodd BeanUtil (from http://jodd.org) - Jodd Core (from http://jodd.org) @@ -375,7 +354,6 @@ The following software have components provided under the terms of this license: - API Common (from https://github.com/googleapis, https://github.com/googleapis/api-common-java, https://repo1.maven.org/maven2/com/google/api/api-common) - ASM Core (from http://asm.ow2.io/, http://asm.ow2.org/) - AspectJ Weaver (from http://www.aspectj.org, https://www.eclipse.org/aspectj/) -- Expression Language 3.0 (from http://el-spec.java.net, http://uel.java.net, https://projects.eclipse.org/projects/ee4j.el) - GAX (Google Api eXtensions) for Java (Core) (from https://repo1.maven.org/maven2/com/google/api/gax) - GAX (Google Api eXtensions) for Java (HTTP JSON) (from https://repo1.maven.org/maven2/com/google/api/gax-httpjson) - GAX (Google Api eXtensions) for Java (gRPC) (from https://repo1.maven.org/maven2/com/google/api/gax-grpc) @@ -386,7 +364,6 @@ The following software have components provided under the terms of this license: - Hamcrest (from http://hamcrest.org/JavaHamcrest/) - Hamcrest Core (from http://hamcrest.org/, http://hamcrest.org/JavaHamcrest/, https://repo1.maven.org/maven2/org/hamcrest/hamcrest-core) - JBoss Jakarta Annotations API (from https://github.com/jboss/jboss-jakarta-annotations-api_spec) -- Jackson module: Afterburner (from http://wiki.fasterxml.com/JacksonHome, https://github.com/FasterXML/jackson-modules-base) - Jakarta Activation API (from https://github.com/eclipse-ee4j/jaf, https://github.com/jakartaee/jaf-api, https://repo1.maven.org/maven2/jakarta/activation/jakarta.activation-api) - Jakarta Annotations API (from https://projects.eclipse.org/projects/ee4j.ca) - Jakarta WebSocket - Server API (from https://projects.eclipse.org/projects/ee4j.websocket, https://repo1.maven.org/maven2/org/jboss/spec/javax/websocket/jboss-websocket-api_1.1_spec) @@ -448,11 +425,11 @@ The following software have components provided under the terms of this license: - Guava: Google Core Libraries for Java (from http://code.google.com/p/guava-libraries, https://github.com/google/guava, https://repo1.maven.org/maven2/com/google/guava/guava) - HdrHistogram (from http://hdrhistogram.github.io/HdrHistogram/) -- Hibernate Validator (from https://repo1.maven.org/maven2/org/hibernate/hibernate-validator, https://repo1.maven.org/maven2/org/hibernate/validator/hibernate-validator) - LatencyUtils (from http://latencyutils.github.io/LatencyUtils/) - MongoDB Java Driver (from http://mongodb.org/, http://www.mongodb.org, https://www.mongodb.com/) - Netty/Common (from https://repo1.maven.org/maven2/io/netty/netty-common) - Prometheus Java Simpleclient (from https://repo1.maven.org/maven2/io/prometheus/simpleclient) +- RabbitMQ Java Client (from http://www.rabbitmq.com, https://www.rabbitmq.com) - Undertow Core (from https://repo1.maven.org/maven2/io/undertow/undertow-core) - reactive-streams (from http://www.reactive-streams.org/) @@ -462,7 +439,6 @@ CDDL-1.0 The following software have components provided under the terms of this license: - Apache Log4j Core (from https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core) -- Expression Language 3.0 (from http://el-spec.java.net, http://uel.java.net, https://projects.eclipse.org/projects/ee4j.el) - Jakarta Activation API (from https://github.com/eclipse-ee4j/jaf, https://github.com/jakartaee/jaf-api, https://repo1.maven.org/maven2/jakarta/activation/jakarta.activation-api) - Java Architecture for XML Binding (from http://jaxb.java.net/, https://repo1.maven.org/maven2/javax/xml/bind/jaxb-api) - JavaBeans Activation Framework (from https://repo1.maven.org/maven2/com/sun/activation/javax.activation) @@ -474,12 +450,7 @@ CDDL-1.1 ======================================================================== The following software have components provided under the terms of this license: -- Common Annotations 1.2 API -- Expression Language 3.0 (from http://el-spec.java.net, http://uel.java.net, https://projects.eclipse.org/projects/ee4j.el) -- Jakarta Servlet (from https://javaee.github.io/servlet-spec/, https://projects.eclipse.org/projects/ee4j.servlet) -- Jakarta WebSocket - Server API (from https://projects.eclipse.org/projects/ee4j.websocket, https://repo1.maven.org/maven2/org/jboss/spec/javax/websocket/jboss-websocket-api_1.1_spec) - Java Architecture for XML Binding (from http://jaxb.java.net/, https://repo1.maven.org/maven2/javax/xml/bind/jaxb-api) -- Java Servlet 4.0 API - JavaBeans Activation Framework (from https://repo1.maven.org/maven2/com/sun/activation/javax.activation) - JavaMail API (from https://repo1.maven.org/maven2/com/sun/mail/javax.mail) - javax.annotation-api (from http://jcp.org/en/jsr/detail?id=250) @@ -498,7 +469,6 @@ EPL-1.0 The following software have components provided under the terms of this license: - AspectJ Weaver (from http://www.aspectj.org, https://www.eclipse.org/aspectj/) -- Expression Language 3.0 (from http://el-spec.java.net, http://uel.java.net, https://projects.eclipse.org/projects/ee4j.el) - JUnit Jupiter (Aggregator) (from https://junit.org/junit5/) - JUnit Jupiter API (from http://junit.org/junit5/, https://junit.org/junit5/) - JUnit Jupiter Engine (from http://junit.org/junit5/, https://junit.org/junit5/) @@ -508,7 +478,7 @@ The following software have components provided under the terms of this license: - Jakarta Activation API (from https://github.com/eclipse-ee4j/jaf, https://github.com/jakartaee/jaf-api, https://repo1.maven.org/maven2/jakarta/activation/jakarta.activation-api) - Jakarta Annotations API (from https://projects.eclipse.org/projects/ee4j.ca) - Jakarta Bean Validation API (from https://beanvalidation.org) -- Jakarta Servlet (from https://javaee.github.io/servlet-spec/, https://projects.eclipse.org/projects/ee4j.servlet) +- Jakarta Servlet (from https://projects.eclipse.org/projects/ee4j.servlet) - Jakarta WebSocket - Server API (from https://projects.eclipse.org/projects/ee4j.websocket, https://repo1.maven.org/maven2/org/jboss/spec/javax/websocket/jboss-websocket-api_1.1_spec) - Jakarta XML Binding API (from https://repo1.maven.org/maven2/jakarta/xml/bind/jakarta.xml.bind-api, https://repo1.maven.org/maven2/org/jboss/spec/javax/xml/bind/jboss-jaxb-api_2.3_spec) - Java Servlet 4.0 API @@ -528,7 +498,6 @@ EPL-2.0 The following software have components provided under the terms of this license: - AspectJ Weaver (from http://www.aspectj.org, https://www.eclipse.org/aspectj/) -- Expression Language 3.0 (from http://el-spec.java.net, http://uel.java.net, https://projects.eclipse.org/projects/ee4j.el) - JBoss Jakarta Annotations API (from https://github.com/jboss/jboss-jakarta-annotations-api_spec) - JUnit Jupiter (Aggregator) (from https://junit.org/junit5/) - JUnit Jupiter API (from http://junit.org/junit5/, https://junit.org/junit5/) @@ -539,7 +508,7 @@ The following software have components provided under the terms of this license: - Jakarta Activation API (from https://github.com/eclipse-ee4j/jaf, https://github.com/jakartaee/jaf-api, https://repo1.maven.org/maven2/jakarta/activation/jakarta.activation-api) - Jakarta Annotations API (from https://projects.eclipse.org/projects/ee4j.ca) - Jakarta Bean Validation API (from https://beanvalidation.org) -- Jakarta Servlet (from https://javaee.github.io/servlet-spec/, https://projects.eclipse.org/projects/ee4j.servlet) +- Jakarta Servlet (from https://projects.eclipse.org/projects/ee4j.servlet) - Jakarta WebSocket - Server API (from https://projects.eclipse.org/projects/ee4j.websocket, https://repo1.maven.org/maven2/org/jboss/spec/javax/websocket/jboss-websocket-api_1.1_spec) - Jakarta XML Binding API (from https://repo1.maven.org/maven2/jakarta/xml/bind/jakarta.xml.bind-api, https://repo1.maven.org/maven2/org/jboss/spec/javax/xml/bind/jboss-jaxb-api_2.3_spec) - Java Servlet 4.0 API @@ -549,12 +518,10 @@ GPL-2.0-only ======================================================================== The following software have components provided under the terms of this license: -- Expression Language 3.0 (from http://el-spec.java.net, http://uel.java.net, https://projects.eclipse.org/projects/ee4j.el) - JBoss Jakarta Annotations API (from https://github.com/jboss/jboss-jakarta-annotations-api_spec) - Jakarta Annotations API (from https://projects.eclipse.org/projects/ee4j.ca) - Jakarta WebSocket - Server API (from https://projects.eclipse.org/projects/ee4j.websocket, https://repo1.maven.org/maven2/org/jboss/spec/javax/websocket/jboss-websocket-api_1.1_spec) - Java Architecture for XML Binding (from http://jaxb.java.net/, https://repo1.maven.org/maven2/javax/xml/bind/jaxb-api) -- Java Servlet 4.0 API - JavaBeans Activation Framework (from https://repo1.maven.org/maven2/com/sun/activation/javax.activation) - RabbitMQ Java Client (from http://www.rabbitmq.com, https://www.rabbitmq.com) - tomcat-embed-core (from http://tomcat.apache.org/) @@ -572,18 +539,16 @@ GPL-2.0-with-classpath-exception The following software have components provided under the terms of this license: - Checker Qual (from https://checkerframework.org) -- Expression Language 3.0 (from http://el-spec.java.net, http://uel.java.net, https://projects.eclipse.org/projects/ee4j.el) - JBoss Jakarta Annotations API (from https://github.com/jboss/jboss-jakarta-annotations-api_spec) - Jakarta Activation API (from https://github.com/eclipse-ee4j/jaf, https://github.com/jakartaee/jaf-api, https://repo1.maven.org/maven2/jakarta/activation/jakarta.activation-api) - Jakarta Annotations API (from https://projects.eclipse.org/projects/ee4j.ca) - Jakarta Bean Validation API (from https://beanvalidation.org) -- Jakarta Servlet (from https://javaee.github.io/servlet-spec/, https://projects.eclipse.org/projects/ee4j.servlet) +- Jakarta Servlet (from https://projects.eclipse.org/projects/ee4j.servlet) - Jakarta WebSocket - Server API (from https://projects.eclipse.org/projects/ee4j.websocket, https://repo1.maven.org/maven2/org/jboss/spec/javax/websocket/jboss-websocket-api_1.1_spec) - Jakarta XML Binding API (from https://repo1.maven.org/maven2/jakarta/xml/bind/jakarta.xml.bind-api, https://repo1.maven.org/maven2/org/jboss/spec/javax/xml/bind/jboss-jaxb-api_2.3_spec) - Java Architecture for XML Binding (from http://jaxb.java.net/, https://repo1.maven.org/maven2/javax/xml/bind/jaxb-api) - Java Servlet 4.0 API - JavaBeans Activation Framework (from https://repo1.maven.org/maven2/com/sun/activation/javax.activation) -- RabbitMQ Java Client (from http://www.rabbitmq.com, https://www.rabbitmq.com) - javax.annotation-api (from http://jcp.org/en/jsr/detail?id=250) - tomcat-embed-core (from http://tomcat.apache.org/) @@ -592,9 +557,8 @@ GPL-3.0-only ======================================================================== The following software have components provided under the terms of this license: -- Expression Language 3.0 (from http://el-spec.java.net, http://uel.java.net, https://projects.eclipse.org/projects/ee4j.el) - Jakarta Annotations API (from https://projects.eclipse.org/projects/ee4j.ca) -- Jakarta Servlet (from https://javaee.github.io/servlet-spec/, https://projects.eclipse.org/projects/ee4j.servlet) +- Jakarta Servlet (from https://projects.eclipse.org/projects/ee4j.servlet) - Java Architecture for XML Binding (from http://jaxb.java.net/, https://repo1.maven.org/maven2/javax/xml/bind/jaxb-api) - Java Servlet 4.0 API @@ -604,7 +568,6 @@ ISC The following software have components provided under the terms of this license: - Java Native Access Platform (from https://github.com/java-native-access/jna) -- Spring Security - Core (from http://spring.io/spring-security, https://repo1.maven.org/maven2/org/springframework/security/spring-security-core, https://spring.io/projects/spring-security, https://spring.io/spring-security) - spring-security-crypto (from http://spring.io/spring-security, https://spring.io/projects/spring-security, https://spring.io/spring-security) ======================================================================== @@ -647,13 +610,6 @@ The following software have components provided under the terms of this license: - Javassist (from http://www.javassist.org/) - SnakeYAML (from http://code.google.com/p/snakeyaml/, http://www.snakeyaml.org, https://bitbucket.org/snakeyaml/snakeyaml) -======================================================================== -LGPL-3.0-only -======================================================================== -The following software have components provided under the terms of this license: - -- RabbitMQ Java Client (from http://www.rabbitmq.com, https://www.rabbitmq.com) - ======================================================================== MIT ======================================================================== @@ -715,6 +671,7 @@ The following software have components provided under the terms of this license: - msal4j (from https://github.com/AzureAD/microsoft-authentication-library-for-java) - msal4j-persistence-extension (from https://github.com/AzureAD/microsoft-authentication-extensions-for-java) - qpid-proton-j-extensions (from https://github.com/Azure/qpid-proton-j-extensions) +- webjars-locator-core (from http://webjars.org) ======================================================================== MPL-1.1 @@ -774,18 +731,25 @@ The following software have components provided under the terms of this license: - Netty/Codec (from https://repo1.maven.org/maven2/io/netty/netty-codec) +======================================================================== +mit-old-style-no-advert +======================================================================== +The following software have components provided under the terms of this license: + +- Brave (from https://repo1.maven.org/maven2/io/zipkin/brave/brave) + ======================================================================== public-domain ======================================================================== The following software have components provided under the terms of this license: +- Apache Groovy (from http://groovy-lang.org, http://groovy.codehaus.org/, https://groovy-lang.org) - HdrHistogram (from http://hdrhistogram.github.io/HdrHistogram/) - JBoss Logging 3 (from http://www.jboss.org) - JSON in Java (from https://github.com/douglascrockford/JSON-java) - LatencyUtils (from http://latencyutils.github.io/LatencyUtils/) - Microsoft Azure client library for Blob Storage (from https://github.com/Azure/azure-sdk-for-java) - PostgreSQL JDBC Driver -- RabbitMQ Java Client (from http://www.rabbitmq.com, https://www.rabbitmq.com) - Undertow Core (from https://repo1.maven.org/maven2/io/undertow/undertow-core) - Undertow Servlet (from https://repo1.maven.org/maven2/io/undertow/undertow-servlet) - Undertow WebSockets JSR356 implementations (from https://repo1.maven.org/maven2/io/undertow/undertow-websockets-jsr) -- GitLab