Skip to content

Full Upgrade of First Party Library Dependencies

Chad Leong requested to merge dependency-upgrade into master

This generated MR upgrades the first party libraries (other OSDU libraries) to utilize the latest release. The intent is to keep all dependent libraries up to date. This upgrade can be merged immediately without further approval if the CI pipeline reports success.

If this MR has failed, we need to work with the maintainers and affected provider teams to find a solution.

Dependency Information Before the Upgrade

Branch: master
SHA:    b24aa95bfa9fa0f1d396fe92b6d47ea3c9fcd937
Maven:  0.25.0-SNAPSHOT
Maven Dependencies Root testing/
core-lib-azure 0.24.0
core-lib-gc 0.24.0 0.24.0
os-core-lib-aws 0.24.0 0.24.0
os-core-common 0.24.0 0.24.0
os-core-lib-ibm 0.24.0 0.24.0
core 0.24.0-rc7
postgres 0.24.0-rc7
osm 0.24.0
(3rd Party) org.apache.logging.log4j.log4j-api 2.17.1, 2.17.2 2.17.2, 2.13.3
(3rd Party) org.apache.logging.log4j.log4j-to-slf4j 2.17.1, 2.17.2 2.17.2, 2.13.3
(3rd Party) org.yaml.snakeyaml 2.0, 1.33, 1.30 1.30, 2.0 
Critical: Found Vulnerable Snake YAML dependency (<2.0)
├─ _Root_
│  ├─ org.opengroup.osdu.partition-ibm == 0.25.0-SNAPSHOT
│  │  └─ org.yaml.snakeyaml == 1.33
│  ├─ org.opengroup.osdu.partition-gc == 0.25.0-SNAPSHOT
│  │  └─ org.springframework.boot.spring-boot-starter-security == 2.7.10
│  │     └─ org.springframework.boot.spring-boot-starter == 2.7.10
│  │        └─ org.yaml.snakeyaml == 1.30
│  └─ org.opengroup.osdu.partition-core-plus == 0.25.0-SNAPSHOT
│     └─ org.opengroup.osdu.os-osm.postgres == 0.24.0-rc7
│        └─ org.springframework.boot.spring-boot-starter-web == 2.7.10
│           └─ org.springframework.boot.spring-boot-starter == 2.7.10
│              └─ org.yaml.snakeyaml == 1.30
└─ testing/
├─ org.opengroup.osdu.partition.partition-test-aws == 0.25.0-SNAPSHOT
│  └─ org.opengroup.osdu.core.aws.os-core-lib-aws == 0.24.0
│     └─ org.springframework.boot.spring-boot-starter-web == 2.7.7
│        └─ org.springframework.boot.spring-boot-starter == 2.7.7
│           └─ org.yaml.snakeyaml == 1.30
└─ org.opengroup.osdu.partition.partition-test-gc == 0.25.0-SNAPSHOT
└─ org.opengroup.osdu.core-lib-gc == 0.24.0
└─ org.opengroup.osdu.os-core-common == 0.24.0
└─ org.springframework.boot.spring-boot-starter-web == 2.7.7
└─ org.springframework.boot.spring-boot-starter == 2.7.7
└─ org.yaml.snakeyaml == 1.30

Dependency Information After the Upgrade

Branch: dependency-upgrade
SHA:    31e0a87e7cc2606030412f5b863b3b5ceb105e20
Maven:  0.25.0-SNAPSHOT
Maven Dependencies Root testing/
core-lib-azure 0.24.0
core-lib-gc 0.24.0 0.24.0
os-core-lib-aws 0.24.0 0.24.0
os-core-common 0.24.0 0.24.0
os-core-lib-ibm 0.24.0 0.24.0
postgres 0.24.0
osm 0.24.0
(3rd Party) org.apache.logging.log4j.log4j-api 2.17.1, 2.17.2 2.17.2, 2.13.3
(3rd Party) org.apache.logging.log4j.log4j-to-slf4j 2.17.1, 2.17.2 2.17.2, 2.13.3
(3rd Party) org.yaml.snakeyaml 2.0, 1.33, 1.30 1.30, 2.0 
Critical: Found Vulnerable Snake YAML dependency (<2.0)
├─ _Root_
│  ├─ org.opengroup.osdu.partition-ibm == 0.25.0-SNAPSHOT
│  │  └─ org.yaml.snakeyaml == 1.33
│  ├─ org.opengroup.osdu.partition-gc == 0.25.0-SNAPSHOT
│  │  └─ org.springframework.boot.spring-boot-starter-security == 2.7.10
│  │     └─ org.springframework.boot.spring-boot-starter == 2.7.10
│  │        └─ org.yaml.snakeyaml == 1.30
│  └─ org.opengroup.osdu.partition-core-plus == 0.25.0-SNAPSHOT
│     └─ org.opengroup.osdu.partition-core == 0.25.0-SNAPSHOT
│        └─ org.springframework.boot.spring-boot-starter-web == 2.7.10
│           └─ org.springframework.boot.spring-boot-starter == 2.7.10
│              └─ org.yaml.snakeyaml == 1.30
└─ testing/
├─ org.opengroup.osdu.partition.partition-test-aws == 0.25.0-SNAPSHOT
│  └─ org.opengroup.osdu.core.aws.os-core-lib-aws == 0.24.0
│     └─ org.springframework.boot.spring-boot-starter-web == 2.7.7
│        └─ org.springframework.boot.spring-boot-starter == 2.7.7
│           └─ org.yaml.snakeyaml == 1.30
└─ org.opengroup.osdu.partition.partition-test-gc == 0.25.0-SNAPSHOT
└─ org.opengroup.osdu.core-lib-gc == 0.24.0
└─ org.opengroup.osdu.os-core-common == 0.24.0
└─ org.springframework.boot.spring-boot-starter-web == 2.7.7
└─ org.springframework.boot.spring-boot-starter == 2.7.7
└─ org.yaml.snakeyaml == 1.30

Merge request reports