eclipse-tractusx / digital-product-pass

digital product pass

https://github.com/eclipse-tractusx/digital-product-pass

Apache License 2.0

21 stars 11 forks source link

Release/v2.3.0 security fixes: chore(fix): fixed springboot security vulnerabilities and added codeql workflow #289

Closed saudkhan116 closed 2 months ago

saudkhan116 commented 2 months ago

Why we create this PR?

Added CodeQL workflow to analyze the codebase as a requirement from the release guidelines
Removed veracode workflows from git actions (replaced by CodeQL).

What we want to achieve with this PR?

To meet the trg-8 requirements

What is new?

Added

Added CodeQL code analysis to the workflow to comply with the release guidelines

Deleted

Removed veracode workflows from git actions (replaced by CodeQL).

Security Fixes:

Fixed the following spring security vulnerabilities:
- CVE-2024-22234
- CVE-2024-22257
- CVE-2024-22243
- CVE-2024-22259

github-advanced-security[bot] commented 2 months ago

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

saudkhan116 commented 2 months ago

This PR is closed becasue the branch is renamed. Opened another PR here #293