Update aws-java-sdk-s3 to remove ion-java

emdash-ie commented 7 months ago

What does this change?

There’s a vulnerability in ion-java, which is depended on by the current version of aws-java-sdk-s3, but removed from 1.12.638 forward. This change updates that dependency to its newest version to remove the ion-java dependency and facilitate removal of the vulnerability from projects which depend on this one.

How to test

To test this, I suppose I could make a snapshot release, and then run the tests of each dependent listed below with the snapshot version to make sure the tests pass. Should I?

How can we measure success?

Updates become possible to more projects to remove the ion-java vulnerability.
Nothing breaks.

Deployment

[ ] Updated facia-tool to use latest version
[ ] Updated frontend to use latest version
[ ] Updated MAPI to use latest version
[ ] Updated Ophan to use latest version
[ ] Updated story-packages to use latest version
[ ] Updated apple-news to use latest version
[ ] Checked for other downstream dependencies (perhaps via snyk or github search)

emdash-ie commented 7 months ago

This supersedes PR 297, which is a scala steward PR updating to a slightly less new version. Maybe we should just go with the scala steward PR?

Divs-B commented 7 months ago

This supersedes PR 297, which is a scala steward PR updating to a slightly less new version. Maybe we should just go with the scala steward PR?

Yes I think lets go ahead with Scala-steward PR(s), good to have upgrade anyway across the board, lets see if that fixes ion-java too if not then will take ahead your PR.

gu-scala-library-release[bot] commented 7 months ago

@Divs-B has published a preview version of this PR with release workflow run #13, based on commit c11bcb4e0308567742ade7c404eb8cd6f0241aaf:

5.0.4-PREVIEW.update-aws-java-sdk-s3.2024-03-06T1657.c11bcb4e

Want to make another preview release?

Click 'Run workflow' in the [GitHub UI](https://github.com/guardian/facia-scala-client/actions/workflows/release.yml), specifying the update-aws-java-sdk-s3 branch, or use the [GitHub CLI](https://cli.github.com/) command: gh workflow run release.yml --ref update-aws-java-sdk-s3

Want to make a full release after this PR is merged?

Click 'Run workflow' in the [GitHub UI](https://github.com/guardian/facia-scala-client/actions/workflows/release.yml), leaving the branch as the default, or use the [GitHub CLI](https://cli.github.com/) command: gh workflow run release.yml

guardian / facia-scala-client