Dblatcher/akka and logback vulnerabilities - Githubissues

guardian / grid

The Guardian’s image management system

https://www.theguardian.com/info/developer-blog/2015/aug/12/open-sourcing-grid-image-service

Apache License 2.0

1.44k stars 121 forks source link

Dblatcher/akka and logback vulnerabilities #4298

Closed dblatcher closed 2 months ago

dblatcher commented 2 months ago

What does this change?

Addresses vulnerabilities:

adds dependency overrides to patch vulnerabilities in logback-classic and akka-http-core
patches kinesis-logback-appender to 1.4.4 (did not upgrade to v2 as relies on awsSdk v2 - Grid currently using awsSdk v1)

How should a reviewer test this change?

project should still compile, test and run - healthchecks for all services should pass.

How can success be measured?

reduction in vulnerabilities

Who should look at this?

Tested? Documented?

[ ] locally by committer
[ ] locally by Guardian reviewer
[ ] on the Guardian's TEST environment
[ ] relevant documentation added or amended (if needed)

github-actions[bot] commented 2 months ago

Deploy build 12594 to TEST

All deployment options

- [Deploy build 12594 to TEST](https://riffraff.gutools.co.uk/deployment/deployAgain?project=media-service%3A%3Agrid%3A%3Aall&build=12594&stage=TEST&updateStrategy=MostlyHarmless&action=deploy) - [Deploy parts of build 12594 to TEST by previewing it first](https://riffraff.gutools.co.uk/preview/yaml?project=media-service%3A%3Agrid%3A%3Aall&build=12594&stage=TEST&updateStrategy=MostlyHarmless)

From guardian/actions-riff-raff.