Update dependencies CVE - Githubissues

jaegertracing / spark-dependencies

Spark job for dependency links

http://jaegertracing.io/

Apache License 2.0

124 stars 69 forks source link

Update dependencies CVE #135

Closed ruospalo closed 8 months ago

ruospalo commented 8 months ago

Supersed #132

Which problem is this PR solving?

Spark Dependencies job has dependencies towards Java libraries with several CVE associated with them. This PR will update those dependencies and fixes compilation problems
Decrease the CVEs from Total: 90 (UNKNOWN: 0, LOW: 5, MEDIUM: 20, HIGH: 46, CRITICAL: 19) to Total: 5 (UNKNOWN: 0, LOW: 1, MEDIUM: 2, HIGH: 2, CRITICAL: 0)

Description of the changes

Upgrade spark to 3.5.1, jackson libraries to 2.15.3.
Fix compilation problems

How was this change tested?

Executing tests successfully.
Running trivy to check the CVEs

Executing jaeger operator helm chart pointing to the image built, running with the following CRD:


kubectl apply  -f - <<EOF                                        
# Deploy the Jaeger instance
apiVersion: jaegertracing.io/v1
kind: Jaeger
metadata:
name: my-jaeger
spec:
strategy: allinone
storage:
type: elasticsearch
options:
  es:
    server-urls: http://elasticsearch:9200
dependencies:
  schedule: "*/1 * * * *"
EOF


## Checklist
- [X] I have read https://github.com/jaegertracing/jaeger/blob/master/CONTRIBUTING_GUIDELINES.md
- [X] I have signed all commits
- [ ] I have added unit tests for the new functionality (no new tests)
- [ ] I have run lint and test steps successfully