search

pact-foundation / pact-jvm

JVM version of Pact. Enables consumer driven contract testing, providing a mock service and DSL for the consumer project, and interaction playback and verification for the service provider project.
https://docs.pact.io
Apache License 2.0
1.08k stars 480 forks source link

Update vulnerable dependency versions #1626

Closed Okeanos closed 2 years ago

Okeanos commented 2 years ago

After integrating the pact-jvm artifacts into a project and running vulnerability scans a concerning number of "vulnerable transitive dependency detected" messages cropped up in automated scans. While I assume (without having verified this!) that a lot are effectively "false-positives" in the sense that the vulnerability is not exploitable (by default) it would nevertheless be good form to upgrade these vulnerable dependencies declared in the pact-jvm artifacts to later versions without known vulnerabilities.

In particular at least the following implementation dependencies have known vulnerabilities and newer versions (I only list updates to patch or minor releases; major upgrades are clearly marked because of expected incompatibilities) that may be used:

The following test dependencies are affected:

While going through the list I noticed that most of these versions are not centrally managed (by default) for all sub-projects in the global gradle.properties which would make management way easier (and still allow overriding in particular cases where it is necessary).

Also I noticed that that consumer/junit/build.gradle has a faulty dependency tree by declaring a dependency twice in different versions:

dependencies {
    testImplementation 'com.fasterxml.jackson.core:jackson-databind:2.12.4'
    // ...
    testImplementation 'com.fasterxml.jackson.core:jackson-databind:2.11.0.rc1'
 }

This should probably be cleaned up as well.

Updating, testing and validating all of these proposed updates is probably a large and thankless chore but would reduce unnecessary noise when consuming these artifacts and working with them. It may be an idea to try centralising the dependency management and try whether Dependabot can help with PRs and automated builds that show failures early.

rholshausen commented 2 years ago

Released with version 4.3.16

Okeanos commented 2 years ago

Thanks a lot 😍