[1.13.x-blue] [KOGITO-8432] - CVE-2022-25857 - Upgrade SnakeYAML on Spring Boot related components #2726

github-actions · 2023-01-10T05:40:13Z

Backport: https://github.com/kiegroup/kogito-runtimes/pull/2721

See: https://issues.redhat.com/browse/KOGITO-8432

Small update on our SB libraries to fix the affected components. See: spring-projects/spring-boot#32221 for more info.

Signed-off-by: Ricardo Zanini zanini@redhat.com

Many thanks for submitting your Pull Request ❤️!

Please make sure that your PR meets the following requirements:

You have read the contributors guide
Your code is properly formatted according to this configuration
Pull Request title is properly formatted: KOGITO-XYZ Subject
Pull Request title contains the target branch if not targeting main: [0.9.x] KOGITO-XYZ Subject
Pull Request contains link to the JIRA issue
Pull Request contains link to any dependent or related Pull Request
Pull Request contains description of the issue
Pull Request does not include fixes for issues other than the main ticket

How to replicate CI configuration locally?

Build Chain tool does "simple" maven build(s), the builds are just Maven commands, but because the repositories relates and depends on each other and any change in API or class method could affect several of those repositories there is a need to use build-chain tool to handle cross repository builds and be sure that we always use latest version of the code for each repository.

build-chain tool is a build tool which can be used on command line locally or in Github Actions workflow(s), in case you need to change multiple repositories and send multiple dependent pull requests related with a change you can easily reproduce the same build by executing it on Github hosted environment or locally in your development environment. See local execution details to get more information about it.

How to retest this PR or trigger a specific build:

for pull request checks
Please add comment: Jenkins retest this
for a specific pull request check
Please add comment: Jenkins (re)run [kogito-runtimes|kogito-apps|kogito-examples] tests
for quarkus branch checks
Run checks against Quarkus current used branch
Please add comment: Jenkins run quarkus-branch
for a quarkus branch specific check
Run checks against Quarkus current used branch
Please add comment: Jenkins (re)run [kogito-runtimes|kogito-apps|kogito-examples] quarkus-branch
for quarkus main checks
Run checks against Quarkus main branch
Please add comment: Jenkins run quarkus-main
for a specific quarkus main check
Run checks against Quarkus main branch
Please add comment: Jenkins (re)run [kogito-runtimes|kogito-apps|kogito-examples] quarkus-main
for quarkus lts checks
Run checks against Quarkus lts branch
Please add comment: Jenkins run quarkus-lts
for a specific quarkus lts check
Run checks against Quarkus lts branch
Please add comment: Jenkins (re)run [kogito-runtimes|kogito-apps|kogito-examples] quarkus-lts
for native checks
Run native checks
Please add comment: Jenkins run native
for a specific native check
Run native checks
Please add comment: Jenkins (re)run [kogito-runtimes|kogito-apps|kogito-examples] native
for mandrel checks
Run native checks against Mandrel image
Please add comment: Jenkins run mandrel
for a specific mandrel check
Run native checks against Mandrel image
Please add comment: Jenkins (re)run [kogito-runtimes|kogito-apps|kogito-examples] mandrel
for mandrel lts checks
Run native checks against Mandrel image and quarkus lts branch
Please add comment: Jenkins run mandrel-lts
for a specific mandrel lts check
Run native checks against Mandrel image and quarkus lts branch
Please add comment: Jenkins (re)run [kogito-runtimes|kogito-apps|kogito-examples] mandrel-lts
Full Kogito testing (with cloud images and operator BDD testing)
Please add comment: Jenkins run BDD
This check should be used only if a big change is done as it takes time to run, need resources and one full BDD tests check can be done at a time ...

How to backport a pull request to a different branch?

In order to automatically create a backporting pull request please add one or more labels having the following format backport-<branch-name>, where <branch-name> is the name of the branch where the pull request must be backported to (e.g., backport-7.67.x to backport the original PR to the 7.67.x branch).

NOTE: backporting is an action aiming to move a change (usually a commit) from a branch (usually the main one) to another one, which is generally referring to a still maintained release branch. Keeping it simple: it is about to move a specific change or a set of them from one branch to another.

Once the original pull request is successfully merged, the automated action will create one backporting pull request per each label (with the previous format) that has been added.

If something goes wrong, the author will be notified and at this point a manual backporting is needed.

NOTE: this automated backporting is triggered whenever a pull request on main branch is labeled or closed, but both conditions must be satisfied to get the new PR created.

…ated components (#2721) Signed-off-by: Ricardo Zanini <zanini@redhat.com> Signed-off-by: Ricardo Zanini <zanini@redhat.com>

kie-ci · 2023-01-10T05:41:18Z