purge vulnerable dependencies from reactor

apache · Dec 18, 2023 · 1f74126 · 1f74126
1 parent 1a51b34
commit 1f74126
Show file tree

Hide file tree

Showing 110 changed files with 776 additions and 621 deletions.
diff --git a/pom.xml b/pom.xml
diff --git a/streams-cli/pom.xml b/streams-cli/pom.xml
@@ -69,9 +69,9 @@
             <version>${project.version}</version>
         </dependency>
         <dependency>
-            <groupId>org.beanshell</groupId>
+            <groupId>org.apache-extras.beanshell</groupId>
             <artifactId>bsh</artifactId>
-            <version>2.0b5</version>
+            <version>2.0b6</version>
         </dependency>
     </dependencies>
     <build>
@@ -105,4 +105,4 @@
             </plugin>
         </plugins>
     </build>
-</project>
+</project>
diff --git a/streams-components/streams-converters/pom.xml b/streams-components/streams-converters/pom.xml
@@ -55,13 +55,30 @@
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-annotations</artifactId>
         </dependency>
+        <dependency>
+            <groupId>net.minidev</groupId>
+            <artifactId>json-smart</artifactId>
+            <version>2.5.0</version>
+        </dependency>
         <dependency>
             <groupId>com.jayway.jsonpath</groupId>
             <artifactId>json-path</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>net.minidev</groupId>
+                    <artifactId>json-smart</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>com.jayway.jsonpath</groupId>
             <artifactId>json-path-assert</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>net.minidev</groupId>
+                    <artifactId>json-smart</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>junit</groupId>

diff --git a/...onverters/src/main/java/org/apache/streams/converter/BaseObjectNodeActivityConverter.java b/...onverters/src/main/java/org/apache/streams/converter/BaseObjectNodeActivityConverter.java
@@ -26,7 +26,7 @@ Licensed to the Apache Software Foundation (ASF) under one
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.ObjectNode;
-import org.apache.commons.lang.NotImplementedException;
+import org.apache.commons.lang3.NotImplementedException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 

diff --git a/...ms-converters/src/main/java/org/apache/streams/converter/BaseStringActivityConverter.java b/...ms-converters/src/main/java/org/apache/streams/converter/BaseStringActivityConverter.java
@@ -19,14 +19,14 @@ Licensed to the Apache Software Foundation (ASF) under one
 
 package org.apache.streams.converter;
 
+import org.apache.commons.lang3.NotImplementedException;
 import org.apache.streams.data.ActivityConverter;
 import org.apache.streams.exceptions.ActivityConversionException;
 import org.apache.streams.jackson.StreamsJacksonMapper;
 import org.apache.streams.pojo.json.Activity;
 
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.ObjectMapper;
-import org.apache.commons.lang.NotImplementedException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 

diff --git a/streams-config/pom.xml b/streams-config/pom.xml
@@ -64,10 +64,18 @@
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-collections4</artifactId>
+        </dependency>
         <dependency>
             <groupId>commons-validator</groupId>
             <artifactId>commons-validator</artifactId>
             <exclusions>
+                <exclusion>
+                    <groupId>commons-collections</groupId>
+                    <artifactId>commons-collections</artifactId>
+                </exclusion>
                 <exclusion>
                     <groupId>commons-logging</groupId>
                     <artifactId>commons-logging</artifactId>
@@ -77,15 +85,14 @@
         <dependency>
             <groupId>javax.validation</groupId>
             <artifactId>validation-api</artifactId>
-            <version>1.1.0.Final</version>
         </dependency>
         <dependency>
             <groupId>junit</groupId>
             <artifactId>junit</artifactId>
         </dependency>
         <dependency>
             <groupId>org.hamcrest</groupId>
-            <artifactId>hamcrest-all</artifactId>
+            <artifactId>hamcrest</artifactId>
             <scope>test</scope>
         </dependency>
         <dependency>

diff --git a/streams-contrib/pom.xml b/streams-contrib/pom.xml
@@ -40,10 +40,10 @@
         <module>streams-amazon-aws</module>
         <module>streams-persist-cassandra</module>
         <module>streams-persist-console</module>
-        <module>streams-persist-elasticsearch</module>
+<!--        <module>streams-persist-elasticsearch</module>-->
         <module>streams-persist-filebuffer</module>
         <module>streams-persist-hbase</module>
-        <module>streams-persist-hdfs</module>
+<!--        <module>streams-persist-hdfs</module>-->
         <module>streams-persist-graph</module>
         <module>streams-persist-kafka</module>
         <module>streams-persist-mongo</module>

diff --git a/streams-contrib/streams-amazon-aws/pom.xml b/streams-contrib/streams-amazon-aws/pom.xml
@@ -33,7 +33,7 @@
     <description>Amazon AWS Modules</description>
 
     <properties>
-        <amazonaws.version>1.11.184</amazonaws.version>
+        <amazonaws.version>1.12.606</amazonaws.version>
     </properties>
 
     <modules>

diff --git a/streams-contrib/streams-persist-cassandra/pom.xml b/streams-contrib/streams-persist-cassandra/pom.xml
@@ -30,8 +30,8 @@
     <description>Cassandra Module</description>
 
     <properties>
-        <cassandra.version>3.11.0</cassandra.version>
-        <cassandra-driver.version>3.3.0</cassandra-driver.version>
+        <cassandra.version>3.11.16</cassandra.version>
+        <cassandra-driver.version>3.11.5</cassandra-driver.version>
     </properties>
 
     <dependencies>
@@ -55,6 +55,11 @@
             <artifactId>streams-util</artifactId>
             <version>${project.version}</version>
         </dependency>
+        <dependency>
+            <groupId>org.yaml</groupId>
+            <artifactId>snakeyaml</artifactId>
+            <version>2.2</version>
+        </dependency>
         <dependency>
             <groupId>org.apache.cassandra</groupId>
             <artifactId>cassandra-all</artifactId>
@@ -64,12 +69,29 @@
                     <groupId>com.datastax.cassandra</groupId>
                     <artifactId>*</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>org.apache.thrift</groupId>
+                    <artifactId>libthrift</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.jboss.logging</groupId>
+                    <artifactId>jboss-logging</artifactId>
+                </exclusion>
                 <exclusion>
                     <groupId>org.jboss.logging</groupId>
                     <artifactId>jboss-logging</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>org.yaml</groupId>
+                    <artifactId>snakeyaml</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
+        <dependency>
+            <groupId>org.apache.thrift</groupId>
+            <artifactId>libthrift</artifactId>
+            <version>0.12.0</version>
+        </dependency>
         <dependency>
             <groupId>com.datastax.cassandra</groupId>
             <artifactId>cassandra-driver-core</artifactId>
@@ -243,4 +265,4 @@
 
         </profile>
     </profiles>
-</project>
+</project>
diff --git a/streams-contrib/streams-persist-elasticsearch/pom.xml b/streams-contrib/streams-persist-elasticsearch/pom.xml
@@ -48,16 +48,9 @@
             <version>${lucene.version}</version>
             <scope>test</scope>
         </dependency>
-        <dependency>
-            <groupId>org.elasticsearch</groupId>
-            <artifactId>elasticsearch</artifactId>
-            <type>test-jar</type>
-            <scope>test</scope>
-            <optional>true</optional>
-        </dependency>
         <dependency>
             <groupId>org.hamcrest</groupId>
-            <artifactId>hamcrest-all</artifactId>
+            <artifactId>hamcrest</artifactId>
             <scope>test</scope>
         </dependency>
         <dependency>
@@ -85,6 +78,10 @@
             <artifactId>streams-util</artifactId>
             <version>${project.version}</version>
         </dependency>
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-all</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.apache.streams</groupId>
             <artifactId>streams-schema-activitystreams</artifactId>
@@ -93,11 +90,35 @@
             <classifier>testdata</classifier>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.yaml</groupId>
+            <artifactId>snakeyaml</artifactId>
+            <version>2.2</version>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.dataformat</groupId>
+            <artifactId>jackson-dataformat-cbor</artifactId>
+            <version>2.11.4</version>
+        </dependency>
         <dependency>
             <groupId>org.elasticsearch</groupId>
             <artifactId>elasticsearch</artifactId>
             <scope>compile</scope>
             <type>jar</type>
+            <exclusions>
+                <exclusion>
+                    <groupId>com.fasterxml.jackson.dataformat</groupId>
+                    <artifactId>jackson-dataformat-cbor</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.netty</groupId>
+                    <artifactId>netty</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.yaml</groupId>
+                    <artifactId>snakeyaml</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.apache.streams</groupId>

diff --git a/...rch/src/test/java/org/apache/streams/elasticsearch/test/DatumFromMetadataProcessorIT.java b/...rch/src/test/java/org/apache/streams/elasticsearch/test/DatumFromMetadataProcessorIT.java
@@ -27,7 +27,7 @@
 import com.typesafe.config.Config;
 import com.typesafe.config.ConfigFactory;
 import com.typesafe.config.ConfigParseOptions;
-import org.apache.commons.lang.SerializationUtils;
+import org.apache.commons.lang3.SerializationUtils;
 import org.elasticsearch.client.Client;
 import org.testng.Assert;
 import org.testng.annotations.BeforeClass;

diff --git a/.../src/test/java/org/apache/streams/elasticsearch/test/TestDocumentToMetadataProcessor.java b/.../src/test/java/org/apache/streams/elasticsearch/test/TestDocumentToMetadataProcessor.java
@@ -25,7 +25,7 @@
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.ObjectNode;
 
-import org.apache.commons.lang.SerializationUtils;
+import org.apache.commons.lang3.SerializationUtils;
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;

diff --git a/...rc/test/java/org/apache/streams/elasticsearch/test/TestMetadataFromDocumentProcessor.java b/...rc/test/java/org/apache/streams/elasticsearch/test/TestMetadataFromDocumentProcessor.java
@@ -26,7 +26,7 @@
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.apache.commons.io.IOUtils;
-import org.apache.commons.lang.SerializationUtils;
+import org.apache.commons.lang3.SerializationUtils;
 import org.junit.Before;
 import org.junit.Test;
 import org.slf4j.Logger;

diff --git a/streams-contrib/streams-persist-filebuffer/pom.xml b/streams-contrib/streams-persist-filebuffer/pom.xml
@@ -88,10 +88,6 @@
             <scope>test</scope>
             <type>test-jar</type>
         </dependency>
-        <dependency>
-            <groupId>org.testng</groupId>
-            <artifactId>testng</artifactId>
-        </dependency>
     </dependencies>
     <build>
         <sourceDirectory>src/main/java</sourceDirectory>