Skip to content

Commit f742485

Browse files
jleiva-gapjleiva-gap
authored
[APIPUB-80] Fixing vulnerabilities found with Docker Scout (Ed-Fi-Alliance-OSS#84)
Update nuget packages Update System.Text.Json to version 8.0.5 Update .NET SDK alpine version to use Alpine 3.20 Update apk for openssl to use version 3.3.2 and remove vulnerability Update apk for postgres client to use version 16
1 parent ca01994 commit f742485

15 files changed

Lines changed: 68 additions & 60 deletions

File tree

‎src/Dockerfile‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
# The Ed-Fi Alliance licenses this file to you under the Apache License, Version 2.0.
44
# See the LICENSE and NOTICES files in the project root for more information.
55

6-
# Tag aspnet:8.0-alpine
7-
FROM mcr.microsoft.com/dotnet/aspnet@sha256:ba398f8c6a0469436cc115bfbd278002baf4ce9423b6d8a9e904da6adc31a23d
6+
# Tag aspnet:8.0-alpine3.20
7+
FROM mcr.microsoft.com/dotnet/aspnet:8.0-alpine3.20@sha256:b5b7dec8006fe016cc864f618cf60eab24fb7d7a28c8ecf4f6b90ceeaa5cf9f2
88
LABEL maintainer="Ed-Fi Alliance, LLC and Contributors <techsupport@ed-fi.org>"
99

1010
ARG VERSION="1.2.1"
@@ -21,7 +21,8 @@ COPY ./Docker/plainTextNamedConnections.template.json /app/plainTextNamedConnect
2121

2222
COPY ./Docker/run.sh /app/run.sh
2323

24-
RUN apk --no-cache add unzip=~6 dos2unix=~7 bash=~5 gettext=~0 postgresql13-client=~13 icu=~74 curl=~8 && \
24+
RUN apk update && \
25+
apk --no-cache add --upgrade unzip=~6 dos2unix=~7 bash=~5 gettext=~0 openssl=3.3.2-r0 postgresql16-client=~16 icu=~74 curl=~8 && \
2526
wget -nv -O /app/ApiPublisher.zip https://pkgs.dev.azure.com/ed-fi-alliance/Ed-Fi-Alliance-OSS/_apis/packaging/feeds/EdFi/nuget/packages/EdFi.ApiPublisher/versions/${VERSION}/content && \
2627
unzip /app/ApiPublisher.zip 'EdFi.ApiPublisher/**' -d /app/ && \
2728
mv /app/EdFi.ApiPublisher/* /app/ && \

‎src/EdFi.Tools.ApiPublisher.Cli/EdFi.Tools.ApiPublisher.Cli.csproj‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,20 +7,21 @@
77
<NoWarn>NU5100, NU5124</NoWarn>
88
</PropertyGroup>
99
<ItemGroup>
10-
<PackageReference Include="Autofac.Extensions.DependencyInjection" Version="9.0.0" />
11-
<PackageReference Include="AWSSDK.CloudWatchLogs" Version="3.7.305.55" />
12-
<PackageReference Include="AWSSDK.Core" Version="3.7.304.25" />
10+
<PackageReference Include="Autofac.Extensions.DependencyInjection" Version="10.0.0" />
11+
<PackageReference Include="AWSSDK.CloudWatchLogs" Version="3.7.403.21" />
12+
<PackageReference Include="AWSSDK.Core" Version="3.7.400.35" />
1313
<PackageReference Include="Serilog.Enrichers.Thread" Version="4.0.0" />
14-
<PackageReference Include="Serilog.Settings.Configuration" Version="8.0.1" />
15-
<PackageReference Include="Serilog.Sinks.AwsCloudWatch" Version="4.2.29" />
14+
<PackageReference Include="Serilog.Settings.Configuration" Version="8.0.4" />
15+
<PackageReference Include="Serilog.Sinks.AwsCloudWatch" Version="4.3.37" />
1616
<PackageReference Include="Serilog.Sinks.File" Version="6.0.0" />
17-
<PackageReference Include="Microsoft.Extensions.Configuration.Binder" Version="8.0.1" />
17+
<PackageReference Include="Microsoft.Extensions.Configuration.Binder" Version="8.0.2" />
1818
<PackageReference Include="Microsoft.Extensions.Configuration.CommandLine" Version="8.0.0" />
1919
<PackageReference Include="Microsoft.Extensions.Configuration.EnvironmentVariables" Version="8.0.0" />
20-
<PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="8.0.0" />
21-
<PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="8.0.0" />
20+
<PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="8.0.1" />
21+
<PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="8.0.1" />
2222
<PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
23-
<PackageReference Include="System.Threading.Tasks.Dataflow" Version="8.0.0" />
23+
<PackageReference Include="System.Text.Json" Version="8.0.5" />
24+
<PackageReference Include="System.Threading.Tasks.Dataflow" Version="8.0.1" />
2425
</ItemGroup>
2526
<ItemGroup>
2627
<None Update="apiPublisherSettings.json">

‎src/EdFi.Tools.ApiPublisher.ConfigurationStore.Aws/EdFi.Tools.ApiPublisher.ConfigurationStore.Aws.csproj‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,11 @@
44
<LangVersion>10</LangVersion>
55
</PropertyGroup>
66
<ItemGroup>
7-
<PackageReference Include="Amazon.Extensions.Configuration.SystemsManager" Version="6.2.0" />
7+
<PackageReference Include="Amazon.Extensions.Configuration.SystemsManager" Version="6.2.2" />
88
<PackageReference Include="AWSSDK.Extensions.NETCore.Setup" Version="3.7.301" />
9-
<PackageReference Include="AWSSDK.SimpleSystemsManagement" Version="3.7.305.5" />
9+
<PackageReference Include="AWSSDK.SimpleSystemsManagement" Version="3.7.402.14" />
1010
<PackageReference Include="Microsoft.Extensions.Configuration" Version="8.0.0" />
11+
<PackageReference Include="System.Text.Json" Version="8.0.5" />
1112
</ItemGroup>
1213
<ItemGroup>
1314
<ProjectReference Include="..\EdFi.Tools.ApiPublisher.Connections.Api\EdFi.Tools.ApiPublisher.Connections.Api.csproj" />

‎src/EdFi.Tools.ApiPublisher.ConfigurationStore.Plaintext/EdFi.Tools.ApiPublisher.ConfigurationStore.Plaintext.csproj‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@
33
<TargetFramework>net8.0</TargetFramework>
44
<ImplicitUsings>enable</ImplicitUsings>
55
</PropertyGroup>
6+
<ItemGroup>
7+
<PackageReference Include="System.Text.Json" Version="8.0.5" />
8+
</ItemGroup>
69
<ItemGroup>
710
<ProjectReference Include="..\EdFi.Tools.ApiPublisher.Connections.Api\EdFi.Tools.ApiPublisher.Connections.Api.csproj" />
811
<ProjectReference Include="..\EdFi.Tools.ApiPublisher.Core\EdFi.Tools.ApiPublisher.Core.csproj" />

‎src/EdFi.Tools.ApiPublisher.ConfigurationStore.PostgreSql/EdFi.Tools.ApiPublisher.ConfigurationStore.PostgreSql.csproj‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,10 @@
44
<LangVersion>10</LangVersion>
55
</PropertyGroup>
66
<ItemGroup>
7-
<PackageReference Include="Npgsql" Version="8.0.3" />
7+
<PackageReference Include="Npgsql" Version="8.0.5" />
88
<PackageReference Include="Microsoft.Extensions.Configuration" Version="8.0.0" />
99
<PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" Version="8.0.0" />
10+
<PackageReference Include="System.Text.Json" Version="8.0.5" />
1011
</ItemGroup>
1112
<ItemGroup>
1213
<ProjectReference Include="..\EdFi.Tools.ApiPublisher.Connections.Api\EdFi.Tools.ApiPublisher.Connections.Api.csproj" />

‎src/EdFi.Tools.ApiPublisher.ConfigurationStore.SqlServer/EdFi.Tools.ApiPublisher.ConfigurationStore.SqlServer.csproj‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,12 @@
44
<LangVersion>10</LangVersion>
55
</PropertyGroup>
66
<ItemGroup>
7-
<PackageReference Include="Azure.Identity" Version="1.12.0" />
8-
<PackageReference Include="Microsoft.Data.SqlClient" Version="5.2.1" />
7+
<PackageReference Include="Azure.Identity" Version="1.13.0" />
8+
<PackageReference Include="Microsoft.Data.SqlClient" Version="5.2.2" />
99
<PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" Version="8.0.0" />
10-
<PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" Version="7.6.2" />
11-
<PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="7.6.2" />
10+
<PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.1.2" />
11+
<PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.1.2" />
12+
<PackageReference Include="System.Text.Json" Version="8.0.5" />
1213
</ItemGroup>
1314
<ItemGroup>
1415
<ProjectReference Include="..\EdFi.Tools.ApiPublisher.Connections.Api\EdFi.Tools.ApiPublisher.Connections.Api.csproj" />

‎src/EdFi.Tools.ApiPublisher.Connections.Api/EdFi.Tools.ApiPublisher.Connections.Api.csproj‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,19 @@
55
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
66
</PropertyGroup>
77
<ItemGroup>
8-
<PackageReference Include="Autofac" Version="8.0.0" />
9-
<PackageReference Include="Microsoft.CodeAnalysis" Version="4.10.0" />
10-
<PackageReference Include="Microsoft.CodeAnalysis.CSharp.CodeStyle" Version="4.10.0">
8+
<PackageReference Include="Autofac" Version="8.1.1" />
9+
<PackageReference Include="Microsoft.CodeAnalysis" Version="4.11.0" />
10+
<PackageReference Include="Microsoft.CodeAnalysis.CSharp.CodeStyle" Version="4.11.0">
1111
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
1212
<PrivateAssets>all</PrivateAssets>
1313
</PackageReference>
14-
<PackageReference Include="Microsoft.Extensions.Configuration.Binder" Version="8.0.1" />
15-
<PackageReference Include="Polly.RateLimiting" Version="8.4.1" />
14+
<PackageReference Include="Microsoft.Extensions.Configuration.Binder" Version="8.0.2" />
15+
<PackageReference Include="Polly.RateLimiting" Version="8.4.2" />
1616
<PackageReference Include="SonarAnalyzer.CSharp" Version="9.32.0.97167">
1717
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
1818
<PrivateAssets>all</PrivateAssets>
1919
</PackageReference>
20+
<PackageReference Include="System.Text.Json" Version="8.0.5" />
2021
</ItemGroup>
2122
<ItemGroup>
2223
<ProjectReference Include="..\EdFi.Tools.ApiPublisher.Core\EdFi.Tools.ApiPublisher.Core.csproj" />

‎src/EdFi.Tools.ApiPublisher.Connections.Api/Modules/EdFiApiAsSourceModule.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ protected override void Load(ContainerBuilder builder)
124124
// API dependency metadata from Ed-Fi ODS API (using Source API)
125125
if (options.UseSourceDependencyMetadata)
126126
{
127-
builder.RegisterType<EdFiApiGraphMLDependencyMetadataProvider>()
127+
_ = builder.RegisterType<EdFiApiGraphMLDependencyMetadataProvider>()
128128
.As<IGraphMLDependencyMetadataProvider>()
129129
.WithParameter(
130130
// Configure to use with Target API

‎src/EdFi.Tools.ApiPublisher.Connections.Api/Modules/EdFiApiAsTargetModule.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ protected override void Load(ContainerBuilder builder)
6060
// API dependency metadata from Ed-Fi ODS API (using Target API)
6161
if (!options.UseSourceDependencyMetadata)
6262
{
63-
builder.RegisterType<EdFiApiGraphMLDependencyMetadataProvider>()
63+
_ = builder.RegisterType<EdFiApiGraphMLDependencyMetadataProvider>()
6464
.As<IGraphMLDependencyMetadataProvider>()
6565
.WithParameter(
6666
// Configure to use with Target API

‎src/EdFi.Tools.ApiPublisher.Connections.Api/Processing/Source/Versioning/EdFiApiSourceCurrentChangeVersionProvider.cs‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,12 @@ public EdFiApiSourceCurrentChangeVersionProvider(ISourceEdFiApiClientProvider so
4646

4747
try
4848
{
49-
long maxChangeVersion =
50-
49+
long maxChangeVersion
50+
=
5151
// Versions of Ed-Fi API through at least v3.4
5252
(JObject.Parse(versionResponseText)["NewestChangeVersion"]
53-
54-
// Enhancements/fixes applied introduced as part of API Publisher work
55-
?? JObject.Parse(versionResponseText)["newestChangeVersion"]).Value<long>();
53+
// Enhancements/fixes applied introduced as part of API Publisher work
54+
?? JObject.Parse(versionResponseText)["newestChangeVersion"]).Value<long>();
5655

5756
return maxChangeVersion;
5857
}

0 commit comments

Comments
 (0)