From 09b478d677cdc26c8ad8e8ca6a591092613af2de Mon Sep 17 00:00:00 2001 From: Alex Porcelli Date: Tue, 12 Mar 2024 13:21:28 -0400 Subject: [PATCH 1/6] RHPAM-3709: upgrade maven dependencies to address CVE-2021-26291 --- .../kie-wb-common-ala-build-maven/pom.xml | 12 ++++---- .../pom.xml | 30 +++++++++---------- .../kie-wb-common-compiler-core/pom.xml | 18 +++++------ .../compiler/impl/external339/AFMavenCli.java | 4 +-- .../impl/external339/ReusableAFMavenCli.java | 4 +-- .../pom.xml | 4 +-- .../pom.xml | 6 ++-- .../pom.xml | 6 ++-- .../pom.xml | 6 ++-- .../kie-wb-common-services-backend/pom.xml | 6 ++-- 10 files changed, 48 insertions(+), 48 deletions(-) diff --git a/kie-wb-common-ala/kie-wb-common-ala-build-maven/pom.xml b/kie-wb-common-ala/kie-wb-common-ala-build-maven/pom.xml index 9b373f95702..7b143f8406c 100644 --- a/kie-wb-common-ala/kie-wb-common-ala-build-maven/pom.xml +++ b/kie-wb-common-ala/kie-wb-common-ala-build-maven/pom.xml @@ -99,16 +99,16 @@ - org.eclipse.aether - aether-api + org.apache.maven.resolver + maven-resolver-api - org.eclipse.aether - aether-connector-basic + org.apache.maven.resolver + maven-resolver-connector-basic - org.eclipse.aether - aether-transport-wagon + org.apache.maven.resolver + maven-resolver-transport-wagon org.apache.maven.wagon diff --git a/kie-wb-common-screens/kie-wb-common-datasource-mgmt/kie-wb-common-datasource-mgmt-backend/pom.xml b/kie-wb-common-screens/kie-wb-common-datasource-mgmt/kie-wb-common-datasource-mgmt-backend/pom.xml index f30a4e766b8..6c866e88f65 100644 --- a/kie-wb-common-screens/kie-wb-common-datasource-mgmt/kie-wb-common-datasource-mgmt-backend/pom.xml +++ b/kie-wb-common-screens/kie-wb-common-datasource-mgmt/kie-wb-common-datasource-mgmt-backend/pom.xml @@ -188,41 +188,41 @@ org.apache.maven - maven-aether-provider + maven-resolver-provider - org.eclipse.aether - aether-api + org.apache.maven.resolver + maven-resolver-api - org.eclipse.aether - aether-util + org.apache.maven.resolver + maven-resolver-util - org.eclipse.aether - aether-connector-basic + org.apache.maven.resolver + maven-resolver-connector-basic - org.eclipse.aether - aether-transport-file + org.apache.maven.resolver + maven-resolver-transport-file - org.eclipse.aether - aether-transport-http + org.apache.maven.resolver + maven-resolver-transport-http - org.eclipse.aether - aether-spi + org.apache.maven.resolver + maven-resolver-spi - org.eclipse.aether - aether-impl + org.apache.maven.resolver + maven-resolver-impl diff --git a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/pom.xml b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/pom.xml index b3690166186..35565e1d794 100644 --- a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/pom.xml +++ b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/pom.xml @@ -260,8 +260,8 @@ kie-soup-maven-integration - org.eclipse.aether - aether-util + org.apache.maven.resolver + maven-resolver-util @@ -395,8 +395,8 @@ maven-core - org.eclipse.aether - aether-util + org.apache.maven.resolver + maven-resolver-util @@ -457,7 +457,7 @@ - org.sonatype.plexus + org.codehaus.plexus plexus-sec-dispatcher @@ -494,13 +494,13 @@ - org.eclipse.aether - aether-api + org.apache.maven.resolver + maven-resolver-api - org.eclipse.aether - aether-impl + org.apache.maven.resolver + maven-resolver-impl runtime diff --git a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/src/main/java/org/kie/workbench/common/services/backend/compiler/impl/external339/AFMavenCli.java b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/src/main/java/org/kie/workbench/common/services/backend/compiler/impl/external339/AFMavenCli.java index fa21d9ba867..56b1167b4d4 100644 --- a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/src/main/java/org/kie/workbench/common/services/backend/compiler/impl/external339/AFMavenCli.java +++ b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/src/main/java/org/kie/workbench/common/services/backend/compiler/impl/external339/AFMavenCli.java @@ -1184,7 +1184,7 @@ protected MavenExecutionRequest populateRequest(AFCliRequest cliRequest, final String threadConfiguration = commandLine.hasOption(CLIManager.THREADS) ? commandLine.getOptionValue(CLIManager.THREADS) : request.getSystemProperties().getProperty( - MavenCli.THREADS_DEPRECATED); // TODO: Remove this setting. Note that the int-tests use it + "maven.threads.experimental"); // TODO: Remove this setting. Note that the int-tests use it if (threadConfiguration != null) { // @@ -1216,7 +1216,7 @@ protected int calculateDegreeOfConcurrencyWithCoreMultiplier(String threadConfig } protected TransferListener getConsoleTransferListener() { - return new ConsoleMavenTransferListener(output); + return new ConsoleMavenTransferListener(output, true); } // diff --git a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/src/main/java/org/kie/workbench/common/services/backend/compiler/impl/external339/ReusableAFMavenCli.java b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/src/main/java/org/kie/workbench/common/services/backend/compiler/impl/external339/ReusableAFMavenCli.java index 7e558c820f0..bffe4ac6667 100644 --- a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/src/main/java/org/kie/workbench/common/services/backend/compiler/impl/external339/ReusableAFMavenCli.java +++ b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/src/main/java/org/kie/workbench/common/services/backend/compiler/impl/external339/ReusableAFMavenCli.java @@ -1227,7 +1227,7 @@ protected MavenExecutionRequest populateRequest(AFCliRequest cliRequest, final String threadConfiguration = commandLine.hasOption(CLIManager.THREADS) ? commandLine.getOptionValue(CLIManager.THREADS) : request.getSystemProperties().getProperty( - MavenCli.THREADS_DEPRECATED); // TODO: Remove this setting. Note that the int-tests use it + "maven.threads.experimental"); // TODO: Remove this setting. Note that the int-tests use it if (threadConfiguration != null) { // @@ -1259,7 +1259,7 @@ protected int calculateDegreeOfConcurrencyWithCoreMultiplier(String threadConfig } protected TransferListener getConsoleTransferListener() { - return new ConsoleMavenTransferListener(output); + return new ConsoleMavenTransferListener(output, true); } // diff --git a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-maven-plugins-testing/pom.xml b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-maven-plugins-testing/pom.xml index 66128daaa07..a4b09877fd3 100644 --- a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-maven-plugins-testing/pom.xml +++ b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-maven-plugins-testing/pom.xml @@ -116,8 +116,8 @@ - org.eclipse.aether - aether-impl + org.apache.maven.resolver + maven-resolver-impl test diff --git a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-offprocess-classpath/pom.xml b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-offprocess-classpath/pom.xml index 6793d2ff7df..45f07df7e5c 100644 --- a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-offprocess-classpath/pom.xml +++ b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-offprocess-classpath/pom.xml @@ -87,8 +87,8 @@ - org.eclipse.aether - aether-api + org.apache.maven.resolver + maven-resolver-api @@ -471,7 +471,7 @@ - org.sonatype.plexus + org.codehaus.plexus plexus-sec-dispatcher diff --git a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-offprocess-core/pom.xml b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-offprocess-core/pom.xml index 30856d311b6..9ee6630170d 100644 --- a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-offprocess-core/pom.xml +++ b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-offprocess-core/pom.xml @@ -78,8 +78,8 @@ slf4j-api - org.eclipse.aether - aether-api + org.apache.maven.resolver + maven-resolver-api org.uberfire @@ -215,7 +215,7 @@ plexus-utils - org.sonatype.plexus + org.codehaus.plexus plexus-sec-dispatcher diff --git a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-offprocess-service/pom.xml b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-offprocess-service/pom.xml index dfc87e5857d..f3f964c6690 100644 --- a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-offprocess-service/pom.xml +++ b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-offprocess-service/pom.xml @@ -87,8 +87,8 @@ slf4j-api - org.eclipse.aether - aether-api + org.apache.maven.resolver + maven-resolver-api org.uberfire @@ -224,7 +224,7 @@ plexus-utils - org.sonatype.plexus + org.codehaus.plexus plexus-sec-dispatcher diff --git a/kie-wb-common-services/kie-wb-common-services-backend/pom.xml b/kie-wb-common-services/kie-wb-common-services-backend/pom.xml index f44e5fea386..d7869d5a632 100644 --- a/kie-wb-common-services/kie-wb-common-services-backend/pom.xml +++ b/kie-wb-common-services/kie-wb-common-services-backend/pom.xml @@ -256,8 +256,8 @@ slf4j-api - org.eclipse.aether - aether-api + org.apache.maven.resolver + maven-resolver-api @@ -390,7 +390,7 @@ - org.sonatype.plexus + org.codehaus.plexus plexus-sec-dispatcher From 796019d5326ff4309c338cf0061f395fe10fcb3a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tibor=20Zim=C3=A1nyi?= Date: Fri, 22 Mar 2024 13:14:27 +0100 Subject: [PATCH 2/6] Fix duplicate classes problem in kie-wb-common-server-ui-backend. --- .../kie-wb-common-server-ui-backend/pom.xml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kie-wb-common-screens/kie-wb-common-server-ui/kie-wb-common-server-ui-backend/pom.xml b/kie-wb-common-screens/kie-wb-common-server-ui/kie-wb-common-server-ui-backend/pom.xml index 8eb31c68d68..d05eed08e51 100644 --- a/kie-wb-common-screens/kie-wb-common-server-ui/kie-wb-common-server-ui-backend/pom.xml +++ b/kie-wb-common-screens/kie-wb-common-server-ui/kie-wb-common-server-ui-backend/pom.xml @@ -189,6 +189,14 @@ javax.inject javax.inject + + org.sonatype.plexus + plexus-cipher + + + org.sonatype.plexus + plexus-sec-dispatcher + From 88e1604858e01b03be2eefbfc0877c7a91d7c173 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tibor=20Zim=C3=A1nyi?= Date: Fri, 22 Mar 2024 13:19:36 +0100 Subject: [PATCH 3/6] Fix duplicate classes problem in kie-wb-common-compiler-distribution. --- .../kie-wb-common-compiler-distribution/pom.xml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-distribution/pom.xml b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-distribution/pom.xml index 98ec869f9ee..a433cf12e55 100644 --- a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-distribution/pom.xml +++ b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-distribution/pom.xml @@ -209,6 +209,14 @@ javax.enterprise cdi-api + + org.sonatype.plexus + plexus-cipher + + + org.sonatype.plexus + plexus-sec-dispatcher + From a7c7abd7ee00103d7ac1f368802036d9f7b7e0bc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tibor=20Zim=C3=A1nyi?= Date: Fri, 22 Mar 2024 13:26:00 +0100 Subject: [PATCH 4/6] Fix duplicate classes problem in kie-wb-common-ala-wildfly-provider. --- .../kie-wb-common-ala-wildfly-provider/pom.xml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kie-wb-common-ala/kie-wb-common-ala-wildfly/kie-wb-common-ala-wildfly-provider/pom.xml b/kie-wb-common-ala/kie-wb-common-ala-wildfly/kie-wb-common-ala-wildfly-provider/pom.xml index 746759435a6..5710b1805d4 100644 --- a/kie-wb-common-ala/kie-wb-common-ala-wildfly/kie-wb-common-ala-wildfly-provider/pom.xml +++ b/kie-wb-common-ala/kie-wb-common-ala-wildfly/kie-wb-common-ala-wildfly-provider/pom.xml @@ -127,6 +127,14 @@ io.netty netty-transport-native-epoll + + org.sonatype.plexus + plexus-cipher + + + org.sonatype.plexus + plexus-sec-dispatcher + From 48a7bfd1f129d9bb5302bfbb96390c673975d9a6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tibor=20Zim=C3=A1nyi?= Date: Wed, 27 Mar 2024 17:20:04 +0100 Subject: [PATCH 5/6] Update maven-dependency-plugin. --- .../kie-wb-common-compiler-maven-plugins/pom.xml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-maven-plugins/pom.xml b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-maven-plugins/pom.xml index 054ab4146d8..ce92bd505d5 100644 --- a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-maven-plugins/pom.xml +++ b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-maven-plugins/pom.xml @@ -16,6 +16,7 @@ org.kie.wb.common.services.backend.compiler.maven.plugins + 3.6.1 @@ -134,6 +135,10 @@ org.apache.maven.reporting maven-reporting-impl + + javax.inject + javax.inject + From 82e7455026e5c0653f9395fcdfd0f46d04f8e8c2 Mon Sep 17 00:00:00 2001 From: jstastny-cz Date: Thu, 28 Mar 2024 07:58:54 +0100 Subject: [PATCH 6/6] load kie version for plugin reference string from properties --- .../backend/compiler/configuration/ConfigurationUtil.java | 0 .../services/backend/compiler/configuration/MavenConfig.java | 3 ++- 2 files changed, 2 insertions(+), 1 deletion(-) rename kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/src/{test => main}/java/org/kie/workbench/common/services/backend/compiler/configuration/ConfigurationUtil.java (100%) diff --git a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/src/test/java/org/kie/workbench/common/services/backend/compiler/configuration/ConfigurationUtil.java b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/src/main/java/org/kie/workbench/common/services/backend/compiler/configuration/ConfigurationUtil.java similarity index 100% rename from kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/src/test/java/org/kie/workbench/common/services/backend/compiler/configuration/ConfigurationUtil.java rename to kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/src/main/java/org/kie/workbench/common/services/backend/compiler/configuration/ConfigurationUtil.java diff --git a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/src/main/java/org/kie/workbench/common/services/backend/compiler/configuration/MavenConfig.java b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/src/main/java/org/kie/workbench/common/services/backend/compiler/configuration/MavenConfig.java index 0d08baf5d83..a3a04fadb03 100644 --- a/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/src/main/java/org/kie/workbench/common/services/backend/compiler/configuration/MavenConfig.java +++ b/kie-wb-common-services/kie-wb-common-compiler/kie-wb-common-compiler-core/src/main/java/org/kie/workbench/common/services/backend/compiler/configuration/MavenConfig.java @@ -20,7 +20,8 @@ */ public class MavenConfig { - public static final String DEPS_IN_MEMORY_BUILD_CLASSPATH = "org.kie.workbench.services:kie-wb-common-compiler-maven-plugins:build-classpath"; + public static final String DEPS_IN_MEMORY_BUILD_CLASSPATH = "org.kie.workbench.services:kie-wb-common-compiler-maven-plugins:" + + new ConfigurationUtil().loadKieVersionProperties().getProperty("KIE_VERSION") + ":build-classpath"; public static final String MAVEN_DEP_PLUGING_LOCAL_REPOSITORY = "-Dmdep.localRepoProperty=";