fix vulnerabilities

shashank11p · shashank11p · commit d6183bc32245 · 2021-11-20T11:15:42.000+05:30
diff --git a/otel-extensions/build.gradle.kts b/otel-extensions/build.gradle.kts
@@ -46,6 +46,10 @@ dependencies {
     api("com.google.protobuf:protobuf-java-util")
     // convert yaml to json, since java protobuf impl supports only json
     implementation("com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.11.3")
+    // fix vulnerability
+    constraints {
+        api("com.google.code.gson:gson:2.8.9")
+    }
 
     testImplementation("io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:${versions["opentelemetry"]}-alpha")
     testImplementation("io.opentelemetry:opentelemetry-sdk:${versions["opentelemetry"]}")
diff --git a/shaded-protobuf-java-util/build.gradle.kts b/shaded-protobuf-java-util/build.gradle.kts
@@ -8,6 +8,10 @@ dependencies {
         exclude("com.google.protobuf", "protobuf-java")
         exclude("com.google.guava", "guava")
     }
+    // fix vulnerability
+    constraints {
+        implementation("com.google.code.gson:gson:2.8.9")
+    }
 }
 
 tasks.shadowJar {
diff --git a/testing-bootstrap/build.gradle.kts b/testing-bootstrap/build.gradle.kts
@@ -16,7 +16,9 @@ dependencies {
     implementation(project(":javaagent-core"))
     implementation(project(":filter-api"))
 
-    implementation("ch.qos.logback:logback-classic:1.2.3")
+    implementation("ch.qos.logback:logback-classic:1.2.3") {
+        exclude("ch.qos.logback:logback-core@1.2.3")
+    }
     implementation("org.slf4j:slf4j-api:${versions["slf4j"]}")
 }
 

Original file line number	Diff line number	Diff line change
`@@ -8,6 +8,10 @@ dependencies {`
`8`	`8`	`exclude("com.google.protobuf", "protobuf-java")`
`9`	`9`	`exclude("com.google.guava", "guava")`
`10`	`10`	`}`
	`11`	`+ // fix vulnerability`
	`12`	`+ constraints {`
	`13`	`+ implementation("com.google.code.gson:gson:2.8.9")`
	`14`	`+ }`
`11`	`15`	`}`
`12`	`16`
`13`	`17`	`tasks.shadowJar {`
Original file line number	Diff line number	Diff line change
`@@ -16,7 +16,9 @@ dependencies {`
`16`	`16`	`implementation(project(":javaagent-core"))`
`17`	`17`	`implementation(project(":filter-api"))`
`18`	`18`
`19`		`- implementation("ch.qos.logback:logback-classic:1.2.3")`
	`19`	`+ implementation("ch.qos.logback:logback-classic:1.2.3") {`
	`20`	`+ exclude("ch.qos.logback:logback-core@1.2.3")`
	`21`	`+ }`
`20`	`22`	`implementation("org.slf4j:slf4j-api:${versions["slf4j"]}")`
`21`	`23`	`}`
`22`	`24`