Vulnerabilities (#82)

Co-authored-by: Dill <[email protected]>
Co-authored-by: dilyaver.kaibulaev <[email protected]>

.github/workflows/docker-publish.yml

@@ -16,4 +16,3 @@ jobs:
       docker-username: ${{ github.actor }}
     secrets:
       docker-password: ${{ secrets.GITHUB_TOKEN }}
-

README.md

@@ -1,4 +1,4 @@
-# Overview (4.1.2)
+# Overview (4.1.3)
 
 Event store (estore) is an important th2 component responsible for storing events into Cradle. Please refer to [Cradle repository] (https://github.com/th2-net/cradleapi/blob/master/README.md) for more details. This component has a pin for listening events via MQ.
 
@@ -72,6 +72,11 @@ Please see more details about this feature via [link](https://github.com/th2-net
 
 # Changes
 
+## 4.1.3
+
++ Update common version from `3.44.0` to `3.44.1`
++ Update bom version from `4.1.0` to `4.2.0`.
+
 ## 4.1.2
 
 + Update common version from `3.36.0` to `3.44.0`

build.gradle

@@ -3,6 +3,7 @@ plugins {
     id 'java-library'
     id 'application'
     id 'com.palantir.docker' version '0.25.0'
+    id "org.owasp.dependencycheck" version "8.1.0"
 }
 
 ext {
@@ -54,9 +55,15 @@ jar {
     }
 }
 
+configurations {
+    compileClasspath {
+        resolutionStrategy.activateDependencyLocking()
+    }
+}
+
 dependencies {
-    api platform('com.exactpro.th2:bom:4.1.0')
-    implementation 'com.exactpro.th2:common:3.44.0'
+    api platform('com.exactpro.th2:bom:4.2.0')
+    implementation 'com.exactpro.th2:common:3.44.1'
     implementation 'com.exactpro.th2:task-utils:0.1.1'
     implementation("com.exactpro.th2:cradle-core:$cradleVersion") {
         because('need to override common dep. remove in release')
@@ -96,3 +103,14 @@ dockerPrepare {
 docker {
     copySpec.from(tarTree("$buildDir/distributions/${applicationName}.tar"))
 }
+
+dependencyCheck {
+    formats=['SARIF', 'JSON', 'HTML']
+    failBuildOnCVSS=5
+
+    analyzers {
+        assemblyEnabled = false
+        nugetconfEnabled = false
+        nodeEnabled = false
+    }
+}

gradle.properties

@@ -1 +1 @@
-release_version=4.1.2
+release_version=4.1.3