Skip to content

Commit 086f6b5

Browse files
bestbeforetodaybestbeforetoday
authored
Update dependencies to address CVE-2024-7254 (#353)
Also the following dependency changes: - Remove obsolete JUnit 4. - Replace com.github.stefanbirkner:system-rules with uk.org.webcompere:system-stubs-jupiter since the former appears not to work correctly with JUnit 5. - Update versions following v2.5.3 release. Signed-off-by: Mark S. Lewis <[email protected]>
1 parent a645338 commit 086f6b5

File tree

55 files changed

+567
-692
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+567
-692
lines changed

Diff for: ‎build.gradle

+15-15
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,11 @@
44
* SPDX-License-Identifier: Apache-2.0
55
*/
66

7-
apply plugin: 'idea'
8-
apply plugin: 'eclipse-wtp'
9-
version = '2.5.3'
7+
plugins {
8+
id "com.github.ben-manes.versions" version "0.51.0"
9+
}
10+
11+
version = '2.5.4'
1012

1113

1214
// If the nightly property is set, then this is the scheduled main
@@ -46,18 +48,16 @@ subprojects {
4648
}
4749

4850
dependencies {
49-
implementation 'commons-cli:commons-cli:1.6.0'
50-
implementation 'commons-logging:commons-logging:1.2'
51-
testImplementation 'org.junit.jupiter:junit-jupiter-api:5.3.1'
52-
testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine:5.3.1'
53-
54-
testImplementation 'org.hamcrest:hamcrest-library:1.3'
55-
testImplementation 'org.mockito:mockito-core:2.23.0'
56-
testImplementation 'com.github.stefanbirkner:system-rules:system-rules-1.17.0'
57-
58-
testCompileOnly 'junit:junit:4.13.2'
59-
testRuntimeOnly 'org.junit.vintage:junit-vintage-engine:5.10.2'
60-
testImplementation 'org.assertj:assertj-core:3.9.1'
51+
implementation 'commons-cli:commons-cli:1.9.0'
52+
implementation 'commons-logging:commons-logging:1.3.4'
53+
testImplementation 'org.junit.jupiter:junit-jupiter-api:5.11.0'
54+
testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine:5.11.0'
55+
56+
testImplementation 'org.hamcrest:hamcrest-library:3.0'
57+
testImplementation 'org.mockito:mockito-core:5.13.0'
58+
testImplementation 'uk.org.webcompere:system-stubs-jupiter:2.1.6'
59+
60+
testImplementation 'org.assertj:assertj-core:3.26.3'
6161
}
6262

6363
test {

Diff for: ‎examples/fabric-contract-example-as-service/build.gradle

+4-4
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,10 @@ repositories {
2222

2323
dependencies {
2424
compile 'org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.2'
25-
compile 'org.json:json:20231013'
26-
testImplementation 'org.junit.jupiter:junit-jupiter:5.4.2'
27-
testImplementation 'org.assertj:assertj-core:3.11.1'
28-
testImplementation 'org.mockito:mockito-core:2.+'
25+
compile 'org.json:json:20240303'
26+
testImplementation 'org.junit.jupiter:junit-jupiter:5.11.0'
27+
testImplementation 'org.assertj:assertj-core:3.26.3'
28+
testImplementation 'org.mockito:mockito-core:5.13.0'
2929
}
3030

3131
shadowJar {

Diff for: ‎examples/fabric-contract-example-gradle-kotlin/build.gradle.kts

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,10 @@ version = "0.0.1"
1515

1616
dependencies {
1717
implementation("org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.2")
18-
implementation("org.json:json:20231013")
18+
implementation("org.json:json:20240303")
1919
implementation("org.jetbrains.kotlin:kotlin-stdlib-jdk8")
2020

21-
testImplementation("org.junit.jupiter:junit-jupiter:5.4.2")
21+
testImplementation("org.junit.jupiter:junit-jupiter:5.11.0")
2222
testImplementation("com.nhaarman.mockitokotlin2:mockito-kotlin:2.1.0")
2323
}
2424

Diff for: ‎examples/fabric-contract-example-gradle/build.gradle

+4-4
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,10 @@ repositories {
2222

2323
dependencies {
2424
compile 'org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.2'
25-
compile 'org.json:json:20231013'
26-
testImplementation 'org.junit.jupiter:junit-jupiter:5.4.2'
27-
testImplementation 'org.assertj:assertj-core:3.11.1'
28-
testImplementation 'org.mockito:mockito-core:2.+'
25+
compile 'org.json:json:20240303'
26+
testImplementation 'org.junit.jupiter:junit-jupiter:5.11.0'
27+
testImplementation 'org.assertj:assertj-core:3.26.3'
28+
testImplementation 'org.mockito:mockito-core:5.13.0'
2929
}
3030

3131
shadowJar {

Diff for: ‎examples/ledger-api/build.gradle

+4-4
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,10 @@ repositories {
2222

2323
dependencies {
2424
compile 'org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.2'
25-
compile 'org.json:json:20231013'
26-
testImplementation 'org.junit.jupiter:junit-jupiter:5.4.2'
27-
testImplementation 'org.assertj:assertj-core:3.11.1'
28-
testImplementation 'org.mockito:mockito-core:2.+'
25+
compile 'org.json:json:20240303'
26+
testImplementation 'org.junit.jupiter:junit-jupiter:5.11.0'
27+
testImplementation 'org.assertj:assertj-core:3.26.3'
28+
testImplementation 'org.mockito:mockito-core:5.13.0'
2929
}
3030

3131
shadowJar {

Diff for: ‎fabric-chaincode-docker/build.gradle

+3-2
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,10 @@ buildscript {
99
maven { url "https://oss.sonatype.org/content/repositories/snapshots" }
1010
maven { url "https://www.jitpack.io" }
1111
mavenCentral()
12+
gradlePluginPortal()
1213
}
1314
dependencies {
14-
classpath 'com.bmuschko:gradle-docker-plugin:5.1.0'
15+
classpath 'com.bmuschko:gradle-docker-plugin:9.4.0'
1516
}
1617
}
1718

@@ -64,6 +65,6 @@ task copyAllDeps(type: Copy) {
6465
task buildImage(type: DockerBuildImage) {
6566
dependsOn copyAllDeps
6667
inputDir = project.file('Dockerfile').parentFile
67-
tags = ['hyperledger/fabric-javaenv', 'hyperledger/fabric-javaenv:2.5', 'hyperledger/fabric-javaenv:amd64-2.5.3', 'hyperledger/fabric-javaenv:amd64-latest']
68+
images = ['hyperledger/fabric-javaenv', 'hyperledger/fabric-javaenv:2.5', 'hyperledger/fabric-javaenv:amd64-2.5.4', 'hyperledger/fabric-javaenv:amd64-latest']
6869
}
6970

Diff for: ‎fabric-chaincode-integration-test/build.gradle

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
dependencies {
22
implementation project(':fabric-chaincode-docker')
33
implementation project(':fabric-chaincode-shim')
4-
implementation 'org.json:json:20231013'
4+
implementation 'org.json:json:20240303'
55
}
66

77

Diff for: ‎fabric-chaincode-integration-test/src/contracts/bare-gradle/build.gradle

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ repositories {
1919
}
2020

2121
dependencies {
22-
implementation 'org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.3'
22+
implementation 'org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.4'
2323
implementation 'org.hyperledger.fabric:fabric-protos:0.3.3'
2424
}
2525

Diff for: ‎fabric-chaincode-integration-test/src/contracts/bare-maven/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
1313

1414
<!-- fabric-chaincode-java -->
15-
<fabric-chaincode-java.version>2.5.3</fabric-chaincode-java.version>
15+
<fabric-chaincode-java.version>2.5.4</fabric-chaincode-java.version>
1616

1717
</properties>
1818

Diff for: ‎fabric-chaincode-integration-test/src/contracts/fabric-ledger-api/build.gradle

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ repositories {
2525
}
2626

2727
dependencies {
28-
implementation 'org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.3'
28+
implementation 'org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.4'
2929
implementation 'org.hyperledger.fabric:fabric-protos:0.3.3'
3030
}
3131

Diff for: ‎fabric-chaincode-integration-test/src/contracts/fabric-shim-api/build.gradle

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ repositories {
2525
}
2626

2727
dependencies {
28-
implementation 'org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.3'
28+
implementation 'org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.4'
2929
implementation 'org.hyperledger.fabric:fabric-protos:0.3.3'
3030
implementation 'commons-logging:commons-logging:1.2'
3131
implementation 'com.google.code.gson:gson:2.10.1'

Diff for: ‎fabric-chaincode-integration-test/src/contracts/wrapper-maven/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
1313

1414
<!-- fabric-chaincode-java -->
15-
<fabric-chaincode-java.version>2.5.3</fabric-chaincode-java.version>
15+
<fabric-chaincode-java.version>2.5.4</fabric-chaincode-java.version>
1616

1717
</properties>
1818

Diff for: ‎fabric-chaincode-integration-test/src/test/java/org/hyperleder/fabric/shim/integration/contractinstall/ContractInstallTest.java

+5-4
Original file line numberDiff line numberDiff line change
@@ -4,21 +4,22 @@
44
SPDX-License-Identifier: Apache-2.0
55
*/
66
package org.hyperleder.fabric.shim.integration.contractinstall;
7+
78
import static org.hamcrest.core.StringContains.containsString;
8-
import static org.junit.Assert.assertThat;
9+
import static org.hamcrest.MatcherAssert.assertThat;
910

1011
import org.hyperleder.fabric.shim.integration.util.FabricState;
1112
import org.hyperleder.fabric.shim.integration.util.InvokeHelper;
12-
import org.junit.BeforeClass;
13-
import org.junit.Test;
13+
import org.junit.jupiter.api.BeforeAll;
14+
import org.junit.jupiter.api.Test;
1415

1516
/**
1617
* Basic Java Chaincode Test
1718
*
1819
*/
1920
public class ContractInstallTest {
2021

21-
@BeforeClass
22+
@BeforeAll
2223
public static void setUp() throws Exception {
2324
FabricState.getState().start();
2425

Diff for: ‎fabric-chaincode-integration-test/src/test/java/org/hyperleder/fabric/shim/integration/ledgertests/LedgerIntegrationTest.java

+4-4
Original file line numberDiff line numberDiff line change
@@ -5,20 +5,20 @@
55
*/
66
package org.hyperleder.fabric.shim.integration.ledgertests;
77
import static org.hamcrest.core.StringContains.containsString;
8-
import static org.junit.Assert.assertThat;
8+
import static org.hamcrest.MatcherAssert.assertThat;
99

1010
import org.hyperleder.fabric.shim.integration.util.FabricState;
1111
import org.hyperleder.fabric.shim.integration.util.InvokeHelper;
12-
import org.junit.BeforeClass;
13-
import org.junit.Test;
12+
import org.junit.jupiter.api.BeforeAll;
13+
import org.junit.jupiter.api.Test;
1414

1515
/**
1616
* Basic Java Chaincode Test
1717
*
1818
*/
1919
public class LedgerIntegrationTest {
2020

21-
@BeforeClass
21+
@BeforeAll
2222
public static void setUp() throws Exception {
2323

2424

Diff for: ‎fabric-chaincode-integration-test/src/test/java/org/hyperleder/fabric/shim/integration/shimtests/SACCIntegrationTest.java

+4-4
Original file line numberDiff line numberDiff line change
@@ -5,20 +5,20 @@
55
*/
66
package org.hyperleder.fabric.shim.integration.shimtests;
77
import static org.hamcrest.core.StringContains.containsString;
8-
import static org.junit.Assert.assertThat;
8+
import static org.hamcrest.MatcherAssert.assertThat;
99

1010
import org.hyperleder.fabric.shim.integration.util.FabricState;
1111
import org.hyperleder.fabric.shim.integration.util.InvokeHelper;
12-
import org.junit.BeforeClass;
13-
import org.junit.Test;
12+
import org.junit.jupiter.api.BeforeAll;
13+
import org.junit.jupiter.api.Test;
1414

1515
/**
1616
* Basic Java Chaincode Test
1717
*
1818
*/
1919
public class SACCIntegrationTest {
2020

21-
@BeforeClass
21+
@BeforeAll
2222
public static void setUp() throws Exception {
2323
FabricState.getState().start();
2424

Diff for: ‎fabric-chaincode-integration-test/src/test/java/org/hyperleder/fabric/shim/integration/shimtests/SBECCIntegrationTest.java

+4-4
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,16 @@
77

88
import static org.hamcrest.core.StringContains.containsString;
99
import static org.hamcrest.Matchers.not;
10-
import static org.junit.Assert.assertThat;
10+
import static org.hamcrest.MatcherAssert.assertThat;
1111

1212
import org.hyperleder.fabric.shim.integration.util.FabricState;
1313
import org.hyperleder.fabric.shim.integration.util.InvokeHelper;
14-
import org.junit.BeforeClass;
15-
import org.junit.Test;
14+
import org.junit.jupiter.api.BeforeAll;
15+
import org.junit.jupiter.api.Test;
1616

1717
public class SBECCIntegrationTest {
1818

19-
@BeforeClass
19+
@BeforeAll
2020
public static void setUp() throws Exception {
2121
FabricState.getState().start();
2222

Diff for: ‎fabric-chaincode-shim/build.gradle

+11-21
Original file line numberDiff line numberDiff line change
@@ -3,25 +3,16 @@
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
6-
buildscript {
7-
repositories {
8-
mavenCentral()
9-
}
10-
dependencies {
11-
classpath 'org.owasp:dependency-check-gradle:8.4.0'
12-
}
13-
}
146

157
plugins {
168
id 'maven-publish'
179
id 'jacoco'
1810
id 'signing'
1911
id 'checkstyle'
20-
id 'org.cyclonedx.bom' version '1.8.1'
2112
}
2213

2314
checkstyle {
24-
toolVersion '10.12.5'
15+
toolVersion '10.18.1'
2516
configFile file("../ci/checkstyle/checkstyle.xml")
2617
configProperties = [root_dir: file("..") ]
2718
}
@@ -54,34 +45,33 @@ tasks.withType(org.gradle.api.tasks.testing.Test) {
5445
}
5546

5647
dependencies {
48+
implementation platform('com.google.protobuf:protobuf-bom:3.25.5')
49+
implementation platform('io.grpc:grpc-bom:1.68.0')
50+
implementation platform('io.opentelemetry:opentelemetry-bom:1.42.1')
51+
5752
implementation 'org.hyperledger.fabric:fabric-protos:0.3.3'
5853
implementation 'org.bouncycastle:bcpkix-jdk18on:1.78.1'
5954
implementation 'org.bouncycastle:bcprov-jdk18on:1.78.1'
60-
implementation 'io.github.classgraph:classgraph:4.8.165'
55+
implementation 'io.github.classgraph:classgraph:4.8.176'
6156
implementation 'com.github.everit-org.json-schema:org.everit.json.schema:1.14.4'
6257
implementation 'org.json:json:20240303'
63-
implementation 'com.google.protobuf:protobuf-java-util:3.24.4'
58+
implementation 'com.google.protobuf:protobuf-java-util'
6459

65-
// Required if using Java 11+ as no longer bundled in the core libraries
66-
testImplementation 'javax.xml.bind:jaxb-api:2.3.1'
67-
68-
implementation platform('io.grpc:grpc-bom:1.60.0')
6960
implementation 'io.grpc:grpc-netty-shaded'
7061
implementation 'io.grpc:grpc-protobuf'
7162
implementation 'io.grpc:grpc-stub'
72-
7363
testImplementation 'io.grpc:grpc-inprocess'
74-
75-
implementation platform("io.opentelemetry:opentelemetry-bom:1.32.0")
64+
// Required if using Java 11+ as no longer bundled in the core libraries
65+
testImplementation 'javax.xml.bind:jaxb-api:2.3.1'
7666

7767
implementation 'io.opentelemetry:opentelemetry-api'
78-
implementation 'io.opentelemetry.proto:opentelemetry-proto:1.0.0-alpha'
68+
implementation 'io.opentelemetry.proto:opentelemetry-proto:1.3.2-alpha'
7969
implementation 'io.opentelemetry:opentelemetry-sdk'
8070
implementation 'io.opentelemetry:opentelemetry-sdk-extension-autoconfigure'
8171
implementation 'io.opentelemetry:opentelemetry-sdk-trace'
8272
implementation 'io.opentelemetry:opentelemetry-exporter-otlp'
8373
implementation 'io.opentelemetry:opentelemetry-extension-trace-propagators'
84-
implementation 'io.opentelemetry.instrumentation:opentelemetry-grpc-1.6:1.32.0-alpha'
74+
implementation 'io.opentelemetry.instrumentation:opentelemetry-grpc-1.6:2.8.0-alpha'
8575
}
8676

8777
sourceSets {

Diff for: ‎fabric-chaincode-shim/src/test/java/ChaincodeWithoutPackageTest.java

+12-18
Original file line numberDiff line numberDiff line change
@@ -4,31 +4,25 @@
44
* SPDX-License-Identifier: Apache-2.0
55
*/
66

7-
import static org.hamcrest.Matchers.is;
8-
import static org.hyperledger.fabric.protos.peer.ChaincodeMessage.Type.READY;
9-
import static org.hyperledger.fabric.protos.peer.ChaincodeMessage.Type.REGISTER;
10-
import static org.junit.Assert.assertThat;
7+
import org.hyperledger.fabric.shim.ChaincodeBase;
8+
import org.hyperledger.fabric.shim.mock.peer.ChaincodeMockPeer;
9+
import org.hyperledger.fabric.shim.mock.peer.RegisterStep;
10+
import org.hyperledger.fabric.shim.mock.peer.ScenarioStep;
11+
import org.junit.jupiter.api.AfterEach;
12+
import org.junit.jupiter.api.Test;
1113

1214
import java.util.ArrayList;
1315
import java.util.List;
1416
import java.util.concurrent.TimeUnit;
1517

16-
import org.hyperledger.fabric.shim.ChaincodeBase;
17-
import org.hyperledger.fabric.shim.mock.peer.ChaincodeMockPeer;
18-
import org.hyperledger.fabric.shim.mock.peer.RegisterStep;
19-
import org.hyperledger.fabric.shim.mock.peer.ScenarioStep;
20-
import org.junit.After;
21-
import org.junit.Rule;
22-
import org.junit.Test;
23-
import org.junit.contrib.java.lang.system.EnvironmentVariables;
18+
import static org.assertj.core.api.Assertions.assertThat;
19+
import static org.hyperledger.fabric.protos.peer.ChaincodeMessage.Type.READY;
20+
import static org.hyperledger.fabric.protos.peer.ChaincodeMessage.Type.REGISTER;
2421

2522
public final class ChaincodeWithoutPackageTest {
26-
@Rule
27-
public final EnvironmentVariables environmentVariables = new EnvironmentVariables();
28-
2923
private ChaincodeMockPeer server;
3024

31-
@After
25+
@AfterEach
3226
public void afterTest() throws Exception {
3327
if (server != null) {
3428
server.stop();
@@ -49,8 +43,8 @@ public void testRegisterChaincodeWithoutPackage() throws Exception {
4943

5044
ChaincodeMockPeer.checkScenarioStepEnded(server, 1, 5000, TimeUnit.MILLISECONDS);
5145

52-
assertThat(server.getLastMessageSend().getType(), is(READY));
53-
assertThat(server.getLastMessageRcvd().getType(), is(REGISTER));
46+
assertThat(server.getLastMessageSend().getType()).isEqualTo(READY);
47+
assertThat(server.getLastMessageRcvd().getType()).isEqualTo(REGISTER);
5448
}
5549

5650
}

0 commit comments

Comments
 (0)