KNIME 4.6 node build fails dependency checker

[webbres]

Raising here for visibility.

KNIME community builds now have OWASP dependency checker run against them and fail on critical security issues.

Legacy CDK fails on:

• CVE-2019-17571, CVE-2020-9493, CVE-2022-23305 (shaded: log4j:log4j:1.2.17) - this can be switched to reload4j
• CVE-2022-28890: (shaded: org.apache.jena:jena-core:2.7.4)
• CVE-2022-28890: (shaded: org.apache.jena:jena-iri:0.9.4)

The KNIME plugin has a bundled jar for CDK 1.5.13 so it's not possible to simply replace the libs provided.

For the reaction decoder tool integration I updated the dependencies (CDK 2.4 -> 2.7) and then had to update some of the CDK dependencies to work around security issues.

I'll try submit a fix for this, will need to make sure CDK 1.5 tests pass with updated JENA deps

[egonw]

Yes, update to CDK 2.7.1 is really needed. Let's see how far we get with https://github.com/cdk/nodes4knime-cdk2

[egonw]

I have now pushed a patch that make the "fork" compile with the CDK 2.7.1. The next two weeks I will not have time to work on it. Continuation of the patch is most welcome, e.g. to restore AMBIT and Jmol functionality. Restoring the JChemPaint functionality is a lot harder. Last year I already tried updating JChemPaint to the latest CDK version, but unsuccesfully.

[webbres]

I'll take a look and see if I can progress it.

[webbres]

FYI I've started looking at continuing the CDK upgrade on this fork: https://github.com/webbres/nodes4knime-cdk2/tree/cdk2-upgrade