Fix build, update CVE-affected versions (opensearch-project#1102)

* Fix build, update CVE-affected versions * Spotless depends on CVE-impacted eclipse dependency, now needs JDK17+ Signed-off-by: Daniel Widdis <[email protected]> --------- Signed-off-by: Daniel Widdis <[email protected]>
dbwiddis · Nov 22, 2023 · 8b7c283 · 8b7c283
1 parent 558f556
commit 8b7c283
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/build.gradle b/build.gradle
@@ -152,6 +152,10 @@ configurations.all {
         force "net.bytebuddy:byte-buddy-agent:1.9.15"
         force "com.google.code.gson:gson:2.8.9"
         force "junit:junit:4.13.2"
+
+        force "com.google.guava:guava:32.1.3-jre" // CVE for 31.1
+        force "com.fasterxml.jackson.core:jackson-core:2.16.0" // CVE for 2.14.1
+        force "org.eclipse.platform:org.eclipse.core.runtime:3.29.0" // CVE for < 3.29.0        
     }
 }
 

diff --git a/dataGeneration/requirements.txt b/dataGeneration/requirements.txt
@@ -2,4 +2,4 @@ numpy==1.23.0
 opensearch_py==2.0.0
 retry==0.9.2
 scipy==1.10.0
-urllib3==1.26.17
+urllib3==1.26.18