updated few jars for security fix

[portal.git] / ecomp-portal-widget-ms / widget-ms / pom.xml

diff --git a/ecomp-portal-widget-ms/widget-ms/pom.xml b/ecomp-portal-widget-ms/widget-ms/pom.xml
index 08659cc..a601dbe 100644 (file)
--- a/ecomp-portal-widget-ms/widget-ms/pom.xml
+++ b/ecomp-portal-widget-ms/widget-ms/pom.xml
@@ -1,19 +1,20 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
-       <modelVersion>4.0.0</modelVersion>
+               <modelVersion>4.0.0</modelVersion>
 
        <!-- This project must name Spring as parent; cannot name Portal -->
+       
        <parent>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-parent</artifactId>
-               <version>1.4.2.RELEASE</version>
+               <version>2.2.5.RELEASE</version>
                <relativePath /> <!-- lookup parent from repository -->
        </parent>
 
        <groupId>org.onap.portal</groupId>
        <artifactId>widget-ms</artifactId>
-       <version>1.3.0</version>
+       <version>3.4.0</version>
        <packaging>jar</packaging>
        <name>widget-microservice</name>
 
@@ -22,8 +23,10 @@
                <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
                <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
                <java.version>1.8</java.version>
-               <hibernate.version>4.3.11.Final</hibernate.version>
-               <skipTests>true</skipTests>
+               <hibernate.version>5.4.14.Final</hibernate.version>
+               <skipTests>false</skipTests>
+               <!-- Replicate this from OParent -->
+               <jacocoVersion>0.8.2</jacocoVersion>
        </properties>
 
        <dependencies>
@@ -42,16 +45,22 @@
                <dependency>
                        <groupId>org.springframework.boot</groupId>
                        <artifactId>spring-boot-starter-security</artifactId>
+                       <exclusions>
+                               <exclusion>
+                                       <groupId>org.springframework.security</groupId>
+                               <artifactId>spring-security-web</artifactId>
+                               </exclusion>
+                       </exclusions>
                </dependency>
                <dependency>
                        <groupId>org.springframework.boot</groupId>
                        <artifactId>spring-boot-starter-thymeleaf</artifactId>
                </dependency>
-               <dependency>
+               <!-- <dependency>
                        <groupId>org.springframework.boot</groupId>
                        <artifactId>spring-boot-devtools</artifactId>
                        <optional>true</optional>
-               </dependency>
+               </dependency> -->
                <dependency>
                        <groupId>org.springframework.boot</groupId>
                        <artifactId>spring-boot-configuration-processor</artifactId>
@@ -60,7 +69,7 @@
                <dependency>
                        <groupId>org.hibernate</groupId>
                        <artifactId>hibernate-core</artifactId>
-                       <!-- <version>${hibernate.version}</version> -->
+                       <version>${hibernate.version}</version>
                </dependency>
                <dependency>
                        <groupId>org.springframework.boot</groupId>
@@ -83,20 +92,25 @@
                <dependency>
                        <groupId>org.mariadb.jdbc</groupId>
                        <artifactId>mariadb-java-client</artifactId>
-                       <!-- <version>1.5.8</version> -->
+                       <version>1.5.8</version>
                </dependency>
                <dependency>
                        <groupId>com.github.ulisesbocchio</groupId>
                        <artifactId>jasypt-spring-boot-starter</artifactId>
-                       <version>1.9</version>
+                       <version>2.1.0</version>
                </dependency>
+               <dependency>
+                       <groupId>org.jsoup</groupId>
+                       <artifactId>jsoup</artifactId>
+                       <version>1.12.1</version>
+       </dependency>
                <!-- hibernate-core depends on dom4j, which has optional dependencies. 
                        On jenkins, contrary to doc, mvn 3.0.5 packages the optional dependencies 
                        in the war. Workaround: exclude them explicitly. -->
                <dependency>
                        <groupId>dom4j</groupId>
                        <artifactId>dom4j</artifactId>
-                       <!-- <version>1.6.1</version> -->
+                       <version>1.6.1</version>
                        <exclusions>
                                <exclusion>
                                        <groupId>jaxme</groupId>
@@ -128,6 +142,53 @@
                                </exclusion>
                        </exclusions>
                </dependency>
+               <!-- Jacoco offline instrumentation agent -->
+               <dependency>
+                       <groupId>org.jacoco</groupId>
+                       <artifactId>org.jacoco.agent</artifactId>
+                       <version>${jacocoVersion}</version>
+                       <classifier>runtime</classifier>
+               </dependency>
+               <dependency>
+               <groupId>org.apache.tomcat.embed</groupId>
+               <artifactId>tomcat-embed-core</artifactId>
+               <version>9.0.36</version>
+               </dependency>
+               <dependency>
+                       <groupId>ch.qos.logback</groupId>
+                       <artifactId>logback-core</artifactId>
+                       <version>1.2.3</version>
+               </dependency>
+               <dependency>
+                       <groupId>ch.qos.logback</groupId>
+                       <artifactId>logback-classic</artifactId>
+                       <version>1.2.3</version>
+               </dependency>
+               <dependency>
+                       <groupId>com.fasterxml.jackson.core</groupId>
+                       <artifactId>jackson-annotations</artifactId>
+                       <version>2.11.0</version>
+               </dependency>
+               <dependency>
+                       <groupId>com.fasterxml.jackson.core</groupId>
+                       <artifactId>jackson-core</artifactId>
+                       <version>2.11.0</version>
+               </dependency>
+               <dependency>
+                       <groupId>com.fasterxml.jackson.core</groupId>
+                       <artifactId>jackson-databind</artifactId>
+                       <version>2.11.0</version>
+               </dependency>
+               <dependency>
+               <groupId>org.springframework.security</groupId>
+               <artifactId>spring-security-web</artifactId>
+               <version>5.2.3.RELEASE</version>
+               </dependency>
+               <dependency>
+                       <groupId>org.projectlombok</groupId>
+                       <artifactId>lombok</artifactId>
+                       <version>1.18.4</version>
+               </dependency>
        </dependencies>
 
        <build>
@@ -150,6 +211,7 @@
 
                <pluginManagement>
                        <plugins>
+                               <!-- replicated from OParent -->
                                <plugin>
                                        <groupId>org.apache.maven.plugins</groupId>
                                        <artifactId>maven-site-plugin</artifactId>
@@ -184,10 +246,28 @@
                        <plugin>
                                <groupId>org.jacoco</groupId>
                                <artifactId>jacoco-maven-plugin</artifactId>
-                               <version>0.7.6.201602180812</version>
+                               <version>${jacocoVersion}</version>
                                <executions>
+                                       <!-- disable jacoco executions from oparent -->
+                                       <execution>
+                                               <id>pre-unit-test</id>
+                                               <phase>none</phase>
+                                       </execution>
+                                       <execution>
+                                               <id>post-unit-test</id>
+                                               <phase>none</phase>
+                                       </execution>
+                                       <execution>
+                                               <id>pre-integration-test</id>
+                                               <phase>none</phase>
+                                       </execution>
+                                       <execution>
+                                               <id>post-integration-test</id>
+                                               <phase>none</phase>
+                                       </execution>
+                                       <!-- Order matters -->
                                        <execution>
-                                               <id>prepare-agent</id>
+                                               <id>portal-prepare-agent</id>
                                                <goals>
                                                        <goal>prepare-agent</goal>
                                                </goals>
@@ -195,21 +275,22 @@
                                                        <destFile>${sonar.jacoco.reportPath}</destFile>
                                                </configuration>
                                        </execution>
+                                       <!-- offline instrumentation for PowerMock -->
                                        <execution>
-                                               <id>default-instrument</id>
+                                               <id>portal-offline-instrument</id>
                                                <goals>
                                                        <goal>instrument</goal>
                                                </goals>
                                        </execution>
                                        <execution>
-                                               <id>default-restore-instrumented-classes</id>
+                                               <id>portal-restore-instrumented-classes</id>
                                                <phase>test</phase>
                                                <goals>
                                                        <goal>restore-instrumented-classes</goal>
                                                </goals>
                                        </execution>
                                        <execution>
-                                               <id>post-unit-test</id>
+                                               <id>portal-post-unit-test</id>
                                                <phase>test</phase>
                                                <goals>
                                                        <goal>report</goal>
@@ -219,9 +300,18 @@
                                                        <outputDirectory>${project.basedir}/target/site/jacoco</outputDirectory>
                                                </configuration>
                                        </execution>
-                       
                                </executions>
                        </plugin>
+
+                       <plugin>
+                               <groupId>org.apache.maven.plugins</groupId>
+                               <artifactId>maven-surefire-plugin</artifactId>
+                               <configuration>
+                                       <systemPropertyVariables>
+                                               <jacoco-agent.destfile>${project.build.directory}/code-coverage/jacoco-ut.exec</jacoco-agent.destfile>
+                                       </systemPropertyVariables>
+                               </configuration>
+                       </plugin>
                </plugins>
 
        </build>