From 1cc6736c4eeed2e641e3754b5c1aa52a73165086 Mon Sep 17 00:00:00 2001
From: stedelia <144045955+stedelia@users.noreply.github.com>
Date: Wed, 31 Jul 2024 11:05:36 +0200
Subject: [PATCH] fix: Update maven dependency to fix cve (#22)

Co-authored-by: Vitolo-Andrea <andrea.vitolo@emeal.nttdata.com>
---
 .grype.yaml | 10 ++++++++++
 pom.xml     | 38 +++++++++++++++++++++++++++++++++++++-
 2 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 .grype.yaml

diff --git a/.grype.yaml b/.grype.yaml
new file mode 100644
index 0000000..28e75a2
--- /dev/null
+++ b/.grype.yaml
@@ -0,0 +1,10 @@
+ignore:
+  - vulnerability: CVE-2022-1471 # solved in snakeyaml 2.2
+  - vulnerability: CVE-2024-23672 # tomcat-embed-core 10.1.25
+  - vulnerability: CVE-2024-24549 # tomcat-embed-websocket 10.1.25
+  - vulnerability: CVE-2024-22243 # spring-web 6.0.22
+  - vulnerability: CVE-2024-22259 # spring-web 6.0.22
+  - vulnerability: CVE-2023-3635 # okio-jvm 3.9.0
+  - vulnerability: CVE-2023-51074 # json-path 2.9.0
+  - vulnerability: CVE-2024-26308 # commons-compress 1.26.2
+  - vulnerability: CVE-2024-25710 # commons-compress 1.26.2
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 2105923..ac4ac7e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -110,6 +110,22 @@
 
 	<dependencyManagement>
 		<dependencies>
+			<dependency>
+				<groupId>org.yaml</groupId>
+				<artifactId>snakeyaml</artifactId>
+				<version>2.2</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.commons</groupId>
+				<artifactId>commons-compress</artifactId>
+				<version>1.26.2</version>
+			</dependency>
+			<dependency>
+				<groupId>com.jayway.jsonpath</groupId>
+				<artifactId>json-path</artifactId>
+				<version>2.9.0</version>
+			</dependency>
+
 			<dependency>
 				<groupId>org.springframework.cloud</groupId>
 				<artifactId>spring-cloud-dependencies</artifactId>
@@ -117,7 +133,27 @@
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>
-
+			<dependency>
+				<groupId>com.squareup.okio</groupId>
+				<artifactId>okio-jvm</artifactId>
+				<version>3.9.0</version>
+				<scope>runtime</scope>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-core</artifactId>
+				<version>10.1.25</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.tomcat.embed</groupId>
+				<artifactId>tomcat-embed-websocket</artifactId>
+				<version>10.1.25</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework</groupId>
+				<artifactId>spring-web</artifactId>
+				<version>6.0.22</version>
+			</dependency>
 			<dependency>
 				<groupId>com.azure.spring</groupId>
 				<artifactId>spring-cloud-azure-dependencies</artifactId>