deps: updates to latest (clean trivy run) (#3759)

Signed-off-by: Adrian Cole <[email protected]>
openzipkin · Apr 13, 2024 · 3467f1d · 3467f1d
1 parent 845312a
commit 3467f1d
Show file tree

Hide file tree

Showing 8 changed files with 278 additions and 320 deletions.
diff --git a/benchmarks/pom.xml b/benchmarks/pom.xml
@@ -208,44 +208,6 @@
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>
-
-    <!-- overrides from zipkin-server project are not picked up here so redefine -->
-    <!-- temporary until netty-4.1.108.Final -->
-    <dependency>
-      <groupId>io.netty</groupId>
-      <artifactId>netty-tcnative-boringssl-static</artifactId>
-      <version>2.0.63.Final</version>
-      <classifier>linux-x86_64</classifier>
-      <scope>runtime</scope>
-    </dependency>
-    <dependency>
-      <groupId>io.netty</groupId>
-      <artifactId>netty-tcnative-boringssl-static</artifactId>
-      <version>2.0.63.Final</version>
-      <classifier>linux-aarch_64</classifier>
-      <scope>runtime</scope>
-    </dependency>
-    <dependency>
-      <groupId>io.netty</groupId>
-      <artifactId>netty-tcnative-boringssl-static</artifactId>
-      <version>2.0.63.Final</version>
-      <classifier>osx-x86_64</classifier>
-      <scope>runtime</scope>
-    </dependency>
-    <dependency>
-      <groupId>io.netty</groupId>
-      <artifactId>netty-tcnative-boringssl-static</artifactId>
-      <version>2.0.63.Final</version>
-      <classifier>osx-aarch_64</classifier>
-      <scope>runtime</scope>
-    </dependency>
-    <dependency>
-      <groupId>io.netty</groupId>
-      <artifactId>netty-tcnative-boringssl-static</artifactId>
-      <version>2.0.63.Final</version>
-      <classifier>windows-x86_64</classifier>
-      <scope>runtime</scope>
-    </dependency>
   </dependencies>
 
   <build>

diff --git a/docker/test-images/zipkin-eureka/pom.xml b/docker/test-images/zipkin-eureka/pom.xml
@@ -49,11 +49,6 @@
         <artifactId>httpclient</artifactId>
         <version>4.5.14</version>
       </dependency>
-      <dependency>
-        <groupId>software.amazon.ion</groupId>
-        <artifactId>ion-java</artifactId>
-        <version>1.5.1</version>
-      </dependency>
     </dependencies>
   </dependencyManagement>
 
@@ -68,8 +63,18 @@
           <groupId>commons-logging</groupId>
           <artifactId>commons-logging</artifactId>
         </exclusion>
+        <exclusion>
+          <groupId>software.amazon.ion</groupId>
+          <artifactId>ion-java</artifactId>
+        </exclusion>
       </exclusions>
     </dependency>
+    <!-- dodge CVE -->
+    <dependency>
+      <groupId>com.amazon.ion</groupId>
+      <artifactId>ion-java</artifactId>
+      <version>1.11.4</version>
+    </dependency>
 
     <!-- Get rid of log warning saying to use Caffeine -->
     <dependency>

diff --git a/pom.xml b/pom.xml
@@ -42,27 +42,27 @@
 
     <!-- override to set exclusions per-project -->
     <errorprone.args />
-    <errorprone.version>2.25.0</errorprone.version>
+    <errorprone.version>2.26.1</errorprone.version>
 
     <zipkin-proto3.version>1.0.0</zipkin-proto3.version>
 
     <armeria.groupId>com.linecorp.armeria</armeria.groupId>
-    <armeria.version>1.27.2</armeria.version>
+    <armeria.version>1.28.0</armeria.version>
     <!-- Match Armeria version to avoid conflicts including running tests in the IDE -->
-    <netty.version>4.1.106.Final</netty.version>
+    <netty.version>4.1.108.Final</netty.version>
 
     <!-- It's easy for Jackson dependencies to get misaligned, so we manage it ourselves. -->
-    <jackson.version>2.16.1</jackson.version>
+    <jackson.version>2.17.0</jackson.version>
 
     <java-driver.version>4.18.0</java-driver.version>
-    <micrometer.version>1.12.3</micrometer.version>
+    <micrometer.version>1.12.5</micrometer.version>
 
     <!-- Used for Generated annotations -->
     <javax-annotation-api.version>1.3.2</javax-annotation-api.version>
 
     <!-- update together -->
-    <spring-boot.version>3.2.3</spring-boot.version>
-    <spring.version>6.1.4</spring.version>
+    <spring-boot.version>3.2.4</spring-boot.version>
+    <spring.version>6.1.6</spring.version>
 
     <!-- MySQL connector is GPL, even if it has an OSS exception.
          https://www.mysql.com/about/legal/licensing/foss-exception/
@@ -71,15 +71,15 @@
     -->
     <mariadb-java-client.version>3.3.3</mariadb-java-client.version>
     <HikariCP.version>5.1.0</HikariCP.version>
-    <slf4j.version>2.0.12</slf4j.version>
+    <slf4j.version>2.0.13</slf4j.version>
     <auto-value.version>1.10.4</auto-value.version>
     <git-commit-id.version>4.9.10</git-commit-id.version>
 
     <!-- Test only dependencies -->
     <junit-jupiter.version>5.10.2</junit-jupiter.version>
     <mockito.version>5.11.0</mockito.version>
     <assertj.version>3.25.3</assertj.version>
-    <awaitility.version>4.2.0</awaitility.version>
+    <awaitility.version>4.2.1</awaitility.version>
     <testcontainers.version>1.19.7</testcontainers.version>
     <okhttp.version>4.12.0</okhttp.version>
     <kryo.version>5.6.0</kryo.version>
@@ -94,9 +94,9 @@
     <go-offline-maven-plugin.version>1.2.8</go-offline-maven-plugin.version>
     <!-- TODO: cleanup any redundant ignores now also in the 4.0 release (once final) -->
     <license-maven-plugin.version>4.3</license-maven-plugin.version>
-    <maven-assembly-plugin.version>3.6.0</maven-assembly-plugin.version>
+    <maven-assembly-plugin.version>3.7.1</maven-assembly-plugin.version>
     <maven-bundle-plugin.version>5.1.9</maven-bundle-plugin.version>
-    <maven-compiler-plugin.version>3.12.1</maven-compiler-plugin.version>
+    <maven-compiler-plugin.version>3.13.0</maven-compiler-plugin.version>
     <!-- Use same version as https://github.com/openzipkin/docker-java -->
     <maven-dependency-plugin.version>3.6.1</maven-dependency-plugin.version>
     <maven-deploy-plugin.version>3.1.1</maven-deploy-plugin.version>
@@ -108,7 +108,7 @@
     <maven-jar-plugin.version>3.3.0</maven-jar-plugin.version>
     <maven-release-plugin.version>3.0.1</maven-release-plugin.version>
     <maven-shade-plugin.version>3.5.2</maven-shade-plugin.version>
-    <maven-source-plugin.version>3.3.0</maven-source-plugin.version>
+    <maven-source-plugin.version>3.3.1</maven-source-plugin.version>
     <maven-surefire-plugin.version>3.2.5</maven-surefire-plugin.version>
     <nexus-staging-maven-plugin.version>1.6.13</nexus-staging-maven-plugin.version>
     <wire-maven-plugin.version>1.3</wire-maven-plugin.version>
@@ -690,7 +690,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-gpg-plugin</artifactId>
-            <version>3.1.0</version>
+            <version>3.2.3</version>
             <executions>
               <execution>
                 <id>sign-artifacts</id>

diff --git a/zipkin-collector/activemq/pom.xml b/zipkin-collector/activemq/pom.xml
@@ -20,7 +20,7 @@
 
   <properties>
     <main.basedir>${project.basedir}/../..</main.basedir>
-    <activemq.version>5.18.3</activemq.version>
+    <activemq.version>5.18.4</activemq.version>
   </properties>
 
   <dependencies>

diff --git a/zipkin-collector/rabbitmq/pom.xml b/zipkin-collector/rabbitmq/pom.xml
@@ -20,7 +20,7 @@
 
   <properties>
     <main.basedir>${project.basedir}/../..</main.basedir>
-    <amqp-client.version>5.20.0</amqp-client.version>
+    <amqp-client.version>5.21.0</amqp-client.version>
   </properties>
 
   <dependencies>