From 0507b37d8478f6819997eef6c08aee205afb114c Mon Sep 17 00:00:00 2001
From: Felix Dittrich <31076102+f11h@users.noreply.github.com>
Date: Tue, 14 Feb 2023 09:31:44 +0100
Subject: [PATCH] Update CWA-Parent to Spring Boot 3 and JDK 17 (#13)

* Update to Spring Boot 3

* Update to Spring Boot 3

* Update Dependencies

* Update CI Jobs to Java 17

* Update Readme

* Update OWASP Exclusions

* Update OWASP Exclusions
---
 .github/workflows/ci-main.yml         |   2 +-
 .github/workflows/ci-pull-request.yml |   6 +-
 .github/workflows/ci-release.yml      |   2 +-
 README.md                             |   2 +-
 keycloak/pom.xml                      |  13 ++-
 mysql-persistence/pom.xml             |   4 +-
 owasp/suppressions.xml                |  30 ++----
 pom.xml                               | 147 ++++++++------------------
 8 files changed, 72 insertions(+), 134 deletions(-)

diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml
index a2f9c75..0d8da1d 100644
--- a/.github/workflows/ci-main.yml
+++ b/.github/workflows/ci-main.yml
@@ -20,7 +20,7 @@ jobs:
           restore-keys: ${{ env.cache-name }}-
       - uses: actions/setup-java@v1
         with:
-          java-version: 11
+          java-version: 17
       - name: environment
         run: |
           sudo apt-get install --yes --no-install-recommends libxml-xpath-perl
diff --git a/.github/workflows/ci-pull-request.yml b/.github/workflows/ci-pull-request.yml
index e4cde91..26111ab 100644
--- a/.github/workflows/ci-pull-request.yml
+++ b/.github/workflows/ci-pull-request.yml
@@ -7,11 +7,11 @@ on:
       - reopened
 jobs:
   build:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/setup-java@v2
         with:
-          java-version: 11
+          java-version: 17
           distribution: adopt
       - uses: actions/checkout@v2
         with:
@@ -31,7 +31,7 @@ jobs:
     steps:
       - uses: actions/setup-java@v2
         with:
-          java-version: 11
+          java-version: 17
           distribution: adopt
       - uses: actions/checkout@v2
         with:
diff --git a/.github/workflows/ci-release.yml b/.github/workflows/ci-release.yml
index 9635fcf..166043e 100644
--- a/.github/workflows/ci-release.yml
+++ b/.github/workflows/ci-release.yml
@@ -30,7 +30,7 @@ jobs:
           restore-keys: ${{ env.cache-name }}-
       - uses: actions/setup-java@v1
         with:
-          java-version: 11
+          java-version: 17
       - name: version
         run: >-
           APP_SHA=$(git rev-parse --short ${GITHUB_SHA});
diff --git a/README.md b/README.md
index 5b02737..1dc01f8 100644
--- a/README.md
+++ b/README.md
@@ -60,7 +60,7 @@ In either case open a terminal pointing to the directory you put the sources in.
 #### Maven based build
 This is the recommended way for taking part in the development.  
 Please check, whether following prerequisites are installed on your machine:
-- [Open JDK 11](https://openjdk.java.net) or a similar JDK 11 compatible VM  
+- [Open JDK 17](https://adoptium.net) or a similar JDK 17 compatible VM  
 - [Maven](https://maven.apache.org)
 
 ## Documentation  
diff --git a/keycloak/pom.xml b/keycloak/pom.xml
index 8daf18b..124ebaa 100644
--- a/keycloak/pom.xml
+++ b/keycloak/pom.xml
@@ -23,18 +23,21 @@
             <version>${project.parent.version}</version>
             <type>pom</type>
         </dependency>
-
         <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-spring-boot-starter</artifactId>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
         </dependency>
         <dependency>
             <groupId>com.c4-soft.springaddons</groupId>
-            <artifactId>spring-security-oauth2-test-addons</artifactId>
+            <artifactId>spring-addons-oauth2-test</artifactId>
         </dependency>
         <dependency>
             <groupId>com.c4-soft.springaddons</groupId>
-            <artifactId>spring-security-oauth2-test-webmvc-addons</artifactId>
+            <artifactId>spring-addons-webmvc-test</artifactId>
         </dependency>
     </dependencies>
 </project>
diff --git a/mysql-persistence/pom.xml b/mysql-persistence/pom.xml
index 14353c1..efbd2c1 100644
--- a/mysql-persistence/pom.xml
+++ b/mysql-persistence/pom.xml
@@ -32,8 +32,8 @@
             <artifactId>h2</artifactId>
         </dependency>
         <dependency>
-            <groupId>mysql</groupId>
-            <artifactId>mysql-connector-java</artifactId>
+            <groupId>com.mysql</groupId>
+            <artifactId>mysql-connector-j</artifactId>
             <scope>runtime</scope>
         </dependency>
         <dependency>
diff --git a/owasp/suppressions.xml b/owasp/suppressions.xml
index ac2f910..bb3e06e 100644
--- a/owasp/suppressions.xml
+++ b/owasp/suppressions.xml
@@ -1,36 +1,24 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
-
-    <suppress>
-        <notes>CVE is matching for Spring Security 5.3.x, but we have 5.7.x</notes>
-        <cve>CVE-2020-5408</cve>
-    </suppress>
-
-    <suppress>
-        <notes>CVE is matching for Spring Framework up to 5.3.20, but we have 5.3.21</notes>
-        <cve>CVE-2016-1000027</cve>
-    </suppress>
-    
     <suppress>
-        <notes>False Positive matches</notes>
-        <cve>CVE-2022-31514</cve>
-        <cve>CVE-2022-2393</cve>
+        <notes>Both CVE are matching for eclipse ide</notes>
+        <cve>CVE-2008-7271</cve>
+        <cve>CVE-2010-4647</cve>
     </suppress>
 
     <suppress>
-        <notes>SnakeYML False Positive Matcher (CVE is up to 1.32, but also matches for 1.33)</notes>
-        <cve>CVE-2022-38752</cve>
+        <notes>no YAML content from users is parsed within this service</notes>
+        <cve>CVE-2022-1471</cve>
     </suppress>
 
     <suppress>
-        <notes>This CVE is only affecting Keycloak Server not the Lib. (https://bugzilla.redhat.com/show_bug.cgi?id=2141404)</notes>
-        <cve>CVE-2022-3916</cve>
+        <notes>H2 is only used for testing, not production</notes>
+        <cve>CVE-2022-45868</cve>
     </suppress>
 
     <suppress>
-        <notes>The affected libs are just used for unit-testing.</notes>
-        <cve>CVE-2022-31690</cve>
-        <cve>CVE-2022-31692</cve>
+        <notes>False positive. CVE is matching for hutools. OWASP Check matches for json-lib</notes>
+        <cve>CVE-2022-45688</cve>
     </suppress>
 
 </suppressions>
diff --git a/pom.xml b/pom.xml
index 184bfcb..ea73790 100644
--- a/pom.xml
+++ b/pom.xml
@@ -27,12 +27,20 @@
 
     <properties>
         <!-- java -->
-        <java.version>11</java.version>
-        <maven.compiler.source>11</maven.compiler.source>
-        <maven.compiler.target>11</maven.compiler.target>
+        <java.version>17</java.version>
+        <maven.compiler.source>17</maven.compiler.source>
+        <maven.compiler.target>17</maven.compiler.target>
         <!-- charset -->
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
+
+        <spring-boot.version>3.0.2</spring-boot.version>
+        <lombok.version>1.18.26</lombok.version>
+        <mapstruct.version>1.5.3.Final</mapstruct.version>
+        <shedlock.version>5.1.0</shedlock.version>
+        <jjwt.version>0.11.5</jjwt.version>
+        <zxing.version>3.5.1</zxing.version>
+        <springaddons.version>6.0.12</springaddons.version>
     </properties>
 
     <modules>
@@ -59,83 +67,26 @@
             <dependency>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-dependencies</artifactId>
-                <version>2.7.5</version><!-- Also update version of Spring Boot in Spring Boot Plugin -->
+                <version>${spring-boot.version}</version>
                 <type>pom</type>
                 <scope>import</scope>
-                <exclusions>
-                    <exclusion>
-                        <groupId>com.fasterxml.jackson.core</groupId>
-                        <artifactId>jackson-databind</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>org.yaml</groupId>
-                        <artifactId>snakeyaml</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>org.springframework.security</groupId>
-                        <artifactId>spring-security-core</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>org.springframework.security</groupId>
-                        <artifactId>spring-security-web</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>org.springframework.security</groupId>
-                        <artifactId>spring-security-config</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>org.springframework.security</groupId>
-                        <artifactId>spring-security-crypto</artifactId>
-                    </exclusion>
-                </exclusions>
-            </dependency>
-            <dependency>
-                <groupId>org.springframework.security</groupId>
-                <artifactId>spring-security-core</artifactId>
-                <version>5.7.5</version>
-            </dependency>
-            <dependency>
-                <groupId>org.springframework.security</groupId>
-                <artifactId>spring-security-web</artifactId>
-                <version>5.7.5</version>
-            </dependency>
-            <dependency>
-                <groupId>org.springframework.security</groupId>
-                <artifactId>spring-security-config</artifactId>
-                <version>5.7.5</version>
-            </dependency>
-            <dependency>
-                <groupId>org.springframework.security</groupId>
-                <artifactId>spring-security-crypto</artifactId>
-                <version>5.7.5</version>
-            </dependency>
-
-            <dependency>
-                <groupId>org.yaml</groupId>
-                <artifactId>snakeyaml</artifactId>
-                <version>1.33</version>
-            </dependency>
-            <dependency>
-                <groupId>com.fasterxml.jackson.core</groupId>
-                <artifactId>jackson-databind</artifactId>
-                <version>2.14.0</version>
             </dependency>
             <dependency>
                 <groupId>org.springframework.cloud</groupId>
                 <artifactId>spring-cloud-dependencies</artifactId>
-                <version>2021.0.5</version>
+                <version>2022.0.1</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
             <dependency>
                 <groupId>org.springframework.cloud</groupId>
-                <artifactId>spring-cloud-starter-openfeign</artifactId>
-                <version>3.1.5</version>
+                <artifactId>spring-cloud-starter-sleuth</artifactId>
+                <version>3.1.6</version>
             </dependency>
             <dependency>
                 <groupId>org.springdoc</groupId>
                 <artifactId>springdoc-openapi-ui</artifactId>
-                <version>1.6.12</version>
+                <version>1.6.14</version>
             </dependency>
 
 
@@ -143,7 +94,7 @@
             <dependency>
                 <groupId>org.projectlombok</groupId>
                 <artifactId>lombok</artifactId>
-                <version>1.18.24</version><!-- Also update version of lombok in Maven Compiler Plugin -->
+                <version>${lombok.version}</version>
             </dependency>
 
 
@@ -151,12 +102,12 @@
             <dependency>
                 <groupId>net.javacrumbs.shedlock</groupId>
                 <artifactId>shedlock-spring</artifactId>
-                <version>4.42.0</version>
+                <version>${shedlock.version}</version>
             </dependency>
             <dependency>
                 <groupId>net.javacrumbs.shedlock</groupId>
                 <artifactId>shedlock-provider-jdbc-template</artifactId>
-                <version>4.42.0</version>
+                <version>${shedlock.version}</version>
             </dependency>
 
             <!-- Commons IO -->
@@ -177,23 +128,23 @@
             <dependency>
                 <groupId>io.jsonwebtoken</groupId>
                 <artifactId>jjwt-api</artifactId>
-                <version>0.11.5</version>
+                <version>${jjwt.version}</version>
             </dependency>
             <dependency>
                 <groupId>io.jsonwebtoken</groupId>
                 <artifactId>jjwt-impl</artifactId>
-                <version>0.11.5</version>
+                <version>${jjwt.version}</version>
             </dependency>
             <dependency>
                 <groupId>io.jsonwebtoken</groupId>
                 <artifactId>jjwt-jackson</artifactId>
-                <version>0.11.5</version>
+                <version>${jjwt.version}</version>
                 <scope>runtime</scope>
             </dependency>
             <dependency>
                 <groupId>com.nimbusds</groupId>
                 <artifactId>nimbus-jose-jwt</artifactId>
-                <version>9.25.6</version>
+                <version>9.30.1</version>
             </dependency>
 
 
@@ -201,7 +152,7 @@
             <dependency>
                 <groupId>org.liquibase</groupId>
                 <artifactId>liquibase-core</artifactId>
-                <version>4.17.2</version>
+                <version>4.19.0</version>
             </dependency>
             <dependency>
                 <groupId>com.h2database</groupId>
@@ -212,7 +163,7 @@
             <dependency>
                 <groupId>org.postgresql</groupId>
                 <artifactId>postgresql</artifactId>
-                <version>42.5.0</version>
+                <version>42.5.3</version>
             </dependency>
 
 
@@ -228,7 +179,7 @@
             <dependency>
                 <groupId>eu.europa.ec.dgc</groupId>
                 <artifactId>dgc-lib</artifactId>
-                <version>1.3.3</version>
+                <version>2.0.0</version>
             </dependency>
 
 
@@ -244,12 +195,12 @@
             <dependency>
                 <groupId>com.google.zxing</groupId>
                 <artifactId>core</artifactId>
-                <version>3.5.0</version>
+                <version>${zxing.version}</version>
             </dependency>
             <dependency>
                 <groupId>com.google.zxing</groupId>
                 <artifactId>javase</artifactId>
-                <version>3.5.1</version>
+                <version>${zxing.version}</version>
             </dependency>
 
 
@@ -261,25 +212,20 @@
             </dependency>
 
             <!-- Keycloak -->
-            <dependency>
-                <groupId>org.keycloak</groupId>
-                <artifactId>keycloak-spring-boot-starter</artifactId>
-                <version>20.0.1</version>
-            </dependency>
             <dependency>
                 <groupId>org.keycloak</groupId>
                 <artifactId>keycloak-admin-client</artifactId>
-                <version>20.0.1</version>
+                <version>20.0.3</version>
             </dependency>
             <dependency>
                 <groupId>com.c4-soft.springaddons</groupId>
-                <artifactId>spring-security-oauth2-test-addons</artifactId>
-                <version>3.1.19-jdk11</version>
+                <artifactId>spring-addons-oauth2-test</artifactId>
+                <version>${springaddons.version}</version>
             </dependency>
             <dependency>
                 <groupId>com.c4-soft.springaddons</groupId>
-                <artifactId>spring-security-oauth2-test-webmvc-addons</artifactId>
-                <version>3.1.19-jdk11</version>
+                <artifactId>spring-addons-webmvc-test</artifactId>
+                <version>${springaddons.version}</version>
             </dependency>
 
 
@@ -287,14 +233,14 @@
             <dependency>
                 <groupId>org.modelmapper.extensions</groupId>
                 <artifactId>modelmapper-spring</artifactId>
-                <version>3.1.0</version>
+                <version>3.1.1</version>
             </dependency>
 
             <!-- AWS -->
             <dependency>
                 <groupId>com.amazonaws</groupId>
                 <artifactId>aws-java-sdk-s3</artifactId>
-                <version>1.12.344</version>
+                <version>1.12.405</version>
             </dependency>
 
             <!-- SAP Cloud Foundry -->
@@ -306,19 +252,19 @@
             <dependency>
                 <groupId>com.sap.cloud.sdk.cloudplatform</groupId>
                 <artifactId>scp-cf</artifactId>
-                <version>3.75.0</version>
+                <version>4.7.0</version>
             </dependency>
             <dependency>
                 <groupId>com.sap.hcp.cf.logging</groupId>
                 <artifactId>cf-java-logging-support-logback</artifactId>
-                <version>3.6.2</version>
+                <version>3.6.3</version>
             </dependency>
 
             <!-- Mapstruct -->
             <dependency>
                 <groupId>org.mapstruct</groupId>
                 <artifactId>mapstruct</artifactId>
-                <version>1.5.3.Final</version><!-- Also update version of Mapstruct in Maven Compiler Plugin -->
+                <version>${mapstruct.version}</version>
             </dependency>
         </dependencies>
     </dependencyManagement>
@@ -329,7 +275,7 @@
                 <plugin>
                     <groupId>org.springframework.boot</groupId>
                     <artifactId>spring-boot-maven-plugin</artifactId>
-                    <version>2.7.5</version>
+                    <version>${spring-boot.version}</version>
                     <executions>
                         <execution>
                             <goals>
@@ -343,7 +289,7 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-plugin</artifactId>
-                    <version>3.0.0-M7</version>
+                    <version>3.0.0-M8</version>
                 </plugin>
 
                 <plugin>
@@ -355,12 +301,12 @@
                             <path>
                                 <groupId>org.projectlombok</groupId>
                                 <artifactId>lombok</artifactId>
-                                <version>1.18.24</version>
+                                <version>${lombok.version}</version>
                             </path>
                             <path>
                                 <groupId>org.mapstruct</groupId>
                                 <artifactId>mapstruct-processor</artifactId>
-                                <version>1.5.3.Final</version>
+                                <version>${mapstruct.version}</version>
                             </path>
                         </annotationProcessorPaths>
                     </configuration>
@@ -369,7 +315,7 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-checkstyle-plugin</artifactId>
-                    <version>3.2.0</version>
+                    <version>3.2.1</version>
                     <configuration>
                         <configLocation>codestyle/checkstyle.xml</configLocation>
                         <excludes>target/**/*</excludes>
@@ -412,7 +358,7 @@
                 <plugin>
                     <groupId>org.codehaus.mojo</groupId>
                     <artifactId>license-maven-plugin</artifactId>
-                    <version>4.1</version>
+                    <version>2.0.0</version>
                     <configuration>
                         <includes>**/*.java</includes>
                         <copyrightOwners>${project.organization.name} and all other contributors</copyrightOwners>
@@ -434,9 +380,10 @@
                 <plugin>
                     <groupId>org.owasp</groupId>
                     <artifactId>dependency-check-maven</artifactId>
-                    <version>7.3.1</version>
+                    <version>8.0.2</version>
                     <configuration>
                         <suppressionFile>./owasp/suppressions.xml</suppressionFile>
+                        <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
                         <failBuildOnAnyVulnerability>true</failBuildOnAnyVulnerability>
                     </configuration>
                 </plugin>
@@ -450,7 +397,7 @@
                         <dependency>
                             <groupId>org.springframework.restdocs</groupId>
                             <artifactId>spring-restdocs-asciidoctor</artifactId>
-                            <version>2.0.6.RELEASE</version>
+                            <version>3.0.0</version>
                         </dependency>
                     </dependencies>
                 </plugin>