dependency-track: Fix CVEs

Signed-off-by: Philippe Deslauriers <[email protected]>
wolfi-dev · Mar 5, 2024 · 2da9c8f · 2da9c8f
1 parent fee0796
commit 2da9c8f
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/dependency-track.yaml b/dependency-track.yaml
@@ -1,7 +1,7 @@
 package:
   name: dependency-track
   version: 4.10.1
-  epoch: 1
+  epoch: 2
   description:
   copyright:
     - license: Apache-2.0
@@ -29,6 +29,8 @@ pipeline:
       tag: ${{package.version}}
       expected-commit: fcb8e784d9b208de5ab755a979a48f2535f3c390
 
+  - uses: maven/pombump
+
   - runs: |
       export LANG=en_US.UTF-8
       # Build the API Server and the bundled UI jars

diff --git a/dependency-track/pombump.yaml b/dependency-track/pombump.yaml
@@ -0,0 +1,11 @@
+patches:
+  - groupId: org.apache.commons
+    artifactId: commons-compress
+    version: 1.26.0
+    scope: import
+    type: jar
+  - groupId:  org.postgresql
+    artifactId: postgresql
+    version: 42.6.1
+    scope: import
+    type: jar