Skip to content

[cdks, source-postgres, source-mysql, source-mongodb-v2] Fixing vulnerabilities in dependencies #58132

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 22 commits into from
Apr 24, 2025
Merged

[cdks, source-postgres, source-mysql, source-mongodb-v2] Fixing vulnerabilities in dependencies #58132

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
1f28f22
Implement timeout for document discovery
theyueli Apr 17, 2025
d792fed
formatting
theyueli Apr 17, 2025
fd0b09d
chore: bump-version
octavia-squidington-iii Apr 17, 2025
f5bb4d9
fix test
theyueli Apr 17, 2025
823237e
make tests happy
theyueli Apr 17, 2025
b7c7743
make acceptance test happy
theyueli Apr 17, 2025
1f6a255
use mina-core explicitly 2.0.27
theyueli Apr 17, 2025
f8f7fc2
json-smart, protobuf-java
theyueli Apr 17, 2025
5ea32ed
Merge branch 'master' into yue/vulnerability
theyueli Apr 18, 2025
bdc2df0
chore: bump-version
octavia-squidington-iii Apr 18, 2025
7786235
change log for legacy cdk
theyueli Apr 18, 2025
985290d
Merge branch 'master' into yue/vulnerability
theyueli Apr 22, 2025
b080708
unstage bulk cdk dependency fix temporarily
theyueli Apr 22, 2025
9a27ddf
Merge branch 'master' into yue/vulnerability
theyueli Apr 23, 2025
eca1afe
bump up mysql version
theyueli Apr 23, 2025
ec76c34
make postgres unit test happy
theyueli Apr 24, 2025
14d962f
Merge branch 'master' into yue/vulnerability
theyueli Apr 24, 2025
b86a95a
bump up mysql version
theyueli Apr 24, 2025
b0d5140
formatting
theyueli Apr 24, 2025
b1f9382
adding mongodb
theyueli Apr 24, 2025
134ba2b
clean up
theyueli Apr 24, 2025
0decf7f
fix new cdk dependencies
theyueli Apr 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions airbyte-cdk/bulk/core/base/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ dependencies {
}
api 'io.github.oshai:kotlin-logging-jvm:7.0.0'
api 'io.micronaut:micronaut-runtime'
api 'org.apache.mina:mina-core:2.0.27' // for fixing vulnerability of sshd-mina
api 'org.apache.sshd:sshd-mina:2.13.2'
api 'org.jetbrains.kotlinx:kotlinx-coroutines-core'

Expand Down
1 change: 1 addition & 0 deletions airbyte-cdk/java/airbyte-cdk/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,6 +174,7 @@ corresponds to that version.

| Version | Date | Pull Request | Subject |
|:-----------|:-----------|:------------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 0.48.9 | 2025-04-17 | [\#58132] (https://github.com/airbytehq/airbyte/pull/58132) | Fix vulnerability in dependencies. |
| 0.48.8 | 2025-03-11 | [\#55709](https://github.com/airbytehq/airbyte/pull/55709) | Filter unwanted tables in discover to prevent null table issues |
| 0.48.7 | 2025-01-26 | [\#51596](https://github.com/airbytehq/airbyte/pull/51596) | Make efficient table discovery during read |
| 0.48.6 | 2025-01-26 | [\#51596](https://github.com/airbytehq/airbyte/pull/51596) | Fix flaky source mssql tests |
Expand Down
1 change: 1 addition & 0 deletions airbyte-cdk/java/airbyte-cdk/core/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ dependencies {
api 'com.zaxxer:HikariCP:5.1.0'
api 'org.jooq:jooq:3.19.11'
api 'org.apache.commons:commons-csv:1.11.0'
api 'org.apache.mina:mina-core:2.0.27' // for fixing vulnerability of sshd-mina

implementation project(':airbyte-cdk:java:airbyte-cdk:airbyte-cdk-dependencies')

Expand Down
2 changes: 1 addition & 1 deletion airbyte-cdk/java/airbyte-cdk/core/src/main/resources/version.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
version=0.48.8
version=0.48.9
2 changes: 1 addition & 1 deletion airbyte-cdk/java/airbyte-cdk/dependencies/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ dependencies {
api 'org.slf4j:slf4j-api:2.0.16'
api 'io.github.oshai:kotlin-logging-jvm:7.0.0'
api 'org.jetbrains.kotlinx:kotlinx-coroutines-core:1.8.1'

api 'net.minidev:json-smart:2.5.2'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why adding this?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is to override the json smart library's version. json smart is another vulnerability and has been fixed in this version

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The vulnerable version is in base image?


implementation 'com.jayway.jsonpath:json-path:2.9.0'
implementation 'com.networknt:json-schema-validator:1.5.1'
Expand Down
2 changes: 1 addition & 1 deletion airbyte-integrations/connectors/source-mongodb-v2/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ plugins {
}

airbyteJavaConnector {
cdkVersionRequired = '0.45.1'
cdkVersionRequired = '0.48.9'
features = ['db-sources', 'datastore-mongo']
useLocalCdk = false
}
Expand Down
2 changes: 1 addition & 1 deletion airbyte-integrations/connectors/source-mongodb-v2/metadata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ data:
type: GSM
connectorType: source
definitionId: b2e713cd-cc36-4c0a-b5bd-b47cb8a0561e
dockerImageTag: 1.5.17
dockerImageTag: 1.5.18
dockerRepository: airbyte/source-mongodb-v2
documentationUrl: https://docs.airbyte.com/integrations/sources/mongodb-v2
githubIssueLabel: source-mongodb-v2
Expand Down
1 change: 1 addition & 0 deletions airbyte-integrations/connectors/source-mysql/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ airbyteBulkConnector {
}

dependencies {
api "com.google.protobuf:protobuf-java:4.27.5" // for fixing vulnerability of protobuf-java used by Debezium
implementation 'com.mysql:mysql-connector-j:9.1.0'
implementation 'io.debezium:debezium-connector-mysql'

Expand Down
2 changes: 1 addition & 1 deletion airbyte-integrations/connectors/source-mysql/metadata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ data:
connectorSubtype: database
connectorType: source
definitionId: 435bb9a5-7887-4809-aa58-28c27df0d7ad
dockerImageTag: 3.11.11
dockerImageTag: 3.11.12
dockerRepository: airbyte/source-mysql
documentationUrl: https://docs.airbyte.com/integrations/sources/mysql
githubIssueLabel: source-mysql
Expand Down
3 changes: 2 additions & 1 deletion airbyte-integrations/connectors/source-postgres/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ java {
}

airbyteJavaConnector {
cdkVersionRequired = '0.48.4'
cdkVersionRequired = '0.48.9'
features = ['db-sources', 'datastore-postgres']
useLocalCdk = false
}
Expand All @@ -23,6 +23,7 @@ application {
}

dependencies {
api "com.google.protobuf:protobuf-java:3.25.5" // for fixing vulnerability of protobuf-java used by Debezium
implementation 'commons-codec:commons-codec:1.16.0'
implementation 'io.debezium:debezium-embedded:3.0.1.Final'
implementation 'io.debezium:debezium-connector-postgres:3.0.1.Final'
Expand Down
2 changes: 1 addition & 1 deletion airbyte-integrations/connectors/source-postgres/metadata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ data:
connectorSubtype: database
connectorType: source
definitionId: decd338e-5647-4c0b-adf4-da0e75f5a750
dockerImageTag: 3.6.30
dockerImageTag: 3.6.31
dockerRepository: airbyte/source-postgres
documentationUrl: https://docs.airbyte.com/integrations/sources/postgres
githubIssueLabel: source-postgres
Expand Down
9 changes: 2 additions & 7 deletions ...ce-postgres/src/test/java/io/airbyte/integrations/source/postgres/PostgresSourceTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -293,13 +293,8 @@ void testUserDoesntHasPrivilegesToSelectTable() throws Exception {
return null;
});
final JsonNode anotherUserConfig = getConfig("test_user_3", "132");
final Set<AirbyteMessage> actualMessages =
MoreIterators.toSet(source().read(anotherUserConfig, CONFIGURED_CATALOG, null));
setEmittedAtToNull(actualMessages);
// expect 6 records, 4 state messages and 4 stream status messages.
assertEquals(14, actualMessages.size());
final var actualRecordMessages = filterRecords(actualMessages);
assertEquals(PRIVILEGE_TEST_CASE_EXPECTED_MESSAGES, actualRecordMessages);
final Throwable thrown = assertThrows(Exception.class, () -> MoreIterators.toSet(source().read(anotherUserConfig, CONFIGURED_CATALOG, null)));
assertNotNull(thrown.getMessage());
}

@Test
Expand Down
Loading
Loading