add base dependency version to cve remediations for downstream runtime builds

Brendan Doyle · Brendan Doyle · commit 453e49882a84 · 2023-02-24T09:47:23.000-08:00
diff --git a/core/monitoring/user-events/build.gradle b/core/monitoring/user-events/build.gradle
@@ -45,7 +45,7 @@ dependencies {
 
     testImplementation "junit:junit:4.11"
     testImplementation "org.scalatest:scalatest_${gradle.scala.depVersion}:3.0.8"
-    testImplementation "io.github.embeddedkafka:embedded-kafka_${gradle.scala.depVersion}"
+    testImplementation "io.github.embeddedkafka:embedded-kafka_${gradle.scala.depVersion}:2.4.0"
     constraints {
         testImplementation("io.github.embeddedkafka:embedded-kafka_${gradle.scala.depVersion}:2.4.0")
         testImplementation('org.apache.avro:avro:1.11.1') {
diff --git a/core/standalone/build.gradle b/core/standalone/build.gradle
@@ -169,7 +169,7 @@ dependencies {
     implementation project(':tools:admin')
     implementation "org.rogach:scallop_${gradle.scala.depVersion}:3.3.2"
 
-    implementation "io.github.embeddedkafka:embedded-kafka_${gradle.scala.depVersion}"
+    implementation "io.github.embeddedkafka:embedded-kafka_${gradle.scala.depVersion}:2.4.0"
     constraints {
         implementation("io.github.embeddedkafka:embedded-kafka_${gradle.scala.depVersion}:2.4.0")
         implementation('org.apache.avro:avro:1.11.1') {
diff --git a/tests/build.gradle b/tests/build.gradle
@@ -232,14 +232,14 @@ dependencies {
     implementation ("org.apache.curator:curator-test:${gradle.curator.version}") {
         exclude group: 'log4j'
     }
-    implementation "com.atlassian.oai:swagger-request-validator-core"
+    implementation "com.atlassian.oai:swagger-request-validator-core:1.4.5"
     constraints {
         implementation("com.atlassian.oai:swagger-request-validator-core:1.4.5")
         implementation("org.slf4j:slf4j-ext:1.7.36") {
             because 'swagger-request-validator-core cannot be upgraded to 2.x where vuln is remediated'
         }
     }
-    implementation "io.github.embeddedkafka:embedded-kafka_${gradle.scala.depVersion}"
+    implementation "io.github.embeddedkafka:embedded-kafka_${gradle.scala.depVersion}:2.4.0"
     constraints {
         implementation("io.github.embeddedkafka:embedded-kafka_${gradle.scala.depVersion}:2.4.0")
         implementation('org.apache.avro:avro:1.11.1') {

Original file line number	Diff line number	Diff line change
`@@ -232,14 +232,14 @@ dependencies {`
`232`	`232`	`implementation ("org.apache.curator:curator-test:${gradle.curator.version}") {`
`233`	`233`	`exclude group: 'log4j'`
`234`	`234`	`}`
`235`		`- implementation "com.atlassian.oai:swagger-request-validator-core"`
	`235`	`+ implementation "com.atlassian.oai:swagger-request-validator-core:1.4.5"`
`236`	`236`	`constraints {`
`237`	`237`	`implementation("com.atlassian.oai:swagger-request-validator-core:1.4.5")`
`238`	`238`	`implementation("org.slf4j:slf4j-ext:1.7.36") {`
`239`	`239`	`because 'swagger-request-validator-core cannot be upgraded to 2.x where vuln is remediated'`
`240`	`240`	`}`
`241`	`241`	`}`
`242`		`- implementation "io.github.embeddedkafka:embedded-kafka_${gradle.scala.depVersion}"`
	`242`	`+ implementation "io.github.embeddedkafka:embedded-kafka_${gradle.scala.depVersion}:2.4.0"`
`243`	`243`	`constraints {`
`244`	`244`	`implementation("io.github.embeddedkafka:embedded-kafka_${gradle.scala.depVersion}:2.4.0")`
`245`	`245`	`implementation('org.apache.avro:avro:1.11.1') {`