Ed-Fi-Alliance-OSS · CSR2017 · Jan 12, 2024 · Jan 9, 2024 · Jan 10, 2024 · Jan 10, 2024
@@ -87,6 +87,7 @@ jobs:
           command: cves
           image: local://${{ matrix.dockerfile.name }}
           sarif-file: sarif-${{ matrix.dockerfile.name }}.output.json
+          only-severities: critical,high,medium,low
           summary: true
 
       - name: Upload SARIF result

diff --git a/Application/EdFi.Ods.AdminApi/E2E Tests/gh-action-setup/.automation.env b/Application/EdFi.Ods.AdminApi/E2E Tests/gh-action-setup/.automation.env
@@ -7,7 +7,7 @@ LOGS_FOLDER=/tmp/logs
 # For Authentication
 AUTHORITY=http://localhost/${ADMIN_API_VIRTUAL_NAME}
 ISSUER_URL=https://localhost/${ADMIN_API_VIRTUAL_NAME}
-SIGNING_KEY=qhkaKdYaomlkwUKcsAw22w==
+SIGNING_KEY=TDMyNH0lJmo7aDRnNXYoSmAwSXQpV09nbitHSWJTKn0=
 
 # For Postgres only
 POSTGRES_USER=postgres

diff --git a/Application/EdFi.Ods.AdminApi/EdFi.Ods.AdminApi.csproj b/Application/EdFi.Ods.AdminApi/EdFi.Ods.AdminApi.csproj
@@ -34,7 +34,7 @@
     <PackageReference Include="FluentValidation" Version="11.5.2" />
     <PackageReference Include="FluentValidation.AspNetCore" Version="11.3.0" />
     <PackageReference Include="log4net" Version="2.0.15" />
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="5.0.16" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="6.0.26" />
     <PackageReference Include="Microsoft.EntityFrameworkCore" Version="6.0.16" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="6.0.16" />
     <PackageReference Include="Microsoft.Extensions.Logging.Log4Net.AspNetCore" Version="6.1.0" />

diff --git a/Application/EdFi.Ods.AdminApi/env.example.dev b/Application/EdFi.Ods.AdminApi/env.example.dev
@@ -5,7 +5,7 @@ ADMIN_API_VIRTUAL_NAME=<virtual name for the Admin API endpoint>
 # For Authentication
 AUTHORITY=<Authentication Authority Appsetting Eg. https://localhost:443>
 ISSUER_URL=<Authentication IssuerUrl Appsetting Eg. https://localhost:8001>
-SIGNING_KEY=<Authentication Signing Key (Symmetric Security Key) for OpenIddict>
+SIGNING_KEY=<Create a new string as symmetric encryption key (base64-encoded 256-bit key)>
 
 # For Postgres only
 POSTGRES_USER=<default postgres database user>

diff --git a/Docker/Compose/pgsql/compose-build-dev.yml b/Docker/Compose/pgsql/compose-build-dev.yml
@@ -7,8 +7,8 @@ version: "3.8"
 
 services:
   db-ods:
-    # 2.3.1 corresponds to ODS/API 6.1
-    image: edfialliance/ods-api-db-ods:v2.3.1
+    # 2.3.2 corresponds to ODS/API 6.1
+    image: edfialliance/ods-api-db-ods:v2.3.2
     environment:
       POSTGRES_USER: "${POSTGRES_USER}"
       POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"
@@ -38,7 +38,7 @@ services:
       - api
 
   api:
-    image: edfialliance/ods-api-web-api:v2.3.1
+    image: edfialliance/ods-api-web-api:v2.3.2
     environment:
       POSTGRES_USER: "${POSTGRES_USER}"
       POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"

diff --git a/Docker/Compose/pgsql/env.example b/Docker/Compose/pgsql/env.example
@@ -5,7 +5,7 @@ ODS_VIRTUAL_NAME=webapi
 # For Authentication
 AUTHORITY=http://localhost/${ADMIN_API_VIRTUAL_NAME}
 ISSUER_URL=https://localhost/${ADMIN_API_VIRTUAL_NAME}
-SIGNING_KEY=<Create a new string as symmetric encryption key>
+SIGNING_KEY=<Create a new string as symmetric encryption key (base64-encoded 256-bit key)>
 
 # For Postgres only
 POSTGRES_USER=postgres

diff --git a/Docker/Dockerfile b/Docker/Dockerfile
@@ -4,7 +4,7 @@
 # See the LICENSE and NOTICES files in the project root for more information.
 
 #tag 6.0-alpine
-FROM mcr.microsoft.com/dotnet/aspnet@sha256:201cedd60cb295b2ebea7184561a45c5c0ee337e37300ea0f25cff5a2c762538
+FROM mcr.microsoft.com/dotnet/aspnet@sha256:2647c10e72a83a6e3136aa47de1bb188047006b217982ddd332344bbbf10593f
 LABEL maintainer="Ed-Fi Alliance, LLC and Contributors <techsupport@ed-fi.org>"
 ARG VERSION=latest
 ARG DB=pgsql
@@ -19,7 +19,7 @@ COPY Settings/"${DB}"/appsettings.template.json /app/appsettings.template.json
 COPY Settings/"${DB}"/run.sh /app/run.sh
 COPY Settings/"${DB}"/log4net.config /app/log4net.txt
 
-RUN apk --no-cache add curl=~8 unzip=~6 dos2unix=~7 bash=~5 gettext=~0 jq=~1 icu=~72 && \
+RUN apk --no-cache add curl=~8 unzip=~6 dos2unix=~7 bash=~5 gettext=~0 jq=~1 icu=~73 && \
     if [ "$DB" = "pgsql" ]; then apk --no-cache add postgresql13-client=~13; fi && \
     wget -nv -O /app/AdminApi.zip https://pkgs.dev.azure.com/ed-fi-alliance/Ed-Fi-Alliance-OSS/_apis/packaging/feeds/EdFi/nuget/packages/EdFi.Suite3.ODS.AdminApi/versions/${VERSION}/content && \
     unzip /app/AdminApi.zip AdminApi/* -d /app/ && \

diff --git a/Docker/Settings/DB-Admin/pgsql/Dockerfile b/Docker/Settings/DB-Admin/pgsql/Dockerfile
@@ -3,7 +3,7 @@
 # The Ed-Fi Alliance licenses this file to you under the Apache License, Version 2.0.
 # See the LICENSE and NOTICES files in the project root for more information.
 
-FROM edfialliance/ods-api-db-admin:v2.3.1
+FROM edfialliance/ods-api-db-admin:v2.3.2
 LABEL maintainer="Ed-Fi Alliance, LLC and Contributors <techsupport@ed-fi.org>"
 
 ENV POSTGRES_USER=${POSTGRES_USER}

diff --git a/Docker/Settings/mssql/env.example b/Docker/Settings/mssql/env.example
@@ -6,7 +6,7 @@ ADMIN_API_VIRTUAL_NAME=<virtual name for the Admin API endpoint>
 # For Authentication
 AUTHORITY=<Authentication Authority Appsetting Eg. https://localhost:443>
 ISSUER_URL=<Authentication IssuerUrl Appsetting Eg. https://localhost:8001>
-SIGNING_KEY=<Authentication Signing Key (Symmetric Security Key) for OpenIddict>
+SIGNING_KEY=<Create a new string as symmetric encryption key (base64-encoded 256-bit key)>
 
 # For SQL Server only
 SQLSERVER_ODS_DATASOURCE=<DNS or IP Address of the SQL Server Instance, i.e. sql.somedns.org or 10.1.5.9,1433

diff --git a/Docker/Settings/pgsql/env.example b/Docker/Settings/pgsql/env.example
@@ -5,7 +5,7 @@ ADMIN_API_VIRTUAL_NAME=<virtual name for the Admin API endpoint>
 # For Authentication
 AUTHORITY=<Authentication Authority Appsetting Eg. https://localhost:443>
 ISSUER_URL=<Authentication IssuerUrl Appsetting Eg. https://localhost:8001>
-SIGNING_KEY=<Authentication Signing Key (Symmetric Security Key) for OpenIddict>
+SIGNING_KEY=<Create a new string as symmetric encryption key (base64-encoded 256-bit key)>
 
 # For Postgres only
 POSTGRES_USER=<default postgres database user>

diff --git a/Docker/dbadmin.Dockerfile b/Docker/dbadmin.Dockerfile
@@ -3,7 +3,7 @@
 # The Ed-Fi Alliance licenses this file to you under the Apache License, Version 2.0.
 # See the LICENSE and NOTICES files in the project root for more information.
 
-FROM edfialliance/ods-api-db-admin:v2.3.1
+FROM edfialliance/ods-api-db-admin:v2.3.2
 LABEL maintainer="Ed-Fi Alliance, LLC and Contributors <techsupport@ed-fi.org>"
 
 ENV POSTGRES_USER=${POSTGRES_USER}

diff --git a/Docker/dev.Dockerfile b/Docker/dev.Dockerfile
@@ -8,7 +8,7 @@
 
 
 #tag sdk:6.0-alpine
-FROM mcr.microsoft.com/dotnet/sdk@sha256:c1a73b72c02e7b837e9a93030d545bc4181193e1bab1033364ed2d00986d78ff AS build
+FROM mcr.microsoft.com/dotnet/sdk@sha256:0951e1b2a5dd42ddb157446b25b318d2acfb21aa246c84af51d2dc7af77f6b73 AS build
 WORKDIR /source
 
 COPY Application/NuGet.Config EdFi.Ods.AdminApi/
@@ -21,7 +21,7 @@ FROM build AS publish
 RUN dotnet publish -c Release /p:EnvironmentName=Production --no-build -o /app/EdFi.Ods.AdminApi
 
 #tag aspnet:6.0-alpine
-FROM mcr.microsoft.com/dotnet/aspnet@sha256:201cedd60cb295b2ebea7184561a45c5c0ee337e37300ea0f25cff5a2c762538
+FROM mcr.microsoft.com/dotnet/aspnet@sha256:2647c10e72a83a6e3136aa47de1bb188047006b217982ddd332344bbbf10593f
 LABEL maintainer="Ed-Fi Alliance, LLC and Contributors <techsupport@ed-fi.org>"
 # Alpine image does not contain Globalization Cultures library so we need to install ICU library to get for LINQ expression to work
 # Disable the globaliztion invariant mode (set in base image)
@@ -34,7 +34,7 @@ COPY Settings/dev/log4net.config /app/log4net.txt
 WORKDIR /app
 COPY --from=publish /app/EdFi.Ods.AdminApi .
 
-RUN apk --no-cache add curl=~8 dos2unix=~7 bash=~5 gettext=~0 icu=~72 && \
+RUN apk --no-cache add curl=~8 dos2unix=~7 bash=~5 gettext=~0 icu=~73 && \
     cp /app/log4net.txt /app/log4net.config && \
     dos2unix /app/*.json && \
     dos2unix /app/*.sh && \