Upgrade 3rd Party Dependencies for APIM, SI, SI Tooling, MI and MI Dashboard for 4.2.0 Release

[npamudika]

Problem

Third party dependencies might contain security vulnerabilities and have some missing fixes in the older versions.

Solution

Upgrade third party dependencies to the latest possible version.

Affected Component

APIM, SI, SI Tooling, MI, MI Dashboard

Version

4.2.0

[npamudika]

Sub Tasks -

• Configure environments for pre-release security scans - Configure environments for pre-release security scans #1206
• Analyze reports generated from security scans against Alpha packs for APIM, SI, SI Tooling, MI, and MI Dashboard
  • https://github.com/wso2-enterprise/wso2-apim-internal/issues/1686
  • https://github.com/wso2-enterprise/wso2-apim-internal/issues/1687
  • https://github.com/wso2-enterprise/wso2-apim-internal/issues/1688
  • https://github.com/wso2-enterprise/wso2-apim-internal/issues/1786
  • https://github.com/wso2-enterprise/wso2-apim-internal/issues/1785
  • https://github.com/wso2-enterprise/wso2-apim-internal/issues/1784
• Run trivy scan for Alpha packs - Run Trivy Scans for APIM, SI, MI and MI Dashboard 4.2.0-Alpha #1220
• Analyze trivy scan reports - [4.2.0][Dependency Upgrade] Analyze Trivy scan reports #1302
• Run Fossa scans against APIM, SI, and MI Alpha packs
• Analyze Fossa scan reports
  • https://github.com/wso2-enterprise/wso2-apim-internal/issues/1529
  • https://github.com/wso2-enterprise/wso2-apim-internal/issues/1530
  • https://github.com/wso2-enterprise/wso2-apim-internal/issues/1531
• Upgrade general 3rd party dependencies in APIM
  • [4.2.0][Dependency Upgrade] Tomcat Version Upgrade #1207
  • [4.2.0][Dependency Upgrade] Upgrade Netty Version in APIM 4.2.0 #1221
  • [4.2.0][Dependency Upgrade] Jackson Version Upgrade #1223
  • [4.2.0][Dependency Upgrade] CXF Version Upgrade #1227
• Upgrade 3rd party dependencies reported from Fossa and pre-release security scans (APIM)
  • [4.2.0][Dependency Upgrade] Swagger Parser Upgrade #1208
  • [4.2.0][Dependency Upgrade] Kotlin-Stdlib Version Upgrade #1225
  • [4.2.0][Dependency Upgrade] Snakeyaml Version Upgrade #1222
  • [4.2.0][Dependency Upgrade] Libthrift Version Upgrade #1229
  • [4.2.0][Dependency Upgrade] Apache POI Version Upgrade #1230
  • [4.2.0][Dependency Upgrade] H2 version Upgrade #1233
  • [4.2.0][Dependency Upgrade] nimbus-jose-jwt version upgrade #1234
  • [4.2.0][Dependency Upgrade] plexus-utils version upgrade #1264
  • [4.2.0][Dependency Upgrade] commons-io version upgrade #1265
  • [4.2.0][Dependency Upgrade] jsoup version upgrade #1266
  • [4.2.0][Dependency Upgrade] pax-logging-log4j2 version upgrade #1267
  • [4.2.0][Dependency Upgrade] Jettison version upgrade #1342
  • [4.2.0][Dependency Upgrade] json-smart version upgrade #1297
  • [4.2.0][Dependency Upgrade] gson Version Upgrade #1310
  • [4.2.0][Dependency Upgrade] org.apache.poi Version Upgrade #1315
• Upgrade 3rd party dependencies reported from Fossa and pre-release security scans (SI)
  • [4.2.0][Dependency Upgrade] quartz version upgrade #1235
  • [4.2.0][Dependency Upgrade] commons-io version upgrade #1236
  • [4.2.0][Dependency Upgrade] gson version upgrade #1237
  • [4.2.0][Dependency Upgrade] H2 version upgrade #1238
  • [4.2.0][Dependency Upgrade] commons-text version upgrade #1240
  • [4.2.0][Dependency Upgrade]libthrift version upgrade #1241
  • [4.2.0][Dependency Upgrade]Jackson-databind version upgrade #1242
  • [4.2.0][Dependency Upgrade] Netty Version Upgrade #1243
• Upgrade 3rd party dependencies reported from Fossa and pre-release security scans (MI)
  • [4.2.0][Dependency Upgrade] Netty version upgrade #1247
  • [4.2.0][Dependency Upgrade] Jackson-databind version upgrade #1248
  • [4.2.0][Dependency Upgrade] Commons-net version upgrade #1251
  • [4.2.0][Dependency Upgrade] libthrift version upgrade #1252
  • [4.2.0][Dependency Upgrade] Kotlin version upgrade #1253
  • [4.2.0][Dependency Upgrade] snakeyaml version upgrade #1254
  • [4.2.0][Dependency Upgrade] tomcat version upgrade #1255
  • [4.2.0][Dependency Upgrade] poi version upgrade #1256
  • [4.2.0][Dependency Upgrade] odata-server version upgrade #1259
  • [4.2.0][Dependency Upgrade] jsoup version upgrade #1350
• Upgrade 3rd party dependencies reported from Fossa and pre-release security scans (MI Dashboard)
  • [4.2.0][Dependency Upgrade] jackson-databind version upgrade #1260
  • [4.2.0][Dependency Upgrade] jsoup version upgrade #1261
  • [4.2.0][Dependency Upgrade] jetty-core version upgrade #1345
• Fix other issues reported from pre-release security scans (If applicable)
• Upgrade required dependencies in kernel for the reported vulnerabilities in pre-release security scans - Upgrade required dependencies in kernel upon pre-release security scans #1246

[npamudika]

Tracking Sheet - https://docs.google.com/spreadsheets/d/1PJ0S0uqEa_atmmRq7OZANNvpqro4g6QBTf5FCTqPWJQ/edit#gid=0

[npamudika]

Closing as all the sub tasks are completed.