[MOSIP-44772] fixed eSignet vulnerabilities #2060
Conversation
Signed-off-by: Md-Humair-KK <mdhumair.kankudti@gmail.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
💤 Files with no reviewable changes (1)
WalkthroughThis PR updates dependency versions across two modules: esignet-core's pom.xml bumps spring-kafka to 3.3.16 and postgresql to 42.7.11 (plus a whitespace tweak), and oidc-ui's package.json bumps axios to ^1.16.0. ChangesDependency updates
Estimated code review effort: 1 (Trivial) | ~3 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@oidc-ui/package.json`:
- Line 14: The dependency version in package-lock is out of sync with the axios
bump in package.json, so frozen installs still resolve the old 1.13.5 tarball.
Update oidc-ui/package-lock.json to reflect the new ^1.16.0 range by
regenerating the lockfile or adjusting the axios entry so the locked version and
resolved metadata match the package.json change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 62336ca6-7215-4425-a710-37e7133eb24f
📒 Files selected for processing (2)
esignet-core/pom.xmloidc-ui/package.json
Signed-off-by: Md-Humair-KK <mdhumair.kankudti@gmail.com>
Signed-off-by: Md-Humair-KK <mdhumair.kankudti@gmail.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@esignet-core/pom.xml`:
- Around line 48-51: The spring-kafka dependency in the pom is pinned to a
version that targets a newer Spring Boot/Spring Framework baseline than this
module uses. Update the dependency in the Maven config to stay on the
Boot-managed 3.2.x line, or if that version is required, align the parent Spring
Boot version accordingly; use the spring-kafka dependency declaration to locate
the change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 6f35a662-2308-4fd6-8bb3-f6618fb240b6
⛔ Files ignored due to path filters (1)
oidc-ui/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (2)
esignet-core/pom.xmlpom.xml
Signed-off-by: Md-Humair-KK <mdhumair.kankudti@gmail.com>
Signed-off-by: Md-Humair-KK <mdhumair.kankudti@gmail.com>
Signed-off-by: Md-Humair-KK <mdhumair.kankudti@gmail.com>
| <dependency> | ||
| <groupId>org.springframework.kafka</groupId> | ||
| <artifactId>spring-kafka</artifactId> | ||
| <version>3.1.2</version> |
There was a problem hiding this comment.
why is the version pinning removed here?
There was a problem hiding this comment.
It was redundant versioning as spring kafka with spring 3.2.3 will by default take 3.1.2 version.
Nothing as such specific to remove it.
3 participants
Updated postgres and axios versions...
Summary by CodeRabbit
Bug Fixes
Chores