Merge pull request #134 from yetanalytics/jetty-http2-common-fix

Pedestal CVE updates
yetanalytics · Feb 29, 2024 · ed9c3e0 · ed9c3e0
2 parents 9fe286b + 476cf88
commit ed9c3e0
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 4 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Change Log
 
+## [0.4.2] - 2024-02-29
+- Update Pedestal dependency to 0.6.3.
+- Update Jetty http2-server dependency to 9.4.54 to address CVEs.
+
 ## [0.4.1] - 2024-01-25
 - Fix a number of bugs associated with Statement generation:
   - Fix places where `:definition` was used when `:activityDefinition` was supposed to be used in the code, causing Activities not to be associated with their respective Activity Types.

diff --git a/Makefile b/Makefile
@@ -2,7 +2,7 @@
 
 GROUP_ID ?= com.yetanalytics
 ARTIFACT_ID ?= datasim
-VERSION ?= 0.4.1
+VERSION ?= 0.4.2
 
 clean:
 	rm -rf target

diff --git a/README.md b/README.md
@@ -15,7 +15,7 @@ DATASIM is funded by the Advanced Distributed Learning Initiative at US DoD.
 To use the core DATASIM library in your project, use the following dependency in your `deps.edn` file:
 
 ```clojure
-com.yetanalytics/datasim {:mvn/version "0.4.1"}
+com.yetanalytics/datasim {:mvn/version "0.4.2"}
 ```
 
 If you wish to install DATASIM as an application with features such as CLI or the webserver, perform the following steps:

diff --git a/deps.edn b/deps.edn
@@ -32,8 +32,10 @@
   :run-cli  {:main-opts ["-m" "com.yetanalytics.datasim.cli"]}
   :server   {:extra-paths ["src/server"]
              :extra-deps
-             {io.pedestal/pedestal.jetty   {:mvn/version "0.6.2"}
-              io.pedestal/pedestal.service {:mvn/version "0.6.2"}
+             {io.pedestal/pedestal.jetty   {:mvn/version "0.6.3"
+                                            :exclusions  [org.eclipse.jetty.http2/http2-server]}
+              io.pedestal/pedestal.service {:mvn/version "0.6.3"}
+              org.eclipse.jetty.http2/http2-server {:mvn/version "9.4.54.v20240208"}
               org.slf4j/slf4j-simple       {:mvn/version "1.7.28"}
               clj-http/clj-http            {:mvn/version "3.12.3"}
               environ/environ              {:mvn/version "1.1.0"}