Merge pull request #114 from guardian/ash/VulnFixes

Ash/vuln fixes
guardian · Nov 17, 2023 · 51332cf · 51332cf
2 parents 705f02a + c9e27f7
commit 51332cf
Show file tree

Hide file tree

Showing 11 changed files with 21 additions and 14 deletions.
diff --git a/app/controllers/Application.scala b/app/controllers/Application.scala
@@ -16,7 +16,7 @@
 
 package controllers
 
-import akka.actor.ActorSystem
+import org.apache.pekko.actor.ActorSystem
 import com.madgag.scalagithub.model.RepoId
 import lib.{Bot, RepoSnapshot}
 import play.api.Logging

diff --git a/app/controllers/RepoAcceptListService.scala b/app/controllers/RepoAcceptListService.scala
@@ -1,7 +1,7 @@
 package controllers
 
-import akka.actor.ActorSystem
-import akka.stream.Materializer
+import org.apache.pekko.actor.ActorSystem
+import org.apache.pekko.stream.Materializer
 import com.madgag.github.Implicits._
 import com.madgag.scalagithub.GitHub
 import com.madgag.scalagithub.model.{Repo, RepoId}

diff --git a/app/lib/Delayer.scala b/app/lib/Delayer.scala
@@ -1,6 +1,6 @@
 package lib
 
-import akka.actor.ActorSystem
+import org.apache.pekko.actor.ActorSystem
 
 import java.util.concurrent.TimeUnit
 import scala.concurrent.ExecutionContext.Implicits.global

diff --git a/app/lib/Droid.scala b/app/lib/Droid.scala
@@ -1,6 +1,6 @@
 package lib
 
-import akka.stream.Materializer
+import org.apache.pekko.stream.Materializer
 import com.madgag.git._
 import com.madgag.scalagithub.GitHub
 import com.madgag.scalagithub.model.RepoId

diff --git a/app/lib/PRUpdater.scala b/app/lib/PRUpdater.scala
@@ -1,6 +1,6 @@
 package lib
 
-import akka.stream.Materializer
+import org.apache.pekko.stream.Materializer
 import com.madgag.scalagithub.GitHub
 import com.madgag.scalagithub.commands.CreateComment
 import com.madgag.scalagithub.model.{PullRequest, Repo}

diff --git a/app/lib/RepoSnapshot.scala b/app/lib/RepoSnapshot.scala
@@ -16,7 +16,7 @@
 
 package lib
 
-import akka.stream.Materializer
+import org.apache.pekko.stream.Materializer
 import com.madgag.git._
 import com.madgag.github.Implicits._
 import com.madgag.scala.collection.decorators._

diff --git a/app/lib/RepoUpdater.scala b/app/lib/RepoUpdater.scala
@@ -1,6 +1,6 @@
 package lib
 
-import akka.stream.Materializer
+import org.apache.pekko.stream.Materializer
 import com.madgag.github.Implicits.{RichFuture, RichSource}
 import com.madgag.scalagithub.GitHub
 import com.madgag.scalagithub.commands.CreateLabel

diff --git a/app/lib/ScanScheduler.scala b/app/lib/ScanScheduler.scala
@@ -1,6 +1,6 @@
 package lib
 
-import akka.actor.ActorSystem
+import org.apache.pekko.actor.ActorSystem
 
 import java.time.Instant
 import java.time.Instant.now
@@ -11,7 +11,7 @@ import com.madgag.scalagithub.model.RepoId
 import com.madgag.time.Implicits._
 import lib.labels.Seen
 import play.api.Logging
-import play.api.libs.concurrent.Akka
+import play.api.libs.concurrent.Pekko
 
 import java.util.concurrent.atomic.AtomicReference
 import scala.concurrent.ExecutionContext.Implicits.global

diff --git a/build.sbt b/build.sbt
@@ -32,12 +32,19 @@ libraryDependencies ++= Seq(
   "com.github.nscala-time" %% "nscala-time" % "2.32.0",
   "io.lemonlabs" %% "scala-uri" % "4.0.3",
   "com.typesafe.scala-logging" %% "scala-logging" % "3.9.5",
-  "com.madgag.play-git-hub" %% "core" % "5.10",
-  "com.madgag.play-git-hub" %% "testkit" % "5.10" % Test,
+  "com.madgag.play-git-hub" %% "core" % "6.0",
+  "com.madgag.play-git-hub" %% "testkit" % "6.0" % Test,
   "com.madgag.scala-git" %% "scala-git-test" % "4.6" % Test,
   "org.scalatestplus.play" %% "scalatestplus-play" % "5.1.0" % Test
 )
 
+// Overidden transient dependencies for Vulnerability fixes
+libraryDependencies ++= Seq(
+  // Introduced through org.webjars:bootstrap:3.4.1
+  // Fix available in next major bootstrap version - this will involve a lot of breaking changes however.
+  "org.webjars" % "jquery" % "3.6.4",
+)
+
 routesImport ++= Seq("com.madgag.scalagithub.model._","com.madgag.playgithub.Binders._")
 
 Compile/doc/sources := Seq.empty

diff --git a/project/build.properties b/project/build.properties
@@ -1 +1 @@
-sbt.version=1.9.3
+sbt.version=1.9.7
diff --git a/project/plugins.sbt b/project/plugins.sbt
@@ -1,4 +1,4 @@
-addSbtPlugin("com.typesafe.play" % "sbt-plugin" % "2.8.19")
+addSbtPlugin("org.playframework" % "sbt-plugin" % "3.0.0")
 
 addSbtPlugin("com.eed3si9n" % "sbt-buildinfo" % "0.11.0")