COH-29939 - Address the Sockshop Spring dependency issue identified b…

…y GitHub Compliance Audit Service
oracle · May 7, 2024 · 193bdcc · 193bdcc
1 parent 1b242f8
commit 193bdcc
Show file tree

Hide file tree

Showing 7 changed files with 39 additions and 0 deletions.
diff --git a/carts/pom.xml b/carts/pom.xml
@@ -83,6 +83,13 @@
             <artifactId>opentracing-spring-jaeger-cloud-starter</artifactId>
             <version>${version.lib.opentracing-spring-jaeger}</version>
         </dependency>
+        <!-- Force this transitive dependency -->
+        <dependency>
+            <groupId>io.jaegertracing</groupId>
+            <artifactId>jaeger-thrift</artifactId>
+            <version>${version.lib.jaeger-client}</version>
+        </dependency>
+
 
         <!-- force this version of dependency -->
         <dependency>

diff --git a/catalog/pom.xml b/catalog/pom.xml
@@ -82,6 +82,12 @@
             <artifactId>opentracing-spring-jaeger-cloud-starter</artifactId>
             <version>${version.lib.opentracing-spring-jaeger}</version>
         </dependency>
+        <!-- Force this transitive dependency -->
+        <dependency>
+            <groupId>io.jaegertracing</groupId>
+            <artifactId>jaeger-thrift</artifactId>
+            <version>${version.lib.jaeger-client}</version>
+        </dependency>
 
         <!-- force this version of dependency -->
         <dependency>

diff --git a/orders/pom.xml b/orders/pom.xml
@@ -91,6 +91,12 @@
             <artifactId>opentracing-spring-jaeger-cloud-starter</artifactId>
             <version>${version.lib.opentracing-spring-jaeger}</version>
         </dependency>
+        <!-- Force this transitive dependency -->
+        <dependency>
+            <groupId>io.jaegertracing</groupId>
+            <artifactId>jaeger-thrift</artifactId>
+            <version>${version.lib.jaeger-client}</version>
+        </dependency>
 
         <!-- force this version of dependency -->
         <dependency>

diff --git a/payment/pom.xml b/payment/pom.xml
@@ -82,6 +82,13 @@
             <artifactId>opentracing-spring-jaeger-cloud-starter</artifactId>
             <version>${version.lib.opentracing-spring-jaeger}</version>
         </dependency>
+        <!-- Force this transitive dependency -->
+        <dependency>
+            <groupId>io.jaegertracing</groupId>
+            <artifactId>jaeger-thrift</artifactId>
+            <version>${version.lib.jaeger-client}</version>
+        </dependency>
+
 
         <dependency>
             <groupId>org.apache.httpcomponents.client5</groupId>

diff --git a/pom.xml b/pom.xml
@@ -44,6 +44,7 @@
         <version.lib.springframework>6.1.6</version.lib.springframework>
         <version.lib.opentracing-spring-jaeger>3.3.1</version.lib.opentracing-spring-jaeger>
         <version.lib.jackson>2.16.2</version.lib.jackson>
+        <version.lib.jaeger-client>1.8.1</version.lib.jaeger-client>
 
         <version.plugin.dependency-check-maven>9.1.0</version.plugin.dependency-check-maven>
         <version.plugin.jib>3.4.2</version.plugin.jib>

diff --git a/shipping/pom.xml b/shipping/pom.xml
@@ -82,6 +82,12 @@
             <artifactId>opentracing-spring-jaeger-cloud-starter</artifactId>
             <version>${version.lib.opentracing-spring-jaeger}</version>
         </dependency>
+        <!-- Force this transitive dependency -->
+        <dependency>
+            <groupId>io.jaegertracing</groupId>
+            <artifactId>jaeger-thrift</artifactId>
+            <version>${version.lib.jaeger-client}</version>
+        </dependency>
 
         <!-- force this version of dependency -->
         <dependency>

diff --git a/users/pom.xml b/users/pom.xml
@@ -104,6 +104,12 @@
 			<artifactId>opentracing-spring-jaeger-cloud-starter</artifactId>
 			<version>${version.lib.opentracing-spring-jaeger}</version>
 		</dependency>
+		<!-- Force this transitive dependency -->
+		<dependency>
+			<groupId>io.jaegertracing</groupId>
+			<artifactId>jaeger-thrift</artifactId>
+			<version>${version.lib.jaeger-client}</version>
+		</dependency>
 
 		<!-- -->
 		<dependency>