various vulnerability fixes #8950
Conversation
Dockerfile.nfer
Outdated
| @@ -0,0 +1,40 @@ | |||
| # Use the specified base image | |||
| FROM hz-registry.nferx.com/ubuntu as builder | |||
There was a problem hiding this comment.
@vilay-nference Where is the dockerfile for this image? It is not immediately accessible, so we cannot verify its contents.
In general, we use base images provided directly from first-party sources (e.g. https://hub.docker.com/_/ubuntu).
Please change this to use a standard base image and then we can re-evaluate.
There was a problem hiding this comment.
This is used for internal purpose. I'll delete this file .. not required for gatk
| @@ -232,6 +239,12 @@ configurations { | |||
| } | |||
|
|
|||
| dependencies { | |||
| implementation('net.minidev:json-smart:2.4.9') { | |||
There was a problem hiding this comment.
Could you explain what these new dependencies are?
There was a problem hiding this comment.
This is used as transitive dependencies in one of the package. Overriding the newer version for the compatibles.
Dockerfile.nfer
Outdated
| @@ -0,0 +1,40 @@ | |||
| # Use the specified base image | |||
There was a problem hiding this comment.
Remove this third-party Dockerfile
There was a problem hiding this comment.
Yes. will remove this and update you
| exclude group: 'net.minidev', module: 'json-smart' | ||
| } | ||
| // Example dependencies | ||
| implementation 'biz.aQute.bnd:biz.aQute.bndlib:5.1.2' |
There was a problem hiding this comment.
Don't add new GATK dependencies here unless absolutely necessary
There was a problem hiding this comment.
Again dnsjava is used from hadoop client.
There was a problem hiding this comment.
@droazen . Let us know if any more modifications required
|
@vilay-nference Thank you for doing this work. It's nitpicky annoying stuff to figure out. I have one additional request. Instead of addding additional direct implementation dependencies, could we specify the transtive version requirements in a gradle constraints block? That will:
|
No description provided.