From 866ac973c053c2f16a4baccc773f72f958ae3c98 Mon Sep 17 00:00:00 2001 From: Julian Ladisch Date: Thu, 16 Apr 2026 19:20:21 +0200 Subject: [PATCH 1/2] =?UTF-8?q?EDGCOMMON-97:=20Update=20dependencies=20for?= =?UTF-8?q?=20Trillium=20(Vertx,=20log4j,=20awssdk,=20=E2=80=A6)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This fixes multiple security vulnerabilities: * https://app.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-15365924 * https://app.snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 * https://app.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-15907550 * https://www.cve.org/CVERecord?id=CVE-2025-58056 * https://www.cve.org/CVERecord?id=CVE-2026-33870 * https://www.cve.org/CVERecord?id=CVE-2026-33871 * https://www.cve.org/CVERecord?id=CVE-2025-67735 * https://www.cve.org/CVERecord?id=CVE-2025-68161 * https://www.cve.org/CVERecord?id=CVE-2026-34477 * https://www.cve.org/CVERecord?id=CVE-2026-34480 --- pom.xml | 61 +++++++++++++------ src/assembly/assembly.xml | 1 + .../security/VaultStoreContainerTest.java | 43 +++++++------ 3 files changed, 69 insertions(+), 36 deletions(-) diff --git a/pom.xml b/pom.xml index a7b457e..b946f6a 100644 --- a/pom.xml +++ b/pom.xml @@ -30,8 +30,8 @@ UTF-8 - 2.1.0 - 4.0.0 + 2.1.2 + 4.0.1 @@ -39,21 +39,28 @@ org.apache.logging.log4j log4j-bom - 2.25.1 + 2.25.4 pom import io.vertx vertx-stack-depchain - 5.0.3 + 5.0.10 + pom + import + + + org.junit + junit-bom + 6.0.3 pom import org.testcontainers testcontainers-bom - 1.21.3 + 2.0.4 pom import @@ -65,18 +72,38 @@ nl.jqno.equalsverifier equalsverifier - 3.19.1 + 4.4.2 test io.rest-assured rest-assured - 5.5.6 + 5.5.7 + test + + + org.junit.jupiter + junit-jupiter + test + + + org.junit.vintage + junit-vintage-engine test org.testcontainers - vault + testcontainers-junit-jupiter + test + + + org.testcontainers + testcontainers-vault + test + + + io.vertx + vertx-junit5 test @@ -88,7 +115,7 @@ org.mockito mockito-core - 5.19.0 + 5.23.0 test @@ -148,7 +175,7 @@ software.amazon.awssdk ssm - 2.32.29 + 2.42.34 org.folio @@ -174,7 +201,7 @@ io.github.jopenlibs vault-java-driver - 6.2.0 + 6.2.1 @@ -199,7 +226,7 @@ Java 21 --> maven-compiler-plugin - 3.14.0 + 3.15.0 21 @@ -208,7 +235,7 @@ org.apache.maven.plugins maven-release-plugin - 3.1.1 + 3.3.1 clean verify v@{project.version} @@ -220,12 +247,12 @@ org.apache.maven.plugins maven-surefire-plugin - 3.5.2 + 3.5.5 maven-assembly-plugin - 3.7.1 + 3.8.0 package @@ -250,7 +277,7 @@ maven-source-plugin - 3.3.1 + 3.4.0 attach-sources @@ -264,7 +291,7 @@ maven-javadoc-plugin - 3.11.2 + 3.12.0 attach-javadocs diff --git a/src/assembly/assembly.xml b/src/assembly/assembly.xml index 5098929..093022d 100644 --- a/src/assembly/assembly.xml +++ b/src/assembly/assembly.xml @@ -24,6 +24,7 @@ args4j:args4j io.vertx:vertx-core + io.vertx:vertx-core-logging io.netty:netty-buffer com.fasterxml.jackson.core:jackson-core com.fasterxml.jackson.core:jackson-databind diff --git a/src/test/java/org/folio/edge/core/security/VaultStoreContainerTest.java b/src/test/java/org/folio/edge/core/security/VaultStoreContainerTest.java index 9cf26dd..d178296 100644 --- a/src/test/java/org/folio/edge/core/security/VaultStoreContainerTest.java +++ b/src/test/java/org/folio/edge/core/security/VaultStoreContainerTest.java @@ -6,34 +6,33 @@ import io.vertx.core.Vertx; import io.vertx.ext.unit.TestContext; -import io.vertx.ext.unit.junit.VertxUnitRunner; +import io.vertx.junit5.VertxExtension; +import io.vertx.junit5.VertxTestContext; import java.util.Properties; import org.folio.edge.core.security.SecureStore.NotFoundException; -import org.junit.BeforeClass; -import org.junit.ClassRule; -import org.junit.Test; -import org.junit.runner.RunWith; +import org.junit.jupiter.api.BeforeAll; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.ExtendWith; +import org.testcontainers.junit.jupiter.Container; +import org.testcontainers.junit.jupiter.Testcontainers; import org.testcontainers.vault.VaultContainer; -@RunWith(VertxUnitRunner.class) +@Testcontainers +@ExtendWith(VertxExtension.class) public class VaultStoreContainerTest { - @ClassRule - public static VaultContainer vaultContainer = new VaultContainer<>("vault:1.10.3") + @Container + public static VaultContainer vaultContainer = new VaultContainer<>("hashicorp/vault:1.21") .withVaultToken("bee") - .withSecretInVault("secret/diku", "diku_admin=password123"); + .withInitCommand("kv put secret/diku diku_admin=password123"); private static Properties properties = new Properties(); private static Vertx vertx = Vertx.vertx(); - @BeforeClass + @BeforeAll public static void beforeClass() { vaultContainer.followOutput(out -> System.err.println(out.getUtf8String())); properties.setProperty("token", "bee"); - properties.setProperty("address", "http://" + getHostAndPort()); - } - - private static String getHostAndPort() { - return vaultContainer.getHost() + ":" + vaultContainer.getMappedPort(8200); + properties.setProperty("address", vaultContainer.getHttpHostAddress()); } @Test @@ -42,15 +41,21 @@ public void get() throws Throwable { } @Test - public void getSucceededFuture(TestContext context) { + public void getSucceededFuture(VertxTestContext vtc) { new VaultStore(properties).get(vertx, "secret", "diku", "diku_admin") - .onComplete(context.asyncAssertSuccess(value -> assertThat(value, is("password123")))); + .onComplete(vtc.succeeding(value -> { + assertThat(value, is("password123")); + vtc.completeNow(); + })); } @Test - public void getFailedFuture(TestContext context) { + public void getFailedFuture(VertxTestContext vtc) { new VaultStore(properties).get(vertx, "secret", "diku", "foo") - .onComplete(context.asyncAssertFailure(e -> assertThat(e, is(instanceOf(NotFoundException.class))))); + .onComplete(vtc.failing(e -> { + assertThat(e, is(instanceOf(NotFoundException.class))); + vtc.completeNow(); + })); } // TODO Add test coverage for SSL/TLS configuration From 9c97460e240786151ae2411ac001f808ab8f113f Mon Sep 17 00:00:00 2001 From: Julian Ladisch Date: Fri, 17 Apr 2026 12:03:13 +0200 Subject: [PATCH 2/2] remove unused 'import' and 'public' statements --- .../edge/core/security/VaultStoreContainerTest.java | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/src/test/java/org/folio/edge/core/security/VaultStoreContainerTest.java b/src/test/java/org/folio/edge/core/security/VaultStoreContainerTest.java index d178296..2b95a92 100644 --- a/src/test/java/org/folio/edge/core/security/VaultStoreContainerTest.java +++ b/src/test/java/org/folio/edge/core/security/VaultStoreContainerTest.java @@ -5,7 +5,6 @@ import static org.hamcrest.Matchers.is; import io.vertx.core.Vertx; -import io.vertx.ext.unit.TestContext; import io.vertx.junit5.VertxExtension; import io.vertx.junit5.VertxTestContext; import java.util.Properties; @@ -19,7 +18,7 @@ @Testcontainers @ExtendWith(VertxExtension.class) -public class VaultStoreContainerTest { +class VaultStoreContainerTest { @Container public static VaultContainer vaultContainer = new VaultContainer<>("hashicorp/vault:1.21") @@ -29,19 +28,19 @@ public class VaultStoreContainerTest { private static Vertx vertx = Vertx.vertx(); @BeforeAll - public static void beforeClass() { + static void beforeClass() { vaultContainer.followOutput(out -> System.err.println(out.getUtf8String())); properties.setProperty("token", "bee"); properties.setProperty("address", vaultContainer.getHttpHostAddress()); } @Test - public void get() throws Throwable { + void get() throws Throwable { assertThat(new VaultStore(properties).get("secret", "diku", "diku_admin"), is("password123")); } @Test - public void getSucceededFuture(VertxTestContext vtc) { + void getSucceededFuture(VertxTestContext vtc) { new VaultStore(properties).get(vertx, "secret", "diku", "diku_admin") .onComplete(vtc.succeeding(value -> { assertThat(value, is("password123")); @@ -50,7 +49,7 @@ public void getSucceededFuture(VertxTestContext vtc) { } @Test - public void getFailedFuture(VertxTestContext vtc) { + void getFailedFuture(VertxTestContext vtc) { new VaultStore(properties).get(vertx, "secret", "diku", "foo") .onComplete(vtc.failing(e -> { assertThat(e, is(instanceOf(NotFoundException.class)));