Skip to content

Conversation

benjsmi
Copy link
Contributor

@benjsmi benjsmi commented Oct 17, 2023

As per https://nvd.nist.gov/vuln/detail/CVE-2023-44387, Gradle v7.6.2 is vulnerable. Moves all incorporate wrappers to the latest version of Gradle in their properties spec such that they use the latest Gradle (on the 7.6.x branch) to run the build.

Related to #312 but not mentioned explicitly in that issue.

@benjsmi benjsmi requested a review from a team as a code owner October 17, 2023 21:28
@benjsmi
Copy link
Contributor Author

benjsmi commented Oct 18, 2023

Merged in other merged PR for org.json to this PR to avoid conflicts.

@benjsmi
Copy link
Contributor Author

benjsmi commented Oct 19, 2023

@bestbeforetoday -- do you mind reviewing this?

@benjsmi
Copy link
Contributor Author

benjsmi commented Oct 19, 2023

@bestbeforetoday Read up on the right way to upgrade Gradle Wrapper and have applied those changes to this PR now. Thanks for the tip!

Copy link
Member

@bestbeforetoday bestbeforetoday left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like you might have missed the Gradle wrapper upgrade in the examples/fabric-contract-example-gradle-kotlin directory. Also the commits all need a signoff statement (git commit --amend --signoff)

Signed-off-by: Ben Smith <benjsmi@us.ibm.com>
@sonarqubecloud
Copy link

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

@benjsmi
Copy link
Contributor Author

benjsmi commented Oct 20, 2023

@bestbeforetoday yeah I definitely ran the wrapper command in the Kotlin directory.

programsam@Bens-IBM-Laptop-2022 fabric-contract-example-gradle-kotlin % ./gradlew wrapper --gradle-version 7.6.3
Starting a Gradle Daemon (subsequent builds will be faster)

Deprecated Gradle features were used in this build, making it incompatible with Gradle 8.0.

You can use '--warning-mode all' to show the individual deprecation warnings and determine if they come from your own scripts or plugins.

See https://docs.gradle.org/7.6.3/userguide/command_line_interface.html#sec:command_line_warnings

BUILD SUCCESSFUL in 7s
1 actionable task: 1 up-to-date

Oddly enough, the JAR file in that directory does not/did not seem to need changing. Not sure why that is.

@bestbeforetoday bestbeforetoday merged commit 412447c into hyperledger:main Oct 20, 2023
@benjsmi benjsmi deleted the newer-gradle branch October 23, 2023 13:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants