Update ivy version to 2.5.2 (#619)

- Updates `org.apache.ivy:ivy` to version 2.5.2 to fix
CVE-2022-46751

- Adds 2 CVEs to trivyignore due to `debezium-supplier`
transitive dependencies.

(cherry picked from commit 6cc9cdde21)

.github/workflows/common.yml

@@ -48,19 +48,15 @@ jobs:
     if: ${{ inputs.enableSecurityScan && github.repository == 'spring-cloud/stream-applications' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - name: Run Trivy vulnerability scanner in repo mode
         uses: aquasecurity/trivy-action@master
         with:
           scan-type: 'fs'
           ignore-unfixed: true
-          format: 'sarif'
-          output: 'trivy-results.sarif'
           severity: 'CRITICAL,HIGH'
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
-        with:
-          sarif_file: 'trivy-results.sarif'
+          exit-code: 1
+          trivyignores: .trivyignore
       - name: 'Scanned'
         shell: bash
         run: echo "::info ::Scanned"
@@ -255,7 +251,7 @@ jobs:
           fail-on-empty: false
       - name: 'Upload: Test Reports'
         if: ${{ always() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: 'core-surefire-reports'
           path: 'stream-applications/**/target/surefire-reports'
@@ -373,7 +369,7 @@ jobs:
           fail-on-empty: false
       - name: 'Upload: Test Reports'
         if: ${{ always() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: '${{ matrix.app }}-surefire-reports'
           path: '**/target/surefire-reports'
@@ -471,7 +467,7 @@ jobs:
         run: ./build-app.sh . "applications/sink/${{ matrix.app }}"
       - name: 'Upload: Test Reports'
         if: ${{ always() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: '${{ matrix.app }}-surefire-reports'
           path: '**/target/surefire-reports'
@@ -610,7 +606,7 @@ jobs:
           fail-on-empty: false
       - name: 'Upload: Test Reports'
         if: ${{ always() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: '${{ matrix.app }}-surefire-reports'
           path: '**/target/surefire-reports'
@@ -764,7 +760,7 @@ jobs:
           fail-on-empty: false
       - name: 'Upload: Test Reports'
         if: ${{ always() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: '${{ matrix.app }}-surefire-reports'
           path: '**/target/surefire-reports'

.trivyignore

@@ -1,2 +1,17 @@
+################################
+## From debezium-supplier
+################################
+CVE-2023-1428
+CVE-2023-32731
+
+################################
+# Snakeyaml 1.3.3
+# SCDF usage has been mitigated.
+################################
 CVE-2022-1471
-CVE-2016-1000027
+
+################################
+# Spring Web 5.3.x
+# SCDF not affected.
+################################
+CVE-2016-1000027

applications/processor/groovy-processor/pom.xml

@@ -14,10 +14,6 @@
         <relativePath>../../stream-applications-core/pom.xml</relativePath>
     </parent>
 
-    <properties>
-        <apache-ivy.version>2.5.1</apache-ivy.version>
-    </properties>
-
     <dependencies>
 
         <dependency>

applications/processor/script-processor/pom.xml

@@ -17,7 +17,6 @@
     <properties>
         <jruby-complete.version>9.3.9.0</jruby-complete.version>
         <jython-standalone.version>2.7.3</jython-standalone.version>
-        <apache-ivy.version>2.5.1</apache-ivy.version>
         <graalvm.version>22.3.0</graalvm.version>
     </properties>
 

scan-jar.sh

@@ -4,8 +4,7 @@ SCDIR=$(realpath $SCDIR)
 if [[ "$1" != *"-sources.jar" ]] && [[ "$1" != *"-javadoc.jar" ]]; then
     if [ "$TRIVY_UPLOAD" == "true" ]; then
       echo "Scanning:$1"
-      echo "trivy rootfs --format sarif -o \"$1.sarif\" \"$1\""
-      trivy rootfs --format sarif -o "$1.sarif" "$1"
+      trivy rootfs --exit-code 1 --format sarif -o "$1.sarif" "$1"
       if [ -f "$1.sarif" ]; then
         if [ -f $SCDIR/runs.sarif ]; then
           echo "," >> "$SCDIR/runs.sarif"
@@ -15,7 +14,7 @@ if [[ "$1" != *"-sources.jar" ]] && [[ "$1" != *"-javadoc.jar" ]]; then
         echo "Could not find:$1.sarif"
       fi
     else
-      trivy rootfs -q "$1"
+      trivy rootfs --exit-code 1 -q "$1"
     fi
 else
   if [ "$TRIVY_UPLOAD" == "true" ]; then