Skip to content
This repository was archived by the owner on Jun 2, 2025. It is now read-only.

Commit dfac008

Browse files
claytonparnellclaytonparnell
committed
Fix CVEs, upgrade JDK to 17, fix build issues
1 parent ddccc64 commit dfac008

File tree

6 files changed

+137
-105
lines changed

6 files changed

+137
-105
lines changed

‎Dockerfile

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM openjdk:8
1+
FROM openjdk:17-bullseye
22

33
ENV DEBIAN_FRONTEND=noninteractive
44

@@ -70,19 +70,13 @@ RUN find / -depth -name maven-shared-utils -type d -exec rm -r "{}" \; \
7070
# remove plexus-utils directory because plexus-utils has vulnerabilities
7171
# comment out if need to use maven utilities
7272
&& find / -depth -name plexus-utils -type d -exec rm -r "{}" \; \
73-
# remove old version of commons-compress with vulnerability
74-
&& find / -depth -name commons-compress -type d -exec rm -r "{}/1.20" \; \
7573
# remove jar files from common-io v2.5 and 2.6 both have vulnerabilities
7674
&& find / -name commons-io*2.5.jar -type f -exec rm "{}" \; \
7775
&& find / -name commons-io*2.6.jar -type f -exec rm "{}" \; \
78-
# remove jackson-databind
79-
&& find / -name jackson-databind -type d -exec rm -r "{}/2.13.3" \; \
8076
# remove junit-4.12.jar
8177
&& find / -name junit-4.12.jar -type f -exec rm "{}" \; \
8278
# remove maven-compiler-plugin jar from maven repo
8379
&& find / -name maven-compiler-plugin*.jar -type f -exec rm "{}" \; \
84-
# remove guava jar files
85-
&& rm /usr/share/java/guava.jar && rm /root/.m2/repository/com/google/guava/guava/10.0.1/guava-10.0.1.jar \
8680
# remove commons-codec jar
8781
&& find / -name commons-codec-1.11.jar -type f -exec rm "{}" \;
8882

‎pom.xml

Lines changed: 57 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
<parent>
2020
<groupId>org.springframework.boot</groupId>
2121
<artifactId>spring-boot-starter-parent</artifactId>
22-
<version>2.7.0</version>
22+
<version>3.1.2</version>
2323
</parent>
2424
<modelVersion>4.0.0</modelVersion>
2525
<groupId>org.amazonaws.sagemaker</groupId>
@@ -32,8 +32,9 @@
3232
<artifactId>maven-compiler-plugin</artifactId>
3333
<version>3.10.1</version>
3434
<configuration>
35-
<source>8</source>
36-
<target>8</target>
35+
<source>17</source>
36+
<target>17</target>
37+
<release>17</release>
3738
</configuration>
3839
</plugin>
3940
<plugin>
@@ -42,6 +43,7 @@
4243
<version>3.4.1</version>
4344
<executions>
4445
<execution>
46+
<id>shade-spark-ml-serving</id>
4547
<phase>package</phase>
4648
<goals>
4749
<goal>shade</goal>
@@ -79,9 +81,13 @@
7981
<plugin>
8082
<groupId>org.apache.maven.plugins</groupId>
8183
<artifactId>maven-surefire-plugin</artifactId>
82-
<version>2.22.2</version>
84+
<version>3.1.2</version>
8385
<configuration>
84-
<forkCount>0</forkCount>
86+
<reuseForks>false</reuseForks>
87+
<forkCount>1</forkCount>
88+
<argLine>--add-opens java.base/java.lang=ALL-UNNAMED</argLine>
89+
<argLine>--add-opens java.base/java.lang.reflect=ALL-UNNAMED</argLine>
90+
<argLine>--add-opens java.base/java.net=ALL-UNNAMED</argLine>
8591
<useSystemClassLoader>false</useSystemClassLoader>
8692
</configuration>
8793
</plugin>
@@ -177,12 +183,12 @@
177183
<dependency>
178184
<groupId>org.springframework.boot</groupId>
179185
<artifactId>spring-boot-starter-jetty</artifactId>
180-
<version>2.7.5</version>
186+
<version>3.1.2</version>
181187
</dependency>
182188
<dependency>
183189
<groupId>org.springframework.boot</groupId>
184190
<artifactId>spring-boot-starter-web</artifactId>
185-
<version>2.7.5</version>
191+
<version>3.1.2</version>
186192
<exclusions>
187193
<exclusion>
188194
<artifactId>spring-boot-starter-tomcat</artifactId>
@@ -193,12 +199,12 @@
193199
<dependency>
194200
<groupId>org.springframework.boot</groupId>
195201
<artifactId>spring-boot-starter</artifactId>
196-
<version>2.7.5</version>
202+
<version>3.1.2</version>
197203
</dependency>
198204
<dependency>
199205
<groupId>org.mockito</groupId>
200-
<artifactId>mockito-core</artifactId>
201-
<version>3.12.4</version>
206+
<artifactId>mockito-inline</artifactId>
207+
<version>3.9.0</version>
202208
<scope>test</scope>
203209
</dependency>
204210
<dependency>
@@ -233,19 +239,31 @@
233239
<dependency>
234240
<groupId>org.springframework.boot</groupId>
235241
<artifactId>spring-boot-starter-test</artifactId>
236-
<version>2.7.5</version>
242+
<version>3.1.2</version>
243+
<scope>test</scope>
244+
</dependency>
245+
<dependency>
246+
<groupId>org.springframework</groupId>
247+
<artifactId>spring-test</artifactId>
248+
<version>6.0.11</version>
237249
<scope>test</scope>
238250
</dependency>
239251
<dependency>
240252
<groupId>org.springframework.boot</groupId>
241253
<artifactId>spring-boot-starter-json</artifactId>
242-
<version>2.7.5</version>
254+
<version>3.1.2</version>
243255
</dependency>
244256
<dependency>
245257
<groupId>com.fasterxml.jackson.core</groupId>
246258
<artifactId>jackson-databind</artifactId>
247259
<version>2.14.0-rc2</version>
248260
</dependency>
261+
<!-- https://mvnrepository.com/artifact/com.github.fommil.netlib/core -->
262+
<dependency>
263+
<groupId>com.github.fommil.netlib</groupId>
264+
<artifactId>core</artifactId>
265+
<version>1.1.2</version>
266+
</dependency>
249267
<dependency>
250268
<groupId>com.fasterxml.jackson.core</groupId>
251269
<artifactId>jackson-core</artifactId>
@@ -259,57 +277,62 @@
259277
<dependency>
260278
<groupId>com.jayway.jsonpath</groupId>
261279
<artifactId>json-path</artifactId>
262-
<version>2.7.0</version>
280+
<version>2.8.0</version>
281+
</dependency>
282+
<dependency>
283+
<groupId>org.codehaus.plexus</groupId>
284+
<artifactId>plexus-archiver</artifactId>
285+
<version>4.8.0</version>
263286
</dependency>
264287
<dependency>
265288
<groupId>org.springframework</groupId>
266289
<artifactId>spring-web</artifactId>
267-
<version>5.3.29</version>
290+
<version>6.0.11</version>
268291
</dependency>
269292
<dependency>
270293
<groupId>org.springframework</groupId>
271294
<artifactId>spring-beans</artifactId>
272-
<version>5.3.29</version>
295+
<version>6.0.11</version>
273296
</dependency>
274297
<dependency>
275298
<groupId>org.springframework</groupId>
276299
<artifactId>spring-webmvc</artifactId>
277-
<version>5.3.29</version>
300+
<version>6.0.11</version>
278301
</dependency>
279302
<dependency>
280303
<groupId>org.springframework</groupId>
281304
<artifactId>spring-core</artifactId>
282-
<version>5.3.29</version>
305+
<version>6.0.11</version>
283306
</dependency>
284307
<dependency>
285308
<groupId>org.springframework.boot</groupId>
286309
<artifactId>spring-boot-autoconfigure</artifactId>
287-
<version>2.7.14</version>
310+
<version>3.1.2</version>
288311
</dependency>
289312
<dependency>
290313
<groupId>org.springframework</groupId>
291314
<artifactId>spring-context</artifactId>
292-
<version>5.3.23</version>
315+
<version>6.0.11</version>
293316
</dependency>
294317
<dependency>
295318
<groupId>org.springframework</groupId>
296319
<artifactId>spring-expression</artifactId>
297-
<version>5.3.23</version>
320+
<version>6.0.11</version>
298321
</dependency>
299322
<dependency>
300323
<groupId>org.springframework.boot</groupId>
301324
<artifactId>spring-boot</artifactId>
302-
<version>2.7.5</version>
325+
<version>3.1.2</version>
303326
</dependency>
304327
<dependency>
305328
<groupId>org.springframework</groupId>
306329
<artifactId>spring-aop</artifactId>
307-
<version>5.3.23</version>
330+
<version>6.0.11</version>
308331
</dependency>
309332
<dependency>
310333
<groupId>org.springframework</groupId>
311334
<artifactId>spring-jcl</artifactId>
312-
<version>5.3.23</version>
335+
<version>6.0.11</version>
313336
</dependency>
314337
<dependency>
315338
<groupId>org.yaml</groupId>
@@ -329,42 +352,42 @@
329352
<dependency>
330353
<groupId>org.eclipse.jetty</groupId>
331354
<artifactId>jetty-servlet</artifactId>
332-
<version>9.4.49.v20220914</version>
355+
<version>11.0.14</version>
333356
</dependency>
334357
<dependency>
335358
<groupId>org.eclipse.jetty</groupId>
336359
<artifactId>jetty-webapp</artifactId>
337-
<version>9.4.49.v20220914</version>
360+
<version>11.0.14</version>
338361
</dependency>
339362
<dependency>
340363
<groupId>org.eclipse.jetty</groupId>
341364
<artifactId>jetty-util</artifactId>
342-
<version>9.4.49.v20220914</version>
365+
<version>11.0.14</version>
343366
</dependency>
344367
<dependency>
345368
<groupId>org.eclipse.jetty</groupId>
346369
<artifactId>jetty-http</artifactId>
347-
<version>9.4.49.v20220914</version>
370+
<version>11.0.14</version>
348371
</dependency>
349372
<dependency>
350373
<groupId>org.eclipse.jetty</groupId>
351374
<artifactId>jetty-io</artifactId>
352-
<version>9.4.49.v20220914</version>
375+
<version>11.0.14</version>
353376
</dependency>
354377
<dependency>
355378
<groupId>org.eclipse.jetty</groupId>
356379
<artifactId>jetty-servlets</artifactId>
357-
<version>9.4.49.v20220914</version>
380+
<version>11.0.14</version>
358381
</dependency>
359382
<dependency>
360383
<groupId>org.eclipse.jetty</groupId>
361384
<artifactId>jetty-server</artifactId>
362-
<version>9.4.49.v20220914</version>
385+
<version>11.0.14</version>
363386
</dependency>
364387
<dependency>
365388
<groupId>org.eclipse.jetty</groupId>
366389
<artifactId>jetty-client</artifactId>
367-
<version>9.4.49.v20220914</version>
390+
<version>11.0.14</version>
368391
</dependency>
369392
<dependency>
370393
<groupId>org.eclipse.jetty.websocket</groupId>
@@ -394,22 +417,17 @@
394417
<dependency>
395418
<groupId>ch.qos.logback</groupId>
396419
<artifactId>logback-core</artifactId>
397-
<version>1.2.11</version>
420+
<version>1.4.8</version>
398421
</dependency>
399422
<dependency>
400423
<groupId>commons-codec</groupId>
401424
<artifactId>commons-codec</artifactId>
402425
<version>1.15</version>
403426
</dependency>
404-
<!-- for MLP inference from Mleap -->
405-
<dependency>
406-
<groupId>com.github.fommil.netlib</groupId>
407-
<artifactId>core</artifactId>
408-
<version>1.1.2</version>
409-
</dependency>
410427
</dependencies>
411428
<properties>
412-
<java.version>1.8</java.version>
429+
<java.version>1.17</java.version>
413430
<log4j2.version>2.17.1</log4j2.version>
431+
<jakarta-servlet.version>5.0.0</jakarta-servlet.version>
414432
</properties>
415433
</project>

‎serve.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
#!/bin/bash
22
# This is needed to make sure Java correctly detects CPU/Memory set by the container limits
3-
java -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap -jar /usr/local/lib/sparkml-serving-3.3.jar
3+
java -XX:+UnlockExperimentalVMOptions -jar /usr/local/lib/sparkml-serving-3.3.jar

‎src/main/java/com/amazonaws/sagemaker/configuration/BeanConfiguration.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ public ObjectMapper provideObjectMapper() {
8989
@Bean
9090
public JettyServletWebServerFactory provideJettyServletWebServerFactory() {
9191
final JettyServletWebServerFactory jettyServlet = new JettyServletWebServerFactory(
92-
new Integer(this.getHttpListenerPort()));
92+
Integer.parseInt(this.getHttpListenerPort()));
9393
final List<JettyServerCustomizer> serverCustomizerList = Lists.newArrayList();
9494
final JettyServerCustomizer serverCustomizer = server -> {
9595
final QueuedThreadPool threadPool = server.getBean(QueuedThreadPool.class);

‎src/test/java/com/amazonaws/sagemaker/configuration/BeanConfigurationTest.java

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -19,22 +19,32 @@
1919
import com.amazonaws.sagemaker.utils.SystemUtils;
2020
import java.io.File;
2121
import org.junit.Assert;
22-
import org.junit.Test;
23-
import org.junit.runner.RunWith;
24-
import org.powermock.api.mockito.PowerMockito;
25-
import org.powermock.core.classloader.annotations.PrepareForTest;
26-
import org.powermock.modules.junit4.PowerMockRunner;
22+
import org.junit.jupiter.api.Test;
23+
import org.junit.jupiter.api.AfterEach;
24+
import org.junit.jupiter.api.BeforeEach;
25+
import org.mockito.MockedStatic;
26+
import org.mockito.Mockito;
2727
import org.springframework.boot.web.embedded.jetty.JettyServletWebServerFactory;
2828

29-
@RunWith(PowerMockRunner.class)
30-
@PrepareForTest(SystemUtils.class)
3129
public class BeanConfigurationTest {
3230

3331
public BeanConfigurationTest() {
3432
}
3533

3634
private BeanConfiguration configuration = new BeanConfiguration();
3735

36+
private MockedStatic<SystemUtils> mockedSystemUtils;
37+
38+
@BeforeEach
39+
void setUpStaticMocks() {
40+
mockedSystemUtils = Mockito.mockStatic(SystemUtils.class);
41+
}
42+
43+
@AfterEach
44+
void tearDownStaticMocks() {
45+
mockedSystemUtils.closeOnDemand();
46+
}
47+
3848
@Test
3949
public void testModelLocationNotNull() {
4050
Assert.assertNotNull(configuration.provideModelFile());
@@ -89,8 +99,7 @@ public void testJettyServletWebServerFactoryNotNull() {
8999

90100
@Test
91101
public void testParsePortFromEnvironment() {
92-
PowerMockito.mockStatic(System.class);
93-
PowerMockito.when(SystemUtils.getEnvironmentVariable("SAGEMAKER_BIND_TO_PORT")).thenReturn("7070");
102+
mockedSystemUtils.when(() -> SystemUtils.getEnvironmentVariable("SAGEMAKER_BIND_TO_PORT")).thenReturn("7070");
94103
Assert.assertEquals(configuration.getHttpListenerPort(), "7070");
95104
}
96105

0 commit comments

Comments
 (0)