Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

thingsboard/3.8.1-r1: cve remediation #34137

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

octo-sts[bot]
Copy link
Contributor

@octo-sts octo-sts bot commented Nov 14, 2024

Copy link
Contributor Author

octo-sts bot commented Nov 14, 2024

Gen AI suggestions to solve the build error:

Based on the Maven build error, there are issues with dependency management in the pom.xml file after the pombump operation. Here are the steps to fix the build:

  1. The main errors appear to be related to invalid dependency declarations in the pom.xml after pombump modification:
  • There's a null:null:jar dependency that's missing groupId and artifactId
  • Several dependencies are incorrectly typed as 'jar' when they should be 'pom' for import scope
  1. Modify the pombump step in the melange YAML to handle these specific dependencies correctly. Add explicit type and scope configurations:
- uses: maven/pombump
  with:
    patches:
      - groupId: "com.squareup.okio"
        artifactId: "okio"
        version: "3.4.0"
        type: "pom"
        scope: "import"
      - groupId: "org.springframework.security"
        artifactId: "spring-security-web"
        version: "6.2.7"
        type: "pom"
        scope: "import"
      - groupId: "com.nimbusds"
        artifactId: "nimbus-jose-jwt"
        version: "9.37.2"
        type: "pom"
        scope: "import"
      - groupId: "org.jetbrains.kotlin"
        artifactId: "kotlin-stdlib"
        version: "1.4.21"
        type: "pom"
        scope: "import"
      - groupId: "net.minidev"
        artifactId: "json-smart"
        version: "2.4.9"
        type: "pom"
        scope: "import"
  1. Remove the null:null:jar dependency entry that's causing errors by ensuring it's not added during the pombump process.

This should resolve the Maven dependency management errors and allow the build to proceed. The changes ensure proper dependency type declarations and remove invalid null entries.

If the build still fails, you can debug further by:

  1. Running melange build with --interactive flag
  2. Examining the generated pom.xml inside the build environment
  3. Running mvn with -X flag for detailed debug output

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants