Skip to content

Commit d898294

Browse files
tamassoltesztamassoltesz
authored
Merge branch '11.0' into feat/logs-to-telemetry
2 parents 5ae16c3 + 7a75827 commit d898294

7 files changed

Lines changed: 294 additions & 2 deletions

File tree

‎.github/workflows/container-check.yml‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
name: Container Security Scan
2+
3+
on:
4+
# Allow manual triggering
5+
workflow_dispatch:
6+
7+
# Run automatically once a day at 2 AM UTC
8+
schedule:
9+
- cron: '0 2 * * *'
10+
11+
jobs:
12+
container-scan:
13+
name: Scan SuperTokens PostgreSQL Container
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Run Azure Container Scan
18+
id: container-scan
19+
uses: Azure/container-scan@v0
20+
continue-on-error: true
21+
with:
22+
image-name: supertokens/supertokens-postgresql:latest
23+
severity-threshold: LOW
24+
run-quality-checks: false
25+
env:
26+
DOCKER_CONTENT_TRUST: 1
27+
28+
- name: Upload scan results
29+
id: upload-scan-results
30+
uses: actions/upload-artifact@v4
31+
with:
32+
name: container-scan-results
33+
path: |
34+
${{ steps.container-scan.outputs.scan-report-path }}
35+
retention-days: 30
36+
37+
- name: Generate Security Summary
38+
id: security-summary
39+
run: |
40+
echo "summary<<EOF" >> $GITHUB_OUTPUT
41+
42+
echo "**Image:** \`supertokens/supertokens-postgresql:latest\`\n" >> $GITHUB_OUTPUT
43+
echo "**Scan Date:** \`$(date -u)\`\n" >> $GITHUB_OUTPUT
44+
echo "\n" >> $GITHUB_OUTPUT
45+
46+
# Get the scan report path from the container scan output
47+
SCAN_REPORT_PATH="${{ steps.container-scan.outputs.scan-report-path }}"
48+
49+
if [ -f "$SCAN_REPORT_PATH" ]; then
50+
# Count vulnerabilities by severity using the correct JSON structure
51+
critical=$(jq '[.vulnerabilities[]? | select(.severity == "CRITICAL")] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
52+
high=$(jq '[.vulnerabilities[]? | select(.severity == "HIGH")] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
53+
medium=$(jq '[.vulnerabilities[]? | select(.severity == "MEDIUM")] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
54+
low=$(jq '[.vulnerabilities[]? | select(.severity == "LOW")] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
55+
56+
total_vulns=$(jq '[.vulnerabilities[]?] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
57+
58+
echo "**Total Vulnerabilities:** $total_vulns\n" >> $GITHUB_OUTPUT
59+
echo "\n" >> $GITHUB_OUTPUT
60+
61+
echo "- 🔴 **Critical**: $critical\n" >> $GITHUB_OUTPUT
62+
echo "- 🟠 **High**: $high\n" >> $GITHUB_OUTPUT
63+
echo "- 🟡 **Medium**: $medium\n" >> $GITHUB_OUTPUT
64+
echo "- 🟢 **Low**: $low\n" >> $GITHUB_OUTPUT
65+
echo "\n" >> $GITHUB_OUTPUT
66+
else
67+
echo "❌ **Scan results not found or scan failed**" >> $GITHUB_OUTPUT
68+
fi
69+
70+
echo "\n" >> $GITHUB_OUTPUT
71+
72+
echo "[📃 Download the full report](${{ steps.upload-scan-results.outputs.artifact-url }})\n" >> $GITHUB_OUTPUT
73+
74+
echo "EOF" >> $GITHUB_OUTPUT
75+
76+
- name: Add to Action Summary
77+
run: |
78+
echo "**Image:** \`supertokens/supertokens-postgresql:latest\`" >> $GITHUB_STEP_SUMMARY
79+
echo "" >> $GITHUB_STEP_SUMMARY
80+
echo "**Scan Date:** \`$(date -u)\`" >> $GITHUB_STEP_SUMMARY
81+
echo "" >> $GITHUB_STEP_SUMMARY
82+
83+
# Get the scan report path from the container scan output
84+
SCAN_REPORT_PATH="${{ steps.container-scan.outputs.scan-report-path }}"
85+
86+
if [ -f "$SCAN_REPORT_PATH" ]; then
87+
# Count vulnerabilities by severity using the correct JSON structure
88+
critical=$(jq '[.vulnerabilities[]? | select(.severity == "CRITICAL")] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
89+
high=$(jq '[.vulnerabilities[]? | select(.severity == "HIGH")] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
90+
medium=$(jq '[.vulnerabilities[]? | select(.severity == "MEDIUM")] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
91+
low=$(jq '[.vulnerabilities[]? | select(.severity == "LOW")] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
92+
93+
total_vulns=$(jq '[.vulnerabilities[]?] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
94+
95+
echo "**Total Vulnerabilities:** $total_vulns" >> $GITHUB_STEP_SUMMARY
96+
echo "" >> $GITHUB_STEP_SUMMARY
97+
98+
echo "- 🔴 **Critical**: $critical" >> $GITHUB_STEP_SUMMARY
99+
echo "- 🟠 **High**: $high" >> $GITHUB_STEP_SUMMARY
100+
echo "- 🟡 **Medium**: $medium" >> $GITHUB_STEP_SUMMARY
101+
echo "- 🟢 **Low**: $low" >> $GITHUB_STEP_SUMMARY
102+
echo "" >> $GITHUB_STEP_SUMMARY
103+
104+
echo "**Vulnerabilities:**" >> $GITHUB_STEP_SUMMARY
105+
echo "" >> $GITHUB_STEP_SUMMARY
106+
echo "| ID | Package | Severity | | Description |" >> $GITHUB_STEP_SUMMARY
107+
echo "|----|---------|----------|-|-------------|" >> $GITHUB_STEP_SUMMARY
108+
109+
# Extract and format vulnerabilities into a table with colored severity indicators, excluding LOW severity
110+
jq -r '.vulnerabilities[]? | select(.severity != "LOW") | "| \(.vulnerabilityId // "N/A") | \(.packageName // "N/A") | \(.severity // "UNKNOWN") | \(if .severity == "CRITICAL" then "🔴" elif .severity == "HIGH" then "🟠" elif .severity == "MEDIUM" then "🟡" else "🟢" end) | \((.description // "No description available") | gsub("\n"; " ")) |"' "$SCAN_REPORT_PATH" >> $GITHUB_STEP_SUMMARY
111+
echo "" >> $GITHUB_STEP_SUMMARY
112+
else
113+
echo "❌ **Scan results not found or scan failed**" >> $GITHUB_STEP_SUMMARY
114+
fi
115+
116+
echo "" >> $GITHUB_STEP_SUMMARY
117+
echo "[📃 Download the full report](${{ steps.upload-scan-results.outputs.artifact-url }})" >> $GITHUB_STEP_SUMMARY
118+
119+
- name: Post notification on Slack channel
120+
id: deployment_message
121+
uses: slackapi/slack-github-action@v2.1.0
122+
with:
123+
method: chat.postMessage
124+
token: ${{ secrets.SLACK_BOT_TOKEN }}
125+
payload: |
126+
channel: ${{ secrets.SLACK_CHANNEL_ID }}
127+
text: ""
128+
blocks:
129+
- type: "header"
130+
text:
131+
type: "plain_text"
132+
text: "${{ steps.container-scan.outcome == 'success' && '✅' || '❌' }} Vulnerability Report: ${{ steps.container-scan.outcome == 'success' && 'All okay' || 'Needs attention' }}"
133+
- type: "markdown"
134+
text: "${{ steps.security-summary.outputs.summary }}"

‎CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
1010
## [11.0.5]
1111

1212
- Adds all logs to telemetry which were logged with `io/supertokens/output/Logging.java`
13+
- Upgrades the embedded tomcat to 11.0.8 because of security vulnerabilities
14+
- Adds back previously removed `implementationDependencies.json`, but now it is generated by the build process
1315

1416
## [11.0.4]
1517

‎build.gradle‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,6 @@ repositories {
3232
mavenCentral()
3333
}
3434

35-
3635
dependencies {
3736

3837
// https://mvnrepository.com/artifact/com.google.code.gson/gson
@@ -50,7 +49,7 @@ dependencies {
5049

5150

5251
// https://mvnrepository.com/artifact/org.apache.tomcat.embed/tomcat-embed-core
53-
api group: 'org.apache.tomcat.embed', name: 'tomcat-embed-core', version: '11.0.6'
52+
api group: 'org.apache.tomcat.embed', name: 'tomcat-embed-core', version: '11.0.8'
5453

5554
// https://mvnrepository.com/artifact/com.google.code.findbugs/jsr305
5655
implementation group: 'com.google.code.findbugs', name: 'jsr305', version: '3.0.2'

‎cli/implementationDependencies.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"_comment": "Contains list of implementation dependencies URL for this project. This is a generated file, don't modify the contents by hand.",
3+
"list": [
4+
{
5+
"jar":"https://repo.maven.apache.org/maven2/com/google/code/gson/gson/2.13.1/gson-2.13.1.jar",
6+
"name":"gson 2.13.1",
7+
"src":"https://repo.maven.apache.org/maven2/com/google/code/gson/gson/2.13.1/gson-2.13.1-sources.jar"
8+
},
9+
{
10+
"jar":"https://repo.maven.apache.org/maven2/com/google/errorprone/error_prone_annotations/2.38.0/error_prone_annotations-2.38.0.jar",
11+
"name":"error_prone_annotations 2.38.0",
12+
"src":"https://repo.maven.apache.org/maven2/com/google/errorprone/error_prone_annotations/2.38.0/error_prone_annotations-2.38.0-sources.jar"
13+
},
14+
{
15+
"jar":"https://repo.maven.apache.org/maven2/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.16.1/jackson-dataformat-yaml-2.16.1.jar",
16+
"name":"jackson-dataformat-yaml 2.16.1",
17+
"src":"https://repo.maven.apache.org/maven2/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.16.1/jackson-dataformat-yaml-2.16.1-sources.jar"
18+
},
19+
{
20+
"jar":"https://repo.maven.apache.org/maven2/org/yaml/snakeyaml/2.2/snakeyaml-2.2.jar",
21+
"name":"snakeyaml 2.2",
22+
"src":"https://repo.maven.apache.org/maven2/org/yaml/snakeyaml/2.2/snakeyaml-2.2-sources.jar"
23+
},
24+
{
25+
"jar":"https://repo.maven.apache.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.16.1/jackson-databind-2.16.1.jar",
26+
"name":"jackson-databind 2.16.1",
27+
"src":"https://repo.maven.apache.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.16.1/jackson-databind-2.16.1-sources.jar"
28+
},
29+
{
30+
"jar":"https://repo.maven.apache.org/maven2/de/mkammerer/argon2-jvm/2.11/argon2-jvm-2.11.jar",
31+
"name":"argon2-jvm 2.11",
32+
"src":"https://repo.maven.apache.org/maven2/de/mkammerer/argon2-jvm/2.11/argon2-jvm-2.11-sources.jar"
33+
},
34+
{
35+
"jar":"https://repo.maven.apache.org/maven2/org/mindrot/jbcrypt/0.4/jbcrypt-0.4.jar",
36+
"name":"jbcrypt 0.4",
37+
"src":"https://repo.maven.apache.org/maven2/org/mindrot/jbcrypt/0.4/jbcrypt-0.4-sources.jar"
38+
}
39+
]
40+
}

‎downloader/runBuild‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ exitIfNeeded
1414

1515
exitIfNeeded
1616

17+
1718
(cd ../../ && ./gradlew :$prefix-core:downloader:copyJars < /dev/null)
1819

1920
exitIfNeeded

‎ee/runBuild‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ exitIfNeeded
1414

1515
exitIfNeeded
1616

17+
1718
(cd ../../ && ./gradlew :$prefix-core:ee:copyJars < /dev/null)
1819

1920
exitIfNeeded

‎implementationDependencies.json‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
{
2+
"_comment": "Contains list of implementation dependencies URL for this project. This is a generated file, don't modify the contents by hand.",
3+
"list": [
4+
{
5+
"jar":"https://repo.maven.apache.org/maven2/org/apache/tomcat/embed/tomcat-embed-core/11.0.6/tomcat-embed-core-11.0.6.jar",
6+
"name":"tomcat-embed-core 11.0.6",
7+
"src":"https://repo.maven.apache.org/maven2/org/apache/tomcat/embed/tomcat-embed-core/11.0.6/tomcat-embed-core-11.0.6-sources.jar"
8+
},
9+
{
10+
"jar":"https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat-annotations-api/11.0.6/tomcat-annotations-api-11.0.6.jar",
11+
"name":"tomcat-annotations-api 11.0.6",
12+
"src":"https://repo.maven.apache.org/maven2/org/apache/tomcat/tomcat-annotations-api/11.0.6/tomcat-annotations-api-11.0.6-sources.jar"
13+
},
14+
{
15+
"jar":"https://repo.maven.apache.org/maven2/com/google/code/gson/gson/2.13.1/gson-2.13.1.jar",
16+
"name":"gson 2.13.1",
17+
"src":"https://repo.maven.apache.org/maven2/com/google/code/gson/gson/2.13.1/gson-2.13.1-sources.jar"
18+
},
19+
{
20+
"jar":"https://repo.maven.apache.org/maven2/com/google/errorprone/error_prone_annotations/2.38.0/error_prone_annotations-2.38.0.jar",
21+
"name":"error_prone_annotations 2.38.0",
22+
"src":"https://repo.maven.apache.org/maven2/com/google/errorprone/error_prone_annotations/2.38.0/error_prone_annotations-2.38.0-sources.jar"
23+
},
24+
{
25+
"jar":"https://repo.maven.apache.org/maven2/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.18.2/jackson-dataformat-yaml-2.18.2.jar",
26+
"name":"jackson-dataformat-yaml 2.18.2",
27+
"src":"https://repo.maven.apache.org/maven2/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.18.2/jackson-dataformat-yaml-2.18.2-sources.jar"
28+
},
29+
{
30+
"jar":"https://repo.maven.apache.org/maven2/org/yaml/snakeyaml/2.3/snakeyaml-2.3.jar",
31+
"name":"snakeyaml 2.3",
32+
"src":"https://repo.maven.apache.org/maven2/org/yaml/snakeyaml/2.3/snakeyaml-2.3-sources.jar"
33+
},
34+
{
35+
"jar":"https://repo.maven.apache.org/maven2/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.18.2/jackson-dataformat-cbor-2.18.2.jar",
36+
"name":"jackson-dataformat-cbor 2.18.2",
37+
"src":"https://repo.maven.apache.org/maven2/com/fasterxml/jackson/dataformat/jackson-dataformat-cbor/2.18.2/jackson-dataformat-cbor-2.18.2-sources.jar"
38+
},
39+
{
40+
"jar":"https://repo.maven.apache.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.18.2/jackson-databind-2.18.2.jar",
41+
"name":"jackson-databind 2.18.2",
42+
"src":"https://repo.maven.apache.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.18.2/jackson-databind-2.18.2-sources.jar"
43+
},
44+
{
45+
"jar":"https://repo.maven.apache.org/maven2/ch/qos/logback/logback-classic/1.5.13/logback-classic-1.5.13.jar",
46+
"name":"logback-classic 1.5.13",
47+
"src":"https://repo.maven.apache.org/maven2/ch/qos/logback/logback-classic/1.5.13/logback-classic-1.5.13-sources.jar"
48+
},
49+
{
50+
"jar":"https://repo.maven.apache.org/maven2/ch/qos/logback/logback-core/1.5.13/logback-core-1.5.13.jar",
51+
"name":"logback-core 1.5.13",
52+
"src":"https://repo.maven.apache.org/maven2/ch/qos/logback/logback-core/1.5.13/logback-core-1.5.13-sources.jar"
53+
},
54+
{
55+
"jar":"https://repo.maven.apache.org/maven2/org/slf4j/slf4j-api/2.0.15/slf4j-api-2.0.15.jar",
56+
"name":"slf4j-api 2.0.15",
57+
"src":"https://repo.maven.apache.org/maven2/org/slf4j/slf4j-api/2.0.15/slf4j-api-2.0.15-sources.jar"
58+
},
59+
{
60+
"jar":"https://repo.maven.apache.org/maven2/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar",
61+
"name":"jsr305 3.0.2",
62+
"src":"https://repo.maven.apache.org/maven2/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2-sources.jar"
63+
},
64+
{
65+
"jar":"https://repo.maven.apache.org/maven2/org/xerial/sqlite-jdbc/3.45.1.0/sqlite-jdbc-3.45.1.0.jar",
66+
"name":"sqlite-jdbc 3.45.1.0",
67+
"src":"https://repo.maven.apache.org/maven2/org/xerial/sqlite-jdbc/3.45.1.0/sqlite-jdbc-3.45.1.0-sources.jar"
68+
},
69+
{
70+
"jar":"https://repo.maven.apache.org/maven2/org/mindrot/jbcrypt/0.4/jbcrypt-0.4.jar",
71+
"name":"jbcrypt 0.4",
72+
"src":"https://repo.maven.apache.org/maven2/org/mindrot/jbcrypt/0.4/jbcrypt-0.4-sources.jar"
73+
},
74+
{
75+
"jar":"https://repo.maven.apache.org/maven2/org/jetbrains/annotations/13.0/annotations-13.0.jar",
76+
"name":"annotations 13.0",
77+
"src":"https://repo.maven.apache.org/maven2/org/jetbrains/annotations/13.0/annotations-13.0-sources.jar"
78+
},
79+
{
80+
"jar":"https://repo.maven.apache.org/maven2/de/mkammerer/argon2-jvm/2.11/argon2-jvm-2.11.jar",
81+
"name":"argon2-jvm 2.11",
82+
"src":"https://repo.maven.apache.org/maven2/de/mkammerer/argon2-jvm/2.11/argon2-jvm-2.11-sources.jar"
83+
},
84+
{
85+
"jar":"https://repo.maven.apache.org/maven2/com/auth0/java-jwt/4.4.0/java-jwt-4.4.0.jar",
86+
"name":"java-jwt 4.4.0",
87+
"src":"https://repo.maven.apache.org/maven2/com/auth0/java-jwt/4.4.0/java-jwt-4.4.0-sources.jar"
88+
},
89+
{
90+
"jar":"https://repo.maven.apache.org/maven2/com/lambdaworks/scrypt/1.4.0/scrypt-1.4.0.jar",
91+
"name":"scrypt 1.4.0",
92+
"src":"https://repo.maven.apache.org/maven2/com/lambdaworks/scrypt/1.4.0/scrypt-1.4.0-sources.jar"
93+
},
94+
{
95+
"jar":"https://repo.maven.apache.org/maven2/com/eatthepath/java-otp/0.4.0/java-otp-0.4.0.jar",
96+
"name":"java-otp 0.4.0",
97+
"src":"https://repo.maven.apache.org/maven2/com/eatthepath/java-otp/0.4.0/java-otp-0.4.0-sources.jar"
98+
},
99+
{
100+
"jar":"https://repo.maven.apache.org/maven2/commons-codec/commons-codec/1.15/commons-codec-1.15.jar",
101+
"name":"commons-codec 1.15",
102+
"src":"https://repo.maven.apache.org/maven2/commons-codec/commons-codec/1.15/commons-codec-1.15-sources.jar"
103+
},
104+
{
105+
"jar":"https://repo.maven.apache.org/maven2/com/googlecode/libphonenumber/libphonenumber/8.13.25/libphonenumber-8.13.25.jar",
106+
"name":"libphonenumber 8.13.25",
107+
"src":"https://repo.maven.apache.org/maven2/com/googlecode/libphonenumber/libphonenumber/8.13.25/libphonenumber-8.13.25-sources.jar"
108+
},
109+
{
110+
"jar":"https://repo.maven.apache.org/maven2/com/webauthn4j/webauthn4j-core/0.28.6.RELEASE/webauthn4j-core-0.28.6.RELEASE.jar",
111+
"name":"webauthn4j-core 0.28.6.RELEASE",
112+
"src":"https://repo.maven.apache.org/maven2/com/webauthn4j/webauthn4j-core/0.28.6.RELEASE/webauthn4j-core-0.28.6.RELEASE-sources.jar"
113+
}
114+
]
115+
}

0 commit comments

Comments
 (0)