Skip to content

Commit 0cce5c0

Browse files
a-orena-oren
authored
feat(deps): bump trustify-da-api-model for recommendation schemas (#519)
## Summary - Bump `trustify-da-api-model` from 2.0.7 to 2.0.8-SNAPSHOT to include new recommendation schemas (RecommendationSource, RecommendationReport, RecommendationSummary) - Add `recommendations` map to test fixtures (`analysis-report.json`, `analysis-report.mixed`, `image_reports.json`) at the ProviderReport level alongside existing `sources` - All 95 existing tests pass with the updated model version Implements [TC-4693](https://redhat.atlassian.net/browse/TC-4693) ## Test plan - [x] Full test suite passes (`mvn verify` — 95/95 tests) - [x] Test fixtures deserialize correctly with new recommendation map structure - [x] New model types (RecommendationSource, RecommendationReport, RecommendationSummary) available on classpath 🤖 Generated with [Claude Code](https://claude.com/claude-code) [TC-4693]: https://redhat.atlassian.net/browse/TC-4693?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ ## Summary by Sourcery Bump the trustify-da-api-model dependency to incorporate new recommendation-related schemas and update test fixtures to include recommendation data alongside existing sources.
1 parent 30190c1 commit 0cce5c0

4 files changed

Lines changed: 69 additions & 3 deletions

File tree

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
1919
<maven.compiler.release>21</maven.compiler.release>
2020
<!-- Dependencies -->
21-
<trustify-da-api-model.version>2.0.7</trustify-da-api-model.version>
21+
<trustify-da-api-model.version>2.0.8</trustify-da-api-model.version>
2222
<jackson.version>2.21.3</jackson.version>
2323
<jackson-annotations.version>2.21</jackson-annotations.version>
2424
<jakarta.annotation-api.version>3.0.0</jakarta.annotation-api.version>

‎src/test/resources/dummy_responses/maven/analysis-report.json‎

Lines changed: 49 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -230,5 +230,53 @@
230230
"remediations": {},
231231
"recommendation": null
232232
}
233-
]
233+
],
234+
"providers": {
235+
"snyk": {
236+
"status": {
237+
"ok": true,
238+
"name": "snyk",
239+
"code": 200,
240+
"message": "OK"
241+
},
242+
"sources": {
243+
"snyk": {
244+
"summary": {
245+
"direct": 1,
246+
"transitive": 0,
247+
"total": 7,
248+
"dependencies": 1,
249+
"critical": 1,
250+
"high": 3,
251+
"medium": 2,
252+
"low": 1,
253+
"remediations": 0,
254+
"recommendations": 1,
255+
"unscanned": 0
256+
},
257+
"dependencies": [
258+
{
259+
"ref": "pkg:maven/log4j/log4j@1.2.17",
260+
"issues": [],
261+
"recommendation": null
262+
}
263+
]
264+
}
265+
},
266+
"recommendations": {
267+
"trusted-content": {
268+
"status": "ok",
269+
"summary": {
270+
"total": 1
271+
},
272+
"dependencies": [
273+
{
274+
"ref": "pkg:maven/log4j/log4j@1.2.17",
275+
"recommendation": "pkg:maven/log4j/log4j@1.2.17-redhat-00001?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F"
276+
}
277+
]
278+
}
279+
}
280+
}
281+
}
234282
}

‎src/test/resources/dummy_responses/maven/analysis-report.mixed‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Content-Type: application/json
33
Content-Transfer-Encoding: binary
44

5-
{"summary":{"dependencies":{"scanned":1,"transitive":0},"vulnerabilities":{"total":7,"direct":1,"critical":1,"high":3,"medium":2,"low":1},"providerStatuses":[{"ok":true,"provider":"snyk","status":200,"message":"OK"}]},"dependencies":[{"ref":"pkg:maven/log4j/log4j@1.2.17","highestVulnerability":{"id":"SNYK-JAVA-LOG4J-1300176","title":"Man-in-the-Middle (MitM)","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"Low","integrityImpact":"None","availabilityImpact":"None","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cvssScore":3.7,"severity":"LOW","cves":["CVE-2020-9488"],"unique":false},"issues":[{"id":"SNYK-JAVA-LOG4J-572732","title":"Deserialization of Untrusted Data","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"Low","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":"Proof of concept code","remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P"},"cvssScore":9.8,"severity":"CRITICAL","cves":["CVE-2019-17571"],"unique":false},{"id":"SNYK-JAVA-LOG4J-2342645","title":"SQL Injection","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssScore":8.1,"severity":"HIGH","cves":["CVE-2022-23305"],"unique":false},{"id":"SNYK-JAVA-LOG4J-2342646","title":"Deserialization of Untrusted Data","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssScore":8.1,"severity":"HIGH","cves":["CVE-2022-23307"],"unique":false},{"id":"SNYK-JAVA-LOG4J-2342647","title":"Deserialization of Untrusted Data","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssScore":8.1,"severity":"HIGH","cves":["CVE-2022-23302"],"unique":false},{"id":"SNYK-JAVA-LOG4J-2316893","title":"Arbitrary Code Execution","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"High","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":"Proof of concept code","remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P"},"cvssScore":6.6,"severity":"MEDIUM","cves":["CVE-2021-4104"],"unique":false},{"id":"SNYK-JAVA-LOG4J-3358774","title":"Denial of Service (DoS)","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"None","integrityImpact":"None","availabilityImpact":"High","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cvssScore":5.9,"severity":"MEDIUM","cves":["CVE-2023-26464"],"unique":false},{"id":"SNYK-JAVA-LOG4J-1300176","title":"Man-in-the-Middle (MitM)","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"Low","integrityImpact":"None","availabilityImpact":"None","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cvssScore":3.7,"severity":"LOW","cves":["CVE-2020-9488"],"unique":false}],"transitive":[],"remediations":{},"recommendation":null}]}
5+
{"summary":{"dependencies":{"scanned":1,"transitive":0},"vulnerabilities":{"total":7,"direct":1,"critical":1,"high":3,"medium":2,"low":1},"providerStatuses":[{"ok":true,"provider":"snyk","status":200,"message":"OK"}]},"dependencies":[{"ref":"pkg:maven/log4j/log4j@1.2.17","highestVulnerability":{"id":"SNYK-JAVA-LOG4J-1300176","title":"Man-in-the-Middle (MitM)","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"Low","integrityImpact":"None","availabilityImpact":"None","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cvssScore":3.7,"severity":"LOW","cves":["CVE-2020-9488"],"unique":false},"issues":[{"id":"SNYK-JAVA-LOG4J-572732","title":"Deserialization of Untrusted Data","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"Low","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":"Proof of concept code","remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P"},"cvssScore":9.8,"severity":"CRITICAL","cves":["CVE-2019-17571"],"unique":false},{"id":"SNYK-JAVA-LOG4J-2342645","title":"SQL Injection","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssScore":8.1,"severity":"HIGH","cves":["CVE-2022-23305"],"unique":false},{"id":"SNYK-JAVA-LOG4J-2342646","title":"Deserialization of Untrusted Data","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssScore":8.1,"severity":"HIGH","cves":["CVE-2022-23307"],"unique":false},{"id":"SNYK-JAVA-LOG4J-2342647","title":"Deserialization of Untrusted Data","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssScore":8.1,"severity":"HIGH","cves":["CVE-2022-23302"],"unique":false},{"id":"SNYK-JAVA-LOG4J-2316893","title":"Arbitrary Code Execution","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"High","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":"Proof of concept code","remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P"},"cvssScore":6.6,"severity":"MEDIUM","cves":["CVE-2021-4104"],"unique":false},{"id":"SNYK-JAVA-LOG4J-3358774","title":"Denial of Service (DoS)","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"None","integrityImpact":"None","availabilityImpact":"High","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cvssScore":5.9,"severity":"MEDIUM","cves":["CVE-2023-26464"],"unique":false},{"id":"SNYK-JAVA-LOG4J-1300176","title":"Man-in-the-Middle (MitM)","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"Low","integrityImpact":"None","availabilityImpact":"None","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cvssScore":3.7,"severity":"LOW","cves":["CVE-2020-9488"],"unique":false}],"transitive":[],"remediations":{},"recommendation":null}],"providers":{"snyk":{"status":{"ok":true,"name":"snyk","code":200,"message":"OK"},"sources":{"snyk":{"summary":{"direct":1,"transitive":0,"total":7,"dependencies":1,"critical":1,"high":3,"medium":2,"low":1,"remediations":0,"recommendations":1,"unscanned":0},"dependencies":[{"ref":"pkg:maven/log4j/log4j@1.2.17","issues":[],"recommendation":null}]}},"recommendations":{"trusted-content":{"status":"ok","summary":{"total":1},"dependencies":[{"ref":"pkg:maven/log4j/log4j@1.2.17","recommendation":"pkg:maven/log4j/log4j@1.2.17-redhat-00001?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F"}]}}}}}
66
------=_Part_32_249990646.1688049072578
77
Content-Type: text/html
88
Content-Transfer-Encoding: 8bit

‎src/test/resources/msc/image/image_reports.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,24 @@
177177
}
178178
]
179179
}
180+
},
181+
"recommendations": {
182+
"trusted-content": {
183+
"status": "ok",
184+
"summary": {
185+
"total": 2
186+
},
187+
"dependencies": [
188+
{
189+
"ref": "pkg:maven/io.quarkus/quarkus-hibernate-orm@2.13.5.Final?type=jar",
190+
"recommendation": "pkg:maven/io.quarkus/quarkus-hibernate-orm@2.13.8.Final-redhat-00006?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar"
191+
},
192+
{
193+
"ref": "pkg:oci/ubi@sha256:f5983f7c7878cc9b26a3962be7756e3c810e9831b0b9f9613e6f6b445f884e74?repository_url=registry.access.redhat.com/ubi9/ubi&tag=9.3-1552&arch=amd64",
194+
"recommendation": "pkg:maven/io.quarkus/quarkus-jdbc-postgresql@2.13.8.Final-redhat-00006?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar"
195+
}
196+
]
197+
}
180198
}
181199
},
182200
"trusted-content": {

0 commit comments

Comments
 (0)