prod - Reverse merge#45
Conversation
Dev -> main merge
…bility detection Switch from scanning Gradle cache dir to generating a proper CycloneDX SBOM via the cyclonedx-gradle-plugin and feeding it to Grype. This ensures shaded/fat JARs (e.g. testsigma-java-sdk) have their bundled transitive dependencies fully resolved and reported, closing the gap where 'dir:' scanning missed embedded libs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace the Gradle CycloneDX plugin approach with a proper multi-stage scan: - Add Gradle init-script step that copies runtimeClasspath JARs into .dep-jars/ inside the workspace (no cache-path guessing, workspace-mounted so syft sees them) - Add scan-target fallback step that warns and falls back to source scan if no JARs - Switch SBOM generation to anchore/sbom-action (syft), which reads META-INF/maven/*/pom.properties from each JAR — correctly surfaces bundled dependencies inside fat/shaded JARs (e.g. testsigma-java-sdk's embedded jackson-databind 2.12.1 that the Gradle plugin missed) - Feed the syft SBOM into both Grype (SARIF) and Trivy (JSON) for dual-scanner coverage - Remove org.cyclonedx.bom Gradle plugin; SBOM generation is now CI-only Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- org.json:json 20160810 → 20231013 (CVE-2022-45688, CVE-2023-5072) - org.testng:testng 7.4.0 → 7.7.0 (CVE-2022-4065) - org.apache.commons:commons-lang3 3.12.0 → 3.18.0 (CVE-2025-48924) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
4 participants
No description provided.