Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update base to use JDK21 #2642

Merged
merged 1 commit into from
Feb 5, 2025
Merged

Update base to use JDK21 #2642

merged 1 commit into from
Feb 5, 2025

Conversation

VietND96
Copy link
Member

@VietND96 VietND96 commented Feb 4, 2025

User description

Thanks for contributing to the Docker-Selenium project!
A PR well described will help maintainers to quickly review and merge it

Before submitting your PR, please check our contributing guidelines, applied for this repository.
Avoid large PRs, help reviewers by making them as simple and short as possible.

Description

Supply for the change SeleniumHQ/selenium@2357514 gets effective for containers.
This change might help with SeleniumHQ/selenium#13718
It also might help #2169

Motivation and Context

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist

  • I have read the contributing document.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have added tests to cover my changes.
  • All new and existing tests passed.

PR Type

Enhancement


Description

  • Updated the base Dockerfile to use JDK 21.

  • Removed a specific dependency version for io.lettuce:lettuce-core.


Changes walkthrough 📝

Relevant files
Enhancement
Dockerfile
Update JDK version and clean dependencies                               

Base/Dockerfile

  • Updated JRE_VERSION from 17 to 21.
  • Removed specific version for io.lettuce:lettuce-core.
  • +1/-2     

    Need help?
  • Type /help how to ... in the comments thread for any questions about Qodo Merge usage.
  • Check out the documentation for more information.
  • Signed-off-by: Viet Nguyen Duc <[email protected]>
    Copy link

    qodo-merge-pro bot commented Feb 4, 2025

    PR Reviewer Guide 🔍

    Here are some key observations to aid the review process:

    ⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪
    🧪 No relevant tests
    🔒 Security concerns

    Dependency version control:
    Removing the explicit version pin of lettuce-core (previously 6.5.1.RELEASE) could potentially introduce security vulnerabilities if an older or vulnerable version gets pulled in. The comment on line 130 mentions this was specifically for CVE patches.

    ⚡ Recommended focus areas for review

    Dependency Removal

    Removal of specific lettuce-core version may reintroduce CVE vulnerabilities that were previously patched. Need to verify if the default version is secure.

    # Patch specific version for CVEs in the dependencies
    > /external_jars/.classpath_session_map.txt \

    Copy link

    qodo-merge-pro bot commented Feb 4, 2025

    PR Code Suggestions ✨

    Explore these optional code suggestions:

    CategorySuggestion                                                                                                                                    Score
    Security
    Maintain explicit dependency version control

    Re-add the explicit version for lettuce-core dependency to prevent potential
    security vulnerabilities from transitive dependencies.

    Base/Dockerfile [129-131]

     org.seleniumhq.selenium:selenium-session-map-redis:${MVN_SELENIUM_VERSION} \
     # Patch specific version for CVEs in the dependencies
    +io.lettuce:lettuce-core:6.5.1.RELEASE \
     > /external_jars/.classpath_session_map.txt \
    • Apply this suggestion
    Suggestion importance[1-10]: 9

    Why: The suggestion correctly identifies that removing the explicit version of lettuce-core could expose the system to security vulnerabilities. Pinning dependency versions is crucial for security and stability.

    9

    @VietND96 VietND96 merged commit f4b73c6 into trunk Feb 5, 2025
    27 checks passed
    @VietND96 VietND96 deleted the jdk-21 branch February 5, 2025 01:20
    @VietND96
    Copy link
    Member Author

    VietND96 commented Feb 5, 2025

    @joerg1985 JDK21 is updated and started deploying in Nightly images

    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Projects
    None yet
    Development

    Successfully merging this pull request may close these issues.

    1 participant