From 7c7ac3e591642abc532060f93bba721dc85e837c Mon Sep 17 00:00:00 2001
From: Andrew DeMaria <lostonamountain@gmail.com>
Date: Wed, 26 Jun 2019 10:57:49 -0600
Subject: [PATCH 1/4] Update dependency check

---
 airsonic-main/cve-suppressed.xml | 35 ++++++++++++++++++++++++++++++++
 airsonic-main/pom.xml            |  2 +-
 pom.xml                          | 19 +++++++++--------
 3 files changed, 46 insertions(+), 10 deletions(-)

diff --git a/airsonic-main/cve-suppressed.xml b/airsonic-main/cve-suppressed.xml
index 548e6b40..caa93990 100644
--- a/airsonic-main/cve-suppressed.xml
+++ b/airsonic-main/cve-suppressed.xml
@@ -168,4 +168,39 @@
         <gav regex="true">^com\.sun\.xml\.bind\.external:relaxng-datatype:.*</gav>
         <cve>CVE-2018-18749</cve>
     </suppress>
+    <suppress>
+        <notes>False positive for jflac-codec</notes>
+        <gav regex="true">.*jflac-codec.*</gav>
+        <cve>CVE-2018-14948</cve>
+    </suppress>
+    <suppress>
+        <notes>We do not enable default typing for jackson</notes>
+        <gav regex="true">.*jackson-databind.*</gav>
+        <cve>CVE-2019-12814</cve>
+    </suppress>
+    <suppress>
+        <notes>We do not sue the liquibase sdk</notes>
+        <filePath regex="true">.*liquibase/sdk/.*</filePath>
+        <cvssBelow>9.0</cvssBelow>
+    </suppress>
+    <suppress>
+        <notes>False positive for tomcat vuln in eclipse jetty/jasper compat lib</notes>
+        <gav regex="true">^org\.mortbay\.jasper:apache-jsp:.*$</gav>
+        <cve>CVE-2016-5425</cve>
+    </suppress>
+    <suppress>
+        <notes>False positive for tomcat vuln in eclipse jetty/jasper compat lib</notes>
+        <gav regex="true">^org\.mortbay\.jasper:apache-jsp:.*$</gav>
+        <cve>CVE-2017-6056</cve>
+    </suppress>
+    <suppress>
+        <notes>False positive for tomcat vuln in eclipse jetty/jasper compat lib</notes>
+        <gav regex="true">^org\.mortbay\.jasper:apache-jsp:.*$</gav>
+        <cve>CVE-2019-10072</cve>
+    </suppress>
+    <suppress>
+        <notes>This cve is for apache standard taglibs before 1.2.3. However jstl:1.2 is a separate PROVIDED lib</notes>
+        <gav regex="true">^javax\.servlet:jstl:.*$</gav>
+        <cve>CVE-2015-0254</cve>
+    </suppress>
 </suppressions>
diff --git a/airsonic-main/pom.xml b/airsonic-main/pom.xml
index d50db52b..e2166468 100755
--- a/airsonic-main/pom.xml
+++ b/airsonic-main/pom.xml
@@ -538,7 +538,7 @@
         <dependency>
             <groupId>org.postgresql</groupId>
             <artifactId>postgresql</artifactId>
-            <version>42.1.4</version>
+            <version>42.2.5</version>
             <scope>runtime</scope>
         </dependency>
         <dependency>
diff --git a/pom.xml b/pom.xml
index 6277f7c7..5f8c669d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -18,6 +18,7 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <cxf.version>3.3.1</cxf.version>
         <jackson.version>2.9.9</jackson.version>
+        <tomcat.version>8.5.42</tomcat.version>
     </properties>
 
     <repositories>
@@ -87,7 +88,7 @@
                 <!-- Import dependency management from Spring Boot -->
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-dependencies</artifactId>
-                <version>1.5.20.RELEASE</version>
+                <version>1.5.21.RELEASE</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
@@ -192,37 +193,37 @@
             <dependency>
                 <groupId>org.apache.tomcat.embed</groupId>
                 <artifactId>tomcat-embed-core</artifactId>
-                <version>8.5.40</version>
+                <version>${tomcat.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.tomcat.embed</groupId>
                 <artifactId>tomcat-embed-el</artifactId>
-                <version>8.5.40</version>
+                <version>${tomcat.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.tomcat.embed</groupId>
                 <artifactId>tomcat-embed-jasper</artifactId>
-                <version>8.5.40</version>
+                <version>${tomcat.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.tomcat.embed</groupId>
                 <artifactId>tomcat-embed-websocket</artifactId>
-                <version>8.5.40</version>
+                <version>${tomcat.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.tomcat</groupId>
                 <artifactId>tomcat-annotations-api</artifactId>
-                <version>8.5.40</version>
+                <version>${tomcat.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.tomcat</groupId>
                 <artifactId>tomcat-jdbc</artifactId>
-                <version>8.5.40</version>
+                <version>${tomcat.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.tomcat</groupId>
                 <artifactId>tomcat-juli</artifactId>
-                <version>8.5.40</version>
+                <version>${tomcat.version}</version>
             </dependency>
         </dependencies>
     </dependencyManagement>
@@ -300,7 +301,7 @@
                 <plugin>
                     <groupId>org.owasp</groupId>
                     <artifactId>dependency-check-maven</artifactId>
-                    <version>4.0.0</version>
+                    <version>5.0.0</version>
                     <inherited>true</inherited>
                     <configuration>
                         <failBuildOnAnyVulnerability>true</failBuildOnAnyVulnerability>

From c2acc36f85a3c2f230b222e5ae6f9fe6758e998c Mon Sep 17 00:00:00 2001
From: Andrew DeMaria <lostonamountain@gmail.com>
Date: Wed, 26 Jun 2019 11:20:45 -0600
Subject: [PATCH 2/4] Disable ossindex analyzer as its data is questionable

---
 pom.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pom.xml b/pom.xml
index 5f8c669d..a0ef4995 100644
--- a/pom.xml
+++ b/pom.xml
@@ -308,6 +308,7 @@
                         <suppressionFiles>
                             <suppressionFile>${project.basedir}/cve-suppressed.xml</suppressionFile>
                         </suppressionFiles>
+                        <ossindexAnalyzerEnabled>false</ossindexAnalyzerEnabled>
                     </configuration>
                     <executions>
                         <execution>

From 05580ae7f30553a4c23423a653fd211536ef03b2 Mon Sep 17 00:00:00 2001
From: Andrew DeMaria <lostonamountain@gmail.com>
Date: Wed, 26 Jun 2019 11:23:49 -0600
Subject: [PATCH 3/4] Fix typo

---
 airsonic-main/cve-suppressed.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/airsonic-main/cve-suppressed.xml b/airsonic-main/cve-suppressed.xml
index caa93990..ce449ee7 100644
--- a/airsonic-main/cve-suppressed.xml
+++ b/airsonic-main/cve-suppressed.xml
@@ -179,7 +179,7 @@
         <cve>CVE-2019-12814</cve>
     </suppress>
     <suppress>
-        <notes>We do not sue the liquibase sdk</notes>
+        <notes>We do not use the liquibase sdk</notes>
         <filePath regex="true">.*liquibase/sdk/.*</filePath>
         <cvssBelow>9.0</cvssBelow>
     </suppress>

From 4d615a35f441b88c538f2a7c86b7d70c48fc5cf4 Mon Sep 17 00:00:00 2001
From: Andrew DeMaria <lostonamountain@gmail.com>
Date: Wed, 26 Jun 2019 11:52:11 -0600
Subject: [PATCH 4/4] Add comment for why ossindex is disabled

---
 pom.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pom.xml b/pom.xml
index a0ef4995..8a7a89ae 100644
--- a/pom.xml
+++ b/pom.xml
@@ -308,6 +308,7 @@
                         <suppressionFiles>
                             <suppressionFile>${project.basedir}/cve-suppressed.xml</suppressionFile>
                         </suppressionFiles>
+                        <!-- disabled due to the poor quality of the data from this analyzer -->
                         <ossindexAnalyzerEnabled>false</ossindexAnalyzerEnabled>
                     </configuration>
                     <executions>