flyway/11.1.1-r0: cve remediation

[octo-sts]

flyway/11.1.1-r0: fix GHSA-xq3w-v528-46rv/GHSA-7g45-4rm6-3mm3/

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/flyway.advisories.yaml

[octo-sts]

⚠️ EXPERIMENTAL

Please use 👍 or 👎 on this comment to indicate if you agree or disagree with the recommendation.

To provide more detailed feedback please comment on the recommendation prefixed with /ai-verify:

e.g. /ai-verify partially helpful but I also added bash to the build environment

Gen AI suggestions to solve the build error:

• Detected Error: "Could not transfer artifact io.netty:netty-common:pom:4.1.115 from/to flyway-community-db-support (https://maven.pkg.github.com/flyway/flyway-community-db-support): status code: 401, reason phrase: Unauthorized (401)"

• Error Category: Dependency Resolution

• Failure Point: Maven dependency resolution during build phase

• Root Cause Analysis: The build is failing because it's trying to access GitHub packages repository without proper authentication and also seems to be referencing an incorrect netty version

• Suggested Fix:

1. Add settings.xml configuration to skip the GitHub repository:

  - name: Configure Maven
    runs: |
      mkdir -p ~/.m2
      cat > ~/.m2/settings.xml << EOF
      <settings>
        <mirrors>
          <mirror>
            <id>central-mirror</id>
            <name>Central Mirror</name>
            <url>https://repo1.maven.org/maven2</url>
            <mirrorOf>central</mirrorOf>
          </mirror>
        </mirrors>
      </settings>
      EOF

2. Add this step before the Maven build in the pipeline

• Explanation:

• The error occurs because Maven is trying to fetch dependencies from Flyway's GitHub packages repository which requires authentication
• By configuring Maven to use Maven Central as a mirror, we bypass the GitHub repository authentication requirement
• The netty dependency will be fetched from Maven Central instead

• Additional Notes:

• This is a common issue when building Flyway from source as some dependencies are referenced from GitHub packages
• Using Maven Central as mirror is safe since all required dependencies are available there
• The settings.xml configuration ensures reliable builds without authentication requirements

• References:

• Maven Settings Documentation: https://maven.apache.org/settings.html
• Flyway Build Documentation: https://documentation.red-gate.com/fd/building-from-source-184127510.html