Merge branch 'main' into whitesource-remediate/guava-monorepo

.github/workflows/test_security.yml

@@ -9,8 +9,6 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
 
-env:
-  ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
 
 jobs:
   Get-CI-Image-Tag:
@@ -31,13 +29,16 @@ jobs:
       # this image tag is subject to change as more dependencies and updates will arrive over time
       image: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-version-linux }}
       # need to switch to root so that github actions can install runner binary on container without permission issues.
-      options: --user root
+      options: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-options }}
 
     steps:
+      - name: Run start commands
+        run: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-command }}
+
       - name: Checkout Flow Framework
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Setup Java ${{ matrix.java }}
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: ${{ matrix.java }}

build.gradle

@@ -178,7 +178,7 @@ dependencies {
     implementation "org.dafny:DafnyRuntime:4.9.0"
     implementation "software.amazon.smithy.dafny:conversion:0.1.1"
     implementation 'org.bouncycastle:bcprov-jdk18on:1.79'
-    api "org.apache.httpcomponents.core5:httpcore5:5.3.1"
+    api "org.apache.httpcomponents.core5:httpcore5:5.3.2"
     implementation "jakarta.json.bind:jakarta.json.bind-api:3.0.1"
     implementation "org.glassfish:jakarta.json:2.0.1"
     implementation "org.eclipse:yasson:3.0.4"
@@ -210,7 +210,7 @@ dependencies {
         resolutionStrategy {
             force("com.google.guava:guava:33.4.0-jre") // CVE for 31.1, keep to force transitive dependencies
             force("com.fasterxml.jackson.core:jackson-core:${jacksonVersion}") // Dependency Jar Hell
-            force("org.apache.httpcomponents.core5:httpcore5:5.3.1") // Dependency Jar Hell
+            force("org.apache.httpcomponents.core5:httpcore5:5.3.2") // Dependency Jar Hell
         }
     }
 }

src/test/java/org/opensearch/flowframework/workflow/DeleteConnectorStepTests.java

@@ -28,6 +28,7 @@
 
 import static org.opensearch.flowframework.common.WorkflowResources.CONNECTOR_ID;
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.doAnswer;
 import static org.mockito.Mockito.verify;
 
@@ -58,7 +59,7 @@ public void testDeleteConnector() throws IOException, ExecutionException, Interr
             DeleteResponse output = new DeleteResponse(shardId, connectorIdArg, 1, 1, 1, true);
             actionListener.onResponse(output);
             return null;
-        }).when(machineLearningNodeClient).deleteConnector(any(String.class), any());
+        }).when(machineLearningNodeClient).deleteConnector(anyString(), anyActionListener());
 
         PlainActionFuture<WorkflowData> future = deleteConnectorStep.execute(
             inputData.getNodeId(),
@@ -67,7 +68,7 @@ public void testDeleteConnector() throws IOException, ExecutionException, Interr
             Map.of("step_1", CONNECTOR_ID),
             Collections.emptyMap()
         );
-        verify(machineLearningNodeClient).deleteConnector(any(String.class), any());
+        verify(machineLearningNodeClient).deleteConnector(anyString(), anyActionListener());
 
         assertTrue(future.isDone());
         assertEquals(connectorId, future.get().getContent().get(CONNECTOR_ID));
@@ -97,7 +98,7 @@ public void testDeleteConnectorFailure() throws IOException {
             ActionListener<DeleteResponse> actionListener = invocation.getArgument(1);
             actionListener.onFailure(new FlowFrameworkException("Failed to delete connector", RestStatus.INTERNAL_SERVER_ERROR));
             return null;
-        }).when(machineLearningNodeClient).deleteConnector(any(String.class), any());
+        }).when(machineLearningNodeClient).deleteConnector(anyString(), anyActionListener());
 
         PlainActionFuture<WorkflowData> future = deleteConnectorStep.execute(
             inputData.getNodeId(),
@@ -107,11 +108,16 @@ public void testDeleteConnectorFailure() throws IOException {
             Collections.emptyMap()
         );
 
-        verify(machineLearningNodeClient).deleteConnector(any(String.class), any());
+        verify(machineLearningNodeClient).deleteConnector(anyString(), anyActionListener());
 
         assertTrue(future.isDone());
         ExecutionException ex = assertThrows(ExecutionException.class, () -> future.get().getContent());
         assertTrue(ex.getCause() instanceof FlowFrameworkException);
         assertEquals("Failed to delete connector test", ex.getCause().getMessage());
     }
+
+    @SuppressWarnings("unchecked")
+    private ActionListener<DeleteResponse> anyActionListener() {
+        return any(ActionListener.class);
+    }
 }