SONAR-13155 add command to run yarn security audit

diff --git a/build.gradle b/build.gradle
index ce1b8e8dabeabfb7159e42a8f5f79f9ab8fd36a2..cdb350f6362f22f14bb0d802d5bb556522017fbf 100644 (file)
--- a/build.gradle
+++ b/build.gradle
@@ -415,7 +415,7 @@ subprojects {
 
     node {
       version = '10.15.3'
-      yarnVersion = '1.15.2'
+      yarnVersion = '1.22.0'
       download = true
     }
   }
@@ -548,7 +548,7 @@ dependencyUpdates {
     boolean rejected = ['alpha', 'beta', 'rc', 'cr', 'm', 'preview', 'jre12'].any { qualifier ->
       it.candidate.version ==~ /(?i).*[.-]${qualifier}[.\d-]*/
     }
- 
+
     // Exclude upgrades on new major versions :
     //   com.hazelcast:hazelcast [3.12.3 -> 4.0.0]
     rejected |= !it.candidate.version.substring(0, 2).equals(it.currentVersion.substring(0, 2))

diff --git a/server/sonar-docs/build.gradle b/server/sonar-docs/build.gradle
index d072b8fe25e6a76fc2f951c02de4d6c0a76fa729..cea99b4401595de4b4710abfb61ba6a74fc0eaf2 100644 (file)
--- a/server/sonar-docs/build.gradle
+++ b/server/sonar-docs/build.gradle
@@ -80,6 +80,15 @@ clean.dependsOn(cleanYarn_run)
   dependsOn(yarn)
 }
 
+// Check for known vulnerabilities
+yarn_audit {
+  inputs.file('package.json')
+  outputs.cacheIf { false }
+  args = ['--groups', 'dependencies', '--level', 'high']
+  ignoreExitValue = true
+  dependsOn(yarn)
+}
+
 task zip(type: Zip) {
   def archiveDir = "$version"
   duplicatesStrategy DuplicatesStrategy.EXCLUDE

diff --git a/server/sonar-web/build.gradle b/server/sonar-web/build.gradle
index 1a0b4e76deb843e7c1605e7f095e4b96b819ee4c..7949528eb51f38f9ee75b91cad59fb3132d89654 100644 (file)
--- a/server/sonar-web/build.gradle
+++ b/server/sonar-web/build.gradle
@@ -42,6 +42,15 @@ build.dependsOn(yarn_run)
   dependsOn(yarn)
 }
 
+// Check for known vulnerabilities
+yarn_audit {
+  inputs.file('package.json')
+  outputs.cacheIf { false }
+  args = ['--groups', 'dependencies', '--level', 'high']
+  ignoreExitValue = true
+  dependsOn(yarn)
+}
+
 def sources = fileTree(dir: "src") + fileTree(dir: "scripts") + fileTree(dir: "config")
 
 task licenseCheckWeb(type: com.hierynomus.gradle.license.tasks.LicenseCheck) {