Cannot update dependency version using auto fix with Xray scan

Question

Cannot update dependency version using auto fix with Xray scan

stanislavk1 opened this issue a year ago · 0 comments

Describe the bug
When using the IDE plugin and clicking on the autofix icon in order to change the dependency version, we will be able to see in the logs that the version has been changed, however in the UI it will still display the pervious version without updating it.

To Reproduce
Use a simple pom.xml file and scan it using the plugin in the Intellij IDE:

`

4.0.0
org.jfrog.test
multi
3.7.7.7-SNAPSHOT
pom
Simple Multi Modules Build

<properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <maven.compiler.source>1.8</maven.compiler.source>
    <maven.compiler.target>1.8</maven.compiler.target>
</properties>

<dependencies>
    <dependency>
        <groupId>junit</groupId>
        <artifactId>junit</artifactId>
        <version>3.8.1</version>
        <scope>test</scope>
    </dependency>

com.thoughtworks.xstream xstream-parent 1.3.1 pom

    <dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<version>1.2.17</version>

</dependencies>

<build>
    <pluginManagement>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jar-plugin</artifactId>
                <version>2.4</version>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-war-plugin</artifactId>
                <version>2.4</version>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-source-plugin</artifactId>
                <version>2.1.2</version>
            </plugin>
        </plugins>
    </pluginManagement>
    <plugins>
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-jar-plugin</artifactId>
            <configuration>
                <archive>
                    <addMavenDescriptor>false</addMavenDescriptor>
                </archive>
            </configuration>
        </plugin>
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-war-plugin</artifactId>
            <configuration>
                <archive>
                    <addMavenDescriptor>false</addMavenDescriptor>
                </archive>
            </configuration>
        </plugin>
    </plugins>
</build>

` Click on the Icon next to the dependency and click on 'Update version to X.X.X in order to fix CVE[]'

Expected behavior
The version should be automatically updated in the IDE

Screenshots

Versions

JFrog IDEA plugin version: 2.5.0
Operating system: ANY
Xray version: 3.82.10

Additional context
Stuck trace from the IDE itself:

2023-09-14 12:35:54,065 [1548856] SEVERE - #c.i.o.a.i.ApplicationImpl - Read access is allowed from inside read-action (or EDT) only (see com.intellij.openapi.application.Application.runReadAction()) Current thread: Thread[ApplicationImpl pooled thread 91,4,main] 1827250601 (EventQueue.isDispatchThread()=false) SystemEventQueueThread: Thread[AWT-EventQueue-0,6,main] 304995871 java.lang.Throwable: Read access is allowed from inside read-action (or EDT) only (see com.intellij.openapi.application.Application.runReadAction()) Current thread: Thread[ApplicationImpl pooled thread 91,4,main] 1827250601 (EventQueue.isDispatchThread()=false) SystemEventQueueThread: Thread[AWT-EventQueue-0,6,main] 304995871 at com.intellij.openapi.diagnostic.Logger.error(Logger.java:202) at com.intellij.openapi.application.impl.ApplicationImpl.assertReadAccessAllowed(ApplicationImpl.java:1004) at com.intellij.openapi.application.impl.ApplicationImpl.hasWriteAction(ApplicationImpl.java:977) at com.intellij.psi.impl.PsiToDocumentSynchronizer.toProcessPsiEvent(PsiToDocumentSynchronizer.java:141) at com.intellij.pom.core.impl.PomModelImpl.startTransaction(PomModelImpl.java:263) at com.intellij.pom.core.impl.PomModelImpl.lambda$runTransaction$2(PomModelImpl.java:96) at com.intellij.openapi.progress.impl.CoreProgressManager.lambda$executeNonCancelableSection$3(CoreProgressManager.java:222) at com.intellij.openapi.progress.impl.CoreProgressManager.registerIndicatorAndRun(CoreProgressManager.java:679) at com.intellij.openapi.progress.impl.CoreProgressManager.computeUnderProgress(CoreProgressManager.java:635) at com.intellij.openapi.progress.impl.CoreProgressManager.lambda$computeInNonCancelableSection$4(CoreProgressManager.java:230) at com.intellij.openapi.progress.Cancellation.computeInNonCancelableSection(Cancellation.java:99) at com.intellij.openapi.progress.impl.CoreProgressManager.computeInNonCancelableSection(CoreProgressManager.java:230) at com.intellij.openapi.progress.impl.CoreProgressManager.executeNonCancelableSection(CoreProgressManager.java:221) at com.intellij.pom.core.impl.PomModelImpl.runTransaction(PomModelImpl.java:93) at com.intellij.psi.impl.source.tree.ChangeUtil.prepareAndRunChangeAction(ChangeUtil.java:146) at com.intellij.psi.impl.source.tree.CompositeElement.replaceAllChildrenToChildrenOf(CompositeElement.java:641) at com.intellij.psi.impl.source.xml.XmlTextImpl.doSetValue(XmlTextImpl.java:173) at com.intellij.psi.impl.source.xml.XmlTextImpl.setValue(XmlTextImpl.java:165) at com.intellij.psi.impl.source.xml.XmlTagValueImpl.setText(XmlTagValueImpl.java:133) at com.intellij.psi.impl.source.xml.XmlTagValueImpl.setText(XmlTagValueImpl.java:108) at com.jfrog.ide.idea.inspections.upgradeversion.MavenUpgradeVersion.upgradeComponentVersion(MavenUpgradeVersion.java:38) at com.jfrog.ide.idea.inspections.upgradeversion.UpgradeVersion$1.run(UpgradeVersion.java:59) at com.intellij.openapi.progress.impl.CoreProgressManager.startTask(CoreProgressManager.java:429) at com.intellij.openapi.progress.impl.ProgressManagerImpl.startTask(ProgressManagerImpl.java:114) at com.intellij.openapi.progress.impl.CoreProgressManager.lambda$runProcessWithProgressAsynchronously$6(CoreProgressManager.java:480) at com.intellij.openapi.progress.impl.ProgressRunner.lambda$submit$3(ProgressRunner.java:252) at com.intellij.openapi.progress.impl.CoreProgressManager.lambda$runProcess$2(CoreProgressManager.java:186) at com.intellij.openapi.progress.impl.CoreProgressManager.lambda$executeProcessUnderProgress$13(CoreProgressManager.java:604) at com.intellij.openapi.progress.impl.CoreProgressManager.registerIndicatorAndRun(CoreProgressManager.java:679) at com.intellij.openapi.progress.impl.CoreProgressManager.computeUnderProgress(CoreProgressManager.java:635) at com.intellij.openapi.progress.impl.CoreProgressManager.executeProcessUnderProgress(CoreProgressManager.java:603) at com.intellij.openapi.progress.impl.ProgressManagerImpl.executeProcessUnderProgress(ProgressManagerImpl.java:60) at com.intellij.openapi.progress.impl.CoreProgressManager.runProcess(CoreProgressManager.java:173) at com.intellij.openapi.progress.impl.ProgressRunner.lambda$submit$4(ProgressRunner.java:252) at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1768) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) at java.base/java.util.concurrent.Executors$PrivilegedThreadFactory$1$1.run(Executors.java:702) at java.base/java.util.concurrent.Executors$PrivilegedThreadFactory$1$1.run(Executors.java:699) at java.base/java.security.AccessController.doPrivileged(AccessController.java:399) at java.base/java.util.concurrent.Executors$PrivilegedThreadFactory$1.run(Executors.java:699) at java.base/java.lang.Thread.run(Thread.java:833) 2023-09-14 12:35:54,065 [1548856] SEVERE - #c.i.o.a.i.ApplicationImpl - IntelliJ IDEA 2023.1.1 Build #IC-231.8770.65 2023-09-14 12:35:54,065 [1548856] SEVERE - #c.i.o.a.i.ApplicationImpl - JDK: 17.0.6; VM: OpenJDK 64-Bit Server VM; Vendor: JetBrains s.r.o. 2023-09-14 12:35:54,065 [1548856] SEVERE - #c.i.o.a.i.ApplicationImpl - OS: Mac OS X 2023-09-14 12:35:54,065 [1548856] SEVERE - #c.i.o.a.i.ApplicationImpl - Plugin to blame: JFrog version: 2.5.0 2023-09-14 12:35:54,065 [1548856] INFO - #com.jfrog.ide.idea.log.Logger - Upgraded log4j to version 2.0.0 successfully. 2023-09-14 12:35:55,590 [1550381] INFO - #c.i.w.i.i.j.s.JpsGlobalModelSynchronizerImpl - Saving global entities to files