Project: duracloud
Issue DURACLOUD-988: Ensure DuraCloud dependencies are version consistent and secure
This task is to add two new checks to the DuraCloud dependency chain: 1. Add the dependency convergence option to the maven enforcer (https://maven.apache.org/enforcer/enforcer-rules/dependencyConvergence.html). This compares versions in the dependency tree to ensure that only a single version of any given artifact is referenced in the build. 2. Add the enforce-victims-rule to the maven enforcer (https://github.com/victims/victims-enforcer). This checks the dependency tree against a list of dependencies known to have security vulnerabilities. After adding these requirements, there will be changes needed in the codebase to comply with any issues that are uncovered.
Story points: 5