From 74e6878a21d6f3f7ba81c3675eff29998be7e1ae Mon Sep 17 00:00:00 2001 From: Christoph Pirkl Date: Tue, 26 Sep 2023 09:24:35 +0200 Subject: [PATCH] #45: Upgrade dependencies --- .github/workflows/broken_links_checker.yml | 8 +++-- .github/workflows/ci-build-next-java.yml | 6 ++-- .github/workflows/ci-build.yml | 24 ++++++++----- .github/workflows/dependencies_check.yml | 8 ++--- ...elease_droid_prepare_original_checksum.yml | 12 ++++--- .../release_droid_print_quick_checksum.yml | 7 ++-- ...release_droid_release_on_maven_central.yml | 8 ++--- ...ase_droid_upload_github_release_assets.yml | 8 ++--- .settings/org.eclipse.jdt.core.prefs | 2 +- .vscode/settings.json | 34 +++++++++++-------- dependencies.md | 6 ++-- doc/changes/changelog.md | 1 + doc/changes/changes_1.6.1.md | 34 +++++++++++++++++++ pk_generated_parent.pom | 24 +++++++------ pom.xml | 24 ++++--------- 15 files changed, 124 insertions(+), 82 deletions(-) create mode 100644 doc/changes/changes_1.6.1.md diff --git a/.github/workflows/broken_links_checker.yml b/.github/workflows/broken_links_checker.yml index c4ff3be..82ec1cd 100644 --- a/.github/workflows/broken_links_checker.yml +++ b/.github/workflows/broken_links_checker.yml @@ -15,16 +15,18 @@ jobs: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - name: Configure broken links checker run: | mkdir -p ./target echo '{"aliveStatusCodes": [429, 200], "ignorePatterns": [' \ '{"pattern": "^https?://(www|dev).mysql.com/"},' \ '{"pattern": "^https?://(www.)?opensource.org"}' \ + '{"pattern": "^https?://(www.)?eclipse.org"}' \ + '{"pattern": "^https?://projects.eclipse.org"}' \ ']}' > ./target/broken_links_checker.json - uses: gaurav-nelson/github-action-markdown-link-check@v1 with: - use-quiet-mode: 'yes' - use-verbose-mode: 'yes' + use-quiet-mode: "yes" + use-verbose-mode: "yes" config-file: ./target/broken_links_checker.json diff --git a/.github/workflows/ci-build-next-java.yml b/.github/workflows/ci-build-next-java.yml index e0c15cf..7cbab08 100644 --- a/.github/workflows/ci-build-next-java.yml +++ b/.github/workflows/ci-build-next-java.yml @@ -14,15 +14,15 @@ jobs: cancel-in-progress: true steps: - name: Checkout the repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 - name: Set up JDK 17 uses: actions/setup-java@v3 with: - distribution: 'temurin' + distribution: "temurin" java-version: 17 - cache: 'maven' + cache: "maven" - name: Run tests and build with Maven run: | mvn --batch-mode --update-snapshots clean package -DtrimStackTrace=false \ diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml index e520870..7c42d6d 100644 --- a/.github/workflows/ci-build.yml +++ b/.github/workflows/ci-build.yml @@ -13,16 +13,22 @@ jobs: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true steps: + - name: Free Disk Space + run: | + sudo rm -rf /usr/local/lib/android + sudo rm -rf /usr/share/dotnet - name: Checkout the repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 - - name: Set up JDK 11 + - name: Set up JDK 11 & 17 uses: actions/setup-java@v3 with: - distribution: 'temurin' - java-version: 11 - cache: 'maven' + distribution: "temurin" + java-version: | + 17 + 11 + cache: "maven" - name: Cache SonarCloud packages uses: actions/cache@v3 with: @@ -33,7 +39,7 @@ jobs: run: echo 'testcontainers.reuse.enable=true' > "$HOME/.testcontainers.properties" - name: Run tests and build with Maven run: | - mvn --batch-mode clean verify \ + JAVA_HOME=$JAVA_HOME_11_X64 mvn --batch-mode clean verify \ -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ -DtrimStackTrace=false - name: Publish Test Report @@ -44,12 +50,12 @@ jobs: - name: Sonar analysis if: ${{ env.SONAR_TOKEN != null }} run: | - mvn --batch-mode org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \ + JAVA_HOME=$JAVA_HOME_17_X64 mvn --batch-mode org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \ -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ -DtrimStackTrace=false \ -Dsonar.organization=exasol \ -Dsonar.host.url=https://sonarcloud.io \ - -Dsonar.login=$SONAR_TOKEN + -Dsonar.token=$SONAR_TOKEN env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} \ No newline at end of file + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} diff --git a/.github/workflows/dependencies_check.yml b/.github/workflows/dependencies_check.yml index b2ab231..3059964 100644 --- a/.github/workflows/dependencies_check.yml +++ b/.github/workflows/dependencies_check.yml @@ -9,12 +9,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - name: Set up JDK 11 uses: actions/setup-java@v3 with: - distribution: 'temurin' + distribution: "temurin" java-version: 11 - cache: 'maven' + cache: "maven" - name: Checking dependencies for vulnerabilities - run: mvn --batch-mode org.sonatype.ossindex.maven:ossindex-maven-plugin:audit -f pom.xml \ No newline at end of file + run: mvn --batch-mode org.sonatype.ossindex.maven:ossindex-maven-plugin:audit -f pom.xml diff --git a/.github/workflows/release_droid_prepare_original_checksum.yml b/.github/workflows/release_droid_prepare_original_checksum.yml index 4a980f8..aa0f78f 100644 --- a/.github/workflows/release_droid_prepare_original_checksum.yml +++ b/.github/workflows/release_droid_prepare_original_checksum.yml @@ -7,16 +7,20 @@ jobs: build: runs-on: ubuntu-latest steps: + - name: Free Disk Space + run: | + sudo rm -rf /usr/local/lib/android + sudo rm -rf /usr/share/dotnet - name: Checkout the repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 - name: Set up JDK 11 uses: actions/setup-java@v3 with: - distribution: 'temurin' + distribution: "temurin" java-version: 11 - cache: 'maven' + cache: "maven" - name: Enable testcontainer reuse run: echo 'testcontainers.reuse.enable=true' > "$HOME/.testcontainers.properties" - name: Run tests and build with Maven @@ -28,4 +32,4 @@ jobs: with: name: original_checksum retention-days: 5 - path: original_checksum \ No newline at end of file + path: original_checksum diff --git a/.github/workflows/release_droid_print_quick_checksum.yml b/.github/workflows/release_droid_print_quick_checksum.yml index 8add957..aed4444 100644 --- a/.github/workflows/release_droid_print_quick_checksum.yml +++ b/.github/workflows/release_droid_print_quick_checksum.yml @@ -8,17 +8,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout the repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 - name: Set up JDK 11 uses: actions/setup-java@v3 with: - distribution: 'temurin' + distribution: "temurin" java-version: 11 - cache: 'maven' + cache: "maven" - name: Build with Maven skipping tests run: mvn --batch-mode clean verify -DskipTests - name: Print checksum run: echo 'checksum_start==';find target -maxdepth 1 -name *.jar -exec sha256sum "{}" + | xargs;echo '==checksum_end' - diff --git a/.github/workflows/release_droid_release_on_maven_central.yml b/.github/workflows/release_droid_release_on_maven_central.yml index b467607..dfdbd6a 100644 --- a/.github/workflows/release_droid_release_on_maven_central.yml +++ b/.github/workflows/release_droid_release_on_maven_central.yml @@ -8,15 +8,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout the repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 - name: Set up Maven Central Repository uses: actions/setup-java@v3 with: - distribution: 'temurin' + distribution: "temurin" java-version: 11 - cache: 'maven' + cache: "maven" server-id: ossrh server-username: MAVEN_USERNAME server-password: MAVEN_PASSWORD @@ -27,4 +27,4 @@ jobs: env: MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }} MAVEN_PASSWORD: ${{ secrets.OSSRH_PASSWORD }} - MAVEN_GPG_PASSPHRASE: ${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }} \ No newline at end of file + MAVEN_GPG_PASSPHRASE: ${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }} diff --git a/.github/workflows/release_droid_upload_github_release_assets.yml b/.github/workflows/release_droid_upload_github_release_assets.yml index 7350faf..7ae8bbb 100644 --- a/.github/workflows/release_droid_upload_github_release_assets.yml +++ b/.github/workflows/release_droid_upload_github_release_assets.yml @@ -4,7 +4,7 @@ on: workflow_dispatch: inputs: upload_url: - description: 'Assets upload URL' + description: "Assets upload URL" required: true jobs: @@ -12,15 +12,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout the repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 - name: Set up JDK 11 uses: actions/setup-java@v3 with: - distribution: 'temurin' + distribution: "temurin" java-version: 11 - cache: 'maven' + cache: "maven" - name: Build with Maven skipping tests run: mvn --batch-mode clean verify -DskipTests - name: Generate sha256sum files diff --git a/.settings/org.eclipse.jdt.core.prefs b/.settings/org.eclipse.jdt.core.prefs index 8b5a9aa..bb40c3f 100644 --- a/.settings/org.eclipse.jdt.core.prefs +++ b/.settings/org.eclipse.jdt.core.prefs @@ -111,7 +111,7 @@ org.eclipse.jdt.core.compiler.problem.unusedPrivateMember=warning org.eclipse.jdt.core.compiler.problem.unusedTypeParameter=ignore org.eclipse.jdt.core.compiler.problem.unusedWarningToken=warning org.eclipse.jdt.core.compiler.problem.varargsArgumentNeedCast=warning -org.eclipse.jdt.core.compiler.processAnnotations=enabled +org.eclipse.jdt.core.compiler.processAnnotations=disabled org.eclipse.jdt.core.compiler.release=disabled org.eclipse.jdt.core.compiler.source=11 org.eclipse.jdt.core.formatter.align_assignment_statements_on_columns=false diff --git a/.vscode/settings.json b/.vscode/settings.json index f938933..1ad56f4 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -1,17 +1,21 @@ { - "editor.formatOnSave": true, - "editor.codeActionsOnSave": { - "source.organizeImports": true, - "source.generate.finalModifiers": true, - "source.fixAll": true - }, - "java.codeGeneration.useBlocks": true, - "java.saveActions.organizeImports": true, - "java.sources.organizeImports.starThreshold": 3, - "java.sources.organizeImports.staticStarThreshold": 3, - "java.test.config": { - "vmArgs": [ - "-Djava.util.logging.config.file=src/test/resources/logging.properties" - ] - } + "editor.formatOnSave": true, + "editor.codeActionsOnSave": { + "source.organizeImports": true, + "source.generate.finalModifiers": true, + "source.fixAll": true + }, + "java.codeGeneration.useBlocks": true, + "java.saveActions.organizeImports": true, + "java.sources.organizeImports.starThreshold": 3, + "java.sources.organizeImports.staticStarThreshold": 3, + "java.test.config": { + "vmArgs": [ + "-Djava.util.logging.config.file=src/test/resources/logging.properties" + ] + }, + "sonarlint.connectedMode.project": { + "connectionId": "exasol", + "projectKey": "com.exasol:hamcrest-resultset-matcher" + } } diff --git a/dependencies.md b/dependencies.md index 9e6b909..ae77bbc 100644 --- a/dependencies.md +++ b/dependencies.md @@ -32,7 +32,7 @@ | [Versions Maven Plugin][20] | [Apache License, Version 2.0][15] | | [duplicate-finder-maven-plugin Maven Mojo][21] | [Apache License 2.0][22] | | [Apache Maven Deploy Plugin][23] | [Apache-2.0][15] | -| [Apache Maven GPG Plugin][24] | [Apache License, Version 2.0][15] | +| [Apache Maven GPG Plugin][24] | [Apache-2.0][15] | | [Apache Maven Source Plugin][25] | [Apache License, Version 2.0][15] | | [Apache Maven Javadoc Plugin][26] | [Apache-2.0][15] | | [Nexus Staging Maven Plugin][27] | [Eclipse Public License][28] | @@ -57,7 +57,7 @@ [7]: http://www.apache.org/licenses/LICENSE-2.0.txt [8]: https://github.com/exasol/exasol-testcontainers/ [9]: https://github.com/exasol/exasol-testcontainers/blob/main/LICENSE -[10]: https://testcontainers.org +[10]: https://java.testcontainers.org [11]: http://opensource.org/licenses/MIT [12]: http://sonarsource.github.io/sonar-scanner-maven/ [13]: http://www.gnu.org/licenses/lgpl.txt @@ -68,7 +68,7 @@ [18]: https://sonatype.github.io/ossindex-maven/maven-plugin/ [19]: https://maven.apache.org/surefire/maven-surefire-plugin/ [20]: https://www.mojohaus.org/versions/versions-maven-plugin/ -[21]: https://github.com/basepom/duplicate-finder-maven-plugin +[21]: https://basepom.github.io/duplicate-finder-maven-plugin [22]: http://www.apache.org/licenses/LICENSE-2.0.html [23]: https://maven.apache.org/plugins/maven-deploy-plugin/ [24]: https://maven.apache.org/plugins/maven-gpg-plugin/ diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md index fce17de..1bbdc76 100644 --- a/doc/changes/changelog.md +++ b/doc/changes/changelog.md @@ -1,5 +1,6 @@ # Changes +* [1.6.1](changes_1.6.1.md) * [1.6.0](changes_1.6.0.md) * [1.5.3](changes_1.5.3.md) * [1.5.2](changes_1.5.2.md) diff --git a/doc/changes/changes_1.6.1.md b/doc/changes/changes_1.6.1.md new file mode 100644 index 0000000..779c80e --- /dev/null +++ b/doc/changes/changes_1.6.1.md @@ -0,0 +1,34 @@ +# Matcher for SQL Result Sets 1.6.1, released 2023-09-26 + +Code name: Fix CVE-2023-42503 + +## Summary + +This release fixes CVE-2023-42503 in `org.apache.commons:commons-compress` by upgrading dependencies. + +## Security + +* #45: Fixed CVE-2023-42503 in `org.apache.commons:commons-compress` + +## Dependency Updates + +### Test Dependency Updates + +* Updated `com.exasol:exasol-testcontainers:6.5.2` to `6.6.2` +* Updated `org.junit.jupiter:junit-jupiter-engine:5.9.2` to `5.10.0` +* Updated `org.junit.jupiter:junit-jupiter-params:5.9.2` to `5.10.0` +* Updated `org.testcontainers:jdbc:1.18.0` to `1.19.0` +* Updated `org.testcontainers:junit-jupiter:1.18.0` to `1.19.0` + +### Plugin Dependency Updates + +* Updated `com.exasol:error-code-crawler-maven-plugin:1.2.3` to `1.3.0` +* Updated `com.exasol:project-keeper-maven-plugin:2.9.7` to `2.9.12` +* Updated `org.apache.maven.plugins:maven-enforcer-plugin:3.3.0` to `3.4.0` +* Updated `org.apache.maven.plugins:maven-failsafe-plugin:3.0.0` to `3.1.2` +* Updated `org.apache.maven.plugins:maven-gpg-plugin:3.0.1` to `3.1.0` +* Updated `org.apache.maven.plugins:maven-surefire-plugin:3.0.0` to `3.1.2` +* Updated `org.basepom.maven:duplicate-finder-maven-plugin:1.5.1` to `2.0.1` +* Updated `org.codehaus.mojo:flatten-maven-plugin:1.4.1` to `1.5.0` +* Updated `org.codehaus.mojo:versions-maven-plugin:2.15.0` to `2.16.0` +* Updated `org.jacoco:jacoco-maven-plugin:0.8.9` to `0.8.10` diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom index dea52a8..4d96bd1 100644 --- a/pk_generated_parent.pom +++ b/pk_generated_parent.pom @@ -3,7 +3,7 @@ 4.0.0 com.exasol hamcrest-resultset-matcher-generated-parent - 1.6.0 + 1.6.1 pom UTF-8 @@ -62,7 +62,7 @@ org.apache.maven.plugins maven-enforcer-plugin - 3.3.0 + 3.4.0 enforce-maven @@ -82,7 +82,7 @@ org.codehaus.mojo flatten-maven-plugin - 1.4.1 + 1.5.0 true oss @@ -121,7 +121,7 @@ org.apache.maven.plugins maven-surefire-plugin - 3.0.0 + 3.1.2 @@ -132,7 +132,7 @@ org.codehaus.mojo versions-maven-plugin - 2.15.0 + 2.16.0 display-updates @@ -150,7 +150,7 @@ org.basepom.maven duplicate-finder-maven-plugin - 1.5.1 + 2.0.1 default @@ -168,7 +168,6 @@ true true false - true true false @@ -184,7 +183,7 @@ org.apache.maven.plugins maven-gpg-plugin - 3.0.1 + 3.1.0 sign-artifacts @@ -204,6 +203,9 @@ org.apache.maven.plugins maven-source-plugin + 3.2.1 @@ -258,7 +260,7 @@ org.apache.maven.plugins maven-failsafe-plugin - 3.0.0 + 3.1.2 @@ -279,7 +281,7 @@ org.jacoco jacoco-maven-plugin - 0.8.9 + 0.8.10 prepare-agent @@ -320,7 +322,7 @@ com.exasol error-code-crawler-maven-plugin - 1.2.3 + 1.3.0 verify diff --git a/pom.xml b/pom.xml index 5bedf57..5c3a189 100644 --- a/pom.xml +++ b/pom.xml @@ -2,23 +2,13 @@ 4.0.0 hamcrest-resultset-matcher - 1.6.0 + 1.6.1 Matcher for SQL Result Sets This project provides hamcrest matcher that compares java.sql.ResultSet objects. https://github.com/exasol/hamcrest-resultset-matcher/ - 5.9.2 + 5.10.0 - - - ossrh - https://oss.sonatype.org/content/repositories/snapshots - - - ossrh - https://oss.sonatype.org/service/local/staging/deploy/maven2/ - - org.hamcrest @@ -46,13 +36,13 @@ com.exasol exasol-testcontainers - 6.5.2 + 6.6.2 test org.testcontainers junit-jupiter - 1.18.0 + 1.19.0 test @@ -63,7 +53,7 @@ org.testcontainers jdbc - 1.18.0 + 1.19.0 test @@ -72,7 +62,7 @@ com.exasol project-keeper-maven-plugin - 2.9.7 + 2.9.12 @@ -86,7 +76,7 @@ hamcrest-resultset-matcher-generated-parent com.exasol - 1.6.0 + 1.6.1 pk_generated_parent.pom