diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml index e43cf83..6d154dc 100644 --- a/.github/workflows/ci-build.yml +++ b/.github/workflows/ci-build.yml @@ -57,7 +57,7 @@ jobs: } - name: Set up JDKs id: setup-java - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: |- @@ -87,7 +87,7 @@ jobs: run: | mvn --batch-mode clean verify \ -DossindexSkip=true \ - -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ + --no-transfer-progress \ -DtrimStackTrace=false \ -Dcom.exasol.dockerdb.image=${{ matrix.exasol_db_version }} env: { @@ -99,7 +99,7 @@ jobs: run: | mvn --batch-mode org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \ -DossindexSkip=true \ - -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ + --no-transfer-progress \ -DtrimStackTrace=false \ -Dsonar.token=$SONAR_TOKEN env: { @@ -188,7 +188,7 @@ jobs: } - name: Set up JDK 17 id: setup-java - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: { distribution: temurin, java-version: '17', @@ -198,7 +198,7 @@ jobs: id: build-next-java run: | mvn --batch-mode clean package -DtrimStackTrace=false -Djava.version=17 \ - -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ + --no-transfer-progress \ -DossindexSkip=true ossindex: runs-on: ubuntu-latest @@ -222,7 +222,7 @@ jobs: } - name: Set up JDKs id: setup-java - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: |- @@ -230,15 +230,15 @@ jobs: 21 cache: maven server-id: ossindex - server-username: OSSINDEX_USERNAME - server-password: OSSINDEX_API_TOKEN + server-username-env-var: OSSINDEX_USERNAME + server-password-env-var: OSSINDEX_API_TOKEN - name: Run Ossindex id: ossindex run: | mvn --batch-mode test-compile \ org.sonatype.ossindex.maven:ossindex-maven-plugin:audit \ org.sonatype.ossindex.maven:ossindex-maven-plugin:audit-aggregate \ - -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn + --no-transfer-progress env: { OSSINDEX_USERNAME: '${{ secrets.OSSINDEX_USERNAME }}', OSSINDEX_API_TOKEN: '${{ secrets.OSSINDEX_API_TOKEN }}' @@ -250,9 +250,7 @@ jobs: shell: bash } permissions: { - security-events: write, - contents: read, - actions: read + contents: read } concurrency: { group: '${{ github.workflow }}-github-actions-linter-${{ github.ref }}', @@ -265,9 +263,9 @@ jobs: with: { persist-credentials: false } - - name: Lint GitHub actions with Zizmore + - name: Lint GitHub actions with Zizmor id: lint-github-actions - uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa + uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 with: { advanced-security: false } @@ -300,7 +298,7 @@ jobs: } - name: Set up JDKs id: setup-java - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: |- @@ -335,7 +333,7 @@ jobs: actions: read, issues: read } - uses: ./.github/workflows/release.yml + uses: $/.github/workflows/release.yml with: { started-from-ci: true, maven-central-auto-publish: true diff --git a/.github/workflows/dependencies_check.yml b/.github/workflows/dependencies_check.yml index fa5164f..53b1831 100644 --- a/.github/workflows/dependencies_check.yml +++ b/.github/workflows/dependencies_check.yml @@ -33,7 +33,7 @@ jobs: } - name: Set up JDKs id: setup-jdks - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: |- @@ -41,8 +41,8 @@ jobs: 21 cache: maven server-id: ossindex - server-username: OSSINDEX_USERNAME - server-password: OSSINDEX_API_TOKEN + server-username-env-var: OSSINDEX_USERNAME + server-password-env-var: OSSINDEX_API_TOKEN - name: Generate ossindex report id: ossindex-report run: | @@ -82,7 +82,7 @@ jobs: contents: write, pull-requests: write } - uses: ./.github/workflows/dependencies_update.yml + uses: $/.github/workflows/dependencies_update.yml with: { vulnerability_issues: '${{ needs.report_security_issues.outputs.created-issues }}' } diff --git a/.github/workflows/dependencies_update.yml b/.github/workflows/dependencies_update.yml index 1986eae..9e75866 100644 --- a/.github/workflows/dependencies_update.yml +++ b/.github/workflows/dependencies_update.yml @@ -42,7 +42,7 @@ jobs: } - name: Set up JDKs id: setup-jdks - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: |- diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 515d750..35ca410 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -83,21 +83,21 @@ jobs: - name: Set up Maven Central Repository id: configure-maven-central-credentials if: ${{ true }} - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: |- 11 21 server-id: maven-central-portal - server-username: MAVEN_USERNAME - server-password: MAVEN_PASSWORD + server-username-env-var: MAVEN_USERNAME + server-password-env-var: MAVEN_PASSWORD gpg-private-key: ${{ secrets.OSSRH_GPG_SECRET_KEY }} - gpg-passphrase: MAVEN_GPG_PASSPHRASE + gpg-passphrase-env-var: MAVEN_GPG_PASSPHRASE - name: Set up JDKs id: setup-jdks if: ${{ ! true }} - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: |- @@ -146,7 +146,7 @@ jobs: - { name: Build project, id: build, - run: mvn --batch-mode -DskipTests -DossindexSkip=true clean verify + run: mvn --batch-mode -DskipTests -DskipITs -DossindexSkip=true clean verify } - { name: List secret GPG keys, @@ -159,7 +159,7 @@ jobs: if: ${{ true && (! inputs.skip-maven-central) }} run: | echo "#### Maven Central Release" >> "$GITHUB_STEP_SUMMARY" - mvn --batch-mode -Dgpg.skip=false -DskipTests -DossindexSkip=true deploy \ + mvn --batch-mode -Dgpg.skip=false -DskipTests -DskipITs -DossindexSkip=true deploy \ -Dcentral-publishing.deploymentName="Auto release of repo ${{ github.repository }} using PK release.yml" \ -Dcentral-publishing.autoPublish=${{ inputs.maven-central-auto-publish }} if [[ "${{ inputs.maven-central-auto-publish }}" == "true" ]]; then diff --git a/.settings/org.eclipse.jdt.core.prefs b/.settings/org.eclipse.jdt.core.prefs index 6e2bc99..aafba62 100644 --- a/.settings/org.eclipse.jdt.core.prefs +++ b/.settings/org.eclipse.jdt.core.prefs @@ -258,6 +258,7 @@ org.eclipse.jdt.core.formatter.insert_new_line_after_annotation_on_local_variabl org.eclipse.jdt.core.formatter.insert_new_line_after_annotation_on_method=insert org.eclipse.jdt.core.formatter.insert_new_line_after_annotation_on_package=insert org.eclipse.jdt.core.formatter.insert_new_line_after_annotation_on_parameter=do not insert +org.eclipse.jdt.core.formatter.insert_new_line_after_annotation_on_record_parameter=do not insert org.eclipse.jdt.core.formatter.insert_new_line_after_annotation_on_type=insert org.eclipse.jdt.core.formatter.insert_new_line_after_label=do not insert org.eclipse.jdt.core.formatter.insert_new_line_after_opening_brace_in_array_initializer=do not insert @@ -508,7 +509,7 @@ org.eclipse.jdt.core.formatter.put_text_block_quotes_on_new_line=false org.eclipse.jdt.core.formatter.tabulation.char=space org.eclipse.jdt.core.formatter.tabulation.size=4 org.eclipse.jdt.core.formatter.text_block_indentation=0 -org.eclipse.jdt.core.formatter.use_on_off_tags=false +org.eclipse.jdt.core.formatter.use_on_off_tags=true org.eclipse.jdt.core.formatter.use_tabs_only_for_leading_indentations=true org.eclipse.jdt.core.formatter.wrap_before_additive_operator=true org.eclipse.jdt.core.formatter.wrap_before_assertion_message_operator=true diff --git a/dependencies.md b/dependencies.md index 6528a39..1cec8da 100644 --- a/dependencies.md +++ b/dependencies.md @@ -3,66 +3,69 @@ ## Compile Dependencies -| Dependency | License | -| --------------------------------------- | ------------------------------------------------------------------------------------------------------------ | -| [Jakarta JSON Processing API][0] | [Eclipse Public License 2.0][1]; [GNU General Public License, version 2 with the GNU Classpath Exception][2] | -| [error-reporting-java][3] | [MIT License][4] | -| [JaCoCo :: Core][5] | [EPL-2.0][6] | -| [BucketFS Java][7] | [MIT License][8] | -| [exasol-test-setup-abstraction-java][9] | [MIT License][10] | -| [Apache Commons Compress][11] | [Apache-2.0][12] | -| [SLF4J JDK14 Provider][13] | [MIT][14] | +| Dependency | License | +| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------ | +| [Jakarta JSON Processing API][0] | [Eclipse Public License 2.0][1]; [GNU General Public License, version 2 with the GNU Classpath Exception][2] | +| [error-reporting-java][3] | [MIT License][4] | +| [JaCoCo :: Core][5] | [EPL-2.0][6] | +| [asm][7] | [BSD-3-Clause][8] | +| [asm-commons][7] | [BSD-3-Clause][8] | +| [asm-tree][7] | [BSD-3-Clause][8] | +| [BucketFS Java][9] | [MIT License][10] | +| [exasol-test-setup-abstraction-java][11] | [MIT License][12] | +| [Apache Commons Compress][13] | [Apache-2.0][14] | +| [SLF4J JDK14 Provider][15] | [MIT][16] | ## Test Dependencies | Dependency | License | | ----------------------------------------------- | --------------------------------- | | [JaCoCo :: Agent][5] | [EPL-2.0][6] | -| [JUnit Jupiter Params][15] | [Eclipse Public License v2.0][16] | -| [mockito-junit-jupiter][17] | [MIT][18] | -| [Hamcrest][19] | [BSD-3-Clause][20] | -| [Test containers for Exasol on Docker][21] | [MIT License][22] | -| [Testcontainers :: JUnit Jupiter Extension][23] | [MIT][24] | -| [Test Database Builder for Java][25] | [MIT License][26] | -| [JUnit5 System Extensions][27] | [Eclipse Public License v2.0][28] | +| [JUnit Jupiter Params][17] | [Eclipse Public License v2.0][18] | +| [mockito-junit-jupiter][19] | [MIT][20] | +| [Hamcrest][21] | [BSD-3-Clause][22] | +| [Test containers for Exasol on Docker][23] | [MIT License][24] | +| [Testcontainers :: JUnit Jupiter Extension][25] | [MIT][26] | +| [Test Database Builder for Java][27] | [MIT License][28] | +| [JUnit5 System Extensions][29] | [Eclipse Public License v2.0][30] | ## Runtime Dependencies | Dependency | License | | --------------------- | ------------------------------------------------------------------------------------------------------------ | -| [Eclipse Parsson][29] | [Eclipse Public License 2.0][1]; [GNU General Public License, version 2 with the GNU Classpath Exception][2] | +| [Eclipse Parsson][31] | [Eclipse Public License 2.0][1]; [GNU General Public License, version 2 with the GNU Classpath Exception][2] | ## Plugin Dependencies | Dependency | License | | ------------------------------------------------------- | ---------------------------------------------- | -| [SonarQube Scanner for Maven][30] | [GNU LGPL 3][31] | -| [Apache Maven Toolchains Plugin][32] | [Apache-2.0][12] | -| [Apache Maven Compiler Plugin][33] | [Apache-2.0][12] | -| [Apache Maven Enforcer Plugin][34] | [Apache-2.0][12] | -| [Maven Flatten Plugin][35] | [Apache Software License][12] | -| [org.sonatype.ossindex.maven:ossindex-maven-plugin][36] | [ASL2][37] | -| [Maven Surefire Plugin][38] | [Apache-2.0][12] | -| [Versions Maven Plugin][39] | [Apache License, Version 2.0][12] | -| [duplicate-finder-maven-plugin Maven Mojo][40] | [Apache License 2.0][41] | -| [Apache Maven Artifact Plugin][42] | [Apache-2.0][12] | -| [Apache Maven Deploy Plugin][43] | [Apache-2.0][12] | -| [Apache Maven Source Plugin][44] | [Apache-2.0][12] | -| [Apache Maven Javadoc Plugin][45] | [Apache-2.0][12] | -| [spdx-maven-plugin Maven Plugin][46] | [The Apache Software License, Version 2.0][37] | -| [Build Helper Maven Plugin][47] | [The MIT License][48] | -| [Apache Maven GPG Plugin][49] | [Apache-2.0][12] | -| [Central Publishing Maven Plugin][50] | [The Apache License, Version 2.0][12] | -| [Maven Failsafe Plugin][51] | [Apache-2.0][12] | -| [JaCoCo :: Maven Plugin][52] | [EPL-2.0][6] | -| [error-code-crawler-maven-plugin][53] | [MIT License][54] | -| [Git Commit Id Maven Plugin][55] | [GNU Lesser General Public License 3.0][56] | -| [Apache Maven Dependency Plugin][57] | [Apache-2.0][12] | -| [Project Keeper Maven plugin][58] | [The MIT License][59] | -| [Apache Maven Clean Plugin][60] | [Apache-2.0][12] | -| [Apache Maven Resources Plugin][61] | [Apache-2.0][12] | -| [Apache Maven Install Plugin][62] | [Apache-2.0][12] | -| [Apache Maven Site Plugin][63] | [Apache-2.0][12] | +| [SonarQube Scanner for Maven][32] | [GNU LGPL 3][33] | +| [Apache Maven Toolchains Plugin][34] | [Apache-2.0][14] | +| [Apache Maven Compiler Plugin][35] | [Apache-2.0][14] | +| [Apache Maven Enforcer Plugin][36] | [Apache-2.0][14] | +| [Maven Flatten Plugin][37] | [Apache Software License][14] | +| [org.sonatype.ossindex.maven:ossindex-maven-plugin][38] | [ASL2][39] | +| [Maven Surefire Plugin][40] | [Apache-2.0][14] | +| [Versions Maven Plugin][41] | [Apache License, Version 2.0][14] | +| [duplicate-finder-maven-plugin Maven Mojo][42] | [Apache License 2.0][43] | +| [Apache Maven Artifact Plugin][44] | [Apache-2.0][14] | +| [Apache Maven Deploy Plugin][45] | [Apache-2.0][14] | +| [Apache Maven Source Plugin][46] | [Apache-2.0][14] | +| [Apache Maven Javadoc Plugin][47] | [Apache-2.0][14] | +| [spdx-maven-plugin Maven Plugin][48] | [The Apache Software License, Version 2.0][39] | +| [Build Helper Maven Plugin][49] | [The MIT License][50] | +| [Apache Maven GPG Plugin][51] | [Apache-2.0][14] | +| [Central Publishing Maven Plugin][52] | [The Apache License, Version 2.0][14] | +| [Maven Failsafe Plugin][53] | [Apache-2.0][14] | +| [JaCoCo :: Maven Plugin][54] | [EPL-2.0][6] | +| [error-code-crawler-maven-plugin][55] | [MIT License][56] | +| [Git Commit Id Maven Plugin][57] | [GNU Lesser General Public License 3.0][58] | +| [Apache Maven Dependency Plugin][59] | [Apache-2.0][14] | +| [Project Keeper Maven plugin][60] | [The MIT License][61] | +| [Apache Maven Clean Plugin][62] | [Apache-2.0][14] | +| [Apache Maven Resources Plugin][63] | [Apache-2.0][14] | +| [Apache Maven Install Plugin][64] | [Apache-2.0][14] | +| [Apache Maven Site Plugin][65] | [Apache-2.0][14] | [0]: https://github.com/eclipse-ee4j/jsonp [1]: https://projects.eclipse.org/license/epl-2.0 @@ -71,60 +74,62 @@ [4]: https://github.com/exasol/error-reporting-java/blob/main/LICENSE [5]: https://www.eclemma.org/jacoco/index.html [6]: https://www.eclipse.org/legal/epl-2.0/ -[7]: https://github.com/exasol/bucketfs-java/ -[8]: https://github.com/exasol/bucketfs-java/blob/main/LICENSE -[9]: https://github.com/exasol/exasol-test-setup-abstraction-java/ -[10]: https://github.com/exasol/exasol-test-setup-abstraction-java/blob/main/LICENSE -[11]: https://commons.apache.org/proper/commons-compress/ -[12]: https://www.apache.org/licenses/LICENSE-2.0.txt -[13]: http://www.slf4j.org -[14]: https://opensource.org/license/mit -[15]: https://junit.org/ -[16]: https://www.eclipse.org/legal/epl-v20.html -[17]: https://github.com/mockito/mockito -[18]: https://opensource.org/licenses/MIT -[19]: http://hamcrest.org/JavaHamcrest/ -[20]: https://raw.githubusercontent.com/hamcrest/JavaHamcrest/master/LICENSE -[21]: https://github.com/exasol/exasol-testcontainers/ -[22]: https://github.com/exasol/exasol-testcontainers/blob/main/LICENSE -[23]: https://java.testcontainers.org -[24]: http://opensource.org/licenses/MIT -[25]: https://github.com/exasol/test-db-builder-java/ -[26]: https://github.com/exasol/test-db-builder-java/blob/main/LICENSE -[27]: https://github.com/itsallcode/junit5-system-extensions -[28]: http://www.eclipse.org/legal/epl-v20.html -[29]: https://github.com/eclipse-ee4j/parsson -[30]: https://docs.sonarsource.com/sonarqube-server/latest/extension-guide/developing-a-plugin/plugin-basics/sonar-scanner-maven/sonar-maven-plugin/ -[31]: http://www.gnu.org/licenses/lgpl.txt -[32]: https://maven.apache.org/plugins/maven-toolchains-plugin/ -[33]: https://maven.apache.org/plugins/maven-compiler-plugin/ -[34]: https://maven.apache.org/enforcer/maven-enforcer-plugin/ -[35]: https://www.mojohaus.org/flatten-maven-plugin/ -[36]: https://sonatype.github.io/ossindex-maven/maven-plugin/ -[37]: http://www.apache.org/licenses/LICENSE-2.0.txt -[38]: https://maven.apache.org/surefire/maven-surefire-plugin/ -[39]: https://www.mojohaus.org/versions/versions-maven-plugin/ -[40]: https://basepom.github.io/duplicate-finder-maven-plugin -[41]: http://www.apache.org/licenses/LICENSE-2.0.html -[42]: https://maven.apache.org/plugins/maven-artifact-plugin/ -[43]: https://maven.apache.org/plugins/maven-deploy-plugin/ -[44]: https://maven.apache.org/plugins/maven-source-plugin/ -[45]: https://maven.apache.org/plugins/maven-javadoc-plugin/ -[46]: https://github.com/spdx/spdx-maven-plugin -[47]: https://www.mojohaus.org/build-helper-maven-plugin/ -[48]: https://spdx.org/licenses/MIT.txt -[49]: https://maven.apache.org/plugins/maven-gpg-plugin/ -[50]: https://central.sonatype.org -[51]: https://maven.apache.org/surefire/maven-failsafe-plugin/ -[52]: https://www.jacoco.org/jacoco/trunk/doc/maven.html -[53]: https://github.com/exasol/error-code-crawler-maven-plugin/ -[54]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE -[55]: https://github.com/git-commit-id/git-commit-id-maven-plugin -[56]: http://www.gnu.org/licenses/lgpl-3.0.txt -[57]: https://maven.apache.org/plugins/maven-dependency-plugin/ -[58]: https://github.com/exasol/project-keeper/ -[59]: https://github.com/exasol/project-keeper/blob/main/LICENSE -[60]: https://maven.apache.org/plugins/maven-clean-plugin/ -[61]: https://maven.apache.org/plugins/maven-resources-plugin/ -[62]: https://maven.apache.org/plugins/maven-install-plugin/ -[63]: https://maven.apache.org/plugins/maven-site-plugin/ +[7]: http://asm.ow2.io/ +[8]: https://asm.ow2.io/license.html +[9]: https://github.com/exasol/bucketfs-java/ +[10]: https://github.com/exasol/bucketfs-java/blob/main/LICENSE +[11]: https://github.com/exasol/exasol-test-setup-abstraction-java/ +[12]: https://github.com/exasol/exasol-test-setup-abstraction-java/blob/main/LICENSE +[13]: https://commons.apache.org/proper/commons-compress/ +[14]: https://www.apache.org/licenses/LICENSE-2.0.txt +[15]: http://www.slf4j.org +[16]: https://opensource.org/license/mit +[17]: https://junit.org/ +[18]: https://www.eclipse.org/legal/epl-v20.html +[19]: https://github.com/mockito/mockito +[20]: https://opensource.org/licenses/MIT +[21]: http://hamcrest.org/JavaHamcrest/ +[22]: https://raw.githubusercontent.com/hamcrest/JavaHamcrest/master/LICENSE +[23]: https://github.com/exasol/exasol-testcontainers/ +[24]: https://github.com/exasol/exasol-testcontainers/blob/main/LICENSE +[25]: https://java.testcontainers.org +[26]: http://opensource.org/licenses/MIT +[27]: https://github.com/exasol/test-db-builder-java/ +[28]: https://github.com/exasol/test-db-builder-java/blob/main/LICENSE +[29]: https://github.com/itsallcode/junit5-system-extensions +[30]: http://www.eclipse.org/legal/epl-v20.html +[31]: https://github.com/eclipse-ee4j/parsson +[32]: https://docs.sonarsource.com/sonarqube-server/latest/extension-guide/developing-a-plugin/plugin-basics/sonar-scanner-maven/sonar-maven-plugin/ +[33]: http://www.gnu.org/licenses/lgpl.txt +[34]: https://maven.apache.org/plugins/maven-toolchains-plugin/ +[35]: https://maven.apache.org/plugins/maven-compiler-plugin/ +[36]: https://maven.apache.org/enforcer/maven-enforcer-plugin/ +[37]: https://www.mojohaus.org/flatten-maven-plugin/ +[38]: https://sonatype.github.io/ossindex-maven/maven-plugin/ +[39]: http://www.apache.org/licenses/LICENSE-2.0.txt +[40]: https://maven.apache.org/surefire/maven-surefire-plugin/ +[41]: https://www.mojohaus.org/versions/versions-maven-plugin/ +[42]: https://basepom.github.io/duplicate-finder-maven-plugin +[43]: http://www.apache.org/licenses/LICENSE-2.0.html +[44]: https://maven.apache.org/plugins/maven-artifact-plugin/ +[45]: https://maven.apache.org/plugins/maven-deploy-plugin/ +[46]: https://maven.apache.org/plugins/maven-source-plugin/ +[47]: https://maven.apache.org/plugins/maven-javadoc-plugin/ +[48]: https://github.com/spdx/spdx-maven-plugin +[49]: https://www.mojohaus.org/build-helper-maven-plugin/ +[50]: https://spdx.org/licenses/MIT.txt +[51]: https://maven.apache.org/plugins/maven-gpg-plugin/ +[52]: https://central.sonatype.org +[53]: https://maven.apache.org/surefire/maven-failsafe-plugin/ +[54]: https://www.jacoco.org/jacoco/trunk/doc/maven.html +[55]: https://github.com/exasol/error-code-crawler-maven-plugin/ +[56]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE +[57]: https://github.com/git-commit-id/git-commit-id-maven-plugin +[58]: http://www.gnu.org/licenses/lgpl-3.0.txt +[59]: https://maven.apache.org/plugins/maven-dependency-plugin/ +[60]: https://github.com/exasol/project-keeper/ +[61]: https://github.com/exasol/project-keeper/blob/main/LICENSE +[62]: https://maven.apache.org/plugins/maven-clean-plugin/ +[63]: https://maven.apache.org/plugins/maven-resources-plugin/ +[64]: https://maven.apache.org/plugins/maven-install-plugin/ +[65]: https://maven.apache.org/plugins/maven-site-plugin/ diff --git a/doc/changes/changes_0.6.21.md b/doc/changes/changes_0.6.21.md index 7b7e0cb..fd2c4d8 100644 --- a/doc/changes/changes_0.6.21.md +++ b/doc/changes/changes_0.6.21.md @@ -1,40 +1,57 @@ -# Udf Debugging Java 0.6.21, released 2026-09-14 +# Udf Debugging Java 0.6.21, released 2026-10-16 -Code name: Fixed vulnerability CVE-2026-86231 in com.github.mwiede:jsch:jar:2.28.4:provided +Code name: ## Summary -This release fixes the following vulnerability: +This release fixes the following vulnerabilities by pinning the version of transitive dependencies `org.ow2.asm:*:9.11`. -### CVE-2026-86231 (CWE-298) in dependency `com.github.mwiede:jsch:jar:2.28.4:provided` -A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component. -#### References -* https://guide.sonatype.com/vulnerability/CVE-2026-86231?component-type=maven&component-name=com.github.mwiede%2Fjsch&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1 -* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-86231 -* https://github.com/mwiede/jsch/issues/1091 -* https://github.com/mwiede/jsch/pull/1098 -* https://github.com/mwiede/jsch/releases/tag/jsch-2.28.6 +* In `org.ow2.asm:asm:jar:9.10.1`: + * CVE-2026-110257: Uncontrolled Memory Allocation (6.8) + * CVE-2026-110258: Uncontrolled Memory Allocation (6.8 + * CVE-2026-110259: Uncontrolled Recursion (5.5) + * CVE-2026-110260: Algorithmic Complexity (5.5) + * CVE-2026-110261: Algorithmic Complexity (6.8) + * CVE-2026-110263: Uncontrolled Recursion (6.8) +* In `org.ow2.asm:asm-commons:jar:9.10.1` + * CVE-2026-110262: Allocation of Resources Without Limits or Throttling (4.8) + * CVE-2026-110270: Algorithmic Complexity (5.5) -## Security +## Features -* #88: Fixed vulnerability CVE-2026-86231 in dependency `com.github.mwiede:jsch:jar:2.28.4:provided` +* Fixed CVEs in transitive dependency `org.ow2.asm:*` (PR# 91) ## Dependency Updates ### Compile Dependency Updates -* Updated `com.exasol:bucketfs-java:4.0.0` to `5.0.0` -* Updated `org.slf4j:slf4j-jdk14:2.0.18` to `2.0.19` +* Updated `com.exasol:bucketfs-java:4.0.0` to `5.0.1` +* Added `org.ow2.asm:asm-commons:9.11` +* Added `org.ow2.asm:asm-tree:9.11` +* Added `org.ow2.asm:asm:9.11` +* Updated `org.slf4j:slf4j-jdk14:2.0.18` to `2.0.20` ### Test Dependency Updates * Updated `com.exasol:exasol-testcontainers:7.3.0` to `8.0.2` -* Updated `com.exasol:test-db-builder-java:4.0.1` to `4.0.2` +* Updated `com.exasol:test-db-builder-java:4.0.1` to `4.0.3` +* Updated `org.mockito:mockito-junit-jupiter:5.23.0` to `5.24.0` ### Plugin Dependency Updates -* Updated `com.exasol:error-code-crawler-maven-plugin:2.1.0` to `2.1.1` -* Updated `com.exasol:project-keeper-maven-plugin:5.7.3` to `5.7.5` +* Updated `com.exasol:error-code-crawler-maven-plugin:2.1.0` to `2.1.2` +* Updated `com.exasol:project-keeper-maven-plugin:5.7.3` to `5.7.7` * Updated `io.github.git-commit-id:git-commit-id-maven-plugin:10.0.0` to `10.0.1` +* Updated `org.apache.maven.plugins:maven-artifact-plugin:3.6.1` to `3.7.0` +* Updated `org.apache.maven.plugins:maven-compiler-plugin:3.15.0` to `3.16.0` +* Updated `org.apache.maven.plugins:maven-dependency-plugin:null` to `3.11.0` +* Updated `org.apache.maven.plugins:maven-deploy-plugin:3.1.4` to `3.2.0` +* Updated `org.apache.maven.plugins:maven-failsafe-plugin:3.5.6` to `3.6.0` +* Updated `org.apache.maven.plugins:maven-install-plugin:3.1.4` to `3.2.0` +* Updated `org.apache.maven.plugins:maven-surefire-plugin:3.5.6` to `3.6.0` * Updated `org.apache.maven.plugins:maven-toolchains-plugin:3.2.0` to `3.3.0` +* Updated `org.codehaus.mojo:build-helper-maven-plugin:3.6.1` to `3.6.2` * Updated `org.codehaus.mojo:flatten-maven-plugin:1.7.3` to `1.8.0` +* Updated `org.codehaus.mojo:versions-maven-plugin:2.21.0` to `2.23.0` +* Updated `org.sonarsource.scanner.maven:sonar-maven-plugin:5.7.0.6970` to `5.8.0.7211` +* Updated `org.sonatype.central:central-publishing-maven-plugin:0.11.0` to `0.12.0` diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom index 77b3187..08fe9a7 100644 --- a/pk_generated_parent.pom +++ b/pk_generated_parent.pom @@ -52,7 +52,7 @@ org.apache.maven.plugins maven-install-plugin - 3.1.4 + 3.2.0 org.apache.maven.plugins @@ -67,7 +67,7 @@ org.codehaus.mojo exec-maven-plugin - 3.6.3 + 3.6.4 true @@ -80,7 +80,7 @@ org.sonarsource.scanner.maven sonar-maven-plugin - 5.7.0.6970 + 5.8.0.7211 org.apache.maven.plugins @@ -104,7 +104,7 @@ org.apache.maven.plugins maven-compiler-plugin - 3.15.0 + 3.16.0 ${java.version} true @@ -184,7 +184,7 @@ org.apache.maven.plugins maven-surefire-plugin - 3.5.6 + 3.6.0 ${argLine} @@ -200,7 +200,7 @@ org.codehaus.mojo versions-maven-plugin - 2.21.0 + 2.23.0 display-updates @@ -255,7 +255,7 @@ org.apache.maven.plugins maven-artifact-plugin - 3.6.1 + 3.7.0 check-build-plan @@ -269,7 +269,7 @@ org.apache.maven.plugins maven-deploy-plugin - 3.1.4 + 3.2.0 true @@ -344,7 +344,7 @@ org.codehaus.mojo build-helper-maven-plugin - 3.6.1 + 3.6.2 attach-spdx-sbom @@ -376,6 +376,7 @@ sign + true --pinentry-mode loopback @@ -387,7 +388,7 @@ org.sonatype.central central-publishing-maven-plugin - 0.11.0 + 0.12.0 true maven-central-portal @@ -401,7 +402,7 @@ org.apache.maven.plugins maven-failsafe-plugin - 3.5.6 + 3.6.0 ${argLine} @@ -467,7 +468,7 @@ com.exasol error-code-crawler-maven-plugin - 2.1.1 + 2.1.2 verify diff --git a/pom.xml b/pom.xml index 5429798..0914162 100644 --- a/pom.xml +++ b/pom.xml @@ -6,9 +6,6 @@ udf-debugging-java Utilities for debugging, profiling and code coverage measure for UDFs. https://github.com/exasol/udf-debugging-java/ - - 0.8.15 - jakarta.json @@ -29,19 +26,38 @@ org.jacoco org.jacoco.core - ${jacoco.version} + 0.8.15 org.jacoco org.jacoco.agent - ${jacoco.version} + 0.8.15 runtime test + + + org.ow2.asm + asm + 9.11 + + + + org.ow2.asm + asm-commons + 9.11 + + + + org.ow2.asm + asm-tree + 9.11 + com.exasol bucketfs-java - 5.0.0 + 5.0.1 com.exasol @@ -69,7 +85,7 @@ org.mockito mockito-junit-jupiter - 5.23.0 + 5.24.0 test @@ -94,7 +110,7 @@ com.exasol test-db-builder-java - 4.0.2 + 4.0.3 test @@ -107,13 +123,14 @@ org.slf4j slf4j-jdk14 - 2.0.19 + 2.0.20 maven-dependency-plugin + 3.11.0 copy-jacoco @@ -133,7 +150,7 @@ com.exasol project-keeper-maven-plugin - 5.7.5 + 5.7.7