From 65c0a173401046faae71301db75c241737713670 Mon Sep 17 00:00:00 2001 From: redcatbear Date: Thu, 15 Oct 2026 11:04:08 +0200 Subject: [PATCH 1/8] #84: Pinned `org.ow2.asm:*:9.11` to fix vulnerabilities. --- doc/changes/changes_0.6.21.md | 30 +++++++++++++++-------------- pom.xml | 36 +++++++++++++++++++++++++---------- 2 files changed, 42 insertions(+), 24 deletions(-) diff --git a/doc/changes/changes_0.6.21.md b/doc/changes/changes_0.6.21.md index 7b7e0cb..bc8bfef 100644 --- a/doc/changes/changes_0.6.21.md +++ b/doc/changes/changes_0.6.21.md @@ -1,23 +1,25 @@ -# Udf Debugging Java 0.6.21, released 2026-09-14 +# Udf Debugging Java 0.6.21, released 2026-??-?? -Code name: Fixed vulnerability CVE-2026-86231 in com.github.mwiede:jsch:jar:2.28.4:provided +Code name: ## Summary -This release fixes the following vulnerability: +This release fixes the following vulnerabilities by pinning the version of transitive dependencies `org.ow2.asm:*:9.11`. -### CVE-2026-86231 (CWE-298) in dependency `com.github.mwiede:jsch:jar:2.28.4:provided` -A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component. -#### References -* https://guide.sonatype.com/vulnerability/CVE-2026-86231?component-type=maven&component-name=com.github.mwiede%2Fjsch&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1 -* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-86231 -* https://github.com/mwiede/jsch/issues/1091 -* https://github.com/mwiede/jsch/pull/1098 -* https://github.com/mwiede/jsch/releases/tag/jsch-2.28.6 +* In `org.ow2.asm:asm:jar:9.10.1`: + * CVE-2026-110257: Uncontrolled Memory Allocation (6.8) + * CVE-2026-110258: Uncontrolled Memory Allocation (6.8 + * CVE-2026-110259: Uncontrolled Recursion (5.5) + * CVE-2026-110260: Algorithmic Complexity (5.5) + * CVE-2026-110261: Algorithmic Complexity (6.8) + * CVE-2026-110263: Uncontrolled Recursion (6.8) +* In `org.ow2.asm:asm-commons:jar:9.10.1` + * CVE-2026-110262: Allocation of Resources Without Limits or Throttling (4.8) + * CVE-2026-110270: Algorithmic Complexity (5.5) -## Security +## Features -* #88: Fixed vulnerability CVE-2026-86231 in dependency `com.github.mwiede:jsch:jar:2.28.4:provided` +* ISSUE_NUMBER: description ## Dependency Updates @@ -34,7 +36,7 @@ A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the ### Plugin Dependency Updates * Updated `com.exasol:error-code-crawler-maven-plugin:2.1.0` to `2.1.1` -* Updated `com.exasol:project-keeper-maven-plugin:5.7.3` to `5.7.5` +* Updated `com.exasol:project-keeper-maven-plugin:5.7.3` to `5.7.6` * Updated `io.github.git-commit-id:git-commit-id-maven-plugin:10.0.0` to `10.0.1` * Updated `org.apache.maven.plugins:maven-toolchains-plugin:3.2.0` to `3.3.0` * Updated `org.codehaus.mojo:flatten-maven-plugin:1.7.3` to `1.8.0` diff --git a/pom.xml b/pom.xml index 5429798..7c58a54 100644 --- a/pom.xml +++ b/pom.xml @@ -6,9 +6,6 @@ udf-debugging-java Utilities for debugging, profiling and code coverage measure for UDFs. https://github.com/exasol/udf-debugging-java/ - - 0.8.15 - jakarta.json @@ -29,19 +26,38 @@ org.jacoco org.jacoco.core - ${jacoco.version} + 0.8.15 org.jacoco org.jacoco.agent - ${jacoco.version} + 0.8.15 runtime test + + + org.ow2.asm + asm + 9.11 + + + + org.ow2.asm + asm-commons + 9.11 + + + + org.ow2.asm + asm-tree + 9.11 + com.exasol bucketfs-java - 5.0.0 + 5.0.1 com.exasol @@ -69,7 +85,7 @@ org.mockito mockito-junit-jupiter - 5.23.0 + 5.24.0 test @@ -94,7 +110,7 @@ com.exasol test-db-builder-java - 4.0.2 + 4.0.3 test @@ -107,7 +123,7 @@ org.slf4j slf4j-jdk14 - 2.0.19 + 2.0.20 @@ -133,7 +149,7 @@ com.exasol project-keeper-maven-plugin - 5.7.5 + 5.7.6 From b9e4e650a48478170a5cc228bec274f62e0daa96 Mon Sep 17 00:00:00 2001 From: redcatbear Date: Thu, 15 Oct 2026 11:05:00 +0200 Subject: [PATCH 2/8] #84: Updated PK. --- .github/workflows/ci-build.yml | 30 ++-- .github/workflows/dependencies_check.yml | 8 +- .github/workflows/dependencies_update.yml | 2 +- .github/workflows/release.yml | 14 +- .settings/org.eclipse.jdt.core.prefs | 3 +- dependencies.md | 207 +++++++++++----------- doc/changes/changes_0.6.21.md | 21 ++- pk_generated_parent.pom | 23 +-- 8 files changed, 163 insertions(+), 145 deletions(-) diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml index e43cf83..6d154dc 100644 --- a/.github/workflows/ci-build.yml +++ b/.github/workflows/ci-build.yml @@ -57,7 +57,7 @@ jobs: } - name: Set up JDKs id: setup-java - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: |- @@ -87,7 +87,7 @@ jobs: run: | mvn --batch-mode clean verify \ -DossindexSkip=true \ - -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ + --no-transfer-progress \ -DtrimStackTrace=false \ -Dcom.exasol.dockerdb.image=${{ matrix.exasol_db_version }} env: { @@ -99,7 +99,7 @@ jobs: run: | mvn --batch-mode org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \ -DossindexSkip=true \ - -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ + --no-transfer-progress \ -DtrimStackTrace=false \ -Dsonar.token=$SONAR_TOKEN env: { @@ -188,7 +188,7 @@ jobs: } - name: Set up JDK 17 id: setup-java - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: { distribution: temurin, java-version: '17', @@ -198,7 +198,7 @@ jobs: id: build-next-java run: | mvn --batch-mode clean package -DtrimStackTrace=false -Djava.version=17 \ - -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ + --no-transfer-progress \ -DossindexSkip=true ossindex: runs-on: ubuntu-latest @@ -222,7 +222,7 @@ jobs: } - name: Set up JDKs id: setup-java - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: |- @@ -230,15 +230,15 @@ jobs: 21 cache: maven server-id: ossindex - server-username: OSSINDEX_USERNAME - server-password: OSSINDEX_API_TOKEN + server-username-env-var: OSSINDEX_USERNAME + server-password-env-var: OSSINDEX_API_TOKEN - name: Run Ossindex id: ossindex run: | mvn --batch-mode test-compile \ org.sonatype.ossindex.maven:ossindex-maven-plugin:audit \ org.sonatype.ossindex.maven:ossindex-maven-plugin:audit-aggregate \ - -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn + --no-transfer-progress env: { OSSINDEX_USERNAME: '${{ secrets.OSSINDEX_USERNAME }}', OSSINDEX_API_TOKEN: '${{ secrets.OSSINDEX_API_TOKEN }}' @@ -250,9 +250,7 @@ jobs: shell: bash } permissions: { - security-events: write, - contents: read, - actions: read + contents: read } concurrency: { group: '${{ github.workflow }}-github-actions-linter-${{ github.ref }}', @@ -265,9 +263,9 @@ jobs: with: { persist-credentials: false } - - name: Lint GitHub actions with Zizmore + - name: Lint GitHub actions with Zizmor id: lint-github-actions - uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa + uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 with: { advanced-security: false } @@ -300,7 +298,7 @@ jobs: } - name: Set up JDKs id: setup-java - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: |- @@ -335,7 +333,7 @@ jobs: actions: read, issues: read } - uses: ./.github/workflows/release.yml + uses: $/.github/workflows/release.yml with: { started-from-ci: true, maven-central-auto-publish: true diff --git a/.github/workflows/dependencies_check.yml b/.github/workflows/dependencies_check.yml index fa5164f..53b1831 100644 --- a/.github/workflows/dependencies_check.yml +++ b/.github/workflows/dependencies_check.yml @@ -33,7 +33,7 @@ jobs: } - name: Set up JDKs id: setup-jdks - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: |- @@ -41,8 +41,8 @@ jobs: 21 cache: maven server-id: ossindex - server-username: OSSINDEX_USERNAME - server-password: OSSINDEX_API_TOKEN + server-username-env-var: OSSINDEX_USERNAME + server-password-env-var: OSSINDEX_API_TOKEN - name: Generate ossindex report id: ossindex-report run: | @@ -82,7 +82,7 @@ jobs: contents: write, pull-requests: write } - uses: ./.github/workflows/dependencies_update.yml + uses: $/.github/workflows/dependencies_update.yml with: { vulnerability_issues: '${{ needs.report_security_issues.outputs.created-issues }}' } diff --git a/.github/workflows/dependencies_update.yml b/.github/workflows/dependencies_update.yml index 1986eae..9e75866 100644 --- a/.github/workflows/dependencies_update.yml +++ b/.github/workflows/dependencies_update.yml @@ -42,7 +42,7 @@ jobs: } - name: Set up JDKs id: setup-jdks - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: |- diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 515d750..35ca410 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -83,21 +83,21 @@ jobs: - name: Set up Maven Central Repository id: configure-maven-central-credentials if: ${{ true }} - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: |- 11 21 server-id: maven-central-portal - server-username: MAVEN_USERNAME - server-password: MAVEN_PASSWORD + server-username-env-var: MAVEN_USERNAME + server-password-env-var: MAVEN_PASSWORD gpg-private-key: ${{ secrets.OSSRH_GPG_SECRET_KEY }} - gpg-passphrase: MAVEN_GPG_PASSPHRASE + gpg-passphrase-env-var: MAVEN_GPG_PASSPHRASE - name: Set up JDKs id: setup-jdks if: ${{ ! true }} - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: distribution: temurin java-version: |- @@ -146,7 +146,7 @@ jobs: - { name: Build project, id: build, - run: mvn --batch-mode -DskipTests -DossindexSkip=true clean verify + run: mvn --batch-mode -DskipTests -DskipITs -DossindexSkip=true clean verify } - { name: List secret GPG keys, @@ -159,7 +159,7 @@ jobs: if: ${{ true && (! inputs.skip-maven-central) }} run: | echo "#### Maven Central Release" >> "$GITHUB_STEP_SUMMARY" - mvn --batch-mode -Dgpg.skip=false -DskipTests -DossindexSkip=true deploy \ + mvn --batch-mode -Dgpg.skip=false -DskipTests -DskipITs -DossindexSkip=true deploy \ -Dcentral-publishing.deploymentName="Auto release of repo ${{ github.repository }} using PK release.yml" \ -Dcentral-publishing.autoPublish=${{ inputs.maven-central-auto-publish }} if [[ "${{ inputs.maven-central-auto-publish }}" == "true" ]]; then diff --git a/.settings/org.eclipse.jdt.core.prefs b/.settings/org.eclipse.jdt.core.prefs index 6e2bc99..aafba62 100644 --- a/.settings/org.eclipse.jdt.core.prefs +++ b/.settings/org.eclipse.jdt.core.prefs @@ -258,6 +258,7 @@ org.eclipse.jdt.core.formatter.insert_new_line_after_annotation_on_local_variabl org.eclipse.jdt.core.formatter.insert_new_line_after_annotation_on_method=insert org.eclipse.jdt.core.formatter.insert_new_line_after_annotation_on_package=insert org.eclipse.jdt.core.formatter.insert_new_line_after_annotation_on_parameter=do not insert +org.eclipse.jdt.core.formatter.insert_new_line_after_annotation_on_record_parameter=do not insert org.eclipse.jdt.core.formatter.insert_new_line_after_annotation_on_type=insert org.eclipse.jdt.core.formatter.insert_new_line_after_label=do not insert org.eclipse.jdt.core.formatter.insert_new_line_after_opening_brace_in_array_initializer=do not insert @@ -508,7 +509,7 @@ org.eclipse.jdt.core.formatter.put_text_block_quotes_on_new_line=false org.eclipse.jdt.core.formatter.tabulation.char=space org.eclipse.jdt.core.formatter.tabulation.size=4 org.eclipse.jdt.core.formatter.text_block_indentation=0 -org.eclipse.jdt.core.formatter.use_on_off_tags=false +org.eclipse.jdt.core.formatter.use_on_off_tags=true org.eclipse.jdt.core.formatter.use_tabs_only_for_leading_indentations=true org.eclipse.jdt.core.formatter.wrap_before_additive_operator=true org.eclipse.jdt.core.formatter.wrap_before_assertion_message_operator=true diff --git a/dependencies.md b/dependencies.md index 6528a39..1cec8da 100644 --- a/dependencies.md +++ b/dependencies.md @@ -3,66 +3,69 @@ ## Compile Dependencies -| Dependency | License | -| --------------------------------------- | ------------------------------------------------------------------------------------------------------------ | -| [Jakarta JSON Processing API][0] | [Eclipse Public License 2.0][1]; [GNU General Public License, version 2 with the GNU Classpath Exception][2] | -| [error-reporting-java][3] | [MIT License][4] | -| [JaCoCo :: Core][5] | [EPL-2.0][6] | -| [BucketFS Java][7] | [MIT License][8] | -| [exasol-test-setup-abstraction-java][9] | [MIT License][10] | -| [Apache Commons Compress][11] | [Apache-2.0][12] | -| [SLF4J JDK14 Provider][13] | [MIT][14] | +| Dependency | License | +| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------ | +| [Jakarta JSON Processing API][0] | [Eclipse Public License 2.0][1]; [GNU General Public License, version 2 with the GNU Classpath Exception][2] | +| [error-reporting-java][3] | [MIT License][4] | +| [JaCoCo :: Core][5] | [EPL-2.0][6] | +| [asm][7] | [BSD-3-Clause][8] | +| [asm-commons][7] | [BSD-3-Clause][8] | +| [asm-tree][7] | [BSD-3-Clause][8] | +| [BucketFS Java][9] | [MIT License][10] | +| [exasol-test-setup-abstraction-java][11] | [MIT License][12] | +| [Apache Commons Compress][13] | [Apache-2.0][14] | +| [SLF4J JDK14 Provider][15] | [MIT][16] | ## Test Dependencies | Dependency | License | | ----------------------------------------------- | --------------------------------- | | [JaCoCo :: Agent][5] | [EPL-2.0][6] | -| [JUnit Jupiter Params][15] | [Eclipse Public License v2.0][16] | -| [mockito-junit-jupiter][17] | [MIT][18] | -| [Hamcrest][19] | [BSD-3-Clause][20] | -| [Test containers for Exasol on Docker][21] | [MIT License][22] | -| [Testcontainers :: JUnit Jupiter Extension][23] | [MIT][24] | -| [Test Database Builder for Java][25] | [MIT License][26] | -| [JUnit5 System Extensions][27] | [Eclipse Public License v2.0][28] | +| [JUnit Jupiter Params][17] | [Eclipse Public License v2.0][18] | +| [mockito-junit-jupiter][19] | [MIT][20] | +| [Hamcrest][21] | [BSD-3-Clause][22] | +| [Test containers for Exasol on Docker][23] | [MIT License][24] | +| [Testcontainers :: JUnit Jupiter Extension][25] | [MIT][26] | +| [Test Database Builder for Java][27] | [MIT License][28] | +| [JUnit5 System Extensions][29] | [Eclipse Public License v2.0][30] | ## Runtime Dependencies | Dependency | License | | --------------------- | ------------------------------------------------------------------------------------------------------------ | -| [Eclipse Parsson][29] | [Eclipse Public License 2.0][1]; [GNU General Public License, version 2 with the GNU Classpath Exception][2] | +| [Eclipse Parsson][31] | [Eclipse Public License 2.0][1]; [GNU General Public License, version 2 with the GNU Classpath Exception][2] | ## Plugin Dependencies | Dependency | License | | ------------------------------------------------------- | ---------------------------------------------- | -| [SonarQube Scanner for Maven][30] | [GNU LGPL 3][31] | -| [Apache Maven Toolchains Plugin][32] | [Apache-2.0][12] | -| [Apache Maven Compiler Plugin][33] | [Apache-2.0][12] | -| [Apache Maven Enforcer Plugin][34] | [Apache-2.0][12] | -| [Maven Flatten Plugin][35] | [Apache Software License][12] | -| [org.sonatype.ossindex.maven:ossindex-maven-plugin][36] | [ASL2][37] | -| [Maven Surefire Plugin][38] | [Apache-2.0][12] | -| [Versions Maven Plugin][39] | [Apache License, Version 2.0][12] | -| [duplicate-finder-maven-plugin Maven Mojo][40] | [Apache License 2.0][41] | -| [Apache Maven Artifact Plugin][42] | [Apache-2.0][12] | -| [Apache Maven Deploy Plugin][43] | [Apache-2.0][12] | -| [Apache Maven Source Plugin][44] | [Apache-2.0][12] | -| [Apache Maven Javadoc Plugin][45] | [Apache-2.0][12] | -| [spdx-maven-plugin Maven Plugin][46] | [The Apache Software License, Version 2.0][37] | -| [Build Helper Maven Plugin][47] | [The MIT License][48] | -| [Apache Maven GPG Plugin][49] | [Apache-2.0][12] | -| [Central Publishing Maven Plugin][50] | [The Apache License, Version 2.0][12] | -| [Maven Failsafe Plugin][51] | [Apache-2.0][12] | -| [JaCoCo :: Maven Plugin][52] | [EPL-2.0][6] | -| [error-code-crawler-maven-plugin][53] | [MIT License][54] | -| [Git Commit Id Maven Plugin][55] | [GNU Lesser General Public License 3.0][56] | -| [Apache Maven Dependency Plugin][57] | [Apache-2.0][12] | -| [Project Keeper Maven plugin][58] | [The MIT License][59] | -| [Apache Maven Clean Plugin][60] | [Apache-2.0][12] | -| [Apache Maven Resources Plugin][61] | [Apache-2.0][12] | -| [Apache Maven Install Plugin][62] | [Apache-2.0][12] | -| [Apache Maven Site Plugin][63] | [Apache-2.0][12] | +| [SonarQube Scanner for Maven][32] | [GNU LGPL 3][33] | +| [Apache Maven Toolchains Plugin][34] | [Apache-2.0][14] | +| [Apache Maven Compiler Plugin][35] | [Apache-2.0][14] | +| [Apache Maven Enforcer Plugin][36] | [Apache-2.0][14] | +| [Maven Flatten Plugin][37] | [Apache Software License][14] | +| [org.sonatype.ossindex.maven:ossindex-maven-plugin][38] | [ASL2][39] | +| [Maven Surefire Plugin][40] | [Apache-2.0][14] | +| [Versions Maven Plugin][41] | [Apache License, Version 2.0][14] | +| [duplicate-finder-maven-plugin Maven Mojo][42] | [Apache License 2.0][43] | +| [Apache Maven Artifact Plugin][44] | [Apache-2.0][14] | +| [Apache Maven Deploy Plugin][45] | [Apache-2.0][14] | +| [Apache Maven Source Plugin][46] | [Apache-2.0][14] | +| [Apache Maven Javadoc Plugin][47] | [Apache-2.0][14] | +| [spdx-maven-plugin Maven Plugin][48] | [The Apache Software License, Version 2.0][39] | +| [Build Helper Maven Plugin][49] | [The MIT License][50] | +| [Apache Maven GPG Plugin][51] | [Apache-2.0][14] | +| [Central Publishing Maven Plugin][52] | [The Apache License, Version 2.0][14] | +| [Maven Failsafe Plugin][53] | [Apache-2.0][14] | +| [JaCoCo :: Maven Plugin][54] | [EPL-2.0][6] | +| [error-code-crawler-maven-plugin][55] | [MIT License][56] | +| [Git Commit Id Maven Plugin][57] | [GNU Lesser General Public License 3.0][58] | +| [Apache Maven Dependency Plugin][59] | [Apache-2.0][14] | +| [Project Keeper Maven plugin][60] | [The MIT License][61] | +| [Apache Maven Clean Plugin][62] | [Apache-2.0][14] | +| [Apache Maven Resources Plugin][63] | [Apache-2.0][14] | +| [Apache Maven Install Plugin][64] | [Apache-2.0][14] | +| [Apache Maven Site Plugin][65] | [Apache-2.0][14] | [0]: https://github.com/eclipse-ee4j/jsonp [1]: https://projects.eclipse.org/license/epl-2.0 @@ -71,60 +74,62 @@ [4]: https://github.com/exasol/error-reporting-java/blob/main/LICENSE [5]: https://www.eclemma.org/jacoco/index.html [6]: https://www.eclipse.org/legal/epl-2.0/ -[7]: https://github.com/exasol/bucketfs-java/ -[8]: https://github.com/exasol/bucketfs-java/blob/main/LICENSE -[9]: https://github.com/exasol/exasol-test-setup-abstraction-java/ -[10]: https://github.com/exasol/exasol-test-setup-abstraction-java/blob/main/LICENSE -[11]: https://commons.apache.org/proper/commons-compress/ -[12]: https://www.apache.org/licenses/LICENSE-2.0.txt -[13]: http://www.slf4j.org -[14]: https://opensource.org/license/mit -[15]: https://junit.org/ -[16]: https://www.eclipse.org/legal/epl-v20.html -[17]: https://github.com/mockito/mockito -[18]: https://opensource.org/licenses/MIT -[19]: http://hamcrest.org/JavaHamcrest/ -[20]: https://raw.githubusercontent.com/hamcrest/JavaHamcrest/master/LICENSE -[21]: https://github.com/exasol/exasol-testcontainers/ -[22]: https://github.com/exasol/exasol-testcontainers/blob/main/LICENSE -[23]: https://java.testcontainers.org -[24]: http://opensource.org/licenses/MIT -[25]: https://github.com/exasol/test-db-builder-java/ -[26]: https://github.com/exasol/test-db-builder-java/blob/main/LICENSE -[27]: https://github.com/itsallcode/junit5-system-extensions -[28]: http://www.eclipse.org/legal/epl-v20.html -[29]: https://github.com/eclipse-ee4j/parsson -[30]: https://docs.sonarsource.com/sonarqube-server/latest/extension-guide/developing-a-plugin/plugin-basics/sonar-scanner-maven/sonar-maven-plugin/ -[31]: http://www.gnu.org/licenses/lgpl.txt -[32]: https://maven.apache.org/plugins/maven-toolchains-plugin/ -[33]: https://maven.apache.org/plugins/maven-compiler-plugin/ -[34]: https://maven.apache.org/enforcer/maven-enforcer-plugin/ -[35]: https://www.mojohaus.org/flatten-maven-plugin/ -[36]: https://sonatype.github.io/ossindex-maven/maven-plugin/ -[37]: http://www.apache.org/licenses/LICENSE-2.0.txt -[38]: https://maven.apache.org/surefire/maven-surefire-plugin/ -[39]: https://www.mojohaus.org/versions/versions-maven-plugin/ -[40]: https://basepom.github.io/duplicate-finder-maven-plugin -[41]: http://www.apache.org/licenses/LICENSE-2.0.html -[42]: https://maven.apache.org/plugins/maven-artifact-plugin/ -[43]: https://maven.apache.org/plugins/maven-deploy-plugin/ -[44]: https://maven.apache.org/plugins/maven-source-plugin/ -[45]: https://maven.apache.org/plugins/maven-javadoc-plugin/ -[46]: https://github.com/spdx/spdx-maven-plugin -[47]: https://www.mojohaus.org/build-helper-maven-plugin/ -[48]: https://spdx.org/licenses/MIT.txt -[49]: https://maven.apache.org/plugins/maven-gpg-plugin/ -[50]: https://central.sonatype.org -[51]: https://maven.apache.org/surefire/maven-failsafe-plugin/ -[52]: https://www.jacoco.org/jacoco/trunk/doc/maven.html -[53]: https://github.com/exasol/error-code-crawler-maven-plugin/ -[54]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE -[55]: https://github.com/git-commit-id/git-commit-id-maven-plugin -[56]: http://www.gnu.org/licenses/lgpl-3.0.txt -[57]: https://maven.apache.org/plugins/maven-dependency-plugin/ -[58]: https://github.com/exasol/project-keeper/ -[59]: https://github.com/exasol/project-keeper/blob/main/LICENSE -[60]: https://maven.apache.org/plugins/maven-clean-plugin/ -[61]: https://maven.apache.org/plugins/maven-resources-plugin/ -[62]: https://maven.apache.org/plugins/maven-install-plugin/ -[63]: https://maven.apache.org/plugins/maven-site-plugin/ +[7]: http://asm.ow2.io/ +[8]: https://asm.ow2.io/license.html +[9]: https://github.com/exasol/bucketfs-java/ +[10]: https://github.com/exasol/bucketfs-java/blob/main/LICENSE +[11]: https://github.com/exasol/exasol-test-setup-abstraction-java/ +[12]: https://github.com/exasol/exasol-test-setup-abstraction-java/blob/main/LICENSE +[13]: https://commons.apache.org/proper/commons-compress/ +[14]: https://www.apache.org/licenses/LICENSE-2.0.txt +[15]: http://www.slf4j.org +[16]: https://opensource.org/license/mit +[17]: https://junit.org/ +[18]: https://www.eclipse.org/legal/epl-v20.html +[19]: https://github.com/mockito/mockito +[20]: https://opensource.org/licenses/MIT +[21]: http://hamcrest.org/JavaHamcrest/ +[22]: https://raw.githubusercontent.com/hamcrest/JavaHamcrest/master/LICENSE +[23]: https://github.com/exasol/exasol-testcontainers/ +[24]: https://github.com/exasol/exasol-testcontainers/blob/main/LICENSE +[25]: https://java.testcontainers.org +[26]: http://opensource.org/licenses/MIT +[27]: https://github.com/exasol/test-db-builder-java/ +[28]: https://github.com/exasol/test-db-builder-java/blob/main/LICENSE +[29]: https://github.com/itsallcode/junit5-system-extensions +[30]: http://www.eclipse.org/legal/epl-v20.html +[31]: https://github.com/eclipse-ee4j/parsson +[32]: https://docs.sonarsource.com/sonarqube-server/latest/extension-guide/developing-a-plugin/plugin-basics/sonar-scanner-maven/sonar-maven-plugin/ +[33]: http://www.gnu.org/licenses/lgpl.txt +[34]: https://maven.apache.org/plugins/maven-toolchains-plugin/ +[35]: https://maven.apache.org/plugins/maven-compiler-plugin/ +[36]: https://maven.apache.org/enforcer/maven-enforcer-plugin/ +[37]: https://www.mojohaus.org/flatten-maven-plugin/ +[38]: https://sonatype.github.io/ossindex-maven/maven-plugin/ +[39]: http://www.apache.org/licenses/LICENSE-2.0.txt +[40]: https://maven.apache.org/surefire/maven-surefire-plugin/ +[41]: https://www.mojohaus.org/versions/versions-maven-plugin/ +[42]: https://basepom.github.io/duplicate-finder-maven-plugin +[43]: http://www.apache.org/licenses/LICENSE-2.0.html +[44]: https://maven.apache.org/plugins/maven-artifact-plugin/ +[45]: https://maven.apache.org/plugins/maven-deploy-plugin/ +[46]: https://maven.apache.org/plugins/maven-source-plugin/ +[47]: https://maven.apache.org/plugins/maven-javadoc-plugin/ +[48]: https://github.com/spdx/spdx-maven-plugin +[49]: https://www.mojohaus.org/build-helper-maven-plugin/ +[50]: https://spdx.org/licenses/MIT.txt +[51]: https://maven.apache.org/plugins/maven-gpg-plugin/ +[52]: https://central.sonatype.org +[53]: https://maven.apache.org/surefire/maven-failsafe-plugin/ +[54]: https://www.jacoco.org/jacoco/trunk/doc/maven.html +[55]: https://github.com/exasol/error-code-crawler-maven-plugin/ +[56]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE +[57]: https://github.com/git-commit-id/git-commit-id-maven-plugin +[58]: http://www.gnu.org/licenses/lgpl-3.0.txt +[59]: https://maven.apache.org/plugins/maven-dependency-plugin/ +[60]: https://github.com/exasol/project-keeper/ +[61]: https://github.com/exasol/project-keeper/blob/main/LICENSE +[62]: https://maven.apache.org/plugins/maven-clean-plugin/ +[63]: https://maven.apache.org/plugins/maven-resources-plugin/ +[64]: https://maven.apache.org/plugins/maven-install-plugin/ +[65]: https://maven.apache.org/plugins/maven-site-plugin/ diff --git a/doc/changes/changes_0.6.21.md b/doc/changes/changes_0.6.21.md index bc8bfef..eceb51e 100644 --- a/doc/changes/changes_0.6.21.md +++ b/doc/changes/changes_0.6.21.md @@ -25,18 +25,31 @@ This release fixes the following vulnerabilities by pinning the version of trans ### Compile Dependency Updates -* Updated `com.exasol:bucketfs-java:4.0.0` to `5.0.0` -* Updated `org.slf4j:slf4j-jdk14:2.0.18` to `2.0.19` +* Updated `com.exasol:bucketfs-java:4.0.0` to `5.0.1` +* Added `org.ow2.asm:asm-commons:9.11` +* Added `org.ow2.asm:asm-tree:9.11` +* Added `org.ow2.asm:asm:9.11` +* Updated `org.slf4j:slf4j-jdk14:2.0.18` to `2.0.20` ### Test Dependency Updates * Updated `com.exasol:exasol-testcontainers:7.3.0` to `8.0.2` -* Updated `com.exasol:test-db-builder-java:4.0.1` to `4.0.2` +* Updated `com.exasol:test-db-builder-java:4.0.1` to `4.0.3` +* Updated `org.mockito:mockito-junit-jupiter:5.23.0` to `5.24.0` ### Plugin Dependency Updates -* Updated `com.exasol:error-code-crawler-maven-plugin:2.1.0` to `2.1.1` +* Updated `com.exasol:error-code-crawler-maven-plugin:2.1.0` to `2.1.2` * Updated `com.exasol:project-keeper-maven-plugin:5.7.3` to `5.7.6` * Updated `io.github.git-commit-id:git-commit-id-maven-plugin:10.0.0` to `10.0.1` +* Updated `org.apache.maven.plugins:maven-artifact-plugin:3.6.1` to `3.7.0` +* Updated `org.apache.maven.plugins:maven-compiler-plugin:3.15.0` to `3.16.0` +* Updated `org.apache.maven.plugins:maven-deploy-plugin:3.1.4` to `3.2.0` +* Updated `org.apache.maven.plugins:maven-failsafe-plugin:3.5.6` to `3.6.0` +* Updated `org.apache.maven.plugins:maven-install-plugin:3.1.4` to `3.2.0` +* Updated `org.apache.maven.plugins:maven-surefire-plugin:3.5.6` to `3.6.0` * Updated `org.apache.maven.plugins:maven-toolchains-plugin:3.2.0` to `3.3.0` +* Updated `org.codehaus.mojo:build-helper-maven-plugin:3.6.1` to `3.6.2` * Updated `org.codehaus.mojo:flatten-maven-plugin:1.7.3` to `1.8.0` +* Updated `org.codehaus.mojo:versions-maven-plugin:2.21.0` to `2.22.0` +* Updated `org.sonarsource.scanner.maven:sonar-maven-plugin:5.7.0.6970` to `5.8.0.7211` diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom index 77b3187..68ff6c0 100644 --- a/pk_generated_parent.pom +++ b/pk_generated_parent.pom @@ -52,7 +52,7 @@ org.apache.maven.plugins maven-install-plugin - 3.1.4 + 3.2.0 org.apache.maven.plugins @@ -67,7 +67,7 @@ org.codehaus.mojo exec-maven-plugin - 3.6.3 + 3.6.4 true @@ -80,7 +80,7 @@ org.sonarsource.scanner.maven sonar-maven-plugin - 5.7.0.6970 + 5.8.0.7211 org.apache.maven.plugins @@ -104,7 +104,7 @@ org.apache.maven.plugins maven-compiler-plugin - 3.15.0 + 3.16.0 ${java.version} true @@ -184,7 +184,7 @@ org.apache.maven.plugins maven-surefire-plugin - 3.5.6 + 3.6.0 ${argLine} @@ -200,7 +200,7 @@ org.codehaus.mojo versions-maven-plugin - 2.21.0 + 2.22.0 display-updates @@ -255,7 +255,7 @@ org.apache.maven.plugins maven-artifact-plugin - 3.6.1 + 3.7.0 check-build-plan @@ -269,7 +269,7 @@ org.apache.maven.plugins maven-deploy-plugin - 3.1.4 + 3.2.0 true @@ -344,7 +344,7 @@ org.codehaus.mojo build-helper-maven-plugin - 3.6.1 + 3.6.2 attach-spdx-sbom @@ -376,6 +376,7 @@ sign + true --pinentry-mode loopback @@ -401,7 +402,7 @@ org.apache.maven.plugins maven-failsafe-plugin - 3.5.6 + 3.6.0 ${argLine} @@ -467,7 +468,7 @@ com.exasol error-code-crawler-maven-plugin - 2.1.1 + 2.1.2 verify From 222c468ba4dea5380f39be89b52465755f43a3bc Mon Sep 17 00:00:00 2001 From: redcatbear Date: Thu, 15 Oct 2026 11:37:15 +0200 Subject: [PATCH 3/8] Pinned `maven-dependency-plugin` to 3.11.0. --- pom.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/pom.xml b/pom.xml index 7c58a54..76ef98f 100644 --- a/pom.xml +++ b/pom.xml @@ -130,6 +130,7 @@ maven-dependency-plugin + 3.11.0 copy-jacoco From 06c5dfe0d8e018436f85f271547c5e04cb7062a8 Mon Sep 17 00:00:00 2001 From: redcatbear Date: Thu, 15 Oct 2026 11:39:31 +0200 Subject: [PATCH 4/8] Updated changelog. --- doc/changes/changes_0.6.21.md | 1 + 1 file changed, 1 insertion(+) diff --git a/doc/changes/changes_0.6.21.md b/doc/changes/changes_0.6.21.md index eceb51e..5c03c31 100644 --- a/doc/changes/changes_0.6.21.md +++ b/doc/changes/changes_0.6.21.md @@ -44,6 +44,7 @@ This release fixes the following vulnerabilities by pinning the version of trans * Updated `io.github.git-commit-id:git-commit-id-maven-plugin:10.0.0` to `10.0.1` * Updated `org.apache.maven.plugins:maven-artifact-plugin:3.6.1` to `3.7.0` * Updated `org.apache.maven.plugins:maven-compiler-plugin:3.15.0` to `3.16.0` +* Updated `org.apache.maven.plugins:maven-dependency-plugin:3.7.0` to `3.11.0` * Updated `org.apache.maven.plugins:maven-deploy-plugin:3.1.4` to `3.2.0` * Updated `org.apache.maven.plugins:maven-failsafe-plugin:3.5.6` to `3.6.0` * Updated `org.apache.maven.plugins:maven-install-plugin:3.1.4` to `3.2.0` From 78afd214318cbee18af28c481637d933eda4f071 Mon Sep 17 00:00:00 2001 From: redcatbear Date: Fri, 16 Oct 2026 08:01:33 +0200 Subject: [PATCH 5/8] 91: Changed change log entry to: * Updated `org.apache.maven.plugins:maven-dependency-plugin:null` to `3.11.0` --- doc/changes/changes_0.6.21.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/changes/changes_0.6.21.md b/doc/changes/changes_0.6.21.md index 5c03c31..3975611 100644 --- a/doc/changes/changes_0.6.21.md +++ b/doc/changes/changes_0.6.21.md @@ -44,7 +44,7 @@ This release fixes the following vulnerabilities by pinning the version of trans * Updated `io.github.git-commit-id:git-commit-id-maven-plugin:10.0.0` to `10.0.1` * Updated `org.apache.maven.plugins:maven-artifact-plugin:3.6.1` to `3.7.0` * Updated `org.apache.maven.plugins:maven-compiler-plugin:3.15.0` to `3.16.0` -* Updated `org.apache.maven.plugins:maven-dependency-plugin:3.7.0` to `3.11.0` +* Updated `org.apache.maven.plugins:maven-dependency-plugin:null` to `3.11.0` * Updated `org.apache.maven.plugins:maven-deploy-plugin:3.1.4` to `3.2.0` * Updated `org.apache.maven.plugins:maven-failsafe-plugin:3.5.6` to `3.6.0` * Updated `org.apache.maven.plugins:maven-install-plugin:3.1.4` to `3.2.0` From 15007bb505a7f48f2f49a0fa8df660c8b7a3a200 Mon Sep 17 00:00:00 2001 From: redcatbear Date: Fri, 16 Oct 2026 08:09:41 +0200 Subject: [PATCH 6/8] #91: Fixed mention of PR. --- doc/changes/changes_0.6.21.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/changes/changes_0.6.21.md b/doc/changes/changes_0.6.21.md index 3975611..45cd5e2 100644 --- a/doc/changes/changes_0.6.21.md +++ b/doc/changes/changes_0.6.21.md @@ -19,7 +19,7 @@ This release fixes the following vulnerabilities by pinning the version of trans ## Features -* ISSUE_NUMBER: description +* Fixed CVEs in transitive dependency `org.ow2.asm:*` (PR# 91) ## Dependency Updates From 73635980dc0faadf022f1859ce72c49b9eda34df Mon Sep 17 00:00:00 2001 From: redcatbear Date: Fri, 16 Oct 2026 10:23:24 +0200 Subject: [PATCH 7/8] #91: Updated MC publishing plugin. --- doc/changes/changes_0.6.21.md | 5 +++-- pk_generated_parent.pom | 4 ++-- pom.xml | 2 +- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/doc/changes/changes_0.6.21.md b/doc/changes/changes_0.6.21.md index 45cd5e2..7861347 100644 --- a/doc/changes/changes_0.6.21.md +++ b/doc/changes/changes_0.6.21.md @@ -40,7 +40,7 @@ This release fixes the following vulnerabilities by pinning the version of trans ### Plugin Dependency Updates * Updated `com.exasol:error-code-crawler-maven-plugin:2.1.0` to `2.1.2` -* Updated `com.exasol:project-keeper-maven-plugin:5.7.3` to `5.7.6` +* Updated `com.exasol:project-keeper-maven-plugin:5.7.3` to `5.7.7` * Updated `io.github.git-commit-id:git-commit-id-maven-plugin:10.0.0` to `10.0.1` * Updated `org.apache.maven.plugins:maven-artifact-plugin:3.6.1` to `3.7.0` * Updated `org.apache.maven.plugins:maven-compiler-plugin:3.15.0` to `3.16.0` @@ -52,5 +52,6 @@ This release fixes the following vulnerabilities by pinning the version of trans * Updated `org.apache.maven.plugins:maven-toolchains-plugin:3.2.0` to `3.3.0` * Updated `org.codehaus.mojo:build-helper-maven-plugin:3.6.1` to `3.6.2` * Updated `org.codehaus.mojo:flatten-maven-plugin:1.7.3` to `1.8.0` -* Updated `org.codehaus.mojo:versions-maven-plugin:2.21.0` to `2.22.0` +* Updated `org.codehaus.mojo:versions-maven-plugin:2.21.0` to `2.23.0` * Updated `org.sonarsource.scanner.maven:sonar-maven-plugin:5.7.0.6970` to `5.8.0.7211` +* Updated `org.sonatype.central:central-publishing-maven-plugin:0.11.0` to `0.12.0` diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom index 68ff6c0..08fe9a7 100644 --- a/pk_generated_parent.pom +++ b/pk_generated_parent.pom @@ -200,7 +200,7 @@ org.codehaus.mojo versions-maven-plugin - 2.22.0 + 2.23.0 display-updates @@ -388,7 +388,7 @@ org.sonatype.central central-publishing-maven-plugin - 0.11.0 + 0.12.0 true maven-central-portal diff --git a/pom.xml b/pom.xml index 76ef98f..0914162 100644 --- a/pom.xml +++ b/pom.xml @@ -150,7 +150,7 @@ com.exasol project-keeper-maven-plugin - 5.7.6 + 5.7.7 From ed675a58bd758ddbeb0d38c7f3793f1cc2829f0a Mon Sep 17 00:00:00 2001 From: redcatbear Date: Fri, 16 Oct 2026 10:33:23 +0200 Subject: [PATCH 8/8] #91: Updated release date. --- doc/changes/changes_0.6.21.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/changes/changes_0.6.21.md b/doc/changes/changes_0.6.21.md index 7861347..fd2c4d8 100644 --- a/doc/changes/changes_0.6.21.md +++ b/doc/changes/changes_0.6.21.md @@ -1,4 +1,4 @@ -# Udf Debugging Java 0.6.21, released 2026-??-?? +# Udf Debugging Java 0.6.21, released 2026-10-16 Code name: