From 78b8d14955c4b31bd8e4937cddb18ee2d506c5db Mon Sep 17 00:00:00 2001 From: Christoph Pirkl Date: Mon, 3 Jul 2023 13:28:34 +0200 Subject: [PATCH 1/2] #57: Updated dependencies --- README.md | 2 +- dependencies.md | 73 +++++++++++++++++++----------------- doc/changes/changelog.md | 1 + doc/changes/changes_0.6.9.md | 48 ++++++++++++++++++++++++ pk_generated_parent.pom | 50 ++++++++++++++++++------ pom.xml | 43 ++++++++++----------- 6 files changed, 145 insertions(+), 72 deletions(-) create mode 100644 doc/changes/changes_0.6.9.md diff --git a/README.md b/README.md index ba0ad23..8229587 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # UDF Debugging Tools for Java [![Build Status](https://github.com/exasol/udf-debugging-java/actions/workflows/ci-build.yml/badge.svg)](https://github.com/exasol/udf-debugging-java/actions/workflows/ci-build.yml) -[![Maven Central – udf-debugging-java](https://img.shields.io/maven-central/v/com.exasol/udf-debugging-java)](https://search.maven.org/artifact/com.exasol/udf-debugging-java) +[![Maven Central – udf-debugging-java](https://img.shields.io/maven-central/v/com.exasol/udf-debugging-java)](https://search.maven.org/artifact/com.exasol/udf-debugging-java) [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=com.exasol%3Audf-debugging-java&metric=alert_status)](https://sonarcloud.io/dashboard?id=com.exasol%3Audf-debugging-java) diff --git a/dependencies.md b/dependencies.md index 880f428..a75fc87 100644 --- a/dependencies.md +++ b/dependencies.md @@ -10,8 +10,8 @@ | [JaCoCo :: Core][5] | [Eclipse Public License 2.0][6] | | [BucketFS Java][7] | [MIT License][8] | | [exasol-test-setup-abstraction-java][9] | [MIT License][10] | -| [Apache Commons Compress][11] | [Apache License, Version 2.0][12] | -| [SLF4J API Module][13] | [MIT License][14] | +| [Apache Commons Compress][11] | [Apache-2.0][12] | +| [SLF4J JDK14 Binding][13] | [MIT License][14] | ## Test Dependencies @@ -38,28 +38,29 @@ | Dependency | License | | ------------------------------------------------------- | ---------------------------------------------- | | [SonarQube Scanner for Maven][29] | [GNU LGPL 3][30] | -| [Apache Maven Compiler Plugin][31] | [Apache License, Version 2.0][12] | -| [Apache Maven Enforcer Plugin][32] | [Apache License, Version 2.0][12] | +| [Apache Maven Compiler Plugin][31] | [Apache-2.0][12] | +| [Apache Maven Enforcer Plugin][32] | [Apache-2.0][12] | | [Maven Flatten Plugin][33] | [Apache Software Licenese][12] | | [Maven Dependency Plugin][34] | [The Apache Software License, Version 2.0][35] | | [Project keeper maven plugin][36] | [The MIT License][37] | | [org.sonatype.ossindex.maven:ossindex-maven-plugin][38] | [ASL2][35] | -| [Maven Surefire Plugin][39] | [Apache License, Version 2.0][12] | +| [Maven Surefire Plugin][39] | [Apache-2.0][12] | | [Versions Maven Plugin][40] | [Apache License, Version 2.0][12] | -| [Apache Maven Deploy Plugin][41] | [Apache License, Version 2.0][12] | -| [Apache Maven GPG Plugin][42] | [Apache License, Version 2.0][12] | -| [Apache Maven Source Plugin][43] | [Apache License, Version 2.0][12] | -| [Apache Maven Javadoc Plugin][44] | [Apache License, Version 2.0][12] | -| [Nexus Staging Maven Plugin][45] | [Eclipse Public License][46] | -| [Maven Failsafe Plugin][47] | [Apache License, Version 2.0][12] | -| [JaCoCo :: Maven Plugin][48] | [Eclipse Public License 2.0][6] | -| [error-code-crawler-maven-plugin][49] | [MIT License][50] | -| [Reproducible Build Maven Plugin][51] | [Apache 2.0][35] | -| [Maven Clean Plugin][52] | [The Apache Software License, Version 2.0][35] | -| [Maven Resources Plugin][53] | [The Apache Software License, Version 2.0][35] | -| [Maven JAR Plugin][54] | [The Apache Software License, Version 2.0][35] | -| [Maven Install Plugin][55] | [The Apache Software License, Version 2.0][35] | -| [Maven Site Plugin 3][56] | [The Apache Software License, Version 2.0][35] | +| [duplicate-finder-maven-plugin Maven Mojo][41] | [Apache License 2.0][42] | +| [Apache Maven Deploy Plugin][43] | [Apache-2.0][12] | +| [Apache Maven GPG Plugin][44] | [Apache License, Version 2.0][12] | +| [Apache Maven Source Plugin][45] | [Apache License, Version 2.0][12] | +| [Apache Maven Javadoc Plugin][46] | [Apache-2.0][12] | +| [Nexus Staging Maven Plugin][47] | [Eclipse Public License][48] | +| [Maven Failsafe Plugin][49] | [Apache-2.0][12] | +| [JaCoCo :: Maven Plugin][50] | [Eclipse Public License 2.0][6] | +| [error-code-crawler-maven-plugin][51] | [MIT License][52] | +| [Reproducible Build Maven Plugin][53] | [Apache 2.0][35] | +| [Maven Clean Plugin][54] | [The Apache Software License, Version 2.0][35] | +| [Maven Resources Plugin][55] | [The Apache Software License, Version 2.0][35] | +| [Maven JAR Plugin][56] | [The Apache Software License, Version 2.0][35] | +| [Maven Install Plugin][57] | [The Apache Software License, Version 2.0][35] | +| [Maven Site Plugin 3][58] | [The Apache Software License, Version 2.0][35] | [0]: https://github.com/eclipse-ee4j/jsonp [1]: https://projects.eclipse.org/license/epl-2.0 @@ -102,19 +103,21 @@ [38]: https://sonatype.github.io/ossindex-maven/maven-plugin/ [39]: https://maven.apache.org/surefire/maven-surefire-plugin/ [40]: https://www.mojohaus.org/versions/versions-maven-plugin/ -[41]: https://maven.apache.org/plugins/maven-deploy-plugin/ -[42]: https://maven.apache.org/plugins/maven-gpg-plugin/ -[43]: https://maven.apache.org/plugins/maven-source-plugin/ -[44]: https://maven.apache.org/plugins/maven-javadoc-plugin/ -[45]: http://www.sonatype.com/public-parent/nexus-maven-plugins/nexus-staging/nexus-staging-maven-plugin/ -[46]: http://www.eclipse.org/legal/epl-v10.html -[47]: https://maven.apache.org/surefire/maven-failsafe-plugin/ -[48]: https://www.jacoco.org/jacoco/trunk/doc/maven.html -[49]: https://github.com/exasol/error-code-crawler-maven-plugin/ -[50]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE -[51]: http://zlika.github.io/reproducible-build-maven-plugin -[52]: http://maven.apache.org/plugins/maven-clean-plugin/ -[53]: http://maven.apache.org/plugins/maven-resources-plugin/ -[54]: http://maven.apache.org/plugins/maven-jar-plugin/ -[55]: http://maven.apache.org/plugins/maven-install-plugin/ -[56]: http://maven.apache.org/plugins/maven-site-plugin/ +[41]: https://github.com/basepom/duplicate-finder-maven-plugin +[42]: http://www.apache.org/licenses/LICENSE-2.0.html +[43]: https://maven.apache.org/plugins/maven-deploy-plugin/ +[44]: https://maven.apache.org/plugins/maven-gpg-plugin/ +[45]: https://maven.apache.org/plugins/maven-source-plugin/ +[46]: https://maven.apache.org/plugins/maven-javadoc-plugin/ +[47]: http://www.sonatype.com/public-parent/nexus-maven-plugins/nexus-staging/nexus-staging-maven-plugin/ +[48]: http://www.eclipse.org/legal/epl-v10.html +[49]: https://maven.apache.org/surefire/maven-failsafe-plugin/ +[50]: https://www.jacoco.org/jacoco/trunk/doc/maven.html +[51]: https://github.com/exasol/error-code-crawler-maven-plugin/ +[52]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE +[53]: http://zlika.github.io/reproducible-build-maven-plugin +[54]: http://maven.apache.org/plugins/maven-clean-plugin/ +[55]: http://maven.apache.org/plugins/maven-resources-plugin/ +[56]: http://maven.apache.org/plugins/maven-jar-plugin/ +[57]: http://maven.apache.org/plugins/maven-install-plugin/ +[58]: http://maven.apache.org/plugins/maven-site-plugin/ diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md index 14bcd2c..4796e0d 100644 --- a/doc/changes/changelog.md +++ b/doc/changes/changelog.md @@ -1,5 +1,6 @@ # Changes +* [0.6.9](changes_0.6.9.md) * [0.6.8](changes_0.6.8.md) * [0.6.7](changes_0.6.7.md) * [0.6.6](changes_0.6.6.md) diff --git a/doc/changes/changes_0.6.9.md b/doc/changes/changes_0.6.9.md new file mode 100644 index 0000000..566c5cf --- /dev/null +++ b/doc/changes/changes_0.6.9.md @@ -0,0 +1,48 @@ +# Udf Debugging Java 0.6.9, released 2023-07-03 + +Code name: Upgrade dependencies on top of 0.6.8 + +## Summary + +This release fixes the following vulnerability in `provided` dependency `io.netty:netty-handler`: +* CVE-2023-34462, severity CWE-770: Allocation of Resources Without Limits or Throttling (6.5) + +## Security + +* #57: Upgraded dependencies + +## Dependency Updates + +### Compile Dependency Updates + +* Updated `com.exasol:bucketfs-java:3.0.0` to `3.1.0` +* Updated `com.exasol:error-reporting-java:1.0.0` to `1.0.1` +* Updated `jakarta.json:jakarta.json-api:2.1.1` to `2.1.2` +* Updated `org.apache.commons:commons-compress:1.22` to `1.23.0` +* Updated `org.jacoco:org.jacoco.core:0.8.8` to `0.8.10` +* Removed `org.slf4j:slf4j-api:2.0.6` +* Added `org.slf4j:slf4j-jdk14:2.0.7` + +### Test Dependency Updates + +* Updated `com.exasol:exasol-testcontainers:6.5.1` to `6.6.0` +* Updated `org.jacoco:org.jacoco.agent:0.8.8` to `0.8.10` +* Updated `org.junit.jupiter:junit-jupiter-engine:5.9.2` to `5.9.3` +* Updated `org.junit.jupiter:junit-jupiter-params:5.9.2` to `5.9.3` +* Updated `org.mockito:mockito-junit-jupiter:5.1.1` to `5.4.0` +* Updated `org.testcontainers:junit-jupiter:1.17.6` to `1.18.3` + +### Plugin Dependency Updates + +* Updated `com.exasol:error-code-crawler-maven-plugin:1.2.2` to `1.2.3` +* Updated `com.exasol:project-keeper-maven-plugin:2.9.3` to `2.9.7` +* Updated `org.apache.maven.plugins:maven-compiler-plugin:3.10.1` to `3.11.0` +* Updated `org.apache.maven.plugins:maven-deploy-plugin:3.0.0` to `3.1.1` +* Updated `org.apache.maven.plugins:maven-enforcer-plugin:3.1.0` to `3.3.0` +* Updated `org.apache.maven.plugins:maven-failsafe-plugin:3.0.0-M8` to `3.0.0` +* Updated `org.apache.maven.plugins:maven-javadoc-plugin:3.4.1` to `3.5.0` +* Updated `org.apache.maven.plugins:maven-surefire-plugin:3.0.0-M8` to `3.0.0` +* Added `org.basepom.maven:duplicate-finder-maven-plugin:1.5.1` +* Updated `org.codehaus.mojo:flatten-maven-plugin:1.3.0` to `1.4.1` +* Updated `org.codehaus.mojo:versions-maven-plugin:2.14.2` to `2.15.0` +* Updated `org.jacoco:jacoco-maven-plugin:0.8.8` to `0.8.9` diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom index 39d60f1..3b5cb6c 100644 --- a/pk_generated_parent.pom +++ b/pk_generated_parent.pom @@ -3,7 +3,7 @@ 4.0.0 com.exasol udf-debugging-java-generated-parent - 0.6.8 + 0.6.9 pom UTF-8 @@ -53,7 +53,7 @@ org.apache.maven.plugins maven-compiler-plugin - 3.10.1 + 3.11.0 ${java.version} ${java.version} @@ -62,7 +62,7 @@ org.apache.maven.plugins maven-enforcer-plugin - 3.1.0 + 3.3.0 enforce-maven @@ -72,7 +72,7 @@ - 3.6.3 + [3.8.7,3.9.0) @@ -82,7 +82,7 @@ org.codehaus.mojo flatten-maven-plugin - 1.3.0 + 1.4.1 true oss @@ -121,7 +121,7 @@ org.apache.maven.plugins maven-surefire-plugin - 3.0.0-M8 + 3.0.0 @@ -132,7 +132,7 @@ org.codehaus.mojo versions-maven-plugin - 2.14.2 + 2.15.0 display-updates @@ -147,10 +147,36 @@ file:///${project.basedir}/versionsMavenPluginRules.xml + + org.basepom.maven + duplicate-finder-maven-plugin + 1.5.1 + + + default + verify + + check + + + + + true + true + true + true + true + true + false + true + true + false + + org.apache.maven.plugins maven-deploy-plugin - 3.0.0 + 3.1.1 true @@ -191,7 +217,7 @@ org.apache.maven.plugins maven-javadoc-plugin - 3.4.1 + 3.5.0 attach-javadocs @@ -232,7 +258,7 @@ org.apache.maven.plugins maven-failsafe-plugin - 3.0.0-M8 + 3.0.0 @@ -253,7 +279,7 @@ org.jacoco jacoco-maven-plugin - 0.8.8 + 0.8.9 prepare-agent @@ -294,7 +320,7 @@ com.exasol error-code-crawler-maven-plugin - 1.2.2 + 1.2.3 verify diff --git a/pom.xml b/pom.xml index ef012c1..18c968c 100644 --- a/pom.xml +++ b/pom.xml @@ -2,14 +2,13 @@ 4.0.0 udf-debugging-java - 0.6.8 + 0.6.9 udf-debugging-java Utilities for debugging, profiling and code coverage measure for UDFs. https://github.com/exasol/udf-debugging-java/ - 5.9.2 - 11.0.0 - 0.8.8 + 5.9.3 + 0.8.10 @@ -25,7 +24,7 @@ jakarta.json jakarta.json-api - 2.1.1 + 2.1.2 org.glassfish @@ -36,7 +35,7 @@ com.exasol error-reporting-java - 1.0.0 + 1.0.1 org.jacoco @@ -53,12 +52,12 @@ com.exasol bucketfs-java - 3.0.0 + 3.1.0 com.exasol exasol-test-setup-abstraction-java - 2.0.0 + 2.0.2 @@ -93,7 +87,7 @@ org.mockito mockito-junit-jupiter - 5.1.1 + 5.4.0 test @@ -106,13 +100,13 @@ com.exasol exasol-testcontainers - 6.5.1 + 6.6.0 test org.testcontainers junit-jupiter - 1.17.6 + 1.18.3 test @@ -127,6 +121,12 @@ 1.2.0 test + + + org.slf4j + slf4j-jdk14 + 2.0.7 + @@ -151,7 +151,7 @@ com.exasol project-keeper-maven-plugin - 2.9.3 + 2.9.7 @@ -165,11 +165,6 @@ ossindex-maven-plugin - - sonatype-2020-0026 + com.exasol exasol-testcontainers