diff --git a/.github/workflows/broken_links_checker.yml b/.github/workflows/broken_links_checker.yml index ee8df76..55d839d 100644 --- a/.github/workflows/broken_links_checker.yml +++ b/.github/workflows/broken_links_checker.yml @@ -21,10 +21,11 @@ jobs: cancel-in-progress: true } steps: - - { - id: checkout, - uses: actions/checkout@v5 - } + - id: checkout + uses: actions/checkout@v7 + with: { + persist-credentials: false + } - id: configure-broken-links-checker name: Configure broken links checker run: | @@ -36,7 +37,7 @@ jobs: '{"pattern": "^https?://projects.eclipse.org"}' \ ']}' > ./target/broken_links_checker.json - id: run-broken-links-checker - uses: tcort/github-action-markdown-link-check@v1 + uses: tcort/github-action-markdown-link-check@e7c7a18363c842693fadde5d41a3bd3573a7a225 with: { use-quiet-mode: yes, use-verbose-mode: yes, diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml index 08bb712..1641eaa 100644 --- a/.github/workflows/ci-build.yml +++ b/.github/workflows/ci-build.yml @@ -33,12 +33,11 @@ jobs: fail-fast: false matrix: exasol_db_version: [ - 2025.1.3, - 8.29.12 + 2026.1.0 ] env: { - DEFAULT_EXASOL_DB_VERSION: 2025.1.3 + DEFAULT_EXASOL_DB_VERSION: 2026.1.0 } steps: - name: Free Disk Space @@ -49,9 +48,10 @@ jobs: sudo rm -rf /usr/share/dotnet - name: Checkout the repository id: checkout - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: { - fetch-depth: 0 + fetch-depth: 0, + persist-credentials: false } - name: Set up JDKs id: setup-java @@ -62,12 +62,9 @@ jobs: 11 17 cache: maven - server-id: ossindex - server-username: OSSINDEX_USERNAME - server-password: OSSINDEX_API_TOKEN - name: Cache SonarCloud packages id: cache-sonar - uses: actions/cache@v4 + uses: actions/cache@v5 with: { path: ~/.sonar/cache, key: '${{ runner.os }}-sonar', @@ -87,12 +84,11 @@ jobs: id: build-pk-verify run: | mvn --batch-mode clean verify \ + -DossindexSkip=true \ -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ -DtrimStackTrace=false \ -Dcom.exasol.dockerdb.image=${{ matrix.exasol_db_version }} env: { - OSSINDEX_USERNAME: '${{ secrets.OSSINDEX_USERNAME }}', - OSSINDEX_API_TOKEN: '${{ secrets.OSSINDEX_API_TOKEN }}', EXASOL_DB_VERSION: '${{ matrix.exasol_db_version }}' } - name: Sonar analysis @@ -100,6 +96,7 @@ jobs: if: ${{ env.SONAR_TOKEN != null && matrix.exasol_db_version == env.DEFAULT_EXASOL_DB_VERSION }} run: | mvn --batch-mode org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \ + -DossindexSkip=true \ -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ -DtrimStackTrace=false \ -Dsonar.token=$SONAR_TOKEN @@ -115,7 +112,7 @@ jobs: } - name: Upload artifacts id: upload-artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: { name: 'artifacts-exasol-${{ matrix.exasol_db_version }}', path: '${{ steps.build-pk-verify.outputs.release-artifacts }}', @@ -131,7 +128,7 @@ jobs: '{"pattern": "^https?://(www.)?eclipse.org"}' \ '{"pattern": "^https?://projects.eclipse.org"}' \ ']}' > ./target/broken_links_checker.json - - uses: tcort/github-action-markdown-link-check@v1 + - uses: tcort/github-action-markdown-link-check@e7c7a18363c842693fadde5d41a3bd3573a7a225 id: run-link-check with: { use-quiet-mode: yes, @@ -154,9 +151,10 @@ jobs: steps: - name: Checkout the repository id: checkout - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: { - fetch-depth: 0 + fetch-depth: 0, + persist-credentials: false } - name: Set up JDK 17 id: setup-java @@ -164,22 +162,91 @@ jobs: with: { distribution: temurin, java-version: '17', - cache: maven, - server-id: ossindex, - server-username: OSSINDEX_USERNAME, - server-password: OSSINDEX_API_TOKEN + cache: maven } - name: Run tests and build with Maven 17 id: build-next-java - run: mvn --batch-mode clean package -DtrimStackTrace=false -Djava.version=17 + run: | + mvn --batch-mode clean package -DtrimStackTrace=false -Djava.version=17 \ + -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ + -DossindexSkip=true + ossindex: + runs-on: ubuntu-latest + defaults: + run: { + shell: bash + } + permissions: { + contents: read + } + concurrency: { + group: '${{ github.workflow }}-ossindex-${{ github.ref }}', + cancel-in-progress: true + } + steps: + - name: Checkout the repository + id: checkout + uses: actions/checkout@v7 + with: { + persist-credentials: false + } + - name: Set up JDKs + id: setup-java + uses: actions/setup-java@v5 + with: + distribution: temurin + java-version: |- + 11 + 17 + cache: maven + server-id: ossindex + server-username: OSSINDEX_USERNAME + server-password: OSSINDEX_API_TOKEN + - name: Run Ossindex + id: ossindex + run: | + mvn --batch-mode test-compile \ + org.sonatype.ossindex.maven:ossindex-maven-plugin:audit \ + org.sonatype.ossindex.maven:ossindex-maven-plugin:audit-aggregate \ + -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn env: { OSSINDEX_USERNAME: '${{ secrets.OSSINDEX_USERNAME }}', OSSINDEX_API_TOKEN: '${{ secrets.OSSINDEX_API_TOKEN }}' } + lint-github-actions: + runs-on: ubuntu-latest + defaults: + run: { + shell: bash + } + permissions: { + security-events: write, + contents: read, + actions: read + } + concurrency: { + group: '${{ github.workflow }}-github-actions-linter-${{ github.ref }}', + cancel-in-progress: true + } + steps: + - name: Checkout the repository + id: checkout + uses: actions/checkout@v7 + with: { + persist-credentials: false + } + - name: Lint GitHub actions with Zizmore + id: lint-github-actions + uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d + with: { + advanced-security: false + } build: needs: [ matrix-build, - next-java-compatibility + next-java-compatibility, + ossindex, + lint-github-actions ] runs-on: ubuntu-latest defaults: @@ -196,9 +263,10 @@ jobs: steps: - name: Checkout the repository id: checkout - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: { - fetch-depth: 0 + fetch-depth: 0, + persist-credentials: false } - name: Set up JDKs id: setup-java diff --git a/.github/workflows/dependencies_check.yml b/.github/workflows/dependencies_check.yml index b0877fc..cabddf5 100644 --- a/.github/workflows/dependencies_check.yml +++ b/.github/workflows/dependencies_check.yml @@ -4,7 +4,7 @@ on: workflow_dispatch: null schedule: - { - cron: 0 2 * * * + cron: 42 22 * * 0 } jobs: report_security_issues: @@ -25,11 +25,12 @@ jobs: cancel-in-progress: true } steps: - - { - name: Checkout, - id: checkout, - uses: actions/checkout@v5 - } + - name: Checkout + id: checkout + uses: actions/checkout@v7 + with: { + persist-credentials: false + } - name: Set up JDKs id: setup-jdks uses: actions/setup-java@v5 @@ -55,7 +56,7 @@ jobs: } - name: Create GitHub Issues id: create-security-issues - uses: exasol/python-toolbox/.github/actions/security-issues@1.9.0 + uses: exasol/python-toolbox/.github/actions/security-issues@9.0.0 with: { format: maven, command: cat ossindex-report.json, diff --git a/.github/workflows/dependencies_update.yml b/.github/workflows/dependencies_update.yml index 2ba2785..283d8b9 100644 --- a/.github/workflows/dependencies_update.yml +++ b/.github/workflows/dependencies_update.yml @@ -34,10 +34,11 @@ jobs: cancel-in-progress: false } steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 id: checkout with: { - fetch-depth: 0 + fetch-depth: 0, + persist-credentials: true } - name: Set up JDKs id: setup-jdks @@ -58,10 +59,14 @@ jobs: - name: Fail if not running on a branch id: check-branch if: ${{ !startsWith(github.ref, 'refs/heads/') }} - uses: actions/github-script@v8 + uses: actions/github-script@v9 with: script: | - core.setFailed('Not running on a branch, github.ref is ${{ github.ref }}. Please start this workflow only on main or a branch') + const ref = process.env.GITHUB_REF + core.setFailed(`Not running on a branch, github.ref is '${ref}'. Please start this workflow only on main or a branch`) + env: { + GITHUB_REF: '${{ github.ref }}' + } - name: Update dependencies id: update-dependencies run: | @@ -119,7 +124,7 @@ jobs: id: create-branch if: ${{ github.ref == 'refs/heads/main' }} run: | - branch_name="dependency-update/$(date "+%Y%m%d%H%M%S")" + branch_name="dependency-update/$(date "+%Y-%m-%d_%H-%M-%S")" echo "Creating branch $branch_name" git checkout -b "$branch_name" - name: Commit changes & push @@ -159,7 +164,7 @@ jobs: - name: Report failure Status to Slack channel id: report-failure-slack if: ${{ always() }} - uses: ravsamhq/notify-slack-action@v2 + uses: ravsamhq/notify-slack-action@be814b201e233b2dc673608aa46e5447c8ab13f2 with: { status: '${{ job.status }}', token: '${{ secrets.GITHUB_TOKEN }}', @@ -173,7 +178,7 @@ jobs: - name: Report new Pull Request to Slack channel id: report-pr-slack if: ${{ steps.create-pr.outputs.pr_url }} - uses: ravsamhq/notify-slack-action@v2 + uses: ravsamhq/notify-slack-action@be814b201e233b2dc673608aa46e5447c8ab13f2 with: { status: '${{ job.status }}', token: '${{ secrets.GITHUB_TOKEN }}', diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index dbc1ea2..66a8723 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -75,9 +75,10 @@ jobs: steps: - name: Checkout the repository id: checkout - uses: actions/checkout@v5 + uses: actions/checkout@v7 with: { - fetch-depth: 0 + fetch-depth: 0, + persist-credentials: true } - name: Set up Maven Central Repository id: configure-maven-central-credentials @@ -88,7 +89,6 @@ jobs: java-version: |- 11 17 - cache: maven server-id: maven-central-portal server-username: MAVEN_USERNAME server-password: MAVEN_PASSWORD @@ -107,10 +107,14 @@ jobs: - name: Fail if not running on main or release branch id: check-main-or-release-branch if: ${{ github.ref != 'refs/heads/main' && !startsWith(github.ref, 'refs/heads/release/') }} - uses: actions/github-script@v8 + uses: actions/github-script@v9 with: script: | - core.setFailed('Not running on main or release branch, github.ref is ${{ github.ref }}. Please start this workflow only on main or a branch starting with release/') + const ref = process.env.GITHUB_REF + core.setFailed(`Not running on main or release branch, github.ref is '${ref}'. Please start this workflow only on main or a branch starting with release/`) + env: { + GITHUB_REF: '${{ github.ref }}' + } - name: Check CI build of this commit succeeded id: check-ci-build-status if: ${{ ! inputs.started-from-ci }} @@ -142,7 +146,7 @@ jobs: - { name: Build project, id: build, - run: mvn --batch-mode -DskipTests -Dossindex.skip=true clean verify + run: mvn --batch-mode -DskipTests -DossindexSkip=true clean verify } - { name: List secret GPG keys, @@ -155,7 +159,7 @@ jobs: if: ${{ true && (! inputs.skip-maven-central) }} run: | echo "#### Maven Central Release" >> "$GITHUB_STEP_SUMMARY" - mvn --batch-mode -Dgpg.skip=false -DskipTests -Dossindex.skip=true deploy \ + mvn --batch-mode -Dgpg.skip=false -DskipTests -DossindexSkip=true deploy \ -Dcentral-publishing.deploymentName="Auto release of repo ${{ github.repository }} using PK release.yml" \ -Dcentral-publishing.autoPublish=${{ inputs.maven-central-auto-publish }} if [[ "${{ inputs.maven-central-auto-publish }}" == "true" ]]; then @@ -236,7 +240,7 @@ jobs: - name: Report failure Status to Slack channel id: report-failure-status-slack if: ${{ always() }} - uses: ravsamhq/notify-slack-action@v2 + uses: ravsamhq/notify-slack-action@be814b201e233b2dc673608aa46e5447c8ab13f2 with: { status: '${{ job.status }}', token: '${{ github.token }}', @@ -250,7 +254,7 @@ jobs: - name: Report new release to Slack channel id: report-new-release-slack if: ${{ steps.create-github-release.outputs.release-url }} - uses: ravsamhq/notify-slack-action@v2 + uses: ravsamhq/notify-slack-action@be814b201e233b2dc673608aa46e5447c8ab13f2 with: { status: '${{ job.status }}', token: '${{ github.token }}', diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..4b5fd60 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,32 @@ +# Generated by Project Keeper +# https://github.com/exasol/project-keeper/blob/main/project-keeper/src/main/resources/templates/.github/zizmor.yml +# See https://docs.zizmor.sh/configuration/#settings +rules: + unpinned-uses: + config: + policies: + "actions/*": ref-pin + "exasol/python-toolbox/.github/actions/security-issues": ref-pin + "*": hash-pin + cache-poisoning: + ignore: + # Enabling caching is OK for non-release workflows + - ci-build.yml + - ci-build-native-build.yml + - ci-build-db-version-matrix.yml + - project-keeper-verify.yml + - test_on_windows.yml + - test_linux_build_on_windows.yml + obfuscation: + ignore: + # Generated workflows use boolean conditions like ${{ false }} + - ci-build.yml + - release.yml + - project-keeper-verify.yml + secrets-inherit: + ignore: + # Required for passing slack webhooks + - ci-build.yml + - ci-build-db-version-matrix.yml + - dependencies_check.yml + - release.yml diff --git a/.project-keeper.yml b/.project-keeper.yml index 2344296..777e3d9 100644 --- a/.project-keeper.yml +++ b/.project-keeper.yml @@ -7,10 +7,7 @@ sources: build: runnerOs: ubuntu-24.04 exasolDbVersions: - - "2025.1.3" - - "8.29.12" - # UDFs in Exasol 7.1 will be fixed in the next Docker-DB release - # - "7.1.30" + - "2026.1.0" workflows: - name: ci-build.yml stepCustomizations: diff --git a/.settings/org.eclipse.jdt.core.prefs b/.settings/org.eclipse.jdt.core.prefs index 7644ed3..f5f6a72 100644 --- a/.settings/org.eclipse.jdt.core.prefs +++ b/.settings/org.eclipse.jdt.core.prefs @@ -122,8 +122,10 @@ org.eclipse.jdt.core.compiler.problem.varargsArgumentNeedCast=warning org.eclipse.jdt.core.compiler.processAnnotations=disabled org.eclipse.jdt.core.compiler.release=disabled org.eclipse.jdt.core.compiler.source=11 +org.eclipse.jdt.core.formatter.align_arrows_in_switch_on_columns=false org.eclipse.jdt.core.formatter.align_assignment_statements_on_columns=false org.eclipse.jdt.core.formatter.align_fields_grouping_blank_lines=2147483647 +org.eclipse.jdt.core.formatter.align_selector_in_method_invocation_on_expression_first_line=false org.eclipse.jdt.core.formatter.align_type_members_on_columns=false org.eclipse.jdt.core.formatter.align_variable_declarations_on_columns=false org.eclipse.jdt.core.formatter.align_with_spaces=false @@ -151,6 +153,8 @@ org.eclipse.jdt.core.formatter.alignment_for_conditional_expression_chain=0 org.eclipse.jdt.core.formatter.alignment_for_enum_constants=16 org.eclipse.jdt.core.formatter.alignment_for_expressions_in_array_initializer=16 org.eclipse.jdt.core.formatter.alignment_for_expressions_in_for_loop_header=0 +org.eclipse.jdt.core.formatter.alignment_for_expressions_in_switch_case_with_arrow=0 +org.eclipse.jdt.core.formatter.alignment_for_expressions_in_switch_case_with_colon=0 org.eclipse.jdt.core.formatter.alignment_for_logical_operator=16 org.eclipse.jdt.core.formatter.alignment_for_method_declaration=0 org.eclipse.jdt.core.formatter.alignment_for_module_statements=16 @@ -159,6 +163,7 @@ org.eclipse.jdt.core.formatter.alignment_for_multiplicative_operator=16 org.eclipse.jdt.core.formatter.alignment_for_parameterized_type_references=0 org.eclipse.jdt.core.formatter.alignment_for_parameters_in_constructor_declaration=16 org.eclipse.jdt.core.formatter.alignment_for_parameters_in_method_declaration=16 +org.eclipse.jdt.core.formatter.alignment_for_permitted_types_in_type_declaration=16 org.eclipse.jdt.core.formatter.alignment_for_record_components=16 org.eclipse.jdt.core.formatter.alignment_for_relational_operator=0 org.eclipse.jdt.core.formatter.alignment_for_resources_in_try=80 @@ -169,6 +174,7 @@ org.eclipse.jdt.core.formatter.alignment_for_superclass_in_type_declaration=16 org.eclipse.jdt.core.formatter.alignment_for_superinterfaces_in_enum_declaration=16 org.eclipse.jdt.core.formatter.alignment_for_superinterfaces_in_record_declaration=16 org.eclipse.jdt.core.formatter.alignment_for_superinterfaces_in_type_declaration=16 +org.eclipse.jdt.core.formatter.alignment_for_switch_case_with_arrow=0 org.eclipse.jdt.core.formatter.alignment_for_throws_clause_in_constructor_declaration=16 org.eclipse.jdt.core.formatter.alignment_for_throws_clause_in_method_declaration=16 org.eclipse.jdt.core.formatter.alignment_for_type_annotations=0 @@ -194,6 +200,7 @@ org.eclipse.jdt.core.formatter.brace_position_for_anonymous_type_declaration=end org.eclipse.jdt.core.formatter.brace_position_for_array_initializer=end_of_line org.eclipse.jdt.core.formatter.brace_position_for_block=end_of_line org.eclipse.jdt.core.formatter.brace_position_for_block_in_case=end_of_line +org.eclipse.jdt.core.formatter.brace_position_for_block_in_case_after_arrow=end_of_line org.eclipse.jdt.core.formatter.brace_position_for_constructor_declaration=end_of_line org.eclipse.jdt.core.formatter.brace_position_for_enum_constant=end_of_line org.eclipse.jdt.core.formatter.brace_position_for_enum_declaration=end_of_line @@ -213,6 +220,7 @@ org.eclipse.jdt.core.formatter.comment.format_header=false org.eclipse.jdt.core.formatter.comment.format_html=true org.eclipse.jdt.core.formatter.comment.format_javadoc_comments=true org.eclipse.jdt.core.formatter.comment.format_line_comments=true +org.eclipse.jdt.core.formatter.comment.format_markdown_comments=true org.eclipse.jdt.core.formatter.comment.format_source_code=true org.eclipse.jdt.core.formatter.comment.indent_parameter_description=false org.eclipse.jdt.core.formatter.comment.indent_root_tags=false @@ -220,7 +228,8 @@ org.eclipse.jdt.core.formatter.comment.indent_tag_description=false org.eclipse.jdt.core.formatter.comment.insert_new_line_before_root_tags=insert org.eclipse.jdt.core.formatter.comment.insert_new_line_between_different_tags=do not insert org.eclipse.jdt.core.formatter.comment.insert_new_line_for_parameter=do not insert -org.eclipse.jdt.core.formatter.comment.line_length=120 +org.eclipse.jdt.core.formatter.comment.javadoc_do_not_separate_block_tags=false +org.eclipse.jdt.core.formatter.comment.line_length=160 org.eclipse.jdt.core.formatter.comment.new_lines_at_block_boundaries=true org.eclipse.jdt.core.formatter.comment.new_lines_at_javadoc_boundaries=true org.eclipse.jdt.core.formatter.comment.preserve_white_space_between_code_and_line_comments=false @@ -292,6 +301,7 @@ org.eclipse.jdt.core.formatter.insert_space_after_comma_in_method_invocation_arg org.eclipse.jdt.core.formatter.insert_space_after_comma_in_multiple_field_declarations=insert org.eclipse.jdt.core.formatter.insert_space_after_comma_in_multiple_local_declarations=insert org.eclipse.jdt.core.formatter.insert_space_after_comma_in_parameterized_type_reference=insert +org.eclipse.jdt.core.formatter.insert_space_after_comma_in_permitted_types=insert org.eclipse.jdt.core.formatter.insert_space_after_comma_in_record_components=insert org.eclipse.jdt.core.formatter.insert_space_after_comma_in_superinterfaces=insert org.eclipse.jdt.core.formatter.insert_space_after_comma_in_switch_case_expressions=insert @@ -383,6 +393,7 @@ org.eclipse.jdt.core.formatter.insert_space_before_comma_in_method_invocation_ar org.eclipse.jdt.core.formatter.insert_space_before_comma_in_multiple_field_declarations=do not insert org.eclipse.jdt.core.formatter.insert_space_before_comma_in_multiple_local_declarations=do not insert org.eclipse.jdt.core.formatter.insert_space_before_comma_in_parameterized_type_reference=do not insert +org.eclipse.jdt.core.formatter.insert_space_before_comma_in_permitted_types=do not insert org.eclipse.jdt.core.formatter.insert_space_before_comma_in_record_components=do not insert org.eclipse.jdt.core.formatter.insert_space_before_comma_in_superinterfaces=do not insert org.eclipse.jdt.core.formatter.insert_space_before_comma_in_switch_case_expressions=do not insert @@ -446,7 +457,8 @@ org.eclipse.jdt.core.formatter.insert_space_between_empty_parens_in_constructor_ org.eclipse.jdt.core.formatter.insert_space_between_empty_parens_in_enum_constant=do not insert org.eclipse.jdt.core.formatter.insert_space_between_empty_parens_in_method_declaration=do not insert org.eclipse.jdt.core.formatter.insert_space_between_empty_parens_in_method_invocation=do not insert -org.eclipse.jdt.core.formatter.join_lines_in_comments=true +org.eclipse.jdt.core.formatter.join_line_comments=false +org.eclipse.jdt.core.formatter.join_lines_in_comments=false org.eclipse.jdt.core.formatter.join_wrapped_lines=false org.eclipse.jdt.core.formatter.keep_annotation_declaration_on_one_line=one_line_never org.eclipse.jdt.core.formatter.keep_anonymous_type_declaration_on_one_line=one_line_never @@ -466,9 +478,11 @@ org.eclipse.jdt.core.formatter.keep_simple_do_while_body_on_same_line=false org.eclipse.jdt.core.formatter.keep_simple_for_body_on_same_line=false org.eclipse.jdt.core.formatter.keep_simple_getter_setter_on_one_line=false org.eclipse.jdt.core.formatter.keep_simple_while_body_on_same_line=false +org.eclipse.jdt.core.formatter.keep_switch_body_block_on_one_line=one_line_never +org.eclipse.jdt.core.formatter.keep_switch_case_with_arrow_on_one_line=one_line_never org.eclipse.jdt.core.formatter.keep_then_statement_on_same_line=false org.eclipse.jdt.core.formatter.keep_type_declaration_on_one_line=one_line_never -org.eclipse.jdt.core.formatter.lineSplit=120 +org.eclipse.jdt.core.formatter.lineSplit=160 org.eclipse.jdt.core.formatter.never_indent_block_comments_on_first_column=false org.eclipse.jdt.core.formatter.never_indent_line_comments_on_first_column=false org.eclipse.jdt.core.formatter.number_of_blank_lines_after_code_block=0 @@ -506,5 +520,6 @@ org.eclipse.jdt.core.formatter.wrap_before_or_operator_multicatch=true org.eclipse.jdt.core.formatter.wrap_before_relational_operator=true org.eclipse.jdt.core.formatter.wrap_before_shift_operator=true org.eclipse.jdt.core.formatter.wrap_before_string_concatenation=true +org.eclipse.jdt.core.formatter.wrap_before_switch_case_arrow_operator=false org.eclipse.jdt.core.formatter.wrap_outer_expressions_when_nested=true org.eclipse.jdt.core.javaFormatter=org.eclipse.jdt.core.defaultJavaFormatter diff --git a/.settings/org.eclipse.jdt.ui.prefs b/.settings/org.eclipse.jdt.ui.prefs index 54d02ac..14b7a65 100644 --- a/.settings/org.eclipse.jdt.ui.prefs +++ b/.settings/org.eclipse.jdt.ui.prefs @@ -61,7 +61,7 @@ cleanup_settings_version=2 eclipse.preferences.version=1 editor_save_participant_org.eclipse.jdt.ui.postsavelistener.cleanup=true formatter_profile=_Exasol -formatter_settings_version=21 +formatter_settings_version=23 org.eclipse.jdt.ui.ignorelowercasenames=true org.eclipse.jdt.ui.importorder=java;javax;org;com; org.eclipse.jdt.ui.ondemandthreshold=3 diff --git a/dependencies.md b/dependencies.md index e982d45..ccaa4a3 100644 --- a/dependencies.md +++ b/dependencies.md @@ -34,34 +34,35 @@ ## Plugin Dependencies -| Dependency | License | -| ------------------------------------------------------- | ------------------------------------------- | -| [Apache Maven Clean Plugin][30] | [Apache-2.0][12] | -| [Apache Maven Install Plugin][31] | [Apache-2.0][12] | -| [Apache Maven Resources Plugin][32] | [Apache-2.0][12] | -| [Apache Maven Site Plugin][33] | [Apache-2.0][12] | -| [SonarQube Scanner for Maven][34] | [GNU LGPL 3][35] | -| [Apache Maven Toolchains Plugin][36] | [Apache-2.0][12] | -| [Apache Maven Dependency Plugin][37] | [Apache-2.0][12] | -| [Project Keeper Maven plugin][38] | [The MIT License][39] | -| [Apache Maven Compiler Plugin][40] | [Apache-2.0][12] | -| [Apache Maven Enforcer Plugin][41] | [Apache-2.0][12] | -| [Maven Flatten Plugin][42] | [Apache Software License][12] | -| [org.sonatype.ossindex.maven:ossindex-maven-plugin][43] | [ASL2][44] | -| [Maven Surefire Plugin][45] | [Apache-2.0][12] | -| [Versions Maven Plugin][46] | [Apache License, Version 2.0][12] | -| [duplicate-finder-maven-plugin Maven Mojo][47] | [Apache License 2.0][48] | -| [Apache Maven Artifact Plugin][49] | [Apache-2.0][12] | -| [Apache Maven Deploy Plugin][50] | [Apache-2.0][12] | -| [Apache Maven GPG Plugin][51] | [Apache-2.0][12] | -| [Apache Maven Source Plugin][52] | [Apache License, Version 2.0][12] | -| [Apache Maven Javadoc Plugin][53] | [Apache-2.0][12] | -| [Central Publishing Maven Plugin][54] | [The Apache License, Version 2.0][12] | -| [Maven Failsafe Plugin][55] | [Apache-2.0][12] | -| [JaCoCo :: Maven Plugin][56] | [EPL-2.0][6] | -| [Quality Summarizer Maven Plugin][57] | [MIT License][58] | -| [error-code-crawler-maven-plugin][59] | [MIT License][60] | -| [Git Commit Id Maven Plugin][61] | [GNU Lesser General Public License 3.0][62] | +| Dependency | License | +| ------------------------------------------------------- | ---------------------------------------------- | +| [SonarQube Scanner for Maven][30] | [GNU LGPL 3][31] | +| [Apache Maven Toolchains Plugin][32] | [Apache-2.0][12] | +| [Apache Maven Dependency Plugin][33] | [Apache-2.0][12] | +| [Project Keeper Maven plugin][34] | [The MIT License][35] | +| [Apache Maven Compiler Plugin][36] | [Apache-2.0][12] | +| [Apache Maven Enforcer Plugin][37] | [Apache-2.0][12] | +| [Maven Flatten Plugin][38] | [Apache Software License][12] | +| [org.sonatype.ossindex.maven:ossindex-maven-plugin][39] | [ASL2][40] | +| [Maven Surefire Plugin][41] | [Apache-2.0][12] | +| [Versions Maven Plugin][42] | [Apache License, Version 2.0][12] | +| [duplicate-finder-maven-plugin Maven Mojo][43] | [Apache License 2.0][44] | +| [Apache Maven Artifact Plugin][45] | [Apache-2.0][12] | +| [Apache Maven Deploy Plugin][46] | [Apache-2.0][12] | +| [Apache Maven Source Plugin][47] | [Apache-2.0][12] | +| [Apache Maven Javadoc Plugin][48] | [Apache-2.0][12] | +| [spdx-maven-plugin Maven Plugin][49] | [The Apache Software License, Version 2.0][40] | +| [Build Helper Maven Plugin][50] | [The MIT License][51] | +| [Apache Maven GPG Plugin][52] | [Apache-2.0][12] | +| [Central Publishing Maven Plugin][53] | [The Apache License, Version 2.0][12] | +| [Maven Failsafe Plugin][54] | [Apache-2.0][12] | +| [JaCoCo :: Maven Plugin][55] | [EPL-2.0][6] | +| [error-code-crawler-maven-plugin][56] | [MIT License][57] | +| [Git Commit Id Maven Plugin][58] | [GNU Lesser General Public License 3.0][59] | +| [Apache Maven Clean Plugin][60] | [Apache-2.0][12] | +| [Apache Maven Resources Plugin][61] | [Apache-2.0][12] | +| [Apache Maven Install Plugin][62] | [Apache-2.0][12] | +| [Apache Maven Site Plugin][63] | [Apache-2.0][12] | [0]: https://github.com/eclipse-ee4j/jsonp [1]: https://projects.eclipse.org/license/epl-2.0 @@ -93,36 +94,37 @@ [27]: https://github.com/itsallcode/junit5-system-extensions [28]: http://www.eclipse.org/legal/epl-v20.html [29]: https://github.com/eclipse-ee4j/parsson -[30]: https://maven.apache.org/plugins/maven-clean-plugin/ -[31]: https://maven.apache.org/plugins/maven-install-plugin/ -[32]: https://maven.apache.org/plugins/maven-resources-plugin/ -[33]: https://maven.apache.org/plugins/maven-site-plugin/ -[34]: http://docs.sonarqube.org/display/PLUG/Plugin+Library/sonar-scanner-maven/sonar-maven-plugin -[35]: http://www.gnu.org/licenses/lgpl.txt -[36]: https://maven.apache.org/plugins/maven-toolchains-plugin/ -[37]: https://maven.apache.org/plugins/maven-dependency-plugin/ -[38]: https://github.com/exasol/project-keeper/ -[39]: https://github.com/exasol/project-keeper/blob/main/LICENSE -[40]: https://maven.apache.org/plugins/maven-compiler-plugin/ -[41]: https://maven.apache.org/enforcer/maven-enforcer-plugin/ -[42]: https://www.mojohaus.org/flatten-maven-plugin/ -[43]: https://sonatype.github.io/ossindex-maven/maven-plugin/ -[44]: http://www.apache.org/licenses/LICENSE-2.0.txt -[45]: https://maven.apache.org/surefire/maven-surefire-plugin/ -[46]: https://www.mojohaus.org/versions/versions-maven-plugin/ -[47]: https://basepom.github.io/duplicate-finder-maven-plugin -[48]: http://www.apache.org/licenses/LICENSE-2.0.html -[49]: https://maven.apache.org/plugins/maven-artifact-plugin/ -[50]: https://maven.apache.org/plugins/maven-deploy-plugin/ -[51]: https://maven.apache.org/plugins/maven-gpg-plugin/ -[52]: https://maven.apache.org/plugins/maven-source-plugin/ -[53]: https://maven.apache.org/plugins/maven-javadoc-plugin/ -[54]: https://central.sonatype.org -[55]: https://maven.apache.org/surefire/maven-failsafe-plugin/ -[56]: https://www.jacoco.org/jacoco/trunk/doc/maven.html -[57]: https://github.com/exasol/quality-summarizer-maven-plugin/ -[58]: https://github.com/exasol/quality-summarizer-maven-plugin/blob/main/LICENSE -[59]: https://github.com/exasol/error-code-crawler-maven-plugin/ -[60]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE -[61]: https://github.com/git-commit-id/git-commit-id-maven-plugin -[62]: http://www.gnu.org/licenses/lgpl-3.0.txt +[30]: https://docs.sonarsource.com/sonarqube-server/latest/extension-guide/developing-a-plugin/plugin-basics/sonar-scanner-maven/sonar-maven-plugin/ +[31]: http://www.gnu.org/licenses/lgpl.txt +[32]: https://maven.apache.org/plugins/maven-toolchains-plugin/ +[33]: https://maven.apache.org/plugins/maven-dependency-plugin/ +[34]: https://github.com/exasol/project-keeper/ +[35]: https://github.com/exasol/project-keeper/blob/main/LICENSE +[36]: https://maven.apache.org/plugins/maven-compiler-plugin/ +[37]: https://maven.apache.org/enforcer/maven-enforcer-plugin/ +[38]: https://www.mojohaus.org/flatten-maven-plugin/ +[39]: https://sonatype.github.io/ossindex-maven/maven-plugin/ +[40]: http://www.apache.org/licenses/LICENSE-2.0.txt +[41]: https://maven.apache.org/surefire/maven-surefire-plugin/ +[42]: https://www.mojohaus.org/versions/versions-maven-plugin/ +[43]: https://basepom.github.io/duplicate-finder-maven-plugin +[44]: http://www.apache.org/licenses/LICENSE-2.0.html +[45]: https://maven.apache.org/plugins/maven-artifact-plugin/ +[46]: https://maven.apache.org/plugins/maven-deploy-plugin/ +[47]: https://maven.apache.org/plugins/maven-source-plugin/ +[48]: https://maven.apache.org/plugins/maven-javadoc-plugin/ +[49]: https://github.com/spdx/spdx-maven-plugin +[50]: https://www.mojohaus.org/build-helper-maven-plugin/ +[51]: https://spdx.org/licenses/MIT.txt +[52]: https://maven.apache.org/plugins/maven-gpg-plugin/ +[53]: https://central.sonatype.org +[54]: https://maven.apache.org/surefire/maven-failsafe-plugin/ +[55]: https://www.jacoco.org/jacoco/trunk/doc/maven.html +[56]: https://github.com/exasol/error-code-crawler-maven-plugin/ +[57]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE +[58]: https://github.com/git-commit-id/git-commit-id-maven-plugin +[59]: http://www.gnu.org/licenses/lgpl-3.0.txt +[60]: https://maven.apache.org/plugins/maven-clean-plugin/ +[61]: https://maven.apache.org/plugins/maven-resources-plugin/ +[62]: https://maven.apache.org/plugins/maven-install-plugin/ +[63]: https://maven.apache.org/plugins/maven-site-plugin/ diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md index 85c329d..3a9335b 100644 --- a/doc/changes/changelog.md +++ b/doc/changes/changelog.md @@ -1,5 +1,6 @@ # Changes +* [0.6.19](changes_0.6.19.md) * [0.6.18](changes_0.6.18.md) * [0.6.17](changes_0.6.17.md) * [0.6.16](changes_0.6.16.md) diff --git a/doc/changes/changes_0.6.19.md b/doc/changes/changes_0.6.19.md new file mode 100644 index 0000000..56a55b6 --- /dev/null +++ b/doc/changes/changes_0.6.19.md @@ -0,0 +1,76 @@ +# Udf Debugging Java 0.6.19, released 2026-??-?? + +Code name: Fixed vulnerabilities CVE-2017-7503, CVE-2017-10355, CVE-2026-9563 + +## Summary + +This release fixes the following 3 vulnerabilities: + +### CVE-2017-7503 (CWE-611) in dependency `xerces:xercesImpl:jar:2.12.2:provided` +It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed. +#### References +* https://guide.sonatype.com/vulnerability/CVE-2017-7503?component-type=maven&component-name=xerces%2FxercesImpl&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1 +* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7503 +* https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7503 + +### CVE-2017-10355 (CWE-833) in dependency `xerces:xercesImpl:jar:2.12.2:provided` +sonatype-2017-0348 - xerces:xercesImpl - Denial of Service (DoS) +#### References +* https://guide.sonatype.com/vulnerability/CVE-2017-10355?component-type=maven&component-name=xerces%2FxercesImpl&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1 +* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-10355 +* https://blogs.securiteam.com/index.php/archives/3271 + +### CVE-2026-9563 (CWE-400) in dependency `org.eclipse.parsson:parsson:jar:1.1.7:runtime` +In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, or nested structures, resulting in a denial of service. Eclipse Parsson 1.1.8 introduces a configurable maximum parsing limit with a default limit of 15 million parser-consumed characters. +#### References +* https://guide.sonatype.com/vulnerability/CVE-2026-9563?component-type=maven&component-name=org.eclipse.parsson%2Fparsson&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1 +* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-9563 +* https://github.com/eclipse-ee4j/parsson/pull/169 +* https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/444 + +## Security + +* #81: Fixed vulnerability CVE-2017-7503 in dependency `xerces:xercesImpl:jar:2.12.2:provided` +* #82: Fixed vulnerability CVE-2017-10355 in dependency `xerces:xercesImpl:jar:2.12.2:provided` +* #83: Fixed vulnerability CVE-2026-9563 in dependency `org.eclipse.parsson:parsson:jar:1.1.7:runtime` + +## Dependency Updates + +### Compile Dependency Updates + +* Updated `org.jacoco:org.jacoco.core:0.8.14` to `0.8.15` +* Updated `org.slf4j:slf4j-jdk14:2.0.17` to `2.0.18` + +### Runtime Dependency Updates + +* Updated `org.eclipse.parsson:parsson:1.1.7` to `1.1.9` + +### Test Dependency Updates + +* Updated `com.exasol:exasol-testcontainers:7.2.0` to `7.3.0` +* Updated `com.exasol:test-db-builder-java:3.6.4` to `4.0.1` +* Updated `org.itsallcode:junit5-system-extensions:1.2.2` to `1.2.3` +* Updated `org.jacoco:org.jacoco.agent:0.8.14` to `0.8.15` +* Updated `org.junit.jupiter:junit-jupiter-params:5.13.4` to `5.14.4` +* Updated `org.mockito:mockito-junit-jupiter:5.20.0` to `5.23.0` +* Updated `org.testcontainers:testcontainers-junit-jupiter:2.0.1` to `2.0.5` + +### Plugin Dependency Updates + +* Updated `com.exasol:error-code-crawler-maven-plugin:2.0.5` to `2.1.0` +* Updated `com.exasol:project-keeper-maven-plugin:5.4.3` to `5.7.3` +* Removed `com.exasol:quality-summarizer-maven-plugin:0.2.1` +* Updated `io.github.git-commit-id:git-commit-id-maven-plugin:9.0.2` to `10.0.0` +* Updated `org.apache.maven.plugins:maven-compiler-plugin:3.14.1` to `3.15.0` +* Updated `org.apache.maven.plugins:maven-enforcer-plugin:3.6.2` to `3.6.3` +* Updated `org.apache.maven.plugins:maven-failsafe-plugin:3.5.4` to `3.5.6` +* Updated `org.apache.maven.plugins:maven-resources-plugin:3.3.1` to `3.5.0` +* Updated `org.apache.maven.plugins:maven-site-plugin:3.21.0` to `3.22.0` +* Updated `org.apache.maven.plugins:maven-source-plugin:3.2.1` to `3.4.0` +* Updated `org.apache.maven.plugins:maven-surefire-plugin:3.5.4` to `3.5.6` +* Added `org.codehaus.mojo:build-helper-maven-plugin:3.6.1` +* Updated `org.codehaus.mojo:versions-maven-plugin:2.19.1` to `2.21.0` +* Updated `org.jacoco:jacoco-maven-plugin:0.8.14` to `0.8.15` +* Updated `org.sonarsource.scanner.maven:sonar-maven-plugin:5.2.0.4988` to `5.7.0.6970` +* Updated `org.sonatype.central:central-publishing-maven-plugin:0.9.0` to `0.11.0` +* Added `org.spdx:spdx-maven-plugin:1.0.4` diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom index 3215806..dff9fa9 100644 --- a/pk_generated_parent.pom +++ b/pk_generated_parent.pom @@ -3,7 +3,7 @@ 4.0.0 com.exasol udf-debugging-java-generated-parent - 0.6.18 + 0.6.19 pom UTF-8 @@ -13,6 +13,7 @@ exasol https://sonarcloud.io + false true false false @@ -41,31 +42,45 @@ + + + + org.apache.maven.plugins + maven-clean-plugin + 3.5.0 + + + org.apache.maven.plugins + maven-install-plugin + 3.1.4 + + + org.apache.maven.plugins + maven-resources-plugin + 3.5.0 + + + org.apache.maven.plugins + maven-site-plugin + 3.22.0 + + + org.codehaus.mojo + exec-maven-plugin + 3.6.3 + + + true + + + + + - - org.apache.maven.plugins - maven-clean-plugin - 3.5.0 - - - org.apache.maven.plugins - maven-install-plugin - 3.1.4 - - - org.apache.maven.plugins - maven-resources-plugin - 3.3.1 - - - org.apache.maven.plugins - maven-site-plugin - 3.21.0 - org.sonarsource.scanner.maven sonar-maven-plugin - 5.2.0.4988 + 5.7.0.6970 org.apache.maven.plugins @@ -89,10 +104,9 @@ org.apache.maven.plugins maven-compiler-plugin - 3.14.1 + 3.15.0 - ${java.version} - ${java.version} + ${java.version} true -Xlint:all @@ -103,7 +117,7 @@ org.apache.maven.plugins maven-enforcer-plugin - 3.6.2 + 3.6.3 enforce-maven @@ -154,6 +168,8 @@ 3.2.0 ossindex + + ${ossindexSkip} @@ -168,18 +184,23 @@ org.apache.maven.plugins maven-surefire-plugin - 3.5.4 + 3.5.6 - - -Djava.util.logging.config.file=src/test/resources/logging.properties ${argLine} + ${argLine} + + true + + + + src/test/resources/logging.properties + ${test.excludeTags} org.codehaus.mojo versions-maven-plugin - 2.19.1 + 2.21.0 display-updates @@ -253,33 +274,10 @@ true - - org.apache.maven.plugins - maven-gpg-plugin - 3.2.8 - - - sign-artifacts - verify - - sign - - - - --pinentry-mode - loopback - - - - - org.apache.maven.plugins maven-source-plugin - - 3.2.1 + 3.4.0 attach-sources @@ -303,18 +301,93 @@ UTF-8 + en true true true true - ${java.version} + ${java.version} + true + + + + + org.spdx + spdx-maven-plugin + 1.0.4 + + + build-spdx + package + + createSPDX + + + + + build + + true + true + true + true + false + false + Copyright (c) Exasol + false + JSON-LD + ${project.build.directory}/site/${project.groupId}.${project.artifactId}-${project.version}.spdx3.json + + + org.codehaus.mojo + build-helper-maven-plugin + 3.6.1 + + + attach-spdx-sbom + package + + attach-artifact + + + + + ${project.build.directory}/site/${project.groupId}.${project.artifactId}-${project.version}.spdx3.json + spdx + sbom + + + + + + + + org.apache.maven.plugins + maven-gpg-plugin + 3.2.8 + + + sign-artifacts + verify + + sign + + + + --pinentry-mode + loopback + + + + + org.sonatype.central central-publishing-maven-plugin - 0.9.0 + 0.11.0 true maven-central-portal @@ -328,11 +401,16 @@ org.apache.maven.plugins maven-failsafe-plugin - 3.5.4 + 3.5.6 - - -Djava.util.logging.config.file=src/test/resources/logging.properties ${argLine} - + ${argLine} + + true + + + + src/test/resources/logging.properties + ${test.excludeTags} @@ -348,7 +426,7 @@ org.jacoco jacoco-maven-plugin - 0.8.14 + 0.8.15 prepare-agent @@ -386,23 +464,10 @@ - - com.exasol - quality-summarizer-maven-plugin - 0.2.1 - - - summarize-metrics - - summarize - - - - com.exasol error-code-crawler-maven-plugin - 2.0.5 + 2.1.0 verify @@ -415,7 +480,7 @@ io.github.git-commit-id git-commit-id-maven-plugin - 9.0.2 + 10.0.0 get-the-git-infos diff --git a/pom.xml b/pom.xml index a83255b..ab9a880 100644 --- a/pom.xml +++ b/pom.xml @@ -2,12 +2,12 @@ 4.0.0 udf-debugging-java - 0.6.18 + 0.6.19 udf-debugging-java Utilities for debugging, profiling and code coverage measure for UDFs. https://github.com/exasol/udf-debugging-java/ - 0.8.14 + 0.8.15 @@ -18,7 +18,7 @@ org.eclipse.parsson parsson - 1.1.7 + 1.1.9 runtime @@ -46,7 +46,7 @@ com.exasol exasol-test-setup-abstraction-java - 2.1.10 + 2.1.11 - 5.13.4 + 5.14.4 test org.mockito mockito-junit-jupiter - 5.20.0 + 5.23.0 test @@ -82,32 +82,32 @@ com.exasol exasol-testcontainers - 7.2.0 + 7.3.0 test org.testcontainers testcontainers-junit-jupiter - 2.0.1 + 2.0.5 test com.exasol test-db-builder-java - 3.6.4 + 4.0.1 test org.itsallcode junit5-system-extensions - 1.2.2 + 1.2.3 test org.slf4j slf4j-jdk14 - 2.0.17 + 2.0.18 @@ -133,7 +133,7 @@ com.exasol project-keeper-maven-plugin - 5.4.3 + 5.7.3 @@ -172,7 +172,7 @@ udf-debugging-java-generated-parent com.exasol - 0.6.18 + 0.6.19 pk_generated_parent.pom