Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update deps #273

Merged
merged 6 commits into from
Sep 29, 2023
Merged

Update deps #273

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
feaef0a
Update deps
Shmuma Sep 28, 2023
d5ca5c7
PK fix
Shmuma Sep 28, 2023
c86940f
Fix CI issues
Shmuma Sep 28, 2023
08d5cd2
Exclude netty vulnerability
Shmuma Sep 28, 2023
bfa4988
Pin ubuntu version to fix 'VM Crashed' issue
Shmuma Sep 29, 2023
a2320fd
Prepare the release
Shmuma Sep 29, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/broken_links_checker.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 3 additions & 2 deletions .github/workflows/ci-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ on:
jobs:
build:
name: Build with Exasol ${{ matrix.exasol-docker-version }}
runs-on: ubuntu-latest
runs-on: ubuntu-20.04 # UDFs fail with "VM error: Internal error: VM crashed" on ubuntu-latest
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}-exasol-${{ matrix.exasol-docker-version }}
cancel-in-progress: true
Expand All @@ -27,7 +27,8 @@ jobs:
android: true
dotnet: true
haskell: true
large-packages: true
# temporary fix for https://github.com/jlumbroso/free-disk-space/issues/17
large-packages: false
docker-images: false
swap-storage: false

Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/dependencies_check.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 3 additions & 4 deletions .github/workflows/release_droid_print_quick_checksum.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

256 changes: 129 additions & 127 deletions dependencies.md
View file
Open in desktop

Large diffs are not rendered by default.

29 changes: 25 additions & 4 deletions doc/changes/changes_2.7.4.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,33 +1,54 @@
# Cloud Storage Extension 2.7.4, released 2023-??-??
# Cloud Storage Extension 2.7.4, released 2023-09-29

Code name: Upgrade Dependencies

## Summary

This release fixes vulnerability CVE-2022-46751 in transitive dependency `org.apache.ivy:ivy` by upgrading it to the latest version.

The release also updates the extension to use common code from `@exasol/extension-manager-interface`.
In addition, CVE-2023-42503 in `org.apache.commons:commons-compress` was fixed.

## Security

* #269: Fixed CVE-2022-46751 in `org.apache.ivy:ivy`
* #272: Fixed CVE-2023-42503 in `org.apache.commons:commons-compress`

## Dependency Updates

### Cloud Storage Extension

#### Compile Dependency Updates

* Updated `com.google.protobuf:protobuf-java:3.24.0` to `3.24.1`
* Updated `io.netty:netty-handler:4.1.96.Final` to `4.1.97.Final`
* Updated `com.exasol:parquet-io-java:2.0.4` to `2.0.5`
* Updated `com.google.protobuf:protobuf-java:3.24.0` to `3.24.3`
* Updated `io.dropwizard.metrics:metrics-core:4.2.19` to `4.2.20`
* Updated `io.netty:netty-handler:4.1.96.Final` to `4.1.99.Final`
* Updated `org.apache.avro:avro:1.11.2` to `1.11.3`
* Added `org.apache.commons:commons-compress:1.24.0`
* Added `org.apache.ivy:ivy:2.5.2`
* Updated `org.jetbrains.kotlin:kotlin-stdlib:1.9.0` to `1.9.10`
* Updated `org.slf4j:jul-to-slf4j:2.0.7` to `2.0.9`
* Updated `org.slf4j:slf4j-reload4j:2.0.7` to `2.0.9`
* Updated `org.xerial.snappy:snappy-java:1.1.10.3` to `1.1.10.5`

#### Test Dependency Updates

* Updated `com.dimafeng:testcontainers-scala-scalatest_2.13:0.40.17` to `0.41.0`
* Updated `com.exasol:exasol-testcontainers:6.6.1` to `6.6.2`
* Updated `com.exasol:extension-manager-integration-test-java:0.5.0` to `0.5.1`
* Updated `com.exasol:hamcrest-resultset-matcher:1.6.0` to `1.6.1`
* Updated `com.exasol:test-db-builder-java:3.4.2` to `3.5.1`
* Updated `nl.jqno.equalsverifier:equalsverifier:3.15.1` to `3.15.2`
* Updated `org.mockito:mockito-core:5.4.0` to `5.5.0`
* Updated `org.testcontainers:localstack:1.18.3` to `1.19.0`

#### Plugin Dependency Updates

* Updated `com.diffplug.spotless:spotless-maven-plugin:2.38.0` to `2.39.0`
* Updated `com.exasol:project-keeper-maven-plugin:2.9.10` to `2.9.12`
* Updated `org.apache.maven.plugins:maven-enforcer-plugin:3.3.0` to `3.4.0`
* Updated `org.apache.maven.plugins:maven-javadoc-plugin:3.5.0` to `3.6.0`

### Extension

#### Compile Dependency Updates
Expand Down
2 changes: 1 addition & 1 deletion pk_generated_parent.pom
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

45 changes: 27 additions & 18 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,15 +47,15 @@
<version>1.56.1</version>
</dependency>
<dependency>
<!-- Upgrade nettty-handler to fix CVE-2023-34462-->
<!-- Upgrade nettty-handler to fix CVE-2023-34462 and CVE-2023-4586 -->
<groupId>io.netty</groupId>
<artifactId>netty-handler</artifactId>
<version>4.1.97.Final</version>
<version>4.1.99.Final</version>
</dependency>
<dependency>
<groupId>org.xerial.snappy</groupId>
<artifactId>snappy-java</artifactId>
<version>1.1.10.3</version>
<version>1.1.10.5</version>
</dependency>
<dependency>
<groupId>com.exasol</groupId>
Expand Down Expand Up @@ -364,12 +364,12 @@
<dependency>
<groupId>io.dropwizard.metrics</groupId>
<artifactId>metrics-core</artifactId>
<version>4.2.19</version>
<version>4.2.20</version>
</dependency>
<dependency>
<groupId>com.google.protobuf</groupId>
<artifactId>protobuf-java</artifactId>
<version>3.24.1</version>
<version>3.24.3</version>
</dependency>
<dependency>
<groupId>com.google.cloud.bigdataoss</groupId>
Expand Down Expand Up @@ -397,7 +397,7 @@
<dependency>
<groupId>org.apache.avro</groupId>
<artifactId>avro</artifactId>
<version>1.11.2</version>
<version>1.11.3</version>
<exclusions>
<!-- exluded because of duplicate-finder-maven-plugin -->
<exclusion>
Expand All @@ -410,6 +410,12 @@
</exclusion>
</exclusions>
</dependency>
<dependency>
<!-- Upgrade transitive dependency of org.apache.avro:avro to fix CVE-2023-42503 -->
<groupId>org.apache.commons</groupId>
<artifactId>commons-compress</artifactId>
<version>1.24.0</version>
</dependency>
<dependency>
<groupId>io.delta</groupId>
<artifactId>delta-core_${scala.compat.version}</artifactId>
Expand Down Expand Up @@ -464,17 +470,17 @@
<dependency>
<groupId>com.exasol</groupId>
<artifactId>parquet-io-java</artifactId>
<version>2.0.4</version>
<version>2.0.5</version>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>jul-to-slf4j</artifactId>
<version>2.0.7</version>
<version>2.0.9</version>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-reload4j</artifactId>
<version>2.0.7</version>
<version>2.0.9</version>
<exclusions>
<exclusion>
<groupId>log4j</groupId>
Expand Down Expand Up @@ -535,7 +541,7 @@
<dependency>
<groupId>com.dimafeng</groupId>
<artifactId>testcontainers-scala-scalatest_${scala.compat.version}</artifactId>
<version>0.40.17</version>
<version>0.41.0</version>
<scope>test</scope>
</dependency>
<dependency>
Expand All @@ -547,25 +553,25 @@
<dependency>
<groupId>com.exasol</groupId>
<artifactId>exasol-testcontainers</artifactId>
<version>6.6.1</version>
<version>6.6.2</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>com.exasol</groupId>
<artifactId>test-db-builder-java</artifactId>
<version>3.4.2</version>
<version>3.5.1</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>com.exasol</groupId>
<artifactId>hamcrest-resultset-matcher</artifactId>
<version>1.6.0</version>
<version>1.6.1</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>nl.jqno.equalsverifier</groupId>
<artifactId>equalsverifier</artifactId>
<version>3.15.1</version>
<version>3.15.2</version>
<scope>test</scope>
</dependency>
<dependency>
Expand All @@ -583,7 +589,7 @@
<dependency>
<groupId>com.exasol</groupId>
<artifactId>extension-manager-integration-test-java</artifactId>
<version>0.5.0</version>
<version>0.5.1</version>
<scope>test</scope>
</dependency>
</dependencies>
Expand Down Expand Up @@ -696,7 +702,7 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-javadoc-plugin</artifactId>
<version>3.5.0</version>
<version>3.6.0</version>
<configuration>
<charset>UTF-8</charset>
<doclint/>
Expand Down Expand Up @@ -748,6 +754,9 @@
<!-- CWE-611: Improper Restriction of XML External Entity Reference ('XXE') (9.8); -->
<!-- Used in tests only. -->
<exclude>CVE-2020-36641</exclude>
<!-- Vulnerabilities in io.netty:netty-handler:jar:4.1.99.Final -->
<!-- CWE-300: Channel Accessible by Non-Endpoint ('Man-in-the-Middle') (6.5); -->
kaklakariada marked this conversation as resolved.
Show resolved Hide resolved
<exclude>CVE-2023-4586</exclude>
</excludeVulnerabilityIds>
</configuration>
</plugin>
Expand Down Expand Up @@ -776,7 +785,7 @@
<plugin>
<groupId>com.exasol</groupId>
<artifactId>project-keeper-maven-plugin</artifactId>
<version>2.9.10</version>
<version>2.9.12</version>
<executions>
<execution>
<goals>
Expand Down Expand Up @@ -829,7 +838,7 @@
<plugin>
<groupId>com.diffplug.spotless</groupId>
<artifactId>spotless-maven-plugin</artifactId>
<version>2.38.0</version>
<version>2.39.0</version>
<configuration>
<scala>
<scalafmt>
Expand Down