diff --git a/.github/workflows/broken_links_checker.yml b/.github/workflows/broken_links_checker.yml index f2079ec..82ec1cd 100644 --- a/.github/workflows/broken_links_checker.yml +++ b/.github/workflows/broken_links_checker.yml @@ -15,7 +15,7 @@ jobs: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - name: Configure broken links checker run: | mkdir -p ./target @@ -27,6 +27,6 @@ jobs: ']}' > ./target/broken_links_checker.json - uses: gaurav-nelson/github-action-markdown-link-check@v1 with: - use-quiet-mode: 'yes' - use-verbose-mode: 'yes' + use-quiet-mode: "yes" + use-verbose-mode: "yes" config-file: ./target/broken_links_checker.json diff --git a/.github/workflows/ci-build-next-java.yml b/.github/workflows/ci-build-next-java.yml index e0c15cf..7cbab08 100644 --- a/.github/workflows/ci-build-next-java.yml +++ b/.github/workflows/ci-build-next-java.yml @@ -14,15 +14,15 @@ jobs: cancel-in-progress: true steps: - name: Checkout the repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 - name: Set up JDK 17 uses: actions/setup-java@v3 with: - distribution: 'temurin' + distribution: "temurin" java-version: 17 - cache: 'maven' + cache: "maven" - name: Run tests and build with Maven run: | mvn --batch-mode --update-snapshots clean package -DtrimStackTrace=false \ diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml index 506e9d0..d19ee2a 100644 --- a/.github/workflows/ci-build.yml +++ b/.github/workflows/ci-build.yml @@ -1,5 +1,6 @@ +# Generated by Project Keeper +# https://github.com/exasol/project-keeper/blob/main/project-keeper/src/main/resources/templates/.github/workflows/ci-build.yml name: CI Build - on: push: branches: @@ -14,11 +15,12 @@ jobs: cancel-in-progress: true steps: - name: Free Disk Space + if: ${{ false }} run: | sudo rm -rf /usr/local/lib/android sudo rm -rf /usr/share/dotnet - name: Checkout the repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 - name: Set up JDK 11 & 17 diff --git a/.github/workflows/dependencies_check.yml b/.github/workflows/dependencies_check.yml index b2ab231..4b6eadf 100644 --- a/.github/workflows/dependencies_check.yml +++ b/.github/workflows/dependencies_check.yml @@ -1,20 +1,35 @@ -name: Dependencies Check +name: Report Security Issues for Repository on: + workflow_dispatch: schedule: - cron: "0 2 * * *" jobs: - build: + report_security_issues: runs-on: ubuntu-latest + permissions: + issues: write steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - name: Set up JDK 11 uses: actions/setup-java@v3 with: - distribution: 'temurin' + distribution: "temurin" java-version: 11 - cache: 'maven' - - name: Checking dependencies for vulnerabilities - run: mvn --batch-mode org.sonatype.ossindex.maven:ossindex-maven-plugin:audit -f pom.xml \ No newline at end of file + cache: "maven" + + - name: Generate ossindex report + run: | + mvn org.sonatype.ossindex.maven:ossindex-maven-plugin:audit \ + org.sonatype.ossindex.maven:ossindex-maven-plugin:audit-aggregate \ + -Dossindex.reportFile=$(pwd)/ossindex-report.json \ + -Dossindex.fail=false + + - name: Report Security Issues + uses: exasol/python-toolbox/.github/actions/security-issues@main + with: + format: "maven" + command: "cat ossindex-report.json" + github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release_droid_prepare_original_checksum.yml b/.github/workflows/release_droid_prepare_original_checksum.yml index 0e2d3e7..ba96c12 100644 --- a/.github/workflows/release_droid_prepare_original_checksum.yml +++ b/.github/workflows/release_droid_prepare_original_checksum.yml @@ -8,11 +8,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Free Disk Space + if: ${{ false }} run: | sudo rm -rf /usr/local/lib/android sudo rm -rf /usr/share/dotnet - name: Checkout the repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 - name: Set up JDK 11 diff --git a/.github/workflows/release_droid_print_quick_checksum.yml b/.github/workflows/release_droid_print_quick_checksum.yml index 8add957..aed4444 100644 --- a/.github/workflows/release_droid_print_quick_checksum.yml +++ b/.github/workflows/release_droid_print_quick_checksum.yml @@ -8,17 +8,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout the repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 - name: Set up JDK 11 uses: actions/setup-java@v3 with: - distribution: 'temurin' + distribution: "temurin" java-version: 11 - cache: 'maven' + cache: "maven" - name: Build with Maven skipping tests run: mvn --batch-mode clean verify -DskipTests - name: Print checksum run: echo 'checksum_start==';find target -maxdepth 1 -name *.jar -exec sha256sum "{}" + | xargs;echo '==checksum_end' - diff --git a/.github/workflows/release_droid_release_on_maven_central.yml b/.github/workflows/release_droid_release_on_maven_central.yml index b467607..dfdbd6a 100644 --- a/.github/workflows/release_droid_release_on_maven_central.yml +++ b/.github/workflows/release_droid_release_on_maven_central.yml @@ -8,15 +8,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout the repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 - name: Set up Maven Central Repository uses: actions/setup-java@v3 with: - distribution: 'temurin' + distribution: "temurin" java-version: 11 - cache: 'maven' + cache: "maven" server-id: ossrh server-username: MAVEN_USERNAME server-password: MAVEN_PASSWORD @@ -27,4 +27,4 @@ jobs: env: MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }} MAVEN_PASSWORD: ${{ secrets.OSSRH_PASSWORD }} - MAVEN_GPG_PASSPHRASE: ${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }} \ No newline at end of file + MAVEN_GPG_PASSPHRASE: ${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }} diff --git a/.github/workflows/release_droid_upload_github_release_assets.yml b/.github/workflows/release_droid_upload_github_release_assets.yml index 7350faf..7ae8bbb 100644 --- a/.github/workflows/release_droid_upload_github_release_assets.yml +++ b/.github/workflows/release_droid_upload_github_release_assets.yml @@ -4,7 +4,7 @@ on: workflow_dispatch: inputs: upload_url: - description: 'Assets upload URL' + description: "Assets upload URL" required: true jobs: @@ -12,15 +12,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout the repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 - name: Set up JDK 11 uses: actions/setup-java@v3 with: - distribution: 'temurin' + distribution: "temurin" java-version: 11 - cache: 'maven' + cache: "maven" - name: Build with Maven skipping tests run: mvn --batch-mode clean verify -DskipTests - name: Generate sha256sum files diff --git a/.project-keeper.yml b/.project-keeper.yml index 057b7b4..7da25d4 100644 --- a/.project-keeper.yml +++ b/.project-keeper.yml @@ -3,5 +3,4 @@ sources: path: pom.xml modules: - maven_central -excludes: - - "E-PK-CORE-18: Outdated content: '.github/workflows/release_droid_upload_github_release_assets.yml'" + - integration_tests diff --git a/dependencies.md b/dependencies.md index 42c544b..1328ad4 100644 --- a/dependencies.md +++ b/dependencies.md @@ -17,35 +17,32 @@ | [JSONassert][8] | [The Apache Software License, Version 2.0][9] | | [JUnit Jupiter (Aggregator)][10] | [Eclipse Public License v2.0][11] | | [EqualsVerifier \| release normal jar][12] | [Apache License, Version 2.0][13] | -| [mockito-junit-jupiter][14] | [The MIT License][15] | -| [Apache Derby Database Engine and Embedded JDBC Driver][16] | [Apache 2][9] | +| [mockito-junit-jupiter][14] | [MIT][5] | +| [Apache Derby Database Engine and Embedded JDBC Driver][15] | [Apache 2][9] | ## Plugin Dependencies -| Dependency | License | -| ------------------------------------------------------- | --------------------------------------------- | -| [SonarQube Scanner for Maven][17] | [GNU LGPL 3][18] | -| [Apache Maven Compiler Plugin][19] | [Apache-2.0][13] | -| [Apache Maven Enforcer Plugin][20] | [Apache-2.0][13] | -| [Maven Flatten Plugin][21] | [Apache Software Licenese][13] | -| [org.sonatype.ossindex.maven:ossindex-maven-plugin][22] | [ASL2][9] | -| [Maven Surefire Plugin][23] | [Apache-2.0][13] | -| [Versions Maven Plugin][24] | [Apache License, Version 2.0][13] | -| [duplicate-finder-maven-plugin Maven Mojo][25] | [Apache License 2.0][26] | -| [Apache Maven Deploy Plugin][27] | [Apache-2.0][13] | -| [Apache Maven GPG Plugin][28] | [Apache-2.0][13] | -| [Apache Maven Source Plugin][29] | [Apache License, Version 2.0][13] | -| [Apache Maven Javadoc Plugin][30] | [Apache-2.0][13] | -| [Nexus Staging Maven Plugin][31] | [Eclipse Public License][32] | -| [JaCoCo :: Maven Plugin][33] | [Eclipse Public License 2.0][34] | -| [error-code-crawler-maven-plugin][35] | [MIT License][36] | -| [Reproducible Build Maven Plugin][37] | [Apache 2.0][9] | -| [Apache Maven JAR Plugin][38] | [Apache License, Version 2.0][13] | -| [Project keeper maven plugin][39] | [The MIT License][40] | -| [Maven Clean Plugin][41] | [The Apache Software License, Version 2.0][9] | -| [Maven Resources Plugin][42] | [The Apache Software License, Version 2.0][9] | -| [Maven Install Plugin][43] | [The Apache Software License, Version 2.0][9] | -| [Maven Site Plugin 3][44] | [The Apache Software License, Version 2.0][9] | +| Dependency | License | +| ------------------------------------------------------- | --------------------------------- | +| [SonarQube Scanner for Maven][16] | [GNU LGPL 3][17] | +| [Apache Maven Compiler Plugin][18] | [Apache-2.0][13] | +| [Apache Maven Enforcer Plugin][19] | [Apache-2.0][13] | +| [Maven Flatten Plugin][20] | [Apache Software Licenese][13] | +| [Apache Maven JAR Plugin][21] | [Apache License, Version 2.0][13] | +| [Project keeper maven plugin][22] | [The MIT License][23] | +| [org.sonatype.ossindex.maven:ossindex-maven-plugin][24] | [ASL2][9] | +| [Maven Surefire Plugin][25] | [Apache-2.0][13] | +| [Versions Maven Plugin][26] | [Apache License, Version 2.0][13] | +| [duplicate-finder-maven-plugin Maven Mojo][27] | [Apache License 2.0][28] | +| [Apache Maven Deploy Plugin][29] | [Apache-2.0][13] | +| [Apache Maven GPG Plugin][30] | [Apache-2.0][13] | +| [Apache Maven Source Plugin][31] | [Apache License, Version 2.0][13] | +| [Apache Maven Javadoc Plugin][32] | [Apache-2.0][13] | +| [Nexus Staging Maven Plugin][33] | [Eclipse Public License][34] | +| [Maven Failsafe Plugin][35] | [Apache-2.0][13] | +| [JaCoCo :: Maven Plugin][36] | [Eclipse Public License 2.0][37] | +| [error-code-crawler-maven-plugin][38] | [MIT License][39] | +| [Reproducible Build Maven Plugin][40] | [Apache 2.0][9] | [0]: https://github.com/exasol/virtual-schema-common-java/ [1]: https://github.com/exasol/virtual-schema-common-java/blob/main/LICENSE @@ -62,33 +59,29 @@ [12]: https://www.jqno.nl/equalsverifier [13]: https://www.apache.org/licenses/LICENSE-2.0.txt [14]: https://github.com/mockito/mockito -[15]: https://github.com/mockito/mockito/blob/main/LICENSE -[16]: http://db.apache.org/derby/ -[17]: http://sonarsource.github.io/sonar-scanner-maven/ -[18]: http://www.gnu.org/licenses/lgpl.txt -[19]: https://maven.apache.org/plugins/maven-compiler-plugin/ -[20]: https://maven.apache.org/enforcer/maven-enforcer-plugin/ -[21]: https://www.mojohaus.org/flatten-maven-plugin/ -[22]: https://sonatype.github.io/ossindex-maven/maven-plugin/ -[23]: https://maven.apache.org/surefire/maven-surefire-plugin/ -[24]: https://www.mojohaus.org/versions/versions-maven-plugin/ -[25]: https://basepom.github.io/duplicate-finder-maven-plugin -[26]: http://www.apache.org/licenses/LICENSE-2.0.html -[27]: https://maven.apache.org/plugins/maven-deploy-plugin/ -[28]: https://maven.apache.org/plugins/maven-gpg-plugin/ -[29]: https://maven.apache.org/plugins/maven-source-plugin/ -[30]: https://maven.apache.org/plugins/maven-javadoc-plugin/ -[31]: http://www.sonatype.com/public-parent/nexus-maven-plugins/nexus-staging/nexus-staging-maven-plugin/ -[32]: http://www.eclipse.org/legal/epl-v10.html -[33]: https://www.jacoco.org/jacoco/trunk/doc/maven.html -[34]: https://www.eclipse.org/legal/epl-2.0/ -[35]: https://github.com/exasol/error-code-crawler-maven-plugin/ -[36]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE -[37]: http://zlika.github.io/reproducible-build-maven-plugin -[38]: https://maven.apache.org/plugins/maven-jar-plugin/ -[39]: https://github.com/exasol/project-keeper/ -[40]: https://github.com/exasol/project-keeper/blob/main/LICENSE -[41]: http://maven.apache.org/plugins/maven-clean-plugin/ -[42]: http://maven.apache.org/plugins/maven-resources-plugin/ -[43]: http://maven.apache.org/plugins/maven-install-plugin/ -[44]: http://maven.apache.org/plugins/maven-site-plugin/ +[15]: http://db.apache.org/derby/ +[16]: http://sonarsource.github.io/sonar-scanner-maven/ +[17]: http://www.gnu.org/licenses/lgpl.txt +[18]: https://maven.apache.org/plugins/maven-compiler-plugin/ +[19]: https://maven.apache.org/enforcer/maven-enforcer-plugin/ +[20]: https://www.mojohaus.org/flatten-maven-plugin/ +[21]: https://maven.apache.org/plugins/maven-jar-plugin/ +[22]: https://github.com/exasol/project-keeper/ +[23]: https://github.com/exasol/project-keeper/blob/main/LICENSE +[24]: https://sonatype.github.io/ossindex-maven/maven-plugin/ +[25]: https://maven.apache.org/surefire/maven-surefire-plugin/ +[26]: https://www.mojohaus.org/versions/versions-maven-plugin/ +[27]: https://basepom.github.io/duplicate-finder-maven-plugin +[28]: http://www.apache.org/licenses/LICENSE-2.0.html +[29]: https://maven.apache.org/plugins/maven-deploy-plugin/ +[30]: https://maven.apache.org/plugins/maven-gpg-plugin/ +[31]: https://maven.apache.org/plugins/maven-source-plugin/ +[32]: https://maven.apache.org/plugins/maven-javadoc-plugin/ +[33]: http://www.sonatype.com/public-parent/nexus-maven-plugins/nexus-staging/nexus-staging-maven-plugin/ +[34]: http://www.eclipse.org/legal/epl-v10.html +[35]: https://maven.apache.org/surefire/maven-failsafe-plugin/ +[36]: https://www.jacoco.org/jacoco/trunk/doc/maven.html +[37]: https://www.eclipse.org/legal/epl-2.0/ +[38]: https://github.com/exasol/error-code-crawler-maven-plugin/ +[39]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE +[40]: http://zlika.github.io/reproducible-build-maven-plugin diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md index 21cce99..b53a894 100644 --- a/doc/changes/changelog.md +++ b/doc/changes/changelog.md @@ -1,5 +1,6 @@ # Changes +* [11.0.3](changes_11.0.3.md) * [11.0.2](changes_11.0.2.md) * [11.0.1](changes_11.0.1.md) * [11.0.0](changes_11.0.0.md) diff --git a/doc/changes/changes_11.0.3.md b/doc/changes/changes_11.0.3.md new file mode 100644 index 0000000..bafa879 --- /dev/null +++ b/doc/changes/changes_11.0.3.md @@ -0,0 +1,35 @@ +# Virtual Schema Common JDBC 11.0.3, released 2023-??-?? + +Code name: + +## Summary + +**Note:** This release excludes vulnerability CVE-2022-46337 in test dependency `org.apache.derby:derby:jar:10.14.2.0`. Newer versions don’t support Java 8 any more. + +## Security + +* #154: Updated dependencies + +## Dependency Updates + +### Compile Dependency Updates + +* Updated `com.exasol:virtual-schema-common-java:17.0.0` to `17.0.1` + +### Test Dependency Updates + +* Updated `nl.jqno.equalsverifier:equalsverifier:3.14.3` to `3.15.3` +* Updated `org.junit.jupiter:junit-jupiter:5.9.3` to `5.10.1` +* Updated `org.mockito:mockito-junit-jupiter:5.4.0` to `5.7.0` + +### Plugin Dependency Updates + +* Updated `com.exasol:error-code-crawler-maven-plugin:1.3.0` to `1.3.1` +* Updated `com.exasol:project-keeper-maven-plugin:2.9.11` to `2.9.16` +* Updated `org.apache.maven.plugins:maven-enforcer-plugin:3.4.0` to `3.4.1` +* Added `org.apache.maven.plugins:maven-failsafe-plugin:3.2.2` +* Updated `org.apache.maven.plugins:maven-javadoc-plugin:3.5.0` to `3.6.2` +* Updated `org.apache.maven.plugins:maven-surefire-plugin:3.1.2` to `3.2.2` +* Updated `org.codehaus.mojo:versions-maven-plugin:2.16.0` to `2.16.1` +* Updated `org.jacoco:jacoco-maven-plugin:0.8.10` to `0.8.11` +* Updated `org.sonarsource.scanner.maven:sonar-maven-plugin:3.9.1.2184` to `3.10.0.2594` diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom index 8208a20..43eda09 100644 --- a/pk_generated_parent.pom +++ b/pk_generated_parent.pom @@ -3,7 +3,7 @@ 4.0.0 com.exasol virtual-schema-common-jdbc-generated-parent - 11.0.2 + 11.0.3 pom UTF-8 @@ -48,7 +48,7 @@ org.sonarsource.scanner.maven sonar-maven-plugin - 3.9.1.2184 + 3.10.0.2594 org.apache.maven.plugins @@ -57,12 +57,18 @@ ${java.version} ${java.version} + true + + + -Xlint:all,-processing + + org.apache.maven.plugins maven-enforcer-plugin - 3.4.0 + 3.4.1 enforce-maven @@ -72,7 +78,7 @@ - [3.8.7,3.9.0) + 3.6.3 @@ -121,7 +127,7 @@ org.apache.maven.plugins maven-surefire-plugin - 3.1.2 + 3.2.2 @@ -132,7 +138,7 @@ org.codehaus.mojo versions-maven-plugin - 2.16.0 + 2.16.1 display-updates @@ -219,7 +225,7 @@ org.apache.maven.plugins maven-javadoc-plugin - 3.5.0 + 3.6.2 attach-javadocs @@ -234,6 +240,7 @@ true true true + true @@ -257,10 +264,30 @@ + + org.apache.maven.plugins + maven-failsafe-plugin + 3.2.2 + + + -Djava.util.logging.config.file=src/test/resources/logging.properties ${argLine} + + ${test.excludeTags} + + + + verify + + integration-test + verify + + + + org.jacoco jacoco-maven-plugin - 0.8.10 + 0.8.11 prepare-agent @@ -301,7 +328,7 @@ com.exasol error-code-crawler-maven-plugin - 1.3.0 + 1.3.1 verify diff --git a/pom.xml b/pom.xml index 5966599..bbd8cf1 100644 --- a/pom.xml +++ b/pom.xml @@ -2,7 +2,7 @@ 4.0.0 virtual-schema-common-jdbc - 11.0.2 + 11.0.3 Virtual Schema Common JDBC Common module for JDBC-based data access from Virtual Schemas. https://github.com/exasol/virtual-schema-common-jdbc/ @@ -10,7 +10,7 @@ com.exasol virtual-schema-common-java - 17.0.0 + 17.0.1 com.exasol @@ -38,19 +38,19 @@ org.junit.jupiter junit-jupiter - 5.9.3 + 5.10.1 test nl.jqno.equalsverifier equalsverifier - 3.14.3 + 3.15.3 test org.mockito mockito-junit-jupiter - 5.4.0 + 5.7.0 test @@ -84,7 +84,7 @@ com.exasol project-keeper-maven-plugin - 2.9.11 + 2.9.16 @@ -93,12 +93,22 @@ + + org.sonatype.ossindex.maven + ossindex-maven-plugin + + + + CVE-2022-46337 + + + virtual-schema-common-jdbc-generated-parent com.exasol - 11.0.2 + 11.0.3 pk_generated_parent.pom diff --git a/src/main/java/com/exasol/adapter/dialects/validators/ExceptionHandlingProperty.java b/src/main/java/com/exasol/adapter/dialects/validators/ExceptionHandlingProperty.java index f251e3f..7c22ccc 100644 --- a/src/main/java/com/exasol/adapter/dialects/validators/ExceptionHandlingProperty.java +++ b/src/main/java/com/exasol/adapter/dialects/validators/ExceptionHandlingProperty.java @@ -14,7 +14,10 @@ /** * This class enables to validate the value of the exception handling property. + * + * @deprecated this will be removed in the next release */ +@Deprecated(forRemoval = true) public class ExceptionHandlingProperty implements PropertyValueValidator { /** @@ -39,4 +42,4 @@ public void validate(final String exceptionHandling) throws PropertyValidationEx .map(Enum::toString).collect(Collectors.toList()).toString()) .toString()); } -} \ No newline at end of file +} diff --git a/src/test/java/com/exasol/adapter/jdbc/RemoteConnectionFactoryTest.java b/src/test/java/com/exasol/adapter/jdbc/RemoteConnectionFactoryTest.java index 75daf73..11bceb6 100644 --- a/src/test/java/com/exasol/adapter/jdbc/RemoteConnectionFactoryTest.java +++ b/src/test/java/com/exasol/adapter/jdbc/RemoteConnectionFactoryTest.java @@ -10,7 +10,6 @@ import static org.mockito.Mockito.when; import java.sql.Connection; -import java.sql.DriverManager; import java.sql.SQLException; import java.util.*;