diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml index 4d3ebab..4b08a41 100644 --- a/.github/workflows/ci-build.yml +++ b/.github/workflows/ci-build.yml @@ -1,5 +1,6 @@ +# Generated by Project Keeper +# https://github.com/exasol/project-keeper/blob/main/project-keeper/src/main/resources/templates/.github/workflows/ci-build-db-version-matrix.yml name: CI Build - on: push: branches: @@ -8,12 +9,19 @@ on: jobs: build: - runs-on: ubuntu-20.04 # UDFs fail with "VM error: Internal error: VM crashed" on ubuntu-latest + runs-on: ubuntu-20.04 concurrency: - group: ${{ github.workflow }}-${{ github.ref }} + group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.exasol_db_version }} cancel-in-progress: true + strategy: + fail-fast: false + matrix: + exasol_db_version: ["7.1.24", "8.23.1"] + env: + DEFAULT_EXASOL_DB_VERSION: "7.1.24" steps: - name: Free Disk Space + if: ${{ false }} run: | sudo rm -rf /usr/local/lib/android sudo rm -rf /usr/share/dotnet @@ -41,14 +49,19 @@ jobs: run: | JAVA_HOME=$JAVA_HOME_11_X64 mvn --batch-mode clean verify \ -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ - -DtrimStackTrace=false + -DtrimStackTrace=false \ + -Dcom.exasol.dockerdb.image=${{ matrix.exasol_db_version }} + env: + # Set additional environment variable as in scala projects the scalatest plugin does not forward + # the system property -Dcom.exasol.dockerdb.image to the test's implementation. + EXASOL_DB_VERSION: ${{ matrix.exasol_db_version }} - name: Publish Test Report uses: scacap/action-surefire-report@v1 if: ${{ always() && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]' }} with: github_token: ${{ secrets.GITHUB_TOKEN }} - name: Sonar analysis - if: ${{ env.SONAR_TOKEN != null }} + if: ${{ env.SONAR_TOKEN != null && matrix.exasol_db_version == env.DEFAULT_EXASOL_DB_VERSION }} run: | JAVA_HOME=$JAVA_HOME_17_X64 mvn --batch-mode org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \ -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ diff --git a/.github/workflows/dependencies_check.yml b/.github/workflows/dependencies_check.yml index 3059964..4b6eadf 100644 --- a/.github/workflows/dependencies_check.yml +++ b/.github/workflows/dependencies_check.yml @@ -1,12 +1,15 @@ -name: Dependencies Check +name: Report Security Issues for Repository on: + workflow_dispatch: schedule: - cron: "0 2 * * *" jobs: - build: + report_security_issues: runs-on: ubuntu-latest + permissions: + issues: write steps: - uses: actions/checkout@v4 @@ -16,5 +19,17 @@ jobs: distribution: "temurin" java-version: 11 cache: "maven" - - name: Checking dependencies for vulnerabilities - run: mvn --batch-mode org.sonatype.ossindex.maven:ossindex-maven-plugin:audit -f pom.xml + + - name: Generate ossindex report + run: | + mvn org.sonatype.ossindex.maven:ossindex-maven-plugin:audit \ + org.sonatype.ossindex.maven:ossindex-maven-plugin:audit-aggregate \ + -Dossindex.reportFile=$(pwd)/ossindex-report.json \ + -Dossindex.fail=false + + - name: Report Security Issues + uses: exasol/python-toolbox/.github/actions/security-issues@main + with: + format: "maven" + command: "cat ossindex-report.json" + github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release_droid_prepare_original_checksum.yml b/.github/workflows/release_droid_prepare_original_checksum.yml index 843604c..bc76555 100644 --- a/.github/workflows/release_droid_prepare_original_checksum.yml +++ b/.github/workflows/release_droid_prepare_original_checksum.yml @@ -5,9 +5,10 @@ on: jobs: build: - runs-on: ubuntu-20.04 # UDFs fail with "VM error: Internal error: VM crashed" on ubuntu-latest + runs-on: ubuntu-20.04 steps: - name: Free Disk Space + if: ${{ false }} run: | sudo rm -rf /usr/local/lib/android sudo rm -rf /usr/share/dotnet diff --git a/.project-keeper.yml b/.project-keeper.yml index ce8a3ac..7ce8f65 100644 --- a/.project-keeper.yml +++ b/.project-keeper.yml @@ -6,6 +6,8 @@ sources: - integration_tests linkReplacements: - https://www.microsoft.com/en-us/sql-server/sql-server-2017|https://www.microsoft.com/en-us/sql-server -excludes: - - "E-PK-CORE-18: Outdated content: '.github/workflows/ci-build.yml'" - - "E-PK-CORE-18: Outdated content: '.github/workflows/release_droid_prepare_original_checksum.yml'" +build: + runnerOs: ubuntu-20.04 + exasolDbVersions: + - "7.1.24" + - "8.23.1" diff --git a/dependencies.md b/dependencies.md index 5a6c18b..bc97cc0 100644 --- a/dependencies.md +++ b/dependencies.md @@ -45,11 +45,6 @@ | [Reproducible Build Maven Plugin][43] | [Apache 2.0][29] | | [Project keeper maven plugin][44] | [The MIT License][45] | | [Maven Dependency Plugin][46] | [The Apache Software License, Version 2.0][29] | -| [Maven Clean Plugin][47] | [The Apache Software License, Version 2.0][29] | -| [Maven Resources Plugin][48] | [The Apache Software License, Version 2.0][29] | -| [Maven Install Plugin][49] | [The Apache Software License, Version 2.0][29] | -| [Maven Deploy Plugin][50] | [The Apache Software License, Version 2.0][29] | -| [Maven Site Plugin 3][51] | [The Apache Software License, Version 2.0][29] | [0]: https://github.com/exasol/virtual-schema-common-jdbc/ [1]: https://github.com/exasol/virtual-schema-common-jdbc/blob/main/LICENSE @@ -62,7 +57,7 @@ [8]: https://junit.org/junit5/ [9]: https://www.eclipse.org/legal/epl-v20.html [10]: https://github.com/mockito/mockito -[11]: https://github.com/mockito/mockito/blob/main/LICENSE +[11]: https://opensource.org/licenses/MIT [12]: https://github.com/exasol/exasol-testcontainers/ [13]: https://github.com/exasol/exasol-testcontainers/blob/main/LICENSE [14]: https://java.testcontainers.org @@ -98,8 +93,3 @@ [44]: https://github.com/exasol/project-keeper/ [45]: https://github.com/exasol/project-keeper/blob/main/LICENSE [46]: http://maven.apache.org/plugins/maven-dependency-plugin/ -[47]: http://maven.apache.org/plugins/maven-clean-plugin/ -[48]: http://maven.apache.org/plugins/maven-resources-plugin/ -[49]: http://maven.apache.org/plugins/maven-install-plugin/ -[50]: http://maven.apache.org/plugins/maven-deploy-plugin/ -[51]: http://maven.apache.org/plugins/maven-site-plugin/ diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md index 166b6f0..c40f56a 100644 --- a/doc/changes/changelog.md +++ b/doc/changes/changelog.md @@ -1,5 +1,6 @@ # Changes +* [2.1.2](changes_2.1.2.md) * [2.1.1](changes_2.1.1.md) * [2.1.0](changes_2.1.0.md) * [2.0.3](changes_2.0.3.md) diff --git a/doc/changes/changes_2.1.2.md b/doc/changes/changes_2.1.2.md new file mode 100644 index 0000000..fcaaaaa --- /dev/null +++ b/doc/changes/changes_2.1.2.md @@ -0,0 +1,35 @@ +# Virtual Schema for SQLServer 2.1.2, released 2023-11-21 + +Code name: Fix CVE-2023-4043 in test dependency `org.eclipse.parsson:parsson` + +## Summary + +This release fixes vulnerability CVE-2023-4043 in test dependency `org.eclipse.parsson:parsson`. + +## Security + +* #114: Fixed CVE-2023-4043 in test dependency `org.eclipse.parsson:parsson` + +## Dependency Updates + +### Test Dependency Updates + +* Updated `com.exasol:exasol-testcontainers:6.6.2` to `6.6.3` +* Updated `com.exasol:hamcrest-resultset-matcher:1.6.1` to `1.6.3` +* Updated `com.exasol:test-db-builder-java:3.5.1` to `3.5.2` +* Updated `com.microsoft.sqlserver:mssql-jdbc:11.2.1.jre8` to `12.4.2.jre8` +* Updated `org.junit.jupiter:junit-jupiter:5.10.0` to `5.10.1` +* Updated `org.mockito:mockito-junit-jupiter:5.6.0` to `5.7.0` +* Updated `org.testcontainers:junit-jupiter:1.19.1` to `1.19.2` +* Updated `org.testcontainers:mssqlserver:1.19.1` to `1.19.2` + +### Plugin Dependency Updates + +* Updated `com.exasol:error-code-crawler-maven-plugin:1.3.0` to `1.3.1` +* Updated `com.exasol:project-keeper-maven-plugin:2.9.12` to `2.9.16` +* Updated `org.apache.maven.plugins:maven-enforcer-plugin:3.4.0` to `3.4.1` +* Updated `org.apache.maven.plugins:maven-failsafe-plugin:3.1.2` to `3.2.2` +* Updated `org.apache.maven.plugins:maven-surefire-plugin:3.1.2` to `3.2.2` +* Updated `org.codehaus.mojo:versions-maven-plugin:2.16.0` to `2.16.1` +* Updated `org.jacoco:jacoco-maven-plugin:0.8.10` to `0.8.11` +* Updated `org.sonarsource.scanner.maven:sonar-maven-plugin:3.9.1.2184` to `3.10.0.2594` diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom index 46d949e..b474f63 100644 --- a/pk_generated_parent.pom +++ b/pk_generated_parent.pom @@ -3,7 +3,7 @@ 4.0.0 com.exasol sqlserver-virtual-schema-generated-parent - 2.1.1 + 2.1.2 pom UTF-8 @@ -37,7 +37,7 @@ org.sonarsource.scanner.maven sonar-maven-plugin - 3.9.1.2184 + 3.10.0.2594 org.apache.maven.plugins @@ -46,12 +46,18 @@ ${java.version} ${java.version} + true + + + -Xlint:all,-processing + + org.apache.maven.plugins maven-enforcer-plugin - 3.4.0 + 3.4.1 enforce-maven @@ -61,7 +67,7 @@ - [3.8.7,3.9.0) + 3.6.3 @@ -110,7 +116,7 @@ org.apache.maven.plugins maven-surefire-plugin - 3.1.2 + 3.2.2 @@ -121,7 +127,7 @@ org.codehaus.mojo versions-maven-plugin - 2.16.0 + 2.16.1 display-updates @@ -214,10 +220,9 @@ org.apache.maven.plugins maven-failsafe-plugin - 3.1.2 + 3.2.2 - + -Djava.util.logging.config.file=src/test/resources/logging.properties ${argLine} ${test.excludeTags} @@ -235,7 +240,7 @@ org.jacoco jacoco-maven-plugin - 0.8.10 + 0.8.11 prepare-agent @@ -276,7 +281,7 @@ com.exasol error-code-crawler-maven-plugin - 1.3.0 + 1.3.1 verify diff --git a/pom.xml b/pom.xml index 50a6c0d..734a5e2 100644 --- a/pom.xml +++ b/pom.xml @@ -2,30 +2,14 @@ 4.0.0 sqlserver-virtual-schema - 2.1.1 + 2.1.2 Virtual Schema for SQLServer Abstraction layer that makes an external Microsoft SQL Server database accessible from an Exasol database through regular SQL commands https://github.com/exasol/sqlserver-virtual-schema/ 11.0.2 - 1.19.1 + 1.19.2 - - - maven.exasol.com - https://maven.exasol.com/artifactory/exasol-releases - - false - - - - maven.exasol.com-snapshots - https://maven.exasol.com/artifactory/exasol-snapshots - - true - - - com.exasol @@ -59,20 +43,20 @@ org.junit.jupiter junit-jupiter - 5.10.0 + 5.10.1 test org.mockito mockito-junit-jupiter - 5.6.0 + 5.7.0 test com.exasol exasol-testcontainers - 6.6.2 + 6.6.3 test @@ -84,7 +68,7 @@ com.microsoft.sqlserver mssql-jdbc - 11.2.1.jre8 + 12.4.2.jre8 test @@ -97,13 +81,13 @@ com.exasol test-db-builder-java - 3.5.1 + 3.5.2 test com.exasol hamcrest-resultset-matcher - 1.6.1 + 1.6.3 test @@ -135,7 +119,7 @@ com.exasol project-keeper-maven-plugin - 2.9.12 + 2.9.16 @@ -168,7 +152,7 @@ sqlserver-virtual-schema-generated-parent com.exasol - 2.1.1 + 2.1.2 pk_generated_parent.pom