diff --git a/.github/workflows/dependencies_check.yml b/.github/workflows/dependencies_check.yml index 3059964..4b6eadf 100644 --- a/.github/workflows/dependencies_check.yml +++ b/.github/workflows/dependencies_check.yml @@ -1,12 +1,15 @@ -name: Dependencies Check +name: Report Security Issues for Repository on: + workflow_dispatch: schedule: - cron: "0 2 * * *" jobs: - build: + report_security_issues: runs-on: ubuntu-latest + permissions: + issues: write steps: - uses: actions/checkout@v4 @@ -16,5 +19,17 @@ jobs: distribution: "temurin" java-version: 11 cache: "maven" - - name: Checking dependencies for vulnerabilities - run: mvn --batch-mode org.sonatype.ossindex.maven:ossindex-maven-plugin:audit -f pom.xml + + - name: Generate ossindex report + run: | + mvn org.sonatype.ossindex.maven:ossindex-maven-plugin:audit \ + org.sonatype.ossindex.maven:ossindex-maven-plugin:audit-aggregate \ + -Dossindex.reportFile=$(pwd)/ossindex-report.json \ + -Dossindex.fail=false + + - name: Report Security Issues + uses: exasol/python-toolbox/.github/actions/security-issues@main + with: + format: "maven" + command: "cat ossindex-report.json" + github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/dependencies.md b/dependencies.md index c4b0466..f68537e 100644 --- a/dependencies.md +++ b/dependencies.md @@ -37,34 +37,34 @@ | AWSGlueETL | [Amazon Software License][33] | | [Test containers for Exasol on Docker][34] | [MIT License][35] | | [Test Database Builder for Java][36] | [MIT License][37] | -| [Test utilities for `java.util.logging`][38] | [MIT][39] | -| [Matcher for SQL Result Sets][40] | [MIT License][41] | -| [EqualsVerifier \| release normal jar][42] | [Apache License, Version 2.0][3] | -| [Apache Log4j API][43] | [Apache-2.0][3] | -| [Apache Log4j Core][44] | [Apache-2.0][3] | +| [Test utilities for `java.util.logging`][38] | [MIT][26] | +| [Matcher for SQL Result Sets][39] | [MIT License][40] | +| [EqualsVerifier \| release normal jar][41] | [Apache License, Version 2.0][3] | +| [Apache Log4j API][42] | [Apache-2.0][3] | +| [Apache Log4j Core][43] | [Apache-2.0][3] | ## Plugin Dependencies | Dependency | License | | ------------------------------------------------------- | ------------------------------------- | -| [SonarQube Scanner for Maven][45] | [GNU LGPL 3][46] | -| [Apache Maven Compiler Plugin][47] | [Apache-2.0][3] | -| [Apache Maven Enforcer Plugin][48] | [Apache-2.0][3] | -| [Maven Flatten Plugin][49] | [Apache Software Licenese][3] | -| [Apache Maven Shade Plugin][50] | [Apache-2.0][3] | -| [OpenFastTrace Maven Plugin][51] | [GNU General Public License v3.0][52] | -| [org.sonatype.ossindex.maven:ossindex-maven-plugin][53] | [ASL2][11] | -| [Maven Surefire Plugin][54] | [Apache-2.0][3] | -| [Versions Maven Plugin][55] | [Apache License, Version 2.0][3] | -| [duplicate-finder-maven-plugin Maven Mojo][56] | [Apache License 2.0][1] | -| [Apache Maven Assembly Plugin][57] | [Apache-2.0][3] | -| [Apache Maven JAR Plugin][58] | [Apache License, Version 2.0][3] | -| [Project keeper maven plugin][59] | [The MIT License][60] | -| [Artifact reference checker and unifier][61] | [MIT License][62] | -| [Maven Failsafe Plugin][63] | [Apache-2.0][3] | -| [JaCoCo :: Maven Plugin][64] | [Eclipse Public License 2.0][65] | -| [error-code-crawler-maven-plugin][66] | [MIT License][67] | -| [Reproducible Build Maven Plugin][68] | [Apache 2.0][11] | +| [SonarQube Scanner for Maven][44] | [GNU LGPL 3][45] | +| [Apache Maven Compiler Plugin][46] | [Apache-2.0][3] | +| [Apache Maven Enforcer Plugin][47] | [Apache-2.0][3] | +| [Maven Flatten Plugin][48] | [Apache Software Licenese][3] | +| [Apache Maven Shade Plugin][49] | [Apache-2.0][3] | +| [OpenFastTrace Maven Plugin][50] | [GNU General Public License v3.0][51] | +| [org.sonatype.ossindex.maven:ossindex-maven-plugin][52] | [ASL2][11] | +| [Maven Surefire Plugin][53] | [Apache-2.0][3] | +| [Versions Maven Plugin][54] | [Apache License, Version 2.0][3] | +| [duplicate-finder-maven-plugin Maven Mojo][55] | [Apache License 2.0][1] | +| [Apache Maven Assembly Plugin][56] | [Apache-2.0][3] | +| [Apache Maven JAR Plugin][57] | [Apache License, Version 2.0][3] | +| [Project keeper maven plugin][58] | [The MIT License][59] | +| [Artifact reference checker and unifier][60] | [MIT License][61] | +| [Maven Failsafe Plugin][62] | [Apache-2.0][3] | +| [JaCoCo :: Maven Plugin][63] | [Eclipse Public License 2.0][64] | +| [error-code-crawler-maven-plugin][65] | [MIT License][66] | +| [Reproducible Build Maven Plugin][67] | [Apache 2.0][11] | [0]: https://spark.apache.org/ [1]: http://www.apache.org/licenses/LICENSE-2.0.html @@ -92,7 +92,7 @@ [23]: https://github.com/exasol/error-reporting-java/ [24]: https://github.com/exasol/error-reporting-java/blob/main/LICENSE [25]: https://github.com/mockito/mockito -[26]: https://github.com/mockito/mockito/blob/main/LICENSE +[26]: https://opensource.org/licenses/MIT [27]: https://junit.org/junit5/ [28]: https://www.eclipse.org/legal/epl-v20.html [29]: http://hamcrest.org/JavaHamcrest/ @@ -105,33 +105,32 @@ [36]: https://github.com/exasol/test-db-builder-java/ [37]: https://github.com/exasol/test-db-builder-java/blob/main/LICENSE [38]: https://github.com/exasol/java-util-logging-testing/ -[39]: https://opensource.org/licenses/MIT -[40]: https://github.com/exasol/hamcrest-resultset-matcher/ -[41]: https://github.com/exasol/hamcrest-resultset-matcher/blob/main/LICENSE -[42]: https://www.jqno.nl/equalsverifier -[43]: https://logging.apache.org/log4j/2.x/log4j/log4j-api/ -[44]: https://logging.apache.org/log4j/2.x/log4j/log4j-core/ -[45]: http://sonarsource.github.io/sonar-scanner-maven/ -[46]: http://www.gnu.org/licenses/lgpl.txt -[47]: https://maven.apache.org/plugins/maven-compiler-plugin/ -[48]: https://maven.apache.org/enforcer/maven-enforcer-plugin/ -[49]: https://www.mojohaus.org/flatten-maven-plugin/ -[50]: https://maven.apache.org/plugins/maven-shade-plugin/ -[51]: https://github.com/itsallcode/openfasttrace-maven-plugin -[52]: https://www.gnu.org/licenses/gpl-3.0.html -[53]: https://sonatype.github.io/ossindex-maven/maven-plugin/ -[54]: https://maven.apache.org/surefire/maven-surefire-plugin/ -[55]: https://www.mojohaus.org/versions/versions-maven-plugin/ -[56]: https://basepom.github.io/duplicate-finder-maven-plugin -[57]: https://maven.apache.org/plugins/maven-assembly-plugin/ -[58]: https://maven.apache.org/plugins/maven-jar-plugin/ -[59]: https://github.com/exasol/project-keeper/ -[60]: https://github.com/exasol/project-keeper/blob/main/LICENSE -[61]: https://github.com/exasol/artifact-reference-checker-maven-plugin/ -[62]: https://github.com/exasol/artifact-reference-checker-maven-plugin/blob/main/LICENSE -[63]: https://maven.apache.org/surefire/maven-failsafe-plugin/ -[64]: https://www.jacoco.org/jacoco/trunk/doc/maven.html -[65]: https://www.eclipse.org/legal/epl-2.0/ -[66]: https://github.com/exasol/error-code-crawler-maven-plugin/ -[67]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE -[68]: http://zlika.github.io/reproducible-build-maven-plugin +[39]: https://github.com/exasol/hamcrest-resultset-matcher/ +[40]: https://github.com/exasol/hamcrest-resultset-matcher/blob/main/LICENSE +[41]: https://www.jqno.nl/equalsverifier +[42]: https://logging.apache.org/log4j/2.x/log4j/log4j-api/ +[43]: https://logging.apache.org/log4j/2.x/log4j/log4j-core/ +[44]: http://sonarsource.github.io/sonar-scanner-maven/ +[45]: http://www.gnu.org/licenses/lgpl.txt +[46]: https://maven.apache.org/plugins/maven-compiler-plugin/ +[47]: https://maven.apache.org/enforcer/maven-enforcer-plugin/ +[48]: https://www.mojohaus.org/flatten-maven-plugin/ +[49]: https://maven.apache.org/plugins/maven-shade-plugin/ +[50]: https://github.com/itsallcode/openfasttrace-maven-plugin +[51]: https://www.gnu.org/licenses/gpl-3.0.html +[52]: https://sonatype.github.io/ossindex-maven/maven-plugin/ +[53]: https://maven.apache.org/surefire/maven-surefire-plugin/ +[54]: https://www.mojohaus.org/versions/versions-maven-plugin/ +[55]: https://basepom.github.io/duplicate-finder-maven-plugin +[56]: https://maven.apache.org/plugins/maven-assembly-plugin/ +[57]: https://maven.apache.org/plugins/maven-jar-plugin/ +[58]: https://github.com/exasol/project-keeper/ +[59]: https://github.com/exasol/project-keeper/blob/main/LICENSE +[60]: https://github.com/exasol/artifact-reference-checker-maven-plugin/ +[61]: https://github.com/exasol/artifact-reference-checker-maven-plugin/blob/main/LICENSE +[62]: https://maven.apache.org/surefire/maven-failsafe-plugin/ +[63]: https://www.jacoco.org/jacoco/trunk/doc/maven.html +[64]: https://www.eclipse.org/legal/epl-2.0/ +[65]: https://github.com/exasol/error-code-crawler-maven-plugin/ +[66]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE +[67]: http://zlika.github.io/reproducible-build-maven-plugin diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md index fb7abb4..8acc170 100644 --- a/doc/changes/changelog.md +++ b/doc/changes/changelog.md @@ -1,5 +1,6 @@ # Changes +* [2.1.1](changes_2.1.1.md) * [2.1.0](changes_2.1.0.md) * [2.0.1](changes_2.0.1.md) * [2.0.0](changes_2.0.0.md) diff --git a/doc/changes/changes_2.1.1.md b/doc/changes/changes_2.1.1.md new file mode 100644 index 0000000..bffb985 --- /dev/null +++ b/doc/changes/changes_2.1.1.md @@ -0,0 +1,40 @@ +# Exasol AWS Glue Connector 2.1.1, released 2023-11-20 + +Code name: Fix CVE-2023-4043 in test dependency `org.eclipse.parsson:parsson` + +## Summary + +This release fixes vulnerability CVE-2023-4043 in test dependency `org.eclipse.parsson:parsson`. + +## Security + +* #82: Fixed CVE-2023-4043 in test dependency `org.eclipse.parsson:parsson` + +## Dependency Updates + +### Compile Dependency Updates + +* Updated `software.amazon.awssdk:s3:2.21.8` to `2.21.26` + +### Test Dependency Updates + +* Updated `com.amazonaws:aws-java-sdk-s3:1.12.574` to `1.12.592` +* Updated `com.exasol:exasol-testcontainers:6.6.2` to `6.6.3` +* Updated `com.exasol:hamcrest-resultset-matcher:1.6.1` to `1.6.2` +* Updated `com.exasol:test-db-builder-java:3.5.1` to `3.5.2` +* Updated `nl.jqno.equalsverifier:equalsverifier:3.15.2` to `3.15.3` +* Updated `org.apache.logging.log4j:log4j-api:2.21.1` to `2.22.0` +* Updated `org.apache.logging.log4j:log4j-core:2.21.1` to `2.22.0` +* Updated `org.junit.jupiter:junit-jupiter-api:5.10.0` to `5.10.1` +* Updated `org.junit.jupiter:junit-jupiter:5.10.0` to `5.10.1` +* Updated `org.mockito:mockito-core:5.6.0` to `5.7.0` +* Updated `org.mockito:mockito-junit-jupiter:5.6.0` to `5.7.0` +* Updated `org.testcontainers:junit-jupiter:1.19.1` to `1.19.2` +* Updated `org.testcontainers:localstack:1.19.1` to `1.19.2` + +### Plugin Dependency Updates + +* Updated `com.exasol:project-keeper-maven-plugin:2.9.14` to `2.9.16` +* Updated `org.apache.maven.plugins:maven-failsafe-plugin:3.1.2` to `3.2.2` +* Updated `org.apache.maven.plugins:maven-shade-plugin:3.5.0` to `3.5.1` +* Updated `org.apache.maven.plugins:maven-surefire-plugin:3.1.2` to `3.2.2` diff --git a/doc/developers_guide/developers_guide.md b/doc/developers_guide/developers_guide.md index 4e68eec..5fa4329 100644 --- a/doc/developers_guide/developers_guide.md +++ b/doc/developers_guide/developers_guide.md @@ -40,11 +40,11 @@ To test connector by creating a custom connector, please follow these steps. ### Creating an Assembly Jar -By running `mvn verify` or `mvn package` create a connector artifact. For example, `target/exasol-glue-connector-2.1.0-assembly.jar`. +By running `mvn verify` or `mvn package` create a connector artifact. For example, `target/exasol-glue-connector-2.1.1-assembly.jar`. ### Uploading the Artifact to S3 Bucket -Upload the JAR artifact from previous step into an S3 bucket. For instance, `s3://exasol-artifacts/glue-connector/exasol-glue-connector-2.1.0-assembly.jar`. +Upload the JAR artifact from previous step into an S3 bucket. For instance, `s3://exasol-artifacts/glue-connector/exasol-glue-connector-2.1.1-assembly.jar`. ### Creating a Glue Studio Custom Connector diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom index 2158169..233725d 100644 --- a/pk_generated_parent.pom +++ b/pk_generated_parent.pom @@ -3,7 +3,7 @@ 4.0.0 com.exasol glue-connector-generated-parent - 2.1.0 + 2.1.1 pom UTF-8 @@ -46,6 +46,12 @@ ${java.version} ${java.version} + true + + + -Xlint:all,-processing + + @@ -110,7 +116,7 @@ org.apache.maven.plugins maven-surefire-plugin - 3.1.2 + 3.2.2 @@ -214,10 +220,9 @@ org.apache.maven.plugins maven-failsafe-plugin - 3.1.2 + 3.2.2 - + -Djava.util.logging.config.file=src/test/resources/logging.properties ${argLine} ${test.excludeTags} diff --git a/pom.xml b/pom.xml index 25b6397..c36d3ee 100644 --- a/pom.xml +++ b/pom.xml @@ -3,22 +3,22 @@ 4.0.0 com.exasol glue-connector - 2.1.0 + 2.1.1 Exasol AWS Glue Connector An AWS Glue connector for accessing Exasol database https://github.com/exasol/glue-connector/ glue-connector-generated-parent com.exasol - 2.1.0 + 2.1.1 pk_generated_parent.pom 8 3.3.6 - 5.10.0 - 5.6.0 - 2.21.1 + 5.10.1 + 5.7.0 + 2.22.0 @@ -131,7 +131,7 @@ org.apache.commons commons-compress - 1.24.0 + 1.25.0 provided com.fasterxml.jackson.core @@ -225,7 +227,7 @@ software.amazon.awssdk s3 - 2.21.8 + 2.21.26 io.netty @@ -287,13 +289,13 @@ org.testcontainers junit-jupiter - 1.19.1 + 1.19.2 test org.testcontainers localstack - 1.19.1 + 1.19.2 test - - - CVE-2022-31777 - - - CVE-2023-22946