diff --git a/.github/workflows/dependencies_check.yml b/.github/workflows/dependencies_check.yml
index 3059964..4b6eadf 100644
--- a/.github/workflows/dependencies_check.yml
+++ b/.github/workflows/dependencies_check.yml
@@ -1,12 +1,15 @@
-name: Dependencies Check
+name: Report Security Issues for Repository
on:
+ workflow_dispatch:
schedule:
- cron: "0 2 * * *"
jobs:
- build:
+ report_security_issues:
runs-on: ubuntu-latest
+ permissions:
+ issues: write
steps:
- uses: actions/checkout@v4
@@ -16,5 +19,17 @@ jobs:
distribution: "temurin"
java-version: 11
cache: "maven"
- - name: Checking dependencies for vulnerabilities
- run: mvn --batch-mode org.sonatype.ossindex.maven:ossindex-maven-plugin:audit -f pom.xml
+
+ - name: Generate ossindex report
+ run: |
+ mvn org.sonatype.ossindex.maven:ossindex-maven-plugin:audit \
+ org.sonatype.ossindex.maven:ossindex-maven-plugin:audit-aggregate \
+ -Dossindex.reportFile=$(pwd)/ossindex-report.json \
+ -Dossindex.fail=false
+
+ - name: Report Security Issues
+ uses: exasol/python-toolbox/.github/actions/security-issues@main
+ with:
+ format: "maven"
+ command: "cat ossindex-report.json"
+ github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/dependencies.md b/dependencies.md
index c4b0466..f68537e 100644
--- a/dependencies.md
+++ b/dependencies.md
@@ -37,34 +37,34 @@
| AWSGlueETL | [Amazon Software License][33] |
| [Test containers for Exasol on Docker][34] | [MIT License][35] |
| [Test Database Builder for Java][36] | [MIT License][37] |
-| [Test utilities for `java.util.logging`][38] | [MIT][39] |
-| [Matcher for SQL Result Sets][40] | [MIT License][41] |
-| [EqualsVerifier \| release normal jar][42] | [Apache License, Version 2.0][3] |
-| [Apache Log4j API][43] | [Apache-2.0][3] |
-| [Apache Log4j Core][44] | [Apache-2.0][3] |
+| [Test utilities for `java.util.logging`][38] | [MIT][26] |
+| [Matcher for SQL Result Sets][39] | [MIT License][40] |
+| [EqualsVerifier \| release normal jar][41] | [Apache License, Version 2.0][3] |
+| [Apache Log4j API][42] | [Apache-2.0][3] |
+| [Apache Log4j Core][43] | [Apache-2.0][3] |
## Plugin Dependencies
| Dependency | License |
| ------------------------------------------------------- | ------------------------------------- |
-| [SonarQube Scanner for Maven][45] | [GNU LGPL 3][46] |
-| [Apache Maven Compiler Plugin][47] | [Apache-2.0][3] |
-| [Apache Maven Enforcer Plugin][48] | [Apache-2.0][3] |
-| [Maven Flatten Plugin][49] | [Apache Software Licenese][3] |
-| [Apache Maven Shade Plugin][50] | [Apache-2.0][3] |
-| [OpenFastTrace Maven Plugin][51] | [GNU General Public License v3.0][52] |
-| [org.sonatype.ossindex.maven:ossindex-maven-plugin][53] | [ASL2][11] |
-| [Maven Surefire Plugin][54] | [Apache-2.0][3] |
-| [Versions Maven Plugin][55] | [Apache License, Version 2.0][3] |
-| [duplicate-finder-maven-plugin Maven Mojo][56] | [Apache License 2.0][1] |
-| [Apache Maven Assembly Plugin][57] | [Apache-2.0][3] |
-| [Apache Maven JAR Plugin][58] | [Apache License, Version 2.0][3] |
-| [Project keeper maven plugin][59] | [The MIT License][60] |
-| [Artifact reference checker and unifier][61] | [MIT License][62] |
-| [Maven Failsafe Plugin][63] | [Apache-2.0][3] |
-| [JaCoCo :: Maven Plugin][64] | [Eclipse Public License 2.0][65] |
-| [error-code-crawler-maven-plugin][66] | [MIT License][67] |
-| [Reproducible Build Maven Plugin][68] | [Apache 2.0][11] |
+| [SonarQube Scanner for Maven][44] | [GNU LGPL 3][45] |
+| [Apache Maven Compiler Plugin][46] | [Apache-2.0][3] |
+| [Apache Maven Enforcer Plugin][47] | [Apache-2.0][3] |
+| [Maven Flatten Plugin][48] | [Apache Software Licenese][3] |
+| [Apache Maven Shade Plugin][49] | [Apache-2.0][3] |
+| [OpenFastTrace Maven Plugin][50] | [GNU General Public License v3.0][51] |
+| [org.sonatype.ossindex.maven:ossindex-maven-plugin][52] | [ASL2][11] |
+| [Maven Surefire Plugin][53] | [Apache-2.0][3] |
+| [Versions Maven Plugin][54] | [Apache License, Version 2.0][3] |
+| [duplicate-finder-maven-plugin Maven Mojo][55] | [Apache License 2.0][1] |
+| [Apache Maven Assembly Plugin][56] | [Apache-2.0][3] |
+| [Apache Maven JAR Plugin][57] | [Apache License, Version 2.0][3] |
+| [Project keeper maven plugin][58] | [The MIT License][59] |
+| [Artifact reference checker and unifier][60] | [MIT License][61] |
+| [Maven Failsafe Plugin][62] | [Apache-2.0][3] |
+| [JaCoCo :: Maven Plugin][63] | [Eclipse Public License 2.0][64] |
+| [error-code-crawler-maven-plugin][65] | [MIT License][66] |
+| [Reproducible Build Maven Plugin][67] | [Apache 2.0][11] |
[0]: https://spark.apache.org/
[1]: http://www.apache.org/licenses/LICENSE-2.0.html
@@ -92,7 +92,7 @@
[23]: https://github.com/exasol/error-reporting-java/
[24]: https://github.com/exasol/error-reporting-java/blob/main/LICENSE
[25]: https://github.com/mockito/mockito
-[26]: https://github.com/mockito/mockito/blob/main/LICENSE
+[26]: https://opensource.org/licenses/MIT
[27]: https://junit.org/junit5/
[28]: https://www.eclipse.org/legal/epl-v20.html
[29]: http://hamcrest.org/JavaHamcrest/
@@ -105,33 +105,32 @@
[36]: https://github.com/exasol/test-db-builder-java/
[37]: https://github.com/exasol/test-db-builder-java/blob/main/LICENSE
[38]: https://github.com/exasol/java-util-logging-testing/
-[39]: https://opensource.org/licenses/MIT
-[40]: https://github.com/exasol/hamcrest-resultset-matcher/
-[41]: https://github.com/exasol/hamcrest-resultset-matcher/blob/main/LICENSE
-[42]: https://www.jqno.nl/equalsverifier
-[43]: https://logging.apache.org/log4j/2.x/log4j/log4j-api/
-[44]: https://logging.apache.org/log4j/2.x/log4j/log4j-core/
-[45]: http://sonarsource.github.io/sonar-scanner-maven/
-[46]: http://www.gnu.org/licenses/lgpl.txt
-[47]: https://maven.apache.org/plugins/maven-compiler-plugin/
-[48]: https://maven.apache.org/enforcer/maven-enforcer-plugin/
-[49]: https://www.mojohaus.org/flatten-maven-plugin/
-[50]: https://maven.apache.org/plugins/maven-shade-plugin/
-[51]: https://github.com/itsallcode/openfasttrace-maven-plugin
-[52]: https://www.gnu.org/licenses/gpl-3.0.html
-[53]: https://sonatype.github.io/ossindex-maven/maven-plugin/
-[54]: https://maven.apache.org/surefire/maven-surefire-plugin/
-[55]: https://www.mojohaus.org/versions/versions-maven-plugin/
-[56]: https://basepom.github.io/duplicate-finder-maven-plugin
-[57]: https://maven.apache.org/plugins/maven-assembly-plugin/
-[58]: https://maven.apache.org/plugins/maven-jar-plugin/
-[59]: https://github.com/exasol/project-keeper/
-[60]: https://github.com/exasol/project-keeper/blob/main/LICENSE
-[61]: https://github.com/exasol/artifact-reference-checker-maven-plugin/
-[62]: https://github.com/exasol/artifact-reference-checker-maven-plugin/blob/main/LICENSE
-[63]: https://maven.apache.org/surefire/maven-failsafe-plugin/
-[64]: https://www.jacoco.org/jacoco/trunk/doc/maven.html
-[65]: https://www.eclipse.org/legal/epl-2.0/
-[66]: https://github.com/exasol/error-code-crawler-maven-plugin/
-[67]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE
-[68]: http://zlika.github.io/reproducible-build-maven-plugin
+[39]: https://github.com/exasol/hamcrest-resultset-matcher/
+[40]: https://github.com/exasol/hamcrest-resultset-matcher/blob/main/LICENSE
+[41]: https://www.jqno.nl/equalsverifier
+[42]: https://logging.apache.org/log4j/2.x/log4j/log4j-api/
+[43]: https://logging.apache.org/log4j/2.x/log4j/log4j-core/
+[44]: http://sonarsource.github.io/sonar-scanner-maven/
+[45]: http://www.gnu.org/licenses/lgpl.txt
+[46]: https://maven.apache.org/plugins/maven-compiler-plugin/
+[47]: https://maven.apache.org/enforcer/maven-enforcer-plugin/
+[48]: https://www.mojohaus.org/flatten-maven-plugin/
+[49]: https://maven.apache.org/plugins/maven-shade-plugin/
+[50]: https://github.com/itsallcode/openfasttrace-maven-plugin
+[51]: https://www.gnu.org/licenses/gpl-3.0.html
+[52]: https://sonatype.github.io/ossindex-maven/maven-plugin/
+[53]: https://maven.apache.org/surefire/maven-surefire-plugin/
+[54]: https://www.mojohaus.org/versions/versions-maven-plugin/
+[55]: https://basepom.github.io/duplicate-finder-maven-plugin
+[56]: https://maven.apache.org/plugins/maven-assembly-plugin/
+[57]: https://maven.apache.org/plugins/maven-jar-plugin/
+[58]: https://github.com/exasol/project-keeper/
+[59]: https://github.com/exasol/project-keeper/blob/main/LICENSE
+[60]: https://github.com/exasol/artifact-reference-checker-maven-plugin/
+[61]: https://github.com/exasol/artifact-reference-checker-maven-plugin/blob/main/LICENSE
+[62]: https://maven.apache.org/surefire/maven-failsafe-plugin/
+[63]: https://www.jacoco.org/jacoco/trunk/doc/maven.html
+[64]: https://www.eclipse.org/legal/epl-2.0/
+[65]: https://github.com/exasol/error-code-crawler-maven-plugin/
+[66]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE
+[67]: http://zlika.github.io/reproducible-build-maven-plugin
diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md
index fb7abb4..8acc170 100644
--- a/doc/changes/changelog.md
+++ b/doc/changes/changelog.md
@@ -1,5 +1,6 @@
# Changes
+* [2.1.1](changes_2.1.1.md)
* [2.1.0](changes_2.1.0.md)
* [2.0.1](changes_2.0.1.md)
* [2.0.0](changes_2.0.0.md)
diff --git a/doc/changes/changes_2.1.1.md b/doc/changes/changes_2.1.1.md
new file mode 100644
index 0000000..bffb985
--- /dev/null
+++ b/doc/changes/changes_2.1.1.md
@@ -0,0 +1,40 @@
+# Exasol AWS Glue Connector 2.1.1, released 2023-11-20
+
+Code name: Fix CVE-2023-4043 in test dependency `org.eclipse.parsson:parsson`
+
+## Summary
+
+This release fixes vulnerability CVE-2023-4043 in test dependency `org.eclipse.parsson:parsson`.
+
+## Security
+
+* #82: Fixed CVE-2023-4043 in test dependency `org.eclipse.parsson:parsson`
+
+## Dependency Updates
+
+### Compile Dependency Updates
+
+* Updated `software.amazon.awssdk:s3:2.21.8` to `2.21.26`
+
+### Test Dependency Updates
+
+* Updated `com.amazonaws:aws-java-sdk-s3:1.12.574` to `1.12.592`
+* Updated `com.exasol:exasol-testcontainers:6.6.2` to `6.6.3`
+* Updated `com.exasol:hamcrest-resultset-matcher:1.6.1` to `1.6.2`
+* Updated `com.exasol:test-db-builder-java:3.5.1` to `3.5.2`
+* Updated `nl.jqno.equalsverifier:equalsverifier:3.15.2` to `3.15.3`
+* Updated `org.apache.logging.log4j:log4j-api:2.21.1` to `2.22.0`
+* Updated `org.apache.logging.log4j:log4j-core:2.21.1` to `2.22.0`
+* Updated `org.junit.jupiter:junit-jupiter-api:5.10.0` to `5.10.1`
+* Updated `org.junit.jupiter:junit-jupiter:5.10.0` to `5.10.1`
+* Updated `org.mockito:mockito-core:5.6.0` to `5.7.0`
+* Updated `org.mockito:mockito-junit-jupiter:5.6.0` to `5.7.0`
+* Updated `org.testcontainers:junit-jupiter:1.19.1` to `1.19.2`
+* Updated `org.testcontainers:localstack:1.19.1` to `1.19.2`
+
+### Plugin Dependency Updates
+
+* Updated `com.exasol:project-keeper-maven-plugin:2.9.14` to `2.9.16`
+* Updated `org.apache.maven.plugins:maven-failsafe-plugin:3.1.2` to `3.2.2`
+* Updated `org.apache.maven.plugins:maven-shade-plugin:3.5.0` to `3.5.1`
+* Updated `org.apache.maven.plugins:maven-surefire-plugin:3.1.2` to `3.2.2`
diff --git a/doc/developers_guide/developers_guide.md b/doc/developers_guide/developers_guide.md
index 4e68eec..5fa4329 100644
--- a/doc/developers_guide/developers_guide.md
+++ b/doc/developers_guide/developers_guide.md
@@ -40,11 +40,11 @@ To test connector by creating a custom connector, please follow these steps.
### Creating an Assembly Jar
-By running `mvn verify` or `mvn package` create a connector artifact. For example, `target/exasol-glue-connector-2.1.0-assembly.jar`.
+By running `mvn verify` or `mvn package` create a connector artifact. For example, `target/exasol-glue-connector-2.1.1-assembly.jar`.
### Uploading the Artifact to S3 Bucket
-Upload the JAR artifact from previous step into an S3 bucket. For instance, `s3://exasol-artifacts/glue-connector/exasol-glue-connector-2.1.0-assembly.jar`.
+Upload the JAR artifact from previous step into an S3 bucket. For instance, `s3://exasol-artifacts/glue-connector/exasol-glue-connector-2.1.1-assembly.jar`.
### Creating a Glue Studio Custom Connector
diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom
index 2158169..233725d 100644
--- a/pk_generated_parent.pom
+++ b/pk_generated_parent.pom
@@ -3,7 +3,7 @@
4.0.0
com.exasol
glue-connector-generated-parent
- 2.1.0
+ 2.1.1
pom
UTF-8
@@ -46,6 +46,12 @@
${java.version}
+ true
+
+
+ -Xlint:all,-processing
+
+
@@ -110,7 +116,7 @@
org.apache.maven.plugins
maven-surefire-plugin
- 3.1.2
+ 3.2.2
@@ -214,10 +220,9 @@
org.apache.maven.plugins
maven-failsafe-plugin
- 3.1.2
+ 3.2.2
-
+
-Djava.util.logging.config.file=src/test/resources/logging.properties ${argLine}
${test.excludeTags}
diff --git a/pom.xml b/pom.xml
index 25b6397..c36d3ee 100644
--- a/pom.xml
+++ b/pom.xml
@@ -3,22 +3,22 @@
4.0.0
com.exasol
glue-connector
- 2.1.0
+ 2.1.1
Exasol AWS Glue Connector
An AWS Glue connector for accessing Exasol database
https://github.com/exasol/glue-connector/
glue-connector-generated-parent
com.exasol
- 2.1.0
+ 2.1.1
pk_generated_parent.pom
8
3.3.6
- 5.10.0
- 5.6.0
- 2.21.1
+ 5.10.1
+ 5.7.0
+ 2.22.0
@@ -131,7 +131,7 @@
org.apache.commons
commons-compress
- 1.24.0
+ 1.25.0
provided
com.fasterxml.jackson.core
@@ -225,7 +227,7 @@
software.amazon.awssdk
s3
- 2.21.8
+ 2.21.26
io.netty
@@ -287,13 +289,13 @@
org.testcontainers
junit-jupiter
- 1.19.1
+ 1.19.2
test
org.testcontainers
localstack
- 1.19.1
+ 1.19.2
test
-
-
- CVE-2022-31777
-
-
- CVE-2023-22946