diff --git a/.gitattributes b/.gitattributes index 2a67344..ce4251a 100644 --- a/.gitattributes +++ b/.gitattributes @@ -7,5 +7,6 @@ doc/changes/changelog.md linguist-genera .github/workflows/dependencies_check.yml linguist-generated=true .github/workflows/dependencies_update.yml linguist-generated=true .github/workflows/release.yml linguist-generated=true +.github/zizmor.yml linguist-generated=true .settings/org.eclipse.jdt.core.prefs linguist-generated=true .settings/org.eclipse.jdt.ui.prefs linguist-generated=true diff --git a/.github/workflows/broken_links_checker.yml b/.github/workflows/broken_links_checker.yml index 5b14f64..55d839d 100644 --- a/.github/workflows/broken_links_checker.yml +++ b/.github/workflows/broken_links_checker.yml @@ -21,10 +21,11 @@ jobs: cancel-in-progress: true } steps: - - { - id: checkout, - uses: actions/checkout@v6 - } + - id: checkout + uses: actions/checkout@v7 + with: { + persist-credentials: false + } - id: configure-broken-links-checker name: Configure broken links checker run: | @@ -36,7 +37,7 @@ jobs: '{"pattern": "^https?://projects.eclipse.org"}' \ ']}' > ./target/broken_links_checker.json - id: run-broken-links-checker - uses: tcort/github-action-markdown-link-check@v1 + uses: tcort/github-action-markdown-link-check@e7c7a18363c842693fadde5d41a3bd3573a7a225 with: { use-quiet-mode: yes, use-verbose-mode: yes, diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml index dd287f5..63902fc 100644 --- a/.github/workflows/ci-build.yml +++ b/.github/workflows/ci-build.yml @@ -49,9 +49,10 @@ jobs: sudo rm -rf /usr/share/dotnet - name: Checkout the repository id: checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: { - fetch-depth: 0 + fetch-depth: 0, + persist-credentials: false } - name: Set up JDKs id: setup-java @@ -60,14 +61,11 @@ jobs: distribution: temurin java-version: |- 11 - 17 + 21 cache: maven - server-id: ossindex - server-username: OSSINDEX_USERNAME - server-password: OSSINDEX_API_TOKEN - name: Cache SonarCloud packages id: cache-sonar - uses: actions/cache@v5 + uses: actions/cache@v6 with: { path: ~/.sonar/cache, key: '${{ runner.os }}-sonar', @@ -87,12 +85,11 @@ jobs: id: build-pk-verify run: | mvn --batch-mode clean verify \ + -DossindexSkip=true \ -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ -DtrimStackTrace=false \ -Dcom.exasol.dockerdb.image=${{ matrix.exasol_db_version }} env: { - OSSINDEX_USERNAME: '${{ secrets.OSSINDEX_USERNAME }}', - OSSINDEX_API_TOKEN: '${{ secrets.OSSINDEX_API_TOKEN }}', EXASOL_DB_VERSION: '${{ matrix.exasol_db_version }}' } - name: Sonar analysis @@ -100,6 +97,7 @@ jobs: if: ${{ env.SONAR_TOKEN != null && matrix.exasol_db_version == env.DEFAULT_EXASOL_DB_VERSION }} run: | mvn --batch-mode org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \ + -DossindexSkip=true \ -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ -DtrimStackTrace=false \ -Dsonar.token=$SONAR_TOKEN @@ -109,7 +107,35 @@ jobs: } - name: Verify Release Artifacts id: verify-release-artifacts - run: "print_message() {\n local -r message=$1\n echo \"$message\"\n echo \"$message\" >> \"$GITHUB_STEP_SUMMARY\"\n}\n\nprint_message \"### Release Artifacts\"\n\nIFS=$'\\n' artifacts_array=($ARTIFACTS)\nmissing_files=()\nfor file in \"${artifacts_array[@]}\";\ndo \n echo \"Checking if file $file exists...\"\n if ! [[ -f \"$file\" ]]; then\n print_message \"* ⚠️ \\`$file\\` does not exist ⚠️\"\n echo \"Content of directory $(dirname \"$file\"):\"\n ls \"$(dirname \"$file\")\"\n missing_files+=(\"$file\")\n else\n print_message \"* \\`$file\\` ✅\" \n fi\ndone\nprint_message \"\"\nnumber_of_missing_files=${#missing_files[@]}\nif [[ $number_of_missing_files -gt 0 ]]; then\n print_message \"⚠️ $number_of_missing_files release artifact(s) missing ⚠️\"\n exit 1\nfi\n" + run: | + print_message() { + local -r message=$1 + echo "$message" + echo "$message" >> "$GITHUB_STEP_SUMMARY" + } + + print_message "### Release Artifacts" + + IFS=$'\n' artifacts_array=($ARTIFACTS) + missing_files=() + for file in "${artifacts_array[@]}"; + do + echo "Checking if file $file exists..." + if ! [[ -f "$file" ]]; then + print_message "* ⚠️ \`$file\` does not exist ⚠️" + echo "Content of directory $(dirname "$file"):" + ls "$(dirname "$file")" + missing_files+=("$file") + else + print_message "* \`$file\` ✅" + fi + done + print_message "" + number_of_missing_files=${#missing_files[@]} + if [[ $number_of_missing_files -gt 0 ]]; then + print_message "⚠️ $number_of_missing_files release artifact(s) missing ⚠️" + exit 1 + fi env: { ARTIFACTS: '${{ steps.build-pk-verify.outputs.release-artifacts }}' } @@ -131,7 +157,7 @@ jobs: '{"pattern": "^https?://(www.)?eclipse.org"}' \ '{"pattern": "^https?://projects.eclipse.org"}' \ ']}' > ./target/broken_links_checker.json - - uses: tcort/github-action-markdown-link-check@v1 + - uses: tcort/github-action-markdown-link-check@e7c7a18363c842693fadde5d41a3bd3573a7a225 id: run-link-check with: { use-quiet-mode: yes, @@ -154,9 +180,10 @@ jobs: steps: - name: Checkout the repository id: checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: { - fetch-depth: 0 + fetch-depth: 0, + persist-credentials: false } - name: Set up JDK 17 id: setup-java @@ -164,22 +191,91 @@ jobs: with: { distribution: temurin, java-version: '17', - cache: maven, - server-id: ossindex, - server-username: OSSINDEX_USERNAME, - server-password: OSSINDEX_API_TOKEN + cache: maven } - name: Run tests and build with Maven 17 id: build-next-java - run: mvn --batch-mode clean package -DtrimStackTrace=false -Djava.version=17 + run: | + mvn --batch-mode clean package -DtrimStackTrace=false -Djava.version=17 \ + -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ + -DossindexSkip=true + ossindex: + runs-on: ubuntu-latest + defaults: + run: { + shell: bash + } + permissions: { + contents: read + } + concurrency: { + group: '${{ github.workflow }}-ossindex-${{ github.ref }}', + cancel-in-progress: true + } + steps: + - name: Checkout the repository + id: checkout + uses: actions/checkout@v7 + with: { + persist-credentials: false + } + - name: Set up JDKs + id: setup-java + uses: actions/setup-java@v5 + with: + distribution: temurin + java-version: |- + 11 + 21 + cache: maven + server-id: ossindex + server-username: OSSINDEX_USERNAME + server-password: OSSINDEX_API_TOKEN + - name: Run Ossindex + id: ossindex + run: | + mvn --batch-mode test-compile \ + org.sonatype.ossindex.maven:ossindex-maven-plugin:audit \ + org.sonatype.ossindex.maven:ossindex-maven-plugin:audit-aggregate \ + -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn env: { OSSINDEX_USERNAME: '${{ secrets.OSSINDEX_USERNAME }}', OSSINDEX_API_TOKEN: '${{ secrets.OSSINDEX_API_TOKEN }}' } + lint-github-actions: + runs-on: ubuntu-latest + defaults: + run: { + shell: bash + } + permissions: { + security-events: write, + contents: read, + actions: read + } + concurrency: { + group: '${{ github.workflow }}-github-actions-linter-${{ github.ref }}', + cancel-in-progress: true + } + steps: + - name: Checkout the repository + id: checkout + uses: actions/checkout@v7 + with: { + persist-credentials: false + } + - name: Lint GitHub actions with Zizmore + id: lint-github-actions + uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa + with: { + advanced-security: false + } build: needs: [ matrix-build, - next-java-compatibility + next-java-compatibility, + ossindex, + lint-github-actions ] runs-on: ubuntu-latest defaults: @@ -196,9 +292,10 @@ jobs: steps: - name: Checkout the repository id: checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: { - fetch-depth: 0 + fetch-depth: 0, + persist-credentials: false } - name: Set up JDKs id: setup-java @@ -207,7 +304,7 @@ jobs: distribution: temurin java-version: |- 11 - 17 + 21 cache: maven - name: Check if release is needed id: check-release diff --git a/.github/workflows/dependencies_check.yml b/.github/workflows/dependencies_check.yml index 4307252..fa5164f 100644 --- a/.github/workflows/dependencies_check.yml +++ b/.github/workflows/dependencies_check.yml @@ -4,7 +4,7 @@ on: workflow_dispatch: null schedule: - { - cron: 0 2 * * * + cron: 42 22 * * 0 } jobs: report_security_issues: @@ -25,11 +25,12 @@ jobs: cancel-in-progress: true } steps: - - { - name: Checkout, - id: checkout, - uses: actions/checkout@v6 - } + - name: Checkout + id: checkout + uses: actions/checkout@v7 + with: { + persist-credentials: false + } - name: Set up JDKs id: setup-jdks uses: actions/setup-java@v5 @@ -37,7 +38,7 @@ jobs: distribution: temurin java-version: |- 11 - 17 + 21 cache: maven server-id: ossindex server-username: OSSINDEX_USERNAME @@ -55,7 +56,7 @@ jobs: } - name: Create GitHub Issues id: create-security-issues - uses: exasol/python-toolbox/.github/actions/security-issues@6.4.0 + uses: exasol/python-toolbox/.github/actions/security-issues@10.1.0 with: { format: maven, command: cat ossindex-report.json, diff --git a/.github/workflows/dependencies_update.yml b/.github/workflows/dependencies_update.yml index 1fd1e1f..1986eae 100644 --- a/.github/workflows/dependencies_update.yml +++ b/.github/workflows/dependencies_update.yml @@ -34,10 +34,11 @@ jobs: cancel-in-progress: false } steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 id: checkout with: { - fetch-depth: 0 + fetch-depth: 0, + persist-credentials: true } - name: Set up JDKs id: setup-jdks @@ -46,7 +47,7 @@ jobs: distribution: temurin java-version: |- 11 - 17 + 21 cache: maven - name: Print issues id: debug-print-issues @@ -61,7 +62,11 @@ jobs: uses: actions/github-script@v9 with: script: | - core.setFailed('Not running on a branch, github.ref is ${{ github.ref }}. Please start this workflow only on main or a branch') + const ref = process.env.GITHUB_REF + core.setFailed(`Not running on a branch, github.ref is '${ref}'. Please start this workflow only on main or a branch`) + env: { + GITHUB_REF: '${{ github.ref }}' + } - name: Update dependencies id: update-dependencies run: | @@ -159,7 +164,7 @@ jobs: - name: Report failure Status to Slack channel id: report-failure-slack if: ${{ always() }} - uses: ravsamhq/notify-slack-action@v2 + uses: ravsamhq/notify-slack-action@be814b201e233b2dc673608aa46e5447c8ab13f2 with: { status: '${{ job.status }}', token: '${{ secrets.GITHUB_TOKEN }}', @@ -173,7 +178,7 @@ jobs: - name: Report new Pull Request to Slack channel id: report-pr-slack if: ${{ steps.create-pr.outputs.pr_url }} - uses: ravsamhq/notify-slack-action@v2 + uses: ravsamhq/notify-slack-action@be814b201e233b2dc673608aa46e5447c8ab13f2 with: { status: '${{ job.status }}', token: '${{ secrets.GITHUB_TOKEN }}', diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5e2b148..1b177b5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -75,9 +75,10 @@ jobs: steps: - name: Checkout the repository id: checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: { - fetch-depth: 0 + fetch-depth: 0, + persist-credentials: true } - name: Set up Maven Central Repository id: configure-maven-central-credentials @@ -87,8 +88,7 @@ jobs: distribution: temurin java-version: |- 11 - 17 - cache: maven + 21 server-id: maven-central-portal server-username: MAVEN_USERNAME server-password: MAVEN_PASSWORD @@ -102,7 +102,7 @@ jobs: distribution: temurin java-version: |- 11 - 17 + 21 cache: maven - name: Fail if not running on main or release branch id: check-main-or-release-branch @@ -110,7 +110,11 @@ jobs: uses: actions/github-script@v9 with: script: | - core.setFailed('Not running on main or release branch, github.ref is ${{ github.ref }}. Please start this workflow only on main or a branch starting with release/') + const ref = process.env.GITHUB_REF + core.setFailed(`Not running on main or release branch, github.ref is '${ref}'. Please start this workflow only on main or a branch starting with release/`) + env: { + GITHUB_REF: '${{ github.ref }}' + } - name: Check CI build of this commit succeeded id: check-ci-build-status if: ${{ ! inputs.started-from-ci }} @@ -142,7 +146,7 @@ jobs: - { name: Build project, id: build, - run: mvn --batch-mode -DskipTests -Dossindex.skip=true clean verify + run: mvn --batch-mode -DskipTests -DossindexSkip=true clean verify } - { name: List secret GPG keys, @@ -155,7 +159,7 @@ jobs: if: ${{ false && (! inputs.skip-maven-central) }} run: | echo "#### Maven Central Release" >> "$GITHUB_STEP_SUMMARY" - mvn --batch-mode -Dgpg.skip=false -DskipTests -Dossindex.skip=true deploy \ + mvn --batch-mode -Dgpg.skip=false -DskipTests -DossindexSkip=true deploy \ -Dcentral-publishing.deploymentName="Auto release of repo ${{ github.repository }} using PK release.yml" \ -Dcentral-publishing.autoPublish=${{ inputs.maven-central-auto-publish }} if [[ "${{ inputs.maven-central-auto-publish }}" == "true" ]]; then @@ -236,7 +240,7 @@ jobs: - name: Report failure Status to Slack channel id: report-failure-status-slack if: ${{ always() }} - uses: ravsamhq/notify-slack-action@v2 + uses: ravsamhq/notify-slack-action@be814b201e233b2dc673608aa46e5447c8ab13f2 with: { status: '${{ job.status }}', token: '${{ github.token }}', @@ -250,7 +254,7 @@ jobs: - name: Report new release to Slack channel id: report-new-release-slack if: ${{ steps.create-github-release.outputs.release-url }} - uses: ravsamhq/notify-slack-action@v2 + uses: ravsamhq/notify-slack-action@be814b201e233b2dc673608aa46e5447c8ab13f2 with: { status: '${{ job.status }}', token: '${{ github.token }}', diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..a8508a1 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,33 @@ +# Generated by Project Keeper +# https://github.com/exasol/project-keeper/blob/main/project-keeper/src/main/resources/templates/.github/zizmor.yml +# See https://docs.zizmor.sh/configuration/#settings +rules: + unpinned-uses: + config: + policies: + "actions/*": ref-pin + "exasol/python-toolbox/.github/actions/security-issues": ref-pin + "*": hash-pin + cache-poisoning: + ignore: + # Enabling caching is OK for non-release workflows + - ci-build.yml + - ci-build-native-build.yml + - ci-build-db-version-matrix.yml + - project-keeper-verify.yml + - test_on_windows.yml + - test_linux_build_on_windows.yml + obfuscation: + ignore: + # Generated workflows use boolean conditions like ${{ false }} + # Note: We cannot exclude this using inline comments because GitHubWorkflowIO does not preserve comments in the workflow YAML files. + - ci-build.yml + - release.yml + - project-keeper-verify.yml + secrets-inherit: + ignore: + # Required for passing slack webhooks + - ci-build.yml + - ci-build-db-version-matrix.yml + - dependencies_check.yml + - release.yml diff --git a/.vscode/settings.json b/.vscode/settings.json index 44ae763..5f5cc4e 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -11,7 +11,7 @@ "java.test.config": { "vmArgs": [ "-Djava.util.logging.config.file=src/test/resources/logging.properties", - "-Dcom.exasol.dockerdb.image=2025.2.1" + "-Dcom.exasol.dockerdb.image=2026.1.0" ], "env": { "EXASOL_TELEMETRY_DISABLE": "true" @@ -21,4 +21,4 @@ "connectionId": "exasol", "projectKey": "com.exasol:mysql-virtual-schema" } -} \ No newline at end of file +} diff --git a/dependencies.md b/dependencies.md index 4f45d91..27536e8 100644 --- a/dependencies.md +++ b/dependencies.md @@ -28,32 +28,32 @@ ## Plugin Dependencies -| Dependency | License | -| ------------------------------------------------------- | ------------------------------------------- | -| [SonarQube Scanner for Maven][25] | [GNU LGPL 3][26] | -| [Apache Maven Toolchains Plugin][27] | [Apache-2.0][28] | -| [Apache Maven Compiler Plugin][29] | [Apache-2.0][28] | -| [Apache Maven Enforcer Plugin][30] | [Apache-2.0][28] | -| [Maven Flatten Plugin][31] | [Apache Software License][28] | -| [org.sonatype.ossindex.maven:ossindex-maven-plugin][32] | [ASL2][33] | -| [Maven Surefire Plugin][34] | [Apache-2.0][28] | -| [Versions Maven Plugin][35] | [Apache License, Version 2.0][28] | -| [duplicate-finder-maven-plugin Maven Mojo][36] | [Apache License 2.0][37] | -| [Apache Maven Artifact Plugin][38] | [Apache-2.0][28] | -| [Apache Maven Assembly Plugin][39] | [Apache-2.0][28] | -| [Apache Maven JAR Plugin][40] | [Apache-2.0][28] | -| [Artifact reference checker and unifier][41] | [MIT License][42] | -| [Apache Maven Dependency Plugin][43] | [Apache-2.0][28] | -| [Project Keeper Maven plugin][44] | [The MIT License][45] | -| [Maven Failsafe Plugin][46] | [Apache-2.0][28] | -| [JaCoCo :: Maven Plugin][47] | [EPL-2.0][24] | -| [Quality Summarizer Maven Plugin][48] | [MIT License][49] | -| [error-code-crawler-maven-plugin][50] | [MIT License][51] | -| [Git Commit Id Maven Plugin][52] | [GNU Lesser General Public License 3.0][53] | -| [Apache Maven Clean Plugin][54] | [Apache-2.0][28] | -| [Apache Maven Resources Plugin][55] | [Apache-2.0][28] | -| [Apache Maven Install Plugin][56] | [Apache-2.0][28] | -| [Apache Maven Site Plugin][57] | [Apache-2.0][28] | +| Dependency | License | +| ------------------------------------------------------- | ---------------------------------------------- | +| [SonarQube Scanner for Maven][25] | [GNU LGPL 3][26] | +| [Apache Maven Toolchains Plugin][27] | [Apache-2.0][28] | +| [Apache Maven Compiler Plugin][29] | [Apache-2.0][28] | +| [Apache Maven Enforcer Plugin][30] | [Apache-2.0][28] | +| [Maven Flatten Plugin][31] | [Apache Software License][28] | +| [org.sonatype.ossindex.maven:ossindex-maven-plugin][32] | [ASL2][33] | +| [Maven Surefire Plugin][34] | [Apache-2.0][28] | +| [Versions Maven Plugin][35] | [Apache License, Version 2.0][28] | +| [duplicate-finder-maven-plugin Maven Mojo][36] | [Apache License 2.0][37] | +| [Apache Maven Artifact Plugin][38] | [Apache-2.0][28] | +| [Apache Maven Assembly Plugin][39] | [Apache-2.0][28] | +| [Apache Maven JAR Plugin][40] | [Apache-2.0][28] | +| [Artifact reference checker and unifier][41] | [MIT License][42] | +| [spdx-maven-plugin Maven Plugin][43] | [The Apache Software License, Version 2.0][33] | +| [Apache Maven Dependency Plugin][44] | [Apache-2.0][28] | +| [Project Keeper Maven plugin][45] | [The MIT License][46] | +| [Maven Failsafe Plugin][47] | [Apache-2.0][28] | +| [JaCoCo :: Maven Plugin][48] | [EPL-2.0][24] | +| [error-code-crawler-maven-plugin][49] | [MIT License][50] | +| [Git Commit Id Maven Plugin][51] | [GNU Lesser General Public License 3.0][52] | +| [Apache Maven Clean Plugin][53] | [Apache-2.0][28] | +| [Apache Maven Resources Plugin][54] | [Apache-2.0][28] | +| [Apache Maven Install Plugin][55] | [Apache-2.0][28] | +| [Apache Maven Site Plugin][56] | [Apache-2.0][28] | [0]: https://github.com/exasol/virtual-schema-common-jdbc/ [1]: https://github.com/exasol/virtual-schema-common-jdbc/blob/main/LICENSE @@ -98,18 +98,17 @@ [40]: https://maven.apache.org/plugins/maven-jar-plugin/ [41]: https://github.com/exasol/artifact-reference-checker-maven-plugin/ [42]: https://github.com/exasol/artifact-reference-checker-maven-plugin/blob/main/LICENSE -[43]: https://maven.apache.org/plugins/maven-dependency-plugin/ -[44]: https://github.com/exasol/project-keeper/ -[45]: https://github.com/exasol/project-keeper/blob/main/LICENSE -[46]: https://maven.apache.org/surefire/maven-failsafe-plugin/ -[47]: https://www.jacoco.org/jacoco/trunk/doc/maven.html -[48]: https://github.com/exasol/quality-summarizer-maven-plugin/ -[49]: https://github.com/exasol/quality-summarizer-maven-plugin/blob/main/LICENSE -[50]: https://github.com/exasol/error-code-crawler-maven-plugin/ -[51]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE -[52]: https://github.com/git-commit-id/git-commit-id-maven-plugin -[53]: http://www.gnu.org/licenses/lgpl-3.0.txt -[54]: https://maven.apache.org/plugins/maven-clean-plugin/ -[55]: https://maven.apache.org/plugins/maven-resources-plugin/ -[56]: https://maven.apache.org/plugins/maven-install-plugin/ -[57]: https://maven.apache.org/plugins/maven-site-plugin/ +[43]: https://github.com/spdx/spdx-maven-plugin +[44]: https://maven.apache.org/plugins/maven-dependency-plugin/ +[45]: https://github.com/exasol/project-keeper/ +[46]: https://github.com/exasol/project-keeper/blob/main/LICENSE +[47]: https://maven.apache.org/surefire/maven-failsafe-plugin/ +[48]: https://www.jacoco.org/jacoco/trunk/doc/maven.html +[49]: https://github.com/exasol/error-code-crawler-maven-plugin/ +[50]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE +[51]: https://github.com/git-commit-id/git-commit-id-maven-plugin +[52]: http://www.gnu.org/licenses/lgpl-3.0.txt +[53]: https://maven.apache.org/plugins/maven-clean-plugin/ +[54]: https://maven.apache.org/plugins/maven-resources-plugin/ +[55]: https://maven.apache.org/plugins/maven-install-plugin/ +[56]: https://maven.apache.org/plugins/maven-site-plugin/ diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md index 0f687f2..82ae3d4 100644 --- a/doc/changes/changelog.md +++ b/doc/changes/changelog.md @@ -1,5 +1,6 @@ # Changes +* [6.0.2](changes_6.0.2.md) * [6.0.1](changes_6.0.1.md) * [6.0.0](changes_6.0.0.md) * [5.1.1](changes_5.1.1.md) diff --git a/doc/changes/changes_6.0.2.md b/doc/changes/changes_6.0.2.md new file mode 100644 index 0000000..8453653 --- /dev/null +++ b/doc/changes/changes_6.0.2.md @@ -0,0 +1,84 @@ +# Virtual Schema for MySQL 6.0.2, released 2026-07-29 + +Code name: Fixed vulnerabilities CVE-2026-9563, CVE-2026-60586, CVE-2026-60623, CVE-2026-60624, CVE-2026-61082 + +## Summary + +This release fixes the following 5 vulnerabilities: + +### CVE-2026-9563 (CWE-400) in dependency `org.eclipse.parsson:parsson:jar:1.1.7:test` +In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, or nested structures, resulting in a denial of service. Eclipse Parsson 1.1.8 introduces a configurable maximum parsing limit with a default limit of 15 million parser-consumed characters. +#### References +* https://guide.sonatype.com/vulnerability/CVE-2026-9563?component-type=maven&component-name=org.eclipse.parsson%2Fparsson&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1 +* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-9563 +* https://github.com/eclipse-ee4j/parsson/pull/169 +* https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/444 + +### CVE-2026-60586 (CWE-200) in dependency `com.mysql:mysql-connector-j:jar:9.7.0:test` +Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). +#### References +* https://guide.sonatype.com/vulnerability/CVE-2026-60586?component-type=maven&component-name=com.mysql%2Fmysql-connector-j&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1 +* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-60586 +* https://www.oracle.com/security-alerts/cpujul2026.html + +### CVE-2026-60623 (CWE-668) in dependency `com.mysql:mysql-connector-j:jar:9.7.0:test` +Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L). +#### References +* https://guide.sonatype.com/vulnerability/CVE-2026-60623?component-type=maven&component-name=com.mysql%2Fmysql-connector-j&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1 +* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-60623 +* https://www.oracle.com/security-alerts/cpujul2026.html + +### CVE-2026-60624 (CWE-400) in dependency `com.mysql:mysql-connector-j:jar:9.7.0:test` +Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). +#### References +* https://guide.sonatype.com/vulnerability/CVE-2026-60624?component-type=maven&component-name=com.mysql%2Fmysql-connector-j&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1 +* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-60624 +* https://www.oracle.com/security-alerts/cpujul2026.html + +### CVE-2026-61082 (CWE-200) in dependency `com.mysql:mysql-connector-j:jar:9.7.0:test` +Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). +#### References +* https://guide.sonatype.com/vulnerability/CVE-2026-61082?component-type=maven&component-name=com.mysql%2Fmysql-connector-j&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1 +* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-61082 +* https://www.oracle.com/security-alerts/cpujul2026.html + +## Security + +* #62: Fixed vulnerability CVE-2026-9563 in dependency `org.eclipse.parsson:parsson:jar:1.1.7:test` +* #63: Fixed vulnerability CVE-2026-60586 in dependency `com.mysql:mysql-connector-j:jar:9.7.0:test` +* #64: Fixed vulnerability CVE-2026-60623 in dependency `com.mysql:mysql-connector-j:jar:9.7.0:test` +* #65: Fixed vulnerability CVE-2026-60624 in dependency `com.mysql:mysql-connector-j:jar:9.7.0:test` +* #66: Fixed vulnerability CVE-2026-61082 in dependency `com.mysql:mysql-connector-j:jar:9.7.0:test` + +## Dependency Updates + +### Compile Dependency Updates + +* Updated `com.exasol:virtual-schema-common-jdbc:14.0.2` to `14.0.4` + +### Test Dependency Updates + +* Updated `com.exasol:exasol-testcontainers:7.2.3` to `8.0.1` +* Updated `com.exasol:hamcrest-resultset-matcher:1.7.2` to `1.7.3` +* Updated `com.exasol:test-db-builder-java:4.0.0` to `4.0.2` +* Updated `com.exasol:udf-debugging-java:0.6.18` to `0.6.20` +* Updated `com.exasol:virtual-schema-common-jdbc:14.0.2` to `14.0.4` +* Updated `com.mysql:mysql-connector-j:9.7.0` to `9.6.0` +* Updated `org.jacoco:org.jacoco.agent:0.8.14` to `0.8.15` +* Updated `org.junit.jupiter:junit-jupiter-api:5.14.3` to `5.14.4` +* Updated `org.slf4j:slf4j-jdk14:2.0.17` to `2.0.18` + +### Plugin Dependency Updates + +* Updated `com.exasol:artifact-reference-checker-maven-plugin:0.4.4` to `1.0.1` +* Updated `com.exasol:error-code-crawler-maven-plugin:2.0.7` to `2.1.0` +* Updated `com.exasol:project-keeper-maven-plugin:5.5.2` to `5.7.4` +* Removed `com.exasol:quality-summarizer-maven-plugin:0.2.1` +* Updated `org.apache.maven.plugins:maven-dependency-plugin:3.10.0` to `3.11.0` +* Updated `org.apache.maven.plugins:maven-enforcer-plugin:3.6.2` to `3.6.3` +* Updated `org.apache.maven.plugins:maven-failsafe-plugin:3.5.5` to `3.5.6` +* Updated `org.apache.maven.plugins:maven-site-plugin:3.21.0` to `3.22.0` +* Updated `org.apache.maven.plugins:maven-surefire-plugin:3.5.5` to `3.5.6` +* Updated `org.jacoco:jacoco-maven-plugin:0.8.14` to `0.8.15` +* Updated `org.sonarsource.scanner.maven:sonar-maven-plugin:5.5.0.6356` to `5.7.0.6970` +* Added `org.spdx:spdx-maven-plugin:1.0.4` diff --git a/doc/user_guide/mysql_user_guide.md b/doc/user_guide/mysql_user_guide.md index 18497e1..947ac3d 100644 --- a/doc/user_guide/mysql_user_guide.md +++ b/doc/user_guide/mysql_user_guide.md @@ -49,7 +49,7 @@ The SQL statement below creates the adapter script, defines the Java class that --/ CREATE OR REPLACE JAVA ADAPTER SCRIPT SCHEMA_FOR_VS_SCRIPT.ADAPTER_SCRIPT_MYSQL AS %scriptclass com.exasol.adapter.RequestDispatcher; - %jar /buckets/bfsdefault/default/virtual-schema-dist-14.0.2-mysql-6.0.1.jar; + %jar /buckets/bfsdefault/default/virtual-schema-dist-14.0.4-mysql-6.0.2.jar; %jar /buckets/bfsdefault/default/mysql-connector-java-.jar; / ; @@ -120,7 +120,7 @@ See also [Adapter Properties for JDBC-Based Virtual Schemas](https://github.com/ | YEAR | ✓ | DATE | | (1) Types TIME, DATETIME and TIMESTAMP with fractional second precision are mapped to TIMESTAMP with milliseconds precision -for Exasol versions up to 8.31. Starting with Exasol 8.32 they are mapped with the same specified precision as in MySQL. +for Exasol versions up to 8.31. Starting with Exasol 8.32 they are mapped with the same specified precision as in MySQL. * The tested versions of MySQL Connector JDBC Driver return the column's size depending on the charset and its collation. As the real data in a MySQL table can sometimes exceed the size that we get from the JDBC driver, we set the size for all TEXT columns to 65535 characters. @@ -136,4 +136,5 @@ In the following matrix you find combinations of JDBC driver and dialect version | 4.1.3 | MySQL 8.0.23 | MySQL Connector | 8.0.23 | | 5.0.1 | MySQL 8.1.0 | MySQL Connector | 8.1.0 | | 5.0.2 | MySQL 9.0.1 | MySQL Connector | 9.0.1 | -| Latest | MySQL 9.2.0 | MySQL Connector | 9.3.0 | +| 5.1.0 | MySQL 9.2.0 | MySQL Connector | 9.3.0 | +| 6.0.2 | MySQL 9.7.2 | MySQL Connector | 9.6.0 | diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom index 27eb970..2d9c33b 100644 --- a/pk_generated_parent.pom +++ b/pk_generated_parent.pom @@ -3,7 +3,7 @@ 4.0.0 com.exasol mysql-virtual-schema-generated-parent - 6.0.1 + 6.0.2 pom UTF-8 @@ -13,6 +13,7 @@ exasol https://sonarcloud.io + false @@ -38,7 +39,7 @@ org.jacoco org.jacoco.agent - 0.8.14 + 0.8.15 test runtime @@ -64,7 +65,7 @@ org.apache.maven.plugins maven-site-plugin - 3.21.0 + 3.22.0 org.codehaus.mojo @@ -82,7 +83,7 @@ org.sonarsource.scanner.maven sonar-maven-plugin - 5.5.0.6356 + 5.7.0.6970 org.apache.maven.plugins @@ -108,8 +109,7 @@ maven-compiler-plugin 3.15.0 - ${java.version} - ${java.version} + ${java.version} true -Xlint:all @@ -120,7 +120,7 @@ org.apache.maven.plugins maven-enforcer-plugin - 3.6.2 + 3.6.3 enforce-maven @@ -171,6 +171,8 @@ 3.2.0 ossindex + + ${ossindexSkip} @@ -185,7 +187,7 @@ org.apache.maven.plugins maven-surefire-plugin - 3.5.5 + 3.5.6 ${argLine} @@ -307,7 +309,7 @@ com.exasol artifact-reference-checker-maven-plugin - 0.4.4 + 1.0.1 verify @@ -317,10 +319,39 @@ + + + org.spdx + spdx-maven-plugin + 1.0.4 + + + build-spdx + package + + createSPDX + + + + + build + + true + true + true + true + false + false + Copyright (c) Exasol + false + JSON-LD + ${project.build.directory}/site/${project.groupId}.${project.artifactId}-${project.version}.spdx3.json + + org.apache.maven.plugins maven-dependency-plugin - 3.10.0 + 3.11.0 copy-jacoco @@ -340,7 +371,7 @@ org.apache.maven.plugins maven-failsafe-plugin - 3.5.5 + 3.5.6 ${argLine} @@ -366,7 +397,7 @@ org.jacoco jacoco-maven-plugin - 0.8.14 + 0.8.15 prepare-agent @@ -410,23 +441,10 @@ - - com.exasol - quality-summarizer-maven-plugin - 0.2.1 - - - summarize-metrics - - summarize - - - - com.exasol error-code-crawler-maven-plugin - 2.0.7 + 2.1.0 verify diff --git a/pom.xml b/pom.xml index f437b28..dab7f72 100644 --- a/pom.xml +++ b/pom.xml @@ -2,12 +2,12 @@ 4.0.0 mysql-virtual-schema - 6.0.1 + 6.0.2 Virtual Schema for MySQL Virtual Schema for MySQL https://github.com/exasol/mysql-virtual-schema/ - 14.0.2 + 14.0.4 2.0.5 @@ -35,7 +35,7 @@ org.junit.jupiter junit-jupiter-api - 5.14.3 + 5.14.4 test @@ -48,7 +48,7 @@ com.exasol exasol-testcontainers - 7.2.3 + 8.0.1 test @@ -66,19 +66,20 @@ com.mysql mysql-connector-j - 9.7.0 + + 9.6.0 test com.exasol test-db-builder-java - 4.0.0 + 4.0.2 test com.exasol hamcrest-resultset-matcher - 1.7.2 + 1.7.3 test @@ -90,13 +91,13 @@ com.exasol udf-debugging-java - 0.6.18 + 0.6.20 test org.slf4j slf4j-jdk14 - 2.0.17 + 2.0.18 test @@ -141,7 +142,7 @@ com.exasol project-keeper-maven-plugin - 5.5.2 + 5.7.4 @@ -172,7 +173,7 @@ mysql-virtual-schema-generated-parent com.exasol - 6.0.1 + 6.0.2 pk_generated_parent.pom diff --git a/src/test/java/com/exasol/adapter/dialects/mysql/IntegrationTestConstants.java b/src/test/java/com/exasol/adapter/dialects/mysql/IntegrationTestConstants.java index 0105c76..32705e1 100644 --- a/src/test/java/com/exasol/adapter/dialects/mysql/IntegrationTestConstants.java +++ b/src/test/java/com/exasol/adapter/dialects/mysql/IntegrationTestConstants.java @@ -3,9 +3,9 @@ import java.nio.file.Path; public final class IntegrationTestConstants { - public static final String VIRTUAL_SCHEMAS_JAR_NAME_AND_VERSION = "virtual-schema-dist-14.0.2-mysql-6.0.1.jar"; - public static final String MYSQL_DOCKER_IMAGE_REFERENCE = "mysql:9.6.0"; - public static final String EXASOL_VERSION = "2025.2.1"; + public static final String VIRTUAL_SCHEMAS_JAR_NAME_AND_VERSION = "virtual-schema-dist-14.0.4-mysql-6.0.2.jar"; + public static final String MYSQL_DOCKER_IMAGE_REFERENCE = "mysql:9.7.2"; + public static final String EXASOL_VERSION = "2026.1.0"; public static final Path PATH_TO_VIRTUAL_SCHEMAS_JAR = Path.of("target", VIRTUAL_SCHEMAS_JAR_NAME_AND_VERSION); public static final String SCHEMA_EXASOL = "SCHEMA_EXASOL";