From 9e9c58ac9af3bb5441c161ce38b5487848e183f8 Mon Sep 17 00:00:00 2001 From: Automatic Dependency Updater Date: Sat, 25 Jul 2026 03:05:27 +0000 Subject: [PATCH 1/3] =?UTF-8?q?=F0=9F=94=90=20Update=20dependencies=20to?= =?UTF-8?q?=20fix=20vulnerabilities?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- doc/changes/changelog.md | 1 + doc/changes/changes_6.0.2.md | 70 +++++++++++++++++++ doc/user_guide/mysql_user_guide.md | 2 +- pk_generated_parent.pom | 2 +- pom.xml | 18 ++--- .../mysql/IntegrationTestConstants.java | 2 +- 6 files changed, 83 insertions(+), 12 deletions(-) create mode 100644 doc/changes/changes_6.0.2.md diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md index 0f687f2..82ae3d4 100644 --- a/doc/changes/changelog.md +++ b/doc/changes/changelog.md @@ -1,5 +1,6 @@ # Changes +* [6.0.2](changes_6.0.2.md) * [6.0.1](changes_6.0.1.md) * [6.0.0](changes_6.0.0.md) * [5.1.1](changes_5.1.1.md) diff --git a/doc/changes/changes_6.0.2.md b/doc/changes/changes_6.0.2.md new file mode 100644 index 0000000..4d4c989 --- /dev/null +++ b/doc/changes/changes_6.0.2.md @@ -0,0 +1,70 @@ +# Virtual Schema for MySQL 6.0.2, released 2026-??-?? + +Code name: Fixed vulnerabilities CVE-2026-9563, CVE-2026-60586, CVE-2026-60623, CVE-2026-60624, CVE-2026-61082 + +## Summary + +This release fixes the following 5 vulnerabilities: + +### CVE-2026-9563 (CWE-400) in dependency `org.eclipse.parsson:parsson:jar:1.1.7:test` +In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, or nested structures, resulting in a denial of service. Eclipse Parsson 1.1.8 introduces a configurable maximum parsing limit with a default limit of 15 million parser-consumed characters. +#### References +* https://guide.sonatype.com/vulnerability/CVE-2026-9563?component-type=maven&component-name=org.eclipse.parsson%2Fparsson&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1 +* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-9563 +* https://github.com/eclipse-ee4j/parsson/pull/169 +* https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/444 + +### CVE-2026-60586 (CWE-200) in dependency `com.mysql:mysql-connector-j:jar:9.7.0:test` +Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). +#### References +* https://guide.sonatype.com/vulnerability/CVE-2026-60586?component-type=maven&component-name=com.mysql%2Fmysql-connector-j&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1 +* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-60586 +* https://www.oracle.com/security-alerts/cpujul2026.html + +### CVE-2026-60623 (CWE-668) in dependency `com.mysql:mysql-connector-j:jar:9.7.0:test` +Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L). +#### References +* https://guide.sonatype.com/vulnerability/CVE-2026-60623?component-type=maven&component-name=com.mysql%2Fmysql-connector-j&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1 +* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-60623 +* https://www.oracle.com/security-alerts/cpujul2026.html + +### CVE-2026-60624 (CWE-400) in dependency `com.mysql:mysql-connector-j:jar:9.7.0:test` +Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). +#### References +* https://guide.sonatype.com/vulnerability/CVE-2026-60624?component-type=maven&component-name=com.mysql%2Fmysql-connector-j&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1 +* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-60624 +* https://www.oracle.com/security-alerts/cpujul2026.html + +### CVE-2026-61082 (CWE-200) in dependency `com.mysql:mysql-connector-j:jar:9.7.0:test` +Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). +#### References +* https://guide.sonatype.com/vulnerability/CVE-2026-61082?component-type=maven&component-name=com.mysql%2Fmysql-connector-j&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1 +* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-61082 +* https://www.oracle.com/security-alerts/cpujul2026.html + +## Security + +* #62: Fixed vulnerability CVE-2026-9563 in dependency `org.eclipse.parsson:parsson:jar:1.1.7:test` +* #63: Fixed vulnerability CVE-2026-60586 in dependency `com.mysql:mysql-connector-j:jar:9.7.0:test` +* #64: Fixed vulnerability CVE-2026-60623 in dependency `com.mysql:mysql-connector-j:jar:9.7.0:test` +* #65: Fixed vulnerability CVE-2026-60624 in dependency `com.mysql:mysql-connector-j:jar:9.7.0:test` +* #66: Fixed vulnerability CVE-2026-61082 in dependency `com.mysql:mysql-connector-j:jar:9.7.0:test` + +## Dependency Updates + +### Compile Dependency Updates + +* Updated `com.exasol:virtual-schema-common-jdbc:14.0.2` to `14.0.4` + +### Test Dependency Updates + +* Updated `com.exasol:exasol-testcontainers:7.2.3` to `7.3.0` +* Updated `com.exasol:test-db-builder-java:4.0.0` to `4.0.1` +* Updated `com.exasol:udf-debugging-java:0.6.18` to `0.6.20` +* Updated `com.exasol:virtual-schema-common-jdbc:14.0.2` to `14.0.4` +* Updated `org.junit.jupiter:junit-jupiter-api:5.14.3` to `6.1.2` +* Updated `org.slf4j:slf4j-jdk14:2.0.17` to `2.0.18` + +### Plugin Dependency Updates + +* Updated `com.exasol:project-keeper-maven-plugin:5.5.2` to `5.7.4` diff --git a/doc/user_guide/mysql_user_guide.md b/doc/user_guide/mysql_user_guide.md index 18497e1..a2c05bb 100644 --- a/doc/user_guide/mysql_user_guide.md +++ b/doc/user_guide/mysql_user_guide.md @@ -49,7 +49,7 @@ The SQL statement below creates the adapter script, defines the Java class that --/ CREATE OR REPLACE JAVA ADAPTER SCRIPT SCHEMA_FOR_VS_SCRIPT.ADAPTER_SCRIPT_MYSQL AS %scriptclass com.exasol.adapter.RequestDispatcher; - %jar /buckets/bfsdefault/default/virtual-schema-dist-14.0.2-mysql-6.0.1.jar; + %jar /buckets/bfsdefault/default/virtual-schema-dist-14.0.2-mysql-6.0.2.jar; %jar /buckets/bfsdefault/default/mysql-connector-java-.jar; / ; diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom index 27eb970..cea5f46 100644 --- a/pk_generated_parent.pom +++ b/pk_generated_parent.pom @@ -3,7 +3,7 @@ 4.0.0 com.exasol mysql-virtual-schema-generated-parent - 6.0.1 + 6.0.2 pom UTF-8 diff --git a/pom.xml b/pom.xml index f437b28..985b386 100644 --- a/pom.xml +++ b/pom.xml @@ -2,12 +2,12 @@ 4.0.0 mysql-virtual-schema - 6.0.1 + 6.0.2 Virtual Schema for MySQL Virtual Schema for MySQL https://github.com/exasol/mysql-virtual-schema/ - 14.0.2 + 14.0.4 2.0.5 @@ -35,7 +35,7 @@ org.junit.jupiter junit-jupiter-api - 5.14.3 + 6.1.2 test @@ -48,7 +48,7 @@ com.exasol exasol-testcontainers - 7.2.3 + 7.3.0 test @@ -72,7 +72,7 @@ com.exasol test-db-builder-java - 4.0.0 + 4.0.1 test @@ -90,13 +90,13 @@ com.exasol udf-debugging-java - 0.6.18 + 0.6.20 test org.slf4j slf4j-jdk14 - 2.0.17 + 2.0.18 test @@ -141,7 +141,7 @@ com.exasol project-keeper-maven-plugin - 5.5.2 + 5.7.4 @@ -172,7 +172,7 @@ mysql-virtual-schema-generated-parent com.exasol - 6.0.1 + 6.0.2 pk_generated_parent.pom diff --git a/src/test/java/com/exasol/adapter/dialects/mysql/IntegrationTestConstants.java b/src/test/java/com/exasol/adapter/dialects/mysql/IntegrationTestConstants.java index 0105c76..773a2ce 100644 --- a/src/test/java/com/exasol/adapter/dialects/mysql/IntegrationTestConstants.java +++ b/src/test/java/com/exasol/adapter/dialects/mysql/IntegrationTestConstants.java @@ -3,7 +3,7 @@ import java.nio.file.Path; public final class IntegrationTestConstants { - public static final String VIRTUAL_SCHEMAS_JAR_NAME_AND_VERSION = "virtual-schema-dist-14.0.2-mysql-6.0.1.jar"; + public static final String VIRTUAL_SCHEMAS_JAR_NAME_AND_VERSION = "virtual-schema-dist-14.0.2-mysql-6.0.2.jar"; public static final String MYSQL_DOCKER_IMAGE_REFERENCE = "mysql:9.6.0"; public static final String EXASOL_VERSION = "2025.2.1"; From 82d2dfedbd2b2edb920657d4fd58a8d3079eff04 Mon Sep 17 00:00:00 2001 From: Christoph Pirkl Date: Wed, 29 Jul 2026 13:03:21 +0200 Subject: [PATCH 2/3] Fix vulnerabiltiies --- .github/workflows/broken_links_checker.yml | 11 +- .github/workflows/ci-build.yml | 141 +++++++++++++++--- .github/workflows/dependencies_check.yml | 17 ++- .github/workflows/dependencies_update.yml | 17 ++- .github/workflows/release.yml | 24 +-- .github/zizmor.yml | 33 ++++ .vscode/settings.json | 4 +- dependencies.md | 81 +++++----- doc/changes/changes_6.0.2.md | 22 ++- doc/user_guide/mysql_user_guide.md | 7 +- pk_generated_parent.pom | 68 +++++---- pom.xml | 11 +- .../mysql/IntegrationTestConstants.java | 6 +- 13 files changed, 308 insertions(+), 134 deletions(-) create mode 100644 .github/zizmor.yml diff --git a/.github/workflows/broken_links_checker.yml b/.github/workflows/broken_links_checker.yml index 5b14f64..55d839d 100644 --- a/.github/workflows/broken_links_checker.yml +++ b/.github/workflows/broken_links_checker.yml @@ -21,10 +21,11 @@ jobs: cancel-in-progress: true } steps: - - { - id: checkout, - uses: actions/checkout@v6 - } + - id: checkout + uses: actions/checkout@v7 + with: { + persist-credentials: false + } - id: configure-broken-links-checker name: Configure broken links checker run: | @@ -36,7 +37,7 @@ jobs: '{"pattern": "^https?://projects.eclipse.org"}' \ ']}' > ./target/broken_links_checker.json - id: run-broken-links-checker - uses: tcort/github-action-markdown-link-check@v1 + uses: tcort/github-action-markdown-link-check@e7c7a18363c842693fadde5d41a3bd3573a7a225 with: { use-quiet-mode: yes, use-verbose-mode: yes, diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml index dd287f5..63902fc 100644 --- a/.github/workflows/ci-build.yml +++ b/.github/workflows/ci-build.yml @@ -49,9 +49,10 @@ jobs: sudo rm -rf /usr/share/dotnet - name: Checkout the repository id: checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: { - fetch-depth: 0 + fetch-depth: 0, + persist-credentials: false } - name: Set up JDKs id: setup-java @@ -60,14 +61,11 @@ jobs: distribution: temurin java-version: |- 11 - 17 + 21 cache: maven - server-id: ossindex - server-username: OSSINDEX_USERNAME - server-password: OSSINDEX_API_TOKEN - name: Cache SonarCloud packages id: cache-sonar - uses: actions/cache@v5 + uses: actions/cache@v6 with: { path: ~/.sonar/cache, key: '${{ runner.os }}-sonar', @@ -87,12 +85,11 @@ jobs: id: build-pk-verify run: | mvn --batch-mode clean verify \ + -DossindexSkip=true \ -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ -DtrimStackTrace=false \ -Dcom.exasol.dockerdb.image=${{ matrix.exasol_db_version }} env: { - OSSINDEX_USERNAME: '${{ secrets.OSSINDEX_USERNAME }}', - OSSINDEX_API_TOKEN: '${{ secrets.OSSINDEX_API_TOKEN }}', EXASOL_DB_VERSION: '${{ matrix.exasol_db_version }}' } - name: Sonar analysis @@ -100,6 +97,7 @@ jobs: if: ${{ env.SONAR_TOKEN != null && matrix.exasol_db_version == env.DEFAULT_EXASOL_DB_VERSION }} run: | mvn --batch-mode org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \ + -DossindexSkip=true \ -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ -DtrimStackTrace=false \ -Dsonar.token=$SONAR_TOKEN @@ -109,7 +107,35 @@ jobs: } - name: Verify Release Artifacts id: verify-release-artifacts - run: "print_message() {\n local -r message=$1\n echo \"$message\"\n echo \"$message\" >> \"$GITHUB_STEP_SUMMARY\"\n}\n\nprint_message \"### Release Artifacts\"\n\nIFS=$'\\n' artifacts_array=($ARTIFACTS)\nmissing_files=()\nfor file in \"${artifacts_array[@]}\";\ndo \n echo \"Checking if file $file exists...\"\n if ! [[ -f \"$file\" ]]; then\n print_message \"* ⚠️ \\`$file\\` does not exist ⚠️\"\n echo \"Content of directory $(dirname \"$file\"):\"\n ls \"$(dirname \"$file\")\"\n missing_files+=(\"$file\")\n else\n print_message \"* \\`$file\\` ✅\" \n fi\ndone\nprint_message \"\"\nnumber_of_missing_files=${#missing_files[@]}\nif [[ $number_of_missing_files -gt 0 ]]; then\n print_message \"⚠️ $number_of_missing_files release artifact(s) missing ⚠️\"\n exit 1\nfi\n" + run: | + print_message() { + local -r message=$1 + echo "$message" + echo "$message" >> "$GITHUB_STEP_SUMMARY" + } + + print_message "### Release Artifacts" + + IFS=$'\n' artifacts_array=($ARTIFACTS) + missing_files=() + for file in "${artifacts_array[@]}"; + do + echo "Checking if file $file exists..." + if ! [[ -f "$file" ]]; then + print_message "* ⚠️ \`$file\` does not exist ⚠️" + echo "Content of directory $(dirname "$file"):" + ls "$(dirname "$file")" + missing_files+=("$file") + else + print_message "* \`$file\` ✅" + fi + done + print_message "" + number_of_missing_files=${#missing_files[@]} + if [[ $number_of_missing_files -gt 0 ]]; then + print_message "⚠️ $number_of_missing_files release artifact(s) missing ⚠️" + exit 1 + fi env: { ARTIFACTS: '${{ steps.build-pk-verify.outputs.release-artifacts }}' } @@ -131,7 +157,7 @@ jobs: '{"pattern": "^https?://(www.)?eclipse.org"}' \ '{"pattern": "^https?://projects.eclipse.org"}' \ ']}' > ./target/broken_links_checker.json - - uses: tcort/github-action-markdown-link-check@v1 + - uses: tcort/github-action-markdown-link-check@e7c7a18363c842693fadde5d41a3bd3573a7a225 id: run-link-check with: { use-quiet-mode: yes, @@ -154,9 +180,10 @@ jobs: steps: - name: Checkout the repository id: checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: { - fetch-depth: 0 + fetch-depth: 0, + persist-credentials: false } - name: Set up JDK 17 id: setup-java @@ -164,22 +191,91 @@ jobs: with: { distribution: temurin, java-version: '17', - cache: maven, - server-id: ossindex, - server-username: OSSINDEX_USERNAME, - server-password: OSSINDEX_API_TOKEN + cache: maven } - name: Run tests and build with Maven 17 id: build-next-java - run: mvn --batch-mode clean package -DtrimStackTrace=false -Djava.version=17 + run: | + mvn --batch-mode clean package -DtrimStackTrace=false -Djava.version=17 \ + -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \ + -DossindexSkip=true + ossindex: + runs-on: ubuntu-latest + defaults: + run: { + shell: bash + } + permissions: { + contents: read + } + concurrency: { + group: '${{ github.workflow }}-ossindex-${{ github.ref }}', + cancel-in-progress: true + } + steps: + - name: Checkout the repository + id: checkout + uses: actions/checkout@v7 + with: { + persist-credentials: false + } + - name: Set up JDKs + id: setup-java + uses: actions/setup-java@v5 + with: + distribution: temurin + java-version: |- + 11 + 21 + cache: maven + server-id: ossindex + server-username: OSSINDEX_USERNAME + server-password: OSSINDEX_API_TOKEN + - name: Run Ossindex + id: ossindex + run: | + mvn --batch-mode test-compile \ + org.sonatype.ossindex.maven:ossindex-maven-plugin:audit \ + org.sonatype.ossindex.maven:ossindex-maven-plugin:audit-aggregate \ + -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn env: { OSSINDEX_USERNAME: '${{ secrets.OSSINDEX_USERNAME }}', OSSINDEX_API_TOKEN: '${{ secrets.OSSINDEX_API_TOKEN }}' } + lint-github-actions: + runs-on: ubuntu-latest + defaults: + run: { + shell: bash + } + permissions: { + security-events: write, + contents: read, + actions: read + } + concurrency: { + group: '${{ github.workflow }}-github-actions-linter-${{ github.ref }}', + cancel-in-progress: true + } + steps: + - name: Checkout the repository + id: checkout + uses: actions/checkout@v7 + with: { + persist-credentials: false + } + - name: Lint GitHub actions with Zizmore + id: lint-github-actions + uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa + with: { + advanced-security: false + } build: needs: [ matrix-build, - next-java-compatibility + next-java-compatibility, + ossindex, + lint-github-actions ] runs-on: ubuntu-latest defaults: @@ -196,9 +292,10 @@ jobs: steps: - name: Checkout the repository id: checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: { - fetch-depth: 0 + fetch-depth: 0, + persist-credentials: false } - name: Set up JDKs id: setup-java @@ -207,7 +304,7 @@ jobs: distribution: temurin java-version: |- 11 - 17 + 21 cache: maven - name: Check if release is needed id: check-release diff --git a/.github/workflows/dependencies_check.yml b/.github/workflows/dependencies_check.yml index 4307252..fa5164f 100644 --- a/.github/workflows/dependencies_check.yml +++ b/.github/workflows/dependencies_check.yml @@ -4,7 +4,7 @@ on: workflow_dispatch: null schedule: - { - cron: 0 2 * * * + cron: 42 22 * * 0 } jobs: report_security_issues: @@ -25,11 +25,12 @@ jobs: cancel-in-progress: true } steps: - - { - name: Checkout, - id: checkout, - uses: actions/checkout@v6 - } + - name: Checkout + id: checkout + uses: actions/checkout@v7 + with: { + persist-credentials: false + } - name: Set up JDKs id: setup-jdks uses: actions/setup-java@v5 @@ -37,7 +38,7 @@ jobs: distribution: temurin java-version: |- 11 - 17 + 21 cache: maven server-id: ossindex server-username: OSSINDEX_USERNAME @@ -55,7 +56,7 @@ jobs: } - name: Create GitHub Issues id: create-security-issues - uses: exasol/python-toolbox/.github/actions/security-issues@6.4.0 + uses: exasol/python-toolbox/.github/actions/security-issues@10.1.0 with: { format: maven, command: cat ossindex-report.json, diff --git a/.github/workflows/dependencies_update.yml b/.github/workflows/dependencies_update.yml index 1fd1e1f..1986eae 100644 --- a/.github/workflows/dependencies_update.yml +++ b/.github/workflows/dependencies_update.yml @@ -34,10 +34,11 @@ jobs: cancel-in-progress: false } steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 id: checkout with: { - fetch-depth: 0 + fetch-depth: 0, + persist-credentials: true } - name: Set up JDKs id: setup-jdks @@ -46,7 +47,7 @@ jobs: distribution: temurin java-version: |- 11 - 17 + 21 cache: maven - name: Print issues id: debug-print-issues @@ -61,7 +62,11 @@ jobs: uses: actions/github-script@v9 with: script: | - core.setFailed('Not running on a branch, github.ref is ${{ github.ref }}. Please start this workflow only on main or a branch') + const ref = process.env.GITHUB_REF + core.setFailed(`Not running on a branch, github.ref is '${ref}'. Please start this workflow only on main or a branch`) + env: { + GITHUB_REF: '${{ github.ref }}' + } - name: Update dependencies id: update-dependencies run: | @@ -159,7 +164,7 @@ jobs: - name: Report failure Status to Slack channel id: report-failure-slack if: ${{ always() }} - uses: ravsamhq/notify-slack-action@v2 + uses: ravsamhq/notify-slack-action@be814b201e233b2dc673608aa46e5447c8ab13f2 with: { status: '${{ job.status }}', token: '${{ secrets.GITHUB_TOKEN }}', @@ -173,7 +178,7 @@ jobs: - name: Report new Pull Request to Slack channel id: report-pr-slack if: ${{ steps.create-pr.outputs.pr_url }} - uses: ravsamhq/notify-slack-action@v2 + uses: ravsamhq/notify-slack-action@be814b201e233b2dc673608aa46e5447c8ab13f2 with: { status: '${{ job.status }}', token: '${{ secrets.GITHUB_TOKEN }}', diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5e2b148..1b177b5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -75,9 +75,10 @@ jobs: steps: - name: Checkout the repository id: checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: { - fetch-depth: 0 + fetch-depth: 0, + persist-credentials: true } - name: Set up Maven Central Repository id: configure-maven-central-credentials @@ -87,8 +88,7 @@ jobs: distribution: temurin java-version: |- 11 - 17 - cache: maven + 21 server-id: maven-central-portal server-username: MAVEN_USERNAME server-password: MAVEN_PASSWORD @@ -102,7 +102,7 @@ jobs: distribution: temurin java-version: |- 11 - 17 + 21 cache: maven - name: Fail if not running on main or release branch id: check-main-or-release-branch @@ -110,7 +110,11 @@ jobs: uses: actions/github-script@v9 with: script: | - core.setFailed('Not running on main or release branch, github.ref is ${{ github.ref }}. Please start this workflow only on main or a branch starting with release/') + const ref = process.env.GITHUB_REF + core.setFailed(`Not running on main or release branch, github.ref is '${ref}'. Please start this workflow only on main or a branch starting with release/`) + env: { + GITHUB_REF: '${{ github.ref }}' + } - name: Check CI build of this commit succeeded id: check-ci-build-status if: ${{ ! inputs.started-from-ci }} @@ -142,7 +146,7 @@ jobs: - { name: Build project, id: build, - run: mvn --batch-mode -DskipTests -Dossindex.skip=true clean verify + run: mvn --batch-mode -DskipTests -DossindexSkip=true clean verify } - { name: List secret GPG keys, @@ -155,7 +159,7 @@ jobs: if: ${{ false && (! inputs.skip-maven-central) }} run: | echo "#### Maven Central Release" >> "$GITHUB_STEP_SUMMARY" - mvn --batch-mode -Dgpg.skip=false -DskipTests -Dossindex.skip=true deploy \ + mvn --batch-mode -Dgpg.skip=false -DskipTests -DossindexSkip=true deploy \ -Dcentral-publishing.deploymentName="Auto release of repo ${{ github.repository }} using PK release.yml" \ -Dcentral-publishing.autoPublish=${{ inputs.maven-central-auto-publish }} if [[ "${{ inputs.maven-central-auto-publish }}" == "true" ]]; then @@ -236,7 +240,7 @@ jobs: - name: Report failure Status to Slack channel id: report-failure-status-slack if: ${{ always() }} - uses: ravsamhq/notify-slack-action@v2 + uses: ravsamhq/notify-slack-action@be814b201e233b2dc673608aa46e5447c8ab13f2 with: { status: '${{ job.status }}', token: '${{ github.token }}', @@ -250,7 +254,7 @@ jobs: - name: Report new release to Slack channel id: report-new-release-slack if: ${{ steps.create-github-release.outputs.release-url }} - uses: ravsamhq/notify-slack-action@v2 + uses: ravsamhq/notify-slack-action@be814b201e233b2dc673608aa46e5447c8ab13f2 with: { status: '${{ job.status }}', token: '${{ github.token }}', diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..a8508a1 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,33 @@ +# Generated by Project Keeper +# https://github.com/exasol/project-keeper/blob/main/project-keeper/src/main/resources/templates/.github/zizmor.yml +# See https://docs.zizmor.sh/configuration/#settings +rules: + unpinned-uses: + config: + policies: + "actions/*": ref-pin + "exasol/python-toolbox/.github/actions/security-issues": ref-pin + "*": hash-pin + cache-poisoning: + ignore: + # Enabling caching is OK for non-release workflows + - ci-build.yml + - ci-build-native-build.yml + - ci-build-db-version-matrix.yml + - project-keeper-verify.yml + - test_on_windows.yml + - test_linux_build_on_windows.yml + obfuscation: + ignore: + # Generated workflows use boolean conditions like ${{ false }} + # Note: We cannot exclude this using inline comments because GitHubWorkflowIO does not preserve comments in the workflow YAML files. + - ci-build.yml + - release.yml + - project-keeper-verify.yml + secrets-inherit: + ignore: + # Required for passing slack webhooks + - ci-build.yml + - ci-build-db-version-matrix.yml + - dependencies_check.yml + - release.yml diff --git a/.vscode/settings.json b/.vscode/settings.json index 44ae763..5f5cc4e 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -11,7 +11,7 @@ "java.test.config": { "vmArgs": [ "-Djava.util.logging.config.file=src/test/resources/logging.properties", - "-Dcom.exasol.dockerdb.image=2025.2.1" + "-Dcom.exasol.dockerdb.image=2026.1.0" ], "env": { "EXASOL_TELEMETRY_DISABLE": "true" @@ -21,4 +21,4 @@ "connectionId": "exasol", "projectKey": "com.exasol:mysql-virtual-schema" } -} \ No newline at end of file +} diff --git a/dependencies.md b/dependencies.md index 4f45d91..27536e8 100644 --- a/dependencies.md +++ b/dependencies.md @@ -28,32 +28,32 @@ ## Plugin Dependencies -| Dependency | License | -| ------------------------------------------------------- | ------------------------------------------- | -| [SonarQube Scanner for Maven][25] | [GNU LGPL 3][26] | -| [Apache Maven Toolchains Plugin][27] | [Apache-2.0][28] | -| [Apache Maven Compiler Plugin][29] | [Apache-2.0][28] | -| [Apache Maven Enforcer Plugin][30] | [Apache-2.0][28] | -| [Maven Flatten Plugin][31] | [Apache Software License][28] | -| [org.sonatype.ossindex.maven:ossindex-maven-plugin][32] | [ASL2][33] | -| [Maven Surefire Plugin][34] | [Apache-2.0][28] | -| [Versions Maven Plugin][35] | [Apache License, Version 2.0][28] | -| [duplicate-finder-maven-plugin Maven Mojo][36] | [Apache License 2.0][37] | -| [Apache Maven Artifact Plugin][38] | [Apache-2.0][28] | -| [Apache Maven Assembly Plugin][39] | [Apache-2.0][28] | -| [Apache Maven JAR Plugin][40] | [Apache-2.0][28] | -| [Artifact reference checker and unifier][41] | [MIT License][42] | -| [Apache Maven Dependency Plugin][43] | [Apache-2.0][28] | -| [Project Keeper Maven plugin][44] | [The MIT License][45] | -| [Maven Failsafe Plugin][46] | [Apache-2.0][28] | -| [JaCoCo :: Maven Plugin][47] | [EPL-2.0][24] | -| [Quality Summarizer Maven Plugin][48] | [MIT License][49] | -| [error-code-crawler-maven-plugin][50] | [MIT License][51] | -| [Git Commit Id Maven Plugin][52] | [GNU Lesser General Public License 3.0][53] | -| [Apache Maven Clean Plugin][54] | [Apache-2.0][28] | -| [Apache Maven Resources Plugin][55] | [Apache-2.0][28] | -| [Apache Maven Install Plugin][56] | [Apache-2.0][28] | -| [Apache Maven Site Plugin][57] | [Apache-2.0][28] | +| Dependency | License | +| ------------------------------------------------------- | ---------------------------------------------- | +| [SonarQube Scanner for Maven][25] | [GNU LGPL 3][26] | +| [Apache Maven Toolchains Plugin][27] | [Apache-2.0][28] | +| [Apache Maven Compiler Plugin][29] | [Apache-2.0][28] | +| [Apache Maven Enforcer Plugin][30] | [Apache-2.0][28] | +| [Maven Flatten Plugin][31] | [Apache Software License][28] | +| [org.sonatype.ossindex.maven:ossindex-maven-plugin][32] | [ASL2][33] | +| [Maven Surefire Plugin][34] | [Apache-2.0][28] | +| [Versions Maven Plugin][35] | [Apache License, Version 2.0][28] | +| [duplicate-finder-maven-plugin Maven Mojo][36] | [Apache License 2.0][37] | +| [Apache Maven Artifact Plugin][38] | [Apache-2.0][28] | +| [Apache Maven Assembly Plugin][39] | [Apache-2.0][28] | +| [Apache Maven JAR Plugin][40] | [Apache-2.0][28] | +| [Artifact reference checker and unifier][41] | [MIT License][42] | +| [spdx-maven-plugin Maven Plugin][43] | [The Apache Software License, Version 2.0][33] | +| [Apache Maven Dependency Plugin][44] | [Apache-2.0][28] | +| [Project Keeper Maven plugin][45] | [The MIT License][46] | +| [Maven Failsafe Plugin][47] | [Apache-2.0][28] | +| [JaCoCo :: Maven Plugin][48] | [EPL-2.0][24] | +| [error-code-crawler-maven-plugin][49] | [MIT License][50] | +| [Git Commit Id Maven Plugin][51] | [GNU Lesser General Public License 3.0][52] | +| [Apache Maven Clean Plugin][53] | [Apache-2.0][28] | +| [Apache Maven Resources Plugin][54] | [Apache-2.0][28] | +| [Apache Maven Install Plugin][55] | [Apache-2.0][28] | +| [Apache Maven Site Plugin][56] | [Apache-2.0][28] | [0]: https://github.com/exasol/virtual-schema-common-jdbc/ [1]: https://github.com/exasol/virtual-schema-common-jdbc/blob/main/LICENSE @@ -98,18 +98,17 @@ [40]: https://maven.apache.org/plugins/maven-jar-plugin/ [41]: https://github.com/exasol/artifact-reference-checker-maven-plugin/ [42]: https://github.com/exasol/artifact-reference-checker-maven-plugin/blob/main/LICENSE -[43]: https://maven.apache.org/plugins/maven-dependency-plugin/ -[44]: https://github.com/exasol/project-keeper/ -[45]: https://github.com/exasol/project-keeper/blob/main/LICENSE -[46]: https://maven.apache.org/surefire/maven-failsafe-plugin/ -[47]: https://www.jacoco.org/jacoco/trunk/doc/maven.html -[48]: https://github.com/exasol/quality-summarizer-maven-plugin/ -[49]: https://github.com/exasol/quality-summarizer-maven-plugin/blob/main/LICENSE -[50]: https://github.com/exasol/error-code-crawler-maven-plugin/ -[51]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE -[52]: https://github.com/git-commit-id/git-commit-id-maven-plugin -[53]: http://www.gnu.org/licenses/lgpl-3.0.txt -[54]: https://maven.apache.org/plugins/maven-clean-plugin/ -[55]: https://maven.apache.org/plugins/maven-resources-plugin/ -[56]: https://maven.apache.org/plugins/maven-install-plugin/ -[57]: https://maven.apache.org/plugins/maven-site-plugin/ +[43]: https://github.com/spdx/spdx-maven-plugin +[44]: https://maven.apache.org/plugins/maven-dependency-plugin/ +[45]: https://github.com/exasol/project-keeper/ +[46]: https://github.com/exasol/project-keeper/blob/main/LICENSE +[47]: https://maven.apache.org/surefire/maven-failsafe-plugin/ +[48]: https://www.jacoco.org/jacoco/trunk/doc/maven.html +[49]: https://github.com/exasol/error-code-crawler-maven-plugin/ +[50]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE +[51]: https://github.com/git-commit-id/git-commit-id-maven-plugin +[52]: http://www.gnu.org/licenses/lgpl-3.0.txt +[53]: https://maven.apache.org/plugins/maven-clean-plugin/ +[54]: https://maven.apache.org/plugins/maven-resources-plugin/ +[55]: https://maven.apache.org/plugins/maven-install-plugin/ +[56]: https://maven.apache.org/plugins/maven-site-plugin/ diff --git a/doc/changes/changes_6.0.2.md b/doc/changes/changes_6.0.2.md index 4d4c989..8453653 100644 --- a/doc/changes/changes_6.0.2.md +++ b/doc/changes/changes_6.0.2.md @@ -1,4 +1,4 @@ -# Virtual Schema for MySQL 6.0.2, released 2026-??-?? +# Virtual Schema for MySQL 6.0.2, released 2026-07-29 Code name: Fixed vulnerabilities CVE-2026-9563, CVE-2026-60586, CVE-2026-60623, CVE-2026-60624, CVE-2026-61082 @@ -58,13 +58,27 @@ Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connec ### Test Dependency Updates -* Updated `com.exasol:exasol-testcontainers:7.2.3` to `7.3.0` -* Updated `com.exasol:test-db-builder-java:4.0.0` to `4.0.1` +* Updated `com.exasol:exasol-testcontainers:7.2.3` to `8.0.1` +* Updated `com.exasol:hamcrest-resultset-matcher:1.7.2` to `1.7.3` +* Updated `com.exasol:test-db-builder-java:4.0.0` to `4.0.2` * Updated `com.exasol:udf-debugging-java:0.6.18` to `0.6.20` * Updated `com.exasol:virtual-schema-common-jdbc:14.0.2` to `14.0.4` -* Updated `org.junit.jupiter:junit-jupiter-api:5.14.3` to `6.1.2` +* Updated `com.mysql:mysql-connector-j:9.7.0` to `9.6.0` +* Updated `org.jacoco:org.jacoco.agent:0.8.14` to `0.8.15` +* Updated `org.junit.jupiter:junit-jupiter-api:5.14.3` to `5.14.4` * Updated `org.slf4j:slf4j-jdk14:2.0.17` to `2.0.18` ### Plugin Dependency Updates +* Updated `com.exasol:artifact-reference-checker-maven-plugin:0.4.4` to `1.0.1` +* Updated `com.exasol:error-code-crawler-maven-plugin:2.0.7` to `2.1.0` * Updated `com.exasol:project-keeper-maven-plugin:5.5.2` to `5.7.4` +* Removed `com.exasol:quality-summarizer-maven-plugin:0.2.1` +* Updated `org.apache.maven.plugins:maven-dependency-plugin:3.10.0` to `3.11.0` +* Updated `org.apache.maven.plugins:maven-enforcer-plugin:3.6.2` to `3.6.3` +* Updated `org.apache.maven.plugins:maven-failsafe-plugin:3.5.5` to `3.5.6` +* Updated `org.apache.maven.plugins:maven-site-plugin:3.21.0` to `3.22.0` +* Updated `org.apache.maven.plugins:maven-surefire-plugin:3.5.5` to `3.5.6` +* Updated `org.jacoco:jacoco-maven-plugin:0.8.14` to `0.8.15` +* Updated `org.sonarsource.scanner.maven:sonar-maven-plugin:5.5.0.6356` to `5.7.0.6970` +* Added `org.spdx:spdx-maven-plugin:1.0.4` diff --git a/doc/user_guide/mysql_user_guide.md b/doc/user_guide/mysql_user_guide.md index a2c05bb..947ac3d 100644 --- a/doc/user_guide/mysql_user_guide.md +++ b/doc/user_guide/mysql_user_guide.md @@ -49,7 +49,7 @@ The SQL statement below creates the adapter script, defines the Java class that --/ CREATE OR REPLACE JAVA ADAPTER SCRIPT SCHEMA_FOR_VS_SCRIPT.ADAPTER_SCRIPT_MYSQL AS %scriptclass com.exasol.adapter.RequestDispatcher; - %jar /buckets/bfsdefault/default/virtual-schema-dist-14.0.2-mysql-6.0.2.jar; + %jar /buckets/bfsdefault/default/virtual-schema-dist-14.0.4-mysql-6.0.2.jar; %jar /buckets/bfsdefault/default/mysql-connector-java-.jar; / ; @@ -120,7 +120,7 @@ See also [Adapter Properties for JDBC-Based Virtual Schemas](https://github.com/ | YEAR | ✓ | DATE | | (1) Types TIME, DATETIME and TIMESTAMP with fractional second precision are mapped to TIMESTAMP with milliseconds precision -for Exasol versions up to 8.31. Starting with Exasol 8.32 they are mapped with the same specified precision as in MySQL. +for Exasol versions up to 8.31. Starting with Exasol 8.32 they are mapped with the same specified precision as in MySQL. * The tested versions of MySQL Connector JDBC Driver return the column's size depending on the charset and its collation. As the real data in a MySQL table can sometimes exceed the size that we get from the JDBC driver, we set the size for all TEXT columns to 65535 characters. @@ -136,4 +136,5 @@ In the following matrix you find combinations of JDBC driver and dialect version | 4.1.3 | MySQL 8.0.23 | MySQL Connector | 8.0.23 | | 5.0.1 | MySQL 8.1.0 | MySQL Connector | 8.1.0 | | 5.0.2 | MySQL 9.0.1 | MySQL Connector | 9.0.1 | -| Latest | MySQL 9.2.0 | MySQL Connector | 9.3.0 | +| 5.1.0 | MySQL 9.2.0 | MySQL Connector | 9.3.0 | +| 6.0.2 | MySQL 9.7.2 | MySQL Connector | 9.6.0 | diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom index cea5f46..2d9c33b 100644 --- a/pk_generated_parent.pom +++ b/pk_generated_parent.pom @@ -13,6 +13,7 @@ exasol https://sonarcloud.io + false @@ -38,7 +39,7 @@ org.jacoco org.jacoco.agent - 0.8.14 + 0.8.15 test runtime @@ -64,7 +65,7 @@ org.apache.maven.plugins maven-site-plugin - 3.21.0 + 3.22.0 org.codehaus.mojo @@ -82,7 +83,7 @@ org.sonarsource.scanner.maven sonar-maven-plugin - 5.5.0.6356 + 5.7.0.6970 org.apache.maven.plugins @@ -108,8 +109,7 @@ maven-compiler-plugin 3.15.0 - ${java.version} - ${java.version} + ${java.version} true -Xlint:all @@ -120,7 +120,7 @@ org.apache.maven.plugins maven-enforcer-plugin - 3.6.2 + 3.6.3 enforce-maven @@ -171,6 +171,8 @@ 3.2.0 ossindex + + ${ossindexSkip} @@ -185,7 +187,7 @@ org.apache.maven.plugins maven-surefire-plugin - 3.5.5 + 3.5.6 ${argLine} @@ -307,7 +309,7 @@ com.exasol artifact-reference-checker-maven-plugin - 0.4.4 + 1.0.1 verify @@ -317,10 +319,39 @@ + + + org.spdx + spdx-maven-plugin + 1.0.4 + + + build-spdx + package + + createSPDX + + + + + build + + true + true + true + true + false + false + Copyright (c) Exasol + false + JSON-LD + ${project.build.directory}/site/${project.groupId}.${project.artifactId}-${project.version}.spdx3.json + + org.apache.maven.plugins maven-dependency-plugin - 3.10.0 + 3.11.0 copy-jacoco @@ -340,7 +371,7 @@ org.apache.maven.plugins maven-failsafe-plugin - 3.5.5 + 3.5.6 ${argLine} @@ -366,7 +397,7 @@ org.jacoco jacoco-maven-plugin - 0.8.14 + 0.8.15 prepare-agent @@ -410,23 +441,10 @@ - - com.exasol - quality-summarizer-maven-plugin - 0.2.1 - - - summarize-metrics - - summarize - - - - com.exasol error-code-crawler-maven-plugin - 2.0.7 + 2.1.0 verify diff --git a/pom.xml b/pom.xml index 985b386..dab7f72 100644 --- a/pom.xml +++ b/pom.xml @@ -35,7 +35,7 @@ org.junit.jupiter junit-jupiter-api - 6.1.2 + 5.14.4 test @@ -48,7 +48,7 @@ com.exasol exasol-testcontainers - 7.3.0 + 8.0.1 test @@ -66,19 +66,20 @@ com.mysql mysql-connector-j - 9.7.0 + + 9.6.0 test com.exasol test-db-builder-java - 4.0.1 + 4.0.2 test com.exasol hamcrest-resultset-matcher - 1.7.2 + 1.7.3 test diff --git a/src/test/java/com/exasol/adapter/dialects/mysql/IntegrationTestConstants.java b/src/test/java/com/exasol/adapter/dialects/mysql/IntegrationTestConstants.java index 773a2ce..32705e1 100644 --- a/src/test/java/com/exasol/adapter/dialects/mysql/IntegrationTestConstants.java +++ b/src/test/java/com/exasol/adapter/dialects/mysql/IntegrationTestConstants.java @@ -3,9 +3,9 @@ import java.nio.file.Path; public final class IntegrationTestConstants { - public static final String VIRTUAL_SCHEMAS_JAR_NAME_AND_VERSION = "virtual-schema-dist-14.0.2-mysql-6.0.2.jar"; - public static final String MYSQL_DOCKER_IMAGE_REFERENCE = "mysql:9.6.0"; - public static final String EXASOL_VERSION = "2025.2.1"; + public static final String VIRTUAL_SCHEMAS_JAR_NAME_AND_VERSION = "virtual-schema-dist-14.0.4-mysql-6.0.2.jar"; + public static final String MYSQL_DOCKER_IMAGE_REFERENCE = "mysql:9.7.2"; + public static final String EXASOL_VERSION = "2026.1.0"; public static final Path PATH_TO_VIRTUAL_SCHEMAS_JAR = Path.of("target", VIRTUAL_SCHEMAS_JAR_NAME_AND_VERSION); public static final String SCHEMA_EXASOL = "SCHEMA_EXASOL"; From 9a5586e38c21bdcb5154ea93dbe5b0d90f401c80 Mon Sep 17 00:00:00 2001 From: Christoph Pirkl Date: Wed, 29 Jul 2026 13:04:09 +0200 Subject: [PATCH 3/3] Mark file as generated --- .gitattributes | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitattributes b/.gitattributes index 2a67344..ce4251a 100644 --- a/.gitattributes +++ b/.gitattributes @@ -7,5 +7,6 @@ doc/changes/changelog.md linguist-genera .github/workflows/dependencies_check.yml linguist-generated=true .github/workflows/dependencies_update.yml linguist-generated=true .github/workflows/release.yml linguist-generated=true +.github/zizmor.yml linguist-generated=true .settings/org.eclipse.jdt.core.prefs linguist-generated=true .settings/org.eclipse.jdt.ui.prefs linguist-generated=true