build(deps): bump org.owasp:dependency-check-maven from 8.3.1 to 8.4.0 #1631

dependabot · 2023-08-24T00:25:38Z

Bumps org.owasp:dependency-check-maven from 8.3.1 to 8.4.0.

Release notes

Sourced from org.owasp:dependency-check-maven's releases.

Version 8.4.0

Added

feat: Add support for Nexus v3 to NexusAnalyzer (#5849)

Fixed

fix: Hint Analyzer should run before VersionFilter Analyzer (#5818)

chore: switch to sha1-pinning as suggested by Semgrep

fix: OSS Index Analyzer SocketTimeoutException exception handling based on warn only parameter (#5845)

fix: use curl with -L to follow github redirect (#5808)

fix: use curl with -L to follow github redirect

fix: #5671 out of memory error (#5789)

fix: #5671 Exit method as soon as we detect a loop to prevent an infinite loop leading to an OutOfMemoryError

Changelog

Sourced from org.owasp:dependency-check-maven's changelog.

Version 8.4.0 (2023-08-19)

Added

feat: Add support for Nexus v3 to NexusAnalyzer (#5849)

Fixed

fix: Hint Analyzer should run before VersionFilter Analyzer (#5818)

chore: switch to sha1-pinning as suggested by Semgrep

fix: OSS Index Analyzer SocketTimeoutException exception handling based on warn only parameter (#5845)

fix: use curl with -L to follow github redirect (#5808)

fix: use curl with -L to follow github redirect

fix: #5671 out of memory error (#5789)

fix: #5671 Exit method as soon as we detect a loop to prevent an infinite loop leading to an OutOfMemoryError

See the full listing of changes.

Commits

cc2db4c build: prepare release v8.4.0
17c5081 chore: prepare release (#5891)
d1e5736 build(deps): bump com.google.guava:guava from 32.0.1-jre to 32.1.2-jre (#5850)
e685b80 feat: Add support for Nexus v3 to NexusAnalyzer (#5849)
a29afc4 fix: Hint Analyzer should run before VersionFilter Analyzer (#5818)
49c6591 build(deps): bump actions/setup-node from 3.8.0 to 3.8.1 (#5889)
0f4553a build(deps): bump actions/setup-node from 3.8.0 to 3.8.1
8ee8214 build(deps): bump actions/setup-node from 3.7.0 to 3.8.0 (#5877)
d71f038 build(deps): bump org.semver4j:semver4j from 5.0.0 to 5.1.0 (#5878)
5a55c81 build(deps): bump org.semver4j:semver4j from 5.0.0 to 5.1.0
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

github-actions · 2023-08-24T00:46:28Z

Test image available:

$ CRYOSTAT_IMAGE=ghcr.io/cryostatio/cryostat:pr-1631-e58b5b1fb803f8a249afb897b7ae772f5c01d46d-linux-arm64 sh smoketest.sh

github-actions · 2023-08-24T00:46:33Z

Test image available:

$ CRYOSTAT_IMAGE=ghcr.io/cryostatio/cryostat:pr-1631-e58b5b1fb803f8a249afb897b7ae772f5c01d46d-linux-amd64 sh smoketest.sh

andrewazores · 2023-08-24T20:56:15Z

@dependabot rebase

andrewazores · 2023-08-24T20:57:36Z

/build_test

andrewazores · 2023-08-24T21:31:35Z

Looks like the Action fails to push images to ghcr.io: https://github.com/cryostatio/cryostat/actions/runs/5968826929/job/16194311189

@mwangggg I guess we will need to bring back that other token secret.

andrewazores · 2023-08-25T13:27:22Z

@tthvo ^

tthvo · 2023-08-25T19:45:35Z

~~Ahh I think for that, we need explicitly ask for the permissions. Otherwise, the token will remain restrictive as read-only. Looks like we are missing a permission request here:~~

EDITED: https://github.com/cryostatio/cryostat/pull/1635#issuecomment-1694094452

tthvo · 2023-08-28T18:32:34Z

/build_test

github-actions · 2023-08-28T20:04:56Z

ARCH	IMAGE
amd64	ghcr.io/cryostatio/cryostat:pr--3743dbf3f0180f9891ed527c479449b465cc0a04-linux-amd64
arm64	ghcr.io/cryostatio/cryostat:pr--3743dbf3f0180f9891ed527c479449b465cc0a04-linux-arm64

To run smoketest:

# amd64          
CRYOSTAT_IMAGE=ghcr.io/cryostatio/cryostat:pr--3743dbf3f0180f9891ed527c479449b465cc0a04-linux-amd64 sh smoketest.sh

# or arm64
CRYOSTAT_IMAGE=ghcr.io/cryostatio/cryostat:pr--3743dbf3f0180f9891ed527c479449b465cc0a04-linux-arm64 sh smoketest.sh

andrewazores · 2023-08-28T20:35:53Z

ghcr.io/cryostatio/cryostat:pr--3743dbf3f0180f9891ed527c479449b465cc0a04-linux-amd64

Looks like the action didn't pick up the PR event number?

tthvo · 2023-08-28T21:06:05Z

Ahh i think because the event is issue_comment so it does not have number field in the context.

PR context: https://docs.github.com/en/webhooks/webhook-events-and-payloads#pull_request

Comment context: https://docs.github.com/en/webhooks/webhook-events-and-payloads#issue_comment

Maybe we can switch it to use ~~run_id~~ or extract the PR number from checkout-branch job @mwangggg ?

andrewazores · 2023-09-21T20:12:08Z

@dependabot rebase

andrewazores · 2023-09-21T20:40:12Z

@dependabot rebase

Bumps [org.owasp:dependency-check-maven](https://github.com/jeremylong/DependencyCheck) from 8.3.1 to 8.4.0. - [Release notes](https://github.com/jeremylong/DependencyCheck/releases) - [Changelog](https://github.com/jeremylong/DependencyCheck/blob/main/CHANGELOG.md) - [Commits](jeremylong/DependencyCheck@v8.3.1...v8.4.0) --- updated-dependencies: - dependency-name: org.owasp:dependency-check-maven dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot requested review from andrewazores and ebaron as code owners August 24, 2023 00:25

dependabot bot added chore Refactor, rename, cleanup, etc. dependencies Pull requests that update a dependency file safe-to-test labels Aug 24, 2023

dependabot bot requested a review from a team August 24, 2023 00:25

github-actions bot added the needs-triage Needs thorough attention from code reviewers label Aug 24, 2023

andrewazores removed the needs-triage Needs thorough attention from code reviewers label Aug 24, 2023

dependabot bot force-pushed the dependabot/maven/org.owasp-dependency-check-maven-8.4.0 branch from e58b5b1 to 3743dbf Compare August 24, 2023 20:56

andrewazores mentioned this pull request Aug 24, 2023

[Task] /build_test command enhancements #1634

Closed

andrewazores mentioned this pull request Aug 25, 2023

[Request] Replace GHCR_PR_TOKEN with GITHUB_TOKEN cryostatio/cryostat-operator#613

Closed

dependabot bot force-pushed the dependabot/maven/org.owasp-dependency-check-maven-8.4.0 branch from 3743dbf to 2fde641 Compare August 28, 2023 20:59

dependabot bot force-pushed the dependabot/maven/org.owasp-dependency-check-maven-8.4.0 branch 7 times, most recently from 8c0c1dd to bd96c8f Compare August 31, 2023 15:18

dependabot bot force-pushed the dependabot/maven/org.owasp-dependency-check-maven-8.4.0 branch 3 times, most recently from e228e48 to 6432f9e Compare September 5, 2023 13:40

dependabot bot force-pushed the dependabot/maven/org.owasp-dependency-check-maven-8.4.0 branch 2 times, most recently from 42c97dc to fd3f8e4 Compare September 8, 2023 21:23

dependabot bot force-pushed the dependabot/maven/org.owasp-dependency-check-maven-8.4.0 branch from fd3f8e4 to 3c4e2cc Compare September 19, 2023 14:47

aali309 approved these changes Sep 21, 2023

View reviewed changes

dependabot bot force-pushed the dependabot/maven/org.owasp-dependency-check-maven-8.4.0 branch from 3c4e2cc to 3de394a Compare September 21, 2023 20:12

dependabot bot force-pushed the dependabot/maven/org.owasp-dependency-check-maven-8.4.0 branch from 3de394a to c76983c Compare September 21, 2023 20:40

andrewazores approved these changes Sep 21, 2023

View reviewed changes

andrewazores merged commit 53a9723 into main Sep 21, 2023
7 checks passed

dependabot bot deleted the dependabot/maven/org.owasp-dependency-check-maven-8.4.0 branch September 21, 2023 20:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump org.owasp:dependency-check-maven from 8.3.1 to 8.4.0 #1631

build(deps): bump org.owasp:dependency-check-maven from 8.3.1 to 8.4.0 #1631

dependabot bot commented on behalf of github Aug 24, 2023 •

edited

Loading

github-actions bot commented Aug 24, 2023

github-actions bot commented Aug 24, 2023

andrewazores commented Aug 24, 2023

andrewazores commented Aug 24, 2023

andrewazores commented Aug 24, 2023

andrewazores commented Aug 25, 2023

tthvo commented Aug 25, 2023 •

edited

Loading

tthvo commented Aug 28, 2023

github-actions bot commented Aug 28, 2023

andrewazores commented Aug 28, 2023

tthvo commented Aug 28, 2023 •

edited

Loading

andrewazores commented Sep 21, 2023

andrewazores commented Sep 21, 2023

build(deps): bump org.owasp:dependency-check-maven from 8.3.1 to 8.4.0 #1631

build(deps): bump org.owasp:dependency-check-maven from 8.3.1 to 8.4.0 #1631

Conversation

dependabot bot commented on behalf of github Aug 24, 2023 • edited Loading

Version 8.4.0

Added

Fixed

Version 8.4.0 (2023-08-19)

Added

Fixed

github-actions bot commented Aug 24, 2023

github-actions bot commented Aug 24, 2023

andrewazores commented Aug 24, 2023

andrewazores commented Aug 24, 2023

andrewazores commented Aug 24, 2023

andrewazores commented Aug 25, 2023

tthvo commented Aug 25, 2023 • edited Loading

tthvo commented Aug 28, 2023

github-actions bot commented Aug 28, 2023

andrewazores commented Aug 28, 2023

tthvo commented Aug 28, 2023 • edited Loading

andrewazores commented Sep 21, 2023

andrewazores commented Sep 21, 2023

dependabot bot commented on behalf of github Aug 24, 2023 •

edited

Loading

tthvo commented Aug 25, 2023 •

edited

Loading

tthvo commented Aug 28, 2023 •

edited

Loading