From b3733c3cb49ef0c61839d06a42d65991371c85d8 Mon Sep 17 00:00:00 2001 From: Florian Zschocke Date: Sat, 14 Jun 2025 17:25:49 +0200 Subject: dep: Update multiple dependencies after security scan Update dependencies after running grype to the fixed versions. --- .classpath | 39 +++---- build.moxie | 22 ++-- gitblit.iml | 125 +++++++++++---------- releases.moxie | 14 ++- .../java/com/gitblit/tickets/TicketNotifier.java | 3 +- .../java/com/gitblit/wicket/pages/BasePage.java | 3 +- 6 files changed, 112 insertions(+), 94 deletions(-) diff --git a/.classpath b/.classpath index 8253f511..ed27f4e0 100644 --- a/.classpath +++ b/.classpath @@ -24,15 +24,15 @@ - - - - - - - - - + + + + + + + + + @@ -66,22 +66,23 @@ - - - - + + + + - + - + - + - - + + + @@ -97,7 +98,7 @@ - + diff --git a/build.moxie b/build.moxie index 057c1c9d..c305dc14 100644 --- a/build.moxie +++ b/build.moxie @@ -105,17 +105,17 @@ repositories: central, eclipse-snapshots, eclipse, gitblit # Convenience properties for dependencies properties: { - jetty.version : 9.4.49.v20220914 + jetty.version : 9.4.57.v20241219 slf4j.version : 1.7.36 wicket.version : 1.4.22 lucene.version : 5.5.2 jgit.version : 4.11.9.201909030838-r - groovy.version : 2.4.4 - bouncycastle.version : 1.69 + groovy.version : 2.4.21 + bouncycastle.version : 1.81 selenium.version : 2.28.0 wikitext.version : 1.4 sshd.version: 1.7.0 - mina.version: 2.0.25 + mina.version: 2.0.27 guice.version : 5.1.0 # Gitblit maintains a fork of guice-servlet guice-servlet.version : 5.1.0-gb2 @@ -168,9 +168,9 @@ dependencies: - compile 'org.fusesource.wikitext:confluence-core:${wikitext.version}' :war - compile 'org.eclipse.jgit:org.eclipse.jgit:${jgit.version}' :war :fedclient :manager !junit - compile 'org.eclipse.jgit:org.eclipse.jgit.http.server:${jgit.version}' :war :manager !junit -- compile 'org.bouncycastle:bcprov-jdk15on:${bouncycastle.version}' :war -- compile 'org.bouncycastle:bcmail-jdk15on:${bouncycastle.version}' :war -- compile 'org.bouncycastle:bcpkix-jdk15on:${bouncycastle.version}' :war +- compile 'org.bouncycastle:bcprov-jdk18on:${bouncycastle.version}' :war +- compile 'org.bouncycastle:bcmail-jdk18on:${bouncycastle.version}' :war +- compile 'org.bouncycastle:bcpkix-jdk18on:${bouncycastle.version}' :war - compile 'net.i2p.crypto:eddsa:0.2.0' :war !org.easymock - compile 'org.apache.sshd:sshd-core:${sshd.version}' :war !org.easymock - compile 'org.apache.mina:mina-core:${mina.version}' :war !org.easymock @@ -178,10 +178,10 @@ dependencies: - compile 'com.google.code.gson:gson:2.10' :war :fedclient :manager :api - compile 'org.codehaus.groovy:groovy-all:${groovy.version}' :war - compile 'com.unboundid:unboundid-ldapsdk:2.3.8' :war -- compile 'org.apache.ivy:ivy:2.2.0' :war +- compile 'org.apache.ivy:ivy:2.5.3' :war - compile 'com.toedter:jcalendar:1.3.2' :authority -- compile 'org.apache.commons:commons-compress:1.24.0' :war -- compile 'commons-io:commons-io:2.11.0' :war +- compile 'org.apache.commons:commons-compress:1.27.1' :war +- compile 'commons-io:commons-io:2.19.0' :war - compile 'com.force.api:force-partner-api:24.0.0' :war - compile 'org.freemarker:freemarker:2.3.22' :war - compile 'com.github.dblock.waffle:waffle-jna:1.7.3' :war @@ -193,7 +193,7 @@ dependencies: - compile 'org.apache.tika:tika-core:1.28.5' :war - compile 'org.jsoup:jsoup:1.16.2' :war - compile 'com.sun.activation:javax.activation:1.2.0' :war :manager :fedclient -- test 'junit:junit:4.12' +- test 'junit:junit:4.13.1' # Dependencies for Selenium web page testing - test 'org.seleniumhq.selenium:selenium-java:${selenium.version}' @jar - test 'org.seleniumhq.selenium:selenium-support:${selenium.version}' @jar diff --git a/gitblit.iml b/gitblit.iml index 0761644b..52dc93df 100644 --- a/gitblit.iml +++ b/gitblit.iml @@ -211,101 +211,101 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -671,46 +671,46 @@ - + - + - + - + - + - + - + - + - + - + - + - + @@ -737,13 +737,13 @@ - + - + - + @@ -781,13 +781,13 @@ - + - + - + @@ -803,13 +803,13 @@ - + - + - + @@ -823,24 +823,35 @@ - + - + - + - + - + - + + + + + + + + + + + + @@ -1010,13 +1021,13 @@ - + - + - + diff --git a/releases.moxie b/releases.moxie index 5895dc7e..f13ef403 100644 --- a/releases.moxie +++ b/releases.moxie @@ -55,6 +55,7 @@ r34: { - Updated Git clients list on empty repository page. - Improved Chinese translation of "fork". - Switched logging library from Log4j1 to reload4j. + - Updating the BouncyCastle version required to switch from bc*-jdk15on to bc*-jdk18on additions: - Option to explicitly disable optional client TLS certificates. (issue-1137, pr-1138 by @oddeirik) - Support for ECDSA and Ed25519 (EdDSA) user keys. (pr-1427, pr-1272) @@ -66,21 +67,24 @@ r34: { - update to Google Guice 5.1.0 - update to Google Guava 32.1.3-jre - update to Google Gson 2.10 - - update to Apache commons-io 2.11.0 + - update to Apache commons-io 2.19 - update to Apache commons-codec 1.9 - - update to Apache commons-compress 1.24 + - update to Apache commons-compress 1.27.1 - update to Apache Tika 1.28.5 - update to libpam4j 1.11 - update to MINA SSHD 1.7.0 - - update to MINA Core 2.0.25 - - update to BouncyCastle 1.69 - - update to Jetty 9.4.49.v20220914 (pr-1213 by @paladox, plus more) + - update to MINA Core 2.0.27 + - update to BouncyCastle 1.81 + - update to Jetty 9.4.57.v20241219 (pr-1213 by @paladox, plus more) - update to JGit 4.11.9.201909030838-r (pr-1252 by @jvanhercke, plus more) - update to Bugtraq v0.4 - update to JSoup 1.16.2 + - update to Groovy 2.4.21 + - update to Ivy 2.5.3 - update to slf4j 1.7.36 - replace log4j1 with reload4j - added clipboard.js, replacing Clippy + - update to JUnit 4.13.1 settings: - { name: 'server.requireClientCertificates', defaultValue: 'optional' } contributors: diff --git a/src/main/java/com/gitblit/tickets/TicketNotifier.java b/src/main/java/com/gitblit/tickets/TicketNotifier.java index f284e7be..a16b3753 100644 --- a/src/main/java/com/gitblit/tickets/TicketNotifier.java +++ b/src/main/java/com/gitblit/tickets/TicketNotifier.java @@ -17,6 +17,7 @@ package com.gitblit.tickets; import java.io.IOException; import java.io.InputStream; +import java.io.UncheckedIOException; import java.text.DateFormat; import java.text.MessageFormat; import java.text.SimpleDateFormat; @@ -640,7 +641,7 @@ public class TicketNotifier { for (String line : lines) { sb.append(line).append('\n'); } - } catch (IOException e) { + } catch (UncheckedIOException e) { } finally { if (is != null) { diff --git a/src/main/java/com/gitblit/wicket/pages/BasePage.java b/src/main/java/com/gitblit/wicket/pages/BasePage.java index 0d99f5e5..72e6a283 100644 --- a/src/main/java/com/gitblit/wicket/pages/BasePage.java +++ b/src/main/java/com/gitblit/wicket/pages/BasePage.java @@ -17,6 +17,7 @@ package com.gitblit.wicket.pages; import java.io.IOException; import java.io.InputStream; +import java.io.UncheckedIOException; import java.text.MessageFormat; import java.util.ArrayList; import java.util.Calendar; @@ -495,7 +496,7 @@ public abstract class BasePage extends SessionPage { for (String line : lines) { sb.append(line).append('\n'); } - } catch (IOException e) { + } catch (UncheckedIOException e) { } finally { if (is != null) { -- cgit v1.2.3