CVE-2024-36114 (#73)

* Updated dependencies Fixed CVE-2024-36114 via transitive dependency override
exasol · Jun 3, 2024 · 064d364 · 064d364
1 parent e99b050
commit 064d364
Show file tree

Hide file tree

Showing 9 changed files with 151 additions and 116 deletions.
diff --git a/.github/workflows/broken_links_checker.yml b/.github/workflows/broken_links_checker.yml
diff --git a/.github/workflows/ci-build-next-java.yml b/.github/workflows/ci-build-next-java.yml
diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml
diff --git a/.github/workflows/dependencies_update.yml b/.github/workflows/dependencies_update.yml
diff --git a/dependencies.md b/dependencies.md
diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md
diff --git a/doc/changes/changes_2.0.9.md b/doc/changes/changes_2.0.9.md
@@ -0,0 +1,36 @@
+# Parquet for Java 2.0.9, released 2024-06-03
+
+Code name: Security update - fix for CVE-2024-36114
+
+## Summary
+
+Fixed CVE-2024-36114  https://github.com/advisories/GHSA-973x-65j7-xcf4 via transitive version update.
+Updated dependencies.
+
+## Security
+
+* #72: CVE-2024-36114: io.airlift:aircompressor:jar:0.21:compile
+
+## Dependency Updates
+
+### Compile Dependency Updates
+
+* Added `io.airlift:aircompressor:0.27`
+* Updated `org.apache.commons:commons-compress:1.26.1` to `1.26.2`
+
+### Test Dependency Updates
+
+* Updated `org.mockito:mockito-core:5.11.0` to `5.12.0`
+* Updated `org.mockito:mockito-junit-jupiter:5.11.0` to `5.12.0`
+
+### Plugin Dependency Updates
+
+* Updated `com.exasol:error-code-crawler-maven-plugin:2.0.2` to `2.0.3`
+* Updated `com.exasol:project-keeper-maven-plugin:4.3.0` to `4.3.2`
+* Updated `org.apache.maven.plugins:maven-deploy-plugin:3.1.1` to `3.1.2`
+* Updated `org.apache.maven.plugins:maven-enforcer-plugin:3.4.1` to `3.5.0`
+* Updated `org.apache.maven.plugins:maven-gpg-plugin:3.2.2` to `3.2.4`
+* Updated `org.apache.maven.plugins:maven-javadoc-plugin:3.6.3` to `3.7.0`
+* Updated `org.apache.maven.plugins:maven-toolchains-plugin:3.1.0` to `3.2.0`
+* Updated `org.sonarsource.scanner.maven:sonar-maven-plugin:3.11.0.3922` to `4.0.0.4121`
+* Updated `org.sonatype.plugins:nexus-staging-maven-plugin:1.6.13` to `1.7.0`