Skip to content

Commit 55b350a

Browse files
infeoinfeo
committed
Merge branch 'release/2.0.7'
2 parents b02ef7a + c73b475 commit 55b350a

File tree

6 files changed

+53
-83
lines changed

6 files changed

+53
-83
lines changed

‎.github/workflows/build.yml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
name: Build
22
on:
3-
[push]
3+
push:
4+
pull_request_target:
5+
types: [labeled]
46
jobs:
57
build:
68
name: Build and Test
@@ -29,9 +31,9 @@ jobs:
2931
name: artifacts
3032
path: target/*.jar
3133
- name: Create Release
32-
uses: softprops/action-gh-release@v1
34+
uses: softprops/action-gh-release@v2
3335
if: startsWith(github.ref, 'refs/tags/')
3436
with:
3537
prerelease: true
3638
token: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
37-
generate_release_notes: true
39+
generate_release_notes: true

‎.github/workflows/dependency-check.yml

Lines changed: 8 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -10,54 +10,11 @@ on:
1010

1111
jobs:
1212
check-dependencies:
13-
name: Check dependencies
14-
runs-on: ubuntu-latest
15-
steps:
16-
- uses: actions/checkout@v4
17-
with:
18-
show-progress: false
19-
- name: Setup Java
20-
uses: actions/setup-java@v4
21-
with:
22-
java-version: 17
23-
distribution: 'temurin'
24-
cache: 'maven'
25-
- name: Cache NVD DB
26-
uses: actions/cache@v4
27-
with:
28-
path: ~/.m2/repository/org/owasp/dependency-check-data/
29-
key: dependency-check-${{ github.run_id }}
30-
restore-keys: |
31-
dependency-check
32-
env:
33-
SEGMENT_DOWNLOAD_TIMEOUT_MINS: 5
34-
- name: Run org.owasp:dependency-check plugin
35-
id: dependency-check
36-
continue-on-error: true
37-
run: mvn -B validate -Pdependency-check
38-
env:
39-
NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
40-
- name: Upload report on failure
41-
if: steps.dependency-check.outcome == 'failure'
42-
uses: actions/upload-artifact@v4
43-
with:
44-
name: dependency-check-report
45-
path: target/dependency-check-report.html
46-
if-no-files-found: error
47-
- name: Slack Notification on regular check
48-
if: github.event_name == 'schedule' && steps.dependency-check.outcome == 'failure'
49-
uses: rtCamp/action-slack-notify@v2
50-
env:
51-
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
52-
SLACK_USERNAME: 'Cryptobot'
53-
SLACK_ICON: false
54-
SLACK_ICON_EMOJI: ':bot:'
55-
SLACK_CHANNEL: 'cryptomator-desktop'
56-
SLACK_TITLE: "Vulnerabilities in ${{ github.event.repository.name }} detected."
57-
SLACK_MESSAGE: "Download the <https://github.com/${{ github.repository }}/actions/run/${{ github.run_id }}|report> for more details."
58-
SLACK_FOOTER: false
59-
MSG_MINIMAL: true
60-
- name: Failing workflow on release branch
61-
if: github.event_name == 'push' && steps.dependency-check.outcome == 'failure'
62-
shell: bash
63-
run: exit 1
13+
uses: skymatic/workflows/.github/workflows/run-dependency-check.yml@v1
14+
with:
15+
runner-os: 'ubuntu-latest'
16+
java-distribution: 'temurin'
17+
java-version: 21
18+
secrets:
19+
nvd-api-key: ${{ secrets.NVD_API_KEY }}
20+
slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}

‎.github/workflows/publish-central.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,6 @@ jobs:
2121
server-id: ossrh # Value of the distributionManagement/repository/id field of the pom.xml
2222
server-username: MAVEN_USERNAME # env variable for username in deploy
2323
server-password: MAVEN_PASSWORD # env variable for token in deploy
24-
gpg-private-key: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
25-
gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase
2624
- name: Enforce project version ${{ github.event.inputs.tag }}
2725
run: mvn versions:set -B -DnewVersion=${{ github.event.inputs.tag }}
2826
- name: Deploy
@@ -35,4 +33,6 @@ jobs:
3533
--add-opens=java.desktop/java.awt.font=ALL-UNNAMED
3634
MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
3735
MAVEN_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
38-
MAVEN_GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
36+
MAVEN_GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
37+
MAVEN_GPG_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
38+
MAVEN_GPG_KEY_FINGERPRINT: "58117AFA1F85B3EEC154677D615D449FE6E6A235"

‎.github/workflows/publish-github.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,15 @@ jobs:
1313
java-version: 21
1414
distribution: 'temurin'
1515
cache: 'maven'
16-
gpg-private-key: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
17-
gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase
1816
- name: Enforce project version ${{ github.event.release.tag_name }}
1917
run: mvn versions:set -B -DnewVersion=${{ github.event.release.tag_name }}
2018
- name: Deploy
2119
run: mvn deploy -B -DskipTests -Psign,deploy-github --no-transfer-progress
2220
env:
2321
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2422
MAVEN_GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
23+
MAVEN_GPG_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
24+
MAVEN_GPG_KEY_FINGERPRINT: "58117AFA1F85B3EEC154677D615D449FE6E6A235"
2525
- name: Slack Notification
2626
uses: rtCamp/action-slack-notify@v2
2727
env:

‎pom.xml

Lines changed: 26 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<modelVersion>4.0.0</modelVersion>
44
<groupId>org.cryptomator</groupId>
55
<artifactId>webdav-nio-adapter</artifactId>
6-
<version>2.0.6</version>
6+
<version>2.0.7</version>
77
<name>WebDAV-NIO Adapter</name>
88
<description>Embedded Jetty serving a WebDAV servlet to access resources at a given NIO path.</description>
99
<url>https://github.com/cryptomator/webdav-nio-adapter</url>
@@ -19,19 +19,25 @@
1919
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
2020

2121
<!-- dependencies -->
22-
<integrations-api.version>1.3.0</integrations-api.version>
23-
<webdavservlet.version>1.2.5</webdavservlet.version>
24-
<jetty.version>10.0.20</jetty.version>
25-
<slf4j.version>2.0.11</slf4j.version>
22+
<integrations-api.version>1.4.0</integrations-api.version>
23+
<webdavservlet.version>1.2.6</webdavservlet.version>
24+
<jetty.version>10.0.24</jetty.version>
25+
<slf4j.version>2.0.16</slf4j.version>
2626

2727
<!-- test dependencies -->
28-
<junit.jupiter.version>5.10.1</junit.jupiter.version>
28+
<junit.jupiter.version>5.11.0</junit.jupiter.version>
2929

3030
<!-- mvn plugin dependencies -->
31-
<dependency-check.version>9.0.9</dependency-check.version>
32-
<jacoco.version>0.8.11</jacoco.version>
33-
<nexus-staging.version>1.6.13</nexus-staging.version>
34-
<maven.deploy.version>3.1.1</maven.deploy.version>
31+
<mvn-compiler.version>3.13.0</mvn-compiler.version>
32+
<mvn-surefire.version>3.5.1</mvn-surefire.version>
33+
<mvn-jar.version>3.4.2</mvn-jar.version>
34+
<mvn-source.version>3.3.1</mvn-source.version>
35+
<mvn-javadoc.version>3.10.1</mvn-javadoc.version>
36+
<mvn-deploy.version>3.1.3</mvn-deploy.version>
37+
<mvn-gpg.version>3.2.7</mvn-gpg.version>
38+
<dependency-check.version>11.1.0</dependency-check.version>
39+
<jacoco.version>0.8.12</jacoco.version>
40+
<nexus-staging.version>1.7.0</nexus-staging.version>
3541
</properties>
3642

3743
<licenses>
@@ -82,7 +88,7 @@
8288
<dependency>
8389
<groupId>org.jetbrains</groupId>
8490
<artifactId>annotations</artifactId>
85-
<version>24.1.0</version>
91+
<version>26.0.1</version>
8692
<scope>provided</scope>
8793
</dependency>
8894

@@ -113,7 +119,7 @@
113119
<plugin>
114120
<groupId>org.apache.maven.plugins</groupId>
115121
<artifactId>maven-compiler-plugin</artifactId>
116-
<version>3.12.1</version>
122+
<version>${mvn-compiler.version}</version>
117123
<configuration>
118124
<release>${project.build.jdk}</release>
119125
<showWarnings>true</showWarnings>
@@ -122,16 +128,16 @@
122128
<plugin>
123129
<groupId>org.apache.maven.plugins</groupId>
124130
<artifactId>maven-surefire-plugin</artifactId>
125-
<version>3.2.5</version>
131+
<version>${mvn-surefire.version}</version>
126132
</plugin>
127133
<plugin>
128134
<groupId>org.apache.maven.plugins</groupId>
129135
<artifactId>maven-jar-plugin</artifactId>
130-
<version>3.3.0</version>
136+
<version>${mvn-jar.version}</version>
131137
</plugin>
132138
<plugin>
133139
<artifactId>maven-source-plugin</artifactId>
134-
<version>3.3.0</version>
140+
<version>${mvn-source.version}</version>
135141
<executions>
136142
<execution>
137143
<id>attach-sources</id>
@@ -143,7 +149,7 @@
143149
</plugin>
144150
<plugin>
145151
<artifactId>maven-javadoc-plugin</artifactId>
146-
<version>3.6.3</version>
152+
<version>${mvn-javadoc.version}</version>
147153
<executions>
148154
<execution>
149155
<id>attach-javadocs</id>
@@ -171,7 +177,7 @@
171177
<skipTestScope>true</skipTestScope>
172178
<detail>true</detail>
173179
<suppressionFile>suppression.xml</suppressionFile>
174-
<nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>
180+
<nvdApiKeyEnvironmentVariable>NVD_API_KEY</nvdApiKeyEnvironmentVariable>
175181
</configuration>
176182
<executions>
177183
<execution>
@@ -219,7 +225,7 @@
219225
<plugins>
220226
<plugin>
221227
<artifactId>maven-gpg-plugin</artifactId>
222-
<version>3.1.0</version>
228+
<version>${mvn-gpg.version}</version>
223229
<executions>
224230
<execution>
225231
<id>sign-artifacts</id>
@@ -228,10 +234,7 @@
228234
<goal>sign</goal>
229235
</goals>
230236
<configuration>
231-
<gpgArguments>
232-
<arg>--pinentry-mode</arg>
233-
<arg>loopback</arg>
234-
</gpgArguments>
237+
<signer>bc</signer>
235238
</configuration>
236239
</execution>
237240
</executions>
@@ -280,7 +283,7 @@
280283
<plugin>
281284
<groupId>org.apache.maven.plugins</groupId>
282285
<artifactId>maven-deploy-plugin</artifactId>
283-
<version>${maven.deploy.version}</version>
286+
<version>${mvn-deploy.version}</version>
284287
</plugin>
285288
</plugins>
286289
</build>

‎suppression.xml

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,5 +29,13 @@
2929
<vulnerabilityName>CVE-2020-8908</vulnerabilityName>
3030
<cve>CVE-2020-8908</cve>
3131
</suppress>
32+
<suppress>
33+
<notes><![CDATA[
34+
The project does not use the HttpURI class at all, so no decoded user data is passed to it.
35+
See also https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh.
36+
]]></notes>
37+
<packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty/jetty-http@.*$</packageUrl>
38+
<vulnerabilityName>CVE-2024-6763</vulnerabilityName>
39+
</suppress>
3240

33-
</suppressions>
41+
</suppressions>

0 commit comments

Comments
 (0)