V2.2.3 is fix release for several CVEs related to netty-codec-http. Special thanks to @​JanWesterkamp-iJUG for bringing the topic and the support provided.
Is important to note, that netty-codec-http is used ONLY for preview goals auto-refresh and http, and have no impact in normal conversion using process-asciidoc.
This release also includes some fixes ported from main branch listed below.
As always, thanks to all contributors! Specially those taking time providing report issues and feedback đź‘Ť
Fixes
#610 Fixed default value for eruby which caused a failure when using erb templates. Thanks (@​mokdeve) for reporting.
Documentation
#592 Fix absolute path in usage example and AsciiDoc references in docs (@​MarkusTiede)
Build / Infrastructure
#620 Upgrade Asciidoctorj to v2.5.7 and jRuby to v9.3.8.0
#625 Bump Doxia to v1.12.0 and test with maven-site-plugin v3.12.1
#620 Bump netty-codec-http to v4.1.90.Final, fixes several CVEs
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Bumps asciidoctor-maven-plugin from 2.2.2 to 2.2.3.
Release notes
Sourced from asciidoctor-maven-plugin's releases.
Changelog
Sourced from asciidoctor-maven-plugin's changelog.
Commits
31078f6[maven-release-plugin] prepare release asciidoctor-maven-plugin-2.2.37154d78Update properties in docs for v2.2.3 release (#626)4911ef3Bump Doxia to v1.12.0 and maven-site-plugin in IT to 3.12.1 (#625)1b58db1Bump GH actions checkout and setup-java to v3 (#624)31acf36Bump build plugin dependencies (#623)fd84281Delete TravisCI configuration, now unused (#622)74c1013Enable CI pipelines for 2.2.x branch PRs (#621)0c69cebBump netty-codec-http to latest v4.1.90.Final49e8301Bump AsciidoctorJ to v2.5.7b1042d2Fixes conversion failure when using erb templateDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)