search

Snootch17 / jdbc

Apache License 2.0
0 stars 0 forks source link

Update dependency org.codehaus.plexus:plexus-archiver to v3 - autoclosed #19

Closed mend-for-github-com[bot] closed 2 years ago

mend-for-github-com[bot] commented 2 years ago

This PR contains the following updates:

Package Type Update Change
org.codehaus.plexus:plexus-archiver (source) provided major 2.4.4 -> 3.6.0

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity CVSS Score CVE
Medium Medium 5.5 CVE-2018-1002200

Release Notes

codehaus-plexus/plexus-archiver ### [`v3.6.0`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-360) Plexus Archiver 3.6.0 requires Java 7. ##### New Features - \[Pull Request [#​84](https://togithub.com/codehaus-plexus/plexus-archiver/issues/84)]\[pr-84], \[Issue [#​57](https://togithub.com/codehaus-plexus/plexus-archiver/issues/57)]\[issue-68] - Added Archiver implementation (`JarToolModularJarArchiver`) that creates modular JAR files using the JDK jar tool. The implementation uses `java.util.spi.ToolProvider` introduced in Java 9, so if it is run on Java 7 or 8 the resulting archive will be identical to a one created by `JarArchiver` - the module descriptor is not going to be validated and no additional information (such as version, main class and packages) is going to be added. - \[Issue [#​67](https://togithub.com/codehaus-plexus/plexus-archiver/issues/67)]\[issue-67] - Added ability to set the module version and main class of a modular JAR file - \[Pull Request [#​83](https://togithub.com/codehaus-plexus/plexus-archiver/issues/83)]\[pr-83] - Added new protected method (`postCreateArchive`) to `AbstractArchiver` that is called after the archive is created successfully ##### Improvements - \[Pull Request [#​87](https://togithub.com/codehaus-plexus/plexus-archiver/issues/87)]\[pr-87] - of Levan Giguashvili (odinn1984) Snyk eng team to fix a possible security issue. (See https://gist.github.com/grnd/eafd7dab7c4cc6197d817a07fa46b2df) ##### Bugs - \[Pull Request [#​73](https://togithub.com/codehaus-plexus/plexus-archiver/issues/73)]\[pr-73] - Symbolic links not properly encoded in ZIP archives - \[Issue [#​57](https://togithub.com/codehaus-plexus/plexus-archiver/issues/57)]\[issue-57] - `ZipArchiver` creates archives with inconsistent central directory entries - \[Issue [#​79](https://togithub.com/codehaus-plexus/plexus-archiver/issues/79)]\[issue-79] - `JarArchiver` and `PlexusIoZipFileResourceCollection` leak file descriptors ##### Tasks - \[Pull Request [#​77](https://togithub.com/codehaus-plexus/plexus-archiver/issues/77)]\[pr-77] - Fixed the way unit tests modify the timestamp of a file - \[Issue [#​71](https://togithub.com/codehaus-plexus/plexus-archiver/issues/71)]\[issue-71], \[Pull Request [#​72](https://togithub.com/codehaus-plexus/plexus-archiver/issues/72)]\[pr-72], \[Issue [#​76](https://togithub.com/codehaus-plexus/plexus-archiver/issues/76)]\[issue-76], \[Issue [#​78](https://togithub.com/codehaus-plexus/plexus-archiver/issues/78)]\[issue-78], \[Issue [#​85](https://togithub.com/codehaus-plexus/plexus-archiver/issues/85)]\[issue-85], \[Issue [#​86](https://togithub.com/codehaus-plexus/plexus-archiver/issues/86)]\[issue-86] - Updated dependencies: `commons-compress` to 1.16.1, `plexus-utils` to 3.1.0, `org.tukaani:xz` to 1.8 and `plexus-io` to 3.0.1 ### [`v3.5`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-35) Plexus Archiver 3.5 requires Java 7. Now Plexus Archiver uses pure Java implementations to deal with file attributes so the `useJvmChmod` is no longer used and it is just ignored. `Archiver#setUseJvmChmod`, `Archiver#isUseJvmChmod()`, `UnArchiver#setUseJvmChmod`, `UnArchiver#isUseJvmChmod()`, `ArchiveEntryUtils#chmod( File, int, Logger, boolean )` and `ArchiveEntryUtils#chmod( File, int, Logger )` are deprecated and are subject to removal in a future version. ##### Improvements - \[Pull Request [#​51](https://togithub.com/codehaus-plexus/plexus-archiver/issues/51)]\[pr-51] - More specific exception for cases when there are no files to archive. Now `EmptyArchiveException` is thrown when you try to create empty archive. Previously the more generic `ArchiverException` was thrown. ##### Bugs - \[Issue [#​47](https://togithub.com/codehaus-plexus/plexus-archiver/issues/47)]\[issue-47] - Archiver follows symlinks on Windows - \[Issue [#​53](https://togithub.com/codehaus-plexus/plexus-archiver/issues/53)]\[issue-53] - `AbstractZipArchiver` no longer respects `recompressAddedZips` - \[Issue [#​58](https://togithub.com/codehaus-plexus/plexus-archiver/issues/58)]\[issue-58] - Creates corrupt JARs ##### Tasks - \[Pull Request [#​56](https://togithub.com/codehaus-plexus/plexus-archiver/issues/56)]\[pr-56] - Upgrade the minimum required Java version to 7 and Plexus IO to 3.0.0 - \[Issue [#​60](https://togithub.com/codehaus-plexus/plexus-archiver/issues/60)]\[issue-60] - Upgrade dependencies. `plexus-container-default` to `1.0-alpha-30`, `commons-compress` to 1.14, `org.tukaani.xz` to 1.6 and `com.google.code.findbugs.jsr305` to 3.0.2 ### [`v3.4.1`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-341) ##### Improvements - \[Pull Request [#​87](https://togithub.com/codehaus-plexus/plexus-archiver/issues/87)]\[pr-87] - of Levan Giguashvili (odinn1984) Snyk eng team to fix a possible security issue. (See https://gist.github.com/grnd/eafd7dab7c4cc6197d817a07fa46b2df) ### [`v3.4`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-341) ##### Improvements - \[Pull Request [#​87](https://togithub.com/codehaus-plexus/plexus-archiver/issues/87)]\[pr-87] - of Levan Giguashvili (odinn1984) Snyk eng team to fix a possible security issue. (See https://gist.github.com/grnd/eafd7dab7c4cc6197d817a07fa46b2df) ### [`v3.3`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-33) ##### Improvements - \[Issue [#​42](https://togithub.com/codehaus-plexus/plexus-archiver/issues/42)]\[issue-42] - No need to fallback to unicode path extra field policy `NOT_ENCODEABLE` - \[Issue [#​39](https://togithub.com/codehaus-plexus/plexus-archiver/issues/39)]\[issue-39] - Updated to stop falling back to the unicode path extra field policy `NOT_ENCODEABLE`. If a name is not encodeable in UTF-8, it also is not encodeable in the extra field. Updated to always add the Info-ZIP Unicode Path Extra Field when creating an archive using an encoding different from UTF-8 instead of only when a name is not encodeable. Additionally support that extra field when unarchiving. - \[Issue [#​38](https://togithub.com/codehaus-plexus/plexus-archiver/issues/38)]\[issue-38] - Downgrade `PrintWriter` to `Writer` in `Manifest` - \[Issue [#​36](https://togithub.com/codehaus-plexus/plexus-archiver/issues/36)]\[issue-36] - `Created-by` entry does not reflect who created the JAR - \[Issue [#​35](https://togithub.com/codehaus-plexus/plexus-archiver/issues/35)]\[issue-35] - Replace `defaultManifest.mf` with inline code - \[Issue [#​17](https://togithub.com/codehaus-plexus/plexus-archiver/issues/17)]\[issue-17] - Remove unnecessary conversion in `Manifest#Attribute#write` - \[Issue [#​16](https://togithub.com/codehaus-plexus/plexus-archiver/issues/16)]\[issue-16] - Manifest entry `Archiver-Version` is incomplete/wrong. Entry does not reflect the archiver version. Remove since it adds not information it pretends to add. - \[Issue [#​5](https://togithub.com/codehaus-plexus/plexus-archiver/issues/5)]\[issue-5] - Added proper bound on memory usage, patch by Björn Eickvonder - \[Pull Request [#​41](https://togithub.com/codehaus-plexus/plexus-archiver/issues/41)]\[pr-41] - Support the Info-ZIP Unicode Path Extra Field. ##### Bugs - \[Issue [#​43](https://togithub.com/codehaus-plexus/plexus-archiver/issues/43)]\[issue-43] - Updated to stop failing creating `Created-by` manifest entries, when the version of the archiver cannot be determined - \[Issue [#​37](https://togithub.com/codehaus-plexus/plexus-archiver/issues/37)]\[issue-37] - Deprecate `Manifest(Reader)` and update all related Implemenation does not properly map characters to map and makes assumptions about character encoding which might lead to failures. Deprecate and rely on Java Manifest reader to do the right thing. - \[Issue [#​20](https://togithub.com/codehaus-plexus/plexus-archiver/issues/20)]\[issue-20] - `Manifest#write` blindly casts bytes to chars - \[Issue [#​18](https://togithub.com/codehaus-plexus/plexus-archiver/issues/18)]\[issue-18] - `Manifest#Attribute#writeLine` does not properly calculate max line length ##### Tasks - \[Issue [#​40](https://togithub.com/codehaus-plexus/plexus-archiver/issues/40)]\[issue-40] - Updated to upgrade `plexus-utils` to latest patch release ### [`v3.2`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-32) ##### New Features - \[Pull Request [#​27](https://togithub.com/codehaus-plexus/plexus-archiver/issues/27)]\[pr-27] - Added xz compression support ##### Improvements - \[Issue [#​33](https://togithub.com/codehaus-plexus/plexus-archiver/issues/33)]\[issue-33] - Exceptions are suppressed incorrectly ##### Tasks - \[Issue [#​31](https://togithub.com/codehaus-plexus/plexus-archiver/issues/31)]\[issue-31] - Upgrade of `plexus-utils` to 3.0.23 - \[Issue [#​32](https://togithub.com/codehaus-plexus/plexus-archiver/issues/32)]\[issue-32] - Upgrade of `commons-io` to 2.5 ### [`v3.1.1`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-311) ##### Bugs - \[Issue [#​28](https://togithub.com/codehaus-plexus/plexus-archiver/issues/28)]\[issue-28] - which checks for null preventing NPE ##### Improvements - \[Pull Request [#​26](https://togithub.com/codehaus-plexus/plexus-archiver/issues/26)]\[pr-26] - Improvement from Plamen Totev ### [`v3.1`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-311) ##### Bugs - \[Issue [#​28](https://togithub.com/codehaus-plexus/plexus-archiver/issues/28)]\[issue-28] - which checks for null preventing NPE ##### Improvements - \[Pull Request [#​26](https://togithub.com/codehaus-plexus/plexus-archiver/issues/26)]\[pr-26] - Improvement from Plamen Totev ### [`v3.0.2`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-302) ##### Improvement - `DirectoryArhiver` now respects filemode for directories. Thanks for Olivier Fayau for patch. ### [`v3.0.1`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-301) ##### Improvements - \[Issue [#​3](https://togithub.com/codehaus-plexus/plexus-archiver/issues/3)]\[issue-3] - Switched to pure-java snappy ### [`v3.0`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-302) ##### Improvement - `DirectoryArhiver` now respects filemode for directories. Thanks for Olivier Fayau for patch. ### [`v2.10.3`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-2103) ##### Bugs - \[Issue [#​6](https://togithub.com/codehaus-plexus/plexus-archiver/issues/6)]\[issue-6] - "Too many open files" when building large jars ### [`v2.10.2`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-2102) ##### Bugs - https://issues.apache.org/jira/browse/MASSEMBLY-769 ### [`v2.10.1`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-2101) ##### Bugs - https://issues.apache.org/jira/browse/MASSEMBLY-768 ### [`v2.10`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-2103) ##### Bugs - \[Issue [#​6](https://togithub.com/codehaus-plexus/plexus-archiver/issues/6)]\[issue-6] - "Too many open files" when building large jars ### [`v2.9.1`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-291) - Wrap-up release with plexus-io-2.4.1 ### [`v2.9`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-291) - Wrap-up release with plexus-io-2.4.1 ### [`v2.8.4`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-284) ##### Bugs - PLXCOMP-273 - Normalize file separators for duplicate check ### [`v2.8.3`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-283) ##### Bugs - PLXCOMP-271 - Implicit created directories do not obey proper dirMode - PLXCOMP-272 - Overriding dirmode/filemode breaks symlinks ### [`v2.8.2`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-282) ##### Bugs - PLXCOMP-266 - In-place filtering of streams give incorrect content length for tar files ### [`v2.8.1`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-281) ##### Improvements - PLXCOMP-268 - Add diagnostic archivers ### [`v2.8`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-284) ##### Bugs - PLXCOMP-273 - Normalize file separators for duplicate check ### [`v2.7.1`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-271) ##### Improvements - PLXCOMP-257 - Inconsistent buffering ##### Bugs - PLXCOMP-256 - Several archivers leaks file handles ### [`v2.7`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-271) ##### Improvements - PLXCOMP-257 - Inconsistent buffering ##### Bugs - PLXCOMP-256 - Several archivers leaks file handles ### [`v2.6.4`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-264) ##### Bugs - PLXCOMP-45 - ignoreWebXML flag use is opposite of what the name implies - PLXCOMP-107 - Fail to unzip archive, which contains file with name 'How_can_I_annotate_a_part_in_the_AAM%3F.Help' - PLXCOMP-234 - Plexus archiver TarOptions setDirMode and setMode do not do anything unless TarArchiver.setOptions is called ### [`v2.6.3`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-263) ##### Bugs - PLXCOMP-233 - Plexus archiver can create tarfiles with empty uid and gid bytes - PLXCOMP-247 - Bug with windows AND java5 ### [`v2.6.2`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-262) ##### Bugs - PLXCOMP-238 - CRC Failure if compress=false and file size <= 4 bytes - PLXCOMP-245 - Archives created on windows get zero permissions, creates malformed permissions on linux ### [`v2.6.1`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-261) ##### Bugs - PLXCOMP-243 - Restore JDK1.5 compatibility ### [`v2.6`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-264) ##### Bugs - PLXCOMP-45 - ignoreWebXML flag use is opposite of what the name implies - PLXCOMP-107 - Fail to unzip archive, which contains file with name 'How_can_I_annotate_a_part_in_the_AAM%3F.Help' - PLXCOMP-234 - Plexus archiver TarOptions setDirMode and setMode do not do anything unless TarArchiver.setOptions is called ### [`v2.5`](https://togithub.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md#Plexus-Archiver-25) ##### Improvements - PLXCOMP-153 - TarUnArchiver does not support includes/excludes - PLXCOMP-240 - Convert everything to commons-compress ##### Bugs - PLXCOMP-13 - Plexus Archiver fails on certain Jars - PLXCOMP-205 - Tar unarchiver does not respect includes/excludes flags - PLXCOMP-216 - Unarchiver extracts files into wrong directory - PLXCOMP-232 - Failures to unpack .tar.gz files - PLXCOMP-236 - ZipUnArchiver fails to extract large (>4GB) ZIP files