Bump script-security from 1.28 to 1189.vb_a_b_7c8fd5fde

[dependabot[bot]]

Bumps script-security from 1.28 to 1189.vb_a_b_7c8fd5fde.

Release notes

Sourced from script-security's releases.

1189.vb_a_b_7c8fd5fde

🐛 Bug fixes

• JENKINS-69899 - Do not visit EmptyExpression when transforming fields declared using @Field (#457) @​dwnusbaum

1184.v85d16b_d851b_3

🔒 Security

• Fix SECURITY-2824
  • Pipeline: Groovy Plugin must be updated to 2803.v1a_f77ffcc773 simultaneously to avoid API incompatibility issues

1183.v774b_0b_0a_a_451

🐛 Bug fixes

• Adapt generic-whitelist to handle addition of String#stripIndent method in Java 15 (#453) @​steven-aerts

📦 Dependency updates

• Bump plugin from 4.40 to 4.47 (#451) @​dependabot
• Bump git-changelist-maven-extension from 1.3 to 1.4 (#439) @​dependabot
• chore: use jenkins infra maven cd reusable workflow (#427) @​jetersen

1175.v4b_d517d6db_f0

🐛 Bug fixes

• JENKINS-63766 - Work around JDK-8231454 (#420) @​basil

1172.v35f6a_0b_8207e

🔒 Security

• Fix SECURITY-2116
• Hardening: Do not automatically approve unmodified, unsandboxed scripts when administrators submit job configuration forms. For better compatibility, Pipeline: Groovy should be updated to version 2692.v76b_089ccd026, which requires Pipeline: Job to be simultaneously updated to version 1181.va_25d15548158.

1158.v7c1b_73a_69a_08

🚀 New features and improvements

• Whitelist net.sf.json.JSON isEmpty() (#402) @​offa
• JENKINS-62708 - Add JCasC support for approved script hashes (#329) @​MarkRx

🐛 Bug fixes

• Optimize the display of ScriptApproval page (#408) @​Mr-LiuDC

👻 Maintenance

• Switch to Temurin distribution (#400) @​offa

... (truncated)

Changelog

Sourced from script-security's changelog.

Changelog

From of version 1.77 see GitHub Releases

Version 1.76

Release date: 2021-02-01

• Improvement: Add the following to the default list of approved signatures ([PR #308](jenkinsci/script-security-plugin#308), [PR #310](jenkinsci/script-security-plugin#310)):
  • All static methods and fields in java.lang.Math
  • All methods related to java.lang.StringBuilder and java.lang.StringBuffer
  • All methods related to java.lang.CharSequence and java.lang.String apart from String.intern()
  • All static methods and fields in java.nio.charset.Charset
  • All methods related to java.util.Base64, java.util.Base64.Decoder, and java.util.Base64.Encoder
• Internal: Update dependencies and parent POM ([PR #311](jenkinsci/script-security-plugin#311), [PR #313](jenkinsci/script-security-plugin#313), [PR #314](jenkinsci/script-security-plugin#314), [PR #316](jenkinsci/script-security-plugin#316), [PR #317](jenkinsci/script-security-plugin#317), [PR #321](jenkinsci/script-security-plugin#321), [PR #323](jenkinsci/script-security-plugin#323), [PR #324](jenkinsci/script-security-plugin#324), [PR #326](jenkinsci/script-security-plugin#326))

Version 1.75

Release date: 2020-09-23

• Fix sandbox bypass vulnerability
• Improvement: Add the following to the default list of approved signatures:
  • DefaultGroovyMethods.and(Boolean, Boolean)
  • DefaultGroovyMethods.toBoolean(Boolean)
  • DefaultGroovyMethods.toDouble(String)
  • StringGroovyMethods.toBoolean(String)
  • StringGroovyMethods.toDouble(CharSequence)
  • StringGroovyMethods.toDouble(String)
  • StringGroovyMethods.toInteger(CharSequence)
  • StringGroovyMethods.toInteger(String)

Version 1.74

Release date: 2020-06-30

• Improvement: On the Manage Jenkins page in Jenkins 2.226 and newer, display the link to the In-process Script Approval page under "Security" instead of "Uncategorized". (PR 302)
• Improvement: Add the following to the list of approved Jenkins-related signatures:
  • BallColor.getHtmlBaseColor
  • Result.color
  • Result.fromString(String)

Version 1.73

Release date: 2020-06-03

• Fix security vulnerability. (SECURITY-1866)

Version 1.72

Release date: 2020-05-11

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/jenkinsci/service-now-plugin/network/alerts).

[dependabot[bot]]

Superseded by #44.