Bump maven-resources-plugin from 2.7 to 3.3.1 (#223) @dependabot
Plexus Archiver 4.6.3
🚀 New features and improvements
Fix path traversal vulnerability (#261) @plamentotev Thanks to @Fewword for reporting the vulnerability and suggesting a fix. The vulnerability affects only directories whose name begins with the same prefix as the destination directory. For example malicious archive may extract file in /opt/directory instead of /opt/dir.
[Issue #126][issue-126] - Fixed broken javadoc for
Archiver#configureReproducible.
[Issue #127][issue-127] - Fixed reproducible zip entry time depends
on local daylight saving time.
Plexus Archiver 4.2.0
Improvements
[Pull Request #121][pr-121] - Add API to configure reproducible archives -
Archiver#configureReproducible.
Add option to force the user and group for all archive entries.
Add option to force the last modified date for all archive entries.
[Issue #114][issue-114] - Add option to provide Comparator for Archiver.
The archive entries will be added in the order specified by the
provided comparator.
[Pull Request #117][pr-117] - Add option to limit the output size for
AbstractZipUnArchiver as a way of protection against ZIP bombs.
Thanks to Sergey Patrikeev and Semyon Atamas.
Various code improvements. Thanks to Semyon Atamas and
Sergey Patrikeev.
Bugs
[Issue #94][issue-94] - Fixed setting archiver destination to
the working directory causes NullPointerException.
Tasks
[Issue #119][issue-119] - Updated dependencies: commons-compress to 1.18,
plexus-io to 3.2.0 and plexus-utils to 3.3.0.
Plexus Archiver 4.1.0
Improvements
[Issue #110][issue-110] - Add option to omit "Created-By" manifest entry.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dependabot[bot]
commented
1 year ago
Bumps plexus-archiver from 3.6.0 to 4.7.0.
Release notes
Sourced from plexus-archiver's releases.
... (truncated)
Changelog
Sourced from plexus-archiver's changelog.
... (truncated)
Commits
2de3b16[maven-release-plugin] prepare release plexus-archiver-4.7.0e3b02dbadd umask support and use 022 in RB mode53f6d2aUse NIO Files for creating temporary files49de4c3Use JUnit TempDir to manage temporary files in testsc84755cDeprecate the JAR Index feature (JDK-8302819)1d7ff06Add Archiver aliases for tar.*54b75e9Bump junitVersion from 5.9.2 to 5.9.3ca00cc3Bump zstd-jni from 1.5.5-1 to 1.5.5-2b517c63Override uId and gId for Tar in tested5cc7aBump zstd-jni from 1.5.4-2 to 1.5.5-1Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)