Merge branch 'develop'

wcm-io-devops · Sep 18, 2023 · 11917e2 · 11917e2
2 parents 6a96af0 + 49e88f6
commit 11917e2
Show file tree

Hide file tree

Showing 12 changed files with 184 additions and 133 deletions.
diff --git a/.github/workflows/maven-build.yml b/.github/workflows/maven-build.yml
@@ -39,6 +39,6 @@ jobs:
           java-version: ${{ matrix.java }}
           maven-executable: ./mvnw
           sonar-run-on-os: ubuntu-latest
-          sonar-run-on-java-version: 11
+          sonar-run-on-java-version: 17
           sonar-token: ${{ secrets.SONAR_TOKEN }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/maven-deploy.yml b/.github/workflows/maven-deploy.yml
@@ -2,6 +2,8 @@
 
 name: Deploy
 
+concurrency: ${{ github.workflow }}
+
 on:
   push:
     branches:

diff --git a/.mvn/wrapper/maven-wrapper.jar b/.mvn/wrapper/maven-wrapper.jar
diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties
@@ -5,14 +5,14 @@
 # to you under the Apache License, Version 2.0 (the
 # "License"); you may not use this file except in compliance
 # with the License.  You may obtain a copy of the License at
-# 
+#
 #   http://www.apache.org/licenses/LICENSE-2.0
-# 
+#
 # Unless required by applicable law or agreed to in writing,
 # software distributed under the License is distributed on an
 # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.8.4/apache-maven-3.8.4-bin.zip
-wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.1.0/maven-wrapper-3.1.0.jar
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.4/apache-maven-3.9.4-bin.zip
+wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar
diff --git a/changes.xml b/changes.xml
@@ -23,6 +23,12 @@
     xsi:schemaLocation="http://maven.apache.org/changes/1.0.0 http://maven.apache.org/plugins/maven-changes-plugin/xsd/changes-1.0.0.xsd">
   <body>
 
+    <release version="1.4.4" date="2023-09-18">
+      <action type="fix" dev="sseifert"><![CDATA[
+        Add our own version of <code>org.yaml.snakeyaml.inspector.TrustedTagInspector</code> as it was removed from the SnakeYAML codebase with version 2.1.
+      ]]></action>
+    </release>
+
     <release version="1.4.2" date="2023-03-27">
       <action type="update" dev="sseifert">
         Switch to Java 11 as minimum version.

diff --git a/conga-ansible-plugin/pom.xml b/conga-ansible-plugin/pom.xml
@@ -25,13 +25,13 @@
   <parent>
     <groupId>io.wcm.devops.conga.plugins</groupId>
     <artifactId>io.wcm.devops.conga.plugins.ansible.parent</artifactId>
-    <version>1.4.2</version>
+    <version>1.4.4</version>
     <relativePath>../parent/pom.xml</relativePath>
   </parent>
 
   <groupId>io.wcm.devops.conga.plugins</groupId>
   <artifactId>io.wcm.devops.conga.plugins.ansible</artifactId>
-  <version>1.4.2</version>
+  <version>1.4.4</version>
   <packaging>jar</packaging>
 
   <name>CONGA Ansible Plugin</name>
@@ -57,7 +57,7 @@
     <dependency>
       <groupId>io.wcm.devops.conga</groupId>
       <artifactId>io.wcm.devops.conga.generator</artifactId>
-      <version>1.15.0</version>
+      <version>1.16.2</version>
       <scope>compile</scope>
     </dependency>
 
@@ -88,7 +88,7 @@
     <dependency>
       <groupId>com.jayway.jsonpath</groupId>
       <artifactId>json-path</artifactId>
-      <version>2.7.0</version>
+      <version>2.8.0</version>
       <scope>compile</scope>
     </dependency>
 

diff --git a/conga-ansible-plugin/src/it/example/pom.xml b/conga-ansible-plugin/src/it/example/pom.xml
@@ -65,7 +65,7 @@
       <plugin>
         <groupId>io.wcm.devops.conga</groupId>
         <artifactId>conga-maven-plugin</artifactId>
-        <version>1.15.0</version>
+        <version>1.16.2</version>
         <extensions>true</extensions>
         <configuration>
           <valueProvider>

diff --git a/conga-ansible-plugin/src/main/java/org/yaml/snakeyaml/inspector/TrustedTagInspector.java b/conga-ansible-plugin/src/main/java/org/yaml/snakeyaml/inspector/TrustedTagInspector.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2008, SnakeYAML
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.yaml.snakeyaml.inspector;
+
+import org.yaml.snakeyaml.nodes.Tag;
+
+/**
+ * TagInspector which allows to create any custom instance. Should not be used when the data comes
+ * from untrusted source to prevent possible remote code invocation.
+ */
+public final class TrustedTagInspector implements TagInspector {
+
+  /**
+   * Allow any
+   *
+   * @param tag - the global tag to allow
+   * @return always return true
+   */
+  @Override
+  public boolean isGlobalTagAllowed(Tag tag) {
+    return true;
+  }
+}
-Original file line number
+Diff line change
@@ Expand Up / @@ -2,6 +2,8 @@ @@
     name: Deploy
+    concurrency: ${{ github.workflow }}
     on:
       push:
         branches:
@@ Expand Down @@