- Removed unused suppressions
- Added suppressions for Clojure and Hadoop shaded libraries
Signed-off-by: Pierre Villard <pierre.villard.fr@gmail.com>
This closes#8570.
- Upgraded AWS SDK from 1.12.573 to 1.12.637
- Added dependency check suppression to correct identification of newer ion-java library
Signed-off-by: Pierre Villard <pierre.villard.fr@gmail.com>
This closes#8257.
- Upgraded Azure SDK BOM from 1.2.17 to 1.2.18
- Upgraded Reactor Netty HTTP from 1.0.34 to 1.0.39 for Azure Identity
- Upgraded MSAL4J from 1.13.10 to 1.14.0
- Upgraded Box Java SDK from 4.4.0 to 4.6.1
- Relocated Apache Ant managed versions to bundle parent modules
- Added okio-fakefilesystem to managed dependencies
- Suppressed vulnerability for Picocli misidentified as LINE library
- Added managed dependencies to nifi-code-coverage to avoid false positives due to different parent modules
Signed-off-by: Pierre Villard <pierre.villard.fr@gmail.com>
This closes#8054.
- Removed support for Year field in Cron Expressions
- Changed numeric Day of Week field from starting with 1 to starting with 0
- Removed Quartz and C3P0 from Notice files
This closes#7951
Signed-off-by: Mike Moser <mosermw@apache.org>
- Added dependency-check GitHub workflow
- Upgraded Janino Commons Compiler from 3.1.9 to 3.1.10
- Upgraded Azure SDK BOM from 1.2.16 to 1.2.17
- Upgraded GCP SDK BOM from 26.17.0 to 26.25.0
- Upgraded AWS SDK from 1.12.550 to 1.12.573
- Upgraded Hazelcast from 5.3.2 to 5.3.5
- Upgraded Jersey from 2.40 to 2.41
- Upgraded Camel Salesforce from 3.14.5 to 3.14.9
- Unified ZooKeeper versioning on 3.9.1
- Applied Groovy 2.4.21 to Hive 3 and Iceberg components
- Applied gRPC version 1.59.0 to Asana components
- Applied Jettison 1.5.4 to Atlas and Hive 3 components
- Managed JUnit 4 version to 4.13.2 for MockWebServer
- Excluded HBase libraries from Hive 3 following Iceberg approach
- Excluded Htrace from HBase components
- Upgraded OWASP Dependency Check from 8.4.0 to 8.4.2
- Removed non-applicable dependency check suppressions
- Added dependency check suppressions for non-applicable findings
Signed-off-by: Pierre Villard <pierre.villard.fr@gmail.com>
This closes#7948.
- Updated OWASP suppressions to exclude several JSON and Kafka false positives
- Excluded JUnit dependency from Hive 3 JDBC
This closes#7411
Signed-off-by: Mike Thomsen <mthomsen@apache.org>
- Updated Elasticsearch client false positive vulnerability suppressions for new Ranger transitive dependencies
Signed-off-by: Pierre Villard <pierre.villard.fr@gmail.com>
This closes#7109.
- Upgraded Ranger Hadoop dependencies from 3.3.3 to 3.3.5
- Aligned Iceberg Hadoop version with project Hadoop version
- Updated Atlas dependencies to align hadoop-hdfs-client version with hadoop-common
- Updated Ranger hadoop-auth version to align with other Hadoop dependencies
- Updated Spark Livy bundle to align with project Hadoop version
- Removed unnecessary dependencies from Hive Test Utilities
- Updated HBase 2 Woodstox Core from 5.3.0 to 5.4.0
- Suppressed false positive vulnerabilities for HBase client libraries
Signed-off-by: Pierre Villard <pierre.villard.fr@gmail.com>
This closes#7097.
- Updated suppression configuration
- Upgraded Solr from 8.6.3 to 8.11.1 for Ranger
- Excluded Apache Ivy from Hive and Janus Graph dependencies
- Excluded Groovy from Hive tests
Signed-off-by: Joe Witt <joewitt@apache.org>
- Removed false positive suppressions no longer necessary in current version
Signed-off-by: Pierre Villard <pierre.villard.fr@gmail.com>
This closes#6839.
- Removed non-applicable suppressions
- Added suppressions for Elasticsearch client libraries and other false positives
Signed-off-by: Pierre Villard <pierre.villard.fr@gmail.com>
This closes#6751.
- Replaced individual AWS SDK versions with root managed dependency version
- Set AWS SDK 1 version to 1.12.299
- Set AWS SDK 2 version to 2.17.270
- Suppressed false positive dependency vulnerability for aws-sdk-swf-libraries
Signed-off-by: Pierre Villard <pierre.villard.fr@gmail.com>
This closes#6405.
- Suppressed Apache Calcite vulnerabilities not applicable to Calcite Avatica subproject
- Suppressed HBase server vulnerabilities not applicable to client libraries
- Suppressed several mismatched product vulnerabilities
This closes#6290
Signed-off-by: Paul Grey <greyp@apache.org>
- Changed from com.github.shyiko to com.zendesk dependency group for current library version
Signed-off-by: Pierre Villard <pierre.villard.fr@gmail.com>
This closes#6302.
- Changed Maven profile from owasp to dependency-check
- Configured dependency check plugin to run in validate phase
Signed-off-by: Pierre Villard <pierre.villard.fr@gmail.com>
This closes#6100.
- Removed unnecessary suppression configurations due to detection improvements
Signed-off-by: Pierre Villard <pierre.villard.fr@gmail.com>
This closes#6004.
- Adjusted OWASP dependency-check suppressions to match Registry and MiNiFi packages
Signed-off-by: Pierre Villard <pierre.villard.fr@gmail.com>
This closes#5431.
- Suppressed false positive for ftpserver
- Suppressed false positive for com.metamx:http-client
- Suppressed false positive for Jetty servlet-api
- Suppressed false positive for Testcontainers MySQL
- Suppressed false positive for vorbis-java-tika
This closes#5384
Signed-off-by: Joe Gresock <jgresock@gmail.com>
exceptionfactory