diff --git a/dependencies.md b/dependencies.md index 0a8fab7..1d43008 100644 --- a/dependencies.md +++ b/dependencies.md @@ -6,105 +6,98 @@ | Dependency | License | | --------------------------------- | --------------------------------------------- | | [Apache Parquet Hadoop][0] | [The Apache Software License, Version 2.0][1] | -| [aircompressor][2] | [Apache License 2.0][3] | -| [snappy-java][4] | [Apache-2.0][3] | -| Apache Hadoop Client Aggregator | [Apache-2.0][5] | -| [Apache Avro][6] | [Apache-2.0][5] | -| [Apache Commons Compress][7] | [Apache-2.0][5] | -| [Apache Commons Configuration][8] | [Apache-2.0][5] | -| [dnsjava][9] | [BSD-3-Clause][10] | -| [Scala Library][11] | [Apache-2.0][12] | -| [error-reporting-java][13] | [MIT License][14] | +| Apache Hadoop Client Aggregator | [Apache-2.0][2] | +| [Apache Avro][3] | [Apache-2.0][2] | +| [Apache Commons Configuration][4] | [Apache-2.0][2] | +| [dnsjava][5] | [BSD-3-Clause][6] | +| [Scala Library][7] | [Apache-2.0][8] | +| [error-reporting-java][9] | [MIT License][10] | ## Test Dependencies | Dependency | License | | ------------------------------------------ | ----------------------------------------- | -| [JUnit Jupiter (Aggregator)][15] | [Eclipse Public License v2.0][16] | -| [mockito-core][17] | [MIT][18] | -| [mockito-junit-jupiter][17] | [MIT][18] | -| [Hamcrest][19] | [BSD License 3][20] | -| [scalatest][21] | [the Apache License, ASL Version 2.0][22] | -| [EqualsVerifier \| release normal jar][23] | [Apache License, Version 2.0][5] | +| [JUnit Jupiter (Aggregator)][11] | [Eclipse Public License v2.0][12] | +| [mockito-core][13] | [MIT][14] | +| [mockito-junit-jupiter][13] | [MIT][14] | +| [Hamcrest][15] | [BSD-3-Clause][16] | +| [scalatest][17] | [the Apache License, ASL Version 2.0][18] | +| [EqualsVerifier \| release normal jar][19] | [Apache License, Version 2.0][2] | ## Plugin Dependencies | Dependency | License | | ------------------------------------------------------- | ----------------------------------------- | -| [SonarQube Scanner for Maven][24] | [GNU LGPL 3][25] | -| [Apache Maven Toolchains Plugin][26] | [Apache-2.0][5] | -| [Apache Maven Compiler Plugin][27] | [Apache-2.0][5] | -| [Apache Maven Enforcer Plugin][28] | [Apache-2.0][5] | -| [Maven Flatten Plugin][29] | [Apache Software Licenese][5] | -| [org.sonatype.ossindex.maven:ossindex-maven-plugin][30] | [ASL2][1] | -| [Maven Surefire Plugin][31] | [Apache-2.0][5] | -| [Versions Maven Plugin][32] | [Apache License, Version 2.0][5] | -| [scala-maven-plugin][33] | [Public domain (Unlicense)][34] | -| [ScalaTest Maven Plugin][35] | [the Apache License, ASL Version 2.0][22] | -| [OpenFastTrace Maven Plugin][36] | [GNU General Public License v3.0][37] | -| [Project Keeper Maven plugin][38] | [The MIT License][39] | -| [duplicate-finder-maven-plugin Maven Mojo][40] | [Apache License 2.0][41] | -| [Apache Maven Deploy Plugin][42] | [Apache-2.0][5] | -| [Apache Maven GPG Plugin][43] | [Apache-2.0][5] | -| [Apache Maven Source Plugin][44] | [Apache License, Version 2.0][5] | -| [Apache Maven Javadoc Plugin][45] | [Apache-2.0][5] | -| [Nexus Staging Maven Plugin][46] | [Eclipse Public License][47] | -| [Maven Failsafe Plugin][48] | [Apache-2.0][5] | -| [JaCoCo :: Maven Plugin][49] | [EPL-2.0][50] | -| [error-code-crawler-maven-plugin][51] | [MIT License][52] | -| [Reproducible Build Maven Plugin][53] | [Apache 2.0][1] | +| [SonarQube Scanner for Maven][20] | [GNU LGPL 3][21] | +| [Apache Maven Toolchains Plugin][22] | [Apache-2.0][2] | +| [Apache Maven Compiler Plugin][23] | [Apache-2.0][2] | +| [Apache Maven Enforcer Plugin][24] | [Apache-2.0][2] | +| [Maven Flatten Plugin][25] | [Apache Software Licenese][2] | +| [org.sonatype.ossindex.maven:ossindex-maven-plugin][26] | [ASL2][1] | +| [Maven Surefire Plugin][27] | [Apache-2.0][2] | +| [Versions Maven Plugin][28] | [Apache License, Version 2.0][2] | +| [scala-maven-plugin][29] | [Public domain (Unlicense)][30] | +| [ScalaTest Maven Plugin][31] | [the Apache License, ASL Version 2.0][18] | +| [OpenFastTrace Maven Plugin][32] | [GNU General Public License v3.0][33] | +| [Project Keeper Maven plugin][34] | [The MIT License][35] | +| [duplicate-finder-maven-plugin Maven Mojo][36] | [Apache License 2.0][37] | +| [Apache Maven Deploy Plugin][38] | [Apache-2.0][2] | +| [Apache Maven GPG Plugin][39] | [Apache-2.0][2] | +| [Apache Maven Source Plugin][40] | [Apache License, Version 2.0][2] | +| [Apache Maven Javadoc Plugin][41] | [Apache-2.0][2] | +| [Nexus Staging Maven Plugin][42] | [Eclipse Public License][43] | +| [Maven Failsafe Plugin][44] | [Apache-2.0][2] | +| [JaCoCo :: Maven Plugin][45] | [EPL-2.0][46] | +| [error-code-crawler-maven-plugin][47] | [MIT License][48] | +| [Reproducible Build Maven Plugin][49] | [Apache 2.0][1] | [0]: https://parquet.apache.org [1]: http://www.apache.org/licenses/LICENSE-2.0.txt -[2]: https://github.com/airlift/aircompressor -[3]: https://www.apache.org/licenses/LICENSE-2.0.html -[4]: https://github.com/xerial/snappy-java -[5]: https://www.apache.org/licenses/LICENSE-2.0.txt -[6]: https://avro.apache.org -[7]: https://commons.apache.org/proper/commons-compress/ -[8]: https://commons.apache.org/proper/commons-configuration/ -[9]: https://github.com/dnsjava/dnsjava -[10]: https://opensource.org/licenses/BSD-3-Clause -[11]: https://www.scala-lang.org/ -[12]: https://www.apache.org/licenses/LICENSE-2.0 -[13]: https://github.com/exasol/error-reporting-java/ -[14]: https://github.com/exasol/error-reporting-java/blob/main/LICENSE -[15]: https://junit.org/junit5/ -[16]: https://www.eclipse.org/legal/epl-v20.html -[17]: https://github.com/mockito/mockito -[18]: https://opensource.org/licenses/MIT -[19]: http://hamcrest.org/JavaHamcrest/ -[20]: http://opensource.org/licenses/BSD-3-Clause -[21]: http://www.scalatest.org -[22]: http://www.apache.org/licenses/LICENSE-2.0 -[23]: https://www.jqno.nl/equalsverifier -[24]: http://sonarsource.github.io/sonar-scanner-maven/ -[25]: http://www.gnu.org/licenses/lgpl.txt -[26]: https://maven.apache.org/plugins/maven-toolchains-plugin/ -[27]: https://maven.apache.org/plugins/maven-compiler-plugin/ -[28]: https://maven.apache.org/enforcer/maven-enforcer-plugin/ -[29]: https://www.mojohaus.org/flatten-maven-plugin/ -[30]: https://sonatype.github.io/ossindex-maven/maven-plugin/ -[31]: https://maven.apache.org/surefire/maven-surefire-plugin/ -[32]: https://www.mojohaus.org/versions/versions-maven-plugin/ -[33]: http://github.com/davidB/scala-maven-plugin -[34]: http://unlicense.org/ -[35]: https://www.scalatest.org/user_guide/using_the_scalatest_maven_plugin -[36]: https://github.com/itsallcode/openfasttrace-maven-plugin -[37]: https://www.gnu.org/licenses/gpl-3.0.html -[38]: https://github.com/exasol/project-keeper/ -[39]: https://github.com/exasol/project-keeper/blob/main/LICENSE -[40]: https://basepom.github.io/duplicate-finder-maven-plugin -[41]: http://www.apache.org/licenses/LICENSE-2.0.html -[42]: https://maven.apache.org/plugins/maven-deploy-plugin/ -[43]: https://maven.apache.org/plugins/maven-gpg-plugin/ -[44]: https://maven.apache.org/plugins/maven-source-plugin/ -[45]: https://maven.apache.org/plugins/maven-javadoc-plugin/ -[46]: http://www.sonatype.com/public-parent/nexus-maven-plugins/nexus-staging/nexus-staging-maven-plugin/ -[47]: http://www.eclipse.org/legal/epl-v10.html -[48]: https://maven.apache.org/surefire/maven-failsafe-plugin/ -[49]: https://www.jacoco.org/jacoco/trunk/doc/maven.html -[50]: https://www.eclipse.org/legal/epl-2.0/ -[51]: https://github.com/exasol/error-code-crawler-maven-plugin/ -[52]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE -[53]: http://zlika.github.io/reproducible-build-maven-plugin +[2]: https://www.apache.org/licenses/LICENSE-2.0.txt +[3]: https://avro.apache.org +[4]: https://commons.apache.org/proper/commons-configuration/ +[5]: https://github.com/dnsjava/dnsjava +[6]: https://opensource.org/licenses/BSD-3-Clause +[7]: https://www.scala-lang.org/ +[8]: https://www.apache.org/licenses/LICENSE-2.0 +[9]: https://github.com/exasol/error-reporting-java/ +[10]: https://github.com/exasol/error-reporting-java/blob/main/LICENSE +[11]: https://junit.org/junit5/ +[12]: https://www.eclipse.org/legal/epl-v20.html +[13]: https://github.com/mockito/mockito +[14]: https://opensource.org/licenses/MIT +[15]: http://hamcrest.org/JavaHamcrest/ +[16]: https://raw.githubusercontent.com/hamcrest/JavaHamcrest/master/LICENSE +[17]: http://www.scalatest.org +[18]: http://www.apache.org/licenses/LICENSE-2.0 +[19]: https://www.jqno.nl/equalsverifier +[20]: http://sonarsource.github.io/sonar-scanner-maven/ +[21]: http://www.gnu.org/licenses/lgpl.txt +[22]: https://maven.apache.org/plugins/maven-toolchains-plugin/ +[23]: https://maven.apache.org/plugins/maven-compiler-plugin/ +[24]: https://maven.apache.org/enforcer/maven-enforcer-plugin/ +[25]: https://www.mojohaus.org/flatten-maven-plugin/ +[26]: https://sonatype.github.io/ossindex-maven/maven-plugin/ +[27]: https://maven.apache.org/surefire/maven-surefire-plugin/ +[28]: https://www.mojohaus.org/versions/versions-maven-plugin/ +[29]: http://github.com/davidB/scala-maven-plugin +[30]: http://unlicense.org/ +[31]: https://www.scalatest.org/user_guide/using_the_scalatest_maven_plugin +[32]: https://github.com/itsallcode/openfasttrace-maven-plugin +[33]: https://www.gnu.org/licenses/gpl-3.0.html +[34]: https://github.com/exasol/project-keeper/ +[35]: https://github.com/exasol/project-keeper/blob/main/LICENSE +[36]: https://basepom.github.io/duplicate-finder-maven-plugin +[37]: http://www.apache.org/licenses/LICENSE-2.0.html +[38]: https://maven.apache.org/plugins/maven-deploy-plugin/ +[39]: https://maven.apache.org/plugins/maven-gpg-plugin/ +[40]: https://maven.apache.org/plugins/maven-source-plugin/ +[41]: https://maven.apache.org/plugins/maven-javadoc-plugin/ +[42]: http://www.sonatype.com/public-parent/nexus-maven-plugins/nexus-staging/nexus-staging-maven-plugin/ +[43]: http://www.eclipse.org/legal/epl-v10.html +[44]: https://maven.apache.org/surefire/maven-failsafe-plugin/ +[45]: https://www.jacoco.org/jacoco/trunk/doc/maven.html +[46]: https://www.eclipse.org/legal/epl-2.0/ +[47]: https://github.com/exasol/error-code-crawler-maven-plugin/ +[48]: https://github.com/exasol/error-code-crawler-maven-plugin/blob/main/LICENSE +[49]: http://zlika.github.io/reproducible-build-maven-plugin diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md index 47f2e4d..cc9fe9d 100644 --- a/doc/changes/changelog.md +++ b/doc/changes/changelog.md @@ -1,5 +1,6 @@ # Changes +* [2.0.11](changes_2.0.11.md) * [2.0.10](changes_2.0.10.md) * [2.0.9](changes_2.0.9.md) * [2.0.8](changes_2.0.8.md) diff --git a/doc/changes/changes_2.0.11.md b/doc/changes/changes_2.0.11.md new file mode 100644 index 0000000..2f9d4b7 --- /dev/null +++ b/doc/changes/changes_2.0.11.md @@ -0,0 +1,31 @@ +# Parquet for Java 2.0.11, released 2024-10-17 + +Code name: Fix CVE-2024-47561 in dependency + +## Summary + +This release fixes vulnerability CVE-2024-47561 by updating transitive dependency `org.apache.avro:avro` via `org.apache.hadoop:hadoop-client`. + +## Security + +* #76: Fixed vulnerability CVE-2024-47561 in `org.apache.avro:avro` + +## Dependency Updates + +### Compile Dependency Updates + +* Updated `dnsjava:dnsjava:3.6.0` to `3.6.2` +* Removed `io.airlift:aircompressor:0.27` +* Updated `org.apache.avro:avro:1.11.3` to `1.12.0` +* Removed `org.apache.commons:commons-compress:1.26.2` +* Updated `org.apache.parquet:parquet-hadoop:1.14.1` to `1.14.3` +* Updated `org.scala-lang:scala-library:2.13.14` to `2.13.15` +* Removed `org.xerial.snappy:snappy-java:1.1.10.5` + +### Test Dependency Updates + +* Updated `nl.jqno.equalsverifier:equalsverifier:3.16.1` to `3.17.1` +* Updated `org.hamcrest:hamcrest:2.2` to `3.0` +* Updated `org.junit.jupiter:junit-jupiter:5.10.3` to `5.11.2` +* Updated `org.mockito:mockito-core:5.12.0` to `5.14.2` +* Updated `org.mockito:mockito-junit-jupiter:5.12.0` to `5.14.2` diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom index 6a726ab..cc7f6d7 100644 --- a/pk_generated_parent.pom +++ b/pk_generated_parent.pom @@ -3,7 +3,7 @@ 4.0.0 com.exasol parquet-io-java-generated-parent - 2.0.10 + 2.0.11 pom UTF-8 diff --git a/pom.xml b/pom.xml index ccb99a7..fb0af07 100644 --- a/pom.xml +++ b/pom.xml @@ -3,38 +3,26 @@ 4.0.0 com.exasol parquet-io-java - 2.0.10 + 2.0.11 Parquet for Java This project provides a library that reads Parquet files into Java objects. https://github.com/exasol/parquet-io-java/ parquet-io-java-generated-parent com.exasol - 2.0.10 + 2.0.11 pk_generated_parent.pom - 2.13.14 + 2.13.15 2.13 - 5.12.0 + 5.14.2 org.apache.parquet parquet-hadoop - 1.14.1 - - - - io.airlift - aircompressor - 0.27 - - - - org.xerial.snappy - snappy-java - 1.1.10.5 + 1.14.3 org.apache.hadoop @@ -133,13 +121,7 @@ org.apache.avro avro - 1.11.3 - - - - org.apache.commons - commons-compress - 1.26.2 + 1.12.0 @@ -151,7 +133,7 @@ dnsjava dnsjava - 3.6.0 + 3.6.2 org.scala-lang @@ -167,7 +149,7 @@ org.junit.jupiter junit-jupiter - 5.10.3 + 5.11.2 test @@ -185,7 +167,7 @@ org.hamcrest hamcrest - 2.2 + 3.0 test @@ -197,7 +179,7 @@ nl.jqno.equalsverifier equalsverifier - 3.16.1 + 3.17.1 test