Skip to content

Repository navigation

TaskTide - v0.9.5

Choose a tag to compare

View all tags
@BrenKenna BrenKenna released this 24 Sep 14:06
· 52 commits to main since this release
v0.9.5
f70a020
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

TaskTide Release

Overview

Release: v0.9.5 - vulnerability patches
Date: 24/09/2026
Release type: breaking and maintenance, no maven central

Summary

The release comes with breaking changes that greatly improves the security posture of the TaskTide-WebAPI, and libraries that use the TaskTide-CoreLib.

Starting with the core lib, the JsonRepository is officially dropped. The library was very useful for developing out the the TaskTide-Repository, and TaskTideService interfaces. So that the rest of the code base could be built while specifics around the ItemStore, or using the Jakarta-NoSQL Template and JPA stacks could be figured. Since they are robustly so, this non thread safe package is dropped entirely.

Additionally, CodeQL picked up non-sanitized use of query fields which could introduce CWE-89 and CWE-564. Rather than target the JpaRepository specifically. A standardized validation method is implemented onto the AbstractRepository which resolves to it being applied across repository instances, so it's a better security and general use improvement. Additionally, in keeping with CWE motivation, suspicious query fields as input are dropped (too long based on TaskTideModel average, letters only etc).

Tightening some general practice elements too such as standardizing the use TimeUnit for ThreadSleeps, as well as using one method that is well defined. Clipping any trailing Exception.printTrace(), or too broad exception handling. Mutex library was particular perpetrator here, which helped debugging the nuances of the algorithm when there was a number of simultaneous plates spinning. It greatly helped then, but not anymore as its maturity "grows".

Another security vulnerability was evaluated on the WebAPI for XCS, Web-API explicitly declares JSON as it REST contract via JSON-B and handled that way. The specific CWE-79 alert is currently felt as a false positive because JSON-B is used to serialize json string, and no HTML is generated at all (no is it planned to). That said v2 plans to deliver a full website, so that TaskTide can run as a deployable platform, so these issues are big targets for future releases. But again, it's not intended that a REST-API will generate anything other than JSON for the frontend. But such malicious behaviors are planned to examined within their appropriate context.

Deprecates the old TaskTracker interface on TaskTide-Engine, as the Traverser & WorkloadAcquisitionPolicy is much more stable, mature, and improved design.

Highlights

  • Evaluates and addresses CWE-89, and CWE-564 alerts
  • Evaluates and addresses CWE-79 alerts
  • Drops the JsonRepository
  • Adds query field eval to AbstractRepository.
  • General code clean
  • Deprecates the old TaskTracker interface on TaskTide-Engine. Keeping one big removal per release atm.

Notes for next version

  • Continues code clean around ex.printStack trace
  • Tidies up the help print.
  • Adds a version argument to TaskTide.
  • Tidies the TaskTide splash, would prefer a more explicit tie.
  • Remove TaskTide-Engine-TaskTracker.

Release Versions

Module Version From Version To Released?
mutex v0.9.2 l v0.9.5 ✅
parser v0.9.2 l v0.9.5 ✅
itemstore v0.9.2 l v0.9.5 ✅
core v0.9.2 l `v0.9.5`` ✅
engine v0.9.2 l v0.9.5 ✅
api v0.9.2 l v0.9.5 ✅
tasktide v0.9.2 l v0.9.5 ✅

Only modules whose versions change need to be released. Unchanged modules should retain their existing versions.

Relevant Modules

List the modules affected by this release and briefly explain their involvement.

  • mutex — Java hygiene
  • parser — Consistency for v1
  • itemstore — Consistency for v1
  • core — CWE patches
  • engine — Java hygiene, TaskTracker deprecation
  • api — CWE patches
  • tasktide — CWE patches, and java hygiene

Module Releases

mutex

Version: v0.9.5
Previous version: 0.9.2

Changes

  • Java hygiene dropping ex.printStackTraces, or too broad exception handling etc

Breaking Changes

NA

Migration Notes

NA

parser

Version: v0.9.5
Previous version: v0.9.2

Changes

  • Consistency for v1

Breaking Changes

NA

Migration Notes

NA

itemstore

Version: v0.9.5
Previous version: v0.9.2

Changes

  • Consistency for v1

Breaking Changes

NA

Migration Notes

NA

core

Version: v0.9.5
Previous version: v0.9.2

Changes

  • AbstractRepository query field is sanitized
  • JobEnvironment class field changed to jobType
  • MetricData, and MetricProfile class field changed to metricType

Breaking Changes

  • MetricData, and MetricProfile class field changed to metricType

Migration Notes

  • Not with this version, future versions past v1 will include a full announcement suite.

engine

Version: v0.9.5
Previous version: v0.9.2

Changes

  • Java hygiene dropping ex.printStackTraces, or too broad exception handling etc.
  • Deprecates the old TaskTracker interface on TaskTide-Engine, as the Traverser & WorkloadAcquisitionPolicy is much more stable, mature, and improved design.

Breaking Changes

  • <None / description>

Migration Notes

<Migration instructions, if applicable.>

api

Version: v0.9.5
Previous version: v0.9.2

Changes

  • Explicitly declares JSON via JSON-B is the contract for REST resources

Breaking Changes

NA

Migration Notes

NA

tasktide

Version: v0.9.5
Previous version: v0.9.2

Changes

  • Evaluates and addresses CWE-89, and CWE-564 alerts
  • Evaluates and addresses CWE-79 alerts
  • Drops the JsonRepository
  • Adds query field eval to AbstractRepository.
  • General code clean

Breaking Changes

  • MetricData, and MetricProfile class field changed to metricType

Migration Notes

  • Not with this version, future versions past v1 will include a full announcement suite.

Compatibility / Dependencies

Document important version relationships between components.

Component Depends On Required Version

Compatibility Notes

NA

Breaking Changes

  • MetricData, and MetricProfile class field changed to metricType

Migration Notes

  • Not with this version, future versions past v1 will include a full announcement suite.

Publication

Pre-release

  • [ ✅ ] Clean build completed.
  • [ ✅ ] All tests pass.
  • [ ✅ ] Javadocs generated successfully.
  • [ ✅ ] No unexpected dependency resolution changes.
  • [ ✅ ] Published artifacts verified locally.

Module Verification

  • [ ✅ ] mutex.
  • [ ✅ ] parser.
  • [ ✅ ] itemstore.
  • [ ✅ ] core.
  • [ ✅ ] engine.
  • [ ✅ ] api.
  • [ ✅ ] tasktide.

Runtime / Integration Verification

  • [ ✅ ] CLI/application starts successfully.
  • [ ✅ ] Core workflows verified.
  • [ ✅ ] API verified.

Publication

Pre-release

  • [ ✅ ] Versions updated in gradle.properties.
  • [ ✅ ] Release notes completed.

Publish

  • [ ✅ ] Component artifacts published.
  • [ ✅ ] Aggregate tasktide artifact published.
  • [ ✅ ] OM dependencies verified.
  • [ ✅ ] Signatures verified.
  • [ NA ] This version is not published to Maven Central, because v1.0.0 is next week.
  • [ ✅ ] Published artifacts available from docker hub.

Post-release

  • [ ✅ ] Git tag pushed.
  • [ ✅ ] GitHub release created.
  • [ ✅ ] Documentation updated.
  • [ ✅ ] Next development versions/configuration prepared.

Release Notes

  • No Maven Central publication because TaskTide-v1.0.0 is planned for next week
  • Adds TaskTideModelType as an attribute on the AbstractRepository.
  • Drops JsonRepository breaking changes.
  • Deprecates the Engine-TaskTracker
  • Explicitly declares JSON as contract for REST resources.
  • Refines and standardizes the use and handling of thread sleep.
  • Sanitizes query by field on AbstractRepository level for use across all instances. Improving security profile of JPA, and SQLite-ItemStore.
  • Tidies up "too broad exception" bugs, and system.out print statements.
  • Adds test code assembly to CI. So that it's included with the already present src assembly. Blocks future issues where test matrix start, but fail because the JsonRepository, or some other removed/adjusted dependency is missed by IDE.
  • Deprecates the old TaskTracker interface on TaskTide-Engine, as the Traverser & WorkloadAcquisitionPolicy is much more stable, mature, and improved design.

Added

  • NA

Breaking Changes

  • MetricData, and MetricProfile class field changed to metricType

  • No migration with this version, but future versions past v1 will include a full announcement suite.

Address CWE Vulnerabilities

  • CWE-79, CWE-89, and CWE-564

Removed

  • JsonRepository

Deprecating

  • Deprecates the old TaskTracker interface on TaskTide-Engine, as the Traverser & WorkloadAcquisitionPolicy is much more stable, mature, and improved design.
  • Wanted to keep versions to one big removal/
Assets 7
Loading