Update to 2.6.0 #137

phuongnq · 2023-02-09T08:39:31Z

DB JARs for v10.2.11 are the last ones actually currently available. Please see https://github.com/vorburger/MariaDB4j/issues/484 for the full background about why this is being done. Includes disabling building the DBs' JARs on Travis (for now). Anyone reading this is invited to contributed a PR for MariaDB4j#484 enabling later DB releases (for all platforms) to successfully build.

Bumps [maven-plugin-annotations](https://github.com/apache/maven-plugin-tools) from 3.6.0 to 3.6.2. - [Release notes](https://github.com/apache/maven-plugin-tools/releases) - [Commits](apache/maven-plugin-tools@maven-plugin-tools-3.6.0...maven-plugin-tools-3.6.2) --- updated-dependencies: - dependency-name: org.apache.maven.plugin-tools:maven-plugin-annotations dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [maven-plugin-plugin](https://github.com/apache/maven-plugin-tools) from 3.6.0 to 3.6.2. - [Release notes](https://github.com/apache/maven-plugin-tools/releases) - [Commits](apache/maven-plugin-tools@maven-plugin-tools-3.6.0...maven-plugin-tools-3.6.2) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-plugin-plugin dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Libraries without a set automatic module name causes build warnings for all clients who build with Java >= 9. Also bump version of the Exec library, to use a version which has the automatic module name set.

Bumps `springboot.version` from 2.5.2 to 2.6.0. Updates `spring-boot-dependencies` from 2.5.2 to 2.6.0 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](spring-projects/spring-boot@v2.5.2...v2.6.0) Updates `spring-boot-maven-plugin` from 2.5.2 to 2.6.0 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](spring-projects/spring-boot@v2.5.2...v2.6.0) --- updated-dependencies: - dependency-name: org.springframework.boot:spring-boot-dependencies dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: org.springframework.boot:spring-boot-maven-plugin dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [mysql-connector-java](https://github.com/mysql/mysql-connector-j) from 8.0.22 to 8.0.27. - [Release notes](https://github.com/mysql/mysql-connector-j/releases) - [Changelog](https://github.com/mysql/mysql-connector-j/blob/release/8.0/CHANGES) - [Commits](mysql/mysql-connector-j@8.0.22...8.0.27) --- updated-dependencies: - dependency-name: mysql:mysql-connector-java dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [junit](https://github.com/junit-team/junit4) from 4.13.1 to 4.13.2. - [Release notes](https://github.com/junit-team/junit4/releases) - [Changelog](https://github.com/junit-team/junit4/blob/main/doc/ReleaseNotes4.13.1.md) - [Commits](junit-team/junit4@r4.13.1...r4.13.2) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [maven-compat](https://github.com/apache/maven) from 3.6.3 to 3.8.4. - [Release notes](https://github.com/apache/maven/releases) - [Commits](apache/maven@maven-3.6.3...maven-3.8.4) --- updated-dependencies: - dependency-name: org.apache.maven:maven-compat dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps `maven.version` from 3.6.3 to 3.8.4. Updates `maven-plugin-api` from 3.6.3 to 3.8.4 - [Release notes](https://github.com/apache/maven/releases) - [Commits](apache/maven@maven-3.6.3...maven-3.8.4) Updates `maven-core` from 3.6.3 to 3.8.4 - [Release notes](https://github.com/apache/maven/releases) - [Commits](apache/maven@maven-3.6.3...maven-3.8.4) Updates `maven-model` from 3.6.3 to 3.8.4 - [Release notes](https://github.com/apache/maven/releases) - [Commits](apache/maven@maven-3.6.3...maven-3.8.4) Updates `maven-artifact` from 3.6.3 to 3.8.4 - [Release notes](https://github.com/apache/maven/releases) - [Commits](apache/maven@maven-3.6.3...maven-3.8.4) Updates `maven-settings` from 3.6.3 to 3.8.4 - [Release notes](https://github.com/apache/maven/releases) - [Commits](apache/maven@maven-3.6.3...maven-3.8.4) Updates `maven-settings-builder` from 3.6.3 to 3.8.4 - [Release notes](https://github.com/apache/maven/releases) - [Commits](apache/maven@maven-3.6.3...maven-3.8.4) --- updated-dependencies: - dependency-name: org.apache.maven:maven-plugin-api dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: org.apache.maven:maven-core dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: org.apache.maven:maven-model dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: org.apache.maven:maven-artifact dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: org.apache.maven:maven-settings dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: org.apache.maven:maven-settings-builder dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [slf4j-simple](https://github.com/qos-ch/slf4j) from 1.7.31 to 1.7.32. - [Release notes](https://github.com/qos-ch/slf4j/releases) - [Commits](https://github.com/qos-ch/slf4j/commits) --- updated-dependencies: - dependency-name: org.slf4j:slf4j-simple dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps commons-io from 2.10.0 to 2.11.0. --- updated-dependencies: - dependency-name: commons-io:commons-io dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [assertj-core](https://github.com/assertj/assertj-core) from 3.17.2 to 3.21.0. - [Release notes](https://github.com/assertj/assertj-core/releases) - [Commits](assertj/assertj@assertj-core-3.17.2...assertj-core-3.21.0) --- updated-dependencies: - dependency-name: org.assertj:assertj-core dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

see mockito/mockito-kotlin#383

Bumps [maven-project-info-reports-plugin](https://github.com/apache/maven-project-info-reports-plugin) from 3.1.1 to 3.1.2. - [Release notes](https://github.com/apache/maven-project-info-reports-plugin/releases) - [Commits](apache/maven-project-info-reports-plugin@maven-project-info-reports-plugin-3.1.1...maven-project-info-reports-plugin-3.1.2) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [maven-common-artifact-filters](https://github.com/apache/maven-common-artifact-filters) from 3.1.0 to 3.2.0. - [Release notes](https://github.com/apache/maven-common-artifact-filters/releases) - [Commits](apache/maven-common-artifact-filters@maven-common-artifact-filters-3.1.0...maven-common-artifact-filters-3.2.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

This doesn't fix https://github.com/vorburger/MariaDB4j/issues/488, but still seems like a good idea to do, because the currently used Maven version (or that test dependency) seems to use IO 2.4.1 as well, so this does not appear to be required anymore now.

…from Maven plugin (but it's still transitively inherited)

see https://github.com/vorburger/MariaDB4j/issues/493

for https://github.com/vorburger/MariaDB4j/issues/495

Bumps [mockito-core](https://github.com/mockito/mockito) from 4.4.0 to 4.8.0. - [Release notes](https://github.com/mockito/mockito/releases) - [Commits](mockito/mockito@v4.4.0...v4.8.0) --- updated-dependencies: - dependency-name: org.mockito:mockito-core dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

This reverts commit c7e4cae.

This reverts commit 926f2bb.

[maven-release-plugin] copy for tag mariaDB4j-2.6.0

sonatype-lift · 2023-02-09T08:45:23Z

mariaDB4j-core/src/main/java/ch/vorburger/mariadb4j/DBConfigurationBuilder.java

+    }
+
+    public boolean isWindows() {
+        return WIN32.equals(getOS());


YodaCondition: The non-constant portion of an equals check generally comes first.

Suggested change

return WIN32.equals(getOS());

return Objects.equals(getOS(), WIN32);

❗❗ 2 similar findings have been found in this PR

🔎 Expand here to view all instances of this finding

File Path Line Number

mariaDB4j-core/src/main/java/ch/vorburger/mariadb4j/springframework/MariaDB4jSpringService.java 94

mariaDB4j-core/src/main/java/ch/vorburger/mariadb4j/springframework/MariaDB4jSpringService.java 88

Visit the Lift Web Console to find more details in your report.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Help us improve LIFT! (Sonatype LiftBot external survey)

Was this a good recommendation for you? _{Answering this survey will not impact your Lift settings.}

[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-02-09T08:45:26Z

mariaDB4j-core/src/main/java/ch/vorburger/mariadb4j/DBConfigurationBuilder.java

+
+    public DBConfigurationBuilder setExecutable(Executable executable, String path) {
+        checkIfFrozen("setExecutable");
+        executables.put(requireNonNull(executable, "executable"), () -> new File(requireNonNull(path, "path")));


PATH_TRAVERSAL_IN: This API (java/io/File.(Ljava/lang/String;)V) reads a file whose location might be specified by user input

❗❗ 6 similar findings have been found in this PR

🔎 Expand here to view all instances of this finding

File Path Line Number

mariaDB4j-core/src/main/java/ch/vorburger/mariadb4j/DBConfigurationBuilder.java 401

mariaDB4j-core/src/main/java/ch/vorburger/mariadb4j/DBConfigurationBuilder.java 410

mariaDB4j-core/src/main/java/ch/vorburger/mariadb4j/DBConfigurationBuilder.java 406

mariaDB4j-core/src/main/java/ch/vorburger/mariadb4j/DBConfigurationBuilder.java 402

mariaDB4j-core/src/main/java/ch/vorburger/mariadb4j/DBConfigurationBuilder.java 403

mariaDB4j-core/src/main/java/ch/vorburger/mariadb4j/DBConfigurationBuilder.java 404

Visit the Lift Web Console to find more details in your report.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Help us improve LIFT! (Sonatype LiftBot external survey)

Was this a good recommendation for you? _{Answering this survey will not impact your Lift settings.}

[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-02-09T08:45:28Z

🛠 Lift Auto-fix

Some of the Lift findings in this PR can be automatically fixed. You can download and apply these changes in your local project directory of your branch to review the suggestions before committing.¹

# Download the patch
curl https://lift.sonatype.com/api/patch/github.com/craftercms/MariaDB4j/137.diff -o lift-autofixes.diff

# Apply the patch with git
git apply lift-autofixes.diff

# Review the changes
git diff

Want it all in a single command? Open a terminal in your project's directory and copy and paste the following command:

curl https://lift.sonatype.com/api/patch/github.com/craftercms/MariaDB4j/137.diff | git apply

Once you're satisfied, commit and push your changes in your project.

You can preview the patch by opening the patch URL in the browser. ↩

sonatype-lift · 2023-02-09T10:34:28Z

mariaDB4j-core/src/main/java/ch/vorburger/mariadb4j/DBConfigurationBuilder.java

-                getLibDir(), _getDataDir(), WIN64.equals(getOS()), _getArgs(), _getOSLibraryEnvironmentVarName(),
-                isSecurityDisabled(), isDeletingTemporaryBaseAndDataDirsOnShutdown(), this::getURL,
+        return new DBConfiguration.Impl(_getPort(), _getSocket(), _getBinariesClassPathLocation(), getBaseDir(), getLibDir(), _getDataDir(),
+                _getTmpDir(), WIN64.equals(getOS()), _getArgs(), _getOSLibraryEnvironmentVarName(), isSecurityDisabled(),


YodaCondition: The non-constant portion of an equals check generally comes first.

Suggested change

_getTmpDir(), WIN64.equals(getOS()), _getArgs(), _getOSLibraryEnvironmentVarName(), isSecurityDisabled(),

_getTmpDir(), Objects.equals(getOS(), WIN64), _getArgs(), _getOSLibraryEnvironmentVarName(), isSecurityDisabled(),

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Help us improve LIFT! (Sonatype LiftBot external survey)

Was this a good recommendation for you? _{Answering this survey will not impact your Lift settings.}

[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-02-10T10:42:13Z

mariaDB4j-core/src/main/java/ch/vorburger/mariadb4j/DB.java

@@ -202,7 +205,8 @@ synchronized protected void runMysqlSecureInstallationScript() throws ManagedPro
            }

            boolean secured = false;
-            try (Connection conn = DriverManager.getConnection(configuration.getURL("mysql"), "root", "")) {
+            String jdbcUrl = "jdbc:mysql://localhost:" + configuration.getPort() + "/mysql";
+            try (Connection conn = DriverManager.getConnection(jdbcUrl, "root", "")) {


HARD_CODE_PASSWORD: Hard coded password found

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Help us improve LIFT! (Sonatype LiftBot external survey)

Was this a good recommendation for you? _{Answering this survey will not impact your Lift settings.}

[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-02-10T10:42:15Z

mariaDB4j-core/src/main/java/ch/vorburger/mariadb4j/DB.java

@@ -202,7 +205,8 @@ synchronized protected void runMysqlSecureInstallationScript() throws ManagedPro
            }

            boolean secured = false;
-            try (Connection conn = DriverManager.getConnection(configuration.getURL("mysql"), "root", "")) {
+            String jdbcUrl = "jdbc:mysql://localhost:" + configuration.getPort() + "/mysql";
+            try (Connection conn = DriverManager.getConnection(jdbcUrl, "root", "")) {


DMI_EMPTY_DB_PASSWORD: Empty database password in ch.vorburger.mariadb4j.DB.runMysqlSecureInstallationScript()

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Help us improve LIFT! (Sonatype LiftBot external survey)

Was this a good recommendation for you? _{Answering this survey will not impact your Lift settings.}

[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

vorburger and others added 30 commits November 28, 2021 20:15

Add jakarta.annotation-api to fix broken build on Java 11 (fixes Mari…

5d82b69

…aDB4j#456)

Issue MariaDB4j#372: Add automatic module name to core

1b60537

Libraries without a set automatic module name causes build warnings for all clients who build with Java >= 9. Also bump version of the Exec library, to use a version which has the automatic module name set.

Use lower case letter in automatic module name

aa7a7fa

Clean up dependabot.yml

13e5596

Bump commons-io from 2.10.0 to 2.11.0

1579353

Bumps commons-io from 2.10.0 to 2.11.0. --- updated-dependencies: - dependency-name: commons-io:commons-io dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bump mockito-core from 3.5.15 to 4.1.0

1760987

see mockito/mockito-kotlin#383

Run mvn verify instead of only package on Travis

cbf4e04

Fix Maven plugin dependencies scope and remove commons-io dependency …

5e17669

…from Maven plugin (but it's still transitively inherited)

Use magic <version>@project.version@ in Maven Plugin IT

0d48bdc

see https://github.com/vorburger/MariaDB4j/issues/493

[maven-release-plugin] prepare release mariaDB4j-2.5.0

f965a17

[maven-release-plugin] rollback the release of mariaDB4j-2.5.0

a165388

Bump maven-release-plugin from 2.5.3 to 3.0.0-M4

578267b

for https://github.com/vorburger/MariaDB4j/issues/495

[maven-release-plugin] prepare release mariaDB4j-2.5.0

bfd80cd

[maven-release-plugin] rollback the release of mariaDB4j-2.5.0

d8cd4c1

[maven-release-plugin] prepare release mariaDB4j-2.5.0

648877a

[maven-release-plugin] prepare for next development iteration

03488a0

rm broken Dependabot badge from README

c5eba62

mrdziuban and others added 13 commits September 27, 2022 20:39

Bump springboot version from 2.6.6 to 2.7.4.

769ec85

Update connection URL to use mariadb.

da6fb8e

[maven-release-plugin] prepare release mariaDB4j-2.6.0

926f2bb

[maven-release-plugin] prepare for next development iteration

c7e4cae

Bump release related Maven plugin versions in lite POM

2b5de5b

Revert "[maven-release-plugin] prepare for next development iteration"

faf0fbf

This reverts commit c7e4cae.

Revert "[maven-release-plugin] prepare release mariaDB4j-2.6.0"

53e9848

This reverts commit 926f2bb.

Bump lite POM version used in MariaDB4j itself

2f91ba4

README: Fix broken CHANGELOG link.

4bbc5b4

Move maven-javadoc-plugin from core/ to root POM (fixes MariaDB4j#625)

92f17ba

[maven-release-plugin] prepare release mariaDB4j-2.6.0

2b29fd8

Merge tag 'mariaDB4j-2.6.0'

3063904

[maven-release-plugin] copy for tag mariaDB4j-2.6.0

sonatype-lift bot reviewed Feb 9, 2023

View reviewed changes

phuongnq force-pushed the feature/craftercms-5929 branch 2 times, most recently from d8e0c88 to 538bd3b Compare February 9, 2023 10:30

sonatype-lift bot reviewed Feb 9, 2023

View reviewed changes

phuongnq force-pushed the feature/craftercms-5929 branch 3 times, most recently from 74bd340 to f4c6b91 Compare February 10, 2023 10:37

sonatype-lift bot reviewed Feb 10, 2023

View reviewed changes

fix merge conflict

27b54c8

phuongnq force-pushed the feature/craftercms-5929 branch from f4c6b91 to 27b54c8 Compare February 10, 2023 10:51

phuongnq marked this pull request as ready for review February 10, 2023 11:14

sumerjabri approved these changes Feb 10, 2023

View reviewed changes

sumerjabri merged commit 00dd152 into craftercms:main Feb 10, 2023

phuongnq deleted the feature/craftercms-5929 branch February 29, 2024 03:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update to 2.6.0 #137

Update to 2.6.0 #137

phuongnq commented Feb 9, 2023

sonatype-lift bot Feb 9, 2023

sonatype-lift bot Feb 9, 2023

sonatype-lift bot commented Feb 9, 2023

sonatype-lift bot Feb 9, 2023

sonatype-lift bot Feb 10, 2023

sonatype-lift bot Feb 10, 2023

	return WIN32.equals(getOS());
	return Objects.equals(getOS(), WIN32);

Command	Usage
`@sonatype-lift ignore`	Leave out the above finding from this PR
`@sonatype-lift ignoreall`	Leave out all the existing findings from this PR
`@sonatype-lift exclude <file\|issue\|path\|tool>`	Exclude specified `file\|issue\|path\|tool` from Lift findings by updating your config.toml file

	_getTmpDir(), WIN64.equals(getOS()), _getArgs(), _getOSLibraryEnvironmentVarName(), isSecurityDisabled(),
	_getTmpDir(), Objects.equals(getOS(), WIN64), _getArgs(), _getOSLibraryEnvironmentVarName(), isSecurityDisabled(),

Update to 2.6.0 #137

Update to 2.6.0 #137

Conversation

phuongnq commented Feb 9, 2023

sonatype-lift bot Feb 9, 2023

Choose a reason for hiding this comment

sonatype-lift bot Feb 9, 2023

Choose a reason for hiding this comment

sonatype-lift bot commented Feb 9, 2023

🛠 Lift Auto-fix

Footnotes

sonatype-lift bot Feb 9, 2023

Choose a reason for hiding this comment

sonatype-lift bot Feb 10, 2023

Choose a reason for hiding this comment

sonatype-lift bot Feb 10, 2023

Choose a reason for hiding this comment