Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove unnecessary managed JDBC drivers from parent pom.xml #15862

Closed
9 tasks done
lukaseder opened this issue Nov 21, 2023 · 0 comments
Closed
9 tasks done

Remove unnecessary managed JDBC drivers from parent pom.xml #15862

lukaseder opened this issue Nov 21, 2023 · 0 comments

Comments

@lukaseder
Copy link
Member

lukaseder commented Nov 21, 2023

A few of our test dependencies are declared as managed JDBC drivers in the parent pom.xml <dependencyManagement> section. This is just for convenience of testing, but it isn't necessary. We have a shared jooq-test project that could declare these drivers, even as compile time dependencies to all tests, instead.

If the dependencies are declared in the parent pom.xml, then:

  • We get CVE reports in our jOOQ Open Source Edition, even if it isn't affected (e.g. most recently: CVE-2022-46337)
  • Users might get the same problem

Removing these drivers again would simplify the project structure with no negative impact on user code.

Affected drivers include:

  • com.oracle.database.r2dbc:oracle-r2dbc
  • io.r2dbc:r2dbc-h2
  • io.r2dbc:r2dbc-mssql
  • org.duckdb:duckdb_jdbc
  • org.hsqldb:hsqldb
  • org.mariadb:r2dbc-mariadb
  • org.postgresql:postgresql
  • org.postgresql:r2dbc-postgresql
  • org.xerial:sqlite-jdbc

Drivers that continue being required include:

  • com.h2database:h2
  • com.microsoft.sqlserver:mssql-jdbc
  • com.oracle.database.jdbc:ojdbc11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
No open projects
Development

No branches or pull requests

1 participant