Bump snakeyaml from 1.33 to 2.0 #75

dependabot · 2023-02-27T09:56:43Z

Bumps snakeyaml from 1.33 to 2.0.

Commits

c98ffba issue 561: add negative test case
e2ca740 Use Maven wrapper on github
49d91a1 Fix target for github
19e331d Disable toolchain for github
42c7812 Cobertura plugin does not work
03c82b5 Rename GlobalTagRejectionTest to be run by Maven
6e8cd89 Remove cobertura
d9b0f48 Improve Javadoc
519791a Run install and site goals under docker
82f33d2 Merge branch 'master' into add-module-info
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

> **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

jtnord

2.0 is a potentially breaking change to consumers as some constructors have been removed.

need to ensure that the removed code is not being used by any consumers before this is upgraded.

RobWaterhouse95 · 2023-03-24T14:46:38Z

Hi @jtnord
Has there been any movement on this change?
As far as I am aware, the upgrade to SnakeYaml 2.0 should solve the vulnerability CVE-2022-1471

jtnord · 2023-03-24T15:11:37Z

Hi @jtnord Has there been any movement on this change? As far as I am aware, the upgrade to SnakeYaml 2.0 should solve the vulnerability CVE-2022-1471

https://bitbucket.org/snakeyaml/snakeyaml/wiki/CVE%20&%20NIST.md

There is no vulnerability in snakeyaml - it works as expected - the vulnerability is in any libraries that use it insecurely with untrusted data. The Jenkins plugin ecosystem has been checked for this usage.
There was a very good commentary on this in the snakeyaml issue tracker - but it seems the whole issue tracker has gone awol :-o

Additionally as commented above - 2.0 is potentially breaking so this needs some time to check all consumers will not break and adjust them as appropriate.
In the interim - unless you are using a plugin that has not come from a supported Jenkins update center your scanner is wrong, ie check the plugins you have installed in your instance that depend on this plugin, and if any are internally written or have been installed manually then they need to be inspected.

MarkEWaite · 2023-04-05T15:21:57Z

The ConfigurationAsCodeTest in the plugin bill of materials fails with no such method error when snakeyaml is updated to the incremental build from this pull request.

[ERROR] io.jenkins.tools.bom.sample.ConfigurationAsCodeTest  Time elapsed: 6.765 s  <<< FAILURE!
java.lang.AssertionError: Unexpected exception
        at io.jenkins.plugins.casc.misc.JenkinsConfiguredWithCodeRule.before(JenkinsConfiguredWithCodeRule.java:50)
        at org.jvnet.hudson.test.JenkinsRule$1.evaluate(JenkinsRule.java:602)
        at org.junit.internal.runners.statements.FailOnTimeout$CallableStatement.call(FailOnTimeout.java:299)
        at org.junit.internal.runners.statements.FailOnTimeout$CallableStatement.call(FailOnTimeout.java:293)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: java.lang.NoSuchMethodError: 'void org.yaml.snakeyaml.parser.ParserImpl.<init>(org.yaml.snakeyaml.reader.StreamReader)'
        at io.jenkins.plugins.casc.yaml.YamlUtils.read(YamlUtils.java:62)
        at io.jenkins.plugins.casc.yaml.YamlUtils.merge(YamlUtils.java:41)
        at io.jenkins.plugins.casc.yaml.YamlUtils.loadFrom(YamlUtils.java:102)
        at io.jenkins.plugins.casc.ConfigurationAsCode.configureWith(ConfigurationAsCode.java:637)
        at io.jenkins.plugins.casc.ConfigurationAsCode.configure(ConfigurationAsCode.java:606)
        at io.jenkins.plugins.casc.misc.JenkinsConfiguredWithCodeRule.before(JenkinsConfiguredWithCodeRule.java:47)
        ... 5 more

The configuration as code automated tests will need adaptation before they are ready for snakeyaml 2.0.

Bumps [snakeyaml](https://bitbucket.org/snakeyaml/snakeyaml) from 1.33 to 2.0. - [Commits](https://bitbucket.org/snakeyaml/snakeyaml/branches/compare/snakeyaml-2.0..snakeyaml-1.33) --- updated-dependencies: - dependency-name: org.yaml:snakeyaml dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

jtnord · 2023-05-09T10:06:26Z

The configuration as code automated tests

the production code will need some fixes also

java.lang.NoSuchMethodError: 'void org.yaml.snakeyaml.parser.ParserImpl.<init>(org.yaml.snakeyaml.reader.StreamReader)'
	at io.jenkins.plugins.casc.yaml.YamlUtils.read(YamlUtils.java:62)
	at io.jenkins.plugins.casc.yaml.YamlUtils.merge(YamlUtils.java:41)
	at io.jenkins.plugins.casc.yaml.YamlUtils.loadFrom(YamlUtils.java:102)
	at io.jenkins.plugins.casc.ConfigurationAsCode.configureWith(ConfigurationAsCode.java:637)
	at io.jenkins.plugins.casc.ConfigurationAsCode.configure(ConfigurationAsCode.java:306)
	at io.jenkins.plugins.casc.ConfigurationAsCode.init(ConfigurationAsCode.java:298)

basil

basil · 2023-05-31T23:15:20Z

The following proprietary plugins should be tested as well:

cloudbees-casc-client
cloudbees-casc-items-api
cloudbees-casc-server
cloudbees-workflow-template
master-provisioning-kubernetes

basil · 2023-05-31T23:26:49Z

Might need a release of fabric8io/kubernetes-client#5098 and a corresponding upgrade in https://github.com/jenkinsci/kubernetes-client-api-plugin as well.

jetersen · 2023-06-05T14:54:24Z

@basil the PR you linked to is now included https://github.com/fabric8io/kubernetes-client/releases/tag/v6.7.0

basil · 2023-06-05T17:10:21Z

@basil the PR you linked to is now included https://github.com/fabric8io/kubernetes-client/releases/tag/v6.7.0

⇒ jenkinsci/kubernetes-client-api-plugin#208

samrocketman · 2023-06-23T03:00:43Z

https://github.com/jenkinsci/scm-filter-jervis-plugin/ will be broken by SnakeYAML 2.0 due to how it uses Representer without being constructed with DumperOptions. I've updated the upstream library samrocketman/jervis@40b76c2

I am currently working on converting scm-filter-jervis-plugin from gradle to maven so that it can use automated plugin release. I plan to release the update for jervis to maven central once this project is onboarded to maven automatic releases.

- Requires latest Jenkins. - Packages Jervis 1.7 (same as old version) - Update license copyright to 2023 - Convert from building with Gradle to Maven. - Update plugin for continuous automated release. - Use GMavenPlus to compile groovy. - Targets Java 1.8 bytecode. - Reduce size of plugin by relying on other Jenkins plugins instead of packaging libraries for bouncy castle and snakeyaml. - Update README and plugin docs with terminology updates for accuracy. This release is vulnerable breakage in the future by a dependency: jenkinsci/snakeyaml-api-plugin#75 See also: - https://www.jenkins.io/doc/developer/publishing/releasing-cd/

Jervis centralized all YAML usage in order to save time fixing YAML parsing. See also: - [`YamlOperator`][1]. - jenkinsci/snakeyaml-api-plugin#75 [1]: https://github.com/samrocketman/jervis/blob/jervis-2.0/src/main/groovy/net/gleske/jervis/tools/YamlOperator.groovy

samrocketman · 2023-06-27T14:13:25Z

scm-filter-jervis successfully patched.

It might be worthwhile to centralize common YAML parsing operations plugins might use within this plugin to expose a plugin API for YAML.

Jervis used to use snakeyaml in several classes and since centralizing it, it has been easy to react to breaking changes.

timja · 2023-08-05T13:05:54Z

I think we are good to go on this, any concerns @jtnord?

jtnord · 2023-08-07T09:19:26Z

the k8s plugins (this will require a bump in some consumers of this plugin) need to be updated and the maintainer is on his holidays at the moment.

dependabot · 2023-08-07T09:39:54Z

Superseded by #94.

jtnord · 2023-08-07T10:02:09Z

@olamy mentions that jenkinsci/blueocean-plugin#2472 is needed to be in a release as well

jiridanek · 2023-10-13T09:25:39Z

Bump org.yaml:snakeyaml from 1.33 to 2.2 #96

dependabot bot added the dependencies Pull requests that update a dependency file label Feb 27, 2023

jtnord suggested changes Feb 27, 2023

View reviewed changes

dependabot bot force-pushed the dependabot/maven/org.yaml-snakeyaml-2.0 branch from 3d85939 to b67df79 Compare March 16, 2023 10:55

dependabot bot force-pushed the dependabot/maven/org.yaml-snakeyaml-2.0 branch from b67df79 to 1642e22 Compare March 27, 2023 10:33

dependabot bot force-pushed the dependabot/maven/org.yaml-snakeyaml-2.0 branch from 1642e22 to f142114 Compare April 3, 2023 10:42

dependabot bot force-pushed the dependabot/maven/org.yaml-snakeyaml-2.0 branch from f142114 to 5c28c7c Compare April 11, 2023 07:05

jtnord mentioned this pull request May 9, 2023

testing snakeyaml 2.0 jenkinsci/configuration-as-code-plugin#2274

Closed

6 tasks

basil approved these changes May 31, 2023

View reviewed changes

samrocketman mentioned this pull request Jun 23, 2023

Convert to maven and auto-release jenkinsci/scm-filter-jervis-plugin#6

Merged

samrocketman mentioned this pull request Jun 27, 2023

Forward compatibility with SnakeYAML 2.0 jenkinsci/scm-filter-jervis-plugin#12

Merged

priyawadhwa mentioned this pull request Jul 24, 2023

Add GHSA-mjmj-j48q-9wg2 to Jenkins advisory wolfi-dev/advisories#106

Merged

jetersen mentioned this pull request Jul 28, 2023

Snake YAML Missing function jenkinsci/configuration-as-code-plugin#2324

Open

timja requested a review from jtnord August 5, 2023 13:05

dependabot bot closed this Aug 7, 2023

dependabot bot deleted the dependabot/maven/org.yaml-snakeyaml-2.0 branch August 7, 2023 09:39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump snakeyaml from 1.33 to 2.0 #75

Bump snakeyaml from 1.33 to 2.0 #75

dependabot bot commented on behalf of github Feb 27, 2023 •

edited

Loading

jtnord left a comment •

edited

Loading

RobWaterhouse95 commented Mar 24, 2023

jtnord commented Mar 24, 2023 •

edited

Loading

MarkEWaite commented Apr 5, 2023

jtnord commented May 9, 2023 •

edited

Loading

basil left a comment

basil commented May 31, 2023

basil commented May 31, 2023

jetersen commented Jun 5, 2023

basil commented Jun 5, 2023

samrocketman commented Jun 23, 2023 •

edited

Loading

samrocketman commented Jun 27, 2023 •

edited

Loading

timja commented Aug 5, 2023

jtnord commented Aug 7, 2023

dependabot bot commented on behalf of github Aug 7, 2023

jtnord commented Aug 7, 2023

jiridanek commented Oct 13, 2023

Bump snakeyaml from 1.33 to 2.0 #75

Bump snakeyaml from 1.33 to 2.0 #75

Conversation

dependabot bot commented on behalf of github Feb 27, 2023 • edited Loading

jtnord left a comment • edited Loading

Choose a reason for hiding this comment

RobWaterhouse95 commented Mar 24, 2023

jtnord commented Mar 24, 2023 • edited Loading

MarkEWaite commented Apr 5, 2023

jtnord commented May 9, 2023 • edited Loading

basil left a comment

Choose a reason for hiding this comment

basil commented May 31, 2023

basil commented May 31, 2023

jetersen commented Jun 5, 2023

basil commented Jun 5, 2023

samrocketman commented Jun 23, 2023 • edited Loading

samrocketman commented Jun 27, 2023 • edited Loading

timja commented Aug 5, 2023

jtnord commented Aug 7, 2023

dependabot bot commented on behalf of github Aug 7, 2023

jtnord commented Aug 7, 2023

jiridanek commented Oct 13, 2023

dependabot bot commented on behalf of github Feb 27, 2023 •

edited

Loading

jtnord left a comment •

edited

Loading

jtnord commented Mar 24, 2023 •

edited

Loading

jtnord commented May 9, 2023 •

edited

Loading

samrocketman commented Jun 23, 2023 •

edited

Loading

samrocketman commented Jun 27, 2023 •

edited

Loading