Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove Apache Derby test dependency from pom.xml #5260

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 20, 2023

The Apache Derby dependency, which was scoped for testing, has been removed from the project's POM file and the tests that used it are now using H2.
Derby package for java 8 (version 10.14.x) has a security issue (CVE-2022-46337) that is going to be fixed on series 10.17.x only that requires java 21.
Thus this testing dependency is being removed.

It was introduced in #1120 .

@dependabot dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Nov 20, 2023
@dependabot dependabot bot changed the base branch from master to github-action-DAT-15775 November 30, 2023 20:36
@filipelautert filipelautert self-assigned this Dec 5, 2023
@filipelautert
Copy link
Collaborator

@dependabot rebase

Copy link
Contributor Author

dependabot bot commented on behalf of github Dec 5, 2023

The dependabot.yml entry that created this PR has been deleted so this PR can't be rebased. Please close the PR so Dependabot can create a new one with the current dependabot.yml.

@filipelautert filipelautert added sdou Security, Driver and other updates SafeToBuild Indicates that a particular PR contains changes which are safe to build using GitHub actions labels Dec 5, 2023
@filipelautert
Copy link
Collaborator

@dependabot recreate

Copy link
Contributor Author

dependabot bot commented on behalf of github Dec 6, 2023

The dependabot.yml entry that created this PR has been deleted so this PR can't be recreated. Please close the PR so Dependabot can create a new one with the current dependabot.yml.

@filipelautert filipelautert changed the base branch from github-action-DAT-15775 to master December 6, 2023 12:52
@filipelautert
Copy link
Collaborator

@dependabot rebase

Copy link
Contributor Author

dependabot bot commented on behalf of github Dec 6, 2023

The dependabot.yml entry that created this PR has been deleted so this PR can't be rebased. Please close the PR so Dependabot can create a new one with the current dependabot.yml.

@filipelautert
Copy link
Collaborator

@dependabot recreate

Copy link
Contributor Author

dependabot bot commented on behalf of github Dec 6, 2023

The dependabot.yml entry that created this PR has been deleted so this PR can't be recreated. Please close the PR so Dependabot can create a new one with the current dependabot.yml.

@filipelautert
Copy link
Collaborator

Closing to be recreated

Copy link
Contributor Author

dependabot bot commented on behalf of github Dec 6, 2023

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot bot deleted the dependabot/maven/liquibase-standard/org.apache.derby-derby-10.17.1.0 branch December 6, 2023 13:03
@filipelautert filipelautert restored the dependabot/maven/liquibase-standard/org.apache.derby-derby-10.17.1.0 branch December 6, 2023 13:09
@filipelautert filipelautert reopened this Dec 6, 2023
Bumps org.apache.derby:derby from 10.14.2.0 to 10.17.1.0.

---
updated-dependencies:
- dependency-name: org.apache.derby:derby
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@filipelautert filipelautert force-pushed the dependabot/maven/liquibase-standard/org.apache.derby-derby-10.17.1.0 branch from d753492 to f87067c Compare December 6, 2023 13:09
The Apache Derby database has been replaced with H2 in the LiquibaseServletListener test class. This was done primarily because now derby is in a different package (derby-tools) that is not included with liquibase. Replaced all instances of Derby database configuration with the equivalent for H2 and renamed the related test method appropriately.
The Apache Derby dependency, which was scoped for testing, has been removed from the project's POM file and the tests that used it are now using H2.
Derby package for java 8 (version 10.14.x) has a security issue (CVE-2022-46337) that is going to be fixed on series 10.17.x only that requires java 21.
Thus this testing dependency is being removed.
@filipelautert filipelautert changed the title Bump org.apache.derby:derby from 10.14.2.0 to 10.17.1.0 in /liquibase-standard Remove Apache Derby test dependency from pom.xml Dec 6, 2023
@filipelautert filipelautert merged commit 6ba8926 into master Dec 6, 2023
28 of 30 checks passed
@filipelautert filipelautert deleted the dependabot/maven/liquibase-standard/org.apache.derby-derby-10.17.1.0 branch December 6, 2023 14:43
@filipelautert filipelautert added this to the 1NEXT milestone Dec 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file java Pull requests that update Java code SafeToBuild Indicates that a particular PR contains changes which are safe to build using GitHub actions sdou Security, Driver and other updates
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

None yet

1 participant