Merge pull request #83 from pmonks/dev

pmonks · Jan 17, 2024 · d59f7b8 · d59f7b8
2 parents 4a67bad + e178114
commit d59f7b8
Show file tree

Hide file tree

Showing 7 changed files with 24 additions and 21 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -22,10 +22,10 @@ jobs:
         with:
           distribution: 'temurin'
           java-version: 21
-      - uses: DeLaGuardo/setup-clojure@12.1
+      - uses: DeLaGuardo/setup-clojure@12.3
         with:
           cli: latest
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         with:
           path: |
             ~/.m2/repository

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -17,10 +17,10 @@ jobs:
         with:
           distribution: 'temurin'
           java-version: 21
-      - uses: DeLaGuardo/setup-clojure@12.1
+      - uses: DeLaGuardo/setup-clojure@12.3
         with:
           cli: latest
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         with:
           path: |
             ~/.m2/repository

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -14,10 +14,10 @@ jobs:
         with:
           distribution: 'temurin'
           java-version: 21
-      - uses: DeLaGuardo/setup-clojure@12.1
+      - uses: DeLaGuardo/setup-clojure@12.3
         with:
           cli: latest
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         with:
           path: |
             ~/.m2/repository

diff --git a/.github/workflows/vulnerabilities.yml b/.github/workflows/vulnerabilities.yml
@@ -25,10 +25,10 @@ jobs:
         with:
           distribution: 'temurin'
           java-version: 21
-      - uses: DeLaGuardo/setup-clojure@12.1
+      - uses: DeLaGuardo/setup-clojure@12.3
         with:
           cli: latest
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         with:
           path: |
             ~/.m2/repository

diff --git a/deps.edn b/deps.edn
@@ -19,7 +19,7 @@
 {:paths ["src" "resources"]
  :deps
    {org.clojure/clojure                        {:mvn/version "1.11.1"}
-    org.clojure/tools.deps                     {:mvn/version "0.18.1374"}
+    org.clojure/tools.deps                     {:mvn/version "0.18.1398"}
     org.clojure/data.json                      {:mvn/version "2.5.0"}
     slipset/deps-deploy                        {:mvn/version "0.2.2" :exclusions [org.slf4j/slf4j-nop ch.qos.logback/logback-classic]}
     io.github.clojure/tools.build              {:mvn/version "0.9.6" :exclusions [org.slf4j/slf4j-nop]}
@@ -32,18 +32,18 @@
     org.springframework.build/aws-maven        {:mvn/version "4.8.0.RELEASE"}    ; Note: do NOT upgrade to 5.0.0.RELEASE or deps-deploy throws a ClassDefNotFoundException
 
     ; Dynamic dependencies - any time any of these changes it MUST ALSO BE CHANGED IN pbr.tasks!!
-    org.apache.logging.log4j/log4j-api         {:mvn/version "2.22.0"}    ; Use log4j2 for logging, since logback has become a huge pita in recent times...
-    org.apache.logging.log4j/log4j-core        {:mvn/version "2.22.0"}
-    org.apache.logging.log4j/log4j-jul         {:mvn/version "2.22.0"}    ; Java utils clogging bridge
-    org.apache.logging.log4j/log4j-jcl         {:mvn/version "2.22.0"}    ; Apache commons clogging bridge
-    org.apache.logging.log4j/log4j-slf4j2-impl {:mvn/version "2.22.0"}    ; SLF4J clogging bridge
-    org.apache.logging.log4j/log4j-1.2-api     {:mvn/version "2.22.0"}    ; log4j1 clogging bridge
-;    org.slf4j/slf4j-nop                        {:mvn/version "2.0.9"}    ; Note: used for some commands invoked as sub-processes, but can't be used here or it will shadow log4j2
+    org.apache.logging.log4j/log4j-api         {:mvn/version "2.22.1"}    ; Use log4j2 for logging, since logback has become a huge pita in recent times...
+    org.apache.logging.log4j/log4j-core        {:mvn/version "2.22.1"}
+    org.apache.logging.log4j/log4j-jul         {:mvn/version "2.22.1"}    ; Java utils clogging bridge
+    org.apache.logging.log4j/log4j-jcl         {:mvn/version "2.22.1"}    ; Apache commons clogging bridge
+    org.apache.logging.log4j/log4j-slf4j2-impl {:mvn/version "2.22.1"}    ; SLF4J clogging bridge
+    org.apache.logging.log4j/log4j-1.2-api     {:mvn/version "2.22.1"}    ; log4j1 clogging bridge
+;    org.slf4j/slf4j-nop                        {:mvn/version "2.0.10"}    ; Note: used for some commands invoked as sub-processes, but can't be used here or it will shadow log4j2
     jonase/eastwood                            {:mvn/version "1.4.0"}     ; Note: 1.4.2 uses a version of org.ow2.asm/asm that's incompatible with clj-kondo's dependent version
     codox/codox                                {:mvn/version "0.10.8"}
     com.github.athos/clj-check                 {:git/sha "518d5a1cbfcd7c952f548e6dbfcb9a4a5faf9062"}
     io.github.cognitect-labs/test-runner       {:git/tag "v0.5.1" :git/sha "dfb30dd"}
-    com.github.liquidz/antq                    {:mvn/version "2.7.1147"}}
+    com.github.liquidz/antq                    {:mvn/version "2.8.1173"}}
  :aliases
    {:build {:deps       {com.github.pmonks/pbr {:local/root "."}}
             :ns-default pbr.build}}}
diff --git a/pbr.clj b/pbr.clj
@@ -27,7 +27,7 @@
          :validate-pom true
          :pom          {:description      "Peter's Build Resources for Clojure tools.build projects."
                         :url              "https://github.com/pmonks/pbr"
-                        :licenses         [:license   {:name "Apache License 2.0" :url "http://www.apache.org/licenses/LICENSE-2.0.html"}]
+                        :licenses         [:license   {:name "Apache-2.0" :url "http://www.apache.org/licenses/LICENSE-2.0.html"}]
                         :developers       [:developer {:id "pmonks" :name "Peter Monks" :email "pmonks+pbr@gmail.com"}]
                         :scm              {:url                  "https://github.com/pmonks/pbr"
                                            :connection           "scm:git:git://github.com/pmonks/pbr.git"

diff --git a/src/pbr/tasks.clj b/src/pbr/tasks.clj
@@ -32,11 +32,11 @@
 
 (def ^:private ver-clj-check   {:git/sha "518d5a1cbfcd7c952f548e6dbfcb9a4a5faf9062"})
 (def ^:private ver-test-runner {:git/tag "v0.5.1" :git/sha "dfb30dd"})
-(def ^:private ver-slf4j       {:mvn/version "2.0.9"})
-(def ^:private ver-log4j2      {:mvn/version "2.22.0"})
+(def ^:private ver-slf4j       {:mvn/version "2.0.10"})
+(def ^:private ver-log4j2      {:mvn/version "2.22.1"})
 (def ^:private ver-eastwood    {:mvn/version "1.4.0"})
 (def ^:private ver-codox       {:mvn/version "0.10.8"})
-(def ^:private ver-antq        {:mvn/version "2.7.1147"})
+(def ^:private ver-antq        {:mvn/version "2.8.1173"})
 
 ; Utility functions
 
@@ -367,6 +367,8 @@
 
   :nvd -- opt: a map containing nvd-clojure-specific configuration options. See https://github.com/rm-hull/nvd-clojure#configuration-options"
   [opts]
+  (when (s/blank? (System/getenv "NVD_API_TOKEN"))
+    (throw (ex-info "The NVD_API_TOKEN environment variable was not set. See https://github.com/rm-hull/nvd-clojure#configuration-options for more details about how to obtain an NVD API key." {})))
   (println "ℹ️ Running NVD vulnerability checker (this can take a while)...")
   (flush)
   ; Notes: NVD *cannot* be run in a directory containing a deps.edn, as this "pollutes" the classpath of the JVM it's running in; something it is exceptionally sensitive to.
@@ -383,6 +385,7 @@
     (try
       (delete-dir      output-dir)
       (delete-dir      ".nvd")
+      (io/make-parents (str output-dir "/dummy-child.txt"))
       (io/make-parents ".nvd/.")
       (spit ".nvd/nvd-options.json"
             (json/write-str {:delete-config? false