Sync PR

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,83 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ master, development, patch/*, release/*, hotfix/* ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ master ]
+  schedule:
+    - cron: '21 1 * * 4'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'java' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Learn more about CodeQL language support at https://git.io/codeql-language-support
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+    - name: Set up JDK 1.8
+      uses: actions/setup-java@v1
+      with:
+        java-version: 1.8
+        settings-path: ${{ github.workspace }}
+
+    - name: Load local Maven repository cache
+      uses: actions/cache@v2
+      with:
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            ${{ runner.os }}-maven-
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v1
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v1
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 https://git.io/JvXDl
+
+    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+    #    and modify them (or add more) to build your code if your project
+    #    uses a compiled language
+
+    #- run: |
+    #   make bootstrap
+    #   make release
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v1

.gitignore

@@ -35,3 +35,6 @@ logs/
 # Properties, which may contain sensitive information
 **/developer.properties
 **/local.properties
+
+# Vaadin compiled style
+**/mytheme/styles.css

CHANGELOG.rst

@@ -16,6 +16,74 @@ This project adheres to `Semantic Versioning <https://semver.org/>`_.
 **Deprecated**
 
 
+1.12.5 (2021-12-20)
+-------------------
+
+**Added**
+
+**Fixed**
+
+**Dependencies**
+
+* org.apache.logging.log4j 2.16.0 -> 2.17.0 (addresses CVE-2021-45105)
+
+**Deprecated**
+
+1.12.4 (2021-12-16)
+-------------------
+
+**Added**
+
+**Fixed**
+
+**Dependencies**
+
+* org.apache.logging.log4j 2.15.0 -> 2.16.0 (addresses CVE-2021-45046)
+
+**Deprecated**
+
+1.12.3 (2021-11-13)
+-------------------
+
+**Added**
+
+**Fixed**
+
+**Dependencies**
+
+* org.apache.logging.log4j 2.13.2 -> 2.15.0 (addresses CVE-2021-44228)
+
+**Deprecated**
+
+
+1.12.2 (2021-11-02)
+-------------------
+
+**Added**
+
+**Fixed**
+
+**Dependencies**
+
+* `com.vaadin:7.7.17` -> `7.7.28` (addresses CVE-2021-37714)
+
+**Deprecated**
+
+
+1.12.1 (2021-06-11)
+-------------------
+
+**Added**
+
+**Fixed**
+
+* Correctly replace selected vocabulary values for Cell Lysis in metabolomics import (`#32 <https://github.com/qbicsoftware/projectwizard-portlet/pull/32>`_)
+
+**Dependencies**
+
+**Deprecated**
+
+
 1.12.0 (2021-06-07)
 -------------------
 

pom.xml

@@ -6,7 +6,7 @@
 	<artifactId>projectwizard-portlet</artifactId>
 	<version>1.13.0-SNAPSHOT</version>
 	<name>ProjectWizard Portlet</name>
-	<url>http://github.com/qbicsoftware/projectwizard-portlet</url>
+	<url>https://github.com/qbicsoftware/projectwizard-portlet</url>
 	<description>Creates hierarchical experiments using factorial design.</description>
 	<packaging>war</packaging>
 	<parent>
@@ -15,8 +15,9 @@
 		<version>3.1.4</version>
 	</parent>
 	<properties>
-		<vaadin.version>7.7.17</vaadin.version>
-		<vaadin.plugin.version>7.7.17</vaadin.plugin.version>
+		<vaadin.version>7.7.28</vaadin.version>
+		<vaadin.plugin.version>7.7.28</vaadin.plugin.version>
+		<log4j.version>2.17.0</log4j.version>
 	</properties>
 	<repositories>
 		<repository>
@@ -72,6 +73,16 @@
 		</repository>
 	</repositories>
 	<dependencies>
+		<dependency>
+			<groupId>org.apache.logging.log4j</groupId>
+			<artifactId>log4j-core</artifactId>
+			<version>${log4j.version}</version>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.logging.log4j</groupId>
+			<artifactId>log4j-api</artifactId>
+			<version>${log4j.version}</version>
+		</dependency>
 		<dependency>
 			<groupId>life.qbic</groupId>
 			<artifactId>core-utils-lib</artifactId>