#476 Fix vulnerability CVE-2023-4759 in dependency org.eclipse.jgit:org.eclipse.jgit

doc/changes/changes_2.9.12.md

@@ -0,0 +1,67 @@
+# Project Keeper 2.9.12, released 2023-09-25
+
+Code name: Fix vulnerability CVE-2023-4759
+
+## Summary
+
+This release fixes vulnerability CVE-2023-4759 in dependency `org.eclipse.jgit:org.eclipse.jgit`.
+
+## Security
+
+* #476: Fixed vulnerability CVE-2023-4759 in dependency `org.eclipse.jgit:org.eclipse.jgit`
+
+## Dependency Updates
+
+### Project-Keeper Shared Model Classes
+
+#### Compile Dependency Updates
+
+* Updated `org.eclipse.jgit:org.eclipse.jgit:6.6.0.202305301015-r` to `6.7.0.202309050840-r`
+
+#### Test Dependency Updates
+
+* Updated `nl.jqno.equalsverifier:equalsverifier:3.15.1` to `3.15.2`
+
+### Project Keeper Core
+
+#### Compile Dependency Updates
+
+* Updated `com.exasol:project-keeper-shared-model-classes:2.9.11` to `2.9.12`
+
+#### Runtime Dependency Updates
+
+* Updated `com.exasol:project-keeper-java-project-crawler:2.9.11` to `2.9.12`
+
+#### Test Dependency Updates
+
+* Updated `com.exasol:project-keeper-shared-test-setup:2.9.11` to `2.9.12`
+* Updated `nl.jqno.equalsverifier:equalsverifier:3.15.1` to `3.15.2`
+
+### Project Keeper Command Line Interface
+
+#### Compile Dependency Updates
+
+* Updated `com.exasol:project-keeper-core:2.9.11` to `2.9.12`
+
+#### Test Dependency Updates
+
+* Updated `com.exasol:project-keeper-shared-test-setup:2.9.11` to `2.9.12`
+
+### Project Keeper Maven Plugin
+
+#### Compile Dependency Updates
+
+* Updated `com.exasol:project-keeper-core:2.9.11` to `2.9.12`
+
+### Project Keeper Java Project Crawler
+
+#### Compile Dependency Updates
+
+* Updated `com.exasol:project-keeper-shared-model-classes:2.9.11` to `2.9.12`
+* Updated `org.eclipse.jgit:org.eclipse.jgit:6.6.0.202305301015-r` to `6.7.0.202309050840-r`
+
+### Project Keeper Shared Test Setup
+
+#### Compile Dependency Updates
+
+* Updated `com.exasol:project-keeper-shared-model-classes:2.9.11` to `2.9.12`

parent-pom/pom.xml

@@ -28,7 +28,7 @@
         </repository>
     </distributionManagement>
     <properties>
-        <revision>2.9.11</revision>
+        <revision>2.9.12</revision>
         <maven.version>3.9.4</maven.version>
         <junit.version>5.10.0</junit.version>
         <xmlunit.version>2.9.1</xmlunit.version>
@@ -104,7 +104,7 @@
             <dependency>
                 <groupId>org.eclipse.jgit</groupId>
                 <artifactId>org.eclipse.jgit</artifactId>
-                <version>6.6.0.202305301015-r</version>
+                <version>6.7.0.202309050840-r</version>
             </dependency>
             <dependency>
                 <groupId>net.steppschuh.markdowngenerator</groupId>
@@ -161,7 +161,7 @@
             <dependency>
                 <groupId>org.slf4j</groupId>
                 <artifactId>slf4j-jdk14</artifactId>
-                <version>1.7.36</version>
+                <version>1.7.36</version> <!-- Version 1.7.x required to fix error 'SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".' -->
                 <scope>test</scope>
             </dependency>
             <dependency>
@@ -197,7 +197,7 @@
             <dependency>
                 <groupId>nl.jqno.equalsverifier</groupId>
                 <artifactId>equalsverifier</artifactId>
-                <version>3.15.1</version>
+                <version>3.15.2</version>
                 <scope>test</scope>
             </dependency>
             <!-- overriding vulnerable version -->

shared-model-classes/pom.xml

@@ -10,6 +10,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>project-keeper-shared-model-classes</artifactId>
     <name>Project-Keeper shared model classes</name>
+    <url>https://github.com/exasol/project-keeper/</url>
     <dependencies>
         <dependency>
             <groupId>jakarta.json</groupId>
@@ -69,5 +70,4 @@
             <scope>test</scope>
         </dependency>
     </dependencies>
-    <url>https://github.com/exasol/project-keeper/</url>
 </project>