Merge pull request #620 from lesserwhirls/release_5_6_2

Release 5.6.2

Author: lesserwhirls

build.gradle.kts

@@ -15,5 +15,5 @@
 
 tasks.wrapper {
     // to upgrade the gradle wrapper, bump the version below and run ./gradlew wrapper twice
-    gradleVersion = "8.1.1"
+    gradleVersion = "8.3"
 }

gradle/wrapper/gradle-wrapper.jar

@@ -1,6 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.1.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.3-bin.zip
 networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,7 @@
 #!/bin/sh
 
 #
-# Copyright © 2015-2023 the original authors.
+# Copyright © 2015-2021 the original authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -83,7 +83,8 @@ done
 # This is normally unused
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -130,10 +131,13 @@ location of your Java installation."
     fi
 else
     JAVACMD=java
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
+    fi
 fi
 
 # Increase the maximum file descriptors if we can.

gradlew

@@ -16,18 +16,18 @@
 #
 # project version
 #
-ds3SdkVersion = "5.6.1-SNAPSHOT"
+ds3SdkVersion = "5.6.3-SNAPSHOT"
 #
 # dependency versions
 #
 commonsLang3Version = "3.12.0"
 commonsCodecVersion = "1.15"
 commonsIoVersion = "2.11.0"
 findbugsVersion = "3.0.1"
-guavaVersion = "31.1-jre"
+guavaVersion = "32.1.2-jre"
 hamcrestVersion = "2.2"
 httpclientVersion = "4.5.13"
-jacksonVersion = "2.14.2"
+jacksonVersion = "2.15.2"
 jnaVersion = "5.12.1"
 junitJupiterVersion = "5.9.0"
 junitVersion = "4.13.2"
@@ -70,10 +70,10 @@ slf4jSimple = { group = "org.slf4j", name = "slf4j-simple", version.ref = "slf4j
 # plugins used in buildSrc/
 #
 kotlinJvmPlugin = { group = "org.jetbrains.kotlin", name = "kotlin-gradle-plugin", version.ref = "kotlinVersion" }
-owaspDepCheckPlugin = { group = "org.owasp", name = "dependency-check-gradle", version = "8.1.2" }
-versionsPlugin = { group = "com.github.ben-manes", name = "gradle-versions-plugin", version = "0.46.0" }
+owaspDepCheckPlugin = { group = "org.owasp", name = "dependency-check-gradle", version = "8.4.0" }
+versionsPlugin = { group = "com.github.ben-manes", name = "gradle-versions-plugin", version = "0.47.0" }
 
 [plugins]
-gradleDepVers = { id = "com.github.ben-manes.versions", version = "0.46.0" }
+gradleDepVers = { id = "com.github.ben-manes.versions", version = "0.47.0" }
 gitVersionPlugin = { id = "com.palantir.git-version", version = "0.12.2" } # stuck on this version until we move from building with java 8
 shadowPlugin = { id = "com.github.johnrengelman.shadow", version = "7.1.2" }

libs.versions.toml

@@ -7,4 +7,15 @@
     <packageUrl regex="true">^(?!pkg:maven/commons-net/commons-net).*$</packageUrl>
     <cpe>cpe:/a:apache:commons_net</cpe>
   </suppress>
+  <suppress>
+    <notes><![CDATA[
+    file name: jackson-databind-2.15.2.jar
+    reason: DISPUTED: the vendor's perspective is that this is not a valid vulnerability report, because
+            the steps of constructing a cyclic data structure and trying to serialize it cannot be
+            achieved by an external attacker. See:
+            https://github.com/FasterXML/jackson-databind/issues/3972
+    ]]></notes>
+    <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$</packageUrl>
+    <cve>CVE-2023-35116</cve>
+  </suppress>
 </suppressions>

project_files/owasp/dependency-check-suppression.xml

@@ -14,7 +14,7 @@
  */
 
 plugins {
-    id("org.gradle.toolchains.foojay-resolver-convention").version("0.5.0")
+    id("org.gradle.toolchains.foojay-resolver-convention").version("0.7.0")
 }
 
 rootProject.name = "ds3-java-sdk"