Merge pull request #137 from qbicsoftware/hotfix/1.3.4

Sync Hotfix 1.3.4

Author: jenniferboedker

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,83 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ master, development, patch/*, release/*, hotfix/* ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ master ]
+  schedule:
+    - cron: '21 1 * * 4'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'java' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Learn more about CodeQL language support at https://git.io/codeql-language-support
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+    - name: Set up JDK 1.8
+      uses: actions/setup-java@v1
+      with:
+        java-version: 1.8
+        settings-path: ${{ github.workspace }}
+
+    - name: Load local Maven repository cache
+      uses: actions/cache@v2
+      with:
+        path: ~/.m2/repository
+        key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+        restore-keys: |
+          ${{ runner.os }}-maven-
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v1
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v1
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 https://git.io/JvXDl
+
+    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+    #    and modify them (or add more) to build your code if your project
+    #    uses a compiled language
+
+    #- run: |
+    #   make bootstrap
+    #   make release
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v1

.github/workflows/qube_lint.yml

@@ -4,6 +4,50 @@ Changelog
 
 This project adheres to `Semantic Versioning <https://semver.org/>`_.
 
+1.4.0-SNAPSHOT (2021-12-22)
+---------------------------
+
+**Added**
+
+**Fixed**
+
+**Dependencies**
+
+**Deprecated**
+
+1.3.4 (2021-12-22)
+------------------
+
+**Added**
+
+**Fixed**
+
+* CVE-2021-45105
+
+**Dependencies**
+
+* org.apache.logging.log4j 2.16.0 -> 2.17.0
+
+**Deprecated**
+
+1.3.3 (2021-12-15)
+------------------
+
+**Added**
+
+**Fixed**
+
+* CVE-2021-45046
+
+**Dependencies**
+
+* com.vaadin.* 8.14.0 -> 8.14.3
+* org.apache.logging.log4j 2.15.0 -> 2.16.0
+* org.codehaus.groovy.* 3.0.7 -> 3.0.9
+* org.mariadb.jdbc:mariadb-java-client 2.0.2 -> 2.7.3
+
+**Deprecated**
+
 
 1.4.0-SNAPSHOT (2021-11-02)
 ---------------------------

.github/workflows/sync_project.yml

@@ -9,10 +9,6 @@ sample-tracking-update-portlet
     :target: https://github.com/qbicsoftware/sample-tracking-update-portlet/workflows/Run%20Maven%20Tests/badge.svg
     :alt: Github Workflow Tests Status
 
-.. image:: https://github.com/qbicsoftware/sample-tracking-update-portlet/workflows/QUBE%20lint/badge.svg
-    :target: https://github.com/qbicsoftware/sample-tracking-update-portlet/workflows/QUBE%20lint/badge.svg
-    :alt: qube Lint Status
-
 .. image:: https://readthedocs.org/projects/sample-tracking-update-portlet/badge/?version=latest
     :target: https://sample-tracking-update-portlet.readthedocs.io/en/latest/?badge=latest
     :alt: Documentation Status

.qube.yml

@@ -55,9 +55,9 @@
 # the built documents.
 #
 # The short X.Y version.
-version = '1.4.0-SNAPSHOT'
+version = '1.3.4'
 # The full version, including alpha/beta/rc tags.
-release = '1.4.0-SNAPSHOT'
+release = '1.3.4'
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.

CHANGELOG.rst

@@ -10,15 +10,15 @@
 		<version>3.1.4</version>
 	</parent>
 	<artifactId>sample-tracking-update-portlet</artifactId>
-	<version>1.4.0-SNAPSHOT</version> <!-- <<QUBE_FORCE_BUMP>> -->
+	<version>1.4.0-SNAPSHOT</version>
 	<name>Sample Tracking Update Portlet</name>
 	<url>http://github.com/qbicsoftware/sample-tracking-update-portlet</url>
 	<description>This application provides functionality to update and set the location and status of specific samples</description>
 	<packaging>war</packaging>
 	<properties>
-		<vaadin.version>8.14.0</vaadin.version>
-		<vaadin.plugin.version>8.14.0</vaadin.plugin.version>
-		<log4j.version>2.15.0</log4j.version>
+		<vaadin.version>8.14.3</vaadin.version>
+		<vaadin.plugin.version>8.14.3</vaadin.plugin.version>
+		<log4j.version>2.17.0</log4j.version>
 	</properties>
 	<!-- Since no distribution management was specified,
 	we need to explicitly set a dummy example here to allow for correct site generation-->
@@ -115,18 +115,23 @@
 		<dependency>
 			<groupId>org.codehaus.groovy</groupId>
 			<artifactId>groovy-all</artifactId>
-			<version>3.0.7</version>
+			<version>3.0.9</version>
 			<type>pom</type>
 		</dependency>
+		<dependency>
+			<groupId>org.codehaus.groovy</groupId>
+			<artifactId>groovy</artifactId>
+			<version>3.0.9</version>
+		</dependency>
 		<dependency>
 			<groupId>org.codehaus.groovy</groupId>
 			<artifactId>groovy-sql</artifactId>
-			<version>3.0.7</version>
+			<version>3.0.9</version>
 		</dependency>
 		<dependency>
 			<groupId>org.codehaus.groovy</groupId>
 			<artifactId>groovy-json</artifactId>
-			<version>3.0.7</version>
+			<version>3.0.9</version>
 		</dependency>
 		<!-- Necessary since switch to Java 11 -->
 		<dependency>
@@ -143,13 +148,13 @@
 		</dependency>
 
 
-
 		<!-- Access to our custom databases (portlets use direct JDBC to access data for now),
 			 but we will create a client library that portlets will use
 			 (version  is defined in the parent POM hierarchy (/portal/pom.xml)) -->
 		<dependency>
 			<groupId>org.mariadb.jdbc</groupId>
 			<artifactId>mariadb-java-client</artifactId>
+			<version>2.7.3</version>
 		</dependency>
 
 		<!-- for access to endpoints -->