Bump snakeyaml version to 2.2 to eliminate critical CVE-2022-1471

.github/workflows/manual-release.yml

@@ -0,0 +1,45 @@
+name: Manual Release
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'The version to release'
+        required: true
+        default: '1.20.4.Fiserv'
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: ./.github/actions/setup-java
+
+      - name: Clear existing docker image cache
+        run: docker image prune -af
+
+      - name: Setup Gradle Build Action
+        uses: gradle/actions/setup-gradle@v3
+
+      - name: Set Version
+        run: echo "VERSION=${{ github.event.inputs.version || github.event.release.tag_name }}" >> $GITHUB_ENV
+
+      - name: Run Gradle Build
+        run: ./gradlew build --scan --no-daemon -i -x test
+
+      - name: Run Gradle Publish
+        run: |
+          ./gradlew :testcontainers:publish \
+            -Pversion="${{ github.event.inputs.version }}" --scan --no-daemon -i
+
+      - name: Upload Release Artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-artifacts
+          path: core/build/release-artifact

core/build.gradle

@@ -63,8 +63,8 @@ tasks.japicmp {
 configurations.all {
     resolutionStrategy {
         // use lower Jackson version
-        force 'com.fasterxml.jackson.core:jackson-databind:2.8.8'
-        force 'com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.8.8'
+        force 'com.fasterxml.jackson.core:jackson-databind:2.18.1'
+        force 'com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.1'
     }
 }
 
@@ -100,7 +100,7 @@ dependencies {
     api 'com.github.docker-java:docker-java-transport-zerodep'
 
     shaded 'com.google.guava:guava:33.3.1-jre'
-    shaded "org.yaml:snakeyaml:1.33"
+    shaded "org.yaml:snakeyaml:2.3"
 
     shaded 'org.glassfish.main.external:trilead-ssh2-repackaged:4.1.2'
 

gradle/publishing.gradle

@@ -1,7 +1,7 @@
 apply plugin: 'maven-publish'
 
 task sourceJar(type: Jar) {
-    archiveClassifier.set( 'sources')
+    archiveClassifier.set('sources')
     from sourceSets.main.allJava
 }
 
@@ -57,7 +57,7 @@ publishing {
 
                 def dependenciesNode = rootNode.appendNode('dependencies')
 
-                def apiDeps= project.configurations.api.resolvedConfiguration.firstLevelModuleDependencies
+                def apiDeps = project.configurations.api.resolvedConfiguration.firstLevelModuleDependencies
                 def providedDeps = project.configurations.provided.resolvedConfiguration.firstLevelModuleDependencies
                 def newApiDeps = apiDeps - providedDeps
 
@@ -95,11 +95,7 @@ publishing {
     }
     repositories {
         maven {
-            url("https://oss.sonatype.org/service/local/staging/deploy/maven2")
-            credentials {
-                username = System.getenv("OSSRH_USERNAME")
-                password = System.getenv("OSSRH_PASSWORD")
-            }
+            url = uri("${project(':testcontainers').buildDir}/release-artifact")
         }
     }
-}
+}

modules/k3s/build.gradle

@@ -3,10 +3,9 @@ description = "Testcontainers :: K3S"
 dependencies {
     api project(":testcontainers")
 
-    // https://youtu.be/otCpCn0l4Wo
-    // The core module depends on jackson-databind 2.8.x for backward compatibility.
-    // Any >2.8 version here is not compatible with jackson-databind 2.8.x.
-    shaded 'com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.8.8'
+    // The version of jackson-dataformats must match the version of jackson.
+    // Artifact previously resided with different name prior to version 2.9
+    shaded 'com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.1'
 
     testImplementation 'io.fabric8:kubernetes-client:6.13.1'
     testImplementation 'io.kubernetes:client-java:21.0.1-legacy'