Skip to content

Commit 3760ea4

Browse files
sheyanjie-taosCopilot
sheyanjie-taos
and
Copilot
committed
chore: fix security alerts and align pom dependency properties
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent ec9846c commit 3760ea4

4 files changed

Lines changed: 54 additions & 23 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@ on:
1818
- '*.md'
1919
- '*.txt'
2020

21+
permissions:
22+
contents: read
23+
2124
jobs:
2225
build:
2326
strategy:
@@ -85,4 +88,3 @@ jobs:
8588
verbose: true
8689

8790

88-

‎.github/workflows/release.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ on:
44
pull_request:
55
branches: [ release ]
66

7+
permissions:
8+
contents: write
9+
710
jobs:
811
build:
912
strategy:
@@ -27,4 +30,4 @@ jobs:
2730

2831
# Optional: Uploads the full dependency graph to GitHub to improve the quality of Dependabot alerts this repository can receive
2932
- name: Update dependency graph
30-
uses: advanced-security/maven-dependency-submission-action@571e99aab1055c2e71a1e2309b9691de18d6b7d6
33+
uses: advanced-security/maven-dependency-submission-action@571e99aab1055c2e71a1e2309b9691de18d6b7d6

‎deploy-pom.xml‎

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,9 @@
4646
<scala.binary.version>2.12</scala.binary.version>
4747
<maven-compiler-plugin.version>3.6.0</maven-compiler-plugin.version>
4848
<hamcrest.version>1.3</hamcrest.version>
49-
<jackson.version>2.18.0</jackson.version>
49+
<jackson.version>2.18.6</jackson.version>
50+
<log4j.version>2.25.4</log4j.version>
51+
<lz4.version>1.10.3</lz4.version>
5052
<taos.jdbcdriver.version>3.8.1</taos.jdbcdriver.version>
5153
</properties>
5254

@@ -77,12 +79,12 @@
7779
<dependency>
7880
<groupId>org.apache.logging.log4j</groupId>
7981
<artifactId>log4j-api</artifactId>
80-
<version>2.17.1</version>
82+
<version>${log4j.version}</version>
8183
</dependency>
8284
<dependency>
8385
<groupId>org.apache.logging.log4j</groupId>
8486
<artifactId>log4j-core</artifactId>
85-
<version>2.17.1</version>
87+
<version>${log4j.version}</version>
8688
</dependency>
8789

8890
<dependency>
@@ -95,13 +97,7 @@
9597
<dependency>
9698
<groupId>at.yawk.lz4</groupId>
9799
<artifactId>lz4-java</artifactId>
98-
<version>1.10.3</version>
99-
</dependency>
100-
<!-- Fallback: ensure org.lz4 declarations use version that will relocate -->
101-
<dependency>
102-
<groupId>org.lz4</groupId>
103-
<artifactId>lz4-java</artifactId>
104-
<version>1.8.1</version>
100+
<version>${lz4.version}</version>
105101
</dependency>
106102
</dependencies>
107103
</dependencyManagement>
@@ -117,6 +113,17 @@
117113
<groupId>org.apache.flink</groupId>
118114
<artifactId>flink-streaming-java</artifactId>
119115
<version>${flink.version}</version>
116+
<exclusions>
117+
<exclusion>
118+
<groupId>org.lz4</groupId>
119+
<artifactId>lz4-java</artifactId>
120+
</exclusion>
121+
</exclusions>
122+
</dependency>
123+
124+
<dependency>
125+
<groupId>at.yawk.lz4</groupId>
126+
<artifactId>lz4-java</artifactId>
120127
</dependency>
121128

122129
<dependency>
@@ -192,6 +199,12 @@
192199
<version>${flink.version}</version>
193200
<type>test-jar</type>
194201
<scope>test</scope>
202+
<exclusions>
203+
<exclusion>
204+
<groupId>org.lz4</groupId>
205+
<artifactId>lz4-java</artifactId>
206+
</exclusion>
207+
</exclusions>
195208
</dependency>
196209

197210
<dependency>

‎pom.xml‎

Lines changed: 24 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,9 @@
4444
<scala.binary.version>2.12</scala.binary.version>
4545
<maven-compiler-plugin.version>3.6.0</maven-compiler-plugin.version>
4646
<hamcrest.version>1.3</hamcrest.version>
47-
<jackson.version>2.18.0</jackson.version>
47+
<jackson.version>2.18.6</jackson.version>
48+
<log4j.version>2.25.4</log4j.version>
49+
<lz4.version>1.10.3</lz4.version>
4850
<taos.jdbcdriver.version>3.8.1</taos.jdbcdriver.version>
4951
</properties>
5052

@@ -75,12 +77,12 @@
7577
<dependency>
7678
<groupId>org.apache.logging.log4j</groupId>
7779
<artifactId>log4j-api</artifactId>
78-
<version>2.17.1</version>
80+
<version>${log4j.version}</version>
7981
</dependency>
8082
<dependency>
8183
<groupId>org.apache.logging.log4j</groupId>
8284
<artifactId>log4j-core</artifactId>
83-
<version>2.17.1</version>
85+
<version>${log4j.version}</version>
8486
</dependency>
8587
<dependency>
8688
<groupId>org.apache.commons</groupId>
@@ -92,13 +94,7 @@
9294
<dependency>
9395
<groupId>at.yawk.lz4</groupId>
9496
<artifactId>lz4-java</artifactId>
95-
<version>1.10.3</version>
96-
</dependency>
97-
<!-- Fallback: ensure org.lz4 declarations use version that will relocate -->
98-
<dependency>
99-
<groupId>org.lz4</groupId>
100-
<artifactId>lz4-java</artifactId>
101-
<version>1.8.1</version>
97+
<version>${lz4.version}</version>
10298
</dependency>
10399
</dependencies>
104100
</dependencyManagement>
@@ -114,6 +110,17 @@
114110
<groupId>org.apache.flink</groupId>
115111
<artifactId>flink-streaming-java</artifactId>
116112
<version>${flink.version}</version>
113+
<exclusions>
114+
<exclusion>
115+
<groupId>org.lz4</groupId>
116+
<artifactId>lz4-java</artifactId>
117+
</exclusion>
118+
</exclusions>
119+
</dependency>
120+
121+
<dependency>
122+
<groupId>at.yawk.lz4</groupId>
123+
<artifactId>lz4-java</artifactId>
117124
</dependency>
118125

119126
<!-- Connectors -->
@@ -191,6 +198,12 @@
191198
<version>${flink.version}</version>
192199
<type>test-jar</type>
193200
<scope>test</scope>
201+
<exclusions>
202+
<exclusion>
203+
<groupId>org.lz4</groupId>
204+
<artifactId>lz4-java</artifactId>
205+
</exclusion>
206+
</exclusions>
194207
</dependency>
195208

196209
<dependency>
@@ -360,4 +373,4 @@
360373
</build>
361374

362375

363-
</project>
376+
</project>

0 commit comments

Comments
 (0)