Merge branch 'release/1.2.5'

cryptomator · Feb 5, 2024 · 6c08f95 · 6c08f95
2 parents ea24cea + b531fcc
commit 6c08f95
Show file tree

Hide file tree

Showing 9 changed files with 66 additions and 37 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -3,15 +3,31 @@ updates:
   - package-ecosystem: "maven"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
       day: "monday"
       time: "06:00"
-      timezone: "UTC"
+      timezone: "Etc/UTC"
     groups:
-      maven-dependencies:
+      java-test-dependencies:
+        patterns:
+          - "org.junit.jupiter:*"
+          - "org.mockito:*"
+      maven-build-plugins:
+        patterns:
+          - "org.apache.maven.plugins:*"
+          - "org.owasp:dependency-check-maven"
+          - "org.sonatype.plugins:nexus-staging-maven-plugin"
+          - "org.codehaus.mojo:exec-maven-plugin"
+      java-production-dependencies:
         patterns:
           - "*"
-
+        exclude-patterns:
+          - "org.junit.jupiter:*"
+          - "org.mockito:*"
+          - "org.apache.maven.plugins:*"
+          - "org.owasp:dependency-check-maven"
+          - "org.sonatype.plugins:nexus-staging-maven-plugin"
+          - "org.codehaus.mojo:exec-maven-plugin"
   - package-ecosystem: "github-actions"
     directory: "/" # even for `.github/workflows`
     schedule:

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -13,18 +13,18 @@ jobs:
     if: "!contains(github.event.head_commit.message, '[ci skip]') && !contains(github.event.head_commit.message, '[skip ci]')"
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: 17
           cache: 'maven'
       - name: Ensure to use tagged version
         if: startsWith(github.ref, 'refs/tags/')
         shell: bash
-        run: mvn versions:set --file ./pom.xml -DnewVersion=${GITHUB_REF##*/}
+        run: mvn -B versions:set --file ./pom.xml -DnewVersion=${GITHUB_REF##*/}
       - name: Build and Test
         id: buildAndTest
-        run: mvn -B clean test -Pdependency-check
+        run: mvn -B clean test
       - name: Codesign DLL on release
         if: startsWith(github.ref, 'refs/tags/')
         uses: skymatic/code-sign-action@v2
@@ -37,7 +37,7 @@ jobs:
       - name: Package and Install
         id: packAndInstall
         run: mvn -B install -DskipNativeCompile
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           name: artifacts
           path: target/*.jar

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -17,21 +17,21 @@ jobs:
   analyse:
     name: Analyse
     runs-on: windows-latest
-    if: "!contains(github.event.head_commit.message, '[ci skip]') && !contains(github.event.head_commit.message, '[skip ci]')"
+    if: ${{ !(github.actor == 'dependabot[bot]' && contains(fromJSON('["push"]'), github.event_name)) }}
     steps:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 2
-    - uses: actions/setup-java@v3
+    - uses: actions/setup-java@v4
       with:
         distribution: 'temurin'
         java-version: 17
         cache: 'maven'
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: java
     - name: Build
       run: mvn -B compile
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
diff --git a/.github/workflows/dependency-check.yml b/.github/workflows/dependency-check.yml
@@ -0,0 +1,20 @@
+name: OWASP Maven Dependency Check
+on:
+  schedule:
+    - cron: '0 16 * * 0'
+  push:
+    branches:
+      - 'release/**'
+  workflow_dispatch:
+
+
+jobs:
+  check-dependencies:
+    uses: skymatic/workflows/.github/workflows/run-dependency-check.yml@v1
+    with:
+      runner-os: 'windows-latest'
+      java-distribution: 'temurin'
+      java-version: 17
+    secrets:
+      nvd-api-key: ${{ secrets.NVD_API_KEY }}
+      slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
diff --git a/.github/workflows/publish-central.yml b/.github/workflows/publish-central.yml
@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: "refs/tags/${{ github.event.inputs.tag }}"
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: 17

diff --git a/.github/workflows/publish-github.yml b/.github/workflows/publish-github.yml
@@ -13,7 +13,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/') # only allow publishing tagged versions
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: 17

diff --git a/.idea/misc.xml b/.idea/misc.xml
diff --git a/.idea/modules.xml b/.idea/modules.xml
diff --git a/pom.xml b/pom.xml
@@ -5,7 +5,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>org.cryptomator</groupId>
     <artifactId>integrations-win</artifactId>
-    <version>1.2.4</version>
+    <version>1.2.5</version>
 
     <name>Cryptomator Integrations for Windows</name>
     <description>Provides optional Windows services used by Cryptomator</description>
@@ -38,15 +38,15 @@
 
         <!-- runtime dependencies -->
         <api.version>1.3.0</api.version>
-        <slf4j.version>2.0.9</slf4j.version>
-		<jackson.version>2.15.3</jackson.version>
+        <slf4j.version>2.0.11</slf4j.version>
+		<jackson.version>2.16.1</jackson.version>
 
         <!-- test dependencies -->
-		<junit.jupiter.version>5.10.0</junit.jupiter.version>
-		<mockito.version>5.6.0</mockito.version>
+		<junit.jupiter.version>5.10.1</junit.jupiter.version>
+		<mockito.version>5.10.0</mockito.version>
 
 		<!-- build plugin dependencies -->
-		<dependency-check.version>8.4.0</dependency-check.version>
+		<dependency-check.version>9.0.9</dependency-check.version>
 		<nexus-staging.version>1.6.13</nexus-staging.version>
     </properties>
 
@@ -106,7 +106,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-clean-plugin</artifactId>
-                <version>3.3.1</version>
+                <version>3.3.2</version>
                 <configuration>
                     <filesets>
                         <fileset>
@@ -122,7 +122,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
-                <version>3.11.0</version>
+                <version>3.12.1</version>
                 <configuration>
                     <compilerArgs>
                         <arg>-h</arg>
@@ -180,7 +180,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
-                <version>3.1.2</version>
+                <version>3.2.5</version>
             </plugin>
             <plugin>
                 <artifactId>maven-source-plugin</artifactId>
@@ -196,7 +196,7 @@
             </plugin>
             <plugin>
                 <artifactId>maven-javadoc-plugin</artifactId>
-                <version>3.6.0</version>
+                <version>3.6.3</version>
                 <executions>
                     <execution>
                         <id>attach-javadocs</id>
@@ -248,18 +248,20 @@
                         <artifactId>dependency-check-maven</artifactId>
                         <version>${dependency-check.version}</version>
                         <configuration>
-                            <cveValidForHours>24</cveValidForHours>
+                            <nvdValidForHours>24</nvdValidForHours>
                             <failBuildOnCVSS>0</failBuildOnCVSS>
                             <skipTestScope>true</skipTestScope>
                             <detail>true</detail>
-							<suppressionFile>suppression.xml</suppressionFile>
-							<assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
+                            <suppressionFile>suppression.xml</suppressionFile>
+                            <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
+                            <nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>
                         </configuration>
                         <executions>
                             <execution>
                                 <goals>
                                     <goal>check</goal>
                                 </goals>
+                                <phase>validate</phase>
                             </execution>
                         </executions>
                     </plugin>
@@ -279,7 +281,7 @@
 					<plugin>
 						<groupId>org.codehaus.mojo</groupId>
 						<artifactId>exec-maven-plugin</artifactId>
-						<version>3.1.0</version>
+						<version>3.1.1</version>
 						<executions>
 							<execution>
 								<goals>