Merge from upstream

.github/workflows/codeql-analysis.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       # Get full history for spotless ratchetFrom
       with:
         fetch-depth: 0

.github/workflows/maven.yaml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - name: Set up JDK 17

pom.xml

@@ -663,13 +663,13 @@
         <dependency>
             <groupId>org.slf4j</groupId>
             <artifactId>slf4j-reload4j</artifactId>
-            <version>2.0.17</version>
+            <version>2.0.18</version>
         </dependency>
 
         <dependency>
             <groupId>org.apache.directory.api</groupId>
             <artifactId>api-ldap-model</artifactId>
-            <version>${version.apache.api-ldap}</version>
+            <version>2.1.7</version>
         </dependency>
 
         <dependency>
@@ -783,7 +783,7 @@
         <dependency>
             <groupId>org.apache.httpcomponents.core5</groupId>
             <artifactId>httpcore5</artifactId>
-            <version>5.4.2</version>
+            <version>5.4.3</version>
         </dependency>
 
         <dependency>
@@ -866,7 +866,7 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.21.3</version>
+            <version>2.22.0</version>
         </dependency>
     </dependencies>
 
@@ -902,7 +902,7 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-dependency-plugin</artifactId>
-                    <version>3.10.0</version>
+                    <version>3.11.0</version>
                     <configuration>
                         <usedDependencies>
                             <dependency>com.sun.jersey:jersey-servlet</dependency>
@@ -954,7 +954,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-enforcer-plugin</artifactId>
-                <version>3.6.2</version>
+                <version>3.6.3</version>
                 <dependencies>
                     <dependency>
                         <groupId>org.codehaus.mojo</groupId>
@@ -1036,7 +1036,7 @@
                 <!-- Note: This uses the maven-fluido-skin version specified next. The skin is referenced in src/site/site.xml. -->
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-site-plugin</artifactId>
-                <version>3.21.0</version>
+                <version>3.22.0</version>
                 <dependencies>
                     <!-- Explicitly declare these dependencies so the versions plugin and library bots will flag available updates. The fluido-skin plugin is referenced in src/site/site.xml using the same fluido version property. -->
                     <dependency>
@@ -1050,7 +1050,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
-                <version>3.5.5</version>
+                <version>3.5.6</version>
             </plugin>
 
             <plugin>
@@ -1116,7 +1116,7 @@
             <plugin>
                 <groupId>com.diffplug.spotless</groupId>
                 <artifactId>spotless-maven-plugin</artifactId>
-                <version>3.4.0</version>
+                <version>3.7.0</version>
                 <configuration>
                     <!-- optional: limit format enforcement to just the files changed by this feature branch -->
                     <ratchetFrom>origin/master</ratchetFrom>
@@ -1255,13 +1255,13 @@
         </tomcat.jvmargs.debug>
         <log.directory>${project.build.directory}/log</log.directory>
 
-        <version.apache.api-ldap>2.1.7</version.apache.api-ldap>
+        <version.apache.api-ldap>2.1.8</version.apache.api-ldap>
         <version.apacheds>2.0.0.AM27</version.apacheds>
         <version.fluido>2.1.0</version.fluido>
         <!-- hibernate is up to rev 6+. But 4.0.0. causes this error: symbol: org.hibernate.classic.Session not found -->
         <version.hibernate>3.6.10.Final</version.hibernate>
-        <version.spotbugs.maven>4.9.8.3</version.spotbugs.maven>
-        <version.spotbugs>4.9.8</version.spotbugs>
+        <version.spotbugs.maven>4.10.2.0</version.spotbugs.maven>
+        <version.spotbugs>4.10.2</version.spotbugs>
         <!-- Spring 6.x requires Java 17 -->
         <version.springframework>5.3.39</version.springframework>
         <!-- Tomcat 10 moves from Java EE to Jakarta EE, moving packages javax.* to jakarta.* - code changes likely required to address this change. -->

scripts/runCognium.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+# Install: npm install -g cognium
+# Check for install/updates at https://github.com/cogniumhq/cognium
+
+source scripts/requireCommand.sh
+
+requireCommand cognium
+
+benchmark_version=$(scripts/getBenchmarkVersion.sh 2>/dev/null | grep -E '^[0-9]+\.[0-9]')
+cognium_version=$(cognium --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
+result_file="results/Benchmark_$benchmark_version-cognium-v$cognium_version.sarif"
+
+cognium scan src/main/java --format sarif --category security --output "$result_file"

scripts/runOpenTaint.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+# Check for install/updates at https://github.com/seqra/opentaint
+
+source scripts/requireCommand.sh
+
+requireCommand docker
+
+docker pull ghcr.io/seqra/opentaint
+
+benchmark_version=$(scripts/getBenchmarkVersion.sh 2>/dev/null | tail -1)
+opentaint_version=$(docker run --rm ghcr.io/seqra/opentaint opentaint --version | awk '{print $NF}')
+result_file="/project/results/Benchmark_$benchmark_version-OpenTaint-$opentaint_version.sarif"
+
+docker run --rm -v $(pwd):/project \
+  ghcr.io/seqra/opentaint:latest \
+  opentaint scan \
+  --severity error \
+  --severity warning \
+  --severity note \
+  --output "$result_file" /project