Merge pull request #8098 from lpalashevski/dependabot-03-2024

Dependabot 03 2024 (1)

.github/workflows/codeql-v4.yml

@@ -30,15 +30,15 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/[email protected]
-      - uses: gradle/wrapper-validation-action@v1
+      - uses: gradle/wrapper-validation-action@v2
       - name: Setup Java JDK
         uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: '17'
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3.23.2
+        uses: github/codeql-action/init@v3.24.6
         with:
           languages: java
           queries: security-and-quality
@@ -51,6 +51,6 @@ jobs:
           cache-disabled: true
           arguments: -x javadoc -x test build -PskipOpenTypesFVT
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3.23.2
+        uses: github/codeql-action/analyze@v3.24.6
         with:
           ram: 4096

.github/workflows/linkcheck.yml

@@ -18,7 +18,7 @@ jobs:
     steps:
       - uses: actions/[email protected]
       - name: Link Checker
-        uses: lycheeverse/lychee-action@v1.8.0
+        uses: lycheeverse/lychee-action@v1.9.3
         with:
           # Can switch to true once we run clean
           fail: false

.github/workflows/merge-v4.yml

@@ -24,7 +24,7 @@ jobs:
     steps:
       - uses: actions/[email protected]
         name: Checkout source
-      - uses: gradle/wrapper-validation-action@v1
+      - uses: gradle/wrapper-validation-action@v2
       - name: Set up JDK
         uses: actions/setup-java@v4
         with:
@@ -126,19 +126,19 @@ jobs:
           platforms: linux/amd64,linux/arm64
       # --
       - name: Upload Log of any dependency failures
-        uses: actions/upload-artifact@v3.1.3
+        uses: actions/upload-artifact@v4.3.1
         with:
           name: Dependency Analysis Report (on failure)
           path: build/reports/dependency-analysis/build-health-report.txt
           if-no-files-found: ignore
       # Mostly for verification - not published to the release itself for now
       - name: Upload assemblies
-        uses: actions/upload-artifact@v3.1.3
+        uses: actions/upload-artifact@v4.3.1
         with:
           name: Assemblies
           path: open-metadata-distribution/open-metadata-assemblies/build/distributions/*.gz
       - name: Upload Test coverage report
-        uses: actions/upload-artifact@v3.1.3
+        uses: actions/upload-artifact@v4.3.1
         with:
           name: Jacoco Coverage Report
           path: build/reports/jacoco/codeCoverageReport

.github/workflows/pr-v4.yml

@@ -17,7 +17,7 @@ jobs:
     if: startsWith(github.repository,'odpi/')
     steps:
       - uses: actions/[email protected]
-      - uses: gradle/wrapper-validation-action@v1
+      - uses: gradle/wrapper-validation-action@v2
       - name: Set up JDK
         uses: actions/setup-java@v4
         with:
@@ -32,12 +32,12 @@ jobs:
             build
             --scan
       - name: Upload Test coverage report
-        uses: actions/upload-artifact@v3.1.3
+        uses: actions/upload-artifact@v4.3.1
         with:
           name: Jacoco Coverage Report
           path: build/reports/jacoco/codeCoverageReport
       - name: Upload Log of any dependency failures
-        uses: actions/upload-artifact@v3.1.3
+        uses: actions/upload-artifact@v4.3.1
         with:
           name: Dependency Analysis Report (on failure)
           path: build/reports/dependency-analysis/build-health-report.txt

.github/workflows/release-v4.yml

@@ -26,7 +26,7 @@ jobs:
     steps:
       - uses: actions/[email protected]
         name: Checkout source
-      - uses: gradle/wrapper-validation-action@v1
+      - uses: gradle/wrapper-validation-action@v2
       # Prep for docker builds
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -88,7 +88,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
       # Mostly for verification - not published to the release itself for now
       - name: Upload assemblies
-        uses: actions/upload-artifact@v3.1.3
+        uses: actions/upload-artifact@v4.3.1
         with:
           name: Assemblies
           path: open-metadata-distribution/open-metadata-assemblies/build/distributions/*.gz

.github/workflows/scorecards.yml

@@ -54,14 +54,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@v3.1.3  # tag=v3.0.0
+        uses: actions/upload-artifact@v4.3.1  # tag=v3.0.0
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@v3.23.2  # tag=v1.0.26
+        uses: github/codeql-action/upload-sarif@v3.24.6  # tag=v1.0.26
         with:
           sarif_file: results.sarif

bom/build.gradle

@@ -29,10 +29,10 @@ ext {
     classgraphVersion = '4.8.165'
     classmateVersion = '1.5.1'
     collections4Version = '4.4'
-    commonscodecVersion = '1.16.0'
+    commonscodecVersion = '1.16.1'
     commonsconfiguration2Version = '2.9.0'
     commonsconfigurationVersion = '1.10'
-    commonsioVersion = '2.13.0'
+    commonsioVersion = '2.15.1'
     commonsloggingVersion = '1.3.0'
     commonstextVersion = '1.11.0'
     commonscliVersion = '1.6.0'
@@ -60,10 +60,10 @@ ext {
     javassistVersion = '3.29.2-GA'
     jaxbVersion = '2.3.1'
     jenaVersion = '4.7.0'
-    jodatimeVersion = '2.12.6'
+    jodatimeVersion = '2.12.7'
     jsonldVersion = '0.13.6'
     junitVersion = '4.13.2'
-    junitjupiterVersion = '5.10.0'
+    junitjupiterVersion = '5.10.2'
     junitplatformVersion = '1.9.2'
     jwtVersion = '9.37.1'
     jwtApiVersion = '0.11.5'
@@ -93,7 +93,7 @@ ext {
     slf4jVersion = '2.0.6'
     snappyVersion = '1.1.10.5'
     springbootVersion = '3.1.4'
-    spotbugsVersion = '4.7.3'
+    spotbugsVersion = '4.8.3'
     springdataVersion = '3.0.3'
     springldapVersion = '3.0.1'
     springsecurityVersion = '6.1.4'
@@ -107,9 +107,9 @@ ext {
     validationVersion = '2.0.1.Final'
     gsonVersion = '2.10.1'
     antVersion = '1.10.14'
-    jnrVersion = '3.1.18'
+    jnrVersion = '3.1.19'
     cassandraVersion = '4.1.3'
-    protobufVersion = '3.25.2'
+    protobufVersion = '3.25.3'
     osgiVersion = '8.0.0'
     log4jVersion = '2.22.1'
     jacksonjdk8Version = '2.16.1'

open-metadata-implementation/adapters/open-connectors/lineage-warehouse-connectors/lineage-warehouse-janus-connector/build.gradle

@@ -58,8 +58,8 @@ filter {
         includeEngines 'junit-jupiter'
     }
     dependencies {
-        testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine:5.10.0'
-        testImplementation 'org.junit.jupiter:junit-jupiter-api:5.10.0'
+        testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine:5.10.2'
+        testImplementation 'org.junit.jupiter:junit-jupiter-api:5.10.2'
     }
 
     testLogging {

open-metadata-resources/open-metadata-deployment/docker/configure/Dockerfile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
 # Copyright Contributors to the Egeria project
 
-FROM docker.io/library/alpine:3.18.4
+FROM docker.io/library/alpine:3.19.1
 ARG version=4.4-SNAPSHOT
 ARG VCS_REF=unknown
 ARG VCS_ORIGIN=unknown

settings.gradle

@@ -16,13 +16,13 @@ pluginManagement {
     }
     plugins {
         id "io.freefair.aggregate-javadoc" version "6.6.3"
-        id "io.freefair.lombok" version "8.3"
+        id "io.freefair.lombok" version "8.6"
         // Checks for unnecessary dependencies
-        id("com.autonomousapps.dependency-analysis") version "1.29.0"
+        id("com.autonomousapps.dependency-analysis") version "1.30.0"
         // helps resolve log implementation clashes
         id 'dev.jacomet.logging-capabilities' version "0.11.1"
         // This plugin helps resolve jakarta/javax dev.jacomet.logging-capabilities
-        id 'org.gradlex.java-ecosystem-capabilities' version "1.5.1"
+        id 'org.gradlex.java-ecosystem-capabilities' version "1.5.2"
         // Docs don't recommend specifying a version for checkstyle
         id 'checkstyle'
         id 'org.springframework.boot' version '2.7.16'