Skip to content

Commit a232f97

Browse files
author
Jens Vannerum
committed
Merge remote-tracking branch 'origin/main' into main-fix-email-templates
2 parents 469ae3f + 3f4f5f5 commit a232f97

801 files changed

Lines changed: 48342 additions & 6422 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/dependabot.yml‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ updates:
1515
schedule:
1616
interval: "monthly"
1717
time: "02:00"
18+
# Allow updates to be delayed for a configurable number of days to mitigate
19+
# some classes of supply chain attacks
20+
cooldown:
21+
default-days: 7
1822
# Allow up to 10 open PRs for dependencies
1923
open-pull-requests-limit: 10
2024
# Group together some upgrades in a single PR
@@ -41,6 +45,7 @@ updates:
4145
applies-to: version-updates
4246
patterns:
4347
- "junit:*"
48+
- "com.adobe.testing:*"
4449
- "com.github.stefanbirker:system-rules"
4550
- "com.h2database:*"
4651
- "io.findify:s3mock*"
@@ -49,10 +54,19 @@ updates:
4954
- "org.hamcrest:*"
5055
- "org.mock-server:*"
5156
- "org.mockito:*"
57+
- "org.testcontainers:*"
5258
- "org.xmlunit:*"
5359
update-types:
5460
- "minor"
5561
- "patch"
62+
# Group together all Amazon S3 deps in a single PR
63+
amazon-s3:
64+
applies-to: version-updates
65+
patterns:
66+
- "software.amazon.*:*"
67+
update-types:
68+
- "minor"
69+
- "patch"
5670
# Group together all Apache Commons deps in a single PR
5771
apache-commons:
5872
applies-to: version-updates
@@ -121,12 +135,33 @@ updates:
121135
# Don't try to auto-update any DSpace dependencies
122136
- dependency-name: "org.dspace:*"
123137
- dependency-name: "org.dspace.*:*"
138+
# Don't automatically update BouncyCastle because maven-gpg-plugin REQUIRES a very specific version or release
139+
# errors will occur. See https://github.com/DSpace/DSpace/pull/11696
140+
- dependency-name: "org.bouncycastle:*"
124141
# Ignore major/minor updates for Hibernate. Only patch updates can be automated.
125142
- dependency-name: "org.hibernate.*:*"
126143
update-types: ["version-update:semver-major", "version-update:semver-minor"]
144+
# Ignore updates for jboss-logging because it is a "convergence only" dependency
145+
# that we do not use directly (see comments in pom.xml).
146+
- dependency-name: "org.jboss.logging:*"
147+
# Don't try to update antlr4-runtime because it is a transitive dependency
148+
# used by Hibernate and Solr. The version is pinned in pom.xml and should
149+
# only be updated when required. See: https://github.com/DSpace/DSpace/pull/11989
150+
- dependency-name: "org.antlr:antlr4-runtime"
127151
# Ignore all major version updates for all dependencies. We'll only automate minor/patch updates.
128152
- dependency-name: "*"
129153
update-types: ["version-update:semver-major"]
154+
# Also automatically update all our GitHub actions on the main branch
155+
- package-ecosystem: "github-actions"
156+
directory: "/"
157+
# Monthly dependency updates
158+
schedule:
159+
interval: "monthly"
160+
time: "02:00"
161+
# Allow updates to be delayed for a configurable number of days to mitigate
162+
# some classes of supply chain attacks
163+
cooldown:
164+
default-days: 7
130165
######################
131166
## dspace-9_x branch
132167
######################
@@ -136,6 +171,10 @@ updates:
136171
schedule:
137172
interval: "monthly"
138173
time: "02:00"
174+
# Allow updates to be delayed for a configurable number of days to mitigate
175+
# some classes of supply chain attacks
176+
cooldown:
177+
default-days: 7
139178
# Allow up to 10 open PRs for dependencies
140179
open-pull-requests-limit: 10
141180
# Group together some upgrades in a single PR
@@ -162,6 +201,7 @@ updates:
162201
applies-to: version-updates
163202
patterns:
164203
- "junit:*"
204+
- "com.adobe.testing:*"
165205
- "com.github.stefanbirker:system-rules"
166206
- "com.h2database:*"
167207
- "io.findify:s3mock*"
@@ -170,10 +210,19 @@ updates:
170210
- "org.hamcrest:*"
171211
- "org.mock-server:*"
172212
- "org.mockito:*"
213+
- "org.testcontainers:*"
173214
- "org.xmlunit:*"
174215
update-types:
175216
- "minor"
176217
- "patch"
218+
# Group together all Amazon S3 deps in a single PR
219+
amazon-s3:
220+
applies-to: version-updates
221+
patterns:
222+
- "software.amazon.*:*"
223+
update-types:
224+
- "minor"
225+
- "patch"
177226
# Group together all Apache Commons deps in a single PR
178227
apache-commons:
179228
applies-to: version-updates
@@ -242,12 +291,37 @@ updates:
242291
# Don't try to auto-update any DSpace dependencies
243292
- dependency-name: "org.dspace:*"
244293
- dependency-name: "org.dspace.*:*"
294+
# Last version of errorprone to support JDK 17 is 2.42.x
295+
- dependency-name: "com.google.errorprone:*"
296+
versions: [">=2.43.0"]
297+
# Don't automatically update BouncyCastle because maven-gpg-plugin REQUIRES a very specific version or release
298+
# errors will occur. See https://github.com/DSpace/DSpace/pull/11696
299+
- dependency-name: "org.bouncycastle:*"
245300
# Ignore major/minor updates for Hibernate. Only patch updates can be automated.
246301
- dependency-name: "org.hibernate.*:*"
247302
update-types: ["version-update:semver-major", "version-update:semver-minor"]
303+
# Ignore updates for jboss-logging because it is a "convergence only" dependency
304+
# that we do not use directly (see comments in pom.xml).
305+
- dependency-name: "org.jboss.logging:*"
306+
# Don't try to update antlr4-runtime because it is a transitive dependency
307+
# used by Hibernate and Solr. The version is pinned in pom.xml and should
308+
# only be updated when required. See: https://github.com/DSpace/DSpace/pull/11989
309+
- dependency-name: "org.antlr:antlr4-runtime"
248310
# Ignore all major version updates for all dependencies. We'll only automate minor/patch updates.
249311
- dependency-name: "*"
250312
update-types: [ "version-update:semver-major" ]
313+
# Also automatically update all our GitHub actions on the dspace-9_x branch
314+
- package-ecosystem: "github-actions"
315+
directory: "/"
316+
target-branch: dspace-9_x
317+
# Monthly dependency updates
318+
schedule:
319+
interval: "monthly"
320+
time: "02:00"
321+
# Allow updates to be delayed for a configurable number of days to mitigate
322+
# some classes of supply chain attacks
323+
cooldown:
324+
default-days: 7
251325
######################
252326
## dspace-8_x branch
253327
######################
@@ -257,6 +331,10 @@ updates:
257331
schedule:
258332
interval: "monthly"
259333
time: "02:00"
334+
# Allow updates to be delayed for a configurable number of days to mitigate
335+
# some classes of supply chain attacks
336+
cooldown:
337+
default-days: 7
260338
# Allow up to 10 open PRs for dependencies
261339
open-pull-requests-limit: 10
262340
# Group together some upgrades in a single PR
@@ -283,6 +361,7 @@ updates:
283361
applies-to: version-updates
284362
patterns:
285363
- "junit:*"
364+
- "com.adobe.testing:*"
286365
- "com.github.stefanbirker:system-rules"
287366
- "com.h2database:*"
288367
- "io.findify:s3mock*"
@@ -291,10 +370,19 @@ updates:
291370
- "org.hamcrest:*"
292371
- "org.mock-server:*"
293372
- "org.mockito:*"
373+
- "org.testcontainers:*"
294374
- "org.xmlunit:*"
295375
update-types:
296376
- "minor"
297377
- "patch"
378+
# Group together all Amazon S3 deps in a single PR
379+
amazon-s3:
380+
applies-to: version-updates
381+
patterns:
382+
- "software.amazon.*:*"
383+
update-types:
384+
- "minor"
385+
- "patch"
298386
# Group together all Apache Commons deps in a single PR
299387
apache-commons:
300388
applies-to: version-updates
@@ -363,12 +451,37 @@ updates:
363451
# Don't try to auto-update any DSpace dependencies
364452
- dependency-name: "org.dspace:*"
365453
- dependency-name: "org.dspace.*:*"
454+
# Last version of errorprone to support JDK 17 is 2.42.x
455+
- dependency-name: "com.google.errorprone:*"
456+
versions: [">=2.43.0"]
457+
# Don't automatically update BouncyCastle because maven-gpg-plugin REQUIRES a very specific version or release
458+
# errors will occur. See https://github.com/DSpace/DSpace/pull/11696
459+
- dependency-name: "org.bouncycastle:*"
366460
# Ignore major/minor updates for Hibernate. Only patch updates can be automated.
367461
- dependency-name: "org.hibernate.*:*"
368462
update-types: ["version-update:semver-major", "version-update:semver-minor"]
463+
# Ignore updates for jboss-logging because it is a "convergence only" dependency
464+
# that we do not use directly (see comments in pom.xml).
465+
- dependency-name: "org.jboss.logging:*"
466+
# Don't try to update antlr4-runtime because it is a transitive dependency
467+
# used by Hibernate and Solr. The version is pinned in pom.xml and should
468+
# only be updated when required. See: https://github.com/DSpace/DSpace/pull/11989
469+
- dependency-name: "org.antlr:antlr4-runtime"
369470
# Ignore all major version updates for all dependencies. We'll only automate minor/patch updates.
370471
- dependency-name: "*"
371472
update-types: [ "version-update:semver-major" ]
473+
# Also automatically update all our GitHub actions on the dspace-8_x branch
474+
- package-ecosystem: "github-actions"
475+
directory: "/"
476+
target-branch: dspace-8_x
477+
# Monthly dependency updates
478+
schedule:
479+
interval: "monthly"
480+
time: "02:00"
481+
# Allow updates to be delayed for a configurable number of days to mitigate
482+
# some classes of supply chain attacks
483+
cooldown:
484+
default-days: 7
372485
######################
373486
## dspace-7_x branch
374487
######################
@@ -378,6 +491,10 @@ updates:
378491
schedule:
379492
interval: "monthly"
380493
time: "02:00"
494+
# Allow updates to be delayed for a configurable number of days to mitigate
495+
# some classes of supply chain attacks
496+
cooldown:
497+
default-days: 7
381498
# Allow up to 10 open PRs for dependencies
382499
open-pull-requests-limit: 10
383500
# Group together some upgrades in a single PR
@@ -404,17 +521,27 @@ updates:
404521
applies-to: version-updates
405522
patterns:
406523
- "junit:*"
524+
- "com.adobe.testing:*"
407525
- "com.github.stefanbirker:system-rules"
408526
- "com.h2database:*"
409527
- "io.findify:s3mock*"
410528
- "io.netty:*"
411529
- "org.hamcrest:*"
412530
- "org.mock-server:*"
413531
- "org.mockito:*"
532+
- "org.testcontainers:*"
414533
- "org.xmlunit:*"
415534
update-types:
416535
- "minor"
417536
- "patch"
537+
# Group together all Amazon S3 deps in a single PR
538+
amazon-s3:
539+
applies-to: version-updates
540+
patterns:
541+
- "software.amazon.*:*"
542+
update-types:
543+
- "minor"
544+
- "patch"
418545
# Group together all Apache Commons deps in a single PR
419546
apache-commons:
420547
applies-to: version-updates
@@ -499,13 +626,31 @@ updates:
499626
# Last version of errorprone to support JDK 11 is 2.31.0
500627
- dependency-name: "com.google.errorprone:*"
501628
versions: [">=2.32.0"]
629+
# Don't automatically update BouncyCastle because maven-gpg-plugin REQUIRES a very specific version or release
630+
# errors will occur. See https://github.com/DSpace/DSpace/pull/11696
631+
- dependency-name: "org.bouncycastle:*"
502632
# Spring Security 5.8 changes the behavior of CSRF Tokens in a way which is incompatible with DSpace 7
503633
# See https://github.com/DSpace/DSpace/pull/9888#issuecomment-2408165545
504634
- dependency-name: "org.springframework.security:*"
505635
versions: [">=5.8.0"]
506636
# Ignore major/minor updates for Hibernate. Only patch updates can be automated.
507637
- dependency-name: "org.hibernate.*:*"
508638
update-types: ["version-update:semver-major", "version-update:semver-minor"]
639+
# Ignore updates for jboss-logging because it is a "convergence only" dependency
640+
# that we do not use directly (see comments in pom.xml).
641+
- dependency-name: "org.jboss.logging:*"
509642
# Ignore all major version updates for all dependencies. We'll only automate minor/patch updates.
510643
- dependency-name: "*"
511644
update-types: [ "version-update:semver-major" ]
645+
# Also automatically update all our GitHub actions on the dspace-7_x branch
646+
- package-ecosystem: "github-actions"
647+
directory: "/"
648+
target-branch: dspace-7_x
649+
# Monthly dependency updates
650+
schedule:
651+
interval: "monthly"
652+
time: "02:00"
653+
# Allow updates to be delayed for a configurable number of days to mitigate
654+
# some classes of supply chain attacks
655+
cooldown:
656+
default-days: 7

‎.github/workflows/build.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
# NOTE: Unit Tests include a retry for occasionally failing tests
2525
# - surefire.rerunFailingTestsCount => try again for flakey tests, and keep track of/report on number of retries
2626
- type: "Unit Tests"
27-
java: 17
27+
java: 21
2828
mvnflags: "-DskipUnitTests=false -Dsurefire.rerunFailingTestsCount=2"
2929
resultsdir: "**/target/surefire-reports/**"
3030
# NOTE: ITs skip all code validation checks, as they are already done by Unit Test job.
@@ -34,7 +34,7 @@ jobs:
3434
# - xml.skip => Skip all XML/XSLT validation by xml-maven-plugin
3535
# - failsafe.rerunFailingTestsCount => try again for flakey tests, and keep track of/report on number of retries
3636
- type: "Integration Tests"
37-
java: 17
37+
java: 21
3838
mvnflags: "-DskipIntegrationTests=false -Denforcer.skip=true -Dcheckstyle.skip=true -Dlicense.skip=true -Dxml.skip=true -Dfailsafe.rerunFailingTestsCount=2"
3939
resultsdir: "**/target/failsafe-reports/**"
4040
# Do NOT exit immediately if one matrix job fails
@@ -45,11 +45,11 @@ jobs:
4545
steps:
4646
# https://github.com/actions/checkout
4747
- name: Checkout codebase
48-
uses: actions/checkout@v4
48+
uses: actions/checkout@v6
4949

5050
# https://github.com/actions/setup-java
5151
- name: Install JDK ${{ matrix.java }}
52-
uses: actions/setup-java@v4
52+
uses: actions/setup-java@v5
5353
with:
5454
java-version: ${{ matrix.java }}
5555
distribution: 'temurin'
@@ -87,19 +87,19 @@ jobs:
8787
runs-on: ubuntu-latest
8888
steps:
8989
- name: Checkout
90-
uses: actions/checkout@v4
90+
uses: actions/checkout@v6
9191

9292
# Download artifacts from previous 'tests' job
9393
- name: Download coverage artifacts
94-
uses: actions/download-artifact@v4
94+
uses: actions/download-artifact@v8
9595

9696
# Now attempt upload to Codecov using its action.
9797
# NOTE: We use a retry action to retry the Codecov upload if it fails the first time.
9898
#
9999
# Retry action: https://github.com/marketplace/actions/retry-action
100100
# Codecov action: https://github.com/codecov/codecov-action
101101
- name: Upload coverage to Codecov.io
102-
uses: Wandalen/wretry.action@v1.3.0
102+
uses: Wandalen/wretry.action@v3.8.0
103103
with:
104104
action: codecov/codecov-action@v4
105105
# Ensure codecov-action throws an error when it fails to upload

‎.github/workflows/codescan.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35,19 +35,19 @@ jobs:
3535
steps:
3636
# https://github.com/actions/checkout
3737
- name: Checkout repository
38-
uses: actions/checkout@v4
38+
uses: actions/checkout@v6
3939

4040
# https://github.com/actions/setup-java
4141
- name: Install JDK
42-
uses: actions/setup-java@v4
42+
uses: actions/setup-java@v5
4343
with:
44-
java-version: 17
44+
java-version: 21
4545
distribution: 'temurin'
4646

4747
# Initializes the CodeQL tools for scanning.
4848
# https://github.com/github/codeql-action
4949
- name: Initialize CodeQL
50-
uses: github/codeql-action/init@v3
50+
uses: github/codeql-action/init@v4
5151
with:
5252
# Codescan Javascript as well since a few JS files exist in REST API's interface
5353
languages: java, javascript
@@ -56,8 +56,8 @@ jobs:
5656
# NOTE: Based on testing, this autobuild process works well for DSpace. A custom
5757
# DSpace build w/caching (like in build.yml) was about the same speed as autobuild.
5858
- name: Autobuild
59-
uses: github/codeql-action/autobuild@v3
59+
uses: github/codeql-action/autobuild@v4
6060

6161
# Perform GitHub Code Scanning.
6262
- name: Perform CodeQL Analysis
63-
uses: github/codeql-action/analyze@v3
63+
uses: github/codeql-action/analyze@v4

0 commit comments

Comments
 (0)