From 2ab460a6192ff39aaf1af5380250a845fef8b6af Mon Sep 17 00:00:00 2001 From: Evan Date: 2022年6月22日 17:59:46 +0900 Subject: [PATCH 1/8] Update Readme.md --- Readme.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Readme.md b/Readme.md index 0692e4dd..6f137c59 100644 --- a/Readme.md +++ b/Readme.md @@ -127,7 +127,7 @@ http://localhost:808/doc.html bootstrap-ui MIT License - Copyright (c) 2020 Peng Hu + Copyright (c) 2022 Peng Hu Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal From 59a23ad0d7c5e55ddc6a16baaa377238250eeb56 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: 2022年6月22日 09:00:16 +0000 Subject: [PATCH 2/8] Bump mysql-connector-java from 8.0.21 to 8.0.28 Bumps [mysql-connector-java](https://github.com/mysql/mysql-connector-j) from 8.0.21 to 8.0.28. - [Release notes](https://github.com/mysql/mysql-connector-j/releases) - [Changelog](https://github.com/mysql/mysql-connector-j/blob/release/8.0/CHANGES) - [Commits](https://github.com/mysql/mysql-connector-j/compare/8.0.21...8.0.28) --- updated-dependencies: - dependency-name: mysql:mysql-connector-java dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index b17e93b6..23674d2a 100644 --- a/pom.xml +++ b/pom.xml @@ -61,7 +61,7 @@ 4.13.1 - 8.0.21 + 8.0.28 1.7.21 From a670542f40b8ebd4500418f49494b316ba5267bc Mon Sep 17 00:00:00 2001 From: Evan Date: 2022年6月22日 18:00:28 +0900 Subject: [PATCH 3/8] Create codeql-analysis.yml --- .github/workflows/codeql-analysis.yml | 72 +++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 .github/workflows/codeql-analysis.yml diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml new file mode 100644 index 00000000..1620e2e5 --- /dev/null +++ b/.github/workflows/codeql-analysis.yml @@ -0,0 +1,72 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL" + +on: + push: + branches: [ "master" ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ "master" ] + schedule: + - cron: '24 7 * * 0' + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + language: [ 'java' ] + # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] + # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support + + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v2 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + + # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + # queries: security-extended,security-and-quality + + + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@v2 + + # i️ Command-line programs to run using the OS shell. + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + + # If the Autobuild fails above, remove it and uncomment the following three lines. + # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. + + # - run: | + # echo "Run, Build Application using script" + # ./location_of_script_within_repo/buildscript.sh + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v2 From e8da169f8e11955e62e3ef94833387275d0fb145 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: 2022年6月22日 09:00:34 +0000 Subject: [PATCH 4/8] Bump spring-boot-starter-web from 2.3.0.RELEASE to 2.5.12 Bumps [spring-boot-starter-web](https://github.com/spring-projects/spring-boot) from 2.3.0.RELEASE to 2.5.12. - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](https://github.com/spring-projects/spring-boot/compare/v2.3.0.RELEASE...v2.5.12) --- updated-dependencies: - dependency-name: org.springframework.boot:spring-boot-starter-web dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index b17e93b6..49c58294 100644 --- a/pom.xml +++ b/pom.xml @@ -75,7 +75,7 @@ 1.10.1 - 2.3.0.RELEASE + 2.5.12 3.5.1 From 3acc7cd514e6caed4afa1708f56241f20781413e Mon Sep 17 00:00:00 2001 From: Evan Date: 2022年6月22日 18:00:54 +0900 Subject: [PATCH 5/8] Create SECURITY.md --- SECURITY.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..034e8480 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,21 @@ +# Security Policy + +## Supported Versions + +Use this section to tell people about which versions of your project are +currently being supported with security updates. + +| Version | Supported | +| ------- | ------------------ | +| 5.1.x | :white_check_mark: | +| 5.0.x | :x: | +| 4.0.x | :white_check_mark: | +| < 4.0 | :x: | + +## Reporting a Vulnerability + +Use this section to tell people how to report a vulnerability. + +Tell them where to go, how often they can expect to get an update on a +reported vulnerability, what to expect if the vulnerability is accepted or +declined, etc. From 31888c7068f20d7e5972cc89ac3bea7fd5325edb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: 2022年6月22日 09:01:05 +0000 Subject: [PATCH 6/8] Bump poi from 3.10-beta2 to 3.17 Bumps poi from 3.10-beta2 to 3.17. --- updated-dependencies: - dependency-name: org.apache.poi:poi dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index b17e93b6..14815c7a 100644 --- a/pom.xml +++ b/pom.xml @@ -93,7 +93,7 @@ 2.6.12 - 3.10-beta2 + 3.17 From b783f976e19d418149ddf59fc736b709abf0f1aa Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: 2022年6月22日 09:02:18 +0000 Subject: [PATCH 7/8] Bump jsoup from 1.10.1 to 1.14.2 Bumps [jsoup](https://github.com/jhy/jsoup) from 1.10.1 to 1.14.2. - [Release notes](https://github.com/jhy/jsoup/releases) - [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES) - [Commits](https://github.com/jhy/jsoup/compare/jsoup-1.10.1...jsoup-1.14.2) --- updated-dependencies: - dependency-name: org.jsoup:jsoup dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 5f61043c..4b280e7e 100644 --- a/pom.xml +++ b/pom.xml @@ -73,7 +73,7 @@ [1.2.31,) - 1.10.1 + 1.14.2 2.5.12 From fbbceec7f7fdd907884b6ae43f67dc0258d38b27 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: 2022年6月22日 09:05:19 +0000 Subject: [PATCH 8/8] Bump commons-io from 2.5 to 2.7 Bumps commons-io from 2.5 to 2.7. --- updated-dependencies: - dependency-name: commons-io:commons-io dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 4b280e7e..5b1f7919 100644 --- a/pom.xml +++ b/pom.xml @@ -67,7 +67,7 @@ 1.1.7 - 2.5 + 2.7 [1.3.3,)

AltStyle によって変換されたページ (->オリジナル) /