You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ofbiz.apache.org by "Jacques Le Roux (Jira)" <ji...@apache.org> on 2021/10/27 16:04:00 UTC
[jira] [Comment Edited] (OFBIZ-12339) Update jquery-validation to
1.19.3 for security reason
[ https://issues.apache.org/jira/browse/OFBIZ-12339?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17434933#comment-17434933 ]
Jacques Le Roux edited comment on OFBIZ-12339 at 10/27/21, 4:03 PM:
--------------------------------------------------------------------
Following https://github.com/node-gradle/gradle-node-plugin/blob/master/docs/faq.md#how-do-i-use-npm-ci-instead-of-npm-install
I have tried the feature (see below). I'm not sure it's currently quite useful in OFBiz But anyway it does not hurt to add this possibility, notably for specific CI cases.
{noformat}
C:\projectsASF\Git\ofbiz-framework>gradlew --no-daemon
To honour the JVM settings for this build a new JVM will be forked. Please consider using the daemon: https://docs.gradle.org/6.5/userguide/gradle_daemon.html.
Daemon will be stopped at the end of the build stopping after processing
> Configure project :
You are using one or more deprecated Asciidoctor Gradle plugin features. To help with migration run with --warning-mode=all.
> Task :compileJava
> Task :compileGroovy
> Task :nodeSetup UP-TO-DATE
> Task :npmSetup SKIPPED
> Task :processResources
> Task :classes
> Task :compileTestJava
> Task :npmInstall
updated 4 packages and audited 4 packages in 1.456s
found 0 vulnerabilities
> Task :jar
> Task :compileTestGroovy
> Task :processTestResources
> Task :testClasses
> Task :test
BUILD SUCCESSFUL in 2m 30s
10 actionable tasks: 9 executed, 1 up-to-date
C:\projectsASF\Git\ofbiz-framework>SET CI=ci
C:\projectsASF\Git\ofbiz-framework>gradlew --no-daemon
To honour the JVM settings for this build a new JVM will be forked. Please consider using the daemon: https://docs.gradle.org/6.5/userguide/gradle_daemon.html.
Daemon will be stopped at the end of the build stopping after processing
> Configure project :
You are using one or more deprecated Asciidoctor Gradle plugin features. To help with migration run with --warning-mode=all.
> Task :compileJava UP-TO-DATE
> Task :compileGroovy UP-TO-DATE
> Task :nodeSetup UP-TO-DATE
> Task :npmSetup SKIPPED
> Task :processResources UP-TO-DATE
> Task :classes UP-TO-DATE
> Task :compileTestJava UP-TO-DATE
> Task :npmInstall
npm WARN prepare removing existing node_modules/ before installation
added 4 packages in 0.742s
> Task :jar UP-TO-DATE
> Task :compileTestGroovy UP-TO-DATE
> Task :processTestResources UP-TO-DATE
> Task :testClasses UP-TO-DATE
> Task :test UP-TO-DATE
BUILD SUCCESSFUL in 16s
10 actionable tasks: 1 executed, 9 up-to-date
C:\projectsASF\Git\ofbiz-framework>SET CI=
C:\projectsASF\Git\ofbiz-framework>gradlew --no-daemon
To honour the JVM settings for this build a new JVM will be forked. Please consider using the daemon: https://docs.gradle.org/6.5/userguide/gradle_daemon.html.
Daemon will be stopped at the end of the build stopping after processing
> Configure project :
You are using one or more deprecated Asciidoctor Gradle plugin features. To help with migration run with --warning-mode=all.
> Task :compileJava UP-TO-DATE
> Task :compileGroovy UP-TO-DATE
> Task :nodeSetup UP-TO-DATE
> Task :npmSetup SKIPPED
> Task :processResources UP-TO-DATE
> Task :classes UP-TO-DATE
> Task :compileTestJava UP-TO-DATE
> Task :npmInstall
audited 4 packages in 0.712s
found 0 vulnerabilities
> Task :jar UP-TO-DATE
> Task :compileTestGroovy UP-TO-DATE
> Task :processTestResources UP-TO-DATE
> Task :testClasses UP-TO-DATE
> Task :test UP-TO-DATE
BUILD SUCCESSFUL in 51s
10 actionable tasks: 1 executed, 9 up-to-date
C:\projectsASF\Git\ofbiz-framework>SET CI=ci
C:\projectsASF\Git\ofbiz-framework>gradlew --no-daemon
To honour the JVM settings for this build a new JVM will be forked. Please consider using the daemon: https://docs.gradle.org/6.5/userguide/gradle_daemon.html.
Daemon will be stopped at the end of the build stopping after processing
> Configure project :
You are using one or more deprecated Asciidoctor Gradle plugin features. To help with migration run with --warning-mode=all.
> Task :compileJava UP-TO-DATE
> Task :compileGroovy UP-TO-DATE
> Task :nodeSetup UP-TO-DATE
> Task :npmSetup SKIPPED
> Task :processResources UP-TO-DATE
> Task :classes UP-TO-DATE
> Task :compileTestJava UP-TO-DATE
> Task :npmInstall
npm WARN prepare removing existing node_modules/ before installation
added 4 packages in 1.627s
> Task :jar UP-TO-DATE
> Task :compileTestGroovy UP-TO-DATE
> Task :processTestResources UP-TO-DATE
> Task :testClasses UP-TO-DATE
> Task :test UP-TO-DATE
BUILD SUCCESSFUL in 56s
10 actionable tasks: 1 executed, 9 up-to-date
C:\projectsASF\Git\ofbiz-framework>gradlew --no-daemon
To honour the JVM settings for this build a new JVM will be forked. Please consider using the daemon: https://docs.gradle.org/6.5/userguide/gradle_daemon.html.
Daemon will be stopped at the end of the build stopping after processing
> Configure project :
You are using one or more deprecated Asciidoctor Gradle plugin features. To help with migration run with --warning-mode=all.
> Task :compileJava UP-TO-DATE
> Task :compileGroovy UP-TO-DATE
> Task :nodeSetup UP-TO-DATE
> Task :npmSetup SKIPPED
> Task :processResources UP-TO-DATE
> Task :classes UP-TO-DATE
> Task :compileTestJava UP-TO-DATE
> Task :npmInstall UP-TO-DATE
> Task :jar UP-TO-DATE
> Task :compileTestGroovy UP-TO-DATE
> Task :processTestResources UP-TO-DATE
> Task :testClasses UP-TO-DATE
> Task :test UP-TO-DATE
BUILD SUCCESSFUL in 16s
10 actionable tasks: 10 up-to-date
C:\projectsASF\Git\ofbiz-framework>SET CI=
C:\projectsASF\Git\ofbiz-framework>gradlew --no-daemon
To honour the JVM settings for this build a new JVM will be forked. Please consider using the daemon: https://docs.gradle.org/6.5/userguide/gradle_daemon.html.
Daemon will be stopped at the end of the build stopping after processing
> Configure project :
You are using one or more deprecated Asciidoctor Gradle plugin features. To help with migration run with --warning-mode=all.
> Task :compileJava UP-TO-DATE
> Task :compileGroovy UP-TO-DATE
> Task :nodeSetup UP-TO-DATE
> Task :npmSetup SKIPPED
> Task :processResources UP-TO-DATE
> Task :classes UP-TO-DATE
> Task :compileTestJava UP-TO-DATE
> Task :npmInstall
audited 4 packages in 0.635s
found 0 vulnerabilities
> Task :jar UP-TO-DATE
> Task :compileTestGroovy UP-TO-DATE
> Task :processTestResources UP-TO-DATE
> Task :testClasses UP-TO-DATE
> Task :test UP-TO-DATE
BUILD SUCCESSFUL in 15s
10 actionable tasks: 1 executed, 9 up-to-date
C:\projectsASF\Git\ofbiz-framework>
{noformat}
was (Author: jacques.le.roux):
Following https://github.com/node-gradle/gradle-node-plugin/blob/master/docs/faq.md#how-do-i-use-npm-ci-instead-of-npm-install
I have tried the feature (see below). I'm not sure it's currently quite useful in OFBiz But anyway it does not hurt to add this possibilty
{noformat}
C:\projectsASF\Git\ofbiz-framework>gradlew --no-daemon
To honour the JVM settings for this build a new JVM will be forked. Please consider using the daemon: https://docs.gradle.org/6.5/userguide/gradle_daemon.html.
Daemon will be stopped at the end of the build stopping after processing
> Configure project :
You are using one or more deprecated Asciidoctor Gradle plugin features. To help with migration run with --warning-mode=all.
> Task :compileJava
> Task :compileGroovy
> Task :nodeSetup UP-TO-DATE
> Task :npmSetup SKIPPED
> Task :processResources
> Task :classes
> Task :compileTestJava
> Task :npmInstall
updated 4 packages and audited 4 packages in 1.456s
found 0 vulnerabilities
> Task :jar
> Task :compileTestGroovy
> Task :processTestResources
> Task :testClasses
> Task :test
BUILD SUCCESSFUL in 2m 30s
10 actionable tasks: 9 executed, 1 up-to-date
C:\projectsASF\Git\ofbiz-framework>SET CI=ci
C:\projectsASF\Git\ofbiz-framework>gradlew --no-daemon
To honour the JVM settings for this build a new JVM will be forked. Please consider using the daemon: https://docs.gradle.org/6.5/userguide/gradle_daemon.html.
Daemon will be stopped at the end of the build stopping after processing
> Configure project :
You are using one or more deprecated Asciidoctor Gradle plugin features. To help with migration run with --warning-mode=all.
> Task :compileJava UP-TO-DATE
> Task :compileGroovy UP-TO-DATE
> Task :nodeSetup UP-TO-DATE
> Task :npmSetup SKIPPED
> Task :processResources UP-TO-DATE
> Task :classes UP-TO-DATE
> Task :compileTestJava UP-TO-DATE
> Task :npmInstall
npm WARN prepare removing existing node_modules/ before installation
added 4 packages in 0.742s
> Task :jar UP-TO-DATE
> Task :compileTestGroovy UP-TO-DATE
> Task :processTestResources UP-TO-DATE
> Task :testClasses UP-TO-DATE
> Task :test UP-TO-DATE
BUILD SUCCESSFUL in 16s
10 actionable tasks: 1 executed, 9 up-to-date
C:\projectsASF\Git\ofbiz-framework>SET CI=
C:\projectsASF\Git\ofbiz-framework>gradlew --no-daemon
To honour the JVM settings for this build a new JVM will be forked. Please consider using the daemon: https://docs.gradle.org/6.5/userguide/gradle_daemon.html.
Daemon will be stopped at the end of the build stopping after processing
> Configure project :
You are using one or more deprecated Asciidoctor Gradle plugin features. To help with migration run with --warning-mode=all.
> Task :compileJava UP-TO-DATE
> Task :compileGroovy UP-TO-DATE
> Task :nodeSetup UP-TO-DATE
> Task :npmSetup SKIPPED
> Task :processResources UP-TO-DATE
> Task :classes UP-TO-DATE
> Task :compileTestJava UP-TO-DATE
> Task :npmInstall
audited 4 packages in 0.712s
found 0 vulnerabilities
> Task :jar UP-TO-DATE
> Task :compileTestGroovy UP-TO-DATE
> Task :processTestResources UP-TO-DATE
> Task :testClasses UP-TO-DATE
> Task :test UP-TO-DATE
BUILD SUCCESSFUL in 51s
10 actionable tasks: 1 executed, 9 up-to-date
C:\projectsASF\Git\ofbiz-framework>SET CI=ci
C:\projectsASF\Git\ofbiz-framework>gradlew --no-daemon
To honour the JVM settings for this build a new JVM will be forked. Please consider using the daemon: https://docs.gradle.org/6.5/userguide/gradle_daemon.html.
Daemon will be stopped at the end of the build stopping after processing
> Configure project :
You are using one or more deprecated Asciidoctor Gradle plugin features. To help with migration run with --warning-mode=all.
> Task :compileJava UP-TO-DATE
> Task :compileGroovy UP-TO-DATE
> Task :nodeSetup UP-TO-DATE
> Task :npmSetup SKIPPED
> Task :processResources UP-TO-DATE
> Task :classes UP-TO-DATE
> Task :compileTestJava UP-TO-DATE
> Task :npmInstall
npm WARN prepare removing existing node_modules/ before installation
added 4 packages in 1.627s
> Task :jar UP-TO-DATE
> Task :compileTestGroovy UP-TO-DATE
> Task :processTestResources UP-TO-DATE
> Task :testClasses UP-TO-DATE
> Task :test UP-TO-DATE
BUILD SUCCESSFUL in 56s
10 actionable tasks: 1 executed, 9 up-to-date
C:\projectsASF\Git\ofbiz-framework>gradlew --no-daemon
To honour the JVM settings for this build a new JVM will be forked. Please consider using the daemon: https://docs.gradle.org/6.5/userguide/gradle_daemon.html.
Daemon will be stopped at the end of the build stopping after processing
> Configure project :
You are using one or more deprecated Asciidoctor Gradle plugin features. To help with migration run with --warning-mode=all.
> Task :compileJava UP-TO-DATE
> Task :compileGroovy UP-TO-DATE
> Task :nodeSetup UP-TO-DATE
> Task :npmSetup SKIPPED
> Task :processResources UP-TO-DATE
> Task :classes UP-TO-DATE
> Task :compileTestJava UP-TO-DATE
> Task :npmInstall UP-TO-DATE
> Task :jar UP-TO-DATE
> Task :compileTestGroovy UP-TO-DATE
> Task :processTestResources UP-TO-DATE
> Task :testClasses UP-TO-DATE
> Task :test UP-TO-DATE
BUILD SUCCESSFUL in 16s
10 actionable tasks: 10 up-to-date
C:\projectsASF\Git\ofbiz-framework>SET CI=
C:\projectsASF\Git\ofbiz-framework>gradlew --no-daemon
To honour the JVM settings for this build a new JVM will be forked. Please consider using the daemon: https://docs.gradle.org/6.5/userguide/gradle_daemon.html.
Daemon will be stopped at the end of the build stopping after processing
> Configure project :
You are using one or more deprecated Asciidoctor Gradle plugin features. To help with migration run with --warning-mode=all.
> Task :compileJava UP-TO-DATE
> Task :compileGroovy UP-TO-DATE
> Task :nodeSetup UP-TO-DATE
> Task :npmSetup SKIPPED
> Task :processResources UP-TO-DATE
> Task :classes UP-TO-DATE
> Task :compileTestJava UP-TO-DATE
> Task :npmInstall
audited 4 packages in 0.635s
found 0 vulnerabilities
> Task :jar UP-TO-DATE
> Task :compileTestGroovy UP-TO-DATE
> Task :processTestResources UP-TO-DATE
> Task :testClasses UP-TO-DATE
> Task :test UP-TO-DATE
BUILD SUCCESSFUL in 15s
10 actionable tasks: 1 executed, 9 up-to-date
C:\projectsASF\Git\ofbiz-framework>
{noformat}
> Update jquery-validation to 1.19.3 for security reason
> ------------------------------------------------------
>
> Key: OFBIZ-12339
> URL: https://issues.apache.org/jira/browse/OFBIZ-12339
> Project: OFBiz
> Issue Type: Sub-task
> Components: themes
> Affects Versions: Trunk
> Reporter: Jacques Le Roux
> Assignee: Jacques Le Roux
> Priority: Major
>
> Thanks for Aditya's work at OFBIZ-11960 (thks also to Daniel's commit) and Dependabot installed at GH I have been warned about this vulnerability. It did not reach commits@ofbiz.apache.org. because of a bug I reported at INFRA-22418.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)