This is an automated email from the ASF dual-hosted git repository.
dependabot[bot] pushed a change to branch
dependabot/gradle/gradle-wrapper-8.14.6
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
omit d247ad032c Bump gradle-wrapper from 8.14.5 to 8.14.6
add 66803eca23 Improved: GL-posting and order-completion invoicing
commit-ECAs lack run-as-user="system" (OFBIZ-13673)
add 5f6705bc66 Improved: Scope password-reset JWTs to their purpose,
confined to the password-change flow
add bda0073f5a Bump com.twelvemonkeys.imageio:imageio-tiff from 3.15.2 to
3.15.3
add 66d9f60790 Bump tomcat from 10.1.60 to 10.1.61
add 7bb3486b10 Bump org.apache.cxf:cxf-rt-frontend-jaxrs from 4.2.3 to
4.2.4
add 4da78d2465 Bump actions/upload-artifact from 7.0.1 to 7.0.2
add aef4085c89 Fixed: Missing permission checks on FinAccount
GL-reconciliation services (OFBIZ-13683)
add 0f18dff732 Bump github/codeql-action/upload-sarif
add 3a5cc5c242 Improved: Bump github/codeql-action/init and analyze from
4.38.2 to 4.38.3
add a68331a4b1 Bump tika from 3.3.2 to 3.3.3
add 1953858e36 Improved: Pin Scorecard upload-sarif to a codeql-action
release instead of a main-branch commit
add b8b72d556e Improved: Group Dependabot updates for codeql-action init
and analyze
add 4aab182e8c Bump ossf/scorecard-action from 2.4.4 to 2.5.0
add 5b1856083d Improved: Use a single Apache Shiro version and drop
shiro-core (OFBIZ-13685)
add c0513fb2f8 Improved: FtlWriter calls every macro through one constant
template (OFBIZ-13675)
add 9fe2a26492 Bump dompurify in
/themes/common-theme/webapp/common-theme/js
add 7bd72c46b5 Bump swagger-ui-dist from 5.33.1 to 5.33.2 in
/framework/rest-api
add fb6b2939cd Improved: MacroMenuRenderer passes the macro parameters as
data (OFBIZ-13676)
add c5ac496917 Improved: MacroScreenRenderer passes the macro parameters
as data (OFBIZ-13677)
add 52cd10d0f0 Improved: MacroTreeRenderer passes the macro parameters as
data and writes to the given writer (OFBIZ-13678)
add 9c0d307576 Fixed: URL.getFile() used as a filesystem path breaks OFBiz
when the install directory contains a space (OFBIZ-13687)
add 5de1b918f1 Improved: Replace OpenPDF with Apache PDFBox and drop the
OpenPDF dependency (OFBIZ-13684)
add 35d68ab0e8 Improved: MacroFormRenderer builds the check, radio,
submit, reset, hidden and field title macro calls with
RenderableFtlFormElementsBuilder (OFBIZ-13679)
add 5611b685dc Fixed: Allow the content upload directory in the default
LOCAL_FILE allow-list (OFBIZ-13689)
add ab38bcdd65 Improved: MacroFormRenderer builds the form structure and
hyperlink macro calls with RenderableFtlFormElementsBuilder (OFBIZ-13680)
add c1f4c2b39d Fixed: PDF survey services fail to store answers and throw
a NullPointerException when no PDF is given (OFBIZ-13688)
add c12644866e Fixed: Preserve Webtools theme when editing entities
(OFBIZ-12072)
add 4b0e5aad8f Fixed: Survey PDF services read any server file named in
the pdfFileNameIn parameter (OFBIZ-13690)
add cc6d9d5d05 Improved: MacroFormRenderer builds the find, lookup,
pagination, file, password, image and banner macro calls with
RenderableFtlFormElementsBuilder (OFBIZ-13681)
add 2c8fc6dc61 Fixed: The tests of the text find and range find fields
reference the static mock of UtilProperties (OFBIZ-13681)
add 4ccdb3e917 Improved: The macro renderers cannot compile a string as a
template anymore (OFBIZ-13682)
add 1ff6ac5ceb Bump com.github.ben-manes.caffeine:caffeine from 3.3.0 to
3.3.1
add 4d701c9c69 Bump com.auth0:java-jwt from 4.6.1 to 4.6.2
add 6473bad372 Fixed: Survey PDF services throw a NullPointerException
when contentId matches no Content (OFBIZ-13692)
add f61726762a Fixed: cleanAll deletes the version-controlled
package-lock.json files (OFBIZ-13695)
add 44102f133d Implemented: Generate release notes with GitHub and label
pull requests by type from their title prefix (OFBIZ-13696)
add 4e30277efd Improved: Label pull requests titled "Bump ..." as
dependencies so that the release notes leave them out (OFBIZ-13696)
add 374fdbae25 Improved: Reject uploaded PDF files with hidden attachments
or active actions (OFBIZ-13693)
add 8286d1d3dd Improved: Set the release_branch label of pull requests
automatically (OFBIZ-13696)
add bb78d45e27 Bump the codeql-action group with 2 updates
add 314eaf8a68 Bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.0
add 503f6297ba Bump actions/setup-java from 6.0.1 to 6.1.0
add 1a1d9c1132 Fixed: Add permission checks to WebAnalyticsConfig services
add 70788dcee7 Fixed: Encode the source URL of screen image widgets
add a1602c5560 Fixed: Enforces order-update authorization in
updateShipGroupShipInfo and addItemToApprovedOrder
add c2516b5584 Fixed: Require the ORDERMGR_UPDATE permission in the
updateTrackingNumber service
add 0003431731 Fixed: Encode the source URL of menu, tree and form images
add d1665ff2f0 Fixed: CodeQL workflow fails while printing debug logs
add ddccb6d363 Fixed: Build the sort links of list forms with an encoded
query string
add 5343967656 Improved: Remove the parsing of query strings encoded in
the request path
add 46d7803791 Fixed: Check every URL parameter value for markup in
ControlFilter
add 6294153cb7 Fix Redoc failing to load the OpenAPI specification
add f1faa87638 Upgrade Redoc to 3.0.1 and remove the npm overrides
add 7d3c10865f Bump swagger-ui-dist from 5.33.2 to 5.33.3 in
/framework/rest-api
add 7dd53e8af5 Fix blank Redoc page after the upgrade to Redoc 3
add 5d8d7924f8 Fixed: Close the embedded H2 database cleanly on shutdown
(OFBIZ-13686)
add bccb166ade Improved: Prevent the datasources from being reopened
during shutdown (OFBIZ-13686)
add 34a042341b Remove Jainrain matches from spotbugs exclude.xml
add 4afb1bc107 Fixed: init-gradle-wrapper installs a wrapper jar that does
not match the published checksum (OFBIZ-13699)
add 35f1a662a4 Fixed: Check the owner of the shopping list in
checkShoppingListSecurity
add 8b9358c167 Fixed: Check that the dataResourceId belongs to the
contentId in SimpleContentViewHandler
add f729aa2a35 Bump gradle-wrapper from 8.14.5 to 8.14.6
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (d247ad032c)
\
N -- N -- N refs/heads/dependabot/gradle/gradle-wrapper-8.14.6
(f729aa2a35)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
No new revisions were added by this update.
Summary of changes:
.github/README-CI-CD.md | 15 +
.github/dependabot.yml | 26 +
.../asf-allowlist-check.yml => release.yml} | 53 +-
.github/workflows/codeql-analysis.yml | 5 +-
.github/workflows/gradle.yml | 2 +-
.github/workflows/pr-type-label.yml | 162 ++
.github/workflows/scorecard.yml | 6 +-
DOCKER.adoc | 7 +
.../accounting/servicedef/secas_ledger.xml | 8 +-
.../accounting/servicedef/services_finaccount.xml | 12 +-
.../invoice/InvoiceServicesScript.groovy | 5 +-
applications/content/config/ContentUiLabels.xml | 18 +-
.../content/servicedef/services_survey.xml | 11 +-
.../apache/ofbiz/content/survey/PdfFormHelper.java | 155 ++
.../ofbiz/content/survey/PdfSurveyServices.java | 339 ++--
.../content/view/SimpleContentViewHandler.java | 7 +
applications/content/widget/survey/SurveyForms.xml | 2 -
applications/order/servicedef/secas.xml | 2 +-
applications/order/servicedef/services.xml | 5 +-
.../order/servicedef/services_shoppinglist.xml | 1 +
.../shoppinglist/ShoppingListServicesScript.groovy | 7 +
.../apache/ofbiz/order/order/OrderServices.java | 12 +
applications/product/servicedef/services.xml | 3 +
.../org/apache/ofbiz/product/image/ScaleImage.java | 5 +-
.../imagemanagement/ImageManagementServices.java | 3 +-
.../ofbiz/securityext/login/LoginEvents.java | 5 +-
.../src/main/groovy/ofbiz-node-conventions.gradle | 19 +-
dependencies.gradle | 4 +-
.../ofbiz/base/container/ContainerLoader.java | 15 +-
.../org/apache/ofbiz/base/util/ScriptUtil.java | 3 +-
.../java/org/apache/ofbiz/base/util/UtilCodec.java | 13 -
.../java/org/apache/ofbiz/base/util/UtilHttp.java | 20 -
.../java/org/apache/ofbiz/base/util/UtilURL.java | 23 +-
framework/common/servicedef/services.xml | 8 +
.../java/org/apache/ofbiz/common/CommonEvents.java | 3 +-
.../apache/ofbiz/common/login/LoginServices.java | 11 +-
framework/entity/ofbiz-component.xml | 2 +
...atorContainer.java => DataSourceContainer.java} | 39 +-
.../entity/connection/DBCPConnectionFactory.java | 22 +-
.../org/apache/ofbiz/entity/util/EntityCrypto.java | 12 +-
.../org/apache/ofbiz/minilang/MiniLangUtil.java | 3 +-
framework/rest-api/build.gradle | 2 +-
framework/rest-api/package-lock.json | 1277 +++-----------
framework/rest-api/package.json | 10 +-
.../ofbiz/ws/rs/openapi/OFBizOpenApiUiFilter.java | 6 +-
framework/rest-api/webapp/docs/README.adoc | 8 +-
framework/rest-api/webapp/docs/redoc.html | 17 +-
framework/security/config/security.properties | 14 +-
.../org/apache/ofbiz/security/SecuredUpload.java | 335 +++-
.../org/apache/ofbiz/security/SecurityUtil.java | 35 +-
.../org/apache/ofbiz/service/job/JobPoller.java | 10 +
.../java/org/apache/ofbiz/base/start/Start.java | 2 +
.../apache/ofbiz/webapp/control/ControlFilter.java | 36 +-
.../apache/ofbiz/webapp/control/LoginWorker.java | 33 +-
.../apache/ofbiz/webapp/view/ApacheFopWorker.java | 6 +-
.../ofbiz/webtools/entity/FindGeneric.groovy | 4 -
framework/webtools/widget/CommonScreens.xml | 1 +
.../widget/renderer/html/HtmlMenuRenderer.java | 15 +-
.../widget/renderer/html/HtmlTreeRenderer.java | 16 +-
.../ofbiz/widget/renderer/macro/FtlWriter.java | 105 +-
.../widget/renderer/macro/MacroCommonRenderer.java | 11 -
.../widget/renderer/macro/MacroFormRenderer.java | 1826 +-------------------
.../widget/renderer/macro/MacroMenuRenderer.java | 128 +-
.../widget/renderer/macro/MacroScreenRenderer.java | 294 +---
.../widget/renderer/macro/MacroTreeRenderer.java | 167 +-
.../macro/RenderableFtlFormElementsBuilder.java | 1114 +++++++++++-
...leFtlString.java => RenderableFtlVerbatim.java} | 34 +-
.../macro/renderable/RenderableFtlVisitor.java | 2 +-
.../ofbiz/widget/renderer/macro/FtlWriterTest.java | 75 +
.../renderer/macro/MacroFormRendererTest.java | 505 ++----
.../macro/MacroRenderersTemplateTextGuardTest.java | 98 ++
.../RenderableFtlFormElementsBuilderTest.java | 846 +++++++++
gradle/init-gradle-wrapper.ps1 | 100 +-
gradle/init-gradle-wrapper.sh | 97 +-
gradle/libs.versions.toml | 27 +-
spotbugs/exclude.xml | 12 -
.../webapp/common-theme/js/package-lock.json | 8 +-
.../webapp/common-theme/js/package.json | 2 +-
78 files changed, 4237 insertions(+), 4114 deletions(-)
copy .github/{workflows/asf-allowlist-check.yml => release.yml} (50%)
create mode 100644 .github/workflows/pr-type-label.yml
create mode 100644
applications/content/src/main/java/org/apache/ofbiz/content/survey/PdfFormHelper.java
copy
framework/entity/src/main/java/org/apache/ofbiz/entity/{DelegatorContainer.java
=> DataSourceContainer.java} (57%)
rename
framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/renderable/{RenderableFtlString.java
=> RenderableFtlVerbatim.java} (62%)
create mode 100644
framework/widget/src/test/java/org/apache/ofbiz/widget/renderer/macro/FtlWriterTest.java
create mode 100644
framework/widget/src/test/java/org/apache/ofbiz/widget/renderer/macro/MacroRenderersTemplateTextGuardTest.java
