From f7c47bb085eeda732374c287d4ea0894a653d7d4 Mon Sep 17 00:00:00 2001 From: Sebastian J Date: Sat, 11 Aug 2018 00:48:17 -0400 Subject: [PATCH] Issue #190 - Spring Data Commons vulnerability Fixed security issue with spring-data-commons by update to version `Ingalls-SR14` - see CVE-2018-1273 --- pom.xml | 6 ++--- src/changes/changes.xml | 59 +++++++++++++++++++++++++++++++++++++---- 2 files changed, 57 insertions(+), 8 deletions(-) diff --git a/pom.xml b/pom.xml index 32109160..37005c77 100755 --- a/pom.xml +++ b/pom.xml @@ -20,7 +20,7 @@ 4.0.0 com.github.derjust spring-data-dynamodb - 4.5.7-SNAPSHOT + 4.5.7 Spring Data DynamoDB 2018 @@ -38,7 +38,7 @@ 4.3.6.RELEASE - Ingalls-RELEASE + Ingalls-SR14 5.2.4.Final 1.11.289 @@ -529,7 +529,7 @@ https://github.com/spring-data-dynamodb/spring-data-dynamodb scm:git:ssh://github.com/spring-data-dynamodb/spring-data-dynamodb.git scm:git:ssh://git@github.com/spring-data-dynamodb/spring-data-dynamodb.git - v5.0.2 + v4.5.7 diff --git a/src/changes/changes.xml b/src/changes/changes.xml index 331cd638..37356694 100644 --- a/src/changes/changes.xml +++ b/src/changes/changes.xml @@ -23,10 +23,56 @@ derjust - + Fix Javadoc and cast warnings + + Added support for @Query-based projections + + + Publish master builds to OSSRH as SNAPSHOT + + + Fix incomplete AWS DynamoDBMapper initialization + + + Fix compatibility with AWS SDK 1.11.36 (NullPointerException) + + + Fixed NullPointerException for DynamoDBIndexHashKey (GSI) + + + Confirmed that findByKeyAndOtherKey returns null/Optional.empty() + + + Use just Spring-Data Commons dependency inspired by + https://github.com/sheradmin/spring-data-dynamodb/commit/57efbce2978481cbaf374f01d88424766a314662 + + + Add support for DynamoDBTypeConverted annotations on hash key + + + Fixed NullPointerException for findAllByOrderByProperty queries + + + Fixed method signature + + + Spring Data Rest uses a PersistentEntityResourceAssembler that requires the DynamoDBMappingContext to be exposed as a Spring Bean. + + + Fixed NPE when deleting nonexistent entity + + + Match hibernate validator dependency version with Spring Boot 2 dependency. + + + `Pageable.unpaged()` find queries fail + + + Update to spring-data 2.0.9 due to fix CVE-2018-1273 + @@ -79,15 +125,18 @@ Support @DynamoDBTypeConverted instead of/in addition to @DynamoDBMarshalling for query methods + + Transfer to spring-data-dynamodb organization + Added Spring 5 / Spring-Data Kay support - - - spring-data project artifact does not provide version information thus can't calculate compatibility + + + Update to spring-data Ingalls-SR14 due to fix CVE-2018-1273 @@ -119,4 +168,4 @@ - \ No newline at end of file +