From 58cf6fc0dfc93ed625733bf9e9477e8e57e0a9d2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 27 Jan 2022 08:53:07 -0800 Subject: [PATCH 01/29] Bump `xmlunit.version` from 2.8.4 to 2.9.0 (#6218) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- core/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/pom.xml b/core/pom.xml index 28fbaaaf812bd..af1529aa61b06 100644 --- a/core/pom.xml +++ b/core/pom.xml @@ -41,7 +41,7 @@ THE SOFTWARE. true 2.2 - 2.8.4 + 2.9.0 From adf23ab2e40d325aaa3ffefcfea0076dd8530bae Mon Sep 17 00:00:00 2001 From: Basil Crow Date: Thu, 27 Jan 2022 08:56:22 -0800 Subject: [PATCH 02/29] EOL support for JRuby (#6209) --- core/src/main/java/hudson/util/XStream2.java | 7 ------ .../jenkins/security/whitelisted-classes.txt | 24 ------------------- 2 files changed, 31 deletions(-) diff --git a/core/src/main/java/hudson/util/XStream2.java b/core/src/main/java/hudson/util/XStream2.java index 2ac02f6062b6e..204fd0e39d851 100644 --- a/core/src/main/java/hudson/util/XStream2.java +++ b/core/src/main/java/hudson/util/XStream2.java @@ -81,7 +81,6 @@ import java.util.concurrent.ConcurrentHashMap; import java.util.logging.Level; import java.util.logging.Logger; -import java.util.regex.Pattern; import jenkins.model.Jenkins; import jenkins.util.xstream.SafeURLConverter; @@ -570,18 +569,12 @@ public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext co throw new ConversionException("Refusing to unmarshal " + reader.getNodeName() + " for security reasons; see https://www.jenkins.io/redirect/class-filter/"); } - /** TODO see comment in {@code whitelisted-classes.txt} */ - private static final Pattern JRUBY_PROXY = Pattern.compile("org[.]jruby[.]proxy[.].+[$]Proxy\\d+"); - @Override public boolean canConvert(Class type) { if (type == null) { return false; } String name = type.getName(); - if (JRUBY_PROXY.matcher(name).matches()) { - return false; - } // claim we can convert all the scary stuff so we can throw exceptions when attempting to do so return ClassFilter.DEFAULT.isBlacklisted(name) || ClassFilter.DEFAULT.isBlacklisted(type); } diff --git a/core/src/main/resources/jenkins/security/whitelisted-classes.txt b/core/src/main/resources/jenkins/security/whitelisted-classes.txt index b7d4049406287..fbcdc1a9de017 100644 --- a/core/src/main/resources/jenkins/security/whitelisted-classes.txt +++ b/core/src/main/resources/jenkins/security/whitelisted-classes.txt @@ -135,34 +135,10 @@ org.apache.commons.fileupload.disk.DiskFileItem org.apache.commons.fileupload.util.FileItemHeadersImpl org.apache.tools.ant.Location -# TODO see main ruby-runtime section below -org.jenkinsci.jruby.JRubyMapper$DynamicProxy - # TODO remove when https://github.com/jenkinsci/xtrigger-lib/pull/9 is widely adopted in fstrigger-plugin, urltrigger-plugin, etc. org.jenkinsci.lib.xtrigger.XTriggerCause org.jenkinsci.lib.xtrigger.XTriggerCauseAction -# TODO remove (also XStream2.BlacklistedTypesConverter.JRUBY_PROXY) when Ruby Runtime is fixed -# Related PRs: -# - https://github.com/jenkinsci/ruby-runtime-plugin/pull/5, -# - https://github.com/jenkinsci/ruby-runtime-plugin/pull/6 -# -# oleg-nenashev in PR#6 we are trying to get help from last maintainers due to the plugin codebase splitbrain. -# It is required to fix JENKINS-50616 in a proper way for 2.107.x -org.jruby.RubyArray -org.jruby.RubyBignum -org.jruby.RubyBoolean -org.jruby.RubyBoolean$False -org.jruby.RubyBoolean$True -org.jruby.RubyFixnum -org.jruby.RubyHash -org.jruby.RubyNil -org.jruby.RubyObject -org.jruby.RubyString -org.jruby.RubySymbol -org.jruby.java.proxies.ConcreteJavaProxy -org.jruby.runtime.builtin.IRubyObject - org.jvnet.hudson.MemoryUsage org.jvnet.localizer.Localizable org.jvnet.localizer.ResourceBundleHolder From 726c68cf5a6a29d53ba2cb177a66a28c43ae1f1a Mon Sep 17 00:00:00 2001 From: EBIBO Date: Fri, 28 Jan 2022 19:01:38 +0800 Subject: [PATCH 03/29] [JENKINS-67496] Drag & drop is messed up, drag placeholders always have tiny size (#6184) --- war/src/main/js/sortable-drag-drop.js | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/war/src/main/js/sortable-drag-drop.js b/war/src/main/js/sortable-drag-drop.js index 84217f3ce2382..4130af451f915 100644 --- a/war/src/main/js/sortable-drag-drop.js +++ b/war/src/main/js/sortable-drag-drop.js @@ -23,6 +23,14 @@ function registerSortableDragDrop(e) { forceFallback: true, // Do not use html5 drag & drop behaviour because it does not work with autoscroll scroll: true, bubbleScroll: true, + onChoose: function (event) { + const draggableDiv = event.item; + const height = draggableDiv.clientHeight; + draggableDiv.style.height = `${height}px`; + }, + onUnchoose: function (event) { + event.item.style.removeProperty('height'); + } }); } From 4a7d59496b1abb68b9a10c5babeac12ad8506561 Mon Sep 17 00:00:00 2001 From: Wadeck Follonier Date: Fri, 28 Jan 2022 12:03:08 +0100 Subject: [PATCH 04/29] [JENKINS-67674] Update bundled dependencies after the advisory (#6180) Co-authored-by: Daniel Beck --- .../hudson/model/AbstractProjectTest.java | 10 +++ war/pom.xml | 84 ++++++++++++++++++- 2 files changed, 90 insertions(+), 4 deletions(-) diff --git a/test/src/test/java/hudson/model/AbstractProjectTest.java b/test/src/test/java/hudson/model/AbstractProjectTest.java index d26f4d81f692f..105b4ea01a78d 100644 --- a/test/src/test/java/hudson/model/AbstractProjectTest.java +++ b/test/src/test/java/hudson/model/AbstractProjectTest.java @@ -438,6 +438,16 @@ public void configDotXmlSubmissionToDifferentType() throws Exception { tpm.installDetachedPlugin("scm-api"); tpm.installDetachedPlugin("workflow-api"); tpm.installDetachedPlugin("script-security"); + tpm.installDetachedPlugin("jquery3-api"); + tpm.installDetachedPlugin("snakeyaml-api"); + tpm.installDetachedPlugin("jackson2-api"); + tpm.installDetachedPlugin("popper-api"); + tpm.installDetachedPlugin("plugin-util-api"); + tpm.installDetachedPlugin("font-awesome-api"); + tpm.installDetachedPlugin("bootstrap4-api"); + tpm.installDetachedPlugin("echarts-api"); + tpm.installDetachedPlugin("display-url-api"); + tpm.installDetachedPlugin("checks-api"); tpm.installDetachedPlugin("junit"); tpm.installDetachedPlugin("matrix-project"); diff --git a/war/pom.xml b/war/pom.xml index e0c5d5f6e171a..034f1e06c29ae 100644 --- a/war/pom.xml +++ b/war/pom.xml @@ -258,13 +258,13 @@ THE SOFTWARE. org.jenkins-ci.plugins display-url-api - 2.3.1 + 2.3.4 hpi org.jenkins-ci.plugins mailer - 1.32.1 + 408.vd726a_1130320 hpi @@ -288,7 +288,7 @@ THE SOFTWARE. org.jenkins-ci.plugins matrix-project - 1.18 + 1.20 hpi @@ -300,7 +300,7 @@ THE SOFTWARE. org.jenkins-ci.plugins junit - 1.29 + 1.47 hpi @@ -310,6 +310,82 @@ THE SOFTWARE. 2.42 hpi + + + io.jenkins.plugins + plugin-util-api + 1.5.0 + hpi + + + + io.jenkins.plugins + bootstrap4-api + 4.5.3-1 + hpi + + + + io.jenkins.plugins + checks-api + 1.1.1 + hpi + + + + org.jenkins-ci.plugins + jackson2-api + 2.12.0 + hpi + + + + io.jenkins.plugins + echarts-api + 4.9.0-2 + hpi + + + + + io.jenkins.plugins + snakeyaml-api + 1.27.0 + hpi + + + + + io.jenkins.plugins + jquery3-api + 3.5.1-2 + hpi + + + + + org.jenkins-ci.plugins + jackson2-api + 2.12.0 + hpi + + + + + io.jenkins.plugins + popper-api + 1.16.0-7 + hpi + + + + + io.jenkins.plugins + font-awesome-api + 5.15.1-1 + hpi + + org.jenkins-ci.plugins.workflow From 1af49f99754a73e6f5a997f576a339a43d4bffe4 Mon Sep 17 00:00:00 2001 From: Basil Crow Date: Fri, 28 Jan 2022 09:06:40 -0800 Subject: [PATCH 05/29] Exclude newer versions of `tyrus-standalone-client-jdk` that require Java 11 (#6227) --- .github/dependabot.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 9cec7116807de..891d18c8a469f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -23,6 +23,9 @@ updates: - dependency-name: "javax.servlet.servlet-api" # needs a jakarta upgrade project, imports changed - dependency-name: "jakarta.servlet.jsp.jstl.jakarta.servlet.jsp.jstl-api" + # Starting with version 2.0.2, this library requires Java 11 + - dependency-name: "org.glassfish.tyrus.bundles:tyrus-standalone-client-jdk" + versions: [">=2.0.2"] # see https://github.com/jenkinsci/jenkins/pull/4224 can't be updated without breaking api - dependency-name: "org.jfree:jfreechart" # the dependency is actually provided by the Web container, hence it is aligned with Jetty. See https://github.com/jenkinsci/jenkins/pull/5211 From 691bc959c5b46b15c75e927935a93cd2c8026342 Mon Sep 17 00:00:00 2001 From: NivKeidan <51288016+NivKeidan@users.noreply.github.com> Date: Sun, 30 Jan 2022 10:40:47 +0000 Subject: [PATCH 06/29] JENKINS-67635 consider agent label expressions when applying trimLabels (#6193) --- core/src/main/java/jenkins/model/Jenkins.java | 2 +- .../hudson/slaves/NodeProvisionerTest.java | 85 +++++++++++++++++++ 2 files changed, 86 insertions(+), 1 deletion(-) diff --git a/core/src/main/java/jenkins/model/Jenkins.java b/core/src/main/java/jenkins/model/Jenkins.java index a9323a48bf700..b52340f0cee52 100644 --- a/core/src/main/java/jenkins/model/Jenkins.java +++ b/core/src/main/java/jenkins/model/Jenkins.java @@ -2268,7 +2268,7 @@ private void trimLabels(@CheckForNull Set includedLabels) { this.getNodes().forEach(n -> nodeLabels.addAll(n.getAssignedLabels())); for (Iterator