Fixed audit findings

.github/workflows/ci-build.yml

@@ -33,14 +33,10 @@ jobs:
           restore-keys: ${{ runner.os }}-sonar
       - name: Enable testcontainer reuse
         run: echo 'testcontainers.reuse.enable=true' > "$HOME/.testcontainers.properties"
-      - name: Run scalafix linting
-        run: |
-          JAVA_HOME=$JAVA_HOME_11_X64 mvn --batch-mode clean compile test-compile scalastyle:check scalafix:scalafix
       - name: Run tests and build with Maven
         run: |
           JAVA_HOME=$JAVA_HOME_11_X64 mvn --batch-mode clean verify \
               -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \
-              -Dossindex.skip=true \
               -DtrimStackTrace=false
       - name: Publish Test Report
         uses: scacap/action-surefire-report@v1

.github/workflows/linting.yml

@@ -0,0 +1,27 @@
+name: CI Linting
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
+    steps:
+      - name: Checkout the repository
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Set up JDK 11
+        uses: actions/setup-java@v3
+        with:
+          distribution: "temurin"
+          java-version: 11
+          cache: "maven"
+      - name: Run scalafix linting
+        run: mvn --batch-mode clean compile test-compile scalastyle:check scalafix:scalafix

.project-keeper.yml

@@ -16,7 +16,6 @@ linkReplacements:
   - "http://nexus.sonatype.org/oss-repository-hosting.html/scalatest-maven-plugin|https://github.com/scalatest/scalatest-maven-plugin"
   - "https://logging.apache.org/log4j/2.x/log4j-1.2-api/|https://logging.apache.org/log4j/2.x/"
 excludes:
-  - "E-PK-CORE-18: Outdated content: '.github/workflows/ci-build.yml'"
   - "E-PK-CORE-18: Outdated content: '.github/workflows/ci-build-next-java.yml'"
   - "E-PK-CORE-18: Outdated content: '.github/workflows/release_droid_upload_github_release_assets.yml'"
   - "E-PK-CORE-18: Outdated content: '.github/workflows/release_droid_prepare_original_checksum.yml'"

doc/changes/changes_2.7.2.md

@@ -46,6 +46,7 @@ With this release we updated the user guide documentation and upgraded dependenc
 * Updated `org.apache.orc:orc-core:1.8.3` to `1.9.0`
 * Updated `org.apache.spark:spark-sql_2.13:3.3.2` to `3.4.1`
 * Removed `org.codehaus.jackson:jackson-mapper-asl:1.9.13`
+* Added `org.jetbrains.kotlin:kotlin-stdlib:1.9.0`
 * Updated `org.scala-lang:scala-library:2.13.10` to `2.13.11`
 * Updated `org.slf4j:jul-to-slf4j:2.0.6` to `2.0.7`
 * Updated `org.slf4j:slf4j-log4j12:2.0.6` to `2.0.7`
@@ -57,7 +58,7 @@ With this release we updated the user guide documentation and upgraded dependenc
 * Updated `com.exasol:exasol-testcontainers:6.5.1` to `6.6.1`
 * Updated `com.exasol:extension-manager-integration-test-java:0.2.2` to `0.4.0`
 * Updated `com.exasol:hamcrest-resultset-matcher:1.5.2` to `1.6.0`
-* Updated `nl.jqno.equalsverifier:equalsverifier:3.14.1` to `3.14.3`
+* Updated `nl.jqno.equalsverifier:equalsverifier:3.14.1` to `3.15.1`
 * Updated `org.junit.jupiter:junit-jupiter-engine:5.9.2` to `5.10.0`
 * Updated `org.mockito:mockito-core:5.2.0` to `5.4.0`
 * Updated `org.scalatestplus:scalatestplus-mockito_2.13:1.0.0-M2` to `1.0.0-SNAP5`

pom.xml

@@ -265,8 +265,19 @@
                     <groupId>com.fasterxml.jackson.core</groupId>
                     <artifactId>jackson-annotations</artifactId>
                 </exclusion>
+                <exclusion>
+                    <!-- Exclude to fix CVE-2023-3635 -->
+                    <groupId>com.squareup.okio</groupId>
+                    <artifactId>okio</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
+        <dependency>
+            <!-- Upgrade transitive dependency of hadoop-hdfs-client to fix CVE-2022-24329 -->
+            <groupId>org.jetbrains.kotlin</groupId>
+            <artifactId>kotlin-stdlib</artifactId>
+            <version>1.9.0</version>
+        </dependency>
         <dependency>
             <groupId>org.alluxio</groupId>
             <artifactId>alluxio-core-client-hdfs</artifactId>
@@ -545,7 +556,7 @@
         <dependency>
             <groupId>nl.jqno.equalsverifier</groupId>
             <artifactId>equalsverifier</artifactId>
-            <version>3.14.3</version>
+            <version>3.15.1</version>
             <scope>test</scope>
         </dependency>
         <dependency>