diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 000000000..bc18a32e3 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,31 @@ +--- +name: Bug report +about: Create a report to help us improve +title: '' +labels: '' +assignees: '' + +--- + +**Describe the bug** +A clear and concise description of what the bug is. + +**To Reproduce** +Steps to reproduce the behavior: +1. Go to '...' +2. Click on '....' +3. Scroll down to '....' +4. See error + +**Expected behavior** +A clear and concise description of what you expected to happen. + +**Screenshots** +If applicable, add screenshots to help explain your problem. + +**Operating System (please complete the following information):** + - OS: [e.g. iOS] + - Volttron Version [develop, releases/8.2, main] + +**Additional context** +Add any other context about the problem here. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 000000000..bbcbbe7d6 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,20 @@ +--- +name: Feature request +about: Suggest an idea for this project +title: '' +labels: '' +assignees: '' + +--- + +**Is your feature request related to a problem? Please describe.** +A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] + +**Describe the solution you'd like** +A clear and concise description of what you want to happen. + +**Describe alternatives you've considered** +A clear and concise description of any alternative solutions or features you've considered. + +**Additional context** +Add any other context or screenshots about the feature request here. diff --git a/.github/issue_template.md b/.github/issue_template.md deleted file mode 100644 index 681e4a87b..000000000 --- a/.github/issue_template.md +++ /dev/null @@ -1,17 +0,0 @@ - -### Description of Issue - - -### Affected Version - -### Screenshots - -#### Expected - -#### Actual - -### Steps to Reproduce - -### Additional Details - - diff --git a/.github/workflows/auto-assign-project.yml b/.github/workflows/auto-assign-project.yml new file mode 100644 index 000000000..f5e25921d --- /dev/null +++ b/.github/workflows/auto-assign-project.yml @@ -0,0 +1,22 @@ +name: Add bugs to bugs project + +on: + issues: + types: + - opened + +jobs: + add-to-project: + name: Add issue to project + runs-on: ubuntu-latest + steps: + - uses: actions/add-to-project@v0.3.0 + with: + # You can target a repository in a different organization + # to the issue + project-url: https://github.com/orgs/GRIDAPPSD/projects/7 + # project-url: https://github.com/orgs//projects/ + # github-token: ${{ secrets.ADD_TO_PROJECT_PAT }} + github-token: ${{ secrets.AUTO_ASSIGN_PAT }} + # labeled: bug, needs-triage + # label-operator: OR diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..e99ca4105 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,27 @@ +# Security Policy + +## Reporting a Vulnerability + +If you believe you have found a security vulnerability in GOSS-GridAPPS-D, +please report it privately through GitHub's private vulnerability reporting. + +Go to the **Security** tab of this repository and click **Report a vulnerability**. +This opens a private advisory visible only to the maintainers, so details are +not disclosed publicly before a fix is available. + +Please include enough information to reproduce the issue: affected version or +commit, a description of the impact, and steps to trigger the behavior. + +## Response Expectations + +GOSS-GridAPPS-D is a research platform maintained on a best-effort basis. +We do not offer a formal service level agreement or a guaranteed response +window, and we do not maintain a fixed supported-version matrix. Maintainers +will acknowledge and triage reports as capacity allows, and will coordinate +disclosure of any confirmed issue with the reporter. + +## Scope + +Reports about this repository's source code and its published artifacts are in +scope. For issues in a dependency, please report them to that project directly; +we will address the dependency update here once an upstream fix is available. diff --git a/build.gradle b/build.gradle index c37d72b9d..784435d68 100644 --- a/build.gradle +++ b/build.gradle @@ -292,20 +292,20 @@ task collectBundles(type: Copy) { 'org.apache.felix:org.apache.felix.metatype:1.2.4', // Jetty 11.x WebSocket support (required by ActiveMQ 6.2.0 for ws:// transport) - 'org.eclipse.jetty.websocket:websocket-jetty-server:11.0.24', - 'org.eclipse.jetty.websocket:websocket-jetty-api:11.0.24', - 'org.eclipse.jetty.websocket:websocket-jetty-common:11.0.24', - 'org.eclipse.jetty.websocket:websocket-core-server:11.0.24', - 'org.eclipse.jetty.websocket:websocket-core-common:11.0.24', - 'org.eclipse.jetty.websocket:websocket-servlet:11.0.24', - 'org.eclipse.jetty:jetty-servlet:11.0.24', - 'org.eclipse.jetty:jetty-server:11.0.24', - 'org.eclipse.jetty:jetty-http:11.0.24', - 'org.eclipse.jetty:jetty-io:11.0.24', - 'org.eclipse.jetty:jetty-util:11.0.24', - 'org.eclipse.jetty:jetty-security:11.0.24', - 'org.eclipse.jetty:jetty-webapp:11.0.24', - 'org.eclipse.jetty:jetty-xml:11.0.24', + 'org.eclipse.jetty.websocket:websocket-jetty-server:12.0.33', + 'org.eclipse.jetty.websocket:websocket-jetty-api:12.0.33', + 'org.eclipse.jetty.websocket:websocket-jetty-common:12.0.33', + 'org.eclipse.jetty.websocket:websocket-core-server:12.0.33', + 'org.eclipse.jetty.websocket:websocket-core-common:12.0.33', + 'org.eclipse.jetty.websocket:websocket-servlet:12.0.33', + 'org.eclipse.jetty:jetty-servlet:12.0.33', + 'org.eclipse.jetty:jetty-server:12.0.33', + 'org.eclipse.jetty:jetty-http:12.0.33', + 'org.eclipse.jetty:jetty-io:12.0.33', + 'org.eclipse.jetty:jetty-util:12.0.33', + 'org.eclipse.jetty:jetty-security:12.0.33', + 'org.eclipse.jetty:jetty-webapp:12.0.33', + 'org.eclipse.jetty:jetty-xml:12.0.33', // Pax Logging (OSGi-native logging framework) // Provides SLF4J 2.x API + Log4j2 backend with properties-based configuration @@ -323,9 +323,9 @@ task collectBundles(type: Copy) { 'org.ow2.asm:asm-util:9.7', // Jackson (GridAPPS-D requires 2.18.1+ per bnd.bnd) - 'com.fasterxml.jackson.core:jackson-core:2.18.1', - 'com.fasterxml.jackson.core:jackson-databind:2.18.1', - 'com.fasterxml.jackson.core:jackson-annotations:2.18.1', + 'com.fasterxml.jackson.core:jackson-core:2.18.6', + 'com.fasterxml.jackson.core:jackson-databind:2.18.6', + 'com.fasterxml.jackson.core:jackson-annotations:2.18.6', // GSON (GOSS uses 2.11.0 per bnd.bnd) 'com.google.code.gson:gson:2.11.0', @@ -340,16 +340,16 @@ task collectBundles(type: Copy) { 'org.fusesource.stompjms:stompjms-client:1.19', // Shiro 2.0.0 (required by ActiveMQ 6.2.0 and GOSS for Jakarta EE support) - 'org.apache.shiro:shiro-core:2.0.0', - 'org.apache.shiro:shiro-lang:2.0.0', - 'org.apache.shiro:shiro-web:2.0.0', - 'org.apache.shiro:shiro-cache:2.0.0', - 'org.apache.shiro:shiro-event:2.0.0', - 'org.apache.shiro:shiro-crypto-core:2.0.0', - 'org.apache.shiro:shiro-crypto-hash:2.0.0', - 'org.apache.shiro:shiro-crypto-cipher:2.0.0', - 'org.apache.shiro:shiro-config-core:2.0.0', - 'org.apache.shiro:shiro-config-ogdl:2.0.0', + 'org.apache.shiro:shiro-core:2.2.1', + 'org.apache.shiro:shiro-lang:2.2.1', + 'org.apache.shiro:shiro-web:2.2.1', + 'org.apache.shiro:shiro-cache:2.2.1', + 'org.apache.shiro:shiro-event:2.2.1', + 'org.apache.shiro:shiro-crypto-core:2.2.1', + 'org.apache.shiro:shiro-crypto-hash:2.2.1', + 'org.apache.shiro:shiro-crypto-cipher:2.2.1', + 'org.apache.shiro:shiro-config-core:2.2.1', + 'org.apache.shiro:shiro-config-ogdl:2.2.1', // Commons BeanUtils (required by Shiro config-ogdl) 'commons-beanutils:commons-beanutils:1.9.4', @@ -365,9 +365,9 @@ task collectBundles(type: Copy) { 'org.apache.httpcomponents:httpcore-osgi:4.4.16', // Commons libraries (GOSS versions per bnd.bnd) - 'commons-io:commons-io:2.16.1', + 'commons-io:commons-io:2.14.0', 'commons-lang:commons-lang:2.6', - 'org.apache.commons:commons-lang3:3.17.0', + 'org.apache.commons:commons-lang3:3.18.0', 'commons-pool:commons-pool:1.6', 'org.apache.commons:commons-pool2:2.12.0', 'commons-dbcp:commons-dbcp:1.4', diff --git a/gridappsd-jena/build.gradle b/gridappsd-jena/build.gradle index b26881152..927141453 100644 --- a/gridappsd-jena/build.gradle +++ b/gridappsd-jena/build.gradle @@ -24,20 +24,20 @@ dependencies { // Jena transitive dependencies embed 'org.apache.commons:commons-csv:1.5' // Jena 3.7.0 uses 1.5 - embed 'org.apache.thrift:libthrift:0.10.0' // Jena 3.7.0 uses 0.10.0 + embed 'org.apache.thrift:libthrift:0.23.0' // Jena 3.7.0 uses 0.23.0 embed 'com.github.andrewoma.dexx:collection:0.7' embed 'com.github.jsonld-java:jsonld-java:0.12.0' // Jena 3.7.0 uses 0.12.0 embed 'commons-codec:commons-codec:1.11' // Jena 3.7.0 uses 1.11 - embed 'org.apache.commons:commons-lang3:3.4' + embed 'org.apache.commons:commons-lang3:3.18.0' // HTTP components for remote SPARQL endpoints embed 'org.apache.httpcomponents:httpclient:4.5.5' embed 'org.apache.httpcomponents:httpcore:4.4.9' // Jackson for JSON parsing - embed 'com.fasterxml.jackson.core:jackson-core:2.9.5' - embed 'com.fasterxml.jackson.core:jackson-databind:2.9.5' - embed 'com.fasterxml.jackson.core:jackson-annotations:2.9.5' + embed 'com.fasterxml.jackson.core:jackson-core:2.18.6' + embed 'com.fasterxml.jackson.core:jackson-databind:2.18.6' + embed 'com.fasterxml.jackson.core:jackson-annotations:2.18.6' // Xerces for XML parsing (Jena needs it) embed 'xerces:xercesImpl:2.11.0' diff --git a/gridappsd-poi/build.gradle b/gridappsd-poi/build.gradle index 0e4ba8b67..02b47f767 100644 --- a/gridappsd-poi/build.gradle +++ b/gridappsd-poi/build.gradle @@ -16,9 +16,9 @@ configurations { dependencies { // Apache POI core components for Excel handling - embed 'org.apache.poi:poi:3.17' - embed 'org.apache.poi:poi-ooxml:3.17' - embed 'org.apache.poi:poi-ooxml-schemas:3.17' + embed 'org.apache.poi:poi:5.4.0' + embed 'org.apache.poi:poi-ooxml:5.4.0' + embed 'org.apache.poi:poi-ooxml-schemas:5.4.0' // POI transitive dependencies embed 'org.apache.xmlbeans:xmlbeans:2.6.0' @@ -26,11 +26,11 @@ dependencies { embed 'commons-codec:commons-codec:1.10' // POI 3.17 uses 1.10 // XML Security (needed by POI for signed documents) - embed 'org.apache.santuario:xmlsec:2.1.0' + embed 'org.apache.santuario:xmlsec:2.2.6' // Bouncy Castle (needed by xmlsec) - embed 'org.bouncycastle:bcprov-jdk15on:1.58' - embed 'org.bouncycastle:bcpkix-jdk15on:1.58' + embed 'org.bouncycastle:bcprov-jdk15on:1.70' + embed 'org.bouncycastle:bcpkix-jdk15on:1.70' // Curve25519 (needed by POI) embed 'com.github.virtuald:curvesapi:1.04' @@ -70,10 +70,10 @@ shadowJar { 'Bundle-Version': '3.17.0', 'Bundle-Vendor': 'PNNL', // Export only the POI packages that GridAPPS-D uses - 'Export-Package': 'org.apache.poi.ss.usermodel;version="3.17.0",' + - 'org.apache.poi.hssf.usermodel;version="3.17.0",' + - 'org.apache.poi.xssf.usermodel;version="3.17.0",' + - 'org.apache.poi.ss.util;version="3.17.0"', + 'Export-Package': 'org.apache.poi.ss.usermodel;version="5.4.0.0",' + + 'org.apache.poi.hssf.usermodel;version="5.4.0.0",' + + 'org.apache.poi.xssf.usermodel;version="5.4.0.0",' + + 'org.apache.poi.ss.util;version="5.4.0.0"', // Import from OSGi environment 'Import-Package': 'org.slf4j;version="[1.7,3)";resolution:=optional,' + 'javax.xml.parsers,' + diff --git a/gridappsd-proven/build.gradle b/gridappsd-proven/build.gradle index 8ac2eaffa..bceaf4ad9 100644 --- a/gridappsd-proven/build.gradle +++ b/gridappsd-proven/build.gradle @@ -53,10 +53,10 @@ dependencies { embed files('../cnf/cache/7.1.0/GOSS Dependencies/shacl-1.1.0.jar') // Hazelcast for proven-message serialization - embed 'com.hazelcast:hazelcast:3.9.3' + embed 'com.hazelcast:hazelcast:5.2.5' // Commons IO (proven-message needs it) - embed 'commons-io:commons-io:2.6' + embed 'commons-io:commons-io:2.14.0' // SLF4J API (don't embed implementation, let OSGi provide it) compileOnly 'org.slf4j:slf4j-api:2.0.16'