From 7dacc531e8973b8705dac7e432a9af00b49c56b4 Mon Sep 17 00:00:00 2001 From: Craig <3979063+craig8@users.noreply.github.com> Date: Wed, 11 Jan 2023 12:04:00 -0800 Subject: [PATCH 1/4] Add auto assign and issue template update --- .github/ISSUE_TEMPLATE/bug_report.md | 31 +++++++++++++++++++++++ .github/ISSUE_TEMPLATE/feature_request.md | 20 +++++++++++++++ .github/issue_template.md | 17 ------------- .github/workflows/auto-assign-project.yml | 22 ++++++++++++++++ 4 files changed, 73 insertions(+), 17 deletions(-) create mode 100644 .github/ISSUE_TEMPLATE/bug_report.md create mode 100644 .github/ISSUE_TEMPLATE/feature_request.md delete mode 100644 .github/issue_template.md create mode 100644 .github/workflows/auto-assign-project.yml diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 000000000..bc18a32e3 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,31 @@ +--- +name: Bug report +about: Create a report to help us improve +title: '' +labels: '' +assignees: '' + +--- + +**Describe the bug** +A clear and concise description of what the bug is. + +**To Reproduce** +Steps to reproduce the behavior: +1. Go to '...' +2. Click on '....' +3. Scroll down to '....' +4. See error + +**Expected behavior** +A clear and concise description of what you expected to happen. + +**Screenshots** +If applicable, add screenshots to help explain your problem. + +**Operating System (please complete the following information):** + - OS: [e.g. iOS] + - Volttron Version [develop, releases/8.2, main] + +**Additional context** +Add any other context about the problem here. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 000000000..bbcbbe7d6 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,20 @@ +--- +name: Feature request +about: Suggest an idea for this project +title: '' +labels: '' +assignees: '' + +--- + +**Is your feature request related to a problem? Please describe.** +A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] + +**Describe the solution you'd like** +A clear and concise description of what you want to happen. + +**Describe alternatives you've considered** +A clear and concise description of any alternative solutions or features you've considered. + +**Additional context** +Add any other context or screenshots about the feature request here. diff --git a/.github/issue_template.md b/.github/issue_template.md deleted file mode 100644 index 681e4a87b..000000000 --- a/.github/issue_template.md +++ /dev/null @@ -1,17 +0,0 @@ - -### Description of Issue - - -### Affected Version - -### Screenshots - -#### Expected - -#### Actual - -### Steps to Reproduce - -### Additional Details - - diff --git a/.github/workflows/auto-assign-project.yml b/.github/workflows/auto-assign-project.yml new file mode 100644 index 000000000..8d30644f9 --- /dev/null +++ b/.github/workflows/auto-assign-project.yml @@ -0,0 +1,22 @@ +name: Add bugs to bugs project + +on: + issues: + types: + - opened + +jobs: + add-to-project: + name: Add issue to project + runs-on: ubuntu-latest + steps: + - uses: actions/add-to-project@v0.3.0 + with: + # You can target a repository in a different organization + # to the issue + project-url: https://github.com/orgs/eclipse-volttron/projects/3 + # project-url: https://github.com/orgs//projects/ + # github-token: ${{ secrets.ADD_TO_PROJECT_PAT }} + github-token: ${{ secrets.AUTO_ASSIGN_PAT }} + # labeled: bug, needs-triage + # label-operator: OR From 239e30418ff34fa5840765b2b6a64199bb37888c Mon Sep 17 00:00:00 2001 From: Craig <3979063+craig8@users.noreply.github.com> Date: Thu, 12 Jan 2023 12:56:22 -0800 Subject: [PATCH 2/4] Update auto-assign-project.yml --- .github/workflows/auto-assign-project.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/auto-assign-project.yml b/.github/workflows/auto-assign-project.yml index 8d30644f9..f5e25921d 100644 --- a/.github/workflows/auto-assign-project.yml +++ b/.github/workflows/auto-assign-project.yml @@ -14,7 +14,7 @@ jobs: with: # You can target a repository in a different organization # to the issue - project-url: https://github.com/orgs/eclipse-volttron/projects/3 + project-url: https://github.com/orgs/GRIDAPPSD/projects/7 # project-url: https://github.com/orgs//projects/ # github-token: ${{ secrets.ADD_TO_PROJECT_PAT }} github-token: ${{ secrets.AUTO_ASSIGN_PAT }} From feaa5e52c938d99eca567944c537e465d6668346 Mon Sep 17 00:00:00 2001 From: Craig <3979063+craig8@users.noreply.github.com> Date: Fri, 17 Jul 2026 18:17:33 -0700 Subject: [PATCH 3/4] docs: add security policy pointing to private vulnerability reporting --- SECURITY.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..e99ca4105 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,27 @@ +# Security Policy + +## Reporting a Vulnerability + +If you believe you have found a security vulnerability in GOSS-GridAPPS-D, +please report it privately through GitHub's private vulnerability reporting. + +Go to the **Security** tab of this repository and click **Report a vulnerability**. +This opens a private advisory visible only to the maintainers, so details are +not disclosed publicly before a fix is available. + +Please include enough information to reproduce the issue: affected version or +commit, a description of the impact, and steps to trigger the behavior. + +## Response Expectations + +GOSS-GridAPPS-D is a research platform maintained on a best-effort basis. +We do not offer a formal service level agreement or a guaranteed response +window, and we do not maintain a fixed supported-version matrix. Maintainers +will acknowledge and triage reports as capacity allows, and will coordinate +disclosure of any confirmed issue with the reporter. + +## Scope + +Reports about this repository's source code and its published artifacts are in +scope. For issues in a dependency, please report them to that project directly; +we will address the dependency update here once an upstream fix is available. From d49c6be1633906a93424a9ea106cbbc9807f548c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 18 Jul 2026 02:17:37 +0000 Subject: [PATCH 4/4] chore(deps): bump the gradle group across 1 directory with 12 updates Bumps the gradle group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | org.eclipse.jetty:jetty-http | `11.0.24` | `12.0.33` | | [com.fasterxml.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core) | `2.9.5` | `2.18.6` | | [org.apache.shiro:shiro-core](https://github.com/apache/shiro) | `2.0.0` | `2.2.1` | | commons-io:commons-io | `2.6` | `2.14.0` | | org.apache.commons:commons-lang3 | `3.4` | `3.18.0` | | [com.hazelcast:hazelcast](https://github.com/hazelcast/hazelcast) | `3.9.3` | `5.2.5` | | [org.apache.thrift:libthrift](https://github.com/apache/thrift) | `0.10.0` | `0.23.0` | | org.apache.poi:poi-ooxml | `3.17` | `5.4.0` | | org.apache.santuario:xmlsec | `2.1.0` | `2.2.6` | Updates `org.eclipse.jetty:jetty-http` from 11.0.24 to 12.0.33 Updates `com.fasterxml.jackson.core:jackson-core` from 2.9.5 to 2.18.6 - [Commits](https://github.com/FasterXML/jackson-core/compare/jackson-core-2.9.5...jackson-core-2.18.6) Updates `com.fasterxml.jackson.core:jackson-databind` from 2.9.5 to 2.18.6 - [Commits](https://github.com/FasterXML/jackson/commits) Updates `org.apache.shiro:shiro-core` from 2.0.0 to 2.2.1 - [Release notes](https://github.com/apache/shiro/releases) - [Changelog](https://github.com/apache/shiro/blob/main/RELEASE-NOTES) - [Commits](https://github.com/apache/shiro/compare/shiro-root-2.0.0...shiro-root-2.2.1) Updates `org.apache.shiro:shiro-web` from 2.0.0 to 2.2.1 - [Release notes](https://github.com/apache/shiro/releases) - [Changelog](https://github.com/apache/shiro/blob/main/RELEASE-NOTES) - [Commits](https://github.com/apache/shiro/compare/shiro-root-2.0.0...shiro-root-2.2.1) Updates `commons-io:commons-io` from 2.6 to 2.14.0 Updates `org.apache.commons:commons-lang3` from 3.4 to 3.18.0 Updates `com.hazelcast:hazelcast` from 3.9.3 to 5.2.5 - [Release notes](https://github.com/hazelcast/hazelcast/releases) - [Commits](https://github.com/hazelcast/hazelcast/compare/v3.9.3...v5.2.5) Updates `org.apache.thrift:libthrift` from 0.10.0 to 0.23.0 - [Release notes](https://github.com/apache/thrift/releases) - [Changelog](https://github.com/apache/thrift/blob/master/CHANGES.md) - [Commits](https://github.com/apache/thrift/compare/0.10.0...v0.23.0) Updates `org.apache.poi:poi-ooxml` from 3.17 to 5.4.0 Updates `org.apache.santuario:xmlsec` from 2.1.0 to 2.2.6 Updates `org.bouncycastle:bcpkix-jdk15on` from 1.58 to 1.70 - [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html) - [Commits](https://github.com/bcgit/bc-java/commits) --- updated-dependencies: - dependency-name: org.eclipse.jetty:jetty-http dependency-version: 12.0.33 dependency-type: direct:production dependency-group: gradle - dependency-name: com.fasterxml.jackson.core:jackson-core dependency-version: 2.18.6 dependency-type: direct:production dependency-group: gradle - dependency-name: com.fasterxml.jackson.core:jackson-databind dependency-version: 2.18.6 dependency-type: direct:production dependency-group: gradle - dependency-name: org.apache.shiro:shiro-core dependency-version: 2.2.1 dependency-type: direct:production dependency-group: gradle - dependency-name: org.apache.shiro:shiro-web dependency-version: 2.2.1 dependency-type: direct:production dependency-group: gradle - dependency-name: commons-io:commons-io dependency-version: 2.14.0 dependency-type: direct:production dependency-group: gradle - dependency-name: org.apache.commons:commons-lang3 dependency-version: 3.18.0 dependency-type: direct:production dependency-group: gradle - dependency-name: com.hazelcast:hazelcast dependency-version: 5.2.5 dependency-type: direct:production dependency-group: gradle - dependency-name: org.apache.thrift:libthrift dependency-version: 0.23.0 dependency-type: direct:production dependency-group: gradle - dependency-name: org.apache.poi:poi-ooxml dependency-version: 5.4.0 dependency-type: direct:production dependency-group: gradle - dependency-name: org.apache.santuario:xmlsec dependency-version: 2.2.6 dependency-type: direct:production dependency-group: gradle - dependency-name: org.bouncycastle:bcpkix-jdk15on dependency-version: '1.70' dependency-type: direct:production dependency-group: gradle ... Signed-off-by: dependabot[bot] --- build.gradle | 58 +++++++++++++++++------------------ gridappsd-jena/build.gradle | 10 +++--- gridappsd-poi/build.gradle | 20 ++++++------ gridappsd-proven/build.gradle | 4 +-- 4 files changed, 46 insertions(+), 46 deletions(-) diff --git a/build.gradle b/build.gradle index c37d72b9d..784435d68 100644 --- a/build.gradle +++ b/build.gradle @@ -292,20 +292,20 @@ task collectBundles(type: Copy) { 'org.apache.felix:org.apache.felix.metatype:1.2.4', // Jetty 11.x WebSocket support (required by ActiveMQ 6.2.0 for ws:// transport) - 'org.eclipse.jetty.websocket:websocket-jetty-server:11.0.24', - 'org.eclipse.jetty.websocket:websocket-jetty-api:11.0.24', - 'org.eclipse.jetty.websocket:websocket-jetty-common:11.0.24', - 'org.eclipse.jetty.websocket:websocket-core-server:11.0.24', - 'org.eclipse.jetty.websocket:websocket-core-common:11.0.24', - 'org.eclipse.jetty.websocket:websocket-servlet:11.0.24', - 'org.eclipse.jetty:jetty-servlet:11.0.24', - 'org.eclipse.jetty:jetty-server:11.0.24', - 'org.eclipse.jetty:jetty-http:11.0.24', - 'org.eclipse.jetty:jetty-io:11.0.24', - 'org.eclipse.jetty:jetty-util:11.0.24', - 'org.eclipse.jetty:jetty-security:11.0.24', - 'org.eclipse.jetty:jetty-webapp:11.0.24', - 'org.eclipse.jetty:jetty-xml:11.0.24', + 'org.eclipse.jetty.websocket:websocket-jetty-server:12.0.33', + 'org.eclipse.jetty.websocket:websocket-jetty-api:12.0.33', + 'org.eclipse.jetty.websocket:websocket-jetty-common:12.0.33', + 'org.eclipse.jetty.websocket:websocket-core-server:12.0.33', + 'org.eclipse.jetty.websocket:websocket-core-common:12.0.33', + 'org.eclipse.jetty.websocket:websocket-servlet:12.0.33', + 'org.eclipse.jetty:jetty-servlet:12.0.33', + 'org.eclipse.jetty:jetty-server:12.0.33', + 'org.eclipse.jetty:jetty-http:12.0.33', + 'org.eclipse.jetty:jetty-io:12.0.33', + 'org.eclipse.jetty:jetty-util:12.0.33', + 'org.eclipse.jetty:jetty-security:12.0.33', + 'org.eclipse.jetty:jetty-webapp:12.0.33', + 'org.eclipse.jetty:jetty-xml:12.0.33', // Pax Logging (OSGi-native logging framework) // Provides SLF4J 2.x API + Log4j2 backend with properties-based configuration @@ -323,9 +323,9 @@ task collectBundles(type: Copy) { 'org.ow2.asm:asm-util:9.7', // Jackson (GridAPPS-D requires 2.18.1+ per bnd.bnd) - 'com.fasterxml.jackson.core:jackson-core:2.18.1', - 'com.fasterxml.jackson.core:jackson-databind:2.18.1', - 'com.fasterxml.jackson.core:jackson-annotations:2.18.1', + 'com.fasterxml.jackson.core:jackson-core:2.18.6', + 'com.fasterxml.jackson.core:jackson-databind:2.18.6', + 'com.fasterxml.jackson.core:jackson-annotations:2.18.6', // GSON (GOSS uses 2.11.0 per bnd.bnd) 'com.google.code.gson:gson:2.11.0', @@ -340,16 +340,16 @@ task collectBundles(type: Copy) { 'org.fusesource.stompjms:stompjms-client:1.19', // Shiro 2.0.0 (required by ActiveMQ 6.2.0 and GOSS for Jakarta EE support) - 'org.apache.shiro:shiro-core:2.0.0', - 'org.apache.shiro:shiro-lang:2.0.0', - 'org.apache.shiro:shiro-web:2.0.0', - 'org.apache.shiro:shiro-cache:2.0.0', - 'org.apache.shiro:shiro-event:2.0.0', - 'org.apache.shiro:shiro-crypto-core:2.0.0', - 'org.apache.shiro:shiro-crypto-hash:2.0.0', - 'org.apache.shiro:shiro-crypto-cipher:2.0.0', - 'org.apache.shiro:shiro-config-core:2.0.0', - 'org.apache.shiro:shiro-config-ogdl:2.0.0', + 'org.apache.shiro:shiro-core:2.2.1', + 'org.apache.shiro:shiro-lang:2.2.1', + 'org.apache.shiro:shiro-web:2.2.1', + 'org.apache.shiro:shiro-cache:2.2.1', + 'org.apache.shiro:shiro-event:2.2.1', + 'org.apache.shiro:shiro-crypto-core:2.2.1', + 'org.apache.shiro:shiro-crypto-hash:2.2.1', + 'org.apache.shiro:shiro-crypto-cipher:2.2.1', + 'org.apache.shiro:shiro-config-core:2.2.1', + 'org.apache.shiro:shiro-config-ogdl:2.2.1', // Commons BeanUtils (required by Shiro config-ogdl) 'commons-beanutils:commons-beanutils:1.9.4', @@ -365,9 +365,9 @@ task collectBundles(type: Copy) { 'org.apache.httpcomponents:httpcore-osgi:4.4.16', // Commons libraries (GOSS versions per bnd.bnd) - 'commons-io:commons-io:2.16.1', + 'commons-io:commons-io:2.14.0', 'commons-lang:commons-lang:2.6', - 'org.apache.commons:commons-lang3:3.17.0', + 'org.apache.commons:commons-lang3:3.18.0', 'commons-pool:commons-pool:1.6', 'org.apache.commons:commons-pool2:2.12.0', 'commons-dbcp:commons-dbcp:1.4', diff --git a/gridappsd-jena/build.gradle b/gridappsd-jena/build.gradle index b26881152..927141453 100644 --- a/gridappsd-jena/build.gradle +++ b/gridappsd-jena/build.gradle @@ -24,20 +24,20 @@ dependencies { // Jena transitive dependencies embed 'org.apache.commons:commons-csv:1.5' // Jena 3.7.0 uses 1.5 - embed 'org.apache.thrift:libthrift:0.10.0' // Jena 3.7.0 uses 0.10.0 + embed 'org.apache.thrift:libthrift:0.23.0' // Jena 3.7.0 uses 0.23.0 embed 'com.github.andrewoma.dexx:collection:0.7' embed 'com.github.jsonld-java:jsonld-java:0.12.0' // Jena 3.7.0 uses 0.12.0 embed 'commons-codec:commons-codec:1.11' // Jena 3.7.0 uses 1.11 - embed 'org.apache.commons:commons-lang3:3.4' + embed 'org.apache.commons:commons-lang3:3.18.0' // HTTP components for remote SPARQL endpoints embed 'org.apache.httpcomponents:httpclient:4.5.5' embed 'org.apache.httpcomponents:httpcore:4.4.9' // Jackson for JSON parsing - embed 'com.fasterxml.jackson.core:jackson-core:2.9.5' - embed 'com.fasterxml.jackson.core:jackson-databind:2.9.5' - embed 'com.fasterxml.jackson.core:jackson-annotations:2.9.5' + embed 'com.fasterxml.jackson.core:jackson-core:2.18.6' + embed 'com.fasterxml.jackson.core:jackson-databind:2.18.6' + embed 'com.fasterxml.jackson.core:jackson-annotations:2.18.6' // Xerces for XML parsing (Jena needs it) embed 'xerces:xercesImpl:2.11.0' diff --git a/gridappsd-poi/build.gradle b/gridappsd-poi/build.gradle index 0e4ba8b67..02b47f767 100644 --- a/gridappsd-poi/build.gradle +++ b/gridappsd-poi/build.gradle @@ -16,9 +16,9 @@ configurations { dependencies { // Apache POI core components for Excel handling - embed 'org.apache.poi:poi:3.17' - embed 'org.apache.poi:poi-ooxml:3.17' - embed 'org.apache.poi:poi-ooxml-schemas:3.17' + embed 'org.apache.poi:poi:5.4.0' + embed 'org.apache.poi:poi-ooxml:5.4.0' + embed 'org.apache.poi:poi-ooxml-schemas:5.4.0' // POI transitive dependencies embed 'org.apache.xmlbeans:xmlbeans:2.6.0' @@ -26,11 +26,11 @@ dependencies { embed 'commons-codec:commons-codec:1.10' // POI 3.17 uses 1.10 // XML Security (needed by POI for signed documents) - embed 'org.apache.santuario:xmlsec:2.1.0' + embed 'org.apache.santuario:xmlsec:2.2.6' // Bouncy Castle (needed by xmlsec) - embed 'org.bouncycastle:bcprov-jdk15on:1.58' - embed 'org.bouncycastle:bcpkix-jdk15on:1.58' + embed 'org.bouncycastle:bcprov-jdk15on:1.70' + embed 'org.bouncycastle:bcpkix-jdk15on:1.70' // Curve25519 (needed by POI) embed 'com.github.virtuald:curvesapi:1.04' @@ -70,10 +70,10 @@ shadowJar { 'Bundle-Version': '3.17.0', 'Bundle-Vendor': 'PNNL', // Export only the POI packages that GridAPPS-D uses - 'Export-Package': 'org.apache.poi.ss.usermodel;version="3.17.0",' + - 'org.apache.poi.hssf.usermodel;version="3.17.0",' + - 'org.apache.poi.xssf.usermodel;version="3.17.0",' + - 'org.apache.poi.ss.util;version="3.17.0"', + 'Export-Package': 'org.apache.poi.ss.usermodel;version="5.4.0.0",' + + 'org.apache.poi.hssf.usermodel;version="5.4.0.0",' + + 'org.apache.poi.xssf.usermodel;version="5.4.0.0",' + + 'org.apache.poi.ss.util;version="5.4.0.0"', // Import from OSGi environment 'Import-Package': 'org.slf4j;version="[1.7,3)";resolution:=optional,' + 'javax.xml.parsers,' + diff --git a/gridappsd-proven/build.gradle b/gridappsd-proven/build.gradle index 8ac2eaffa..bceaf4ad9 100644 --- a/gridappsd-proven/build.gradle +++ b/gridappsd-proven/build.gradle @@ -53,10 +53,10 @@ dependencies { embed files('../cnf/cache/7.1.0/GOSS Dependencies/shacl-1.1.0.jar') // Hazelcast for proven-message serialization - embed 'com.hazelcast:hazelcast:3.9.3' + embed 'com.hazelcast:hazelcast:5.2.5' // Commons IO (proven-message needs it) - embed 'commons-io:commons-io:2.6' + embed 'commons-io:commons-io:2.14.0' // SLF4J API (don't embed implementation, let OSGi provide it) compileOnly 'org.slf4j:slf4j-api:2.0.16'