Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade hsqldb from 2.5.2 to 2.7.1 #3400

Merged
merged 17 commits into from Oct 31, 2022

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 24, 2022

Bumps hsqldb from 2.5.2 to 2.7.1. As hsqldb now depends on Java 11, some changes had to be done to testing code:

  1. liquibase-integration tests relied on hsqldb to run command line tests. Replaced it by h2, moved tests changelog files to h2 directory and fixed some tests that failed on h2 (mainly because of h2 requirements of not null columns for fks);

  2. hsqldb was defined on liquibase.sdk.yaml as a test system database. Added logic to remove it on java 8

  3. added code to skip hsqldb db test on java 8.

Fixes #3353

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps hsqldb from 2.5.2 to 2.7.1.

---
updated-dependencies:
- dependency-name: org.hsqldb:hsqldb
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot requested a review from nvoxland as a code owner October 24, 2022 02:22
@dependabot dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Oct 24, 2022
@dependabot dependabot bot requested a review from XDelphiGrl October 24, 2022 02:22
@github-actions
Copy link

github-actions bot commented Oct 24, 2022

Unit Test Results

  4 668 files    4 668 suites   35m 9s ⏱️
  4 624 tests   4 395 ✔️    229 💤 0
54 696 runs  49 572 ✔️ 5 124 💤 0

Results for commit 751fe6f.

♻️ This comment has been updated with latest results.

@r2-lf r2-lf mentioned this pull request Oct 27, 2022
@XDelphiGrl
Copy link
Contributor

@FBurguer, hello!

When we upgrade drivers, we do not usually do any manual testing. However, given that this fix is Java-version specific, I suggest we do some light manual testing.

  • JAVA 8 with HSQL 2.7.1: Verify you get an error message that HSQL 2.7.1 is not compatible with Java 8.
  • JAVA 11 with HSQL 2.7.1: Verify a Liquibase command is successful.
  • JAVA 14 or 17 with HSQL 2.7.1: Verify a Liquibase command is successful.

@filipelautert is a good resource if you have any specific questions.

CC @kristyldatical @suryaaki @mariochampion

@nvoxland nvoxland changed the title Bump hsqldb from 2.5.2 to 2.7.1 Upgrade hsqldb from 2.5.2 to 2.7.1 Oct 28, 2022
Copy link
Contributor

@nvoxland nvoxland left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't see a spot where it lets users know that the driver they are trying to use is not compatible with java 8.

We probably can't / shouldn't have it be hsql-specific, since it can be a general error people as they manage their own drivers. They can even currently have it set up where they have drivers that require java 17 but they are on java 11 so can't just blame it on java 8.

So more like sending to both the UI service and severe-level logging Your database driver is not compatible with your version of Java. You will need to either upgrade your Java version or install a different driver jar file.

Otherwise the changes all look good

@filipelautert
Copy link
Contributor

filipelautert commented Oct 28, 2022

Hi @FBurguer @XDelphiGrl
I would add 1 more test:

  • JAVA 8 with <PICK ANY DB BUT HSQLDB> : Verify it works.

…not compatible with the java version it's being executed.
@FBurguer
Copy link

FBurguer commented Oct 31, 2022

For this PR I checked if this build worked with different Java versions, like Erz and Filipe suggested, these are the results:

  • With Java 8 , liquibase fails with a msg from the driver: PASS
Unexpected error running Liquibase: Your database driver org.hsqldb.jdbcDriver is not compatible with Java version 1.8.0_291. You will need to either upgrade your Java version or install a different driver jar file.
  - Caused by: org/hsqldb/jdbcDriver has been compiled by a more recent version of the Java Runtime (class file version 55.0), this version of the Java Runtime only recognizes class file versions up to 52.0

-With Java 11, liquibase does an update and drop-all without problems: PASS
-With Java 17, liquibase does an update and drop-all without problems: PASS
-Liquibase with Java 8 still works with other databases . Tested with Postgres: PASS

@suryaaki2 suryaaki2 merged commit 1fb44ca into master Oct 31, 2022
@dependabot dependabot bot deleted the dependabot/maven/org.hsqldb-hsqldb-2.7.1 branch October 31, 2022 18:41
@kataggart kataggart added this to the 1NEXT milestone Nov 3, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file docker java Pull requests that update Java code
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

Vulnerability HSQLDB 2.5.2 CVE-2022-41853
7 participants