fix(security): bump Jackson to 2.21 LTS line

.github/workflows/main.yml

@@ -12,13 +12,18 @@ on:
 
 env:
   API_VERSION: 'v2'
-  VERSION_PREFIX: '1.0.3'
+  VERSION_PREFIX: '1.0.4'
   GITHUB_PAGES_BRANCH: 'gh-pages'
 
 jobs:
   build-n-test:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
+
     steps:
       - uses: actions/checkout@v4
 
@@ -49,7 +54,7 @@ jobs:
         env:
           ACCESS_KEY: ${{ secrets.DEV_CA_PUBLIC_USE_INTEGRATION_TEST_ACCESS_KEY }}
           SERVICE_PRINCIPAL_KEY: ${{ secrets.DEV_CA_PUBLIC_USE_TESTOAUTHSERVICEPRINCIPAL_SERVICE_PRINCIPAL_KEY }}
-          REPOSITORY_ID: ${{ secrets.DEV_CA_PUBLIC_USE_REPOSITORY_ID_2 }}
+          REPOSITORY_ID: ${{ secrets.DEV_CA_PUBLIC_USE_REPOSITORY_ID_1 }}
           AUTHORIZATION_TYPE: ${{ secrets.AUTHORIZATION_TYPE }}
           TEST_HEADER: ${{ secrets.TEST_HEADER }}
           READONLY_TEST_FOLDER_ID: ${{ secrets.DEV_CA_READONLY_TEST_FOLDER_ID }}

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 1.0.4
+
+### Chore & Maintenance
+
+- Update `jackson-databind`, `jackson-core`, and `jackson-annotations` dependencies to the 2.21 LTS line due to vulnerability
+- Update `lf-api-client-core` dependency to 2.2.5
+
 ## 1.0.3
 
 ### Chore & Maintenance

pom.xml

@@ -240,7 +240,7 @@
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-annotations</artifactId>
-      <version>${jackson-version}</version>
+      <version>${jackson-annotations-version}</version>
     </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
@@ -270,7 +270,7 @@
     <dependency>
       <groupId>com.laserfiche</groupId>
       <artifactId>lf-api-client-core</artifactId>
-      <version>2.2.4</version>
+      <version>2.2.5</version>
     </dependency>
 
     <!-- test dependencies -->
@@ -309,7 +309,8 @@
     <maven.compiler.target>${java.version}</maven.compiler.target>
     <gson-fire-version>1.8.0</gson-fire-version>
     <swagger-core-version>2.0.0</swagger-core-version>
-    <jackson-version>2.18.2</jackson-version>
+    <jackson-version>2.21.6</jackson-version>
+    <jackson-annotations-version>2.21</jackson-annotations-version>
     <retrofit-version>2.9.0</retrofit-version>
     <threetenbp-version>1.3.5</threetenbp-version>
     <oltu-version>1.0.2</oltu-version>

src/test/java/com/laserfiche/repository/api/integration/BaseTest.java

@@ -8,6 +8,7 @@
 import com.laserfiche.repository.api.RepositoryApiClientImpl;
 import com.laserfiche.repository.api.clients.impl.model.*;
 import com.laserfiche.repository.api.clients.params.ParametersForCreateEntry;
+import com.laserfiche.repository.api.clients.params.ParametersForListAuditReasons;
 import com.laserfiche.repository.api.clients.params.ParametersForListTasks;
 import com.laserfiche.repository.api.clients.params.ParametersForStartDeleteEntry;
 import io.github.cdimascio.dotenv.Dotenv;
@@ -23,6 +24,7 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import java.util.concurrent.TimeUnit;
 
 enum AuthorizationType {
@@ -55,6 +57,8 @@ public class BaseTest {
     protected static final String SMALL_JPEG_FILE_PATH = "src/test/java/com/laserfiche/repository/api/integration/testFiles/test.jpg";
 
     protected static int readonlyTestFolderId = -1;
+    protected static int deleteAuditReasonId = -1;
+    protected static String deleteAuditReasonComment;
 
     @BeforeAll
     public static void setUp() {
@@ -87,6 +91,29 @@ public static void setUp() {
         testHeaders = new HashMap<>();
         testHeaders.put(testHeaderName, "true");
         createRepositoryApiClient();
+        findAuditReasonForDelete();
+    }
+
+    private static void findAuditReasonForDelete() {
+        AuditReasonCollectionResponse auditReasons = repositoryApiClient
+                .getAuditReasonsClient()
+                .listAuditReasons(new ParametersForListAuditReasons().setRepositoryId(repositoryId));
+        Optional<AuditReason> deleteAuditReason = auditReasons.getValue().stream()
+                .filter(auditReason -> auditReason.getAuditEventType() == AuditEventType.DELETE_ENTRY)
+                .findFirst();
+        if (deleteAuditReason.isPresent()) {
+            deleteAuditReasonId = deleteAuditReason.get().getId();
+            deleteAuditReasonComment = deleteAuditReason.get().getName();
+        }
+    }
+
+    protected static StartDeleteEntryRequest newDeleteEntryRequest() {
+        StartDeleteEntryRequest request = new StartDeleteEntryRequest();
+        if (deleteAuditReasonId != -1) {
+            request.setAuditReasonId(deleteAuditReasonId);
+            request.setAuditReasonComment(deleteAuditReasonComment);
+        }
+        return request;
     }
 
     protected static String getEnvironmentVariable(String environmentVariableName) {
@@ -175,7 +202,7 @@ public static void deleteEntry(int entryId) {
                     .startDeleteEntry(new ParametersForStartDeleteEntry()
                             .setRepositoryId(repositoryId)
                             .setEntryId(entryId)
-                            .setRequestBody(new StartDeleteEntryRequest()));
+                            .setRequestBody(newDeleteEntryRequest()));
             waitUntilTaskEnds(startTaskResponse.getTaskId());
         }
     }

src/test/java/com/laserfiche/repository/api/integration/EntriesClientTest.java

@@ -420,12 +420,21 @@ void startDeleteEntryCanDeleteFolder() {
         StartTaskResponse deleteEntryResponse = client.startDeleteEntry(new ParametersForStartDeleteEntry()
                 .setRepositoryId(repositoryId)
                 .setEntryId(entryToDelete.getId())
-                .setRequestBody(new StartDeleteEntryRequest()));
+                .setRequestBody(newDeleteEntryRequest()));
         String taskId = deleteEntryResponse.getTaskId();
         assertNotNull(taskId);
 
         waitUntilTaskEnds(deleteEntryResponse.getTaskId());
 
+        TaskCollectionResponse tasks = repositoryApiClient
+                .getTasksClient()
+                .listTasks(new ParametersForListTasks().setRepositoryId(repositoryId).setTaskIds(taskId));
+        TaskProgress taskProgress = tasks.getValue().get(0);
+        if (taskProgress.getStatus() == TaskStatus.FAILED) {
+            printProblemDetails(taskProgress.getErrors().get(0));
+        }
+        assertEquals(TaskStatus.COMPLETED, taskProgress.getStatus());
+
         ApiException apiException = Assertions.assertThrows(
                 ApiException.class,
                 () -> client.getEntry(new ParametersForGetEntry().setRepositoryId(repositoryId)

src/test/java/com/laserfiche/repository/api/integration/TasksClientTest.java

@@ -30,7 +30,7 @@ void cancelTasksDoesNotReturnErrorWhenCancellingACompletedTask() {
                 .startDeleteEntry(new ParametersForStartDeleteEntry()
                         .setRepositoryId(repositoryId)
                         .setEntryId(deleteEntry.getId())
-                        .setRequestBody(new StartDeleteEntryRequest()));
+                        .setRequestBody(newDeleteEntryRequest()));
         String taskId = result.getTaskId();
         assertNotNull(taskId);
 
@@ -58,7 +58,7 @@ void listTasksWorksAndAcceptsMultipleTaskIdsAndCanBeCalledWithNoTaskIdsAndIgnore
                     .startDeleteEntry(new ParametersForStartDeleteEntry()
                             .setRepositoryId(repositoryId)
                             .setEntryId(entry.getId())
-                            .setRequestBody(new StartDeleteEntryRequest()));
+                            .setRequestBody(newDeleteEntryRequest()));
             assertNotNull(startTaskResponse);
             taskIds[i] = startTaskResponse.getTaskId();
         }