[Renovate] Update dependency detekt to v1.20.0 [SECURITY] [HIGH] - #326
Open
appsec-renovate-bot[bot] wants to merge 1 commit into
Open
[Renovate] Update dependency detekt to v1.20.0 [SECURITY] [HIGH]#326appsec-renovate-bot[bot] wants to merge 1 commit into
appsec-renovate-bot[bot] wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.14.2→1.20.0XML External Entity Reference in detekt
CVE-2022-0272 / GHSA-2cfc-865j-gm4w
More information
Details
Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
Severity
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
detekt/detekt (detekt)
v1.20.0Compare Source
We're extremely excited to share with you all the next upcoming stable release of Detekt:
1.20.0🎉This release is coming with 16 new rules, new API and functionalities and several stability improvements.
First, much thanks to our sponsors ❤️ as we were able to buy a domain and move our website to https://detekt.dev/.
As for the feature shipped, we work a lot on the Reporting side: we added a new type of reporting, improved the styling of the existing one and
generally reduced the unnecessary warnings of run with type resolution.
For rules like
ForbiddenMethodwhere you can configure a signature of a method you want to use in your rule, we added a new syntaxthat allows to reference generic methods & extension functions.
We update a lot of the libraries we depend on bringing Detekt up to the ecosystem: KtLint 0.45.2, Kotlin 1.6.20 and Gradle 7.4.2 to name a few.
Finally, we also migrated all of our tests from Spek to JUnit. This was a huge effort that will hopefully make easier for contributors
to be involved with Detekt.
As always, we want to take the opportunity to thank our contributors for testing, bug reporting and helping
us release this new version of Detekt. You're more than welcome to join our community on the #detekt channel on KotlinLang's Slack (you can get an invite here).
Notable Changes
formattingruleset provided by Detekt is updated to use this new mechanism - #4352LiteFindingsReport(which is more compact reporting and similar to other tools in the ecosystem. You can see an example here) - #4449.FindingsReportandFileBasedFindingsReporter- #44641.19.0for users usingignoreAnnotatedrunning without type resolution - #4570ForbiddenMethodwhere you can specify a method name in the config file, now we added support for:v7.4.2, AGP7.1.3and Kotlin1.6.20(see #4530 #4573 #4133 #4277 #4665)0.45.2(see #4227 #4630 #4645 #4690)Changelog
AnnotationExcluder- #4518formatting- #4473Suppressors - #4440UnnecessaryAbstractClass- #4399innerclasses - #4344Dependency Updates
Housekeeping & Refactorings
setReportOutputConventions- #4546AnnotationExcludertests - #4368See all issues at: 1.20.0
v1.19.0Compare Source
Please welcome the next upcoming stable release of Detekt:
1.19.0🎉This release is coming with a lot of new features, new rules, evolution in the API and stability improvements.
Specifically, we've shipped some features that will allow you to better adapt detekt to run on codebases
that are using JetPack compose with features such as
ignoreAnnotatedandignoreFunction.As always, we want to take the opportunity to thank our contributors for testing, bug reporting and helping
us release this new version of Detekt. You're more than welcome to join our community on the #detekt channel on KotlinLang's Slack (you can get an invite here).
Notable Changes
ignoreAnnotatedconfiguration key that you can use on all your rules to suppress findings if inside an annotated block (e.g.@Composable) - #4102 and #4241ignoreFunctionconfiguration key that you can use to suppress findings if inside a function with a given name - #4148reportsextension on thedetektextension has beendeprecated. See the Migration section below for steps to migrate to the new recommended configuration - #3687
ExplicitCollectionElementAccessMethodrule is now a type-resolution only rule - #4201InvalidPackageDeclarationrule has been split to create theMissingPackageDeclarationrule - #4149ForbiddenCommentrule now offers acustomMessageconfiguration key - #4126LambdaParameterNamingrule, to enforce a naming convention of parameter inside lambdas - #4147InjectDispatcherrule, to check if dispatchers are injectable - #4222ConsoleReportformat - #4027--auto-correctcmdline option to gradle tasks - #4202afterEvaluatewrapper from the Android and KMM plugin - #4159 and #4271Migration
Configuring reports in the Gradle plugin should be done at the task level instead of at the extension (or global) level.
The previous recommendation resulted in the report output for multiple tasks overwriting each other when multiple detekt
tasks were executed in the same Gradle run.
Before this release the recommended way to configure reports was using the
detektextension:detekt { reports { xml { enabled = true destination = file("build/reports/detekt/detekt.xml") } } }This meant all detekt tasks would output the report to the same destination. From this detekt release you should enable
and disable reports for all tasks using the
withTypeGradle method:To customize the report output location configure the task individually:
tasks.detektMain { reports { xml { outputLocation.set(file("build/reports/detekt/customPath.xml")) required.set(true) // reports can also be enabled and disabled at the task level as needed } } }Changelog
in- #4249MaximumLineLengthdocumentation - #4188UnsafeCallOnNullableTypeon tests - #4123Dependency Updates
Housekeeping & Refactorings
applySelfAnalysisVersiontask - #4082See all issues at: 1.19.0
v1.18.1Compare Source
This is a point release for Detekt
1.18.0containing bugfixes for problems that got discovered just after the release.Notable Changes
See all issues at: 1.18.1
v1.18.0Compare Source
1.18.0 - 2021-08-12
We're more than excited to introduce you a next stable release of Detekt:
1.18.0🎉This release is coming with a lot of changes, new rules, evolution in the API and stability improvements.
We want to take the opportunity to thank our contributors for testing, bug reporting and helping
us release this new version of Detekt.
Notable Changes
AvoidReferentialEqualityandBooleanPropertyNaming(see #3924 and #3795)1.5.21, and we're compiling withapiVersionset to1.4- #3956 and #38526.1- #3830VarCouldBeValhas been updated and now works only with type resolution to provide more precise findings - #3880Extensions.getRootAreathat is now deprecated from our codebase. This was affecting users with sporadic crashes. - #3848@Configurationwhile auto-correction capability should be specified with the@AutoCorrectableannotation #3820.Migration
inputproperty inside thedetekt{}extension of the Gradle plugin tosource. Theinputproperty has been deprecated, and we invite you to migrate to the new property (see #3951)valueOrDefaultandvalueOrDefaultCommaSeparatedis no longer recommended. While both will remain part of the public api, they should be replaced by one of the config delegates (see #3891). The key that is used to lookup the configured value is derived from the property name.ThresholdRuleandLazyRegexhave been marked as deprecated and will be removed in a future release. Please migrate to config delegates.detekt-bomartifact. This change should not affect anyone. If it affects you, please let us know.Changelog
Dependency Updates
Housekeeping & Refactorings
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.