Releases · git-commit-id/git-commit-id-maven-plugin

05 Jan 03:03

v2.2.6

16f5f00

Version 2.2.6

Version 2.2.6 is a security update for a potential issue within the jackson-databind dependency. As usual you can checkout the detailed list of bug-fixes :-)

New Features / Bug-Fixes:

The main key-aspects is a security update for a potential issue within the jackson-databind dependency. This specific dependency was updated to v2.9.8 in response to FasterXML/jackson-databind#2186 (CVE-2018-19360, CVE-2018-19361, CVE-2018-19362). Even though by default an user of this plugin does not seem to be affected by this potential issue, it is highly recommended to adopt the latest version at your earliest convenience. Similar to version 2.2.5 this version provides full support for Java 7, Java 8, Java 9, Java 10 and Java 11 (and is potentially also working for any higher version).

Am I affected? (technical details)

The specific issues that have been fixed with the update of jackson-databind dependency are:

CVE-2018-19360: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
CVE-2018-19361: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CVE-2018-19362: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.

This plugin uses the jackson-databind dependency for dumping the git information (serialization) to the generated properties file and determining if the generated json properties are up-to-date (deserialization). As of now it appears that only user who generate json properties via <format>json</format> may be affected by those issues. This specific configuration is set to <format>properties</format> by default and hence by default it appears that those issues are out of scope. Only when this configuration is altered a user may need to consider the linked CVE's as potential security problem.
In general I would be unsure if this ever even could be considered a true attack vector of this plugin, since the generated json file would need to contain data that would trigger this specific bug in the dependency. If an adversary has access to the content to the location where the generated file is residing, I would assume he can also modify the any local file (including project files) and hence would not need to go through the pain and exploit this problem....

Getting the latest release

The plugin is available from Maven Central (see here), so you don't have to configure any additional repositories to use this plugin. All you need to do is to configure it inside your project as dependency:

<dependency>
    <groupId>pl.project13.maven</groupId>
    <artifactId>git-commit-id-plugin</artifactId>
    <version>2.2.6</version>
</dependency>

Known Issues / Limitations:

This plugin is unfortunately not working with Heroku which is due to the fact how Heroku works. In summary Heroku does not copy over the .git-repository but in order to determine the git properties this plugin relies on the fact that it has access to the git-repository. A somewhat workaround to get some information is outlined in #279 (comment)

Reporting Problems

If you find any problem with this plugin, feel free to report it here

Assets 2

30 Aug 22:21

TheSnoozer

v2.2.5

b37b40d

Version 2.2.5

Version 2.2.5 is finally there and includes various bug-fixes and improvements :-)

New Features / Bug-Fixes:

The main key-aspects that have been improved or being worked on are the following:

most likely the last release that supports Java 1.7
Full support for Java 7, Java 8, Java 9, Java 10 and Java 11 (potentially also working for any higher version)
add build number support (git.build.number and git.build.number.unique) for Bamboo, Hudson, Jenkins, TeamCity, Travis, Gitlab CI - #353 / #369
add git.branch support for GitlabCI - #368
add total commit count property via 'rev-list --count' -- #357
fixed a bug where the plugin fails when bamboo generates an unsupported gitRemoteString (the plugin now also never fails when this happens, it will simply log an exception and populate an empty string) -- #352 / #356
various dependency updates including support for java 10 (I think that should have worked before, but its now also tested with that version) -- #347 / #372

Getting the latest release

<dependency>
    <groupId>pl.project13.maven</groupId>
    <artifactId>git-commit-id-plugin</artifactId>
    <version>2.2.5</version>
</dependency>

Known Issues / Limitations:

This plugin is unfortunately not working with Heroku which is due to the fact how Heroku works. In summary Heroku does not copy over the .git-repository but in order to determine the git properties this plugin relies on the fact that it has access to the git-repository. A somewhat workaround to get some information is outlined in #279 (comment)

Reporting Problems

If you find any problem with this plugin, feel free to report it here

Assets 2

04 Dec 05:14

TheSnoozer

v2.2.4

ca51baa

Version 2.2.4

Version 2.2.4 is finally there and includes various bug-fixes and improvements :-)

New Features / Bug-Fixes:

The main key-aspects that have been improved or being worked on are the following:

Fixing an issue where -Dmaven.gitcommitid.skip=true does not skip the plugin execution when the configuration in the POM includes a <skip>false</skip> - #315
Support for all Maven 3.X versions - #316
The runningOnBuildServer check for detecting the branch name on Jenkins / Hudson is now using 'HUDSON_HOME' and 'JENKINS_HOME' as well - #326
The in-built replacement of properties (only for properties generated by the plugin) now can also change the casing of the properties that the user wants to replace (e.g. lower case VS upper case). This behaviour can be achieved by defining a list of transformationRules for the property where those rules should take effect. Each transformationRule consist of two required fields apply and action. The apply-tag controls when the rule should be applied and can be set to BEFORE to have the rule being applied before or it can be set to AFTER to have the rule being applied after the replacement. The action-tag determines the string conversion rule that should be applied. Currenlty supported is LOWER_CASE and UPPER_CASE. Potential candidates in the feature are CAPITALIZATION and INVERT_CASE (open a ticket if you need them...).

<replacementProperties>
  <!-- example: apply replacement only to the specific property git.branch and replace '/' with '-' -->
  <replacementProperty>
    <property>git.branch</property>
    <!-- will not overwrite the existing property and generate a new `git.branch.something` -->
    <propertyOutputSuffix>something</propertyOutputSuffix>
    <token>^([^\/]*)\/([^\/]*)$</token>
    <value>$1-$2</value>
    <regex>true</regex>
    <transformationRules>
      <transformationRule>
        <apply>BEFORE</apply>
        <action>UPPER_CASE</action>
      </transformationRule>
      <transformationRule>
        <apply>AFTER</apply>
        <action>LOWER_CASE</action>
      </transformationRule>
    </transformationRules>
  </replacementProperty>
</replacementProperties>

See #317 for more details on a use-case.

Release-Notes (available as RSS-Feed https://github.com/ktoso/maven-git-commit-id-plugin/releases.atom) - #324 :-)
The code style access this project will now be verified with checkstyle rules (initial idea #214). A contributer can verify the code style either by installing the codestyle plugin in his IDE or simply run checkstyle via maven and execute mvn clean verify -Pcheckstyle -Dmaven.test.skip=true -B for java 7 and java 8. For java9 one may want to run mvn clean verify -Pcheckstyle -Dcheckstyle.version=8.2 -Dmaven.test.skip=true -B that uses a more recent checkstyle version. Feel free to check out our FAQ-Section in the Readme that contains a small write up on how you can integrate checkstyle into your IDE.
The output properties git.closest.tag.name and git.closest.tag.count now will be determined based on properties configured inside the git-describe command (#221). Example:

<gitDescribe>
<tags>true</tags>
</gitDescribe>

will cause that lightweight tags are also included for the closest tags

Also the pattern used inside the gitDescribe might have an impact on the resulting git.closest.tag.name and git.closest.tag.count

this project now has an Issue Template that is being used for every new issue by default - #337
Under certain conditions the JGit implementation yielded wrong results inside the exposed git.tags property (basically it wasn't reporting all tags of a given commit) - #339
A new option to allow to tell the plugin what commit should be used as reference to generate the properties from (#338). By default this property is simply set to HEAD which should reference to the latest commit in your repository. In general this property can be set to something generic like HEAD^1 or point to a branch or tag-name. To support any kind or use-case this configuration can also be set to an entire commit-hash or it's abbreviated version. Please note that for security purposes not all references might be allowed as configuration.
The configuration can be used in the following:

<evaluateOnCommit>HEAD</evaluateOnCommit>

Getting the latest release

<dependency>
    <groupId>pl.project13.maven</groupId>
    <artifactId>git-commit-id-plugin</artifactId>
    <version>2.2.4</version>
</dependency>

Known Issues / Limitations:

This plugin is unfortunately not working with Heroku which is due to the fact how Heroku works. In summary Heroku does not copy over the .git-repository but in order to determine the git properties this plugin relies on the fact that it has access to the git-repository. A somewhat workaround to get some information is outlined in #279 (comment)

Reporting Problems

If you find any problem with this plugin, feel free to report it here

Assets 2

21 Sep 19:41

TheSnoozer

v2.2.3

6ff7d66

Version 2.2.3

Version 2.2.3 is finally there and includes various bug-fixes and improvements :-)

New Features / Bug-Fixes:

The main key-aspects that have been improved or being worked on are the following:

full Java 7, Java 8 and Java 9 support
fixed an issue with the new Validation feature - #276
ability to skip the plugin via commandline -Dmaven.gitcommitid.skip=true - #268
alphabetically sort properties in generated file - #284
M2E Lifecycle Mapping defaults now to runOnIncremental=false - #269
a new method to replace certain characters with regular expressions (only applies for properties generated by the plugin) - #138
ISO 8601 as default date format - #288
git-commit-id-plugin removed project properties generated by other plugins - #310

Getting the latest release

<dependency>
    <groupId>pl.project13.maven</groupId>
    <artifactId>git-commit-id-plugin</artifactId>
    <version>2.2.3</version>
</dependency>

Known Issues / Limitations:

This plugin is unfortunately not working with Heroku which is due to the fact how Heroku works. In summary Heroku does not copy over the .git-repository but in order to determine the git properties this plugin relies on the fact that it has access to the git-repository. A somewhat workaround to get some information is outlined in #279 (comment)

Reporting Problems

If you find any problem with this plugin, feel free to report it here

Assets 2

21 Sep 22:19

TheSnoozer

v2.2.2

86a0355

Version 2.2.2

Version 2.2.2 is finally there and includes various bug-fixes and improvements :-)

New Features / Bug-Fixes:

The main key-aspects that have been improved or being worked on are the following:

add a new feature to ensure that properties meet certain criteria (e.g. fail the build when the version number contains -SNAPSHOT or git repository is dirty) - #106

<plugin>
    <groupId>pl.project13.maven</groupId>
    <artifactId>git-commit-id-plugin</artifactId>
    <version>2.2.2</version>
    <!-- optional to change the phases of the individual mojo's -->
    <executions>
        <execution>
            <id>get-the-git-infos</id>
            <goals>
                <goal>revision</goal>
            </goals>
        </execution>
        <execution>
            <id>validate-the-git-infos</id>
            <goals>
                <goal>validateRevision</goal>
            </goals>
            <!-- default phase is validate -->
            <phase>package</phase>
        </execution>
    </executions>
    <configuration>
        <validationProperties>
            <validationProperty>
                <value>${project.version}</value>
                <regex>^\Q${git.commit.id.describe}\E$|.*-SNAPSHOT$</regex>
            </validationProperty>
            <validationProperty>
                <value>${git.dirty}</value>
                <regex>false</regex>
            </validationProperty>
            <failIfNoMatch>true</failIfNoMatch>
        </validationProperties>
    </configuration>
</plugin>

Inconsistency in dirty state (#234 and #236)
Support GIT_LOCAL_BRANCH in Jenkins / Hudson - #248
Update jgit to the latest Version 4.3.1.201605051710-r - #252
Pretty-Print json in generated git file - #265

Getting the latest release

<dependency>
    <groupId>pl.project13.maven</groupId>
    <artifactId>git-commit-id-plugin</artifactId>
    <version>2.2.2</version>
</dependency>

Reporting Problems

If you find any problem with this plugin, feel free to report it here

Assets 2

22 Sep 00:33

TheSnoozer

v2.2.1

6445336

Version 2.2.1

Version 2.2.1 is finally there and includes various bug-fixes and improvements :-)

New Features / Bug-Fixes:

The main key-aspects that have been improved or being worked on are the following:

fixed the ugly way of misusing slf4j (#202 and #230)
update jgit version to v4.0.1.201506240215-r - #216
Passwords had been exposed with git.remote.origin.url when HTTPS URIs are used - #240

Getting the latest release

<dependency>
    <groupId>pl.project13.maven</groupId>
    <artifactId>git-commit-id-plugin</artifactId>
    <version>2.2.1</version>
</dependency>

Reporting Problems

If you find any problem with this plugin, feel free to report it here

Assets 2

22 Sep 00:53

TheSnoozer

v2.2.0

812e2ae

Version 2.2.0

Version 2.2.0 is finally there and includes various bug-fixes and improvements :-)

New Features / Bug-Fixes:

The main key-aspects that have been improved or being worked on are the following:

Java 1.6 is no longer supported with this version - #205
updated jgit 4.0.0.201506090130-r (needs Java 1.7 and fixed an IOException on windows while building) - #205 and #203
add the ability to set the timezone along with dateFormat with <dateFormatTimeZone>${user.timezone}</dateFormatTimeZone> - #204
the generateGitPropertiesFilename from the README was adjusted to make it clearer that properties should be placed inside the target folder and not inside the source-Folder (e.g. use ${project.build.outputDirectory}/git.properties) - #217
in previous versions the plugin is generating the properties commit.id and commit.id.abbrev. However those can not be put into a JSON structure (#122). If you want to populate values into a JSON structure I would recommend to checkout the new switch <commitIdGenerationMode>full</commitIdGenerationMode> which will store the commit.id as git.commit.id.full and thus allowing you to populate the values into a JSON structure. By default this switch is turned off and thus will generate the properties the old fashioned way to ensure backwards compatibility.

Getting the latest release

<dependency>
    <groupId>pl.project13.maven</groupId>
    <artifactId>git-commit-id-plugin</artifactId>
    <version>2.2.0</version>
</dependency>

Reporting Problems

If you find any problem with this plugin, feel free to report it here

Assets 2

22 Sep 01:03

TheSnoozer

v2.1.15

b899499

Version 2.1.15

Version 2.1.15 is finally there and includes various bug-fixes and improvements :-)

New Features / Bug-Fixes:

The main key-aspects that have been improved or being worked on are the following:

Introduce git.closest.tag.name and git.closest.tag.commit.count as additional output - #54
Introduce a somewhat nasty workaround for https://issues.apache.org/jira/browse/MNG-5787 to have the plugin working with Maven 3.3.3 (#198 and #196)

Getting the latest release

<dependency>
    <groupId>pl.project13.maven</groupId>
    <artifactId>git-commit-id-plugin</artifactId>
    <version>2.1.15</version>
</dependency>

Reporting Problems

If you find any problem with this plugin, feel free to report it here

Assets 2

22 Sep 01:16

TheSnoozer

v2.1.14

382f344

Version 2.1.14

Version 2.1.14 is finally there and includes various bug-fixes and improvements :-)

Additional maintainer:

This project is currently maintained thanks to: @ktoso (founder), @TheSnoozer

New Features / Bug-Fixes:

a git shallow clone yielded some errors when using jgit (#96)
fixed an NPE when running plugin built under Maven 3.0.5/Java 7 under certain conditions (most likely related to docker images) - #153
update a lot of dependencies (#161, #162, #163, #164, #165, #167, #168, #169, #172, #179)
fixed typos in readme and other improvements (#171, #173, #187)
introduce a demo-profile on how to use the plugin inside the pom.xml (#181)
Introduce git.build.host as new property - #178
Introduce includeOnlyProperties which can be used to include only certain properties into the resulting file. Please note that this configuration will be overruled by the exclude properties - #192
Introduce build.version as new property - #192
Plugin should use slf4j for logging - #191

Getting the latest release

<dependency>
    <groupId>pl.project13.maven</groupId>
    <artifactId>git-commit-id-plugin</artifactId>
    <version>2.1.14</version>
</dependency>

Reporting Problems

If you find any problem with this plugin, feel free to report it here

Assets 2

22 Sep 01:46

TheSnoozer

v2.1.13

ed4a76a

Version 2.1.13

Version 2.1.13 is finally there and includes various bug-fixes and improvements :-)

New Features / Bug-Fixes:

Using -dirty as default dirty-marker for git describe - #149
fixed an endless build loop in Eclipse which was causes by the fact that the generated properties file was put into the source-folder and thus seemed to retrigger the eclipse build. With a new build the git-plugin updated the file with a new buildDate which then caused eclipse to detect a changed file and going into an endless cylce - #151
Fix differences in the output of native and jgit - #155
In previous versions the injectAllReactorProjects that was used by this plugin might have overwriten non-git properties in reactor projects. This property was previously set to true and will now be set to false.
Please note: if you are using your git-properties inside your pom-file you need to manually set this property to true (e.g. <injectAllReactorProjects>true</injectAllReactorProjects>)

Getting the latest release

<dependency>
    <groupId>pl.project13.maven</groupId>
    <artifactId>git-commit-id-plugin</artifactId>
    <version>2.1.13</version>
</dependency>

Reporting Problems

If you find any problem with this plugin, feel free to report it here

Assets 2

Releases: git-commit-id/git-commit-id-maven-plugin

Version 2.2.6

New Features / Bug-Fixes:

Am I affected? (technical details)

Getting the latest release

Known Issues / Limitations:

Reporting Problems

Uh oh!

Version 2.2.5

New Features / Bug-Fixes:

Getting the latest release

Known Issues / Limitations:

Reporting Problems

Uh oh!

Version 2.2.4

New Features / Bug-Fixes:

Getting the latest release

Known Issues / Limitations:

Reporting Problems

Uh oh!

Version 2.2.3

New Features / Bug-Fixes:

Getting the latest release

Known Issues / Limitations:

Reporting Problems

Uh oh!

Version 2.2.2

New Features / Bug-Fixes:

Getting the latest release

Reporting Problems

Uh oh!

Version 2.2.1

New Features / Bug-Fixes:

Getting the latest release

Reporting Problems

Uh oh!

Version 2.2.0

New Features / Bug-Fixes:

Getting the latest release

Reporting Problems

Uh oh!

Version 2.1.15

New Features / Bug-Fixes:

Getting the latest release

Reporting Problems

Uh oh!

Version 2.1.14

Additional maintainer:

New Features / Bug-Fixes:

Getting the latest release

Reporting Problems

Uh oh!

Version 2.1.13

New Features / Bug-Fixes:

Getting the latest release

Reporting Problems

Uh oh!