4.2.6

.gitattributes

@@ -1,5 +1,5 @@
 # Auto detect text files and perform LF normalization
-* text=auto
+* text=auto eol=lf
 
 # Standard to msysgit
 *.doc	 diff=astextplain
@@ -33,4 +33,3 @@
 *.eot binary
 *.woff binary
 
-*.xsd text eol=lf

.github/dependabot.yml

@@ -0,0 +1,15 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "maven" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "daily"
+  - package-ecosystem: "github-actions" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "daily"

.github/workflows/codeql-analysis.yml

@@ -13,10 +13,10 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ main ]
+    branches: [ 4.2.x ]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ main ]
+    branches: [ 4.2.x ]
   schedule:
     - cron: '44 20 * * 5'
 
@@ -38,30 +38,24 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
-
+      uses: actions/checkout@v4
+      with:
+        show-progress: 'false'
+
     - name: Setup Java JDK
-      uses: actions/setup-java@v2.3.1
+      uses: actions/setup-java@v3.12.0
       with:
         java-version: 8
         # Java distribution. See the list of supported distributions in README file
         distribution: temurin
         # The package type (jdk, jre, jdk+fx, jre+fx)
         java-package: jdk
         cache: maven
-
-    - name: Maven repository caching
-      uses: actions/cache@v2
-      with:
-        path: ~/.m2/repository
-        key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
-        restore-keys: |
-          ${{ runner.os }}-maven-
 
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@v2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -72,7 +66,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@v2
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -86,7 +80,7 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@v2
 
     - name: Remove SNAPSHOT jars from repository
       run: |

.github/workflows/linux.yml

@@ -12,29 +12,21 @@ jobs:
     strategy:
       matrix:
         include:
-          - os: ubuntu-18.04
+          - os: ubuntu-22.04
             jdk: 8
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         # 500 commits, set to 0 to get all
         fetch-depth: 500
         submodules: 'recursive'
+        show-progress: 'false'
     - name: Set up JDK
-      uses: actions/setup-java@v1
+      uses: actions/setup-java@v3.12.0
       with:
+        distribution: 'temurin'
         java-version: ${{ matrix.jdk }}
-    - name: Set up Maven
-      uses: stCarolas/setup-maven@v4
-      with:
-        maven-version: 3.6.3
-    - name: Maven repository caching
-      uses: actions/cache@v2
-      with:
-        path: ~/.m2/repository
-        key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
-        restore-keys: |
-          ${{ runner.os }}-maven-
+        cache: 'maven'
     - name: Build with Maven
       run: mvn -B -V install -DskipTests=true -Dmaven.javadoc.skip=true
     - name: Remove SNAPSHOT jars from repository
@@ -45,30 +37,28 @@ jobs:
         find ~/.m2/repository -name "*3.8*" -type d | xargs rm -rf {}
 
   QA:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         # 500 commits, set to 0 to get all
         fetch-depth: 500
         submodules: 'recursive'
+        show-progress: 'false'
     - name: Set up JDK
-      uses: actions/setup-java@v1
+      uses: actions/setup-java@v3.12.0
       with:
+        distribution: 'temurin'
         java-version: 8
+        cache: 'maven'
     - name: Set up Maven
       uses: stCarolas/setup-maven@v4
       with:
         maven-version: 3.6.3
-    - name: Maven repository caching
-      uses: actions/cache@v2
-      with:
-        path: ~/.m2/repository
-        key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
-        restore-keys: |
-          ${{ runner.os }}-maven-
     - name: Test with maven
-      run: mvn -B -V -fae install
+      run: |
+        mvn resources:resources@copy-index-schema-to-source -f web
+        mvn -B -V -fae verify -Pit
     - name: Remove SNAPSHOT jars from repository
       run: |
         find ~/.m2/repository -name "*SNAPSHOT*" -type d | xargs rm -rf {}

.github/workflows/mvn-dep-tree.yml

@@ -0,0 +1,33 @@
+# This job sends the maven dependency tree of the project to Github
+# for further security analysis.
+
+name: "MavenDepTreeSubmission"
+
+on:
+  push:
+    branches: [ 4.2.x ]
+  schedule:
+    - cron: '44 22 * * 5'
+
+jobs:
+  update-maven-dep-tree:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          show-progress: 'false'
+
+      - name: Setup Java JDK
+        uses: actions/[email protected]
+        with:
+          java-version: 8
+          # Java distribution. See the list of supported distributions in README file
+          distribution: temurin
+          # The package type (jdk, jre, jdk+fx, jre+fx)
+          java-package: jdk
+          cache: maven
+
+      - name: Submit Dependency Snapshot
+        uses: advanced-security/maven-dependency-submission-action@v3

.github/workflows/sonarcloud.yml

@@ -0,0 +1,49 @@
+name: SonarCloud QA
+on:
+  push:
+    branches:
+      - 4.2.x
+  pull_request:
+    types: [opened, synchronize, reopened]
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    # Only analyze with Sonar on non-fork repos:
+    # https://github.community/t/how-to-detect-a-pull-request-from-a-fork/18363/4
+    if: github.event.pull_request.head.repo.fork != true
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+          submodules: 'recursive'
+          show-progress: 'false'
+      # For building GeoNetwork, JDK8 is necessary, but for running
+      # the SonarQube plugin, JDK11 is necessary.
+      # So, first install JDK 8, build GeoNetwork, then install JDK11
+      # and run SonarQube:
+      - name: Set up JDK 8
+        uses: actions/[email protected]
+        with:
+          java-version: 8
+          distribution: 'temurin'
+          cache: 'maven'
+      - name: Cache SonarCloud packages
+        uses: actions/cache@v3
+        with:
+          path: ~/.sonar/cache
+          key: ${{ runner.os }}-sonar
+          restore-keys: ${{ runner.os }}-sonar
+      - name: Build GN
+        run: mvn -B package -DskipTests
+      - name: Set up JDK 11
+        uses: actions/[email protected]
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+      - name: Analyze with Sonar
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        #TODO: Enable tests, if reliable:
+        run: mvn -B org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=geonetwork_core-geonetwork -Dsonar.organization=geonetwork -DskipTests=true -Dmaven.javadoc.skip=true

.gitignore

@@ -11,10 +11,9 @@ git*.properties
 # Directories and paths
 */*/.*
 */*/target/
-*/.*
 */target/
 .*/
-GeoNetwork*
+#GeoNetwork*
 /geonetwork*
 camel-harvesters/wfsfeature-harvester/logs
 changes-*
@@ -27,6 +26,7 @@ docs/schema-loc-*.rst
 eclipse/
 es/elasticsearch-*
 es/es-dashboards/kibana-*
+es/es-dashboards/data/nodes/
 harvesters/harvester_*.log
 idea/
 jcs_caching/
@@ -39,6 +39,9 @@ schemas/*/doc/*/*.rst
 schematrons/.build
 target/
 transifex/transifex-format/
+
+# web-app, clear using: mvn -f web/pom.xml clean:clean@reset
+
 web-itest/jcs_caching
 web-ui/src/main/resources/catalog/lib/gn*.min.js
 web-ui/src/main/resources/catalog/style/gn*.css
@@ -52,13 +55,14 @@ web/jcs_caching/
 web/logs/
 web/src/main/webapp/META-INF/MANIFEST.MF
 web/src/main/webapp/WEB-INF/data/0*
+web/src/main/webapp/WEB-INF/data/config/encryptor.properties
+web/src/main/webapp/WEB-INF/data/config/index/records.json
 web/src/main/webapp/WEB-INF/data/config/schema_plugins/*/schematron/schematron*.xsl
 web/src/main/webapp/WEB-INF/data/config/schema_plugins/csw-record
 web/src/main/webapp/WEB-INF/data/config/schema_plugins/dublin-core
 web/src/main/webapp/WEB-INF/data/config/schema_plugins/iso19*
 web/src/main/webapp/WEB-INF/data/config/schema_plugins/schemaplugin-uri-catalog.xml
 web/src/main/webapp/WEB-INF/data/config/schemaplugin-uri-catalog.xml
-web/src/main/webapp/WEB-INF/data/config/encryptor.properties
 web/src/main/webapp/WEB-INF/data/data/backup
 web/src/main/webapp/WEB-INF/data/data/metadata_data
 web/src/main/webapp/WEB-INF/data/data/metadata_subversion
@@ -76,6 +80,7 @@ web/src/main/webapp/WEB-INF/data/wro4j-cache*
 web/src/main/webapp/WEB-INF/data_*
 web/src/main/webapp/WEB-INF/metadata_subversion/
 web/src/main/webapp/WEB-INF/server.prop
+web/src/main/webapp/WEB-INF/prebuilt
 web/src/main/webapp/data/
 web/src/main/webapp/doc/en
 web/src/main/webapp/doc/fr

.gitmodules

@@ -7,6 +7,3 @@
 [submodule "web-ui/src/main/resources/catalog/lib/bootstrap-table"]
 	path = web-ui/src/main/resources/catalog/lib/bootstrap-table
 	url = https://github.com/wenzhixin/bootstrap-table.git
-[submodule "docs/manuals"]
-	path = docs/manuals
-	url = https://github.com/geonetwork/doc.git

SECURITY.md

@@ -13,8 +13,9 @@ Each GeoNetwork release is supported with bug fixes for a limited period, with p
 
 | Version     | Supported          | Comment                 |
 | ----------- | ------------------ |------------------------ |
-| 4.x         | :white_check_mark: | Current version         |
-| 3.x         | :white_check_mark: | Maintenance version     |
+| 4.2.x       | :white_check_mark: | Current version         |
+| 4.0.x       | :white_check_mark: | Maintenance version     |
+| 3.12.x      | :white_check_mark: | Maintenance version     |
 
 If your organisation is making use of a GeoNetwork version that is no longer in use by the community all is not lost. You can volunteer on the developer list to make additional releases, or engage with one of our [Commercial Support](https://www.osgeo.org/service-providers/?p=geonetwork) providers. 
 

cachingxslt/pom.xml

@@ -31,7 +31,7 @@
   <parent>
     <groupId>org.geonetwork-opensource</groupId>
     <artifactId>geonetwork</artifactId>
-    <version>4.2.0-0</version>
+    <version>4.2.6-0</version>
   </parent>
 
 
@@ -56,8 +56,8 @@
 
   <dependencies>
     <dependency>
-      <groupId>log4j</groupId>
-      <artifactId>log4j</artifactId>
+      <groupId>org.apache.logging.log4j</groupId>
+      <artifactId>log4j-api</artifactId>
     </dependency>
     <dependency>
       <groupId>net.sf.saxon</groupId>

cachingxslt/src/main/java/de/fzi/dbs/xml/transform/CachingTransformerFactory.java

@@ -2,7 +2,8 @@
 
 import net.sf.saxon.TransformerFactoryImpl;
 
-import org.apache.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
 import org.fao.geonet.utils.CachedTransformer;
 
 import java.io.File;
@@ -28,7 +29,7 @@ public class CachingTransformerFactory extends TransformerFactoryImpl implements
      * Factory logger.
      */
     protected static final Logger logger =
-        Logger.getLogger(CachingTransformerFactory.class);
+        LogManager.getLogger(CachingTransformerFactory.class);
     /**
      * Active readers count.
      */