Merge branch 'cassandra-4.0' into cassandra-4.1

* cassandra-4.0:
  ninja-fix – python2 compat on .build/generate-snyk-file

.build/build-owasp.xml

@@ -113,6 +113,7 @@
     </target>
 
     <target name="generate-snyk-file" unless="ant.gen-snyk.skip">
+        <chmod file="${basedir}/.build/generate-snyk-file" perm="+x"/>
         <exec executable="${basedir}/.build/generate-snyk-file" failonerror="true"/>
     </target>
 </project>

.build/generate-snyk-file

@@ -25,7 +25,7 @@ import os
 
 
 script_dir = os.path.dirname(os.path.abspath(__file__))
-with open(os.path.join(script_dir, "dependency-check-suppressions.xml"), "r", encoding="utf-8") as f:
+with open(os.path.join(script_dir, "dependency-check-suppressions.xml"), "r") as f:
     xml_lines = [line.strip() for line in f.readlines()]
 
 snyk_data = {"ignore": {}}
@@ -53,7 +53,7 @@ while i < len(xml_lines):
             if "</suppress>" in xml_lines[i]:
                 break
             i += 1
-        reason = f"{last_comment} -- {packages}" if last_comment else "Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml"
+        reason = (last_comment + " -- " + packages) if last_comment else "Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml"
 
         # Add suppressions
         for cve_id in cve_ids:
@@ -67,9 +67,9 @@ with open(os.path.join(script_dir, "../.snyk"), "w") as snyk_file:
     snyk_file.write("# Snyk (https://snyk.io) policy file, provides ignores for known false positives.\n")
     snyk_file.write("# This file is autogenerated from .build/dependency-check-suppressions.xml\n")
     snyk_file.write("version: v1.25.0\n")
-    snyk_file.write(f"ignore:\n")
-    for cve_id, ignores in snyk_data["ignore"].items():
-        snyk_file.write(f"  {cve_id}:\n")
+    snyk_file.write("ignore:\n")
+    for cve_id, ignores in sorted(snyk_data["ignore"].items()):
+        snyk_file.write("  {}:\n".format(cve_id))
         for ignore in ignores:
-            snyk_file.write(f"    - reason: {ignore['reason']}\n")
+            snyk_file.write("    - reason: {}\n".format(ignore['reason']))
 

.snyk

@@ -2,24 +2,8 @@
 # This file is autogenerated from .build/dependency-check-suppressions.xml
 version: v1.25.0
 ignore:
-  CVE-2022-1471:
-    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
-  CVE-2022-25857:
-    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
-  CVE-2022-38749:
-    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
-  CVE-2022-38750:
-    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
-  CVE-2022-38751:
-    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
-  CVE-2022-38752:
-    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
-  CVE-2022-41854:
-    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
   CVE-2020-8908:
     - reason: not applicable https://nvd.nist.gov/vuln/detail/CVE-2020-8908 -- ^pkg:maven/com\.google\.guava/guava@.*$
-  CVE-2023-2976:
-    - reason: not applicable https://nvd.nist.gov/vuln/detail/CVE-2020-8908 -- ^pkg:maven/com\.google\.guava/guava@.*$
   CVE-2021-21290:
     - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
   CVE-2021-21295:
@@ -32,19 +16,39 @@ ignore:
     - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
   CVE-2021-43797:
     - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
+  CVE-2022-1471:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
   CVE-2022-24823:
     - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
+  CVE-2022-25857:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
+  CVE-2022-38749:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
+  CVE-2022-38750:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
+  CVE-2022-38751:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
+  CVE-2022-38752:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
+  CVE-2022-41854:
+    - reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
   CVE-2022-41881:
     - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
-  CVE-2023-34462:
-    - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
-  CVE-2023-44487:
-    - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
   CVE-2022-42003:
     - reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$
   CVE-2022-42004:
     - reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$
+  CVE-2023-2976:
+    - reason: not applicable https://nvd.nist.gov/vuln/detail/CVE-2020-8908 -- ^pkg:maven/com\.google\.guava/guava@.*$
+  CVE-2023-34462:
+    - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
   CVE-2023-35116:
     - reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$
+  CVE-2023-44487:
+    - reason: netty's http stuff is not applicable here -- ^pkg:maven/io\.netty/netty\-all@.*$
   CVE-2023-6378:
     - reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
+  CVE-2024-12798:
+    - reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
+  CVE-2024-12801:
+    - reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml