Bump script-security from 1.63.1 to 1.76

[dependabot]

Bumps script-security from 1.63.1 to 1.76.

Changelog

Sourced from script-security's changelog.

Version 1.76

Release date: 2021-02-01

• Improvement: Add the following to the default list of approved signatures ([PR #308](jenkinsci/script-security-plugin#308), [PR #310](jenkinsci/script-security-plugin#310)):
  • All static methods and fields in java.lang.Math
  • All methods related to java.lang.StringBuilder and java.lang.StringBuffer
  • All methods related to java.lang.CharSequence and java.lang.String apart from String.intern()
  • All static methods and fields in java.nio.charset.Charset
  • All methods related to java.util.Base64, java.util.Base64.Decoder, and java.util.Base64.Encoder
• Internal: Update dependencies and parent POM ([PR #311](jenkinsci/script-security-plugin#311), [PR #313](jenkinsci/script-security-plugin#313), [PR #314](jenkinsci/script-security-plugin#314), [PR #316](jenkinsci/script-security-plugin#316), [PR #317](jenkinsci/script-security-plugin#317), [PR #321](jenkinsci/script-security-plugin#321), [PR #323](jenkinsci/script-security-plugin#323), [PR #324](jenkinsci/script-security-plugin#324), [PR #326](jenkinsci/script-security-plugin#326))

Version 1.75

Release date: 2020-09-23

• Fix sandbox bypass vulnerability
• Improvement: Add the following to the default list of approved signatures:
  • DefaultGroovyMethods.and(Boolean, Boolean)
  • DefaultGroovyMethods.toBoolean(Boolean)
  • DefaultGroovyMethods.toDouble(String)
  • StringGroovyMethods.toBoolean(String)
  • StringGroovyMethods.toDouble(CharSequence)
  • StringGroovyMethods.toDouble(String)
  • StringGroovyMethods.toInteger(CharSequence)
  • StringGroovyMethods.toInteger(String)

Version 1.74

Release date: 2020-06-30

• Improvement: On the Manage Jenkins page in Jenkins 2.226 and newer, display the link to the In-process Script Approval page under "Security" instead of "Uncategorized". (PR 302)
• Improvement: Add the following to the list of approved Jenkins-related signatures:
  • BallColor.getHtmlBaseColor
  • Result.color
  • Result.fromString(String)

Version 1.73

Release date: 2020-06-03

• Fix security vulnerability. (SECURITY-1866)

Version 1.72

Release date: 2020-05-11

• This plugin now requires Jenkins 2.176.4 or newer.
• Improvement: Add various methods to the default list of approved signatures: (JENKINS-61952, PR 242, PR 295, PR 296)
  • Remaining java.util.regex.Matcher methods

... (truncated)

Commits

• 6b8273a [maven-release-plugin] prepare release script-security-1.76
• 65628e3 Merge pull request #327 from dwnusbaum/changelog-1.76
• a776ccf Add release notes for 1.76
• a76c4b2 Merge pull request #326 from jenkinsci/dependabot/maven/org.jenkins-ci.plugin...
• f7c4418 Bump plugin from 4.14 to 4.15
• 7f3204b Merge pull request #323 from jenkinsci/dependabot/maven/com.github.ben-manes....
• f95be77 Merge pull request #324 from jenkinsci/dependabot/maven/org.jenkins-ci.plugin...
• 138815d Bump plugin from 4.13 to 4.14
• f3e8d09 Bump caffeine from 2.8.6 to 2.8.8
• f298f99 Merge pull request #321 from jenkinsci/dependabot/maven/org.jenkins-ci.plugin...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #32.