chore(deps): update dependencies #142

renovate · 2022-05-01T00:00:41Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
io.github.zlika:reproducible-build-maven-plugin (source)	`0.15` -> `0.17`
ch.admin.bag.covidcertificate:cc-backend-logging	`1.0.3` -> `1.0.6`
io.jsonwebtoken:jjwt-impl	`0.11.2` -> `0.12.6`
io.jsonwebtoken:jjwt-jackson	`0.11.2` -> `0.12.6`
io.jsonwebtoken:jjwt-root	`0.11.2` -> `0.12.6`
io.jsonwebtoken:jjwt-api	`0.11.2` -> `0.12.6`
org.springframework.boot:spring-boot-dependencies (source)	`2.6.4` -> `2.7.18`

Release Notes

Zlika/reproducible-build-maven-plugin (io.github.zlika:reproducible-build-maven-plugin)

`v0.17`

Compare Source

=========== Features

#71: Allow define lineseparator for strip-jaxb - @rimuln.
#64: Support more archive formats (cpio, ar) - @ebourg.

Non-functional changes

Update commons-compress dependency.

`v0.16`

Compare Source

=========== Features

#59: Make strip-jaxb also work with the org.glassfish xjc implementation - @nilsaellen.

Non-functional changes

Upgrade maven plugins.
Fix wrong scope for maven-plugin-api.

admin-ch/CovidCertificate-Backend-Logging (ch.admin.bag.covidcertificate:cc-backend-logging)

jwtk/jjwt (io.jsonwebtoken:jjwt-impl)

`v0.12.6`

Compare Source

This patch release:

Ensures that after successful JWS signature verification, an application-configured Base64Url Decoder output is
used to construct a Jws instance (instead of JJWT's default decoder). See
Issue 947.
Fixes a decompression memory leak in concurrent/multi-threaded environments introduced in 0.12.0 when decompressing JWTs with a zip header of GZIP. See Issue 949.
Upgrades BouncyCastle to 1.78 via PR 941.

`v0.12.5`

Compare Source

This patch release:

Ensures that builders' NestedCollection changes are applied to the collection immediately as mutation methods are called, no longer
requiring application developers to call .and() to 'commit' or apply a change. For example, prior to this release,
the following code did not apply changes:
```
JwtBuilder builder = Jwts.builder();
builder.audience().add("an-audience"); // no .and() call
builder.compact(); // would not keep 'an-audience'
```
Now this code works as expected and all other NestedCollection instances like it apply changes immediately (e.g. when calling
.add(value)).

However, standard fluent builder chains are still recommended for readability when feasible, e.g.
```
Jwts.builder()
    .audience().add("an-audience").and() // allows fluent chaining
    .subject("Joe")
    // etc...
    .compact()
```
See Issue 916.

`v0.12.4`

Compare Source

This patch release includes various changes listed below.

Jackson Default Parsing Behavior

This release makes two behavioral changes to JJWT's default Jackson ObjectMapper parsing settings:

In the interest of having stronger standards to reject potentially malformed/malicious/accidental JSON that could
have undesirable effects on an application, JJWT's default ObjectMapper is now configured to explicitly reject/fail
parsing JSON (JWT headers and/or Claims) if/when that JSON contains duplicate JSON member names.

For example, now the following JSON, if parsed, would fail (be rejected) by default:
```
{
  "hello": "world",
  "thisWillFail": 42,
  "thisWillFail": "test"
}
```
Technically, the JWT RFCs do allow duplicate named fields as long as the last parsed member is the one used
(see JWS RFC 7515, Section 4), so this is allowed.
However, because JWTs often reflect security concepts, it's usually better to be defensive and reject these
unexpected scenarios by default. The RFC later supports this position/preference in
Section 10.12:
```
Ambiguous and potentially exploitable situations
could arise if the JSON parser used does not enforce the uniqueness
of member names or returns an unpredictable value for duplicate
member names.
```
Finally, this is just a default, and the RFC does indeed allow duplicate member names if the last value is used,
so applications that require duplicates to be allowed can simply configure their own ObjectMapper and use
that with JJWT instead of assuming this (new) JJWT default. See
Issue #877 for more.
If using JJWT's support to use Jackson to parse
Custom Claim Types (for example, a Claim that should be
unmarshalled into a POJO), and the JSON for that POJO contained a member that is not represented in the specified
class, Jackson would fail parsing by default. Because POJOs and JSON data models can sometimes be out of sync
due to different class versions, the default behavior has been changed to ignore these unknown JSON members instead
of failing (i.e. the ObjectMapper's DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES is now set to false)
by default.

Again, if you prefer the stricter behavior of rejecting JSON with extra or unknown properties, you can configure
true on your own ObjectMapper instance and use that instance with the Jwts.parser() builder.

Additional Changes

This release also:

Fixes a thread-safety issue when using java.util.ServiceLoader to dynamically lookup/instantiate pluggable
implementations of JJWT interfaces (e.g. JSON parsers, etc). See
Issue #873 and its documented fix in
PR #893.
Ensures Android environments and older org.json library usages can parse JSON from a JwtBuilder-provided
java.io.Reader instance. Issue 882.
Ensures a single string aud (Audience) claim is retained (without converting it to a Set) when copying/applying a
source Claims instance to a destination Claims builder. Issue 890.
Ensures P-256, P-384 and P-521 Elliptic Curve JWKs zero-pad their field element (x, y, and d) byte array values
if necessary before Base64Url-encoding per RFC 7518, Sections
6.2.1.2,
6.2.1.3, and
6.2.2.1, respectively.
Issue 901.
Ensures that Secret JWKs for HMAC-SHA algorithms with k sizes larger than the algorithm minimum can
be parsed/used as expected. See Issue #905
Ensures there is an upper bound (maximum) iterations enforced for PBES2 decryption to help mitigate potential DoS
attacks. Many thanks to Jingcheng Yang and Jianjun Chen from Sichuan University and Zhongguancun Lab for their
work on this. See PR 911.
Fixes various typos in documentation and JavaDoc. Thanks to those contributing pull requests for these!

`v0.12.3`

Compare Source

This patch release:

Upgrades the org.json dependency to 20231013 to address that library's
CVE-2023-5072 vulnerability.
(Re-)enables empty values for custom claims, which was the behavior in <= 0.11.5.
Issue 858.

`v0.12.2`

Compare Source

This is a follow-up release to finalize the work in 0.12.1 that tried to fix a reflection scope problem
on >= JDK 17. The 0.12.1 fix worked, but only if the importing project or application did not have its own
module-info.java file.

This release removes that reflection code entirely in favor of a JJWT-native implementation, eliminating JPMS
module (scope) problems on >= JDK 17. As such, --add-opens flags are no longer required to use JJWT.

The fix has been tested up through JDK 21 in a separate application environment (out of JJWT's codebase) to assert
expected functionality in a 'clean room' environment in a project both with and without module-info.java usage.

`v0.12.1`

Compare Source

Enabled reflective access on JDK 17+ to java.io.ByteArrayInputStream and sun.security.util.KeyUtil for
jjwt-impl.jar

`v0.12.0`

Compare Source

This is a big release! JJWT now fully supports Encrypted JSON Web Tokens (JWE), JSON Web Keys (JWK) and more! See the
sections below enumerating all new features as well as important notes on breaking changes or backwards-incompatible
changes made in preparation for the upcoming 1.0 release.

Because breaking changes are being introduced, it is strongly recommended to wait until the upcoming 1.0 release
where you can address breaking changes one time only.

Those that need immediate JWE encryption and JWK key support
however will likely want to upgrade now and deal with the smaller subset of breaking changes in the 1.0 release.

Simplified Starter Jar

Those upgrading to new modular JJWT versions from old single-jar versions will transparently obtain everything
they need in their Maven, Gradle or Android projects.

JJWT's early releases had one and only one .jar: jjwt.jar. Later releases moved to a modular design with 'api' and
'impl' jars including 'plugin' jars for Jackson, GSON, org.json, etc. Some users upgrading from the earlier single
jar to JJWT's later versions have been frustrated by being forced to learn how to configure the more modular .jars.

This release re-introduces the jjwt.jar artifact again, but this time it is simply an empty .jar with Maven
metadata that will automatically transitively download the following into a project, retaining the old single-jar
behavior:

jjwt-api.jar
jjwt-impl.jar
jjwt-jackson.jar

Naturally, developers are still encouraged to configure the modular .jars as described in JJWT's documentation for
greater control and to enable their preferred JSON parser, but this stop-gap should help those unaware when upgrading.

JSON Web Encryption (JWE) Support!

This has been a long-awaited feature for JJWT, years in the making, and it is quite extensive - so many encryption
algorithms and key management algorithms are defined by the JWA specification, and new API concepts had to be
introduced for all of them, as well as extensive testing with RFC-defined test vectors. The wait is over!
All JWA-defined encryption algorithms and key management algorithms are fully implemented and supported and
available immediately. For example:

AeadAlgorithm enc = Jwts.ENC.A256GCM;
SecretKey key = enc.key().build();
String compact = Jwts.builder().setSubject("Joe").encryptWith(key, enc).compact();

Jwe<Claims> jwe = Jwts.parser().decryptWith(key).build().parseEncryptedClaims(compact);

Many other RSA and Elliptic Curve examples are in the full README documentation.

JSON Web Key (JWK) Support!

Representing cryptographic keys - SecretKeys, RSA Public and Private Keys, Elliptic Curve Public and
Private keys - as fully encoded JSON objects according to the JWK specification - is now fully implemented and
supported. The new Jwks utility class exists to create JWK builders and parsers as desired. For example:

SecretKey key = Jwts.SIG.HS256.key().build();
SecretJwk jwk = Jwks.builder().forKey(key).build();
assert key.equals(jwk.toKey());

// or if receiving a JWK string:
Jwk<?> parsedJwk = Jwks.parser().build().parse(jwkString);
assert jwk.equals(parsedJwk);
assert key.equals(parsedJwk.toKey());

Many JJWT users won't need to use JWKs explicitly, but some JWA Key Management Algorithms (and lots of RFC test
vectors) utilize JWKs when transmitting JWEs. As this was required by JWE, it is now implemented in full for
JWE use as well as general-purpose JWK support.

JWK Thumbprint and JWK Thumbprint URI support

The JWK Thumbprint and
JWK Thumbprint URI RFC specifications are now fully supported. Please
see the README.md file's corresponding named sections for both for full documentation and usage examples.

JWS Unencoded Payload Option (`b64`) support

The JSON Web Signature (JWS) Unencoded Payload Option RFC specification
is now fully supported. Please see the README.md corresponding named section for documentation and usage examples.

Better PKCS11 and Hardware Security Module (HSM) support

Previous versions of JJWT enforced that Private Keys implemented the RSAKey and ECKey interfaces to enforce key
length requirements. With this release, JJWT will still perform those checks when those data types are available,
but if not, as is common with keys from PKCS11 and HSM KeyStores, JJWT will still allow those Keys to be used,
expecting the underlying Security Provider to enforce any key requirements. This should reduce or eliminate any
custom code previously written to extend JJWT to use keys from those KeyStores or Providers.

Additionally, PKCS11/HSM tests using SoftHSMv2 are run on every build with
every JWS MAC and Signature algorithm and every JWE Key algorithm to ensure continued stable support with
Android and Sun PKCS11 implementations and spec-compliant Hardware Security Modules that use the PKCS11 interface
(such as YubiKey, etc.)

Custom Signature Algorithms

The io.jsonwebtoken.SignatureAlgorithm enum has been deprecated in favor of new
io.jsonwebtoken.security.SecureDigestAlgorithm, io.jsonwebtoken.security.MacAlgorithm, and
io.jsonwebtoken.security.SignatureAlgorithm interfaces to allow custom algorithm implementations. The new nested
Jwts.SIG static inner class is a registry of all standard JWS algorithms as expected, exactly like the
old enum. This change was made because enums are a static concept by design and cannot
support custom values: those who wanted to use custom signature algorithms could not do so until now. The new
interfaces now allow anyone to plug in and support custom algorithms with JJWT as desired.

KeyBuilder and KeyPairBuilder

Because the io.jsonwebtoken.security.Keys#secretKeyFor and io.jsonwebtoken.security.Keys#keyPairFor methods
accepted the now-deprecated io.jsonwebtoken.SignatureAlgorithm enum, they have also been deprecated in favor of
calling new key() or keyPair() builder methods on MacAlgorithm and SignatureAlgorithm instances directly.
For example:

SecretKey key = Jwts.SIG.HS256.key().build();
KeyPair pair = Jwts.SIG.RS256.keyPair().build();

The builders allow for customization of the JCA Provider and SecureRandom during Key or KeyPair generation if desired, whereas
the old enum-based static utility methods did not.

Preparation for 1.0

Now that the JWE and JWK specifications are implemented, only a few things remain for JJWT to be considered at
version 1.0. We have been waiting to apply the 1.0 release version number until the entire set of JWT specifications
are fully supported and we drop JDK 7 support (to allow users to use JDK 8 APIs). To that end, we have had to
deprecate some concepts, or in some cases, completely break backwards compatibility to ensure the transition to
1.0 (and JDK 8 APIs) are possible. Most backwards-incompatible changes are listed in the next section below.

Backwards Compatibility Breaking Changes, Warnings and Deprecations

io.jsonwebtoken.Jwt's getBody() method has been deprecated in favor of a new getPayload() method to
reflect correct JWT specification nomenclature/taxonomy.
io.jsonwebtoken.Jws's getSignature() method has been deprecated in favor of a new getDigest() method to
support expected congruent behavior with Jwe instances (both have digests).
io.jsonwebtoken.JwtParser's parseContentJwt, parseClaimsJwt, parseContentJws, and parseClaimsJws methods
have been deprecated in favor of more intuitive respective parseUnsecuredContent, parseUnsecuredClaims,
parseSignedContent and parseSignedClaims methods.
io.jsonwebtoken.CompressionCodec is now deprecated in favor of the new io.jsonwebtoken.io.CompressionAlgorithm
interface. This is to guarantee API congruence with all other JWT-identifiable algorithm IDs that can be set as a
header value.
io.jsonwebtoken.CompressionCodecResolver has been deprecated in favor of the new
JwtParserBuilder#addCompressionAlgorithms method.

Breaking Changes

io.jsonwebtoken.Claims and io.jsonwebtoken.Header instances are now immutable to enhance security and thread
safety. Creation and mutation are supported with newly introduced ClaimsBuilder and HeaderBuilder concepts.
Even though mutation methods have migrated, there are a couple that have been removed entirely:
- io.jsonwebtoken.JwsHeader#setAlgorithm has been removed - the JwtBuilder will always set the appropriate
  alg header automatically based on builder state.
- io.jsonwebtoken.Header#setCompressionAlgorithm has been removed - the JwtBuilder will always set the appropriate
  zip header automatically based on builder state.
io.jsonwebtoken.Jwts's header(Map), jwsHeader() and jwsHeader(Map) methods have been removed in favor
of the new header() method that returns a HeaderBuilder to support method chaining and dynamic Header type
creation. The HeaderBuilder will dynamically create a Header, JwsHeader or JweHeader automatically based on
builder state.
Similarly, io.jsonwebtoken.Jwts's claims() static method has been changed to return a ClaimsBuilder instead
of a Claims instance.
JWTs that do not contain JSON Claims now have a payload type of byte[] instead of String (that is,
Jwt<byte[]> instead of Jwt<String>). This is because JWTs, especially when used with the
cty (Content Type) header, are capable of handling any type of payload, not just Strings. The previous JJWT
releases didn't account for this, and now the API accurately reflects the JWT RFC specification payload
capabilities. Additionally, the name of plaintext has been changed to content in method names and JavaDoc to
reflect this taxonomy. This change has impacted the following JJWT APIs:
- The JwtBuilder's setPayload(String) method has been deprecated in favor of two new methods:
  - setContent(byte[]), and
  - setContent(byte[], String contentType)
  These new methods allow any kind of content
  within a JWT, not just Strings. The existing setPayload(String) method implementation has been changed to
  delegate to this new setContent(byte[]) method with the argument's UTF-8 bytes, for example
  setContent(payloadString.getBytes(StandardCharsets.UTF_8)).
- The JwtParser's Jwt<Header, String> parsePlaintextJwt(String plaintextJwt) and
  Jws<String> parsePlaintextJws(String plaintextJws) methods have been changed to
  Jwt<Header, byte[]> parseContentJwt(String plaintextJwt) and
  Jws<byte[]> parseContentJws(String plaintextJws) respectively.
- JwtHandler's onPlaintextJwt(String) and onPlaintextJws(String) methods have been changed to
  onContentJwt(byte[]) and onContentJws(byte[]) respectively.
- io.jsonwebtoken.JwtHandlerAdapter has been changed to reflect the above-mentioned name and String-to-byte[]
  argument changes, as well adding the abstract modifier. This class was never intended
  to be instantiated directly, and is provided for subclassing only. The missing modifier has been added to ensure
  the class is used as it had always been intended.
- io.jsonwebtoken.SigningKeyResolver's resolveSigningKey(JwsHeader, String) method has been changed to
  resolveSigningKey(JwsHeader, byte[]).
io.jsonwebtoken.JwtParser is now immutable. All mutation/modification methods (setters, etc) deprecated 4 years
ago have been removed. All parser configuration requires using the JwtParserBuilder.
Similarly, io.jsonwebtoken.Jwts's parser() method deprecated 4 years ago has been changed to now return a
JwtParserBuilder instead of a direct JwtParser instance. The previous Jwts.parserBuilder() method has been
removed as it is now redundant.
The JwtParserBuilder no longer supports PrivateKeys for signature verification. This was an old
legacy behavior scheduled for removal years ago, and that change is now complete. For various cryptographic/security
reasons, asymmetric public/private key signatures should always be created with PrivateKeys and verified with
PublicKeys.
io.jsonwebtoken.CompressionCodec implementations are no longer discoverable via java.util.ServiceLoader due to
runtime performance problems with the JDK's ServiceLoader implementation per
https://github.com/jwtk/jjwt/issues/648/648. Custom implementations should be made available to the JwtParser via
the new JwtParserBuilder#addCompressionAlgorithms method.
Prior to this release, if there was a serialization problem when serializing the JWT Header, an IllegalStateException
was thrown. If there was a problem when serializing the JWT claims, an IllegalArgumentException was
thrown. This has been changed up to ensure consistency: any serialization error with either headers or claims
will now throw a io.jsonwebtoken.io.SerializationException.
Parsing of unsecured JWTs (alg header of none) are now disabled by default as mandated by
RFC 7518, Section 3.6. If you require parsing of
unsecured JWTs, you must call the JwtParserBuilder#enableUnsecured() method, but note the security
implications mentioned in that method's JavaDoc before doing so.
io.jsonwebtoken.gson.io.GsonSerializer now requires Gson instances that have a registered
GsonSupplierSerializer type adapter, for example:
```
new GsonBuilder()
  .registerTypeHierarchyAdapter(io.jsonwebtoken.lang.Supplier.class, GsonSupplierSerializer.INSTANCE)    
  .disableHtmlEscaping().create();
```
This is to ensure JWKs have toString() and application log safety (do not print secure material), but still
serialize to JSON correctly.
io.jsonwebtoken.InvalidClaimException and its two subclasses (IncorrectClaimException and MissingClaimException)
were previously mutable, allowing the corresponding claim name and claim value to be set on the exception after
creation. These should have always been immutable without those setters (just getters), and this was a previous
implementation oversight. This release has ensured they are immutable without the setters.

`v0.11.5`

Compare Source

This patch release adds additional security guards against an ECDSA bug in Java SE versions 15-15.0.6, 17-17.0.2, and 18
(CVE-2022-21449) in addition to the guards added in the JJWT 0.11.3
release. This patch allows JJWT users using those JVM versions to upgrade to JJWT 0.11.5, even if they are unable to
upgrade their JVM to patched/fixed JVM version in a timely manner. Note: if your application does not use these JVM
versions, you are not exposed to the JVM vulnerability.

Note that the CVE is not a bug within JJWT itself - it is a bug within the above listed JVM versions, and the
JJWT 0.11.5 release adds additional precautions within JJWT in case an application team is not able to upgrade
their JVM in a timely manner.

However, even with these additional JJWT security guards, the root cause of the issue is the JVM, so it strongly
recommended to upgrade your JVM to version
15.0.7, 17.0.3, or 18.0.1 or later to ensure the bug does not surface elsewhere in your application code or any other
third party library in your application that may not contain similar security guards.

Issues included in this patch are listed in the JJWT 0.11.5 milestone.

Credits

Thank you to Neil Madden, the security researcher that first discovered the JVM
vulnerability as covered in his Psychic Signatures in Java
blog post. Neil worked directly with the JJWT team to provide these additional guards, beyond what was in the JJWT 0.11.3
release, and we're grateful for his help and collaboration in reviewing our fixes and for the additional tests he
provided the JJWT team.

`v0.11.4`

Compare Source

This patch release:

Adds additional handling for rare JSON parsing exceptions and wraps them in a JwtException to allow the application to handle these conditions as JWT concerns.
Upgrades the jjwt-jackson module's Jackson dependency to 2.12.6.1.
Upgrades the jjwt-orgjson module's org.json:json dependency to 20220320.
Upgrades the jjwt-gson module's gson dependency to 2.9.0.
Upgrades the internal testing BouncyCastle version and any references in README documentation examples to 1.70.
Contains various documentation and typo fixes.

The patch also makes various internal project POM and build enhancements to reduce repetition and the chance for
stale references, and overall create a cleaner build with less warnings. It also ensures that CI testing builds
and executes on all latest OpenJDK versions from Java 7 to Java 18 (inclusive).

Issues included in this patch are listed in the JJWT 0.11.4 milestone.

`v0.11.3`

Compare Source

This patch release adds security guards against an ECDSA bug in Java SE versions 15-15.0.6, 17-17.0.2, and 18
(CVE-2022-21449). Note: if your application does not use these
JVM versions, you are not exposed to the JVM vulnerability.

Note that the CVE is not a bug within JJWT itself - it is a bug within the above listed JVM versions. However, even
with these additional JJWT security guards, the root cause of the issue is the JVM, so it strongly
recommended to upgrade your JVM to version 15.0.7, 17.0.3, or 18.0.1 or later to ensure the bug does not surface
elsewhere in your application code or any other third party library in your application that may not contain similar
security guards.

Issues included in this patch are listed in the JJWT 0.11.3 milestone.

Backwards Compatibility Warning

In addition to additional protections against
r or s values of zero in ECDSA signatures, this
release also disables by default legacy DER-encoded signatures that might be included in an ECDSA-signed JWT.
(DER-encoded signatures are not supported by the JWT RFC specifications, so they are not frequently encountered.)

However, if you are using an application that needs to consume such legacy JWTs (either produced by a very
early version of JJWT, or a different JWT library), you may re-enable DER-encoded ECDSA signatures by setting the
io.jsonwebtoken.impl.crypto.EllipticCurveSignatureValidator.derEncodingSupported System property to the exact
String value true. For example:

System.setProperty("io.jsonwebtoken.impl.crypto.EllipticCurveSignatureValidator.derEncodingSupported", "true");

BUT BE CAREFUL: DO NOT set this System property if your application may run on one of the vulnerable JVMs
noted above (Java SE versions 15-15.0.6, 17-17.0.2, and 18).

You may safely set this property to a String value of true on all other versions of the JVM if you need to
support these legacy JWTs, otherwise it is best to ignore (not set) the property entirely.

Credits

Thank you to Neil Madden, the security researcher that first discovered the JVM
vulnerability as covered in his Psychic Signatures in Java blog post.

We'd also like to thank Toshiki Sasazaki, a member of LINE Corporation's Application Security
Team as the first person to report the concern directly to the JJWT team, as well as for working with us during testing
leading to our conclusions and subsequent 0.11.3 patch release.

spring-projects/spring-boot (org.springframework.boot:spring-boot-dependencies)

`v2.7.18`

Compare Source

⚠️ Noteworthy Changes

Following the Paketo team's announcement that the Bionic CNB builders will be removed, the default builder using by bootBuildImage (Gradle) and spring-boot:build-image (Maven) has been changed to Paketo Jammy #38477

🐞 Bug Fixes

App fails to start with a NoSuchMethodError when using Flyway 10.0.0 #38164
spring.webflux.multipart.max-disk-usage-per-part behaves incorrectly for values where the number of bytes overflows an int #38146
Mail health indicator fails when host is not set in properties #38007

📔 Documentation

Document supported SQL comment prefixes #38385
Fix link to Elasticsearch health indicator #38330
Improve --help and documentation for "encodepassword -a/--algorithm" in the Spring Boot CLI #38203
Document that TomcatConnectorCustomizers are not applied to additional connectors #38183
MyErrorWebExceptionHandler example in documentation isn't working #38104
Document that SerializationFeature.WRITE_DURATIONS_AS_TIMESTAMPS is disabled by default #38083
Update "Running Behind a Front-end Proxy Server" to include reactive and ForwardedHeaderTransformer #37282
Improve documentation of classpath.idx file and its generation by the Maven and Gradle plugins #37125
Document configuration for building images with Colima #34522
Code sample in "Developing Your First Spring Boot Application" does not work #34513
Document ConfigurationPropertyCaching #34172
Document that application.* banner variables require a packaged jar or the use of Boot's launcher #33489
Add section on AspectJ support #32642
Document server.servlet.encoding.* properties and server.servlet.encoding.mapping in particular #32472
Add a section on customizing embedded reactive servers #31917
Clarify that MVC components provided through WebMvcRegistrations are subject to subsequent processing and configuration by MVC #31232
Clarifying documentation on including a top-level @TestConfiguration class in a test #30513
Clarify that @AutoConfigureWebTestClient binds WebTestClient to mock infrastructure #29890
Improve systemd configuration documentation #28453
Document how to customize the basePackages that auto-configurations consider (for example Spring Data Repositories) #27549
Document additional user configuration that's required after setting spring.hateoas.use-hal-as-default-json-media-type to false #26814
Add how-to documentation for test-only database migrations with Flyway/Liquibase #26796

🔨 Dependency Upgrades

Upgrade to ActiveMQ 5.16.7 #38427
Upgrade to DB2 JDBC 11.5.9.0 #38428
Upgrade to Dropwizard Metrics 4.2.22 #38429
Upgrade to Elasticsearch 7.17.15 #38430
Upgrade to Glassfish JAXB 2.3.9 #38431
Upgrade to Micrometer 1.9.17 #38279
Upgrade to Netty 4.1.101.Final #38432
Upgrade to Pooled JMS 1.2.6 #38433
Upgrade to Reactor Bom 2020.0.38 #38280
Upgrade to Spring Batch 4.3.10 #38281
Upgrade to Spring Data Bom 2021.2.18 #38282
Upgrade to Spring Framework 5.3.31 #38283
Upgrade to Spring HATEOAS 1.5.6 #38373
Upgrade to Spring Integration 5.5.20 #38491
Upgrade to Spring RESTDocs 2.0.8.RELEASE #38434
Upgrade to Spring WS 3.1.8 #38284
Upgrade to Tomcat 9.0.83 #38435

❤️ Contributors

Thank you to all the contributors who worked on this release:

@GVictorG7, @PENEKhun, @dreis2211, and @izeye

`v2.7.17`

Compare Source

⚠️ Noteworthy Changes

The behavior of spring.jms.listener.concurrency has been corrected to match the documentation (#37180). If you were setting spring.jms.listener.concurrency without also setting spring.jms.listener.max-concurrency, please review your configuration when upgrading.

🐞 Bug Fixes

@Order does not work on (CommandLine|Application)Runner @Bean methods #37905
Gradle plugin uses to-be-deprecated API for getting and setting file permissions #37878
Task executor metrics are not registered when using lazy initialization #37832
Constructor binding with a custom collection type does not work #37734
Dependency management for kafka-server-common with a test classifier is missing #37499
fileMode and dirMode are not applied to all entries in an archive produced by BootJar #37496
Gradle plugin's build info support produces a deprecation warning when using Gradle 8.4-rc-1 #37493
RepackageMojo doesn't support 1 digit numerical values for project.build.outputTimestamp #37438
Restarter creates memory leak in tests #37373
Contrary to the documentation, setting spring.jms.listener.concurrency alone configures the maximum concurrency #37180
Application fails to start when an optional config import cannot be resolved #35683
@ComponentScan on a test class is processed when creating a test context but is not included in the context's cache key #31577
AspectJ transaction management with compile-time weaving does not work with spring.main.lazy-initialization=true #37506

📔 Documentation

Remove link to LiveReload website due to timeout #37643
Refer to ActiveMQ as ActiveMQ "Classic" #37606
Use more idiomatic Kotlin in example for "Map Health Indicators to Micrometer Metrics" #37491
Document support for Java 21 #37371

🔨 Dependency Upgrades

Upgrade to Dropwizard Metrics 4.2.21 #37893
Upgrade to Elasticsearch 7.17.14 #37840
Upgrade to Infinispan 13.0.20.Final #37841
Upgrade to Jetty 9.4.53.v20231009 #37842
Upgrade to Jetty Reactive HTTPClient 1.1.15 #37927
Upgrade to Micrometer 1.9.16 #37674
Upgrade to Netty 4.1.100.Final #37843
Upgrade to Pooled JMS 1.2.5 #37894
Upgrade to Reactor Bom 2020.0.37 #37675
Upgrade to Spring AMQP 2.4.17 #37676
Upgrade to Spring Data Bom 2021.2.17 #37677
Upgrade to Spring Session Bom 2021.2.3 #37928
Upgrade to Tomcat 9.0.82 #37895
Upgrade to UnboundID LDAPSDK 6.0.10 #37753
Upgrade to Undertow 2.2.28.Final #37929

❤️ Contributors

Thank you to all the contributors who worked on this release:

@bottlerocketjonny, @dependabot[bot], @erichaagdev, @esperar, @izeye, @jbertram, @nielsbasjes, @onobc, @ttddyy, and @vpavic

`v2.7.16`

Compare Source

⭐ New Features

Add TWENTY_ONE to JavaVersion enum #37362

🐞 Bug Fixes

Invalid Accept header produces HTTP 500 in WelcomePageHandlerMapping #37455
PrivateKeyParser doesn't support ed448, XDH and RSA-PSS keys #37237
Parsing OCI image names that are invalid due to the use of upper case letters is very slow #35657
Using https with elliptic curves other than secp384r1 fails #34232
Saml2RelyingPartyAutoConfiguration ignores sign-request when metadata-url is used #33747
Leaking file descriptor / socket within DomainSocket tooling #32423

📔 Documentation

Correct the description of spring.artemis.broker-url #37260
Add default value metadata for management.metrics.export.signalfx.published-histogram-type #37210
Document that PKCS8 PEM files should be used whenever possible #37170
Polish javadoc #37112

🔨 Dependency Upgrades

Upgrade to Elasticsearch 7.17.13 #37286
Upgrade to Jetty 9.4.52.v20230823 #37287
Upgrade to Lombok 1.18.30 #37486
Upgrade to Micrometer 1.9.15 #37245
Upgrade to Reactor Bom 2020.0.36 #37246
Upgrade to Spring AMQP 2.4.16 #37247
Upgrade to Spring Data Bom 2021.2.16 #37248
Upgrade to Spring Framework 5.3.30 #37249
Upgrade to Spring GraphQL 1.0.6 #37250
Upgrade to Spring Integration 5.5.19 #37251
Upgrade to Spring Security 5.7.11 #37414
Upgrade to Spring WS 3.1.7 #37415
Upgrade to Tomcat 9.0.80 #37288

❤️ Contributors

Thank you to all the contributors who worked on this release:

@dependabot[bot], @hakan-krgn, @izeye, @mdeinum, and @quaff

`v2.7.15`

Compare Source

⚠️ Noteworthy Changes

This release upgrades to MariaDB 3.1.4 from 3.0.x to restore compatibility with Java 8. If the upgrade is problematic and Java 8 compatibility is not a requirement, downgrade to 3.0.x by using the mariadb.version property

🐞 Bug Fixes

Artemis ConnectionFactory is not configured when CachingConnectionFactory is missing and enabled properties are false #36767
server.max-http-request-header-size doesn't affect Netty server with http2 enabled #36766
LogbackLoggingSystem does not report suppressed exception details #36645
Tomcat warns about a missing +/- prefix when enabling multiple protocols through server.ssl.enabled-protocols #36572
Descriptions of started and ready time metrics contain time units but the unit may change when the metrics are exported #36507
management.metrics.export.wavefront properties are incomplete #36498
management.metrics.export.signalfx properties are incomplete #36497
management.metrics.export.atlas properties are incomplete #36496
Script-based database initialization fails with an unhelpful error message when configured with a resource that points to a directory #36386
JobLauncherApplicationRunner returns a success exit code even when no jobs have been run #36060
DatabaseDriver swallows real exception #34728
Application Context initialized twice during test when exception thrown during initialization #24888

📔 Documentation

Maven plugin docs contain invalid parameter for image building #37048
Align javadoc of AbstractFilterRegistrationBean#setDispatcherTypes #36965
Update RestTemplateBuilder#defaultHeader javadoc to reference correct client-side HTTP request class #36614
@since is missing from javadoc of values added to JavaVersion since its introduction #36608
Document that server.forward-headers-strategy property defaults to native when running on Kubernetes #36564
Clarify the effect of using @EnableWebMvc #36506
Documentation of spring.redis.url incorrectly states that it does not override spring.redis.user [#36477](htt

Configuration

📅 Schedule: Branch creation - "before 3am on the first day of the month" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate bot requested a review from gstoehld May 1, 2022 00:00

renovate bot force-pushed the renovate/dependencies branch from 8357dc5 to 70e5f79 Compare September 25, 2022 14:28

renovate bot changed the title ~~Update dependencies to v0.11.5~~ Update dependencies Sep 25, 2022

renovate bot force-pushed the renovate/dependencies branch from 70e5f79 to 0c142d9 Compare November 20, 2022 09:29

renovate bot force-pushed the renovate/dependencies branch from 0c142d9 to 846fd2c Compare March 12, 2023 14:57

renovate bot changed the title ~~Update dependencies~~ chore(deps): update dependencies Mar 12, 2023

renovate bot force-pushed the renovate/dependencies branch from 846fd2c to 9b9e248 Compare March 23, 2023 10:01

renovate bot force-pushed the renovate/dependencies branch from 9b9e248 to e3d835e Compare May 28, 2023 11:07

renovate bot force-pushed the renovate/dependencies branch from e3d835e to 8ea2ae5 Compare June 22, 2023 11:30

renovate bot force-pushed the renovate/dependencies branch from 8ea2ae5 to c6ad268 Compare July 20, 2023 11:08

renovate bot force-pushed the renovate/dependencies branch from c6ad268 to ca025bd Compare August 24, 2023 09:40

renovate bot force-pushed the renovate/dependencies branch from ca025bd to 6a6b77c Compare September 21, 2023 10:20

renovate bot force-pushed the renovate/dependencies branch 3 times, most recently from f5e1316 to 0b8446f Compare October 6, 2023 07:39

renovate bot force-pushed the renovate/dependencies branch 3 times, most recently from 2cd31dc to 3f2b14f Compare October 19, 2023 11:04

renovate bot force-pushed the renovate/dependencies branch from 3f2b14f to c58541e Compare November 23, 2023 09:45

renovate bot force-pushed the renovate/dependencies branch 2 times, most recently from 2ce3814 to 75be805 Compare February 1, 2024 17:53

renovate bot force-pushed the renovate/dependencies branch from 75be805 to a916686 Compare June 21, 2024 22:04

chore(deps): update dependencies

d1a155b

renovate bot force-pushed the renovate/dependencies branch from a916686 to d1a155b Compare September 6, 2024 19:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependencies #142

chore(deps): update dependencies #142

renovate bot commented May 1, 2022 •

edited

Loading

chore(deps): update dependencies #142

Are you sure you want to change the base?

chore(deps): update dependencies #142

Conversation

renovate bot commented May 1, 2022 • edited Loading

Release Notes

=========== Features

Non-functional changes

=========== Features

Non-functional changes

Jackson Default Parsing Behavior

Additional Changes

Simplified Starter Jar

JSON Web Encryption (JWE) Support!

JSON Web Key (JWK) Support!

JWK Thumbprint and JWK Thumbprint URI support

JWS Unencoded Payload Option (b64) support

Better PKCS11 and Hardware Security Module (HSM) support

Custom Signature Algorithms

KeyBuilder and KeyPairBuilder

Preparation for 1.0

Backwards Compatibility Breaking Changes, Warnings and Deprecations

Breaking Changes

Credits

Backwards Compatibility Warning

Credits

⚠️ Noteworthy Changes

🐞 Bug Fixes

📔 Documentation

🔨 Dependency Upgrades

❤️ Contributors

⚠️ Noteworthy Changes

🐞 Bug Fixes

📔 Documentation

🔨 Dependency Upgrades

❤️ Contributors

⭐ New Features

🐞 Bug Fixes

📔 Documentation

🔨 Dependency Upgrades

❤️ Contributors

⚠️ Noteworthy Changes

🐞 Bug Fixes

📔 Documentation

Configuration

renovate bot commented May 1, 2022 •

edited

Loading

JWS Unencoded Payload Option (`b64`) support