Skip to content

Update Mend: high confidence minor and patch dependency updates#2

Open
mend-for-github-com[bot] wants to merge 1 commit intomainfrom
whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates
Open

Update Mend: high confidence minor and patch dependency updates#2
mend-for-github-com[bot] wants to merge 1 commit intomainfrom
whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates

Conversation

@mend-for-github-com
Copy link

@mend-for-github-com mend-for-github-com bot commented Aug 7, 2024 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
org.apache.maven.plugins:maven-javadoc-plugin (source) 3.6.3 → 3.12.0 age adoption passing confidence
org.apache.maven.plugins:maven-source-plugin (source) 3.3.0 → 3.4.0 age adoption passing confidence
org.apache.maven.plugins:maven-gpg-plugin (source) 3.1.0 → 3.2.8 age adoption passing confidence
org.jacoco:jacoco-maven-plugin (source) 0.8.7 → 0.8.14 age adoption passing confidence
org.apache.maven.plugins:maven-compiler-plugin (source) 3.12.1 → 3.15.0 age adoption passing confidence
org.skyscreamer:jsonassert 1.5.0 → 1.5.3 age adoption passing confidence
net.minidev:json-smart (source) 2.5.0 → 2.6.0 age adoption passing confidence
com.google.code.gson:gson 2.8.9 → 2.13.2 age adoption passing confidence
junit:junit (source) 4.13.1 → 4.13.2 age adoption passing confidence
org.apache.httpcomponents:httpclient (source) 4.5.13 → 4.5.14 age adoption passing confidence
com.jayway.jsonpath:json-path 2.9.0 → 2.10.0 age adoption passing confidence
com.google.api-client:google-api-client 2.4.0 → 2.9.0 age adoption passing confidence

Release Notes

jacoco/jacoco (org.jacoco:jacoco-maven-plugin)

v0.8.14: 0.8.14

Compare Source

New Features

  • JaCoCo now officially supports Java 25 (GitHub #​1950).
  • Experimental support for Java 26 class files (GitHub #​1870).
  • Branches added by the Kotlin compiler for default argument number 33 or higher are filtered out during generation of report (GitHub #​1655).
  • Part of bytecode generated by the Kotlin compiler for elvis operator that follows safe call operator is filtered out during generation of report (GitHub #​1814, #​1954).
  • Part of bytecode generated by the Kotlin compiler for more cases of chained safe call operators is filtered out during generation of report (GitHub #​1956).
  • Part of bytecode generated by the Kotlin compiler for invocations of suspendCoroutineUninterceptedOrReturn intrinsic is filtered out during generation of report (GitHub #​1929).
  • Part of bytecode generated by the Kotlin compiler for suspending lambdas with parameters is filtered out during generation of report (GitHub #​1945).
  • Part of bytecode generated by the Kotlin compiler for suspending functions and lambdas with suspension points that return inline value class is filtered out during generation of report (GitHub #​1871).
  • Part of bytecode generated by the Kotlin Compose compiler plugin for pausable composition is filtered out during generation of report (GitHub #​1911).
  • Methods generated by the Kotlin serialization compiler plugin are filtered out (GitHub #​1885, #​1970, #​1971).

Fixed bugs

  • Fixed handling of implicit else clause of when with String subject in Kotlin (GitHub #​1813, #​1940).
  • Fixed handling of implicit default clause of switch by String in Java when compiled by ECJ (GitHub #​1813, #​1940).
    Fixed handling of exceptions in chains of safe call operators in Kotlin (GitHub #​1819).

Non-functional Changes

  • JaCoCo now depends on ASM 9.9 (GitHub #​1965).

v0.8.13: 0.8.13

Compare Source

New Features

  • JaCoCo now officially supports Java 23 and Java 24 (GitHub #​1757, #​1631, #​1867).
  • Experimental support for Java 25 class files (GitHub #​1807).
  • Calculation of line coverage for Kotlin inline functions (GitHub #​1670).
  • Calculation of line coverage for Kotlin inline functions with reified type parameter (GitHub #​1670, #​1700).
  • Calculation of coverage for Kotlin JvmSynthetic functions (GitHub #​1700).
  • Part of bytecode generated by the Kotlin Compose compiler plugin is filtered out during generation of report (GitHub #​1616).
  • Part of bytecode generated by the Kotlin compiler for inline value classes is filtered out during generation of report (GitHub #​1475).
  • Part of bytecode generated by the Kotlin compiler for suspending lambdas without suspension points is filtered out during generation of report (GitHub #​1283).
  • Part of bytecode generated by the Kotlin compiler for when expressions and statements with nullable enum subject is filtered out during generation of report (GitHub #​1774).
  • Part of bytecode generated by the Kotlin compiler for when expressions and statements with nullable String subject is filtered out during generation of report (GitHub #​1769).
  • Part of bytecode generated by the Kotlin compiler for chains of safe call operators is filtered out during generation of report (GitHub #​1810, #​1818).
  • Method getEntries generated by the Kotlin compiler for enum classes is filtered out during generation of report (GitHub #​1625).
  • Methods generated by the Kotlin compiler for constructors and functions with JvmOverloads annotation are filtered out (GitHub #​1768).

Fixed bugs

  • Fixed interpretation of Kotlin SMAP (GitHub #​1525).
  • File extensions are preserved in HTML report in case of clashes of normalized file names (GitHub #​1660).

Non-functional Changes

  • JaCoCo build now uses Maven Wrapper and requires at least Maven 3.9.9 (GitHub #​1708, #​1707, #​1681).
  • JaCoCo now depends on ASM 9.8 (GitHub #​1862).
  • More context information when IllegalArgumentException occurs during reading of zip file (GitHub #​1833).

v0.8.12: 0.8.12

Compare Source

New Features

  • JaCoCo now officially supports Java 22 (GitHub #​1596).
  • Experimental support for Java 23 class files (GitHub #​1553).

Fixed bugs

  • Branches added by the Kotlin compiler for functions with default arguments and having more than 32 parameters are filtered out during generation of report (GitHub #​1556).
  • Branch added by the Kotlin compiler version 1.5.0 and above for reading from lateinit property is filtered out during generation of report (GitHub #​1568).

Non-functional Changes

  • JaCoCo now depends on ASM 9.7 (GitHub #​1600).

v0.8.11: 0.8.11

Compare Source

New Features

  • JaCoCo now officially supports Java 21 (GitHub #​1520).
  • Experimental support for Java 22 class files (GitHub #​1479).
  • Part of bytecode generated by the Java compilers for exhaustive switch expressions is filtered out during generation of report (GitHub #​1472).
  • Part of bytecode generated by the Java compilers for record patterns is filtered out during generation of report (GitHub #​1473).

Fixed bugs

  • Instrumentation should not cause VerifyError when the last local variable of method parameters is overridden in the method body to store a value of type long or double (GitHub #​893).
  • Restore exec file compatibility with versions from 0.7.5 to 0.8.8 in case of class files with zero line numbers (GitHub #​1492).

Non-functional Changes

  • jacoco-maven-plugin now requires at least Java 8 (GitHub #​1466, #​1468).
  • JaCoCo build now requires at least Maven 3.5.4 (GitHub #​1467).
  • Maven 3.9.2 should not produce warnings for jacoco-maven-plugin (GitHub #​1468).
  • JaCoCo build now requires JDK 17 (GitHub #​1482).
  • JaCoCo now depends on ASM 9.6 (GitHub #​1518).

v0.8.10: 0.8.10

Compare Source

Fixed bugs

  • Agent should not require configuration of permissions for SecurityManager outside of its codeBase (GitHub #​1425).

v0.8.9: 0.8.9

Compare Source

New Features

  • JaCoCo now officially supports Java 19 and 20 (GitHub #​1371, #​1386).
  • Experimental support for Java 21 class files (GitHub #​1386).
  • Add parameter to include the current project in the report-aggregate Maven goal (GitHub #​1007).
  • Component accessors generated by the Java compilers for records are filtered out during generation of report. Contributed by Tesla Zhang (GitHub #​1393).

Fixed bugs

  • Agent should not open java.lang package to unnamed module of the application class loader (GitHub #​1334).

Non-functional Changes

v0.8.8: 0.8.8

Compare Source

New Features

  • JaCoCo now officially supports Java 17 and 18 (GitHub #​1282, #​1198).
  • Experimental support for Java 19 class files (GitHub #​1264).
  • Part of bytecode generated by the Java compilers for assert statement is filtered out during generation of report (GitHub #​1196).
  • Branch added by the Kotlin compiler version 1.6.0 and above for "unsafe" cast operator is filtered out during generation of report (GitHub #​1266).
  • Improved support for multiple JaCoCo runtimes in the same VM (GitHub #​1057).

Fixed bugs

  • Fixed NullPointerException during filtering (GitHub #​1189).
  • Fix range for debug symbols of method parameters (GitHub #​1246).

Non-functional Changes

  • JaCoCo now depends on ASM 9.2 (GitHub #​1206).
  • Messages of exceptions occurring during analysis or instrumentation now include JaCoCo version (GitHub #​1217).
skyscreamer/JSONassert (org.skyscreamer:jsonassert)

v1.5.3

  • Revert Java release version from 21 to 8 due to breaking older compilers.

v1.5.2

v1.5.1

Going to try to catch up on some ancient PRs, mainly around security and cleanup. Starting with accepted PRs that
didn't get released yet. To be followed hopefully shortly with another release.

  • Added convenience methods for JSONObject comparison using a custom JSONComparator (thanks jakob-o@!)
  • Fix issue #​105: Issue when comparing JSONArray if any value is null (thanks suraj1291993@​!)
  • Fixes security vulnerability associated with older version of junit
netplex/json-smart-v2 (net.minidev:json-smart)

v2.6.0

Compare Source

What's Changed

New Contributors

Full Changelog: netplex/json-smart-v2@2.5.2...v2.6.0

v2.5.2

Compare Source

About CVE-2024-57699

Thanks for @​ccudennec-otto Some remarks on the CVE, more discussions in #​236

  • as mentioned here it is quite unlikely that the vulnerability is exploited if you come here because of Spring Security / com.nimbusds:oauth2-oidc-sdk
  • the code changes for the upcoming release will "only" fix the default modes provided by JSONParser, e.g. MODE_RFC4627
  • if you create the JSONParser manually / with custom options, make sure you set option LIMIT_JSON_DEPTH
    • since that's what "connect2id" is doing in their library, they were responsible for fixing it. They've already provided a new 11.x release that fixes the JSONParser setup on their side, i.e. you rather need their fixed version and not version 2.5.2 of json-smart
    • as stated here, they would also need to backport the fix to the versions that Spring Security needs IMHO

What's Changed

New Contributors

Full Changelog: netplex/json-smart-v2@2.5.1...2.5.2

v2.5.1: V 2.5.1

Compare Source

What's Changed

New Contributors

Full Changelog: netplex/json-smart-v2@2.5.0...2.5.1

google/gson (com.google.code.gson:gson)

v2.10

  • Support for serializing and deserializing Java records, on Java ≥ 16. (#​2201)
  • Add JsonArray.asList and JsonObject.asMap view methods (#​2225)
  • Fix TypeAdapterRuntimeTypeWrapper not detecting reflective TreeTypeAdapter and FutureTypeAdapter (#​1787)
  • Improve JsonReader.skipValue() (#​2062)
  • Perform numeric conversion for primitive numeric type adapters (#​2158)
  • Add Gson.fromJson(..., TypeToken) overloads (#​1700)
  • Fix changes to GsonBuilder affecting existing Gson instances (#​1815)
  • Make JsonElement conversion methods more consistent and fix javadoc (#​2178)
  • Throw UnsupportedOperationException when JsonWriter.jsonValue is not supported (#​1651)
  • Disallow JsonObject Entry.setValue(null) (#​2167)
  • Fix TypeAdapter.toJson throwing AssertionError for custom IOException (#​2172)
  • Convert null to JsonNull for JsonArray.set (#​2170)
  • Fixed nullSafe usage. (#​1555)
  • Validate TypeToken.getParameterized arguments (#​2166)
  • Fix #​1702: Gson.toJson creates CharSequence which does not implement toString (#​1703)
  • Prefer existing adapter for concurrent Gson.getAdapter calls (#​2153)
  • Improve ArrayTypeAdapter for Object[] (#​1716)
  • Improve AppendableWriter performance (#​1706)

v2.9.1

  • Make Object and JsonElement deserialization iterative rather than
    recursive (#​1912)
  • Added parsing support for enum that has overridden toString() method (#​1950)
  • Removed support for building Gson with Gradle (#​2081)
  • Removed obsolete codegen hierarchy (#​2099)
  • Add support for reflection access filter (#​1905)
  • Improve TypeToken creation validation (#​2072)
  • Add explicit support for float in JsonWriter (#​2130, #​2132)
  • Fail when parsing invalid local date (#​2134)

Also many small improvements to javadoc.

v2.9.0

The minimum supported Java version changes from 6 to 7.

  • Change target Java version to 7 (#​2043)
  • Put module-info.class into Multi-Release JAR folder (#​2013)
  • Improve error message when abstract class cannot be constructed (#​1814)
  • Support EnumMap deserialization (#​2071)
  • Add LazilyParsedNumber default adapter (#​2060)
  • Fix JsonReader.hasNext() returning true at end of document (#​2061)
  • Remove Gradle build support. Build script was outdated and not actively
    maintained anymore (#​2063)
  • Add GsonBuilder.disableJdkUnsafe() (#​1904)
  • Add UPPER_CASE_WITH_UNDERSCORES in FieldNamingPolicy (#​2024)
  • Fix failing to serialize Collection or Map with inaccessible constructor (#​1902)
  • Improve TreeTypeAdapter thread-safety (#​1976)
  • Fix Gson.newJsonWriter ignoring lenient and HTML-safe setting (#​1989)
  • Delete unused LinkedHashTreeMap (#​1992)
  • Make default adapters stricter; improve exception messages (#​2000)
  • Fix FieldNamingPolicy.upperCaseFirstLetter uppercasing non-letter (#​2004)
googleapis/google-api-java-client (com.google.api-client:google-api-client)

v2.9.0

Compare Source

Features
Bug Fixes
  • sec: Warn users of unsafe credential generation methods (#​2604) (d4c0a33)
  • Use Cloud RAD in deprecation link in GoogleCredential class (#​2606) (f238d59)

v2.8.1

Compare Source

Bug Fixes

v2.8.0

Compare Source

Features
Bug Fixes

v2.7.2

Compare Source

Bug Fixes
  • Add warnings to users about using credentials from external sources (#​2551) (3bb2879)

v2.7.1

Compare Source

Bug Fixes
  • deps: Update dependency com.google.api-client:google-api-client to v2.7.0 (#​2475) (2fdd3e1)
  • deps: Update dependency com.google.appengine:appengine-api-1.0-sdk to v2.0.31 (#​2526) (06d17a7)
  • deps: Update dependency com.google.auth:google-auth-library-bom to v1.30.0 (#​2521) (0a9461b)
  • deps: Update dependency com.google.cloud:libraries-bom to v26.51.0 (#​2491) (b8a3d13)
  • deps: Update dependency commons-codec:commons-codec to v1.17.1 (#​2527) (e797532)
  • deps: Update dependency org.apache.httpcomponents.client5:httpclient5 to v5.4.1 (#​2534) (9eaf3a8)
  • **dep

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 4 times, most recently from 6c5b8b9 to 8a2c74d Compare August 13, 2024 09:00
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 3 times, most recently from 058924d to 09caa99 Compare August 22, 2024 07:52
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 3 times, most recently from 2d5a144 to 31da823 Compare August 29, 2024 07:48
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 3 times, most recently from 01a19a5 to 85826f8 Compare September 3, 2024 07:56
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 5 times, most recently from 30fcfd2 to 597786d Compare September 15, 2024 07:28
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 4 times, most recently from c57b187 to 6ac7e93 Compare September 25, 2024 06:16
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 6 times, most recently from 797d500 to 48fe0fc Compare October 3, 2024 06:15
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 2 times, most recently from b899192 to 84684c2 Compare October 5, 2024 06:06
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 5 times, most recently from cef2aa8 to c494ac0 Compare October 29, 2024 10:31
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 6 times, most recently from 44b07a8 to 6505759 Compare November 6, 2024 10:47
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 3 times, most recently from 0ce3121 to 4d0e981 Compare November 15, 2024 11:36
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 4 times, most recently from 656b356 to 1314049 Compare November 29, 2024 07:55
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 5 times, most recently from 7bcb4ec to a8f9499 Compare December 6, 2024 06:03
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 2 times, most recently from 1052b70 to 2c13a3e Compare December 11, 2024 07:34
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 4 times, most recently from afceb97 to 01b3399 Compare December 21, 2024 09:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants