Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Bump the all-minor-patch group across 1 directory with 3 updates #666

Closed

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 17, 2025

Bumps the all-minor-patch group with 3 updates in the / directory: com.github.erosb:everit-json-schema, net.minidev:json-smart and org.springframework:spring-core.

Updates com.github.erosb:everit-json-schema from 1.14.4 to 1.14.5

Commits

Updates net.minidev:json-smart from 2.5.1 to 2.5.2

Release notes

Sourced from net.minidev:json-smart's releases.

2.5.2

About CVE-2024-57699

Thanks for @​ccudennec-otto Some remarks on the CVE, more discussions in #236

  • as mentioned here it is quite unlikely that the vulnerability is exploited if you come here because of Spring Security / com.nimbusds:oauth2-oidc-sdk
  • the code changes for the upcoming release will "only" fix the default modes provided by JSONParser, e.g. MODE_RFC4627
  • if you create the JSONParser manually / with custom options, make sure you set option LIMIT_JSON_DEPTH
    • since that's what "connect2id" is doing in their library, they were responsible for fixing it. They've already provided a new 11.x release that fixes the JSONParser setup on their side, i.e. you rather need their fixed version and not version 2.5.2 of json-smart
    • as stated here, they would also need to backport the fix to the versions that Spring Security needs IMHO

What's Changed

... (truncated)

Commits
  • d4f7fa4 migrate to s01.oss.sonatype.org
  • 9ca093d docs: mark v2.5.2 not released now
  • 55fa105 update maintainer github id and email (#234)
  • 7ecb1d3 bump to version 2.5.2.
  • 852caf6 Merge pull request #233 from ccudennec-otto/fix-CVE-2024-57699
  • d1f4645 Merge pull request #228 from netplex/dependabot/maven/json-smart/junit.versio...
  • 19a787e Merge pull request #230 from netplex/dependabot/maven/json-smart-action/junit...
  • f2be4c1 Merge pull request #229 from netplex/dependabot/maven/json-smart/org.apache.m...
  • 224943a Merge pull request #231 from netplex/dependabot/maven/json-smart-action/org.a...
  • c21d854 fix CVE-2024-57699 for predefined parsers
  • Additional commits viewable in compare view

Updates org.springframework:spring-core from 6.2.2 to 6.2.3

Release notes

Sourced from org.springframework:spring-core's releases.

v6.2.3

⭐ New Features

  • Add form fields to MockMvc Kotlin DSL #34412
  • Make ProblemDetail implement Serializable #34409
  • Support @MockitoSpyBean at the type level on test classes #34408
  • Expose order values of TestExecutionListener implementations as constants #34404
  • ContentDisposition should match attributes in a case-insensitive fashion #34383
  • Provide access to servletPath in ServletRequestPathUtils #34379
  • Use ConversionService to convert POJO to array for SpEL varargs invocations #34371
  • Provide a more actionable CGLIB error message with native #34370
  • Wrap disconnected client exceptions as AsyncRequestNotUsableException in Servlet container onError callback #34363
  • Support RFC 8441 WebSocket upgrade with HTTP/2 CONNECT #34362
  • Optimize default property editor allocations for bean instance creation #34361
  • Continue with pre-instantiation when current bean is in creation already #34349
  • Allow filtering bean instances returned by ObjectProvider#stream() #34318
  • GenericConversionService finds wrong converter for partially unresolvable generic types #34298
  • Avoid re-creating HandlerMethod unless handler is resolved through the BeanFactory #34277
  • UrlResource should leniently handle HTTP endpoints which do not support HEAD #34217
  • Add API counterpart for handling Fallback and 'defaultCandidate=false' beans #34203
  • Add support for multidimensional arrays #34183
  • Add getters to ServerResponseResultHandler #34066
  • Improve diagnostics when a Bean Override cannot be selected by type #34006
  • Expression performance regression due to missing annotation types on context classes #33948

🐞 Bug Fixes

  • PathMatchingResourcePatternResolver failing against non-jar file in classpath #34417
  • GenericTypeResolver Since 6.2.0, generics cannot be obtained correctly in multi-layer interface inheritance (possible regression of #24963) #34386
  • Test Bean Overrides honor fallback qualifier instead of @Primary semantics #34374
  • HTTP interface client raises IllegalArgumentException if query param name contains a colon #34364
  • Quartz-style Nth Day of Week cron expressions can overflow to other month #34360
  • Component scan fails to find jar entries in WEB-INF/classes with embedded Tomcat #34348
  • Check hasNext when when accessing sessionIds from UserDestinationResult #34333
  • Property binding to Map that implements Iterable no longer works #34332
  • GenericTypeResolver returns EmptyType #34328
  • Duplicate BeanOverrideHandler discovered in @Nested test class hierarchy when upgrading to Spring 6.2.2 #34324
  • AnnotationBeanNameGenerator issues warning about explicitly aliased value attribute #34317
  • Stop assuming that AspectJ Advice has JoinPoint as the first argument #34316
  • Constructor binding fails for simple types List/Map/Array and for nested container combinations #34305
  • Change in BeanFactoryUtils.beanNamesForTypeIncludingAncestors() Behavior in Spring Framework 6.2.x causing ClassCastExceptions #34300
  • Data binding does not filter HTTP headers for constructor binding #34292
  • Escaped character in nested placeholder not detected properly and leads to invalid parts #34289
  • ReflectJvmMapping.getKotlinFunction returns null for Kotlin properties #34284
  • ConfigurationClassEnhancer should explicitly set custom ClassLoader on CGLIB Enhancer (aligned with CglibAopProxy) #34274
  • Connection reset exception from RestTemplate call in Spring Web MVC controller is ignored #34264
  • AsyncExecution fails to detect the return type of an annotated method from an interface with a generic #33957
  • Ensure Locale context is available for WebFlux method validation #33810

📔 Documentation

... (truncated)

Commits
  • debd312 Release v6.2.3
  • a8be11e Upgrade to TestNG 7.11
  • dfc10c1 Wait for lenient bean creation in non-locked threads as well
  • bbb593d Consistently ignore non-jar files in classpath
  • b2134ee Avoid Gradle build warnings about @⁠SuppressFBWarnings from FindBugs
  • 440a259 Clean up warnings in Gradle build
  • 6174055 Link to @⁠MockitoBean, @⁠MockitoSpyBean, & @⁠TestBean Javadoc from ref docs
  • e31ce35 Support @⁠MockitoSpyBean at the type level on test classes
  • b336bbe Wait for lenient bean creation in locked thread when necessary
  • 056757b Refine tests in MockMvcExtensionsTests
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the all-minor-patch group with 3 updates in the / directory: [com.github.erosb:everit-json-schema](https://github.com/erosb/everit-json-schema), [net.minidev:json-smart](https://github.com/netplex/json-smart-v2) and [org.springframework:spring-core](https://github.com/spring-projects/spring-framework).


Updates `com.github.erosb:everit-json-schema` from 1.14.4 to 1.14.5
- [Commits](https://github.com/erosb/everit-json-schema/commits)

Updates `net.minidev:json-smart` from 2.5.1 to 2.5.2
- [Release notes](https://github.com/netplex/json-smart-v2/releases)
- [Commits](netplex/json-smart-v2@2.5.1...2.5.2)

Updates `org.springframework:spring-core` from 6.2.2 to 6.2.3
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v6.2.2...v6.2.3)

---
updated-dependencies:
- dependency-name: com.github.erosb:everit-json-schema
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-minor-patch
- dependency-name: net.minidev:json-smart
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-minor-patch
- dependency-name: org.springframework:spring-core
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Feb 17, 2025
Copy link
Contributor Author

dependabot bot commented on behalf of github Feb 24, 2025

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Feb 24, 2025
@dependabot dependabot bot deleted the dependabot/maven/all-minor-patch-cc4d497460 branch February 24, 2025 22:32
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
dependencies Pull requests that update a dependency file java Pull requests that update Java code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants