Skip to content

Update Mend: high confidence minor and patch dependency updates #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update Mend: high confidence minor and patch dependency updates #2

wants to merge 1 commit into from

Conversation

@mend-for-github-com
Copy link

@mend-for-github-com mend-for-github-com bot commented Aug 7, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
org.apache.maven.plugins:maven-javadoc-plugin (source) 3.6.3 -> 3.12.0 age adoption passing confidence
org.apache.maven.plugins:maven-source-plugin (source) 3.3.0 -> 3.3.1 age adoption passing confidence
org.apache.maven.plugins:maven-gpg-plugin (source) 3.1.0 -> 3.2.8 age adoption passing confidence
org.jacoco:jacoco-maven-plugin (source) 0.8.7 -> 0.8.14 age adoption passing confidence
org.apache.maven.plugins:maven-compiler-plugin (source) 3.12.1 -> 3.14.1 age adoption passing confidence
org.skyscreamer:jsonassert 1.5.0 -> 1.5.3 age adoption passing confidence
net.minidev:json-smart (source) 2.5.0 -> 2.6.0 age adoption passing confidence
com.google.code.gson:gson 2.8.9 -> 2.13.2 age adoption passing confidence
org.mockito:mockito-core 5.10.0 -> 5.20.0 age adoption passing confidence
junit:junit (source) 4.13.1 -> 4.13.2 age adoption passing confidence
org.apache.httpcomponents:httpclient (source) 4.5.13 -> 4.5.14 age adoption passing confidence
com.jayway.jsonpath:json-path 2.9.0 -> 2.10.0 age adoption passing confidence
io.github.openfeign:feign-core 13.2.1 -> 13.6 age adoption passing confidence

Release Notes

jacoco/jacoco (org.jacoco:jacoco-maven-plugin)

v0.8.14: 0.8.14

Compare Source

New Features

  • JaCoCo now officially supports Java 25 (GitHub #​1950).
  • Experimental support for Java 26 class files (GitHub #​1870).
  • Branches added by the Kotlin compiler for default argument number 33 or higher are filtered out during generation of report (GitHub #​1655).
  • Part of bytecode generated by the Kotlin compiler for elvis operator that follows safe call operator is filtered out during generation of report (GitHub #​1814, #​1954).
  • Part of bytecode generated by the Kotlin compiler for more cases of chained safe call operators is filtered out during generation of report (GitHub #​1956).
  • Part of bytecode generated by the Kotlin compiler for invocations of suspendCoroutineUninterceptedOrReturn intrinsic is filtered out during generation of report (GitHub #​1929).
  • Part of bytecode generated by the Kotlin compiler for suspending lambdas with parameters is filtered out during generation of report (GitHub #​1945).
  • Part of bytecode generated by the Kotlin compiler for suspending functions and lambdas with suspension points that return inline value class is filtered out during generation of report (GitHub #​1871).
  • Part of bytecode generated by the Kotlin Compose compiler plugin for pausable composition is filtered out during generation of report (GitHub #​1911).
  • Methods generated by the Kotlin serialization compiler plugin are filtered out (GitHub #​1885, #​1970, #​1971).

Fixed bugs

  • Fixed handling of implicit else clause of when with String subject in Kotlin (GitHub #​1813, #​1940).
  • Fixed handling of implicit default clause of switch by String in Java when compiled by ECJ (GitHub #​1813, #​1940).
    Fixed handling of exceptions in chains of safe call operators in Kotlin (GitHub #​1819).

Non-functional Changes

  • JaCoCo now depends on ASM 9.9 (GitHub #​1965).

v0.8.13: 0.8.13

Compare Source

New Features

  • JaCoCo now officially supports Java 23 and Java 24 (GitHub #​1757, #​1631, #​1867).
  • Experimental support for Java 25 class files (GitHub #​1807).
  • Calculation of line coverage for Kotlin inline functions (GitHub #​1670).
  • Calculation of line coverage for Kotlin inline functions with reified type parameter (GitHub #​1670, #​1700).
  • Calculation of coverage for Kotlin JvmSynthetic functions (GitHub #​1700).
  • Part of bytecode generated by the Kotlin Compose compiler plugin is filtered out during generation of report (GitHub #​1616).
  • Part of bytecode generated by the Kotlin compiler for inline value classes is filtered out during generation of report (GitHub #​1475).
  • Part of bytecode generated by the Kotlin compiler for suspending lambdas without suspension points is filtered out during generation of report (GitHub #​1283).
  • Part of bytecode generated by the Kotlin compiler for when expressions and statements with nullable enum subject is filtered out during generation of report (GitHub #​1774).
  • Part of bytecode generated by the Kotlin compiler for when expressions and statements with nullable String subject is filtered out during generation of report (GitHub #​1769).
  • Part of bytecode generated by the Kotlin compiler for chains of safe call operators is filtered out during generation of report (GitHub #​1810, #​1818).
  • Method getEntries generated by the Kotlin compiler for enum classes is filtered out during generation of report (GitHub #​1625).
  • Methods generated by the Kotlin compiler for constructors and functions with JvmOverloads annotation are filtered out (GitHub #​1768).

Fixed bugs

  • Fixed interpretation of Kotlin SMAP (GitHub #​1525).
  • File extensions are preserved in HTML report in case of clashes of normalized file names (GitHub #​1660).

Non-functional Changes

  • JaCoCo build now uses Maven Wrapper and requires at least Maven 3.9.9 (GitHub #​1708, #​1707, #​1681).
  • JaCoCo now depends on ASM 9.8 (GitHub #​1862).
  • More context information when IllegalArgumentException occurs during reading of zip file (GitHub #​1833).

v0.8.12: 0.8.12

Compare Source

New Features

  • JaCoCo now officially supports Java 22 (GitHub #​1596).
  • Experimental support for Java 23 class files (GitHub #​1553).

Fixed bugs

  • Branches added by the Kotlin compiler for functions with default arguments and having more than 32 parameters are filtered out during generation of report (GitHub #​1556).
  • Branch added by the Kotlin compiler version 1.5.0 and above for reading from lateinit property is filtered out during generation of report (GitHub #​1568).

Non-functional Changes

  • JaCoCo now depends on ASM 9.7 (GitHub #​1600).

v0.8.11: 0.8.11

Compare Source

New Features

  • JaCoCo now officially supports Java 21 (GitHub #​1520).
  • Experimental support for Java 22 class files (GitHub #​1479).
  • Part of bytecode generated by the Java compilers for exhaustive switch expressions is filtered out during generation of report (GitHub #​1472).
  • Part of bytecode generated by the Java compilers for record patterns is filtered out during generation of report (GitHub #​1473).

Fixed bugs

  • Instrumentation should not cause VerifyError when the last local variable of method parameters is overridden in the method body to store a value of type long or double (GitHub #​893).
  • Restore exec file compatibility with versions from 0.7.5 to 0.8.8 in case of class files with zero line numbers (GitHub #​1492).

Non-functional Changes

  • jacoco-maven-plugin now requires at least Java 8 (GitHub #​1466, #​1468).
  • JaCoCo build now requires at least Maven 3.5.4 (GitHub #​1467).
  • Maven 3.9.2 should not produce warnings for jacoco-maven-plugin (GitHub #​1468).
  • JaCoCo build now requires JDK 17 (GitHub #​1482).
  • JaCoCo now depends on ASM 9.6 (GitHub #​1518).

v0.8.10: 0.8.10

Compare Source

Fixed bugs

  • Agent should not require configuration of permissions for SecurityManager outside of its codeBase (GitHub #​1425).

v0.8.9: 0.8.9

Compare Source

New Features

  • JaCoCo now officially supports Java 19 and 20 (GitHub #​1371, #​1386).
  • Experimental support for Java 21 class files (GitHub #​1386).
  • Add parameter to include the current project in the report-aggregate Maven goal (GitHub #​1007).
  • Component accessors generated by the Java compilers for records are filtered out during generation of report. Contributed by Tesla Zhang (GitHub #​1393).

Fixed bugs

  • Agent should not open java.lang package to unnamed module of the application class loader (GitHub #​1334).

Non-functional Changes

v0.8.8: 0.8.8

Compare Source

New Features

  • JaCoCo now officially supports Java 17 and 18 (GitHub #​1282, #​1198).
  • Experimental support for Java 19 class files (GitHub #​1264).
  • Part of bytecode generated by the Java compilers for assert statement is filtered out during generation of report (GitHub #​1196).
  • Branch added by the Kotlin compiler version 1.6.0 and above for "unsafe" cast operator is filtered out during generation of report (GitHub #​1266).
  • Improved support for multiple JaCoCo runtimes in the same VM (GitHub #​1057).

Fixed bugs

  • Fixed NullPointerException during filtering (GitHub #​1189).
  • Fix range for debug symbols of method parameters (GitHub #​1246).

Non-functional Changes

  • JaCoCo now depends on ASM 9.2 (GitHub #​1206).
  • Messages of exceptions occurring during analysis or instrumentation now include JaCoCo version (GitHub #​1217).
skyscreamer/JSONassert (org.skyscreamer:jsonassert)

v1.5.3

  • Revert Java release version from 21 to 8 due to breaking older compilers.

v1.5.2

v1.5.1

Going to try to catch up on some ancient PRs, mainly around security and cleanup. Starting with accepted PRs that
didn't get released yet. To be followed hopefully shortly with another release.

  • Added convenience methods for JSONObject comparison using a custom JSONComparator (thanks jakob-o@!)
  • Fix issue #​105: Issue when comparing JSONArray if any value is null (thanks suraj1291993@​!)
  • Fixes security vulnerability associated with older version of junit
netplex/json-smart-v2 (net.minidev:json-smart)

v2.6.0

Compare Source

What's Changed

New Contributors

Full Changelog: netplex/json-smart-v2@2.5.2...v2.6.0

v2.5.2

Compare Source

About CVE-2024-57699

Thanks for @​ccudennec-otto Some remarks on the CVE, more discussions in #​236

  • as mentioned here it is quite unlikely that the vulnerability is exploited if you come here because of Spring Security / com.nimbusds:oauth2-oidc-sdk
  • the code changes for the upcoming release will "only" fix the default modes provided by JSONParser, e.g. MODE_RFC4627
  • if you create the JSONParser manually / with custom options, make sure you set option LIMIT_JSON_DEPTH
    • since that's what "connect2id" is doing in their library, they were responsible for fixing it. They've already provided a new 11.x release that fixes the JSONParser setup on their side, i.e. you rather need their fixed version and not version 2.5.2 of json-smart
    • as stated here, they would also need to backport the fix to the versions that Spring Security needs IMHO

What's Changed

New Contributors

Full Changelog: netplex/json-smart-v2@2.5.1...2.5.2

v2.5.1: V 2.5.1

Compare Source

What's Changed

New Contributors

Full Changelog: netplex/json-smart-v2@2.5.0...2.5.1

google/gson (com.google.code.gson:gson)

v2.10

  • Support for serializing and deserializing Java records, on Java ≥ 16. (#​2201)
  • Add JsonArray.asList and JsonObject.asMap view methods (#​2225)
  • Fix TypeAdapterRuntimeTypeWrapper not detecting reflective TreeTypeAdapter and FutureTypeAdapter (#​1787)
  • Improve JsonReader.skipValue() (#​2062)
  • Perform numeric conversion for primitive numeric type adapters (#​2158)
  • Add Gson.fromJson(..., TypeToken) overloads (#​1700)
  • Fix changes to GsonBuilder affecting existing Gson instances (#​1815)
  • Make JsonElement conversion methods more consistent and fix javadoc (#​2178)
  • Throw UnsupportedOperationException when JsonWriter.jsonValue is not supported (#​1651)
  • Disallow JsonObject Entry.setValue(null) (#​2167)
  • Fix TypeAdapter.toJson throwing AssertionError for custom IOException (#​2172)
  • Convert null to JsonNull for JsonArray.set (#​2170)
  • Fixed nullSafe usage. (#​1555)
  • Validate TypeToken.getParameterized arguments (#​2166)
  • Fix #​1702: Gson.toJson creates CharSequence which does not implement toString (#​1703)
  • Prefer existing adapter for concurrent Gson.getAdapter calls (#​2153)
  • Improve ArrayTypeAdapter for Object[] (#​1716)
  • Improve AppendableWriter performance (#​1706)

v2.9.1

  • Make Object and JsonElement deserialization iterative rather than
    recursive (#​1912)
  • Added parsing support for enum that has overridden toString() method (#​1950)
  • Removed support for building Gson with Gradle (#​2081)
  • Removed obsolete codegen hierarchy (#​2099)
  • Add support for reflection access filter (#​1905)
  • Improve TypeToken creation validation (#​2072)
  • Add explicit support for float in JsonWriter (#​2130, #​2132)
  • Fail when parsing invalid local date (#​2134)

Also many small improvements to javadoc.

v2.9.0

The minimum supported Java version changes from 6 to 7.

  • Change target Java version to 7 (#​2043)
  • Put module-info.class into Multi-Release JAR folder (#​2013)
  • Improve error message when abstract class cannot be constructed (#​1814)
  • Support EnumMap deserialization (#​2071)
  • Add LazilyParsedNumber default adapter (#​2060)
  • Fix JsonReader.hasNext() returning true at end of document (#​2061)
  • Remove Gradle build support. Build script was outdated and not actively
    maintained anymore (#​2063)
  • Add GsonBuilder.disableJdkUnsafe() (#​1904)
  • Add UPPER_CASE_WITH_UNDERSCORES in FieldNamingPolicy (#​2024)
  • Fix failing to serialize Collection or Map with inaccessible constructor (#​1902)
  • Improve TreeTypeAdapter thread-safety (#​1976)
  • Fix Gson.newJsonWriter ignoring lenient and HTML-safe setting (#​1989)
  • Delete unused LinkedHashTreeMap (#​1992)
  • Make default adapters stricter; improve exception messages (#​2000)
  • Fix FieldNamingPolicy.upperCaseFirstLetter uppercasing non-letter (#​2004)
mockito/mockito (org.mockito:mockito-core)

v5.20.0

Compare Source

Changelog generated by Shipkit Changelog Gradle Plugin

5.20.0
  • 2025-09-20 - 11 commit(s) by Adrian-Kim, Giulio Longfils, Rafael Winterhalter, dependabot[bot]
  • Bump org.assertj:assertj-core from 3.27.4 to 3.27.5 (#​3730)
  • Introducing the Ability to Mock Construction of Generic Types (#​2401) (#​3729)
  • Bump com.gradle.develocity from 4.1.1 to 4.2 (#​3726)
  • Bump graalvm/setup-graalvm from 1.3.6 to 1.3.7 (#​3725)
  • Bump org.eclipse.platform:org.eclipse.osgi from 3.23.100 to 3.23.200 (#​3720)
  • Bump graalvm/setup-graalvm from 1.3.5 to 1.3.6 (#​3719)
  • Bump actions/setup-java from 4 to 5 (#​3715)
  • Bump com.gradle.develocity from 4.1 to 4.1.1 (#​3713)
  • Bump bytebuddy from 1.17.6 to 1.17.7 (#​3712)
  • test: Use Assume.assumeThat for SequencedCollection tests (#​3711)
  • Fix #​3709 (#​3710)
  • feat: Add support for JDK21 Sequenced Collections. (#​3708)
  • Introducing the Ability to Mock Construction of Generic Types (#​2401)

v5.19.0

[Compare Source](https://redirect.github.com/mockito/mock

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 4 times, most recently from 6c5b8b9 to 8a2c74d Compare August 13, 2024 09:00
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 3 times, most recently from 058924d to 09caa99 Compare August 22, 2024 07:52
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 3 times, most recently from 2d5a144 to 31da823 Compare August 29, 2024 07:48
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 3 times, most recently from 01a19a5 to 85826f8 Compare September 3, 2024 07:56
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 5 times, most recently from 30fcfd2 to 597786d Compare September 15, 2024 07:28
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 4 times, most recently from c57b187 to 6ac7e93 Compare September 25, 2024 06:16
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 6 times, most recently from 797d500 to 48fe0fc Compare October 3, 2024 06:15
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 2 times, most recently from b899192 to 84684c2 Compare October 5, 2024 06:06
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 5 times, most recently from a3281c9 to dfe4fe0 Compare October 3, 2025 16:13
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 4 times, most recently from a594dee to 2f5ef93 Compare October 9, 2025 04:46
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch from 2f5ef93 to 2906113 Compare October 13, 2025 03:44
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 5 times, most recently from ab00464 to c543255 Compare October 27, 2025 22:08
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 4 times, most recently from 90240d1 to e6fef1e Compare November 4, 2025 11:03
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 6 times, most recently from d5fdb73 to 2529f6b Compare November 11, 2025 19:16
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 3 times, most recently from 65bb76d to 2210fff Compare November 15, 2025 17:57
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch from 2210fff to 530292f Compare November 17, 2025 09:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant