Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): bump org.http4k:http4k-core from 5.14.0.0 to 5.42.0.0 in /run/http4k-hello-world #1605

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 30, 2024

Bumps org.http4k:http4k-core from 5.14.0.0 to 5.42.0.0.

Release notes

Sourced from org.http4k:http4k-core's releases.

5.42.0.0

Changelog:

  • http4k-* : Upgrade some dependency versions.
  • http4k-template : Fix line separators for templates to allow working across platform with templates.
  • http4k-connect-amazon-iamidentitycenter* :[Fix 1239] CredentialsProvider.SSO - Credentials caching issue.
  • http4k-connect-amazon-iamidentitycenter* : [Unlikely break] PKCE-based Authorization for AWS SSO. Tweaks should be easy to remedy in previous SSO implementation. H/T @​aharin

5.41.0.0

Changelog:

  • http4k-format-xml : [Fix CVE-2024-55875: Possible Break] Fixed XML processing by disabling entity expansion in DocumentBuilderFactory configuration. Note: This change affects how XML entity references are handled. If your code relies on XML entity expansion (like replacing &entity; references with their defined content), it will need to be updated to provide the correct configuration when deserialising the XML body. Entity references will now remain as unexpanded text in the document.

Full details at: https://www.http4k.org/security/cve-2024-12345/ H/T to @@​JAckLosingHeart for the report

5.40.0.0

Changelog:

  • http4k-core : Allow invalidation of cookie with a path. H/T @​ollieabbey
  • http4k-core : Allow setting cookie value without quotes. H/T @​ollieabbey
  • http4k-core : Fix cookie format for cookie with no attributes. H/T @​ollieabbey
  • http4k-testing-webdriver : Remove usages of deprecated getAttribute API. Now use getDomAttribute instead.
  • http4k-cloudnative : Deprecation of various functions and re-homing into http4k-platform-k8s module.
  • http4k-* : [PRE RELEASE PREPARATION] As a part of the upcoming V6, several modules are being rehoused to new Maven coordinates. In preparation, we have introduced these modules to give users the time to migrate without taking on-board other breaking changes from v6 - essentially allowing the upgrade cycle to be:
  1. Upgrade to latest v5 release. Deal with deprecations and module changes.
  2. Upgrade to v6 when it is released. Deal with other breaking changes. We expect these to be mainly imports and will be detailed in the v6 release note when we have the chance. In the meantime, this is the list of modules that are being rehoused:
SOURCE MODULE - v5.X.X.X DESTINATION MODULE(S) - v6.X.X.X
http4k-aws http4k-platform-aws
http4k-azure http4k-platform-azure
http4k-cloudevents http4k-api-cloudevents
http4k-cloudnative Split into http4k-config, http4k-platform-core, http4k-platform-k8s
http4k-contract http4k-api-openapi
http4k-contract-jsonschema http4k-api-jsonschema
http4k-contract-ui-redoc http4k-api-ui-redoc
http4k-contract-ui-swagger http4k-api-ui-swagger
http4k-failsafe http4k-ops-failsafe
http4k-gcp http4k-platform-gcp
http4k-graphql http4k-api-graphql
http4k-htmx http4k-web-htmx
http4k-jsonrpc http4k-api-jsonrpc
http4k-metrics-micrometer http4k-ops-micrometer
http4k-opentelemetry http4k-ops-opentelemetry
http4k-resilience4j http4k-ops-resilience4j

5.39.0.0

Changelog:

... (truncated)

Changelog

Sourced from org.http4k:http4k-core's changelog.

v5.42.0.0

  • http4k-* : Upgrade some dependency versions.
  • http4k-template : Fix line separators for templates to allow working across platform with templates.
  • http4k-connect-amazon-iamidentitycenter* :[Fix 1239] CredentialsProvider.SSO - Credentials caching issue.
  • http4k-connect-amazon-iamidentitycenter* : [Unlikely break] PKCE-based Authorization for AWS SSO. Tweaks should be easy to remedy in previous SSO implementation. H/T @​aharin

v5.41.0.0

  • http4k-format-xml : [Fix CVE-2024-55875: Possible Break] Fixed XML processing by disabling entity expansion in DocumentBuilderFactory configuration. Note: This change affects how XML entity references are handled. If your code relies on XML entity expansion (like replacing &entity; references with their defined content), it will need to be updated to provide the correct configuration when deserialising the XML body. Entity references will now remain as unexpanded text in the document.

Full details at: https://www.http4k.org/security/cve-2024-12345/

H/T to @@​JAckLosingHeart for the report.

v5.40.0.0

  • http4k-core : Allow invalidation of cookie with a path. H/T @​ollieabbey
  • http4k-core : Allow setting cookie value without quotes. H/T @​ollieabbey
  • http4k-core : Fix cookie format for cookie with no attributes. H/T @​ollieabbey
  • http4k-testing-webdriver : Remove usages of deprecated getAttribute API. Now use getDomAttribute instead.
  • http4k-cloudnative : [Breaking] Deprecation of various functions and re-homing into http4k-platform-k8s module. Some classes and functions have been repackaged.
  • http4k-* : [PRE RELEASE PREPARATION] As a part of the upcoming V6, several modules are being rehoused to new Maven coordinates within http4k Community edition (and retaining the Apache2 license). In preparation, we have introduced these modules to give users the time to migrate without taking on-board other breaking changes from v6 - essentially allowing the upgrade cycle to be:
  1. Upgrade to latest v5 release. Deal with deprecations and module changes.
  2. Upgrade to v6 when it is released. Deal with other breaking changes. We expect these to be mainly imports and will be detailed in the v6 release note when we have the chance. In the meantime, this is the list of modules that are being rehoused:
SOURCE MODULE - v5.X.X.X DESTINATION MODULE(S) - v6.X.X.X
http4k-aws http4k-platform-aws
http4k-azure http4k-platform-azure
http4k-cloudevents http4k-api-cloudevents
http4k-cloudnative Split into http4k-config, http4k-platform-core, http4k-platform-k8s
http4k-contract http4k-api-openapi
http4k-contract-jsonschema http4k-api-jsonschema
http4k-contract-ui-redoc http4k-api-ui-redoc
http4k-contract-ui-swagger http4k-api-ui-swagger
http4k-failsafe http4k-ops-failsafe
http4k-gcp http4k-platform-gcp
http4k-graphql http4k-api-graphql
http4k-htmx http4k-web-htmx
http4k-jsonrpc http4k-api-jsonrpc
http4k-metrics-micrometer http4k-ops-micrometer
http4k-opentelemetry http4k-ops-opentelemetry
http4k-resilience4j http4k-ops-resilience4j

v5.39.0.0

  • http4k-* : Upgrade some dependency versions.
  • http4k-amazon-*-fake : [Unlikely break] Rename AmazonRestfulFake to AmazonRestJsonFake
  • http4k-amazon-evidently-fake : Fixed Project status value to be a valid value instead of an empty string

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [org.http4k:http4k-core](https://github.com/http4k/http4k) from 5.14.0.0 to 5.42.0.0.
- [Release notes](https://github.com/http4k/http4k/releases)
- [Changelog](https://github.com/http4k/http4k/blob/master/CHANGELOG.md)
- [Commits](http4k/http4k@5.14.0.0...5.42.0.0)

---
updated-dependencies:
- dependency-name: org.http4k:http4k-core
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Dec 30, 2024
Copy link
Contributor Author

dependabot bot commented on behalf of github Jan 6, 2025

Superseded by #1608.

@dependabot dependabot bot closed this Jan 6, 2025
@dependabot dependabot bot deleted the dependabot/gradle/run/http4k-hello-world/org.http4k-http4k-core-5.42.0.0 branch January 6, 2025 02:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file java Pull requests that update Java code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants