prepare 6.0.2 release

.circleci/config.yml

@@ -18,11 +18,17 @@ workflows:
           requires:
             - build-linux
       - test-linux:
+          # current LTS version
           name: Java 17 - Linux - OpenJDK
           docker-image: cimg/openjdk:17.0
           with-coverage: true
           requires:
             - build-linux
+      - test-linux:
+          name: Java 19 - Linux - OpenJDK
+          docker-image: cimg/openjdk:19.0
+          requires:
+            - build-linux
       - packaging:
           requires:
             - build-linux

.ldrelease/config.yml

@@ -12,7 +12,7 @@ publications:
 
 jobs:
   - docker:
-      image: gradle:6.8.3-jdk11
+      image: gradle:7.6-jdk11
     template:
       name: gradle
 

.ldrelease/publish.sh

@@ -4,4 +4,9 @@ set -ue
 
 # Publish to Sonatype
 echo "Publishing to Sonatype"
-./gradlew publishToSonatype closeAndReleaseRepository || { echo "Gradle publish/release failed" >&2; exit 1; }
+if [[ -n "${LD_RELEASE_IS_PRERELEASE}" ]]; then
+  ./gradlew publishToSonatype || { echo "Gradle publish/release failed" >&2; exit 1; }	
+else
+  ./gradlew publishToSonatype closeAndReleaseRepository || { echo "Gradle publish/release failed" >&2; exit 1; }
+fi
+

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to the LaunchDarkly Java SDK will be documented in this file. This project adheres to [Semantic Versioning](http://semver.org).
 
+## [5.10.5] - 2023-01-04
+### Fixed:
+- Fixed vulnerability [CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471) which could allow arbitrary code execution if using `FileDataSource` with a YAML file. (Thanks, [antonmos](https://github.com/launchdarkly/java-server-sdk/pull/289)!)
+
 ## [6.0.1] - 2022-12-20
 ### Changed:
 - The internal implementation of the SSE client for streaming updates has been revised to use a single worker thread instead of two worker threads, reducing thread contention and memory usage.

build.gradle

@@ -150,7 +150,7 @@ libraries.test = [
     "junit:junit:4.12",
     "com.fasterxml.jackson.core:jackson-core:${versions.jackson}",
     "com.fasterxml.jackson.core:jackson-databind:${versions.jackson}",
-    "com.launchdarkly:test-helpers:1.3.0"
+    "com.launchdarkly:test-helpers:2.0.1"
 ]
 
 configurations {
@@ -173,6 +173,7 @@ dependencies {
 }
 
 checkstyle {
+    toolVersion = "9.3"
     configFile file("${project.rootDir}/config/checkstyle/checkstyle.xml")
 }
 

config/checkstyle/checkstyle.xml

@@ -10,7 +10,7 @@
     <module name="JavadocPackage"/>    
     <module name="TreeWalker">
         <module name="JavadocMethod">
-	        <property name="scope" value="public"/>
+	        <property name="accessModifiers" value="public"/>
     	</module>
 	    <module name="JavadocType">
 	        <property name="scope" value="public"/>

contract-tests/service/build.gradle

@@ -30,7 +30,7 @@ ext.versions = [
     "gson": "2.7",
     "logback": "1.1.3",
     "okhttp": "4.5.0",
-    "testHelpers": "1.1.0",
+    "testHelpers": "2.0.1",
     "launchdarklyJavaSdkCommon": project(":sdk").versions["launchdarklyJavaSdkCommon"]
 ]
 

contract-tests/service/src/main/java/sdktest/TestService.java

@@ -58,7 +58,7 @@ public BadRequestException(String message) {
     }
   }
 
-  public static void main(String[] args) {
+  public static void main(String[] args) throws Exception {
     // ((ch.qos.logback.classic.Logger)LoggerFactory.getLogger(org.slf4j.Logger.ROOT_LOGGER_NAME)).setLevel(
     //     Level.valueOf(config.logLevel.toUpperCase()));
 
@@ -75,6 +75,11 @@ public static void main(String[] args) {
     server.getRecorder().setEnabled(false); // don't accumulate a request log
 
     System.out.println("Listening on port " + PORT);
+
+    // need to explicitly sleep because HttpServer now starts as a daemon thread
+    while (true) {
+      Thread.sleep(1000);
+    }
   }
 
   private Status getStatus() {

gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,5 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-7.3.3-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-7.6-bin.zip
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists