[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
com.google.cloud.tools:jib-maven-plugin	3.5.1 → 3.5.2
org.apache.maven.plugins:maven-surefire-plugin (source)	3.5.6 → 3.6.0
org.apache.maven.plugins:maven-compiler-plugin (source)	3.15.0 → 3.16.0
com.google.guava:guava	33.6.0-jre → 33.7.2-jre
org.apache.commons:commons-lang3 (source)	3.20.0 → 3.21.0
org.entur:siri-java-model	2.0.6 → 2.0.9
com.fasterxml.jackson.dataformat:jackson-dataformat-xml	2.22.0 → 2.22.4
io.rest-assured:xml-path (source)	6.0.0 → 6.2.0
io.rest-assured:json-path (source)	6.0.0 → 6.2.0
io.rest-assured:rest-assured-common (source)	6.0.0 → 6.2.0
io.rest-assured:rest-assured (source)	6.0.0 → 6.2.0
io.confluent:kafka-streams-avro-serde (source)	7.9.5 → 7.9.10
io.confluent:kafka-schema-registry-client (source)	7.9.5 → 7.9.10
io.confluent:kafka-avro-serializer (source)	7.9.5 → 7.9.10
org.apache.avro:avro-maven-plugin (source)	1.12.1 → 1.12.2
org.apache.avro:avro (source)	1.12.1 → 1.12.2
org.apache.camel:camel-test-spring-junit5 (source)	4.20.0 → 4.23.0
org.apache.camel:camel-test-junit5 (source)	4.20.0 → 4.23.0
org.apache.camel.springboot:camel-spring-boot-bom (source)	4.20.0 → 4.23.0
org.springframework.boot:spring-boot-dependencies (source)	4.1.0 → 4.1.1
org.springframework.boot:spring-boot-maven-plugin (source)	4.1.0 → 4.1.1
org.entur.ror:superpom (source)	7.0.0 → 7.1.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

entur/siri-java-model (org.entur:siri-java-model)

v2.0.9

Compare Source

v2.0.8

Compare Source

v2.0.7

Compare Source

rest-assured/rest-assured (io.rest-assured:xml-path)

v6.2.0

• Fix spring-web-test-client-kotlin-extensions bringing jakarta.servlet-api, jakarta.jakartaee-web-api and about 20 other Jakarta EE API jars to your classpath at runtime. They were declared with a scope that Maven doesn't know (optional), which it treated as a compile dependency, and are now provided, like in spring-mock-mvc-kotlin-extensions (#​1992)
• Upgraded scala-library in scala-support from 2.13.0 to 2.13.18, which fixes CVE-2022-36944, scala3-library_3 in scala-extensions from 3.3.3 to 3.3.8, Jackson 2 (jackson-databind, jackson-core and jackson-module-kotlin) from 2.17.1 to 2.22.3, Jackson 3 (tools.jackson) from 3.0.2 to 3.2.3, Gson from 2.9.0 to 2.14.0, Guava in json-schema-validator from 33.2.1-jre to 33.7.2-jre, commons-lang3 from 3.19.0 to 3.21.0, Yasson from 3.0.4 to 3.0.5 (now with its new group id org.eclipse.yasson, since org.eclipse:yasson 3.0.5 only relocates to it), Parsson from 1.1.7 to 1.1.9, Johnzon (johnzon-mapper) from 2.0.2 to 2.2.0 and jaxb-impl from 2.3.4 to 2.3.9 (#​1986)
• Non-backward compatible change: sending a request directly from a request specification created by RequestSpecBuilder.build() (for example spec.when().get("/x") or spec.post()) now fails with an IllegalStateException that tells you to use given().spec(spec) or given(spec), instead of a NullPointerException. then(), expect() and response() on such a specification also throw this exception, where they returned null before. The specification is meant to be added to a request, and isn't changed by the failed call. The javadoc of RequestSpecBuilder.build() now explains this (part of #​1863)
• Non-backward compatible change: sending a request directly from a response specification created by ResponseSpecBuilder.build() (for example responseSpec.when().get("/x")) now fails with an IllegalStateException that tells you to use given().spec(requestSpec).expect().spec(responseSpec), then().spec(responseSpec) or given(requestSpec, responseSpec), instead of a NullPointerException. when(), given(), with() and request() on such a specification also throw this exception, where they returned null before. Using the specification in a request, or as RestAssured.responseSpecification, works as before. The javadoc of ResponseSpecBuilder.build() now explains this (related to #​1863)
• JsonPath and JSON body assertions can now read a key that contains a colon with the dot notation, such as jsonPath.getInt("message.ErrorCode:") or body("message.ErrorCode:", equalTo(0)), which failed with "Invalid JSON expression" before. A colon in a ternary (a ? b : c) or Elvis (a ?: b) expression, in a closure or in a quoted string is left as is (fixes #​1766)
• Fix request logging of a multipart File whose mime type isn't text, such as application/octet-stream (the default) or image/png, which since 5.5.0 printed the whole file content to the log. Such a part is now logged as the path of the file, as before 5.5.0. The content of a file with a text mime type (text/*, JSON, XML or HTML) is still logged, and is now read with the charset of the part (or of its mime type), or UTF-8 if none is given, instead of the platform default charset. A text file that can't be read is logged as its path, so sending the request reports the error (fixes #​1819)
• Upgraded Groovy from 5.0.3 to 5.0.8 and Apache HttpClient (httpclient and httpmime) from 4.5.13 to 4.5.14 (#​1971)
• Fix races in the static configuration of REST Assured when tests run in parallel. RestAssured.filters(..), replaceFiltersWith(..), registerParser(..) and unregisterParser(..), and RestAssuredMockMvc.resultHandlers(..) and postProcessors(..), could make a given() in another thread fail with a ConcurrentModificationException or copy a default filter list with missing or null filters. given() (and when(), with(), expect() and the static request methods) no longer changes any shared state. The public static fields of RestAssured, RestAssuredMockMvc and RestAssuredWebTestClient, and JsonPath.config, XmlPath.config and JsonSchemaValidator.settings, are now volatile, so a value set before the tests start is seen by every thread. The javadoc of RestAssured, RestAssuredMockMvc and RestAssuredWebTestClient now explains how to use the static configuration when tests run in parallel (fixes #​1967)
• Non-backward compatible change: given() no longer writes the session id into the RestAssured.config field or RestAssured.defaultParser into the global parser registry. While RestAssured.sessionId is set, RestAssured.config() returns the config with the session id, but the RestAssured.config field doesn't contain it, also not after a request, so given().config(RestAssured.config) no longer sends the static session id (use RestAssured.config() instead). Setting RestAssured.sessionId or RestAssured.defaultParser back to null now takes effect without RestAssured.reset(). A list returned by RestAssured.filters() before replaceFiltersWith(..) keeps showing the old filters (fixes #​1967)
• Fix HttpClientConfig.reuseHttpClientInstance() creating more than one HttpClient when several threads send their first request at the same time, and make the default Yasson (JSON-B) object mapper share one Jsonb instance between threads in the same way. Note that the reused HttpClient is reconfigured by every request, so it still must not be used by requests that run at the same time (fixes #​1967)
• Non-backward compatible change: auth().certificate(certURL, password) and RestAssured.certificate(certURL, password), with or without CertificateAuthSettings, now use the file at certURL as key store, as documented, so the client certificate in it is sent to servers that ask for one (mutual TLS). Before, the file was only used as trust store, which it still is. This means that a private key in the file is now offered to any server that asks for a client certificate, also where it's optional (such as nginx with ssl_verify_client optional), which may then reject a certificate it doesn't trust, and that the private key must have the password of the file. To avoid this, or to use the JVM's default trust store, use RestAssured.certificate(trustStorePath, trustStorePassword, keyStorePath, keyStorePassword, CertificateAuthSettings) (as RestAssured.authentication or with RequestSpecBuilder.setAuth(..)), where an empty path means no key store or the default trust store (fixes #​1158, related to #​1325)
• Fix a root path with more than one placeholder left for a later withArgs(..), such as rootPath("a.%s.%s.%s", withArgs("x")).body(withArgs("y", "z"), ..), which failed with a MissingFormatArgumentException. All placeholders without an argument, including ones such as %d, are now kept for later arguments. body(withArgs(..), matcher) also no longer adds a trailing dot to the path, which showed up in failure messages such as "JSON path a.d.e. doesn't match." (fixes #​1949)
• The rest-assured module is now written entirely in Java and no longer depends on Groovy (org.apache.groovy:groovy and groovy-xml) directly. Groovy still comes transitively through json-path and xml-path, which use it for GPath, so the dependencies on the classpath are unchanged. The rest-assured and rest-assured-common OSGi bundles no longer import the groovy packages, and rest-assured-common no longer depends on Groovy at all (#​1917, #​1932)
• Non-backward compatible change: a Groovy closure used as request body now fails with an IllegalArgumentException. This could only happen when a custom ObjectMapper returned a Closure from serialize(..), in which case the closure was run as a builder (a JsonBuilder for JSON, a StreamingMarkupBuilder for XML and HTML, or with a Writer or OutputStream for text and binary content). Return a String, byte[] or InputStream from the ObjectMapper instead (#​1914)
• Non-backward compatible change: a request body that isn't a String (for example a byte[], InputStream or File) sent with content-type application/x-www-form-urlencoded now fails with an IllegalArgumentException explaining that a form url-encoded body must be a String, instead of a groovy.lang.MissingMethodException (#​1914)
• Non-backward compatible change: a groovy.lang.Writable request body sent with a text content-type is now sent as its toString() instead of what its writeTo(..) method writes. Groovy's own Writables (such as JsonBuilder and GString) produce the same output either way. A Groovy WritableFile (file.asWritable()) is now sent like any other File, read with the charset of the request content-type (#​1914)
• Fix the failure message of a body path assertion when the response body can't be parsed into something the path can navigate (for example a JSON body that is just a string), which showed the literal text $contentParser instead of the response body (#​1922)
• Fix form authentication failing with "IllegalArgumentException: parameterValues cannot be null" when an additional input field given to FormAuthConfig.withAdditionalField(s)(..) is an input tag without a value attribute on the login page. The field is now sent as a form parameter without a value (#​1921)
• Fix matchesDtd(URL) in RestAssuredMatchers, RestAssuredMockMvcMatchers and RestAssuredWebTestClientMatchers, which always failed with a GroovyCastException ("Cannot cast object '' with class 'java.lang.String' to class 'java.io.InputStream'") when the response was validated. The DTD is now read from the URL, every time the matcher is used (#​1920)
• Non-backward compatible change: matchesXsdInClasspath(..) and matchesDtdInClasspath(..) (in RestAssuredMatchers, RestAssuredMockMvcMatchers and RestAssuredWebTestClientMatchers) now fail with an IllegalArgumentException saying that the XSD or DTD couldn't be found in classpath, instead of a groovy.lang.GroovyRuntimeException ("Ambiguous method overloading"). The XSD and DTD matchers now also fail with an IllegalArgumentException when asked to match something that isn't a String, for example body("some.path", matchesXsd(..)) where the path returns an element that has child elements, instead of a Groovy exception (#​1920)
• Non-backward compatible change: io.restassured.assertion.HeaderMatcher, DetailedCookieAssertion, ResponseTimeMatcher and StreamVerifier are now written in Java and no longer implement groovy.lang.GroovyObject. HeaderMatcher.validateHeader(..), DetailedCookieAssertion.validateCookies(..) and ResponseTimeMatcher.validate(..) now return Map<String, Object> instead of Object, HeaderMatcher.validateHeader(..) takes a Response, and HeaderMatcher.getMatcher() and get/setResponseAwareMatcher(..) are now generically typed (Matcher<?> and ResponseAwareMatcher) (#​1919)
• A header expectation whose header name is neither a String nor a GString (for example an Integer key in the map passed to headers(Map)) now checks the header named by the key's string form instead of failing with a groovy.lang.MissingMethodException (#​1919)
• Non-backward compatible change: io.restassured.internal.http.HTTPBuilder, which a custom AuthenticationScheme receives in authenticate(..), no longer uses Groovy closures. Its get(..) methods, the request(..) overloads that took a Closure, getHandler() and the post(..) and patch(..) overloads without a response handler are removed. post(..), patch(..) and request(..) now take an HttpResponseHandler or a RequestConfigurer, and response handlers always take two arguments (the response and its parsed content) (#​1923)
• A parameter name that is neither a String nor a GString (for example an Integer key in the map passed to params(Map), queryParams(Map), formParams(Map) or pathParams(Map)) is now used in its string form, so 1 becomes "1", instead of failing with a groovy.lang.MissingMethodException (#​1927)
• Non-backward compatible change: io.restassured.internal.RestAssuredResponseOptionsGroovyImpl is removed and its logic now lives in RestAssuredResponseOptionsImpl, so getGroovyResponse(), setGroovyResponse(..) and the protected groovyResponse field of RestAssuredResponseOptionsImpl are gone. This affects code that calls these methods or subclasses the internal response classes. A subclass that overrides a method such as asString() now also sees that override used by path(..), jsonPath(), as(..) and the other methods that read the body (#​1926)
• Fix asByteArray() on a response with body expectations whose body was replaced by an InputStream (for example by a filter using ResponseBuilder.clone(..).setBody(inputStream)), which failed with a groovy.lang.MissingMethodException (#​1926)
• Non-backward compatible change: the authentication schemes in io.restassured.authentication (BasicAuthScheme, CertAuthScheme, ExplicitNoAuthScheme, FormAuthScheme, NTLMAuthScheme, NoAuthScheme, OAuth2Scheme, OAuthScheme, PreemptiveBasicAuthScheme and PreemptiveOAuth2HeaderScheme), and the AuthenticationScheme interface are now written in Java, and the classes no longer implement groovy.lang.GroovyObject. Their constructors, getters and setters are unchanged. A custom AuthenticationScheme written in Java can now get the authentication configuration from HTTPBuilder.getAuth() (#​1925)
• Non-backward compatible change: io.restassured.internal.matcher.xml.XmlXsdMatcher (the return type of RestAssuredMatchers.matchesXsd(..)) and XmlDtdMatcher are now written in Java and no longer implement groovy.lang.GroovyObject (#​1920)
• A CertAuthScheme whose key store or trust store path (setPathToKeyStore(..) or setPathToTrustStore(..)) is neither a String nor a java.io.File now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#​1925)
• Fix FilterContext.send(..) for a request whose HTTP method has no method of its own in RequestSender, such as TRACE or a custom method given to request(..) (for example request("PURGE", "/x")). It failed with a groovy.lang.MissingMethodException and now sends the request. FilterContext.send(..) now always calls RequestSender.request(method, path) on the request sender it is given, instead of get(path), post(path) and so on (#​1929)
• Fix getResponseContentType() of the response specification that filters receive (FilterableResponseSpecification), which always failed with a StackOverflowError. It now returns the expected content type, the description of the expected content type matcher, or "/" when no content type is expected (#​1928)
• Non-backward compatible change: using a ResponseSpecification that wasn't created by REST Assured, with spec(..) or specification(..) on a response specification or as RestAssured.responseSpecification, now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#​1928)
• A body expectation path that is neither a String nor a GString (for example an Integer key among the additional key/matcher pairs of body(..)) is now used in its string form instead of failing with a groovy.lang.MissingMethodException. A list given as path, or as path arguments to body(..), rootPath(..), root(..) or appendRootPath(..), whose elements aren't all io.restassured.specification.Argument (as created by withArgs(..)) now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#​1928)
• Fix cookies(Map) and cookies(String, Object, Object...) on a request specification, which failed with a groovy.lang.GroovyRuntimeException ("Could not find matching constructor for: io.restassured.http.Cookie$Builder(String, Integer)") when a cookie value wasn't a String, for example an Integer. Such a value is now converted the same way as a value given to cookie(String, Object, Object...), so 1 becomes "1" (#​1930)
• Fix keyStore(KeyStore) on a request specification and RequestSpecBuilder.setKeyStore(KeyStore), which always failed with a groovy.lang.MissingMethodException. SSLConfig gets the keyStore(KeyStore) method that the documentation of keyStore(KeyStore) refers to. A password-protected key store needs its password set with SSLConfig.keyStore(String) on the same SSLConfig, for example config(config().sslConfig(sslConfig().keyStore(keyStore).keyStore("password"))). Calling config(..) after keyStore(KeyStore) replaces the config and drops the key store. relaxedHTTPSValidation() only uses a key store given by path, not a KeyStore object (#​1930)
• Fix multiPart(String, Object) with a String and no request content type, which failed with a groovy.lang.GroovyRuntimeException ("Ambiguous method overloading"). It now adds a text/plain part (#​1930)
• Non-backward compatible change: using a RequestSpecification that wasn't created by REST Assured with spec(..) or specification(..) on a request specification now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#​1930)
• A header or cookie name given to headers(..) or cookies(..) (as a map key or in the name/value varargs) that isn't a String (for example an Integer) is now used in its string form instead of failing with a groovy.lang.GroovyRuntimeException (#​1931)
• Fix merging a request specification that has unnamed path parameters, for example the request specification that a filter receives for get("/users/{id}", 1), with spec(..) or RequestSpecBuilder.addRequestSpecification(..). The resulting specification failed with a groovy.lang.MissingPropertyException when it was sent with unnamed path parameters, merged again, or asked for its URI or unnamed path parameters (for example getURI() or getUnnamedPathParamValues()). It now gets the unnamed path parameters of the specification it was merged with (#​1931)
• Fix form authentication failing with "IllegalArgumentException: Invalid number of path parameters" when the login page is fetched for a request with path parameters, for example given().auth().form("John", "Doe").get("/secured/{id}", 1). The login page is now also fetched at the right URL when the path or a path parameter contains characters that need URL encoding, such as a space or a non-ASCII character, which used to be URL encoded twice (fixes #​1940)
• Non-backward compatible change: form authentication now fails with an IllegalArgumentException that names the field when an additional input field given to FormAuthConfig.withAdditionalField(s)(..) isn't on the login page. Such a field used to be sent with the value "[]" (fixes #​1941)
• Fix form authentication not passing the session filter of the request on to the login request when the filter is a subclass of SessionFilter (for example new SessionFilter() {}), so the subclass didn't get the session id (fixes #​1941)
• Fix form authentication failing with a NullPointerException when the login form has no action attribute. Such a form is now posted to the path and query of the URL of the login page, like a browser does: the URL that the request for the login page was redirected to, or the CSRF token page (including the base path) when CSRF is enabled. As for any form action, it is posted to the host of the request (fixes #​1941)
• Non-backward compatible change: form authentication now posts a login form with an empty action (action="") to the URL of the login page, like a browser does, instead of to "/" (fixes #​1941)
• Fix form authentication URL encoding the path and query of a form action read from the login page twice, so for example a form with action "/login?r=a%20b" was posted to /login?r=a%2520b. A "+" in the query of such a form action is decoded as a space, as servlet containers do, an encoded "/", "?", "#", "{" or "}" in its path is kept encoded, and a fragment ("#..") is left out. A form action given to FormAuthConfig is still used as it is (#​1954)
• Non-backward compatible change: form authentication now resolves a relative form action read from the login page against the URL of the login page (or its ), like a browser does. An action without a leading slash used to be resolved against the root, so for example action="login" on the page /secured/page was posted to /login and is now posted to /secured/login (#​1954)
• Fix form authentication for an absolute form action read from the login page (for example action="http://localhost:8080/login"), which was appended as a path to the host of the request. Like any other form action, its path and query are now posted to the host of the request (#​1954)
• Form authentication now fails with a message saying that the Location header is missing when the request for the login page is redirected (302) without a Location header, instead of "IllegalArgumentException: path cannot be null" (fixes #​1941)
• Non-backward compatible change: a key store configured without a trust store (with keyStore(..) on a request specification, RequestSpecBuilder, RestAssured or SSLConfig) is now used, so REST Assured offers its client certificate to a server that asks for one. Previously the key store was loaded but ignored unless a trust store was configured too, so a server that requires a client certificate rejected the connection. How the server certificate is validated is unchanged (the JVM's default trust when no trust store is configured). A server that only requests a client certificate (for example nginx with "ssl_verify_client optional") and doesn't trust it now rejects a connection that used to work. A key store whose private key can't be read with the key store password now fails the request instead of being ignored, and a key store given as a KeyStore without a password, whose private key needs one, fails with an IllegalArgumentException that says how to set the password (fixes #​1942)
• When the SSL settings can't be applied to an http request that is redirected to https, the SSLException now ends with the message of the cause, for example a FileNotFoundException for a missing trust store, instead of "null" (fixes #​1942)
• Fix sending a String body or form parameters with noContentType(), which failed with an IllegalArgumentException ("Don't know how to encode ... as a byte stream") unless an expected response content type was set, or with a NullPointerException for form parameters in a PATCH request. The body is now sent as text in the default content charset (EncoderConfig#defaultContentCharset), so the encodeContentTypeAs("/", ContentType.TEXT) workaround is no longer needed (fixes #​1947)
• Non-backward compatible change: a request body sent with noContentType() no longer gets a Content-Type header. Previously a binary body (byte[], InputStream or File) got "Content-Type: /", and when an expected response content type was set (for example expect().contentType(ContentType.JSON)) that content type was sent as the request Content-Type (fixes #​1947)
• Non-backward compatible change: merging a request specification with spec(..), specification(..) or RequestSpecBuilder.addRequestSpecification(..) no longer resets values that the merged specification never set. The base URI, base path, port, authentication scheme, request body, proxy, HTTP method, path (together with its unnamed path parameters), whether url encoding is enabled, whether a Content-Type is allowed (noContentType()) and whether CSRF is disabled (disableCsrf()) now survive a merge, and are only overwritten when the merged specification sets them. Before, for example, given().auth().oauth2("token").spec(specWithOnlyAHeader) sent no Authorization header, and given().baseUri("http://host").port(8081).spec(specWithOnlyAHeader) fell back to RestAssured.baseURI and RestAssured.port. Values that the merged specification only got from the defaults (such as RestAssured.baseURI, RestAssured.port, RestAssured.authentication or RestAssured.requestSpecification) don't overwrite anything either. This also affects a plain given(), which merges RestAssured.requestSpecification: it now uses the current values of RestAssured.baseURI, RestAssured.port, RestAssured.basePath and RestAssured.urlEncodingEnabled instead of the values they had when RestAssured.requestSpecification was built, unless that specification set them itself. To remove the authentication with a merged specification, set it to none explicitly, for example with RequestSpecBuilder.setAuth(new ExplicitNoAuthScheme()) (fixes #​1939)
• Fix a request hanging forever when its path contains a "{" that is never closed, for example get("/x{b"), or when an unnamed path parameter value contains "{", for example get("/{a}", "{"). An unclosed "{" is now kept as literal text, and path parameter placeholders after it still work, so get("/x{b") goes to /x%7Bb and given().pathParam("a", "A").get("/x{b/{a}") goes to /x%7Bb/A (fixes #​1935)
• Fix a byte[] multi-part being sent empty the second time a request specification is used, for example when a specification built with RequestSpecBuilder.addMultiPart(..) is used for several requests, or when the same given() is sent twice. The content of a byte[] multi-part also stays a byte[] after the request is sent (as seen by getMultiPartParams() on a FilterableRequestSpecification), instead of being replaced by a ByteArrayInputStream (fixes #​1938)
• Fix matchesXsdInClasspath(..) and matchesDtdInClasspath(..) (in RestAssuredMatchers, RestAssuredMockMvcMatchers and RestAssuredWebTestClientMatchers) on a thread that has no context class loader, where they failed with a NullPointerException, or whose context class loader can't see the XSD or DTD (for example in some custom thread pools), where they failed with "Couldn't find the XSD/DTD in classpath". The XSD or DTD is now also looked up in the class loader that loaded REST Assured (fixes #​1937)
• Fix the XSD and DTD matchers (matchesXsd(..), matchesXsdInClasspath(..), matchesDtd(..) and matchesDtdInClasspath(..) in RestAssuredMatchers, RestAssuredMockMvcMatchers and RestAssuredWebTestClientMatchers) so that the same matcher can be used more than once, for example in a shared ResponseSpecification. Matchers created from a String, InputStream, Reader or a classpath resource, and matchesDtd(File), only worked the first time and then failed, for example with a SAXParseException ("Failed to read schema document 'null'") or an IOException ("Stream Closed"). An InputStream or Reader given to these matchers is now read and closed when the matcher is created, and matchesDtd(File) no longer keeps the file open until the matcher is used (fixes #​1936)
• Fix JsonPath, and JSON body expectations such as body("lotto.lottoId", equalTo(5)), failing with "java.lang.ClassNotFoundException: groovy.lang.Script" in an OSGi container, or whenever the thread context class loader can't see Groovy. JsonPath now falls back to Groovy's own class loader when the thread context class loader can't see Groovy (fixes #​1933)
• Non-backward compatible change: path(..) on a response with an HTML content type (for example get("/page.html").path("html.head.title") or then().extract().path(..)) now returns the value the path points to, like it does for JSON and XML responses and like body("html.head.title", ..) does. Previously it returned the XmlPath itself, so extracting the value to a String failed with a ClassCastException. Use htmlPath() to get an XmlPath for an HTML response (fixes #​1943)
• Fix sessionId() and getSessionId() on responses from spring-mock-mvc and spring-web-test-client, and on responses built with ResponseBuilder, which always failed with "IllegalArgumentException: name cannot be null". They now return the value of the cookie named by the configured session id name (JSESSIONID by default). Also fix header(name) and getHeader(name) on a response without headers (for example one built with ResponseBuilder without setting any headers), which failed with a NullPointerException and now return null (fixes #​1944)
• Fix a ResponseAwareMatcher in a static RestAssuredMockMvc.responseSpecification or RestAssuredWebTestClient.responseSpecification failing with a NullPointerException when it calls path(..) on the response, and ignoring the configured session id name in sessionId(). The response it gets now has the config of the request (fixes #​1944)
• Fix a multipart boundary given in the request content type that contains "=", for example contentType("multipart/form-data; boundary="a=b"") or a JavaMail-style boundary such as ----=_Part_0_123. Before, such a boundary was replaced by a random one, or cut short when it ended with "=" (for example abc==). The boundary is now used as given, and the content type of the request specification (and, for "+multipart" content types, the Content-Type header that is sent) no longer gets a second boundary parameter (fixes #​1948)
• Fix CsrfConfig.csrfMetaTagName(..), which also set the CSRF input field name to the meta tag name. A page with both a CSRF input field and a meta tag then had its input field ignored and the token from the meta tag was sent as a header instead. The input field name is now kept (fixes #​1945)
• Fix LogConfig.defaultStream(..), which always turned pretty printing back on, so logConfig().enablePrettyPrinting(false).defaultStream(..) logged pretty printed bodies. The pretty printing setting is now kept (fixes #​1946)
• Fix PATCH requests with form parameters or multipart content, which were sent without their query parameters. Query parameters given with queryParam(..), in the path (for example patch("/x?a=1")) or, for form parameters, with param(..) are now added to the request URI, like for PUT and DELETE (fixes #​1001)
• Non-backward compatible change: EncoderConfig.defaultCharsetForContentType(charset, contentType) now only sets the default charset of the given content type. It used to also change the default content charset (defaultContentCharset()), so the charset was used for every content type without a charset of its own. For example, after encoderConfig().defaultCharsetForContentType("UTF-16", ContentType.JSON) a plain text body was sent as "text/plain; charset=UTF-16" and is now sent as "text/plain; charset=ISO-8859-1". If you relied on this, also call defaultContentCharset(..) (fixes #​1962)
• Non-backward compatible change: DecoderConfig.defaultCharsetForContentType(charset, contentType) now only sets the default charset of the given content type. It used to also change the default content charset (defaultContentCharset()), so a response without a charset in its content-type was decoded with that charset even when its content type had no charset of its own. For example, after decoderConfig().defaultCharsetForContentType("UTF-16", ContentType.JSON) a text/plain response without a charset was decoded as UTF-16 and is now decoded with the default content charset. If you relied on this, also call defaultContentCharset(..) (fixes #​1962)

v6.1.0

• Strip sensitive headers (Authorization and Cookie) when a redirect crosses to a different host, so a token or session isn't leaked to the redirect target. This is on by default and can be turned off with RedirectConfig.stripSensitiveHeadersOnCrossHostRedirect(false) (#​1873). Thanks to the University of Sydney security research team (Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu) for the report.
• Fix JsonPath "properties" spread over a list of objects returning null when the first element lacks a "properties" key (e.g. a GeoJSON feature carrying only a geometry), a regression from the Groovy 5 migration (fixes #​1875) (thanks to HDPark95 for PR #​1878). Thanks to haskiindahouse for the report.
• Fix JsonPath returning null or Groovy meta-data for a nested "properties" navigation over a list of objects (e.g. items.properties.properties.x) on Groovy 5, because the list spread result was a plain list instead of the proxy list that carries the "properties" workaround forward (fixes #​1879) (thanks to kdelay for PR #​1880)
• Fix JsonPath returning -Infinity for finite negative JSON numbers whose magnitude exceeds Float.MAX_VALUE under the default FLOAT_AND_DOUBLE number configuration. The float/double selection compared the signed value against Float.MAX_VALUE, so any such negative number fell into the float branch and overflowed; it now compares the magnitude and promotes to double regardless of sign (fixes #​1874) (thanks to kdelay for PR #​1877). Thanks to haskiindahouse for the report.
• Decode JSON responses without an explicit charset as UTF-8 also when the content-type has parameters (e.g. "application/json; version=1") or is a "+json" type (e.g. "application/problem+json", "application/hal+json"). These used to fall back to the default content charset, which garbled non-ASCII characters in the body and in logged responses (related to #​1885)
• Fix MalformedURLException when a request URL has no slash before a query string that contains another URL, e.g. get("https://example.com?redirect=https://example.com/callback") (fixes #​1836) (thanks to renechoi for PR #​1881)
• Apply user-configured SSL settings (such as relaxed HTTPS validation, trust/key stores and certificate authentication) when an http request is redirected to https. Previously they were only applied if the original request used https, so the redirected request failed with "PKIX path building failed". For a request that starts as http the SSL settings are only applied when REST Assured's default http client factory is used, so an https scheme registered by a custom HttpClientConfig.httpClientFactory is kept (fixes #​790)
• Don't let request specific SSL settings (SSLConfig such as relaxed HTTPS validation, or certificate authentication) leak into later requests when the http client instance is reused (HttpClientConfig.reuseHttpClientInstance()). The client's original https scheme is restored after each request and https connections established with request specific SSL settings are no longer kept alive for reuse.
• json-schema-validator now supports JSON Schema draft-06, draft-07, 2019-09 and 2020-12 (e.g. const, if/then/else, propertyNames, prefixItems, $defs) using the networknt json-schema-validator (com.networknt:json-schema-validator 2.0.8, which is now a dependency of the module, together with slf4j-api). The draft is taken from the "$schema" keyword of the schema, so draft-03/draft-04 schemas are validated exactly as before. Schemas without "$schema" are still validated as draft-04 unless another version is configured, e.g. matchesJsonSchemaInClasspath("schema.json").using(JsonSchemaVersion.DRAFT_2020_12) or JsonSchemaValidatorSettings.schemaVersion(..). Note that: (1) schemas that already declared a draft-06+ "$schema" were previously validated with draft-04 semantics (newer keywords were ignored) and are now validated according to their declared draft, (2) a configured JsonSchemaFactory and checkedValidation only apply to draft-03/draft-04 schemas, (3) "format" is annotation-only (not validated) in 2019-09 and 2020-12, as required by those specifications (fixes #​1823)
• Add ResponseSpecBuilder.expectHeader(String, ResponseAwareMatcher) and ResponseSpecification.header(String, ResponseAwareMatcher), so a reusable response specification can match a header against a value taken from the response, e.g. expectHeader("Location", response -> endsWith("/users/" + response.path("id"))) (fixes #​1884) (thanks to seethinajayadileep for PR #​1887)
• java.time values (LocalDate, Instant, OffsetDateTime, Duration, ZoneId and so on) used as path, query or form parameters, headers or cookies are now sent as their ISO-8601 toString() instead of being run through the object mapper, which quoted them or failed without the JSR-310 module (fixes #​1781) (thanks to seethinajayadileep for PR #​1888)
• A value object used as a parameter, header or cookie value that the object mapper serializes to a plain JSON string (for example a record with a @​JsonValue accessor) is now sent without the surrounding JSON quotes (fixes #​1818)
• Add support for the HTTP QUERY method (a safe, idempotent method that carries a request body), e.g. given().body(..).when().query("/search"). Method.QUERY and query(..) overloads are added to RestAssured, RequestSender/RequestSpecification, RestAssuredMockMvc and RestAssuredWebTestClient (fixes #​1872)
• Fix path parameters in the Spring WebTestClient module: an unnamed path parameter that isn't a String, e.g. get("/posts/{id}", 42L), no longer fails with a ClassCastException and is serialized the same way as a named path parameter, and path parameter values are no longer encoded twice, so a value such as "John Doe" or "100%" reaches the server unchanged instead of as "John%20Doe" or "100%25" (fixes #​1824) (thanks to hantsy for PR #​1825)
• Fix failures when the default locale is Turkish (tr-TR), such as an exception for every response with status code 400 or above and OPTIONS requests sent from a filter or HTTP methods given in lower case, e.g. request("options", ..), not working, by using Locale.ROOT for internal upper and lower case conversions. Cookie.toString() now also formats the Expires attribute as "EEE, dd MMM yyyy HH:mm:ss zzz" in English instead of using the default locale's short date format (thanks to rdmrtn for PR #​1889)
• MultiPartSpecBuilder.charset(Charset) now rejects byte[] and InputStream content with an IllegalArgumentException, like charset(String) already did, instead of silently ignoring the charset (fixes #​1691) (thanks to seethinajayadileep for PR #​1886)
• Fix XmlPath and JsonPath not handling a hyphenated element or key name combined with a negative (from-the-end) list index, e.g. "root.some-list[-1]". XmlPath threw "The parameter ... was used but not defined" and JsonPath returned null (fixes #​1876) (thanks to kdelay for PR #​1882)
• Fix unnamed path parameters in the Spring MockMvc module not being serialized like named ones, so a value object such as a record with a @​JsonValue accessor passed by position, e.g. get("/users/{id}", new Id(42)), was sent as its toString() ("Id[42]") instead of its serialized value ("42"). Note that, as for named path parameters, any other object that isn't a simple value (number, string, boolean, enum, UUID, java.time value etc) passed by position is now serialized by the object mapper instead of using its toString(). In both the Spring MockMvc and WebTestClient modules this also works for multipart requests, since unnamed path parameters are serialized using the explicitly set content type, like named ones, and not the derived "multipart/form-data" (fixes #​1905)
• Fix query parameters in the Spring WebTestClient module not reaching the server as given: a value containing "+", "&", "=" or "{...}", e.g. queryParam("name", "a+b"), was received as "a b", truncated at "&" or failed as a missing URI variable. Query parameters, as well as params and form params that are added to the query string, are now strictly encoded (so reserved characters such as "!" or "," in a value are now sent percent-encoded), and a query parameter without a value, e.g. queryParam("flag"), is sent as "flag" instead of the name of an internal class (fixes #​1904)
• The charset given to MultiPartSpecBuilder.charset(..) is now sent in the Content-Type of a File multi-part (e.g. "text/plain; charset=UTF-8"). Previously it was silently ignored for File content and only applied to String content. Other parameters of the part mime-type (e.g. "application/xml; version=2") are now also kept when a charset is specified, instead of being dropped (fixes #​1903)
• Fix XmlPath and JsonPath not handling a list range with a negative end that is followed by more path, e.g. "root.some-list[0..-1].sub-el" or "list[-2..-1].x". The dots in the range were treated as path separators, so XmlPa

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Oslo)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud