chore(deps): update all dependencies #249
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.2.5->3.2.73.5.0->3.5.24.7.3->4.8.64.8.6.2->4.8.6.62.24->2.252.7.16->2.7.18Release Notes
spotbugs/spotbugs (com.github.spotbugs:spotbugs)
v4.8.6Compare Source
Fixed
IGNORED_PRIORITY(#2994)v4.8.5Compare Source
Fixed
SING_SINGLETON_GETTER_NOT_SYNCHRONIZEDwith eager instances (#2932)SE_BAD_FIELDfor record fields (#2935)v4.8.4Compare Source
Fixed
executionSuccessfulflag in SARIF report being set to false when bugs were found (#2116)exitSignalNametoexitCodeDescription(#2739)Added
MultipleInstantiationsOfSingletonsand introduced new bug types:SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTORis reported in case of a non-private constructor,SING_SINGLETON_IMPLEMENTS_CLONEABLEis reported in case of a class directly implementing theCloneableinterface,SING_SINGLETON_INDIRECTLY_IMPLEMENTS_CLONEABLEis reported when a class indirectly implements theCloneableinterface,SING_SINGLETON_IMPLEMENTS_CLONE_METHODis reported when a class does not implement theCloneableinterface, but has aclone()method,SING_SINGLETON_IMPLEMENTS_SERIALIZABLEis reported when a class directly or indirectly implements theSerializableinterface andSING_SINGLETON_GETTER_NOT_SYNCHRONIZEDis reported when the instance-getter method of the singleton class is not synchronized.(See SEI CERT MSC07-J)
FindOverridableMethodCalldetector with new bug type:MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT. It's reported when an overridable method is called fromreadObject(), according to SEI CERT rule SER09-J. Do not invoke overridable methods from the readObject() method.Changed
Build
v4.8.3Compare Source
Fixed
Changed
v4.8.2Compare Source
Fixed
Added
System.getenv()calls, where the corresponding Java property could be used (See ENV02-J).Build
v4.8.1Compare Source
Fixed
PA_PUBLIC_MUTABLE_OBJECT_ATTRIBUTEbug (#2652)Build
v4.8.0Compare Source
Changed
Fixed
RandomOnceSubDetectorto not report whendoubles,ints, orlongsare called on a newRandomorSecureRandom(#2370)TestASMthrowing error during analysis, because it doesn't note that it reports bugs.Added
classAnnotationNames). For example, use like in an excludeFilter.xml to ignore classes generated by the Immutable framework. This ignores all class, method or field bugs in classes with that annotation.FindAssertionsWithSideEffectsdetecting bugASSERTION_WITH_SIDE_EFFECTandASSERTION_WITH_SIDE_EFFECT_METHODin case of assertions which may have side effects (See EXP06-J. Expressions used in assertions must not produce side effects)PA_PUBLIC_PRIMITIVE_ATTRIBUTE,PA_PUBLIC_ARRAY_ATTRIBUTEandPA_PUBLIC_MUTABLE_OBJECT_ATTRIBUTEto warn for public attributes which are written by the methods of the class. This rule is loosely based on the SEI CERT rule OBJ01-J Limit accessibility of fields. (#OBJ01-J)SerializableIdiomdetector with new bug type:SE_PREVENT_EXT_OBJ_OVERWRITE. It's reported in case of thereadExternal()method allows any caller to reset any value of an objectFindVulnerableSecurityCheckMethodsfor new bug typeVSC_VULNERABLE_SECURITY_CHECK_METHODS. This bug is reported whenever a non-final and non-private method of a non-final class performs a security check using thejava.lang.SecurityManager. (See [SEI CERT MET03-J] (https://wiki.sei.cmu.edu/confluence/display/java/MET03-J.+Methods+that+perform+a+security+check+must+be+declared+private+or+final))SynchronizationOnSharedBuiltinConstantto detectDL_SYNCHRONIZATION_ON_INTERNED_STRING(#2266)FindArgumentAssertionsdetecting bugASSERTION_OF_ARGUMENTSin case of validation of arguments of public functions using assertions (See MET01-J. Never use assertions to validate method arguments)CT_CONSTRUCTOR_THROWfor detecting constructors that throw exceptions.DontReusePublicIdentifiersfor new bug typePI_DO_NOT_REUSE_PUBLIC_IDENTIFIERS. This bug is reported whenever a new class, interface, field, method or variable is created reusing an identifier from the Java Standard Library . (See SEI CERT rule DCL01-J)Security
Build
spotify/fmt-maven-plugin (com.spotify.fmt:fmt-maven-plugin)
v2.25Compare Source
What's Changed
Full Changelog: spotify/fmt-maven-plugin@2.24...2.25
spring-projects/spring-boot (org.springframework.boot:spring-boot-starter-parent)
v2.7.18Compare Source
bootBuildImage(Gradle) andspring-boot:build-image(Maven) has been changed to Paketo Jammy #38477🐞 Bug Fixes
📔 Documentation
classpath.idxfile and its generation by the Maven and Gradle plugins #37125@TestConfigurationclass in a test #30513@AutoConfigureWebTestClientbinds WebTestClient to mock infrastructure #29890spring.hateoas.use-hal-as-default-json-media-typetofalse#26814🔨 Dependency Upgrades
❤️ Contributors
Thank you to all the contributors who worked on this release:
@GVictorG7, @PENEKhun, @dreis2211, and @izeye
v2.7.17Compare Source
spring.jms.listener.concurrencyhas been corrected to match the documentation (#37180). If you were settingspring.jms.listener.concurrencywithout also settingspring.jms.listener.max-concurrency, please review your configuration when upgrading.🐞 Bug Fixes
@Orderdoes not work on (CommandLine|Application)Runner@Beanmethods #37905@ComponentScanon a test class is processed when creating a test context but is not included in the context's cache key #31577📔 Documentation
🔨 Dependency Upgrades
❤️ Contributors
Thank you to all the contributors who worked on this release:
@bottlerocketjonny, @dependabot[bot], @erichaagdev, @esperar, @izeye, @jbertram, @nielsbasjes, @onobc, @ttddyy, and @vpavic
Configuration
📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.