Bump the dependencies group with 11 updates

[dependabot]

Bumps the dependencies group with 11 updates:

Package	From	To
org.mockito:mockito-core	5.8.0	5.11.0
com.fasterxml.jackson.core:jackson-databind	2.16.1	2.17.0
com.fasterxml.jackson.core:jackson-annotations	2.16.1	2.17.0
com.fasterxml.jackson.core:jackson-core	2.16.1	2.17.0
com.fasterxml.jackson.datatype:jackson-datatype-jsr310	2.16.1	2.17.0
com.fasterxml.jackson.core:jackson-core	2.16.1	2.17.0
com.fasterxml.jackson.datatype:jackson-datatype-jsr310	2.16.1	2.17.0
io.jsonwebtoken:jjwt	0.12.3	0.12.5
org.slf4j:slf4j-api	2.0.11	2.0.12
ch.qos.logback:logback-classic	1.4.14	1.5.3
org.apache.maven.plugins:maven-compiler-plugin	3.12.1	3.13.0
org.owasp:dependency-check-maven	9.0.8	9.0.10
org.apache.maven.plugins:maven-gpg-plugin	3.1.0	3.2.2

Updates org.mockito:mockito-core from 5.8.0 to 5.11.0

Release notes

Sourced from org.mockito:mockito-core's releases.

v5.11.0

Changelog generated by Shipkit Changelog Gradle Plugin

5.11.0

• 2024-03-01 - 17 commit(s) by Aouichaoui Youssef, Franz Wong, Pranoti Durugkar, Róbert Papp, dependabot[bot]
• Fixes #3281 : Add native method to exception message of MissingMethodI… [(#3283)](mockito/mockito#3283)
• MissingMethodInvocationException is thrown when mocking native method in 5.x [(#3281)](mockito/mockito#3281)
• Bump com.google.googlejavaformat:google-java-format from 1.19.2 to 1.20.0 [(#3277)](mockito/mockito#3277)
• Bump versions.bytebuddy from 1.14.11 to 1.14.12 [(#3272)](mockito/mockito#3272)
• Bump gradle/wrapper-validation-action from 2.1.0 to 2.1.1 [(#3268)](mockito/mockito#3268)
• Bump org.shipkit:shipkit-auto-version from 2.0.3 to 2.0.4 [(#3267)](mockito/mockito#3267)
• Bump gradle/wrapper-validation-action from 2.0.1 to 2.1.0 [(#3266)](mockito/mockito#3266)
• Bump org.junit.platform:junit-platform-launcher from 1.10.1 to 1.10.2 [(#3265)](mockito/mockito#3265)
• Bump gradle/wrapper-validation-action from 2.0.0 to 2.0.1 [(#3264)](mockito/mockito#3264)
• Bump org.assertj:assertj-core from 3.25.2 to 3.25.3 [(#3261)](mockito/mockito#3261)
• Bump versions.junitJupiter from 5.10.1 to 5.10.2 [(#3260)](mockito/mockito#3260)
• Bump gradle/wrapper-validation-action from 1.1.0 to 2.0.0 [(#3258)](mockito/mockito#3258)
• Fixes #3229: Resolve test generic arguments [(#3257)](mockito/mockito#3257)
• Bump org.shipkit:shipkit-auto-version from 2.0.2 to 2.0.3 [(#3256)](mockito/mockito#3256)
• Use kvm on ubuntu instead of macos to run Android tests [(#3252)](mockito/mockito#3252)
• Fixes #3240 : Renamed mockito bom artifact [(#3251)](mockito/mockito#3251)
• Remove shipkit workaround for generateChangelog [(#3250)](mockito/mockito#3250)
• Bump com.gradle.enterprise from 3.16.1 to 3.16.2 [(#3249)](mockito/mockito#3249)
• Mockito bom missing artifact in maven central for java21 [(#3240)](mockito/mockito#3240)
• @Captor test parameters don't work with primitive type arguments [(#3229)](mockito/mockito#3229)
• Gradle 8.2: work around fix for release publishing [(#3053)](mockito/mockito#3053)

v5.10.0

Changelog generated by Shipkit Changelog Gradle Plugin

5.10.0

• 2024-01-24 - 8 commit(s) by Andre Brait, dependabot[bot]
• Bump org.shipkit:shipkit-auto-version from 1.2.2 to 2.0.2 [(#3248)](mockito/mockito#3248)
• Bump org.assertj:assertj-core from 3.25.1 to 3.25.2 [(#3247)](mockito/mockito#3247)
• Bump org.shipkit:shipkit-changelog from 1.2.0 to 2.0.1 [(#3245)](mockito/mockito#3245)
• Bump com.diffplug.spotless from 6.24.0 to 6.25.0 [(#3244)](mockito/mockito#3244)
• Better typing for PluginLoader#loadPlugin(..) [(#3242)](mockito/mockito#3242)
• Bump com.github.ben-manes.versions from 0.50.0 to 0.51.0 [(#3241)](mockito/mockito#3241)
• Bump com.diffplug.spotless from 6.23.3 to 6.24.0 [(#3236)](mockito/mockito#3236)
• Fixes #3219: Add support for static mocks on DoNotMockEnforcer [(#3220)](mockito/mockito#3220)
• Mockito#mockStatic(Class) skips DoNotMockEnforcer [(#3219)](mockito/mockito#3219)

v5.9.0

What's Changed

• Bump com.diffplug.spotless from 6.23.2 to 6.23.3 by @​dependabot in mockito/mockito#3191
• Bump com.gradle.enterprise from 3.15.1 to 3.16 by @​dependabot in mockito/mockito#3192
• Bump org.eclipse.platform:org.eclipse.osgi from 3.18.500 to 3.18.600 by @​dependabot in mockito/mockito#3193
• Bump com.gradle.enterprise from 3.16 to 3.16.1 by @​dependabot in mockito/mockito#3200
• Bump actions/upload-artifact from 3 to 4 by @​dependabot in mockito/mockito#3201
• Bump com.google.googlejavaformat:google-java-format from 1.18.1 to 1.19.1 by @​dependabot in mockito/mockito#3206

... (truncated)

Commits

• ea6ff8c Add native method to MissingMethodInvocationException (#3283)
• 8431ae2 Bump com.google.googlejavaformat:google-java-format (#3277)
• a10d43c Bump versions.bytebuddy from 1.14.11 to 1.14.12 (#3272)
• 699799d Bump gradle/wrapper-validation-action from 2.1.0 to 2.1.1 (#3268)
• 861ca99 Bump org.shipkit:shipkit-auto-version from 2.0.3 to 2.0.4 (#3267)
• 043c0f0 Bump gradle/wrapper-validation-action from 2.0.1 to 2.1.0 (#3266)
• fa31e11 Bump gradle/wrapper-validation-action from 2.0.0 to 2.0.1 (#3264)
• efa8d2a Bump org.junit.platform:junit-platform-launcher from 1.10.1 to 1.10.2 (#3265)
• 66d18cc Bump org.assertj:assertj-core from 3.25.2 to 3.25.3 (#3261)
• e76f14a Bump versions.junitJupiter from 5.10.1 to 5.10.2 (#3260)
• Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-databind from 2.16.1 to 2.17.0

Commits

• See full diff in compare view

Updates com.fasterxml.jackson.core:jackson-annotations from 2.16.1 to 2.17.0

Commits

• See full diff in compare view

Updates com.fasterxml.jackson.core:jackson-core from 2.16.1 to 2.17.0

Commits

• 8fba680 [maven-release-plugin] prepare release jackson-core-2.17.0
• 486b33f Prepare for 2.17.0 release
• a6a1074 Merge branch '2.16' into 2.17
• e5b5e34 Back to snapshot deps
• 8938de4 [maven-release-plugin] prepare for next development iteration
• 4162dfc [maven-release-plugin] prepare release jackson-core-2.16.2
• 37ef9b3 Prepare for 2.16.2 release
• e2cc65d Bump the github-actions group with 3 updates (#1236)
• d29507f Improve #1149 wrt JsonParser.getNumberTypeFP() default implementation (#1235)
• 1994217 Add explicit override for JSON parsers for JsonParser.getNumberTypeFP()
• Additional commits viewable in compare view

Updates com.fasterxml.jackson.datatype:jackson-datatype-jsr310 from 2.16.1 to 2.17.0

Updates com.fasterxml.jackson.core:jackson-core from 2.16.1 to 2.17.0

Commits

• 8fba680 [maven-release-plugin] prepare release jackson-core-2.17.0
• 486b33f Prepare for 2.17.0 release
• a6a1074 Merge branch '2.16' into 2.17
• e5b5e34 Back to snapshot deps
• 8938de4 [maven-release-plugin] prepare for next development iteration
• 4162dfc [maven-release-plugin] prepare release jackson-core-2.16.2
• 37ef9b3 Prepare for 2.16.2 release
• e2cc65d Bump the github-actions group with 3 updates (#1236)
• d29507f Improve #1149 wrt JsonParser.getNumberTypeFP() default implementation (#1235)
• 1994217 Add explicit override for JSON parsers for JsonParser.getNumberTypeFP()
• Additional commits viewable in compare view

Updates com.fasterxml.jackson.datatype:jackson-datatype-jsr310 from 2.16.1 to 2.17.0

Updates io.jsonwebtoken:jjwt from 0.12.3 to 0.12.5

Release notes

Sourced from io.jsonwebtoken:jjwt's releases.

0.12.5

This release fixes issue #916 and ensures that builders' NestedCollection changes are applied to the collection immediately as mutation methods are called, no longer requiring application developers to call .and() to 'commit' or apply a change. For example, prior to this release, the following code did not apply changes:

JwtBuilder builder = Jwts.builder();
builder.audience().add("an-audience"); // no .and() call
builder.compact(); // would not keep 'an-audience'

Now this code works as expected and all other NestedCollection instances like it apply changes immediately (e.g. when calling .add(value)).

However, standard fluent builder chains are still recommended for readability when feasible, e.g.

Jwts.builder()
    .audience().add("an-audience").and() // allows fluent chaining
    .subject("Joe")
    // etc...
    .compact()

These same notes are repeated in the CHANGELOG, and as always, project documentation is in the README.

Please allow 30 minutes from the time this announcement is published for the release to be available in Maven Central.

0.12.4

This is patch release completes 10 issues, with two especially noteworthy changes, and a number of other smaller bug fixes and enhancements.

1. The default Jackson deserializer will now reject duplicate JSON members by default in an attempt to be a little more strict at rejecting potentially malicious or malformed JSON. This is a default and can be overridden with a custom ObjectMapper if desired.
2. Password-based JWE encryption key algorithms (PBES2_HS256_A128KW, PBES2_HS384_A192KW and PBES2_HS512_A256KW) now enforce an upper bound (maximum) number of iterations allowed during decryption to mitigate against potential DoS attacks. Many thanks to Jingcheng Yang and Jianjun Chen from Sichuan University and Zhongguancun Lab for their work on this!

A number of other issues fixed: thread-safe ServiceLoader usage for dynamic JSON processor lookup, Android enhancements for JSON Reader APIs, fixed Elliptic Curve field element padding, and more. Please read the 0.12.4 CHANGELOG for full details of all of these changes, and as always, project documentation is in the 0.12.4 README.

Please allow 30 minutes from the time this announcement is published for the release to be available in Maven Central.

Changelog

Sourced from io.jsonwebtoken:jjwt's changelog.

0.12.5

This patch release:

• Ensures that builders' NestedCollection changes are applied to the collection immediately as mutation methods are called, no longer requiring application developers to call .and() to 'commit' or apply a change. For example, prior to this release, the following code did not apply changes:

  JwtBuilder builder = Jwts.builder();
  builder.audience().add("an-audience"); // no .and() call
  builder.compact(); // would not keep 'an-audience'

  Now this code works as expected and all other NestedCollection instances like it apply changes immediately (e.g. when calling .add(value)).

  However, standard fluent builder chains are still recommended for readability when feasible, e.g.

  Jwts.builder()
      .audience().add("an-audience").and() // allows fluent chaining
      .subject("Joe")
      // etc...
      .compact()

  See Issue 916.

0.12.4

This patch release includes various changes listed below.

Jackson Default Parsing Behavior

This release makes two behavioral changes to JJWT's default Jackson ObjectMapper parsing settings:

1. In the interest of having stronger standards to reject potentially malformed/malicious/accidental JSON that could have undesirable effects on an application, JJWT's default ObjectMapper is now configured to explicitly reject/fail parsing JSON (JWT headers and/or Claims) if/when that JSON contains duplicate JSON member names.

   For example, now the following JSON, if parsed, would fail (be rejected) by default:

   {
     "hello": "world",
     "thisWillFail": 42,
     "thisWillFail": "test"
   }

   Technically, the JWT RFCs do allow duplicate named fields as long as the last parsed member is the one used (see JWS RFC 7515, Section 4), so this is allowed. However, because JWTs often reflect security concepts, it's usually better to be defensive and reject these

... (truncated)

Commits

• 2399e2f [maven-release-plugin] prepare release 0.12.5
• 8d3de65 Preparing for 0.12.5 release
• a0a123e PR #917
• afcd889 0.12.4 staging (#913)
• dd10b12 Added JWK Set documentation to README.mdJwkset doc (#912)
• 6335381 PBES2 decryption maximum iterations (#911)
• 2884eb7 - Updating to GitHub latest actions/checkout and actions/setup-java script ve...
• 628bd6f Secret JWK k values larger than HMAC-SHA minimums (#909)
• b12dabf Fix small typos (#908)
• 26f5dc3 Updating changelog with more information/clarity for the 0.12.4 release (#907)
• Additional commits viewable in compare view

Updates org.slf4j:slf4j-api from 2.0.11 to 2.0.12

Updates ch.qos.logback:logback-classic from 1.4.14 to 1.5.3

Commits

• f2d8a1a prepare release 1.5.3
• 99ccca7 fix /issues/785
• df7c7c5 prepare work on 1.5.3-SNAPSHOT
• baf5d70 prepare release 1.5.2
• 6998e81 add NoAutoStartUtil.shouldBeStarted method
• 40bc1c2 export tyler related packages
• 0094ba3 start work on 1.5.2-SNAPSHOT
• 88fd31c prepare release 1.5.1
• 231e9bd more internal changes and refactorings
• 8f3a304 more fine tuning of propertyModelHandler and co
• Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-compiler-plugin from 3.12.1 to 3.13.0

Release notes

Sourced from org.apache.maven.plugins:maven-compiler-plugin's releases.

3.13.0

🚀 New features and improvements

• [MCOMPILER-574] - Propagate cause of exception in AbstractCompilerMojo (#232) @​slawekjaranowski
• [MCOMPILER-582] - Automatic detection of release option for JDK < 9 (#228) @​slawekjaranowski
• [MCOMPILER-583] - Require Maven 3.6.3 (#229) @​slawekjaranowski
• [MCOMPILER-577] - Rename parameter "forceJavacCompilerUse" (#225) @​kwin
• [MCOMPILER-570] - Add links to javac documentation of JDK17 (#224) @​kwin
• [MCOMPILER-576] - Deprecate parameter "compilerVersion" (#223) @​kwin

📦 Dependency updates

• [MCOMPILER-575] - Bump plexusCompilerVersion from 2.14.2 to 2.15.0 (#227) @​dependabot
• Bump apache/maven-gh-actions-shared from 3 to 4 (#226) @​dependabot

📝 Documentation updates

• [MCOMPILER-548] - JDK 21 throws annotations processing warning that can not be turned off (#200) @​hgschmie

👻 Maintenance

• [MCOMPILER-584] - Refresh page - Using Non-Javac Compilers (#231) @​slawekjaranowski
• [MCOMPILER-585] - Refresh plugins versions in ITs (#230) @​slawekjaranowski
• subject verb agreement (#221) @​elharo

Commits

• a1415aa [maven-release-plugin] prepare release maven-compiler-plugin-3.13.0
• b2b9196 [MCOMPILER-574] Propagate cause of exception in AbstractCompilerMojo
• 6d2ce5a [MCOMPILER-584] Refresh page - Using Non-Javac Compilers
• eebad60 [MCOMPILER-585] Refresh plugins versions in ITs
• ceacf68 [MCOMPILER-582] Automatic detection of release option for JDK < 9
• 110293f [MCOMPILER-583] Require Maven 3.6.3
• 90131df [MCOMPILER-575] Bump plexusCompilerVersion from 2.14.2 to 2.15.0 (#227)
• 74cfc72 [MCOMPILER-548] JDK 21 throws annotations processing warning that can not be ...
• f85aa27 Bump apache/maven-gh-actions-shared from 3 to 4
• d59ef49 extract Maven 3.3.1 specific method call
• Additional commits viewable in compare view

Updates org.owasp:dependency-check-maven from 9.0.8 to 9.0.10

Release notes

Sourced from org.owasp:dependency-check-maven's releases.

Version 9.0.10

Refer to the CHANGELOG.md for information about improvements and upgrade notes.

Version 9.0.9

Refer to the CHANGELOG.md for information about improvements and upgrade notes.

Changelog

Sourced from org.owasp:dependency-check-maven's changelog.

Version 9.0.10 (2024-03-15)

• fix: #4321 Suppress redis server CVEs for client libraries (#4321) (#6489)
• fix: bump commons-compress from 1.25.0 to 1.26.0 to fix CVE-2024-25710 and CVE-2024-26308 (#6492)
• feat: Allow to pass NVD API key via environment variable (#6454)
• fix: issue 5452 - ConcurrentModificationException in NodePackageAnalyzer.processDependencies - adding synchronized block (#6501)
• docs: document the default data directory (#6484)
• fix: prevent NPE in bundler audit (#6462)
• fix: #6441 Improve suppression rule to not restrict to a single version (#6442)

See the full listing of changes.

Version 9.0.9 (2024-01-17)

• fix: for #6374 to delete non-empty directories (#6375)
• fix: NoSuchMethodError closeQuietly(java.io.Closeable[]) (#6377)
• chore: close stream to prevent possible resource leak (#6382)
• docs: Document default for CLI --data (#6359)
• docs: document gradle build (#6371)

See the full listing of changes.

Commits

• b18a1d6 build: prepare release v9.0.10
• b6a03c1 docs: prepare release 9.0.10
• e57ec63 fix: #4321 Suppress redis server CVEs for client libraries (#4321) (#6489)
• 04aff68 fix: bump commons-compress from 1.25.0 to 1.26.0 to fix CVE-2024-25710 and CV...
• ea72798 feat: Allow to pass NVD API key via environment variable (#6454)
• 44a3f16 fix: issue 5452 - ConcurrentModificationException in NodePackageAnalyzer.proc...
• 873289e docs: document the default data directory (#6484)
• 5df22e2 fix: prevent NPE in bundler audit (#6462)
• 39631db fix: #6441 Improve suppression rule to not restrict to a single version (#6442)
• 33c4c98 build: release 9.0.9 (#6396)
• Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-gpg-plugin from 3.1.0 to 3.2.2

Release notes

Sourced from org.apache.maven.plugins:maven-gpg-plugin's releases.

3.2.2

JiRA link

Release Notes - Maven GPG Plugin - Version 3.2.2

---

What's Changed

• [MGPG-113] SignAndDeployFileMojo results in 401 by @​cstamas in apache/maven-gpg-plugin#82
• [MGPG-114] Allow max key size of 16KB by @​cstamas in apache/maven-gpg-plugin#83
• [MGPG-115] Show more info about key used to sign by @​cstamas in apache/maven-gpg-plugin#84

Full Changelog: apache/maven-gpg-plugin@maven-gpg-plugin-3.2.1...maven-gpg-plugin-3.2.2

3.2.1

JIRA link

Release Notes - Maven GPG Plugin - Version 3.2.1

... (truncated)

Commits

• ab97064 [maven-release-plugin] prepare release maven-gpg-plugin-3.2.2
• 2be0a00 [MGPG-115] Show more info about key used to sign (#84)
• 3631830 [MGPG-114] Allow max key size of 16KB (#83)
• 528fab9 [MGPG-113] SignAndDeployFileMojo results in 401 (#82)
• 770636b [maven-release-plugin] prepare for next development iteration
• 5b69086 [maven-release-plugin] prepare release maven-gpg-plugin-3.2.1
• 28d298c [MGPG-111] Fix dependencies (#81)
• 75d8ed5 [MGPG-112] serverId def value was unintentionally dropped (#80)
• 2a11a2d [maven-release-plugin] prepare for next development iteration
• 4b23da8 [maven-release-plugin] prepare release maven-gpg-plugin-3.2.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Superseded by #275.