Update all non-major dependencies#715
Open
renovate[bot] wants to merge 1 commit intomasterfrom
Open
Conversation
Contributor
Author
|
Contributor
Summary
This PR updates 12 dependencies to newer versions, primarily minor and patch releases managed by Renovate. The most significant change is Kotlin itself, updating to What reviewers should knowKey areas to review:
|
![sonar-review-alpha[bot]](https://avatars.githubusercontent.com/in/3025063?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Routine Renovate dependency update. All the security-sensitive libraries (Spring Security, commons-codec, commons-net, okhttp) are updated only in kotlin-checks-test-sources, which compiles sample Kotlin code used by security rule tests — none of these land in the production plugin JAR.
One structural issue worth fixing before merge: the Kotlin artifact versions in kotlin-checks-test-sources/build.gradle.kts are hardcoded to 2.4.20-neptune-246 as literal strings, while every other module reads the version from the kotlinVersion project property (val kotlinVersion: String by project.ext). This PR updates them correctly today, but the pattern guarantees drift on the next Kotlin bump unless someone remembers to also touch this file.
Comment on lines
+12
to
+14
| implementation("org.jetbrains.kotlin:kotlin-reflect:2.4.20-neptune-246") | ||
| implementation("org.jetbrains.kotlin:kotlin-test:2.4.20-neptune-246") | ||
| implementation("org.jetbrains.kotlin:kotlin-test-junit5:2.4.20-neptune-246") |
Contributor
There was a problem hiding this comment.
These three Kotlin library versions are hardcoded literals while every other module reads them from the kotlinVersion project property (e.g. sonar-kotlin-api/build.gradle.kts uses val kotlinVersion: String by project.ext). Next time kotlinVersion is bumped in gradle.properties, these lines won't be updated automatically — causing a mismatch between the Kotlin compiler the rest of the build uses and the libraries this test-sources module compiles against.
Suggested change
| implementation("org.jetbrains.kotlin:kotlin-reflect:2.4.20-neptune-246") | |
| implementation("org.jetbrains.kotlin:kotlin-test:2.4.20-neptune-246") | |
| implementation("org.jetbrains.kotlin:kotlin-test-junit5:2.4.20-neptune-246") | |
| val kotlinVersion: String by project.ext | |
| implementation("org.jetbrains.kotlin:kotlin-reflect:$kotlinVersion") | |
| implementation("org.jetbrains.kotlin:kotlin-test:$kotlinVersion") | |
| implementation("org.jetbrains.kotlin:kotlin-test-junit5:$kotlinVersion") |
- Mark as noise
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.10.0→1.11.03.17.0→3.20.01.13→1.21.04.2.17.RELEASE→4.2.20.RELEASE7.6.1→7.9.15.7.2→5.8.163.8.0→3.13.04.9.0→4.12.02.3.20→2.4.20-neptune-2466.11.0→6.25.02.3.20→2.4.20-neptune-2462.3.20→2.4.20-neptune-2461.5.1→1.10.22.3.20→2.4.20-neptune-246Release Notes
Kotlin/kotlinx.serialization (org.jetbrains.kotlinx:kotlinx-serialization-core)
v1.11.0==================
This release is based on Kotlin 2.3.20 and provides new Json exceptions API and some bugfixes and improvements.
Expose Json exceptions structure
To make working with exceptions easier and providing proper error codes in e.g., REST APIs,
classes
JsonException,JsonDecodingException, andJsonEncodingExceptionare now public.They have relevant public properties, such as
shortMessage,path,offset, and others.This API is currently experimental, and we're going to improve it further in the subsequent releases.
See the linked issues for the details: #1930, #1877.
Ability to hide user input from exception messages for security/privacy reasons.
Historically, exception messages in kotlinx.serialization often included the input Json itself for debuggability reason.
Such behavior may pose additional challenges for logging, analytics, and other systems, since
a system is not always allowed to store user data due to privacy/security reasons, which imposes additional sanitation logic.
To address this issue, a new property
exceptionsWithDebugInfois added toJsonConfiguration.Disable it to hide user input from exception messages.
IMPORTANT: This behavior will be enabled by default when this property becomes stable.
See #2590 for more details.
Bugfixes and improvements
apache/commons-codec (commons-codec:commons-codec)
v1.21.0The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.21.0.
The Apache Commons Codec component contains encoders and decoders for
formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.
This is a feature and maintenance release. Java 8 or later is required.
v1.17.2The Apache Commons Codec component contains encoders and decoders for
formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.
This is a feature and maintenance release. Java 8 or later is required.
v1.17.1The Apache Commons Codec component contains encoders and decoders for
various formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.
Feature and fix release. Requires a minimum of Java 8.
v1.17.0The Apache Commons Codec component contains encoders and decoders for
various formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.
Feature and fix release. Requires a minimum of Java 8.
v1.16.1The Apache Commons Codec component contains encoders and decoders for
various formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.
Feature and fix release. Requires a minimum of Java 8.
spring-projects/spring-security (org.springframework.security:spring-security-core)
v4.2.20.RELEASECompare Source
🔨 Dependency Upgrades
v4.2.19.RELEASECompare Source
🔨 Dependency Upgrades
❤️ Contributors
We'd like to thank all the contributors who worked on this release!
v4.2.18.RELEASECompare Source
⭐ New Features
❤️ Contributors
We'd like to thank all the contributors who worked on this release!
Guardsquare/proguard (com.guardsquare:proguard-gradle)
v7.9.1: 7.9.1Bugfixes
v7.8.2Bugfixes
v7.8.1Bugfixes
java.lang.IncompatibleClassChangeErrorwhen shrinking is enabled and sealed interfaces are used (#501).java.lang.ClassCastExceptionwhen inlining (#505).Kotlin/kotlinx.coroutines (org.jetbrains.kotlinx:kotlinx-coroutines-core)
v1.10.2Compare Source
kotlinx-coroutines-debugJAR file including themodule-info.classfile twice, resulting in failures in various tooling (#4314). Thanks, @RyuNen344!Flow.stateInhanging when the scope is cancelled in advance or the flow is empty (#4322). Thanks, @francescotescari!.limitedParallelism(#4330) and during flow collection (#4272).runBlockingfailing to run its coroutine to completion in some cases if its JVM thread got interrupted (#4399).v1.10.1Compare Source
v1.10.0Compare Source
Flow.any,Flow.all, andFlow.none(#4212). Thanks, @CLOVIS-AI!kotlinx-coroutines-debugandkotlinx-coroutines-corecode to avoid a split package between the two artifacts (#4247). Note that directly referencingkotlinx.coroutines.debug.AgentPremainmust now be replaced withkotlinx.coroutines.debug.internal.AgentPremain. Thanks, @sellmair!kotlinx-coroutines-debug, reducing the artifact size and simplifying the build configuration of client code. Thanks, @sellmair!NullPointerExceptionwhen using Java-deserializedkotlinx-coroutines-coreexceptions (#4291). Thanks, @AlexRiedler!CoroutineDispatcher.dispatchinstead of raising internal errors (#4091). Thanks, @zuevmaxim!Dispatchers.DefaultorDispatchers.IOtask after ayield()in rare scenarios (#4248).main()coroutine on Wasm/WASI from executing after adelay()call in some scenarios (#4239).runBlockingtasks on Kotlin/Native that arrive after therunBlockingblock was exited (#4245).Flowoperators sometimes resuming without taking cancellation into account (#4254). Thanks, @jxdabc!ThreadLocalvalues not to get cleaned when using non-CoroutineDispatchercontinuation interceptors (#4296).v1.9.0Compare Source
Features
limitedParallelismnow optionally accepts the name of the dispatcher view for easier debugging (#4023).Dispatchers.IOon the JVM when other standard dispatchers are accessed (#4166). Thanks, @metalhead8816!Flow<T>.chunked(size: Int): Flow<List<T>>operator that groups emitted values into groups of the given size (#1290).AutoCloseablenow (#4123).Fixes
hasNexton aChannel's iterator is idempotent (#4065). Thanks, @gitpaxultek!CoroutineScope()created without an explicit dispatcher usesDispatchers.Defaulton Native (#4074). Thanks, @whyoleg!Dispatchers.Mainfrom initializing when the Firebase dependency is used (#3914).runBlocking(#4134).MutextoSemaphore(#4176).asDeferredon aFuturemany times (#4156).Deprecations and promotions
BroadcastChannel-based API (#4197).kotlinx-coroutines-testAPI (#4198).Job.cancelFutureOnCompletion(#4173).CoroutineDispatcher.limitedParallelismto stable (#3864).CoroutineStart.ATOMICfromExperimentalCoroutinesApitoDelicateCoroutinesApi(#4169).CancellableContinuation.resumewith anonCancellationlambda to stable, providing extra arguments to the lambda (#4088).InternalForInheritanceCoroutinesApiopt-in (#3770).ExperimentalForInheritanceCoroutinesApiopt-in (#3770).Other
CoroutineStartandChannel-based API (#4147, #4148, #4167). Thanks, @globsterg!Job(#4053).v1.8.1Compare Source
@ExperimentalTimeannotation from usages ofTimeSource(#4046). Thanks, @hfhbd!NullPointerExceptionwhen setting theStateFlowvalue on old Android devices (#3820).kotlin.random.Randomas part ofDispatchers.DefaultandDispatchers.IOinitialization (#4051).Flow.timeoutthrows the exception with which the channel was closed (#4071).Changelog relative to version 1.8.1-Beta
Flow.timeoutthrows the exception with which the channel was closed (#4071).v1.8.0Compare Source
Dispatchers.Main != Dispatchers.Main.immediate(#3545, #3963).Flowoperators that limit cancel the upstream flow to forget that they were already finished if there is another such operator upstream (#4035, #4038)kotlinx-coroutines-debugis published with the correct Java 9 module info (#3944).kotlinx-coroutines-debugno longer requires manually settingDebugProbes.enableCoroutineCreationStackTracestofalse, it's the default (#3783).kotlinx-coroutines-test: set the default timeout ofrunTestto 60 seconds, added the ability to configure it on the JVM with thekotlinx.coroutines.test.default_timeout=10s(#3800).kotlinx-coroutines-test: fixed a bug that could lead to not all uncaught exceptions being reported after some tests failed (#3800).delay(Duration)rounds nanoseconds up to whole milliseconds and not down (#3920). Thanks @kevincianfarini!Dispatchers.Defaultand the default thread for background work are guaranteed to use the same context classloader as the object containing it them (#3832).SharedFlow.collectsuspends for the first time, it's registered as a subscriber for thatSharedFlow(#3885). Before, it was also true, but not documented.withLockon JS (#3881). Thanks @CLOVIS-AI!Changelog relative to version 1.8.0-RC2
kotlinx-coroutines-debugno longer requires manually settingDebugProbes.enableCoroutineCreationStackTracestofalse, it's the default (#3783).Flowoperators that limit cancel the upstream flow to forget that they were already finished if there is another such operator upstream (#4035, #4038)v1.7.3Compare Source
v1.7.2Compare Source
Bug fixes and improvements
CopyableThreadContextElementnow properly copies an element when crossing the coroutine boundary inflowOn(#3787). Thanks @wanyingd1996!newSingleThreadContextfrom closing (#3768).MutexduringtryLock/unlocksequence with owners is fixed (#3745).v1.7.1Compare Source
Bug fixes and improvements
runTestis restored (#3673)onUndeliveredElementnow allocate less memory (#3646)v1.7.0Compare Source
Core API significant improvements
Channelimplementation with significant performance improvements across the API (#3621).selectoperator implementation: faster, more lightweight, and more robust (#3020).MutexandSemaphorenow share the same underlying data structure (#3020).Dispatchers.IOis added to K/N (#3205)newFixedThreadPoolandDispatchers.Defaultimplementations on K/N were wholly rewritten to support graceful growth under load (#3595).kotlinx-coroutines-testrework:timeoutparameter torunTestfor the whole-test timeout, 10 seconds by default (#3270). This replaces the configuration of quiescence timeouts, which is now deprecated (#3603).withTimeoutexception messages indicate if the timeout used the virtual time (#3588).TestCoroutineScheduler,runTest, andTestScopeAPI are promoted to stable (#3622).runTestnow also fails if there were uncaught exceptions in coroutines not inherited from the test coroutine (#1205).Breaking changes
kotlinx-coroutines-coreandkotlinx-coroutines-jdk8artifacts were merged into a single artifact (#3268).\bsymbol and are now navigable in IDE and supplied with proper documentation (#2291).CoroutineContext.isActivereturnstruefor contexts without any job in them (#3300).Bug fixes and improvements
JavaFxversion is updated to 17.0.2 inkotlinx-coroutines-javafx(#3671)..BroadcastChanneland all the corresponding API are deprecated (#2680).Dispatchers.Defaultis backed by the number of threads equal to the number of available cores (#3366).Job.parentAPI (#3201).TestSchedulerleaked cancelled jobs (#3398).TestScope.timeSourcenow provides comparable time marks (#3617). Thanks @hfhbd!withTimeouthandles were preserved in JS runtime (#3440).awaitFrameonly awaits a single frame when used from the main looper (#3432). Thanks @pablobaxter!Class-Pathattribute was removed fromkotlinx-coroutines-debug.jarmanifest (#3361).updateThreadContextoperated on the parent context (#3411).Flow.filterIsInstanceextension (#3240).Dispatchers.Defaultthread name prefixes are now configurable with system property (#3231).Flow.timeoutoperator as@FlowPreview(#2624). Thanks @pablobaxter!futurebuilder in case of exceptions (#3475). Thanks @He-Pin!Mono.awaitSingleOrNullnow waits for theonCompletesignal (#3487).Channel.isClosedForSendandChannel.isClosedForReceiveare promoted from experimental to delicate (#3448).EventLoop(#3547).Dispatchers.IO.limitedParallelism(valueLargerThanIOSize)no longer creates an additional wrapper (#3442). Thanks @dovchinnikov!@FlowPreviewand@ExperimentalCoroutinesApiare promoted to experimental and stable respectively (#3542, #3097, #3548).Dispatchers.DefaultandDispatchers.IO(#3416, #3418).suspendCancellableCoroutineReusablemight have hanged (#3613).CoroutineExceptionHandleris no longer invoked in case of unprocessedfuturefailure (#3452).withContextoperator (#3592).DebugProbes(#3527).CoroutineDispatcher.asExecutor()runs tasks without dispatching if the dispatcher is unconfined (#3683). Thanks @odedniv!SharedFlow.toMutableListandSharedFlow.toSetlints are introduced (#3706).Channel.invokeOnCloseis promoted to stable API (#3358).Dispatchers.DefaultandDispatchers.IOduring the startup phase (#3652).Dispatchers.Default(#3642).limitedParallelismto perform dispatches even after the underlying dispatcher was closed (#3672).causewas selected (#3714).Changelog for previous versions may be found in CHANGES_UP_TO_1.7.md
v1.6.4Compare Source
TestScope.backgroundScopefor launching coroutines that perform work in the background and need to be cancelled at the end of the test (#3287).kotlinx-coroutines-debughaving an incorrect reference tokotlinx-coroutines-bom, which cause the builds of Maven projects using the debug module to break (#3334).Publisher.awaitfunctions inkotlinx-coroutines-reactivenot ensuring that theSubscribermethods are invoked serially (#3360). Thank you, @EgorKulbachka!withTimeouton K/N with the new memory model (#3351).Throwableimplementations in the core library are serializable (#3328).v1.6.3Compare Source
v1.6.2Compare Source
ThreadLocalElementnot being correctly updated when the most outersuspendfunction was called directly withoutkotlinx.coroutines(#2930).runBlockingevent loop, and a benign data race inMutex(#3250, #3251).TestCoroutineContextis removed, which fixes thekotlinx-coroutines-testJPMS package being split betweenkotlinx-coroutines-coreandkotlinx-coroutines-test(#3218).0.17.2, which includes a more efficient and robust JS IR transformer (#3255).1.6.21, Gradle version is updated to7.4.2(#3281). Thanks, @wojtek-kalicinski!v1.6.1Compare Source
Dispatchers.Main.This behavior was introduced in 1.6.0 and then found inconvenient and erroneous (#3106, #3113).
CopyableThreadContextElementto solve issues uncovered after the initial release (#3227).ThreadLocalElementnot being properly updated in racy scenarios (#2930).CoroutineExceptionHandlerthat triggered ANR on some devices (#3180).CoroutineDispatcherto a Rx scheduler (#968, #548). Thanks @recheej!flowbuilder being retained in memory (#3197).limitedParallelismon K/N with new memory model throwingClassCastException(#3223).CoroutineContextis added to the exception printed to the defaultCoroutineExceptionHandlerto improve debuggability (#3153).Dispatchers.Defaultwas significantly reduced (#3137).kotlinx-coroutines-slf4jfrom 1.7.25 to 1.7.32.v1.6.0Compare Source
Note that this is a full changelog relative to the 1.5.2 version. Changelog relative to 1.6.0-RC3 can be found at the end.
kotlinx-coroutines-test rework
kotlinx-coroutines-testbecame a multiplatform library usable from K/JVM, K/JS, and K/N.).
Dispatchers
CoroutineDispatcher.limitedParallelismthat allows obtaining a view of the original dispatcher with limited parallelism (#2919).Dispatchers.IO.limitedParallelismusages ignore the bound on the parallelism level ofDispatchers.IOitself to avoid starvation (#2943).Dispatchers.shutdownmethod for containerized environments (#2558).newSingleThreadContextandnewFixedThreadPoolContextare promoted to delicate API (#2919).Breaking changes
futurebuilder no longer reports unhandled exceptions into the globalCoroutineExceptionHandler. Thanks @vadimsemenov! (#2774, #2791).Mutex.onLockis deprecated for removal (#2794).Dispatchers.Mainis now used as the default source of time fordelayandwithTimeoutwhen present (#2972).kotlinx.coroutines.main.delaysystem property can be set tofalse.collectno longer resolves when used with a non-in-place argument of a functional type. This is a candidate for a fix, uncovered after 1.6.0, see #3107 for the additional details.Bug fixes and improvements
kotlin.native.binary.memoryModelis enabled (#2914).CopyableThreadContextElementfor mutable context elements shared among multiple coroutines. Thanks @yorickhenning! (#2893).transformWhile,awaitClose,ProducerScope,merge,runningFold,runingReduce, andscanare promoted to stable API (#2971).SharedFlow.subscriptionCountno longer conflates incoming updates and gives all subscribers a chance to observe a short-lived subscription (#2488, #2863, #2871).Flowexception transparency mechanism is improved to be more exception-friendly (#3017, #2860).flat*operators that leverage multiple coroutines is no longer propagated upstream (#2964).SharedFlow.collectnow returnsNothing(#2789, #2502).DisposableHandleis nowfun interface, and corresponding inline extension is removed (#2790).FlowCollectoris nowfun interface, and corresponding inline extension is removed (#3047).processUnhandledException(#2981).Taskcallbacks inkotlinx-coroutines-play-services(#2990).CoroutineExceptionHandleris loaded eagerly and does not invokeServiceLoaderon its exception-handling path (#2552).ServiceLoaderoptimization (#2880).SendChannel.trySendBlockingis now available on Kotlin/Native (#3064).ClassValuewhen available (#2997).Delayinterface is deprecated (#2979).CommonPoolis removed.@ExperimentalTimeis no longer needed for methods that useDuration(#3041).v1.5.2Compare Source
onUndeliveredElementwas incorrectly called on properly received elements on JS (#2826).Dispatchers.Defaulton React Native, it now fully relies onsetTimeoutinstead of stubprocess.nextTick. Thanks to @Legion2 (#2843).Muteximplementation (#2581).Muteximplementation is made completely lock-free as stated ([#2590](https://redirect.github.com/KConfiguration
📅 Schedule: (in timezone CET)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.