Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump com.github.tomakehurst:wiremock-jre8-standalone from 2.35.0 to 2.35.1 #359

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Sep 8, 2023

Bumps com.github.tomakehurst:wiremock-jre8-standalone from 2.35.0 to 2.35.1.

Release notes

Sourced from com.github.tomakehurst:wiremock-jre8-standalone's releases.

2.35.1 - Security Release

🔒 This is a security release that addresses the following issues

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

Credits: @​W0rty, @​numacanedo, @​Mahoney, @​tomakehurst, @​oleg-nenashev

Commits
  • 8706343 Bumped patch version
  • 20adc25 Stop NetworkAddressRules doing DNS lookups
  • aa29d9c Make NetworkAddressRulesAdheringDnsResolver testable
  • 90a37e1 Applied DNS resolver enforcement to webhooks extension
  • d9fd0b4 Moved enforcement of network address rules to Apache client DNS resolver to a...
  • eac439f Prevent webhook calling forbidden endpoints
  • 9ba86d6 Rename poorly named method
  • ef5b722 spotless apply
  • 5412ed1 Fixed some formatting in NetworkAddressRulesTest
  • 295ad5c Added some extra NetworkAddressRules test cases
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [com.github.tomakehurst:wiremock-jre8-standalone](https://github.com/wiremock/wiremock) from 2.35.0 to 2.35.1.
- [Release notes](https://github.com/wiremock/wiremock/releases)
- [Commits](wiremock/wiremock@2.35.0...2.35.1)

---
updated-dependencies:
- dependency-name: com.github.tomakehurst:wiremock-jre8-standalone
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Sep 8, 2023
@MarkEWaite MarkEWaite mentioned this pull request Oct 10, 2023
3 tasks
MarkEWaite added a commit to MarkEWaite/github-plugin that referenced this pull request Oct 10, 2023
Java 21 was released Sep 19, 2023. We want to announce full support
for Java 21 in early October and would like the most used plugins to
be compiled and tested with Java 21.

The acceptance test harness and plugin bill of materials tests are
already passing with Java 21. This is a further step to improve plugin
readiness for use with Java 21 and for development with Java 21.

The change intentionally tests only two Java configurations, Java 17
and Java 21 because we believe that the risk of a regression that only
affects Java 11 is low. We generate Java 11 byte code with the Java 17
and the Java 21 builds, so we're already testing Java 11 byte code.

Also updates parent pom to most current release and removes unneeded
hamcrest dependency declaration.

Supersedes pull request:

* jenkinsci#367
* jenkinsci#366
* jenkinsci#361
* jenkinsci#360
* jenkinsci#359
* jenkinsci#353
* jenkinsci#352
MarkEWaite added a commit to MarkEWaite/github-plugin that referenced this pull request Oct 10, 2023
Java 21 was released Sep 19, 2023. We want to announce full support
for Java 21 in early October and would like the most used plugins to
be compiled and tested with Java 21.

The acceptance test harness and plugin bill of materials tests are
already passing with Java 21. This is a further step to improve plugin
readiness for use with Java 21 and for development with Java 21.

The change intentionally tests only two Java configurations, Java 17
and Java 21 because we believe that the risk of a regression that only
affects Java 11 is low. We generate Java 11 byte code with the Java 17
and the Java 21 builds, so we're already testing Java 11 byte code.

Also updates parent pom to most current release and removes unneeded
hamcrest dependency declaration.

Supersedes pull request:

* jenkinsci#367
* jenkinsci#366
* jenkinsci#361
* jenkinsci#360
* jenkinsci#359
* jenkinsci#353
* jenkinsci#352
oleg-nenashev pushed a commit that referenced this pull request Nov 12, 2023
* Test with Java 21

Java 21 was released Sep 19, 2023. We want to announce full support
for Java 21 in early October and would like the most used plugins to
be compiled and tested with Java 21.

The acceptance test harness and plugin bill of materials tests are
already passing with Java 21. This is a further step to improve plugin
readiness for use with Java 21 and for development with Java 21.

The change intentionally tests only two Java configurations, Java 17
and Java 21 because we believe that the risk of a regression that only
affects Java 11 is low. We generate Java 11 byte code with the Java 17
and the Java 21 builds, so we're already testing Java 11 byte code.

Also updates parent pom to most current release and removes unneeded
hamcrest dependency declaration.

Supersedes pull request:

* #367
* #366
* #361
* #360
* #359
* #353
* #352

* Test Java 11 directly

Address the concern that Oleg expressed in
#368 (review)

We've detected no regressions with the transition to testing Java 11
byte code as generated by Java 17 and Java 21 compilers in the 200+
plugins that have made the transition.

We test with Java 11 on older lines (Jenkins 2.401.x and Jenkins
2.414.x) in the plugin bill of materials while testing with Java 21 on
the most recent weekly release.  We've detected no issues with any of
the plugins that are included in the plugin BOM.

We want to reduce Jenkins infrastructure costs by not testing
configurations that are unlikely to detect issues.  Testing with Java
11 is unlikely to detect issues and adds infrastructure cost.

I've added Java 11 on Linux as a test configuration. I do not intend
to make that same addition on the other 100+ repositories where we're
testing with Java 21 and Java 17.  When a plugin maintainer asks to
continue testing Java 11, I'm willing to adapt that pull request.

* Revert "Test Java 11 directly"

This reverts commit 6d8ef2f.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants