Skip to content

Update Mend: high confidence minor and patch dependency updates#14

Open
mend-for-github-com[bot] wants to merge 1 commit into
mainfrom
whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates
Open

Update Mend: high confidence minor and patch dependency updates#14
mend-for-github-com[bot] wants to merge 1 commit into
mainfrom
whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates

Conversation

@mend-for-github-com

@mend-for-github-com mend-for-github-com Bot commented May 26, 2026 •
edited
Loading

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
org.apache.maven.plugins:maven-javadoc-plugin (source) 3.6.3 → 3.12.0 age adoption passing confidence
org.apache.maven.plugins:maven-source-plugin (source) 3.3.0 → 3.4.0 age adoption passing confidence
org.apache.maven.plugins:maven-gpg-plugin (source) 3.1.0 → 3.2.8 age adoption passing confidence
org.jacoco:jacoco-maven-plugin (source) 0.8.7 → 0.8.15 age adoption passing confidence
org.apache.maven.plugins:maven-compiler-plugin (source) 3.12.1 → 3.15.0 age adoption passing confidence
org.skyscreamer:jsonassert 1.5.0 → 1.5.3 age adoption passing confidence
org.codehaus.jettison:jettison 1.5.4 → 1.5.5 age adoption passing confidence
net.minidev:json-smart (source) 2.5.0 → 2.6.0 age adoption passing confidence
com.google.code.gson:gson 2.8.9 → 2.14.0 age adoption passing confidence
commons-io:commons-io (source) 2.7 → 2.22.0 age adoption passing confidence
org.mockito:mockito-core 5.10.0 → 5.23.0 age adoption passing confidence
org.junit.jupiter:junit-jupiter-params (source) 5.7.0 → 5.14.4 age adoption passing confidence
junit:junit (source) 4.13.1 → 4.13.2 age adoption passing confidence
org.apache.httpcomponents:httpclient (source) 4.5.13 → 4.5.14 age adoption passing confidence
com.jayway.jsonpath:json-path 2.9.0 → 2.10.0 age adoption passing confidence

Release Notes

jacoco/jacoco (org.jacoco:jacoco-maven-plugin)

v0.8.15: 0.8.15

Compare Source

New Features

  • JaCoCo now officially supports Java 26 (GitHub #​2076).
  • Experimental support for Java 27 class files (GitHub #​2004).
  • Compatibility methods generated by Kotlin compiler for functions defined in interfaces are filtered out during generation of report (GitHub #​1905).
  • Compatibility methods generated by Kotlin compiler for exposed boxed inline value classes (JvmExposeBoxed annotation) are filtered out during generation of report (GitHub #​1944).
  • Methods generated by the Kotlin compiler for functions with JvmStatic annotation are filtered out during generation of report (GitHub #​2097).
  • Improved filtering of bytecode generated by Kotlin compiler for when expressions and statements with kotlin.String subject where first branch condition contains string with largest hash (GitHub #​2098).
  • Part of bytecode that javac versions from 24 to 26 generate for switch statements and expressions with selector expression of type java.lang.String inside lambdas is filtered out during generation of report (GitHub #​2023).
  • Improved performance of Kotlin files analysis by parsing SMAPs only once per class (GitHub #​2114).
  • For better performance agent output methods tcpclient and tcpserver use BufferedOutputStream to write execution data to socket. Maven plugin, Ant tasks, CLI, API usage examples, and ExecDumpClient API use BufferedInputStream to read execution data from socket. Third-party integrations should do the same to benefit from this change in agent (GitHub #​2089).

Fixed bugs

  • Fixed processing of Kotlin SMAP in synthetic classes (GitHub #​1985).
  • Multiple JaCoCo runtimes within one JVM writing to the same output file should not cause data corruption when running on JDK versions from 6 to 10 affected by JDK-8166253 (GitHub #​2065, #​2074).
  • For better performance agent writes to output file via BufferedOutputStream, this fixes regression introduced in version 0.6.2 (GitHub #​2073).
  • Fixed NullPointerException when JaCoCo agent is loaded by non system class loader, for example when loaded by JBoss Modules (GitHub #​1651).

Non-functional Changes

  • JaCoCo now depends on ASM 9.10.1 (GitHub #​2134).

v0.8.14: 0.8.14

Compare Source

New Features

  • JaCoCo now officially supports Java 25 (GitHub #​1950).
  • Experimental support for Java 26 class files (GitHub #​1870).
  • Branches added by the Kotlin compiler for default argument number 33 or higher are filtered out during generation of report (GitHub #​1655).
  • Part of bytecode generated by the Kotlin compiler for elvis operator that follows safe call operator is filtered out during generation of report (GitHub #​1814, #​1954).
  • Part of bytecode generated by the Kotlin compiler for more cases of chained safe call operators is filtered out during generation of report (GitHub #​1956).
  • Part of bytecode generated by the Kotlin compiler for invocations of suspendCoroutineUninterceptedOrReturn intrinsic is filtered out during generation of report (GitHub #​1929).
  • Part of bytecode generated by the Kotlin compiler for suspending lambdas with parameters is filtered out during generation of report (GitHub #​1945).
  • Part of bytecode generated by the Kotlin compiler for suspending functions and lambdas with suspension points that return inline value class is filtered out during generation of report (GitHub #​1871).
  • Part of bytecode generated by the Kotlin Compose compiler plugin for pausable composition is filtered out during generation of report (GitHub #​1911).
  • Methods generated by the Kotlin serialization compiler plugin are filtered out (GitHub #​1885, #​1970, #​1971).

Fixed bugs

  • Fixed handling of implicit else clause of when with String subject in Kotlin (GitHub #​1813, #​1940).
  • Fixed handling of implicit default clause of switch by String in Java when compiled by ECJ (GitHub #​1813, #​1940).
    Fixed handling of exceptions in chains of safe call operators in Kotlin (GitHub #​1819).

Non-functional Changes

  • JaCoCo now depends on ASM 9.9 (GitHub #​1965).

v0.8.13: 0.8.13

Compare Source

New Features

  • JaCoCo now officially supports Java 23 and Java 24 (GitHub #​1757, #​1631, #​1867).
  • Experimental support for Java 25 class files (GitHub #​1807).
  • Calculation of line coverage for Kotlin inline functions (GitHub #​1670).
  • Calculation of line coverage for Kotlin inline functions with reified type parameter (GitHub #​1670, #​1700).
  • Calculation of coverage for Kotlin JvmSynthetic functions (GitHub #​1700).
  • Part of bytecode generated by the Kotlin Compose compiler plugin is filtered out during generation of report (GitHub #​1616).
  • Part of bytecode generated by the Kotlin compiler for inline value classes is filtered out during generation of report (GitHub #​1475).
  • Part of bytecode generated by the Kotlin compiler for suspending lambdas without suspension points is filtered out during generation of report (GitHub #​1283).
  • Part of bytecode generated by the Kotlin compiler for when expressions and statements with nullable enum subject is filtered out during generation of report (GitHub #​1774).
  • Part of bytecode generated by the Kotlin compiler for when expressions and statements with nullable String subject is filtered out during generation of report (GitHub #​1769).
  • Part of bytecode generated by the Kotlin compiler for chains of safe call operators is filtered out during generation of report (GitHub #​1810, #​1818).
  • Method getEntries generated by the Kotlin compiler for enum classes is filtered out during generation of report (GitHub #​1625).
  • Methods generated by the Kotlin compiler for constructors and functions with JvmOverloads annotation are filtered out (GitHub #​1768).

Fixed bugs

  • Fixed interpretation of Kotlin SMAP (GitHub #​1525).
  • File extensions are preserved in HTML report in case of clashes of normalized file names (GitHub #​1660).

Non-functional Changes

  • JaCoCo build now uses Maven Wrapper and requires at least Maven 3.9.9 (GitHub #​1708, #​1707, #​1681).
  • JaCoCo now depends on ASM 9.8 (GitHub #​1862).
  • More context information when IllegalArgumentException occurs during reading of zip file (GitHub #​1833).

v0.8.12: 0.8.12

Compare Source

New Features

  • JaCoCo now officially supports Java 22 (GitHub #​1596).
  • Experimental support for Java 23 class files (GitHub #​1553).

Fixed bugs

  • Branches added by the Kotlin compiler for functions with default arguments and having more than 32 parameters are filtered out during generation of report (GitHub #​1556).
  • Branch added by the Kotlin compiler version 1.5.0 and above for reading from lateinit property is filtered out during generation of report (GitHub #​1568).

Non-functional Changes

  • JaCoCo now depends on ASM 9.7 (GitHub #​1600).

v0.8.11: 0.8.11

Compare Source

New Features

  • JaCoCo now officially supports Java 21 (GitHub #​1520).
  • Experimental support for Java 22 class files (GitHub #​1479).
  • Part of bytecode generated by the Java compilers for exhaustive switch expressions is filtered out during generation of report (GitHub #​1472).
  • Part of bytecode generated by the Java compilers for record patterns is filtered out during generation of report (GitHub #​1473).

Fixed bugs

  • Instrumentation should not cause VerifyError when the last local variable of method parameters is overridden in the method body to store a value of type long or double (GitHub #​893).
  • Restore exec file compatibility with versions from 0.7.5 to 0.8.8 in case of class files with zero line numbers (GitHub #​1492).

Non-functional Changes

  • jacoco-maven-plugin now requires at least Java 8 (GitHub #​1466, #​1468).
  • JaCoCo build now requires at least Maven 3.5.4 (GitHub #​1467).
  • Maven 3.9.2 should not produce warnings for jacoco-maven-plugin (GitHub #​1468).
  • JaCoCo build now requires JDK 17 (GitHub #​1482).
  • JaCoCo now depends on ASM 9.6 (GitHub #​1518).

v0.8.10: 0.8.10

Compare Source

Fixed bugs

  • Agent should not require configuration of permissions for SecurityManager outside of its codeBase (GitHub #​1425).

v0.8.9: 0.8.9

Compare Source

New Features

  • JaCoCo now officially supports Java 19 and 20 (GitHub #​1371, #​1386).
  • Experimental support for Java 21 class files (GitHub #​1386).
  • Add parameter to include the current project in the report-aggregate Maven goal (GitHub #​1007).
  • Component accessors generated by the Java compilers for records are filtered out during generation of report. Contributed by Tesla Zhang (GitHub #​1393).

Fixed bugs

  • Agent should not open java.lang package to unnamed module of the application class loader (GitHub #​1334).

Non-functional Changes

v0.8.8: 0.8.8

Compare Source

New Features

  • JaCoCo now officially supports Java 17 and 18 (GitHub #​1282, #​1198).
  • Experimental support for Java 19 class files (GitHub #​1264).
  • Part of bytecode generated by the Java compilers for assert statement is filtered out during generation of report (GitHub #​1196).
  • Branch added by the Kotlin compiler version 1.6.0 and above for "unsafe" cast operator is filtered out during generation of report (GitHub #​1266).
  • Improved support for multiple JaCoCo runtimes in the same VM (GitHub #​1057).

Fixed bugs

  • Fixed NullPointerException during filtering (GitHub #​1189).
  • Fix range for debug symbols of method parameters (GitHub #​1246).

Non-functional Changes

  • JaCoCo now depends on ASM 9.2 (GitHub #​1206).
  • Messages of exceptions occurring during analysis or instrumentation now include JaCoCo version (GitHub #​1217).
skyscreamer/JSONassert (org.skyscreamer:jsonassert)

v1.5.3

  • Revert Java release version from 21 to 8 due to breaking older compilers.

v1.5.2

v1.5.1

Going to try to catch up on some ancient PRs, mainly around security and cleanup. Starting with accepted PRs that
didn't get released yet. To be followed hopefully shortly with another release.

  • Added convenience methods for JSONObject comparison using a custom JSONComparator (thanks jakob-o@!)
  • Fix issue #​105: Issue when comparing JSONArray if any value is null (thanks suraj1291993@​!)
  • Fixes security vulnerability associated with older version of junit
netplex/json-smart-v2 (net.minidev:json-smart)

v2.6.0

Compare Source

What's Changed

New Contributors

Full Changelog: netplex/json-smart-v2@2.5.2...v2.6.0

v2.5.2

Compare Source

About CVE-2024-57699

Thanks for @​ccudennec-otto Some remarks on the CVE, more discussions in #​236

  • as mentioned here it is quite unlikely that the vulnerability is exploited if you come here because of Spring Security / com.nimbusds:oauth2-oidc-sdk
  • the code changes for the upcoming release will "only" fix the default modes provided by JSONParser, e.g. MODE_RFC4627
  • if you create the JSONParser manually / with custom options, make sure you set option LIMIT_JSON_DEPTH
    • since that's what "connect2id" is doing in their library, they were responsible for fixing it. They've already provided a new 11.x release that fixes the JSONParser setup on their side, i.e. you rather need their fixed version and not version 2.5.2 of json-smart
    • as stated here, they would also need to backport the fix to the versions that Spring Security needs IMHO

What's Changed

New Contributors

Full Changelog: netplex/json-smart-v2@2.5.1...2.5.2

v2.5.1: V 2.5.1

Compare Source

What's Changed

New Contributors

Full Changelog: netplex/json-smart-v2@2.5.0...2.5.1

google/gson (com.google.code.gson:gson)

v2.10

  • Support for serializing and deserializing Java records, on Java ≥ 16. (#​2201)
  • Add JsonArray.asList and JsonObject.asMap view methods (#​2225)
  • Fix TypeAdapterRuntimeTypeWrapper not detecting reflective TreeTypeAdapter and FutureTypeAdapter (#​1787)
  • Improve JsonReader.skipValue() (#​2062)
  • Perform numeric conversion for primitive numeric type adapters (#​2158)
  • Add Gson.fromJson(..., TypeToken) overloads (#​1700)
  • Fix changes to GsonBuilder affecting existing Gson instances (#​1815)
  • Make JsonElement conversion methods more consistent and fix javadoc (#​2178)
  • Throw UnsupportedOperationException when JsonWriter.jsonValue is not supported (#​1651)
  • Disallow JsonObject Entry.setValue(null) (#​2167)
  • Fix TypeAdapter.toJson throwing AssertionError for custom IOException (#​2172)
  • Convert null to JsonNull for JsonArray.set (#​2170)
  • Fixed nullSafe usage. (#​1555)
  • Validate TypeToken.getParameterized arguments (#​2166)
  • Fix #​1702: Gson.toJson creates CharSequence which does not implement toString (#​1703)
  • Prefer existing adapter for concurrent Gson.getAdapter calls (#​2153)
  • Improve ArrayTypeAdapter for Object[] (#​1716)
  • Improve AppendableWriter performance (#​1706)

v2.9.1

  • Make Object and JsonElement deserialization iterative rather than
    recursive (#​1912)
  • Added parsing support for enum that has overridden toString() method (#​1950)
  • Removed support for building Gson with Gradle (#​2081)
  • Removed obsolete codegen hierarchy (#​2099)
  • Add support for reflection access filter (#​1905)
  • Improve TypeToken creation validation (#​2072)
  • Add explicit support for float in JsonWriter (#​2130, #​2132)
  • Fail when parsing invalid local date (#​2134)

Also many small improvements to javadoc.

v2.9.0

The minimum supported Java version changes from 6 to 7.

  • Change target Java version to 7 (#​2043)
  • Put module-info.class into Multi-Release JAR folder (#​2013)
  • Improve error message when abstract class cannot be constructed (#​1814)
  • Support EnumMap deserialization (#​2071)
  • Add LazilyParsedNumber default adapter (#​2060)
  • Fix JsonReader.hasNext() returning true at end of document (#​2061)
  • Remove Gradle build support. Build script was outdated and not actively
    maintained anymore (#​2063)
  • Add GsonBuilder.disableJdkUnsafe() (#​1904)
  • Add UPPER_CASE_WITH_UNDERSCORES in FieldNamingPolicy (#​2024)
  • Fix failing to serialize Collection or Map with inaccessible constructor (#​1902)
  • Improve TreeTypeAdapter thread-safety (#​1976)
  • Fix Gson.newJsonWriter ignoring lenient and HTML-safe setting (#​1989)
  • Delete unused LinkedHashTreeMap (#​1992)
  • Make default adapters stricter; improve exception messages (#​2000)
  • Fix FieldNamingPolicy.upperCaseFirstLetter uppercasing non-letter (#​2004)
mockito/mockito (org.mockito:mockito-core)

[v5.23.0](ht

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

@mend-for-github-com mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 3 times, most recently from 323ebea to bd201b7 Compare May 29, 2026 11:08
@mend-for-github-com mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch 2 times, most recently from 14c15d6 to 0dfe6a4 Compare June 9, 2026 12:31
@mend-for-github-com mend-for-github-com Bot force-pushed the whitesource-remediate/mend-high-confidence-minor-and-patch-dependency-updates branch from 0dfe6a4 to a240ebf Compare June 15, 2026 10:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants