fix/SOC2-908 - Dependabot vulnerabilities fix - #632
Merged
Conversation
🟡 Risk Classification: MINORApproval route: AI Review + Human Approval Classification reasons
Operational gates
Files analysed: 2 wall-e 2026.06.19-02 · policy |
🔬 Debug — why this classification?Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.
Kinds:
See issue #3 for the proposal to formalise this map as Appendix A of the standards doc. wall-e 2026.06.19-02 · debug |
|
robert-goheen-cko
approved these changes
Aug 4, 2026
david-ruiz-cko
added a commit
that referenced
this pull request
Aug 6, 2026
Release 7.15.0 bundles the 3DS challenge indicator alignment plus a broader refresh of the Sessions model (#631), and a dependency/security update (#632). ### 3DS Challenge Indicator Modeling * Introduced a new `SessionChallengeIndicator` enum in `sessions` to represent all nine possible challenge indicator values for session endpoints, including exemption requests, with detailed documentation for each value. (`src/main/java/com/checkout/sessions/SessionChallengeIndicator.java`) * Updated `ChallengeIndicator` in `common` to clarify its use for payment-related endpoints and to deprecate exemption values, which are now only valid for sessions. Improved documentation for each enum value and marked exemptions as deprecated. (`src/main/java/com/checkout/common/ChallengeIndicator.java`) * Changed the type of the `challengeIndicator` field in both `CreateSessionAcceptedResponse` and `GetSessionResponse` from `ChallengeIndicator` to `SessionChallengeIndicator`, ensuring correct deserialization and alignment with API behaviour. * Removed the now unnecessary imports of `ChallengeIndicator` from `CreateSessionAcceptedResponse`, `GetSessionResponse` and `SessionRequest`. ### Sessions Model Additions * Added Google SPA support with four new classes: `GoogleSpa`, `GoogleSpaInfo`, `GoogleSpaIframe` and `GoogleSpaToken`. (`src/main/java/com/checkout/sessions/GoogleSpa*.java`) * Added the preferred experiences model: `SessionPreferredExperiences`, `Experience`, `ExperienceStatus` and `ExperienceOutcome`. * Added `ThreeDSInfo` and `ThreeDSErrorDetails` to model the 3DS information and error detail objects returned by the session endpoints. * Added the `SessionScheme` enum with the full set of spec values, replacing loosely typed scheme fields. * Extended `SessionRequest` with the new fields (Google SPA, preferred experiences, device information) and fixed the `priorTransactionReference` handling. * Updated `TransactionType` and `SessionsCardMetadataResponse` to match the current spec. ### Documentation * Added comprehensive Javadoc for every field in `CreateSessionAcceptedResponse`, `GetSessionResponse` and `SessionRequest`, clarifying requirements, formats, patterns and default values. ### Test Coverage * New serialization suites: `CreateSessionAcceptedResponseSerializationTest`, `GetSessionResponseSerializationTest`, `SessionRequestSerializationTest`. * New enum conformance suites: `ChallengeIndicatorTest`, `SessionChallengeIndicatorTest`, `SessionSchemeTest`, `TransactionTypeTest`. * Updated the sessions integration tests (`AbstractSessionsTestIT`, `RequestAndGetSessionsTestIT`) for the new indicator type. ### Security and Dependency Update Dependency updates: - sonarqube to 7.3.1.8318 - log4j to `log4j-api:2.25.5`, `log4j-core:2.25.5`, `log4j-slf4j2-impl:2.25.5` Dependabot configuration: * Added a `test-deps` group to combine updates for testing-related dependencies (`org.junit*`, `org.mockito*`, `org.apache.logging.log4j*`, `org.hamcrest*`) into single pull requests. * Increased `open-pull-requests-limit` to 10 for the main package ecosystem. * Added a `github-actions` ecosystem entry with a weekly update schedule.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request updates the sonarcube and log4j dependencies and modifies the
.github/dependabot.ymlconfiguration to improve dependency management by grouping related dependencies and adding support for GitHub Actions. The main changes are:Dependency updates:
Dependency grouping:
test-depsgroup to combine updates for testing-related dependencies (org.junit*,org.mockito*,org.apache.logging.log4j*,org.hamcrest*) into single pull requests, reducing noise and making test dependency updates easier to manage.Dependabot configuration enhancements:
open-pull-requests-limitto 10 for the main package ecosystem, allowing more concurrent dependency update PRs.github-actionsecosystem with a weekly update schedule, enabling automated updates for GitHub Actions workflows.