Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build(deps): bump esapi from 2.5.0.0 to 2.5.1.0 #2118

Merged
merged 1 commit into from
Nov 28, 2022

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 28, 2022

Bumps esapi from 2.5.0.0 to 2.5.1.0.

Release notes

Sourced from esapi's releases.

2.5.1.0

Update summary

  1. Updates to latest versions of direct dependencies, including:
  • An update to AntiSamy: 1.7.0 --> 1.7.2
  • An update to SLFJ4 API: 1.7.36 --> 2.0.4 (Note: 2.0.5 is available and likely would would result in "convergence" issues with the version AntiSamy 1.7.2 pulls in)
  1. A new codec (org.owasp.esapi.codecs.JSONCodec) is provided that provides JSON output encoding as per section 7 of RFC 8259. It is made available via Encoder.encodeForJSON(). (Note unlike other encoders, there is no corresponding decoder (i.e., decodeForJSON()) made available. Since that would normally be done by your JavaScript code, it wasn't deemed essential.
  2. Executing 'mvn site' now creates Javadoc for the ESAPI tag library (GitHub issue #733).

Details

For full details, please see the release notes for ESAPI release 2.5.1.0 located at: https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.5.1.0-release-notes.txt

Note the file "esapi-2.5.1.0-configuration.jar" contains the default ESAPI configuration files under 'configuration/' (ESAPI.properties, validation.properties, etc.) and the file "esapi-2.5.1.0-configuration.jar.asc" is a GPG signature of that jar file made by 'Kevin W. Wall (GitHub signing key) kevin.w.wall@gmail.com'.

Commits
  • 958892f Remove '-SNAPSHOT' from new release number.
  • 262a3b5 Minor updates re: commits; trying to get accurate count from changelog.
  • b5a9e6c Minor updates re: commits.
  • 1255174 Add instructions about using scripts to create release notes.
  • 45b5409 Add instructions about using scripts to create release notes.
  • c3637f6 Final clean-up and tweaks to acknowledgements.
  • 5c8abd6 Used to create 2.5.1.0 release notes.
  • 1ebcb62 Initial cut for 2.5.1.0 release.
  • 51e8764 Replace reference to multiple vars files by meta-character shell regex.
  • 7ac060b Update <date.prev_release> for 2.5.0.0 release date.
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [esapi](https://github.com/ESAPI/esapi-java-legacy) from 2.5.0.0 to 2.5.1.0.
- [Release notes](https://github.com/ESAPI/esapi-java-legacy/releases)
- [Changelog](https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.0-readme-crypto-changes.html)
- [Commits](ESAPI/esapi-java-legacy@esapi-2.5.0.0...esapi-2.5.1.0)

---
updated-dependencies:
- dependency-name: org.owasp.esapi:esapi
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Nov 28, 2022
@cf-gitbot
Copy link

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/183898804

The labels on this github issue will be updated when the story is started.

@strehle strehle merged commit 1507459 into develop Nov 28, 2022
@strehle strehle deleted the dependabot/gradle/org.owasp.esapi-esapi-2.5.1.0 branch November 28, 2022 12:16
strehle added a commit that referenced this pull request Feb 28, 2023
There were 2 version, one in KeyInfo, one in JsonWebKey
The version from JsonWebKey was with \r\n instead of only \n

Deleted the version from KeyInfo with PR #2118, fix this now.
Ensure that value entry in token_key is as before
@strehle strehle mentioned this pull request Feb 28, 2023
strehle added a commit that referenced this pull request Feb 28, 2023
There were 2 version, one in KeyInfo, one in JsonWebKey
The version from JsonWebKey was with \r\n instead of only \n

Deleted the version from KeyInfo with PR #2118, fix this now.
Ensure that value entry in token_key is as before
@cf-gitbot cf-gitbot added delivered accepted Accepted the issue and removed delivered labels May 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
accepted Accepted the issue dependencies Pull requests that update a dependency file java Pull requests that update Java code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants