dependabot[bot] opened a new pull request, #175: URL: https://github.com/apache/fineract-loan-origination/pull/175
Bumps [io.rest-assured:rest-assured](https://github.com/rest-assured/rest-assured) from 6.0.1 to 6.1.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rest-assured/rest-assured/blob/master/changelog.txt";>io.rest-assured:rest-assured's changelog</a>.</em></p> <blockquote> <h2>Changelog 6.1.0 (2026-10-09)</h2> <ul> <li>Strip sensitive headers (Authorization and Cookie) when a redirect crosses to a different host, so a token or session isn't leaked to the redirect target. This is on by default and can be turned off with RedirectConfig.stripSensitiveHeadersOnCrossHostRedirect(false) (<a href="https://redirect.github.com/rest-assured/rest-assured/issues/1873";>#1873</a>). Thanks to the University of Sydney security research team (Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu) for the report.</li> <li>Fix JsonPath "properties" spread over a list of objects returning null when the first element lacks a "properties" key (e.g. a GeoJSON feature carrying only a geometry), a regression from the Groovy 5 migration (fixes <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1875";>#1875</a>) (thanks to HDPark95 for PR <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1878";>#1878</a>). Thanks to haskiindahouse for the report.</li> <li>Fix JsonPath returning null or Groovy meta-data for a nested "properties" navigation over a list of objects (e.g. items.properties.properties.x) on Groovy 5, because the list spread result was a plain list instead of the proxy list that carries the "properties" workaround forward (fixes <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1879";>#1879</a>) (thanks to kdelay for PR <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1880";>#1880</a>)</li> <li>Fix JsonPath returning -Infinity for finite negative JSON numbers whose magnitude exceeds Float.MAX_VALUE under the default FLOAT_AND_DOUBLE number configuration. The float/double selection compared the signed value against Float.MAX_VALUE, so any such negative number fell into the float branch and overflowed; it now compares the magnitude and promotes to double regardless of sign (fixes <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1874";>#1874</a>) (thanks to kdelay for PR <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1877";>#1877</a>). Thanks to haskiindahouse for the report.</li> <li>Decode JSON responses without an explicit charset as UTF-8 also when the content-type has parameters (e.g. "application/json; version=1") or is a "+json" type (e.g. "application/problem+json", "application/hal+json"). These used to fall back to the default content charset, which garbled non-ASCII characters in the body and in logged responses (related to <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1885";>#1885</a>)</li> <li>Fix MalformedURLException when a request URL has no slash before a query string that contains another URL, e.g. get("<a href="https://example.com?redirect=https://example.com/callback";>https://example.com?redirect=https://example.com/callback</a>") (fixes <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1836";>#1836</a>) (thanks to renechoi for PR <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1881";>#1881</a>)</li> <li>Apply user-configured SSL settings (such as relaxed HTTPS validation, trust/key stores and certificate authentication) when an http request is redirected to https. Previously they were only applied if the original request used https, so the redirected request failed with "PKIX path building failed". For a request that starts as http the SSL settings are only applied when REST Assured's default http client factory is used, so an https scheme registered by a custom HttpClientConfig.httpClientFactory is kept (fixes <a href="https://redirect.github.com/rest-assured/rest-assured/issues/790";>#790</a>)</li> <li>Don't let request specific SSL settings (SSLConfig such as relaxed HTTPS validation, or certificate authentication) leak into later requests when the http client instance is reused (HttpClientConfig.reuseHttpClientInstance()). The client's original https scheme is restored after each request and https connections established with request specific SSL settings are no longer kept alive for reuse.</li> <li>json-schema-validator now supports JSON Schema draft-06, draft-07, 2019-09 and 2020-12 (e.g. const, if/then/else, propertyNames, prefixItems, $defs) using the networknt json-schema-validator (com.networknt:json-schema-validator 2.0.8, which is now a dependency of the module, together with slf4j-api). The draft is taken from the "$schema" keyword of the schema, so draft-03/draft-04 schemas are validated exactly as before. Schemas without "$schema" are still validated as draft-04 unless another version is configured, e.g. matchesJsonSchemaInClasspath("schema.json").using(JsonSchemaVersion.DRAFT_2020_12) or JsonSchemaValidatorSettings.schemaVersion(..). Note that: (1) schemas that already declared a draft-06+ "$schema" were previously validated with draft-04 semantics (newer keywords were ignored) and are now validated according to their declared draft, (2) a configured JsonSchemaFactory and checkedValidation only apply to draft-03/draft-04 schemas, (3) "format" is annotation-only (not validated) in 2019-09 and 2020-12, as required by those specifications (fixes <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1823";>#1823</a>)</li> <li>Add ResponseSpecBuilder.expectHeader(String, ResponseAwareMatcher) and ResponseSpecification.header(String, ResponseAwareMatcher), so a reusable response specification can match a header against a value taken from the response, e.g. expectHeader("Location", response -> endsWith("/users/" + response.path("id"))) (fixes <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1884";>#1884</a>) (thanks to seethinajayadileep for PR <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1887";>#1887</a>)</li> <li>java.time values (LocalDate, Instant, OffsetDateTime, Duration, ZoneId and so on) used as path, query or form parameters, headers or cookies are now sent as their ISO-8601 toString() instead of being run through the object mapper, which quoted them or failed without the JSR-310 module (fixes <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1781";>#1781</a>) (thanks to seethinajayadileep for PR <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1888";>#1888</a>)</li> <li>A value object used as a parameter, header or cookie value that the object mapper serializes to a plain JSON string (for example a record with a <a href="https://github.com/JsonValue";><code>@JsonValue</code></a> accessor) is now sent without the surrounding JSON quotes (fixes <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1818";>#1818</a>)</li> <li>Add support for the HTTP QUERY method (a safe, idempotent method that carries a request body), e.g. given().body(..).when().query("/search"). Method.QUERY and query(..) overloads are added to RestAssured, RequestSender/RequestSpecification, RestAssuredMockMvc and RestAssuredWebTestClient (fixes <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1872";>#1872</a>)</li> <li>Fix path parameters in the Spring WebTestClient module: an unnamed path parameter that isn't a String, e.g. get("/posts/{id}", 42L), no longer fails with a ClassCastException and is serialized the same way as a named path parameter, and path parameter values are no longer encoded twice, so a value such as "John Doe" or "100%" reaches the server unchanged instead of as "John%20Doe" or "100%25" (fixes <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1824";>#1824</a>) (thanks to hantsy for PR <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1825";>#1825</a>)</li> <li>Fix failures when the default locale is Turkish (tr-TR), such as an exception for every response with status code 400 or above and OPTIONS requests sent from a filter or HTTP methods given in lower case, e.g. request("options", ..), not working, by using Locale.ROOT for internal upper and lower case conversions. Cookie.toString() now also formats the Expires attribute as "EEE, dd MMM yyyy HH:mm:ss zzz" in English instead of using the default locale's short date format (thanks to rdmrtn for PR <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1889";>#1889</a>)</li> <li>MultiPartSpecBuilder.charset(Charset) now rejects byte[] and InputStream content with an IllegalArgumentException, like charset(String) already did, instead of silently ignoring the charset (fixes <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1691";>#1691</a>) (thanks to seethinajayadileep for PR <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1886";>#1886</a>)</li> <li>Fix XmlPath and JsonPath not handling a hyphenated element or key name combined with a negative (from-the-end) list index, e.g. "root.some-list[-1]". XmlPath threw "The parameter ... was used but not defined" and JsonPath returned null (fixes <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1876";>#1876</a>) (thanks to kdelay for PR <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1882";>#1882</a>)</li> <li>Fix unnamed path parameters in the Spring MockMvc module not being serialized like named ones, so a value object such as a record with a <a href="https://github.com/JsonValue";><code>@JsonValue</code></a> accessor passed by position, e.g. get("/users/{id}", new Id(42)), was sent as its toString() ("Id[42]") instead of its serialized value ("42"). Note that, as for named path parameters, any other object that isn't a simple value (number, string, boolean, enum, UUID, java.time value etc) passed by position is now serialized by the object mapper instead of using its toString(). In both the Spring MockMvc and WebTestClient modules this also works for multipart requests, since unnamed path parameters are serialized using the explicitly set content type, like named ones, and not the derived "multipart/form-data" (fixes <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1905";>#1905</a>)</li> <li>Fix query parameters in the Spring WebTestClient module not reaching the server as given: a value containing "+", "&", "=" or "{...}", e.g. queryParam("name", "a+b"), was received as "a b", truncated at "&" or failed as a missing URI variable. Query parameters, as well as params and form params that are added to the query string, are now strictly encoded (so reserved characters such as "!" or "," in a value are now sent percent-encoded), and a query parameter without a value, e.g. queryParam("flag"), is sent as "flag" instead of the name of an internal class (fixes <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1904";>#1904</a>)</li> <li>The charset given to MultiPartSpecBuilder.charset(..) is now sent in the Content-Type of a File multi-part (e.g. "text/plain; charset=UTF-8"). Previously it was silently ignored for File content and only applied to String content. Other parameters of the part mime-type (e.g. "application/xml; version=2") are now also kept when a charset is specified, instead of being dropped (fixes <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1903";>#1903</a>)</li> <li>Fix XmlPath and JsonPath not handling a list range with a negative end that is followed by more path, e.g. "root.some-list[0..-1].sub-el" or "list[-2..-1].x". The dots in the range were treated as path separators, so XmlPath threw "The parameter ... was used but not defined" (or a Groovy compilation error) and JsonPath returned null or failed. JsonPath now also supports a range on a root array, e.g. "[0..1].x", and chained indexes after a hyphenated name, e.g. "some-list[0][1].x" (fixes <a href="https://redirect.github.com/rest-assured/rest-assured/issues/1906";>#1906</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rest-assured/rest-assured/commit/77653797df97db529108ed4fa76c5cbd0b09d42b";><code>7765379</code></a> [maven-release-plugin] prepare release rest-assured-6.1.0</li> <li><a href="https://github.com/rest-assured/rest-assured/commit/a52e86fe769f257a5c81eb7a111657a3939344f4";><code>a52e86f</code></a> [ci skip] Preparing changelog for release</li> <li><a href="https://github.com/rest-assured/rest-assured/commit/d9e1a3e924492930f6740c60d831825a69d0b65f";><code>d9e1a3e</code></a> Serialize unnamed path params like named ones in MockMvc (<a href="https://redirect.github.com/rest-assured/rest-assured/issues/1910";>#1910</a>)</li> <li><a href="https://github.com/rest-assured/rest-assured/commit/a78ec8033424015e57d510b0e114ceaeb722a106";><code>a78ec80</code></a> Strictly encode query parameters in WebTestClient (<a href="https://redirect.github.com/rest-assured/rest-assured/issues/1908";>#1908</a>)</li> <li><a href="https://github.com/rest-assured/rest-assured/commit/549260a2c69ef2f73b881c1489d4af588f3b4548";><code>549260a</code></a> Send the multipart charset in the Content-Type of File parts (<a href="https://redirect.github.com/rest-assured/rest-assured/issues/1909";>#1909</a>)</li> <li><a href="https://github.com/rest-assured/rest-assured/commit/9335c59ef2a891ef0782a179bbbf40c7934e6c22";><code>9335c59</code></a> Handle list ranges with a negative end followed by more path in XmlPath and J...</li> <li><a href="https://github.com/rest-assured/rest-assured/commit/88410f2b323d0600fd6857abff77c9c33e830a54";><code>88410f2</code></a> Support non-string path params and stop double encoding in WebTestClient (<a href="https://redirect.github.com/rest-assured/rest-assured/issues/1902";>#1902</a>)</li> <li><a href="https://github.com/rest-assured/rest-assured/commit/1437357e80765554ebd932cec59a51b736a864ea";><code>1437357</code></a> Use a fixed locale for case conversions so REST Assured works under Turkish l...</li> <li><a href="https://github.com/rest-assured/rest-assured/commit/ffe66bba0c6d3c62df9b4ac594e5fecbc4cba4ff";><code>ffe66bb</code></a> Validate charset in MultiPartSpecBuilder.charset(Charset) (<a href="https://redirect.github.com/rest-assured/rest-assured/issues/1900";>#1900</a>)</li> <li><a href="https://github.com/rest-assured/rest-assured/commit/9db36774d57bda5d55baee930282712304b05b31";><code>9db3677</code></a> Escape hyphenated XmlPath and JsonPath names with a negative list index (<a href="https://redirect.github.com/rest-assured/rest-assured/issues/1899";>#1899</a>)</li> <li>Additional commits viewable in <a href="https://github.com/rest-assured/rest-assured/compare/rest-assured-6.0.1...rest-assured-6.1.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
