Changed​

• update jeap-opensearch-client-starter from 2.19.0 to 2.20.0
• Exclude the optional Jackson 2 core and databind dependencies from the OpenSearch Java client.

Changed​

• Update parent from 9.0.0 to 9.0.1
• update jeap-spring-boot-tls-starter from 19.27.0 to 19.28.0
• update jeap-opensearch-index-type from 1.24.0 to 1.25.0
• update jeap-db-schema-publisher from 3.28.0 to 3.29.0
• update jeap-spring-boot-roles-anywhere-starter from 3.29.0 to 3.30.0
• update jeap-spring-boot-db-migration-starter from 19.27.0 to 19.28.0
• update jeap-spring-boot-config-aws-starter from 19.28.0 to 19.29.0
• update jeap-spring-boot-jwe-starter from 1.22.0 to 1.23.0
• update jeap-opensearch-index-type-registry-maven-plugin from 3.5.0 to 3.6.0
• update jeap-spring-boot-starters from 24.19.0 to 24.20.0
• update jeap-open-api-publisher from 7.19.0 to 7.20.0
• update jeap-spring-boot-security-client-starter from 24.19.0 to 24.20.0
• update jeap-opensearch-searchitem-api from 2.18.0 to 2.19.0
• update jeap-starter from 24.19.0 to 24.20.0
• update jeap-opensearch-client-starter from 2.18.0 to 2.19.0
• update jeap-crypto from 10.18.0 to 10.19.0
• update jeap-spring-boot-vault-starter from 24.19.0 to 24.20.0
• update jeap-messaging from 18.0.0 to 18.1.0
• update jeap-server-sent-events from 12.17.0 to 12.18.0
• update jeap-messaging-outbox from 17.17.0 to 17.18.0
• update jeap-reaction-observer from 10.17.0 to 10.18.0
• update jeap-messaging-sequential-inbox from 20.17.0 to 20.18.0
• update jeap-spring-boot-security-starter from 24.19.0 to 24.20.0
• update jeap-audit from 10.16.0 to 10.17.0

Changed​

• update jeap-spring-boot-starters from 24.18.0 to 24.19.0
  • Fix failing token introspection when a client id contains colons by URL-encoding the client id and secret before using them as basic auth credentials (see RFC 6749).
• update jeap-messaging from 17.16.0 to 18.0.0
• Update parent from 8.13.0 to 9.0.0, which updates Avro from 1.12.1 to 1.12.2
  • Breaking test change: Major release because this parent updates jeap-messaging from 17.16.0 to 18.0.0, which introduces the Avro class whitelist. Tests without a Spring context that build, serialize or deserialize a generated Avro message have to install the whitelist themselves, see the notes below.
• Avro 1.12.2 only resolves classes from a schema when they are trusted, so jEAP Messaging installs an Avro ClassSecurityValidator whitelist. Trusted are the Avro generated types in ch.admin.bit.jeap and - as long as nothing is configured - in ch.admin, the common JDK collection and value types (UUID, java.time, the legacy java.util.Date / java.sql date types) that a schema can reference via java-class / java-key-class, and whatever jeap.messaging.avro.trusted-packages / jeap.messaging.avro.trusted-classes name - those regardless of whether the class is Avro generated. Being an Avro generated type narrows the built-in packages, it never trusts a class on its own.
• Tests without a Spring context have to install the avro class whitelist themselves. A plain unit test that builds, serializes or deserializes a generated Avro message now fails with SecurityException: Forbidden ... unless it installs the whitelist first:

  @BeforeAll
  static void installAvroClassWhitelist() {
      AvroClassSecurity.installDefaultIfMissing();
  }
  

Stay tuned for upcoming posts.