Update Info

SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-2568


Security update for mockito, snakeyaml, testng


Type: security
Severity: important
Issued: 2024-07-22
Description:
This update for mockito, snakeyaml, testng fixes the following issues:

mockito was updated to version 5.11.0:

- Added bundle manifest to the mockito-core artifact
- Mockito 5 is making core changes to ensure compatibility with future JDK versions.
- Switch the Default MockMaker to mockito-inline (not applicable to mockito-android)

  * Mockito 2.7.6 introduced the mockito-inline mockmaker based on the "inline bytecode" principle, offering
    compatibility advantages over the subclass mockmaker
  * This change avoids JDK restrictions, such as violating module boundaries and leaking subclass creation

- Legitimate use cases for the subclass mockmaker:

  * Scenarios where the inline mockmaker does not function, such as on Graal VM's native image
  * If avoiding mocking final classes, the subclass mockmaker remains a viable option, although issues may arise on
    JDK 17+
  * Mockito aims to support both mockmakers, allowing users to choose based on their requirements.

- Update the Minimum Supported Java Version to 11

  * Mockito 5 raised the minimum supported Java version to 11
  * Community member @reta contributed to this change.
  * Users still on JDK 8 can continue using Mockito 4, with minimal API differences between versions

- New type() Method on ArgumentMatcher

  * The ArgumentMatcher interface now includes a new type() method to support varargs methods, addressing previous
    limitations
  * Users can now differentiate between matching calls with any exact number of arguments or match any number of
    arguments
  * Mockito 5 provides a default implementation of the new method, ensuring backward compatibility.
  * No obligation for users to implement the new method; Mockito 5 considers Void.type by default for varargs handling
  * ArgumentCaptor is now fully type-aware, enabling capturing specific subclasses on a generic method.

- byte-buddy does not bundle asm, but uses objectweb-asm as external library

snake-yaml was updated to version 2.2:

- Changes of version 2.2:

  * Define default scalar style as PLAIN (for polyglot Maven)
  * Add missing 'exports org.yaml.snakeyaml.inspector' to module-info.java

- Changes of version 2.1:

  * Heavy Allocation in Emitter.analyzeScalar(String) due to Regex Overhead
  * Use identity in toString() for sequences to avoid OutOfMemoryError
  * NumberFormatException from SnakeYAML due to int overflow for corrupt YAML version
  * Document size limit should be applied to single document notthe whole input stream
  * Detect invalid Unicode code point (thanks to Tatu Saloranta)
  * Remove Trusted*Inspector classes from main sources tree

- Changes of version 2.0:

  * Rollback to Java 7 target
  * Add module-info.java
  * Migrate to Java 8
  * Remove many deprecated constructors
  * Remove long deprecated methods in FlowStyle
  * Do not allow global tags by default
  * Yaml.LoadAs() signature to support Class<? super T> type instead of Class<T>
  * CustomClassLoaderConstructor takes LoaderOptions
  * Check input parameters for non-null values

testng was updated to version 7.10.1:

- Security issues fixed:

  * CVE-2022-4065: Fixed Zip Slip Vulnerability (bsc#1205628)

- Changes of version 7.10.1:

  * Fixed maven build with junit5

- Changes of version 7.10.0:

  * Minor discrepancy fixes
  * Deleting TestNG eclipse plugin specific classes
  * Remove deprecated JUnit related support in TestNG
  * Handle exceptions in emailable Reporter
  * Added wrapperbot and update workflow order
  * Support ITestNGFactory customisation
  * Streamlined data provider listener invocation
  * Streamlined Guice Module creation in concurrency.
  * Copy test result attributes when unexpected failures
  * chore: use explicit dependency versions instead of refreshVersions
  * Removed Ant
  * Support ordering of listeners
  * Added errorprone
  * Allow custom thread pool executors to be wired in.
  * Allow data providers to be non cacheable
  * Use Locks instead of synchronised keyword
  * Document pgp artifact signing keys
  * Added Unique Id for all test class instances
  * Added issue management workflows
  * Map object to configurations
  * Allow listeners to be disabled at runtime
  * Streamlined Data Provider execution
  * Honour inheritance when parsing listener factories
  * Tweaks around accessing SuiteResult
  * Streamlined random generation
  * Streamlined dependencies for configurations

- Changes of version 7.9.0:

  * Fixed maps containing nulls can be incorrectly considered equal
  * Test Results as artifacts for failed runs
  * Fixed data races
  * Dont honour params specified in suite-file tag
  * Decouple SuiteRunner and TestRunner
  * Disable Native DI for BeforeSuite methods
  * Streamlined running Parallel Dataproviders+retries
  * Removed extra whitespace in log for Configuration.createMethods()
  * Added the link for TestNG Documentation's GitHub Repo in README.md
  * FirstTimeOnlyConfig methods + Listener invocations
  * Added overrideGroupsFromCliInParentChildXml test
  * Ensure thread safety for attribute access
  * Added @inherited to the Listeners annotation
  * Restrict Group inheritance to Before|AfterGroups
  * Ensure ITestResult injected to @AfterMethod is apt
  * Support suite level thread pools for data provider
  * Favour CompletableFuture instead of PoolService
  * Favour FutureTask for concurrency support
  * Shared Threadpool for normal/datadriven tests.
  * Abort for invalid combinations

- Changes of version 7.8.0:

  * [Feature] Not exception but warning if some (not all) of the given test names are not found in suite files.
  * [Feature] Generate testng-results.xml per test suite
  * [Feature] Allow test classes to define "configfailurepolicy" at a per class level
  * XmlTest index is not set for test suites invoked with YAML
  * Listener's onAfterClass is called before @afterclass configuration methods are executed.
  * After upgrading to TestNG 7.5.0, setting ITestResult.status to FAILURE doesn't fail the test anymore
  * JUnitReportReporter should capture the test case output at the test case level
  * TestNG.xml doesn't honour Parallel value of a clone
  * before configuration and before invocation should be 'SKIP' when beforeMethod is 'skip'
  * Test listeners specified in parent testng.xml file are not included in testng-failed.xml file
  * Discrepancies with DataProvider and Retry of failed tests
  * Skipped Tests with DataProvider appear as failed
  * testng-results xml reports config skips from base classes as ignored
  * Feature: Check that specific object present in List
  * Upgraded snakeyaml to 2.0

- Changes of version 7.7.1:

  * Streamline overloaded assertion methods for Groovy

- Changes of version 7.7.0:

  * Replace FindBugs by SpotBugs
  * Gradle: Drop forUseAtConfigurationTime()
  * Added ability to provide custom message to assertThrows\expectThrows methods
  * Only resolve hostname once
  * Prevent overlogging of debug msgs in Graph impl
  * Streamlined dataprovider invoking in abstract classes
  * Streamlined TestResult due to expectedExceptions
  * Unexpected test runs count with retry analyzer
  * Make PackageUtils compliant with JPMS
  * Ability to retry a data provider during failures
  * Fixing bug with DataProvider retry
  * Added config key for callback discrepancy behavior
  * Fixed FileAlreadyExistsException error on copy
  * JarFileUtils.delete(File f) throw actual exception (instead of FileNotFound) when file cannot be deleted #2825
  * Changing assertion message of the osgitest
  * Enhancing the Matrix
  * Avoid Compilation errors on Semeru JDK flavour.
  * Add addition yml extension
  * Support getting dependencies info for a test
  * Honour regex in dependsOnMethods
  * Ensure All tests run all the time
  * Deprecate support for running Spock Tests
  * Streamline dependsOnMethods for configurations
  * Ensure ITestContext available for JUnit4 tests
  * Deprecate support for running JUnit tests
  * Changes of 7.6.1
  * Fix Files.copy() such that parent dirs are created
  * Remove deprecated utility methods

- Changes of version 7.6.0:

  * Remove redundant Parameter implementation
  * Upgraded to JDK11
  * Move SimpleBaseTest to be Kotlin based
  * Restore testnames when using suites in suite.
  * Moving ClassHelperTests into Kotlin
  * IHookable and IConfigurable callback discrepancy
  * Minor refactoring
  * Add additional condition for assertEqualsNoOrder
  * beforeConfiguration() listener method should be invoked for skipped configurations as well
  * Keep the initial order of listeners
  * SuiteRunner could not be initial by default Configuration
  * Enable Dataprovider failures to be considered.
  * BeforeGroups should run before any matched test
  * Fixed possible StringIndexOutOfBoundsException exception in XmlReporter
  * DataProvider: possibility to unload dataprovider class, when done with it
  * Fixed possibilty that AfterGroups method is invoked before all tests
  * Fixed equals implementation for WrappedTestNGMethod
  * Wire-In listeners consistently
  * Streamline AfterClass invocation
  * Show FQMN for tests in console
  * Honour custom attribute values in TestNG default reports



              

Packages


  • mockito-5.11.0-150200.3.7.1