dependabot[bot] opened a new pull request, #2719: URL: https://github.com/apache/tomee/pull/2719
Bumps [com.google.code.gson:gson](https://github.com/google/gson) from 2.2.4 to 2.14.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/gson/releases";>com.google.code.gson:gson's releases</a>.</em></p> <blockquote> <h2>Gson 2.14.0</h2> <h2>What's Changed</h2> <ul> <li> <p>Add type adapters for <code>java.time</code> classes by <a href="https://github.com/eamonnmcmanus";><code>@eamonnmcmanus</code></a> in <a href="https://redirect.github.com/google/gson/pull/2948";>google/gson#2948</a></p> <p>When the <code>java.time</code> API is available, Gson automatically can read and write instances of classes like <code>Instant</code> and <code>Duration</code>. The format it uses essentially freezes the JSON representation that <code>ReflectiveTypeAdapterFactory</code> established by default, based on the private fields of <code>java.time</code> classes. That's not a great representation, but it is understandable. Changing it to anything else would break compatibility with systems that are expecting the current format.</p> <p>With this change, Gson no longer tries to access private fields of these classes using reflection. So it is no longer necessary to run with <code>--add-opens</code> for these classes on recent JDKs.</p> </li> <li> <p>Remove <code>com.google.gson.graph</code> by <a href="https://github.com/eamonnmcmanus";><code>@eamonnmcmanus</code></a> in <a href="https://redirect.github.com/google/gson/pull/2990";>google/gson#2990</a>.</p> <p>This package was not part of any released artifact and depended on Gson internals in potentially problematic ways.</p> </li> <li> <p>Validate that strings being parsed as integers consist of ASCII characters by <a href="https://github.com/eamonnmcmanus";><code>@eamonnmcmanus</code></a> in <a href="https://redirect.github.com/google/gson/pull/2995";>google/gson#2995</a></p> <p>Previously, strings could contain non-ASCII Unicode digits and still be parsed as integers. That's inconsistent with how JSON numbers are treated.</p> </li> <li> <p>Fix duplicate key detection when first value is null by <a href="https://github.com/andrewstellman";><code>@andrewstellman</code></a> in <a href="https://redirect.github.com/google/gson/pull/3006";>google/gson#3006</a></p> <p>This could potentially break code that was relying on the incorrect behaviour. For example, this JSON string was previously accepted but will no longer be: <code>{"foo": null, "foo": bar}</code>.</p> </li> <li> <p>Remove <code>Serializable</code> from internal <code>Type</code> implementation classes. by <a href="https://github.com/eamonnmcmanus";><code>@eamonnmcmanus</code></a> in <a href="https://redirect.github.com/google/gson/pull/3011";>google/gson#3011</a></p> <p>The nested classes <code>ParameterizedTypeImpl</code>, <code>GenericArrayTypeImpl</code>, and <code>WildcardTypeImpl</code> in <code>GsonTypes</code> are implementations of the corresponding types (without <code>Impl</code>) in <code>java.lang.reflect</code>. For some reason, they were serializable, even though the <code>java.lang.reflect</code> implementations are not. Having unnecessarily serializable classes could <em>conceivably</em> have been a security problem if they were part of a larger exploit using serialization. (We do not consider this a likely scenario and do not suggest that you need to update Gson just to get this change.)</p> </li> <li> <p>Add <code>LegacyProtoTypeAdapterFactory</code>. by <a href="https://github.com/eamonnmcmanus";><code>@eamonnmcmanus</code></a> in <a href="https://redirect.github.com/google/gson/pull/3014";>google/gson#3014</a></p> <p>This is not part of any released artifact, but may be of use when trying to fix code that is currently accessing the internals of protobuf classes via reflection.</p> </li> <li> <p>Make AppendableWriter do flush and close if delegation object supports by <a href="https://github.com/MukjepScarlet";><code>@MukjepScarlet</code></a> in <a href="https://redirect.github.com/google/gson/pull/2925";>google/gson#2925</a></p> </li> </ul> <h2>Other less visible changes</h2> <ul> <li>Add default capacity to EnumTypeAdapter maps by <a href="https://github.com/MukjepScarlet";><code>@MukjepScarlet</code></a> in <a href="https://redirect.github.com/google/gson/pull/2959";>google/gson#2959</a></li> <li>refactor: move derived adapters from Gson to TypeAdapters by <a href="https://github.com/MukjepScarlet";><code>@MukjepScarlet</code></a> in <a href="https://redirect.github.com/google/gson/pull/2951";>google/gson#2951</a></li> <li>Optimize <code>new Gson()</code> by <a href="https://github.com/MukjepScarlet";><code>@MukjepScarlet</code></a> in <a href="https://redirect.github.com/google/gson/pull/2864";>google/gson#2864</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ThirdGoddess";><code>@ThirdGoddess</code></a> made their first contribution in <a href="https://redirect.github.com/google/gson/pull/2944";>google/gson#2944</a></li> <li><a href="https://github.com/lmj798";><code>@lmj798</code></a> made their first contribution in <a href="https://redirect.github.com/google/gson/pull/2988";>google/gson#2988</a></li> <li><a href="https://github.com/Eng-YasminKotb";><code>@Eng-YasminKotb</code></a> made their first contribution in <a href="https://redirect.github.com/google/gson/pull/3005";>google/gson#3005</a></li> <li><a href="https://github.com/andrewstellman";><code>@andrewstellman</code></a> made their first contribution in <a href="https://redirect.github.com/google/gson/pull/3006";>google/gson#3006</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/google/gson/compare/gson-parent-2.13.2...gson-parent-2.14.0";>https://github.com/google/gson/compare/gson-parent-2.13.2...gson-parent-2.14.0</a></p> <h2>Gson 2.13.2</h2> <p>The main changes in this release are just newer dependencies.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/google/gson/blob/main/CHANGELOG.md";>com.google.code.gson:gson's changelog</a>.</em></p> <blockquote> <h1>Change Log</h1> <p>The change log for versions newer than 2.10 is available only on the <a href="https://github.com/google/gson/releases";>GitHub Releases page</a>.</p> <h2>Version 2.10</h2> <ul> <li>Support for serializing and deserializing Java records, on Java ≥ 16. (<a href="https://redirect.github.com/google/gson/pull/2201";>google/gson#2201</a>)</li> <li>Add <code>JsonArray.asList</code> and <code>JsonObject.asMap</code> view methods (<a href="https://redirect.github.com/google/gson/pull/2225";>google/gson#2225</a>)</li> <li>Fix <code>TypeAdapterRuntimeTypeWrapper</code> not detecting reflective <code>TreeTypeAdapter</code> and <code>FutureTypeAdapter</code> (<a href="https://redirect.github.com/google/gson/pull/1787";>google/gson#1787</a>)</li> <li>Improve <code>JsonReader.skipValue()</code> (<a href="https://redirect.github.com/google/gson/pull/2062";>google/gson#2062</a>)</li> <li>Perform numeric conversion for primitive numeric type adapters (<a href="https://redirect.github.com/google/gson/pull/2158";>google/gson#2158</a>)</li> <li>Add <code>Gson.fromJson(..., TypeToken)</code> overloads (<a href="https://redirect.github.com/google/gson/pull/1700";>google/gson#1700</a>)</li> <li>Fix changes to <code>GsonBuilder</code> affecting existing <code>Gson</code> instances (<a href="https://redirect.github.com/google/gson/pull/1815";>google/gson#1815</a>)</li> <li>Make <code>JsonElement</code> conversion methods more consistent and fix javadoc (<a href="https://redirect.github.com/google/gson/pull/2178";>google/gson#2178</a>)</li> <li>Throw <code>UnsupportedOperationException</code> when <code>JsonWriter.jsonValue</code> is not supported (<a href="https://redirect.github.com/google/gson/pull/1651";>google/gson#1651</a>)</li> <li>Disallow <code>JsonObject</code> <code>Entry.setValue(null)</code> (<a href="https://redirect.github.com/google/gson/pull/2167";>google/gson#2167</a>)</li> <li>Fix <code>TypeAdapter.toJson</code> throwing AssertionError for custom IOException (<a href="https://redirect.github.com/google/gson/pull/2172";>google/gson#2172</a>)</li> <li>Convert null to JsonNull for <code>JsonArray.set</code> (<a href="https://redirect.github.com/google/gson/pull/2170";>google/gson#2170</a>)</li> <li>Fixed nullSafe usage. (<a href="https://redirect.github.com/google/gson/pull/1555";>google/gson#1555</a>)</li> <li>Validate <code>TypeToken.getParameterized</code> arguments (<a href="https://redirect.github.com/google/gson/pull/2166";>google/gson#2166</a>)</li> <li>Fix <a href="https://redirect.github.com/google/gson/issues/1702";>#1702</a>: Gson.toJson creates CharSequence which does not implement toString (<a href="https://redirect.github.com/google/gson/pull/1703";>google/gson#1703</a>)</li> <li>Prefer existing adapter for concurrent <code>Gson.getAdapter</code> calls (<a href="https://redirect.github.com/google/gson/pull/2153";>google/gson#2153</a>)</li> <li>Improve <code>ArrayTypeAdapter</code> for <code>Object[]</code> (<a href="https://redirect.github.com/google/gson/pull/1716";>google/gson#1716</a>)</li> <li>Improve <code>AppendableWriter</code> performance (<a href="https://redirect.github.com/google/gson/pull/1706";>google/gson#1706</a>)</li> </ul> <h2>Version 2.9.1</h2> <ul> <li>Make <code>Object</code> and <code>JsonElement</code> deserialization iterative rather than recursive (<a href="https://redirect.github.com/google/gson/pull/1912";>google/gson#1912</a>)</li> <li>Added parsing support for enum that has overridden toString() method (<a href="https://redirect.github.com/google/gson/pull/1950";>google/gson#1950</a>)</li> <li>Removed support for building Gson with Gradle (<a href="https://redirect.github.com/google/gson/pull/2081";>google/gson#2081</a>)</li> <li>Removed obsolete <code>codegen</code> hierarchy (<a href="https://redirect.github.com/google/gson/pull/2099";>google/gson#2099</a>)</li> <li>Add support for reflection access filter (<a href="https://redirect.github.com/google/gson/pull/1905";>google/gson#1905</a>)</li> <li>Improve <code>TypeToken</code> creation validation (<a href="https://redirect.github.com/google/gson/pull/2072";>google/gson#2072</a>)</li> <li>Add explicit support for <code>float</code> in <code>JsonWriter</code> (<a href="https://redirect.github.com/google/gson/pull/2130";>google/gson#2130</a>, <a href="https://redirect.github.com/google/gson/pull/2132";>google/gson#2132</a>)</li> <li>Fail when parsing invalid local date (<a href="https://redirect.github.com/google/gson/pull/2134";>google/gson#2134</a>)</li> </ul> <p>Also many small improvements to javadoc.</p> <h2>Version 2.9.0</h2> <p><strong>The minimum supported Java version changes from 6 to 7.</strong></p> <ul> <li>Change target Java version to 7 (<a href="https://redirect.github.com/google/gson/pull/2043";>google/gson#2043</a>)</li> <li>Put <code>module-info.class</code> into Multi-Release JAR folder (<a href="https://redirect.github.com/google/gson/pull/2013";>google/gson#2013</a>)</li> <li>Improve error message when abstract class cannot be constructed (<a href="https://redirect.github.com/google/gson/pull/1814";>google/gson#1814</a>)</li> <li>Support EnumMap deserialization (<a href="https://redirect.github.com/google/gson/pull/2071";>google/gson#2071</a>)</li> <li>Add LazilyParsedNumber default adapter (<a href="https://redirect.github.com/google/gson/pull/2060";>google/gson#2060</a>)</li> <li>Fix JsonReader.hasNext() returning true at end of document (<a href="https://redirect.github.com/google/gson/pull/2061";>google/gson#2061</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/gson/commit/3ff35d6269894901ab8006258395aafc4b9765cd";><code>3ff35d6</code></a> [maven-release-plugin] prepare release gson-parent-2.14.0</li> <li><a href="https://github.com/google/gson/commit/a3024fde2a5c12b9a9a0b6b914ae4899aa574d81";><code>a3024fd</code></a> Bump the maven group with 13 updates (<a href="https://redirect.github.com/google/gson/issues/3002";>#3002</a>)</li> <li><a href="https://github.com/google/gson/commit/5689ffe44952ca6ed44c595886b9043286311b23";><code>5689ffe</code></a> Bump the github-actions group across 1 directory with 3 updates (<a href="https://redirect.github.com/google/gson/issues/3018";>#3018</a>)</li> <li><a href="https://github.com/google/gson/commit/48db33cbf93af6b2f5b117dfdfd826de47f7229c";><code>48db33c</code></a> Add <code>LegacyProtoTypeAdapterFactory</code>. (<a href="https://redirect.github.com/google/gson/issues/3014";>#3014</a>)</li> <li><a href="https://github.com/google/gson/commit/53d703ee76ca3e951fa4a727307c1f28dbcaf3aa";><code>53d703e</code></a> Update outdated comment regarding serializable types (<a href="https://redirect.github.com/google/gson/issues/3012";>#3012</a>)</li> <li><a href="https://github.com/google/gson/commit/0189b727761f31596d1a27b7c60b42478dc9f331";><code>0189b72</code></a> Remove <code>Serializable</code> from internal <code>Type</code> implementation classes. (<a href="https://redirect.github.com/google/gson/issues/3011";>#3011</a>)</li> <li><a href="https://github.com/google/gson/commit/f4d371d29c04066dbe7fdb31f642831f9c7f40cd";><code>f4d371d</code></a> Fix duplicate key detection when first value is null (<a href="https://redirect.github.com/google/gson/issues/3006";>#3006</a>)</li> <li><a href="https://github.com/google/gson/commit/27d9ba1eeeeb156540cf5397504a4f9f256e911f";><code>27d9ba1</code></a> Fix typo in README (JPMS dependencies section) (<a href="https://redirect.github.com/google/gson/issues/3005";>#3005</a>)</li> <li><a href="https://github.com/google/gson/commit/1fa9b7a0a994b006b3be00e2df9de778e71e6807";><code>1fa9b7a</code></a> Validate that strings being parsed as integers consist of ASCII characters (#...</li> <li><a href="https://github.com/google/gson/commit/b7d59549188867deb42e46073fb38735a5beda1c";><code>b7d5954</code></a> Add iterator fail-fast tests for LinkedTreeMap.clear() (<a href="https://redirect.github.com/google/gson/issues/2992";>#2992</a>)</li> <li>Additional commits viewable in <a href="https://github.com/google/gson/compare/gson-2.2.4...gson-parent-2.14.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
