dependabot[bot] opened a new pull request, #3433: URL: https://github.com/apache/maven-surefire/pull/3433
Bumps [org.testng:testng](https://github.com/cbeust/testng) from 7.5 to 7.5.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cbeust/testng/releases";>org.testng:testng's releases</a>.</em></p> <blockquote> <h2>TestNG v7.5.1</h2> <h2>What's Changed</h2> <ul> <li>Cherrypick Zip Slip Vulnerability to 7.5 release by <a href="https://github.com/prashil-g";><code>@prashil-g</code></a> in <a href="https://redirect.github.com/cbeust/testng/pull/2899";>cbeust/testng#2899</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/prashil-g";><code>@prashil-g</code></a> made their first contribution in <a href="https://redirect.github.com/cbeust/testng/pull/2899";>cbeust/testng#2899</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cbeust/testng/compare/7.5...7.5.1";>https://github.com/cbeust/testng/compare/7.5...7.5.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/testng-team/testng/blob/master/CHANGES.txt";>org.testng:testng's changelog</a>.</em></p> <blockquote> <p>Current (7.13.0) Changed: The plain factory methods of org.testng.collections.Lists, Maps and Sets are deprecated for removal in TestNG 8. They are one-line wrappers over a JDK constructor -- Lists.newArrayList() is new ArrayList<>(), Maps.newHashMap() is new HashMap<>(), Sets.newHashSet() is new HashSet<>() -- and each one now carries a javadoc line naming its replacement. TestNG no longer uses any of them internally. The members of those classes that have no JDK equivalent are unaffected and stay supported: Lists.merge, Lists.intersection, the Maps multimap factories, MultiMap/ListMultiMap/SetMultiMap, Objects.toStringHelper and CollectionUtils. org.testng.util.Strings is a different package and is untouched (Julien Herr) New: GITHUB-3344: Lazy (just-in-time) instantiation for <a href="https://github.com/Factory";><code>@Factory</code></a> powered test classes (Krishnan Mahadevan) Changed: GITHUB-3321: YAML suite support moved out of testng-core into a testng-yaml module. testng.jar is unchanged -- the classes are shaded in as before and snakeyaml stays an optional dependency -- but testng-core no longer names YAML anywhere, so the parser cannot drift back into the core module (Julien Herr) Fixed: GITHUB-3321: The set of keys a YAML suite file accepts was whatever XmlSuite and its neighbours happened to expose through public accessors, so "fileName", "parsed" and "parentSuite" were suite keys, "index", "suite" and "xmlSuite" were test keys, "name" on a method selector silently meant "className", and adding a setter to the model silently extended the file format. The keys are now declared in one place and anything else is reported with the list of the accepted ones (Julien Herr) Changed: GITHUB-3321: A test's dependency groups are written under "dependencyGroups" rather than "xmlDependencyGroups", which was named after the field it lands in. The old spelling is still read, with a deprecation warning, as are "xmlPackages", "xmlClasses" and a method selector's "name" (Julien Herr) Fixed: GITHUB-3321: A YAML parameter is now read as text, as it is in testng.xml. An unquoted "44.0" or "true" used to be resolved to a Double or a Boolean and stored in a Map<String, String> through the erased setter, where it threw on the first caller that read the map as strings (Julien Herr) Fixed: GITHUB-3321: A key declared twice in a YAML suite file is now rejected, including under two different spellings of the same key -- "packages" next to "xmlPackages", "classes" next to "xmlClasses", "dependencyGroups" next to "xmlDependencyGroups", or a method selector's "className" next to "name". Whichever came second used to overwrite the first without a word, so a file declaring "tests" twice silently ran half of what it said (Julien Herr) Fixed: GITHUB-3321: A malformed YAML suite file, or one using a key outside the schema, is now reported as a TestNGException like a malformed XML one, instead of letting a snakeyaml exception escape through ISuiteParser (Julien Herr) Fixed: GITHUB-3321: Yaml.toYaml() dropped a test-level "time-out" and a suite-level "group-by-instances" although both can be read back, so converting a suite to YAML and back lost them (Julien Herr) Fixed: GITHUB-3316: close DTD resolver resources and bound connection waits (w3lld1) Fixed: GITHUB-3318: Yaml.toYaml() produced YAML that could not be read back -- a duplicated "packages" key, sequence items written without "- ", <!-- raw HTML omitted --> keys indented at the column of the item they belong to, package filters written without a colon and under the plural keys "includes"/"excludes" the reader does not bind, and "suite-files" written under an unknown key and only for a suite that has child suites. The writer now builds a document and lets snakeyaml emit it, so quoting, escaping and indentation are correct by construction: a parameter valued "a,b" no longer reads back as two entries, and one valued "44.0" no longer reads back as a Double (Julien Herr) New: GITHUB-3318: The YAML writer now also emits the suite-level groups, preserve-order, parent-module, guice-stage, allow-return-values, share-thread-pool-for-data-providers, the method selectors at both levels, class parameters and include descriptions, all of which were silently dropped (Julien Herr) Fixed: DTD validation of suite files was silently disabled: the SAX validation feature was probed under an "https" identifier that no parser recognizes, so setValidating(true) was never reached and violations went unreported. Validation is enabled again, with a new testng.xml.validation=off|warn|strict system property; the default "warn" reports violations without failing the run (Julien Herr) Fixed: XmlSuite.toXml() dropped the "description" attribute of <!-- raw HTML omitted -->, so regenerating a suite (testng-failed.xml, for instance) lost method descriptions (Julien Herr) Fixed: XmlSuite.toXml() dropped a <!-- raw HTML omitted --> priority of -1 while the parser reads a missing priority as 0. Since a negative method-selector priority changes selector evaluation, serializing a suite and reading it back altered its behaviour (Julien Herr) Fixed: The doctype written by XmlSuite.toXml() advertised testng-1.0.dtd although the parser always resolves testng-1.1.dtd (Julien Herr) Fixed: XmlSuite.toXml() emitted two sibling <!-- raw HTML omitted --> elements for a suite that has suite-level groups, which the DTD allows only once, so TestNG's own output did not validate (Julien Herr) Fixed: DTD violations were discarded for suite files pointing at their own copy or a mirror of the DTD rather than at testng.org, so those suites were never validated (Julien Herr) New: GITHUB-3319: testng.xml now has an XSD, testng-1.1.xsd, shipped next to testng-1.1.dtd and mirroring it declaration for declaration, for the tools that cannot consume a DTD. The DTD stays authoritative for files carrying a doctype; a test validates the whole suite corpus under both schemas and fails when the two stop agreeing (Julien Herr) Fixed: Suite files pointing at their own copy or a mirror of the DTD were told to add a <!DOCTYPE> they already declared (Julien Herr) Fixed: A suite whose doctype had only an internal subset was treated as having none: advised to add a <!DOCTYPE> it already declared, and its DTD violations discarded even under strict validation (Julien Herr) New: Added round trip characterization tests covering every suite file of the test corpus, so that XML serialization can be refactored safely (Julien Herr) Fixed: GITHUB-3138: Clarified that class-level <a href="https://github.com/Ignore";><code>@Ignore</code></a> applies to subclasses, not nested classes (ShinyHero666) New: Added OpenRewrite to the build with a hand-picked recipe list (see rewrite.yml), and applied it to the main sources (Julien Herr) Fixed: Remove leftover dead JUnit code: the deprecated unused ConversionUtils and orphaned JUnit test samples, following the removal of JUnit execution support in 7.10.0 (Julien Herr) New: Extract the command line front end out of testng-core into the new testng-cli and testng-jcommander modules, so that testng-core no longer depends on JCommander (Julien Herr)</p> <ul> <li>org.testng.TestNG.main now delegates to an org.testng.ITestNGCliRunner looked up through the ServiceLoader. The reference implementation is bundled inside the org.testng:testng jar, so "java -cp testng.jar org.testng.TestNG suite.xml" is unchanged. Repackaging testng.jar without META-INF/services/org.testng.ITestNGCliRunner now disables the command line.</li> <li>testng-core no longer brings org.jcommander:jcommander transitively. Embedders that drive TestNG through its Java API drop a dependency; those that relied on it being on the classpath have to declare it.</li> <li>Deprecated: TestNG.main, TestNG.privateMain, org.testng.CommandLineArgs (use org.testng.cli.CliOptions), TestNG.configure(CommandLineArgs) (use org.testng.cli.CliConfigurer) and TestNG.validateCommandLineParameters. They all remain available and are scheduled for removal in 8.0; see the behaviour changes listed below.</li> <li>TestNG.validateCommandLineParameters now reports failures as org.testng.TestNGException instead of JCommander's ParameterException. Both are unchecked, so the signature is unchanged, but a caller catching ParameterException no longer catches it.</li> <li>TestNG gained setListenerComparatorClass, setListenerFactoryClass, setExecutorServiceFactoryClass and setInjectorFactoryClass, which instantiate through the object factory in use. They are named rather than overloaded so that existing calls passing a bare null keep compiling.</li> <li>TestNG.setThreadCount now raises a TestNGException for a value below 1 instead of printing the usage banner and calling System.exit(1). The command line output is unchanged, since TestNG.main turns that exception into the same message and exit code; embedders get an exception they can handle.</li> <li>ITestNGCliRunner implementations never terminate the JVM: an unusable command line comes back as a TestNGException. Only TestNG.main turns that into a message, a usage banner and exit code 1, so the observable command line behaviour is unchanged. TestNG.privateMain now throws where it used to exit, which is what an embedder wants.</li> <li>Moved: org.testng.Converter is now org.testng.cli.jcommander.Converter. It is still bundled in testng.jar. Update: Dependency refresh: Guice 6.0.0, JCommander 2.0, snakeyaml 2.6, slf4j-api 2.0.18. Guice 7 and JCommander 3 were skipped: they require jakarta.inject and Java 17 respectively Fixed: GITHUB-3242: use-global-thread-pool no longer refuses to start a suite when the number of data-driven tests reaches thread-count (Krishnan Mahadevan) New: GITHUB-3290: Support data providers that return Stream<Object[]> or Stream<!-- raw HTML omitted -->; the stream is consumed lazily and closed once its rows have been consumed (Krishnan Mahadevan) Update: Building TestNG now requires JDK 25 and uses Gradle 9.6.1; published artifacts still target Java 11 Update: Refreshed the build plugins: Error Prone 5.1.0, SonarQube 7.3.1, Kotlin 2.4.10, AssertJ 3.27.7 Update: GitHub Actions test matrix now covers Java 26 and early-access 27/28, and every action is pinned to a commit SHA Fixed: GITHUB-426: firstTimeOnly <a href="https://github.com/BeforeMethod";><code>@BeforeMethod</code></a> / lastTimeOnly <a href="https://github.com/AfterMethod";><code>@AfterMethod</code></a> were not run as a barrier around a parallel invocationCount thread pool (firstTimeOnly could run concurrently with test invocations, lastTimeOnly ran once per invocation instead of once) Fixed: Time-out now measures a method's own execution time instead of the wall-clock time since dispatch, so thread-pool start-up and scheduling overhead under load no longer cause spurious time-outs; a method that never starts now reports an actionable infrastructure-starvation message Fixed: GITHUB-3166: Skipped configuration methods not receiving the causal throwable before configuration listeners are invoked (Anmol Jain) Fixed: GITHUB-3263: dataProviderClass cache mutation causes subclasses to use wrong data provider when run together (Aleksei Dobrynin) Fixed: GITHUB-3120: ITestNGListenerFactory is broken and never invoked (Krishnan Mahadevan)</li> </ul> <p>7.12.0 Fixed: GITHUB-3231: TestNG retry is going into infinite loop when the data provider returned object is modified before failure (Bartek Florczak) Update: Updated GitHub Actions test matrix to include JDK 25 and JDK 26 EA (Bartek Florczak)</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/testng-team/testng/commit/7ddeadb8e3efaa91a58a1706938fd41d7fea8e7c";><code>7ddeadb</code></a> Attempting Release 7.5.1</li> <li><a href="https://github.com/testng-team/testng/commit/18810fcb2745fcc9d1f7226e956c2aaabeec7f21";><code>18810fc</code></a> Cherrypick - 47afa2c8a29e2cf925238af1ad7c76fba282793f to 7.5 release</li> <li><a href="https://github.com/testng-team/testng/commit/d615583e2d63c809e9cf02357cb5338be24198ab";><code>d615583</code></a> assertEquals(Set,Set) now ignores ordering as it did before, fixes <a href="https://redirect.github.com/cbeust/testng/issues/2643";>#2643</a> (<a href="https://redirect.github.com/cbeust/testng/issues/2648";>#2648</a>)</li> <li><a href="https://github.com/testng-team/testng/commit/573607ba37bdb17f23ac641c5e00eeb742b37a20";><code>573607b</code></a> assertEquals(Set,Set) now ignores ordering as it did before <a href="https://redirect.github.com/cbeust/testng/issues/2643";>#2643</a></li> <li><a href="https://github.com/testng-team/testng/commit/49dbdc9fcc2447d9e2975d6740ac1bb435a861ce";><code>49dbdc9</code></a> Restore BeforeGroups|AfterGroups functionality back</li> <li><a href="https://github.com/testng-team/testng/commit/d9c6e4532e0119a16401e45c6a6e93271dfd68dd";><code>d9c6e45</code></a> Merge pull request <a href="https://redirect.github.com/cbeust/testng/issues/2659";>#2659</a> from RiJo/patch-1</li> <li><a href="https://github.com/testng-team/testng/commit/7308c97ea79d79100f15961799389ef54b2816bb";><code>7308c97</code></a> Bugfix in Assert#assertNotEquals(float, float, float, String)</li> <li><a href="https://github.com/testng-team/testng/commit/80e02ff41021210415a49c488089f05b1aa3dd12";><code>80e02ff</code></a> [GITHUB-2652] Assert methods requires casting since TestNg 7.0 for mixed boxe...</li> <li><a href="https://github.com/testng-team/testng/commit/c1553036aeae8d7cfe4bcb5cac26462b08f52906";><code>c155303</code></a> Fixing formatting issues which caused build failure</li> <li><a href="https://github.com/testng-team/testng/commit/874f36893c56c03f96ec046c13f3722cfeb838da";><code>874f368</code></a> Log skip reason when data provider returns no data</li> <li>Additional commits viewable in <a href="https://github.com/cbeust/testng/compare/7.5...7.5.1";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/maven-surefire/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
