[dependabot]

Bumps io.javalin:javalin from 7.2.3 to 7.2.4.

Release notes

Sourced from io.javalin:javalin's releases.

javalin-parent-7.2.4

Highlights

This is mostly a security and bug-fix release. Many of the fixes were reported privately and fixed by @​andrewstellman. Thank you!

Behavior changes

These fixes are correct, but they can change what existing apps see:

• Static files: paths that are aliases of a static path (/%73ecret/…, //secret/…, /./secret/…) now return 404 instead of serving the file around a before("/secret/*") handler. With treatMultipleSlashesAsSingleSlash on, static paths containing // now return 404 too (#2665).
• Static files: hostedPath is matched as a whole path segment, so hostedPath = "/assets" no longer serves /assetsX/… (#2672).
• Routing: a HEAD request answered by a GET route now gets the GET route's roles, so it's rejected wherever the GET is (#2668).
• BasicAuthPlugin: with no credentials configured, every request is now rejected. Previously every request was let through (#2666).
• Uploads: UploadedFile.filename() returns only the last path segment, so ../../evil.txt becomes evil.txt (#2675).
• Errors: HttpResponseException messages served as text/html are now HTML-escaped. Plain-text and JSON responses are unchanged (#2669).
• WebSockets: closeSession() throws IllegalArgumentException for close codes that can't be sent, such as WsCloseStatus.RESERVED. Previously the session silently stayed open (#2680).
• Validation: checks no longer run on a null value, so a check that isn't null-safe now returns 400 instead of a 500 from an NPE (#2647).

Additions

• RateLimitPlugin.Config.exceptionFunction lets you choose which HttpResponseException is thrown when a limit is exceeded, for example TooManyRequestsResponse. The default is unchanged (#2651).
• ContentType.APPLICATION_PROBLEM_JSON and ContentType.APPLICATION_PROBLEM_XML, plus ContentType.PROBLEM_JSON and ContentType.PROBLEM_XML as plain strings (#2640).

Also in this release (missing from the list below)

• [content-type] Restore the application/xml lookup to APPLICATION_POM by @​alexjameszhang in #2636
• [http] Add problem+json and problem+xml content types by @​alexjameszhang in #2640
• [static-files] Fix precompressed-file bugs in the Jetty resource handler (219f8c14)
• [seekablewriter] Fix an infinite loop on non-skippable streams, and EOF handling (ec457efb)
• [websocket] Disable automatic pings on the error path (0fdafc31)

Dependencies

Jetty 12.1.14, Jackson 2.22.4 / 3.2.4, SLF4J 2.0.20, Micrometer 1.17.2, ayza 10.1.0 (SSL plugin), and patch updates for the template engines (FreeMarker 2.3.35, Handlebars 4.5.5, JTE 3.2.4, CommonMark 0.31.0). No major-version upgrades.

What's Changed

• [github] Clean up stale docs and CI/dependabot config by @​tipsy in javalin/javalin#2626
• [handlebars] Preserve render API with upgraded loader by @​paulrene in javalin/javalin#2623
• [sse] Synchronize comment emit to prevent frame interleaving by @​tipsy in javalin/javalin#2629
• [concurrency] Make internal executor threads daemon by @​tipsy in javalin/javalin#2630
• [cookies] Don't leak a cookie's SameSite onto other cookies by @​tipsy in javalin/javalin#2631
• [websocket] Fix ineffective lock in automatic-ping manager by @​tipsy in javalin/javalin#2632
• [deps] Read OptionalDependency versions from the pom by @​tipsy in javalin/javalin#2633
• [workflow]: Bump actions/setup-java from 5 to 6 in the dependencies group by @​dependabot[bot] in javalin/javalin#2643
• [deps]: Bump the production-dependencies group with 17 updates by @​dependabot[bot] in javalin/javalin#2644
• [deps]: Bump org.seleniumhq.selenium:selenium-chrome-driver from 4.46.0 to 4.48.0 in the development-dependencies group across 1 directory by @​dependabot[bot] in javalin/javalin#2646
• [jetty] Make JettyServer.started atomic and visible across threads by @​kalayciburak in javalin/javalin#2641
• [static-files] Send Content-Length for streamed static files by @​tipsy in javalin/javalin#2648
• [validation] Don't run checks on a null value by @​tipsy in javalin/javalin#2647
• [workflow]: Bump codecov/codecov-action from 7.0.0 to 7.1.1 in the dependencies group by @​dependabot[bot] in javalin/javalin#2653

... (truncated)

Commits

• 5740f0c [maven-release-plugin] prepare release javalin-parent-7.2.4
• 219116c [tests] Make the HTTP/2 websocket tests send from the client first
• 2136a8f [sse] Close keepAlive clients when the async request errors (#2678) (#2679)
• fda2c92 [websocket] Reject close codes that can't be sent in closeSession() (#2680)
• 6369e5f [ci] Run performance preview cleanup on pull_request_target so fork PRs are c...
• 712f9c8 [ratelimitplugin] Add configurable rate limit exception (#2651)
• dc20f85 [ci] Fix invalid secrets check in the performance preview cleanup workflow (#...
• deab0f0 [deps] Bump minor and patch versions of dependencies and plugins (#2676)
• e67fef9 [static-files] Key the Jetty precompression cache by file (#2673)
• dbad221 [context] Strip directory components from uploaded file names (#2675)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)