[PATCH] Update dependencies in ivy.xml and tools/ivy.xml

[taylor.smock]

ivy.xml​

commons-compress

• Update ​commons-compress to v1.21 from v1.20
  • A new class TarFile provides random access to TAR archives.
  • Commons Compress now ships with a copy of the Pack200 code of the retired Apache Harmony project. The pack200 support in Commons Compress no longer uses the implementation of the Java class library - and thus also works for Java 14 and later.
  • Added new methods supporting java.nio.Path as an alternative to java.io.File to many classes.

OpeningHoursParser

• Update ​OpeningHoursParser from v0.24.0 to v0.26.0

• v0.26.0
  • This release adds a flag to indicate more lenient handling of time ranges with earlier end than start times in strict mode. It does not change the behaviour in non-strict mode. Note: the one parameter variant of OpeningHoursParser.rules maintains the same behaviour as prior releases, you will need to use the two parameter call if you want to set the flag.
• v0.25.0
  • adds missing setOpenEnded method for year ranges
  • throws a parse error on invalid data ranges combining open ended with end date

spotbugs-annotations

• Update ​spotbugs-annotations from v4.3.0 to v4.5.1

svgSalamander

• Update ​svgSalamander from 1.1.2.4 to 1.1.3

wiremock

• Update WireMock from 2.27.2 to 2.31.0. This required a rename, as wiremock is Java 7 compatible, but wiremock-jre8 is not. wiremock-jre8 at v2.31.0 also has support for JUnit 5.
  • ​WireMock 2.28.0
    • Plaintext HTTP/2
    • Drops support for JUnit <= 4.7
    • Drops support for JRE 7-, use wiremock-jre8 instead of wiremock
  • ​WireMock 2.29.0
    • New template helpers
    • Date/time matching
    • Logical AND/OR matching
  • ​WireMock 2.30.0
    • Webhooks extension now in Wiremock core
    • Improved first-run time
  • ​WireMock 2.31.0
    • JUnit 5 support
    • Better support for multi-domain mocking

classgraph

• Update ​classgraph from 4.8.110 to 4.8.138
  • Added Resource#readCloseable which returns a CloseableByteBuffer
  • Better support for running with a SecurityManager
  • Find resources by path glob (ScanResult#getResourcesMatchingWildcard)
  • Allow circumvention of encapsulation in JDK 16+ via jvm-driver (​4.8.124)
  • Java 16+ comptability. This adds ​narcissus as a dependency. Either we have to load it explicitly or we can set ClassGraph.CIRCUMVENT_ENCAPSULTION = true at start.
  • Ability to find class references (i.e., find subclasses of a class)
  • General fix for log4shell (CVE-2021-44228) using system properties (if the LogNode class gets loaded)

JUnit

• Update junit-platform from 1.7.2 to 1.8.2 and junit-jupiter to 5.8.2 from 5.7.2.
  • @Suite support
  • JRE now has Java 18 (enum)
  • JFR support in Java 8 Update 262+
  • @ParameterizedTest can now auto close arguments (i.e., AutoClosable, note: this breaks anything that reuses that parameter...)
  • assertThrowsExactly if we don't want any exception subclasses to be thrown
  • @MethodSource/@ArgumentSource can now have optional names
  • Various CSV source improvements

junit5-system-exit

• Update ​junit5-system-ext from 1.1.1 to 1.1.2
  • Works better with Parameterized tests

equalsverifier

• Update ​equalsverifer from 3.6.1 to 3.7.2
  • Prefab values for java.util.concurrent.Semaphore
  • Works better with anonymous/local inner classes

awaitility

• Update ​awaitility from 4.1.0 to 4.1.1
  • Various bug fixes

tools/ivy.xml​

checkstyle

• Update ​checkstyle from 8.44 to 9.2
  • Removal of EOF token. Testing showed that COMPILATION_UNIT had equivalent behavior for TopLevelJavadocCheck.
  • NoWhitespaceBeforeCaseDefaultColon
  • Various bug fixes

pmd

• Update ​pmd from 6.20 to ​6.41.
  • ASTCommentContainer may be able to be used in the future to replace the custom TopLevelJavadocCheck. Currently experimental, so we probably don't want to use it.
  • Java 17 support (specifically, Sealed Classes). Note: ant task was fixed in 6.41 ("Ant task fails with Java17")
  • New rules
    • PrimitiveWrapperInstantiation
    • SimplifiableTestAssertion
    • ReturnEmptyCollectionRatherThanNull (I've explicitly disabled this, as some parts of JOSM return null right now, and I'd rather make this diff as minimal as possible)
    • Junit5TestShouldBePackagePrivate
    • CognitiveComplexity (also disabled due to many positives in JOSM source)
    • MutableStaticState (also diabled due to positives in JOSM source)
    • UseStandardCharsets
    • UnusedAssignment
    • UnnecessaryCast (also disabled due to positives in JOSM source)
    • AvoidCalendarDateCreation
    • UseIOStreamsWithApacheCommonsFileItem
    • LiteralsFirstInComparisons
  • Java 16 support (pattern matching/records)
  • Java 15 support (text blocks)
  • Java 14 support (switch expressions)
• josm-ruleset.xml has been updated for PMD 6.40. Where a check is disabled, I've added a reason attribute, so we know why something is disabled. I've also renamed rules, where applicable.

spotbugs

• Update ​spotbugs and spotbugs-ant from 4.2.3 to 4.5.0 (see also spotbugs-annotations above)

• DCN_NULLPOINTER_EXCEPTION now follows SEI Cert rule ERR08-J
• REFL_REFLECTION_INCREASES_ACCESSIBILITY_OF_CLASS was added for SEI Cert rule SEC05-J: Don't use reflection to increase accessibility of classes, methods or fields. Note: This is ignored for ReflectionUtils in pmd rules, but is not ignored with ant spotbugs.
• MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR/MC_OVERRIDABLE_METHOD_CALL_IN_CLONE for SEI cert rules MET05-J and MET06-J: avoid overridable methods in constructors and clone.
• EOS_BAD_END_OF_STREAM_CHECK from SEI CERT rule FIO08-J: avoid converting Stream#read to byte or int, and then checking against -1.

errorprone

• Update ​errorprone from 2.8.1 to 2.10.0
  • New checks:
    • AlwaysThrows
    • StackTraceElementGetClass
    • BareDotMetacharacter
    • DistinctVarargsChecker
    • MalformedInlineTag
    • MemoizeConstantVisitorStateLookups
    • UnicodeEscape (note: I disabled this in a method for DomainValidator)
    • FieldMissingNullable
    • Java8ApiChecker
    • ParameterMissingNullable
    • TooManyParameters
    • TryWithResourcesVariable
    • UnnecessaryFinal
    • VoidMissingNullable
    • DeprecatedVariable
    • PublicApiNamedStreamShouldReturnStream

[skyper]

Replying to taylor.smock:

• Update ​OpeningHoursParser from v0.24.0 to v0.26.0

v0.26.0

This release adds a flag to indicate more lenient handling of time ranges with earlier end than start times in strict mode. It does not change the behaviour in non-strict mode.

Note: the one parameter variant of OpeningHoursParser.rules maintains the same behaviour as prior releases, you will need to use the two parameter call if you want to set the flag.

The parameter description needs to be updated in the wiki, I guess.

[taylor.smock]

Update JUnit5 to 5.8.2, junit5-system-exit to 1.1.2, checkstyle to 9.2, and pmd to 6.41.0

[taylor.smock]

Update svgSalamander from 1.1.2.4 to 1.1.3, spotbugs from 4.5.0 to 4.5.1, wiremock-jre8 from 2.31 to 2.32, classgraph from 4.8.137 to 4.8.138, and equalsverifier from 3.7.2 to 3.8

[taylor.smock]

Fix test-compile error w.r.t. hamcrest. Hamcrest 2.1 removed org.hamcrest.Factory and indicated that it could be safely deleted without effect.

[taylor.smock]

Update spotbugs from 4.5.1 to 4.5.2 (log4j, see also #21657), update equalsverifier from 3.8 to 3.8.1 (fixes and NPE)

[stoecker]

@Vincent: Any objections against applying that patch myself or should I leave this to you?

[taylor.smock]

CI Run: ​https://gitlab.com/smocktaylor/josm/-/merge_requests/14

Compatibility report: ​https://smocktaylor.gitlab.io/-/josm/-/jobs/1893684669/artifacts/compat_reports/JOSM/18329_to_7f40e00688227d31b4db48da3095b59803259964/compat_report.html

It looks like most of the added methods are from pack200 support in commons-compress.

[taylor.smock]

​https://smocktaylor.gitlab.io/-/josm/-/jobs/1893796586/artifacts/compat_reports/JOSM/18329_to_984c4abbd554aa54273d943f542ecbd1940f8c9b/compat_report.html if we drop Pack200.

[taylor.smock]

Exclude Pack200 from commons-compress (depends upon attachment:21596.6.patch​ )

[stoecker]

In 18330/josm:

see #21596 - update spotbugs dependency

[taylor.smock]

Update for r18330

[taylor.smock]

Note: attachment:21596.exclude_pack200.patch​ can be applied on top of attachment:21596.7.patch​, if we want to exclude Pack200.

[Don-vip]

In 18332/josm:

see #21596 - Update dependencies in ivy.xml and tools/ivy.xml (patch by taylor.smock)

[Don-vip]

In 18333/josm:

see #21596 - exclude Pack200 (patch by taylor.smock)

[Don-vip]

Milestone renamed

[Don-vip]

In 18339/josm:

see #21596 - ignore EI_EXPOSE_REP / EI_EXPOSE_REP2 / MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR (too much noise)