* Upgrade XStream from 1.4.20 to 1.4.21, fixes CVE-2024-47072.
See changelog at https://x-stream.github.io/changes.html#1.4.21
Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>
* Upgrade to Karaf 4.4.5 and Xtext 2.34
Upgrade Karaf from 4.4.4 to 4.4.5:
* Sync runtime dependencies with Karaf 4.4.5, most notably:
* Jetty 9.4.53.v20231009
* JNA 5.14.0
* Pax Logging 2.2.6
* Pax Web 8.0.24
* ASM 9.6
* Resolve itest runbundles
Upgrade Xtext from 2.32 to 2.34
* Sync depencencies, most notably:
* Guava 33.0.0
* classgraph 4.8.165 changing provider to io.github.classgraph
* Migrate old Xtext generator xtext.generator to xtext.xtext.generator
as xtext.generator has been removed from Xtext, affecting
org.openhab.core.model.lazygen
* resolve runbundles
* Remove org.openhab.core.model.lazygen
No longer in use since 2017, see eclipse-archived/smarthome#4122.
Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>
Upgrades Jollyday 0.5.10 (de.jollyday) to 0.23.2 of a more actively maintained fork (de.focus-shift).
* This adds many missing holidays.
* Also removes the workaround for the Danish Great Prayer Day introduced by #3573.
For release notes, see:
https://github.com/focus-shift/jollyday/releasesFixes#3544
Signed-off-by: Wouter Born <github@maindrain.net>
* Simplify assertions
Using the appropriate assertion methods results in less and easier to read code as well as better error messages when assertions fail.
Signed-off-by: Wouter Born <github@maindrain.net>
Stream.toList was introduced in Java 16 and creates an unmodifiable List so it can be used to simplify code whenever the List is not expected to be modified.
Signed-off-by: Wouter Born <github@maindrain.net>
* Sync runtime dependencies with Karaf 4.4.4, most notably:
* Jetty 9.4.52.v20230823
* JNA 5.13.0
* SLF4J 2.0.6
* Pax Logging 2.2.3
* Pax Web 8.0.22
* Resolve itest runbundles
* Use new Pax Web features to simplify dependency management
* Add specs features because Pax Web now depends on "asm"
Signed-off-by: Wouter Born <github@maindrain.net>
Updates json-path from 2.4.0 to 2.8.0
This addresses:
* CVE-2021-27568
* CVE-2021-31684
* CVE-2023-1370
Signed-off-by: Wouter Born <github@maindrain.net>
This is a workaround for JDK-8301341 by using the Java 11 LinkedTransferQueue with the QueueingThreadPoolExecutor in the Core and jUPnP.
Signed-off-by: Wouter Born <github@maindrain.net>
* Closes#3329.
This implements a new optional `cacheable` parameter for these REST endpoints:
- `/rest/items`
- `/rest/things`
- `/rest/rules`
When this parameter is set, a flat list of all elements excluding
non-cacheable fields (e.g. "state", "transformedState", "stateDescription",
"commandDescription" for items, "statusInfo", "firmwareStatus",
"properties" for things, "status" for rules) will be retrieved along with
a `Last-Modified` HTTP response header. When unknown, the Last-Modified
header will be set to the date of the request.
Also only when this parameter is set, and a `If-Modified-Since` header is
found in the request, that header will be compared to the last known
modified date for the corresponding cacheable list. The last modified date
will be reset when any change is made on the elements of the underlying
registry. If the `If-Modified-Since` date is equal or more recent than the
last modified date, then a 304 Not Modified response with no content will
be served instead of the usual 200 OK, informing the client that its
cache is still valid at the provided date.
All other request parameters will be ignored except for "metadata" in the
`/rest/items` endpoint. When a metadata selector is set, the resulting
item list will be considered like a completely different resource, i.e.
it will have its own last modified date. Regarding metadata, the approach
to invalidating last modified dates is very conservative: when any metadata
is changed, all cacheable lists of items will have their last modified date
reset even if the change was in a metadata namespace that wasn't requested.
This also implements the abovedescribed behavior for the
`/rest/ui/components/{namespace}` endpoint, but no `cacheable` parameter
is necessary. The last modified date is tracked by namespace.
Signed-off-by: Yannick Schaus <github@schaus.net>
This addresses CVE-2022-40151 and CVE-2022-41966, see:
https://x-stream.github.io/changes.html#1.4.20
This version also fixes an issue with closing streams so the workaround in GenerateDefaultTranslationsMojoTest is no longer needed.
Signed-off-by: Wouter Born <github@maindrain.net>
* Sync runtime dependencies with Karaf 4.4.3, most notably:
* Jetty 9.4.50.v20221201
* Pax Logging 2.2.0
* Pax Web 8.0.15
* Use OSGi R8 as compile dependency
* Rework Servlets to use Http Whiteboard annotations in favor of proprietary `org.openhab.core.io.http.servlet` classes
* Resolve itest runbundles
Also-by: Jan N. Klug <github@klug.nrw>
Signed-off-by: Wouter Born <github@maindrain.net>
* Raise source level to Java 17 (except for model classes)
* Remove Nashorn script engine
* Upgrade spotless and add jvm options
See https://github.com/diffplug/spotless/issues/834
* Add suppression for findBugs false positive error
* Upgrade xtext to 2.29.0
* Adjust JNA
* Resolve itests
Signed-off-by: Jan N. Klug <github@klug.nrw>
