search

detekt / sarif4k

Kotlin data bindings for the Static Analysis Results Interchange Format (SARIF)
Apache License 2.0
15 stars 7 forks source link

Update dependency org.jetbrains.kotlinx:kotlinx-serialization-json to v1.7.1 #43

Open renovate[bot] opened 1 year ago

renovate[bot] commented 1 year ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
org.jetbrains.kotlinx:kotlinx-serialization-json 1.4.1 -> 1.7.1 age adoption passing confidence

Release Notes

Kotlin/kotlinx.serialization (org.jetbrains.kotlinx:kotlinx-serialization-json) ### [`v1.7.1`](https://togithub.com/Kotlin/kotlinx.serialization/compare/v1.7.0...v1.7.1) ### [`v1.7.0`](https://togithub.com/Kotlin/kotlinx.serialization/blob/HEAD/CHANGELOG.md#170--2024-06-05) \================== This release contains all of the changes from 1.7.0-RC and is compatible with Kotlin 2.0. Please note that for reasons explained in the [1.7.0-RC changelog](https://togithub.com/Kotlin/kotlinx.serialization/releases/tag/v1.7.0-RC), it may not be possible to use it with the Kotlin 1.9.x compiler plugin. Yet, it is still fully backwards compatible with previous versions. The only difference with 1.7.0-RC is that `classDiscriminatorMode` property in `JsonBuilder` is marked as experimental, as it should have been when it was introduced ([#​2680](https://togithub.com/Kotlin/kotlinx.serialization/issues/2680)). ### [`v1.6.3`](https://togithub.com/Kotlin/kotlinx.serialization/blob/HEAD/CHANGELOG.md#163--2024-02-16) \================== This release provides a couple of new features and uses Kotlin 1.9.22 as default. ##### Class discriminator output mode Class discriminator provides information for serializing and deserializing [polymorphic class hierarchies](docs/polymorphism.md#sealed-classes). In case you want to encode more or less information for various third party APIs about types in the output, it is possible to control addition of the class discriminator with the `JsonBuilder.classDiscriminatorMode` property. For example, `ClassDiscriminatorMode.NONE` does not add class discriminator at all, in case the receiving party is not interested in Kotlin types. You can learn more about this feature in the documentation and corresponding [PR](https://togithub.com/Kotlin/kotlinx.serialization/pull/2532). ##### Other features - Add kebab-case naming strategy ([#​2531](https://togithub.com/Kotlin/kotlinx.serialization/issues/2531)) (thanks to [Emil Kantis](https://togithub.com/Kantis)) - Add value class support to the ProtoBufSchemaGenerator ([#​2542](https://togithub.com/Kotlin/kotlinx.serialization/issues/2542)) (thanks to [Felipe Rotilho](https://togithub.com/rotilho)) ##### Bugfixes and improvements - Fix: Hocon polymorphic serialization in containers ([#​2151](https://togithub.com/Kotlin/kotlinx.serialization/issues/2151)) (thanks to [LichtHund](https://togithub.com/LichtHund)) - Actualize lenient mode documentation ([#​2568](https://togithub.com/Kotlin/kotlinx.serialization/issues/2568)) - Slightly improve error messages thrown from serializer() function ([#​2533](https://togithub.com/Kotlin/kotlinx.serialization/issues/2533)) - Do not try to coerce input values for properties ([#​2530](https://togithub.com/Kotlin/kotlinx.serialization/issues/2530)) - Make empty objects and arrays collapsed in pretty print mode ([#​2506](https://togithub.com/Kotlin/kotlinx.serialization/issues/2506)) - Update Gradle dokka configuration to make sure "source" button is visible in all API docs ([#​2518](https://togithub.com/Kotlin/kotlinx.serialization/issues/2518), [#​2524](https://togithub.com/Kotlin/kotlinx.serialization/issues/2524)) ### [`v1.6.2`](https://togithub.com/Kotlin/kotlinx.serialization/compare/v1.6.1...v1.6.2) ### [`v1.6.1`](https://togithub.com/Kotlin/kotlinx.serialization/blob/HEAD/CHANGELOG.md#161--2023-11-15) \================== This release uses Kotlin 1.9.20 by default, while upcoming 1.9.21 is also supported. ##### Trailing commas in Json Trailing commas are one of the most popular non-spec Json variations. A new configuration flag, `allowTrailingComma`, makes Json parser accept them instead of throwing an exception. Note that it does not affect encoding, so kotlinx.serialization always produces Json without trailing commas. See details in the corresponding [PR](https://togithub.com/Kotlin/kotlinx.serialization/pull/2480) ##### Support of WasmJs target Kotlin/Wasm has been experimental for some time and gained enough maturity to be added to the kotlinx libraries. Starting with 1.6.1, kotlinx.serialization provides a wasm-js flavor, so your projects with Kotlin/Wasm can have even more functionality. As usual, just add serialization dependencies to your build and [declare wasmJs target](https://kotlinlang.org/docs/whatsnew1920.html#new-wasm-wasi-target-and-the-renaming-of-the-wasm-target-to-wasm-js). Please remember that Kotlin/Wasm is still experimental, so changes are expected. ##### Bugfixes and improvements - Fix TaggedDecoder nullable decoding ([#​2456](https://togithub.com/Kotlin/kotlinx.serialization/issues/2456)) (thanks to [Phillip Schichtel](https://togithub.com/pschichtel)) - Fix IllegalAccessException for some JPMS boundaries ([#​2469](https://togithub.com/Kotlin/kotlinx.serialization/issues/2469)) - Cbor: check if inline value classes are marked as [@​ByteString](https://togithub.com/ByteString) ([#​2466](https://togithub.com/Kotlin/kotlinx.serialization/issues/2466)) (thanks to [eater](https://togithub.com/the-eater)) - Improve polymorphic deserialization optimization ([#​2481](https://togithub.com/Kotlin/kotlinx.serialization/issues/2481)) - Update Okio dependency to 3.6.0 ([#​2473](https://togithub.com/Kotlin/kotlinx.serialization/issues/2473)) - Add protobuf conformance tests ([#​2404](https://togithub.com/Kotlin/kotlinx.serialization/issues/2404)) (thanks to [Doğaç Eldenk](https://togithub.com/Dogacel)) - Support decoding maps with boolean keys ([#​2440](https://togithub.com/Kotlin/kotlinx.serialization/issues/2440)) ### [`v1.6.0`](https://togithub.com/Kotlin/kotlinx.serialization/blob/HEAD/CHANGELOG.md#160--2023-08-22) \================== This release contains all features and bugfixes from [1.6.0-RC](https://togithub.com/Kotlin/kotlinx.serialization/releases/tag/v1.6.0-RC) plus some bugfixes on its own (see below). Kotlin 1.9.0 is used as a default, while 1.9.10 is also supported. ##### Bugfixes - Improve error messages from Json parser ([#​2406](https://togithub.com/Kotlin/kotlinx.serialization/issues/2406)) - Mark [@​SerialName](https://togithub.com/SerialName), [@​Required](https://togithub.com/Required) and [@​Transient](https://togithub.com/Transient) with [@​MustBeDocumented](https://togithub.com/MustBeDocumented) ([#​2407](https://togithub.com/Kotlin/kotlinx.serialization/issues/2407)) - Ensure that no additional files except java compiler output get into multi-release jar ([#​2405](https://togithub.com/Kotlin/kotlinx.serialization/issues/2405)) - Fix enums with negative numbers in protobuf not serializing & de-serializing ([#​2400](https://togithub.com/Kotlin/kotlinx.serialization/issues/2400)) (thanks to [Doğaç Eldenk](https://togithub.com/Dogacel)) ### [`v1.5.1`](https://togithub.com/Kotlin/kotlinx.serialization/blob/HEAD/CHANGELOG.md#151--2023-05-11) \================== This release contains an important Native targets overhaul, as well as numerous enhancements and bugfixes. Kotlin 1.8.21 is used by default. ##### New set of Native targets The official [Kotlin target support policy](https://kotlinlang.org/docs/native-target-support.html) has recently been published describing new target policy: each target belongs to a certain *tier*, and different tiers have different stability guarantees. The official recommendation for library authors is to support targets up to Tier 3, and kotlinx.serialization now follows it. It means that in this release, there are a lot of new targets added from this tier, such as `androidNativeX86` or `watchosDeviceArm64`. Note that since they belong to Tier 3, they're not auto-tested on CI. kotlinx.serialization also ships some deprecated Kotlin/Native targets that do not belong to any tier (e.g. `iosArm32`, `mingwX86`). We'll continue to release them, but we do not provide support for them, nor do we plan to add new targets from the deprecated list. ##### Improvements in Json elements There are two new function sets that should make creating raw Json elements easier. [First one](https://togithub.com/Kotlin/kotlinx.serialization/pull/2160) contains overloads for `JsonPrimitive` constructor-like function that accept unsigned types: `JsonPrimitive(1u)`. [Second one](https://togithub.com/Kotlin/kotlinx.serialization/pull/2156) adds new `addAll` functions to `JsonArrayBuilder` to be used with collections of numbers, booleans or strings: `buildJsonArray { addAll(listOf(1, 2, 3)) }` Both were contributed to us by [aSemy](https://togithub.com/aSemy). ##### Other enhancements - **Potential source-breaking change**: Rename json-okio `target` variables to `sink` ([#​2226](https://togithub.com/Kotlin/kotlinx.serialization/issues/2226)) - Function to retrieve KSerializer by KClass and type arguments serializers ([#​2291](https://togithub.com/Kotlin/kotlinx.serialization/issues/2291)) - Added FormatLanguage annotation to Json methods ([#​2234](https://togithub.com/Kotlin/kotlinx.serialization/issues/2234)) - Properties Format: Support sealed/polymorphic classes as class properties ([#​2255](https://togithub.com/Kotlin/kotlinx.serialization/issues/2255)) ##### Bugfixes - KeyValueSerializer: Fix missing call to endStructure() ([#​2272](https://togithub.com/Kotlin/kotlinx.serialization/issues/2272)) - ObjectSerializer: Respect sequential decoding ([#​2273](https://togithub.com/Kotlin/kotlinx.serialization/issues/2273)) - Fix value class encoding in various corner cases ([#​2242](https://togithub.com/Kotlin/kotlinx.serialization/issues/2242)) - Fix incorrect json decoding iterator's .hasNext() behavior on array-wrapped inputs ([#​2268](https://togithub.com/Kotlin/kotlinx.serialization/issues/2268)) - Fix memory leak caused by invalid KTypeWrapper's equals method ([#​2274](https://togithub.com/Kotlin/kotlinx.serialization/issues/2274)) - Fixed NoSuchMethodError when parsing a JSON stream on Java 8 ([#​2219](https://togithub.com/Kotlin/kotlinx.serialization/issues/2219)) - Fix MissingFieldException duplication ([#​2213](https://togithub.com/Kotlin/kotlinx.serialization/issues/2213)) ### [`v1.5.0`](https://togithub.com/Kotlin/kotlinx.serialization/blob/HEAD/CHANGELOG.md#150--2023-02-27) \================== This release contains all features and bugfixes from 1.5.0-RC plus some experimental features and bugfixes on its own (see below). Kotlin 1.8.10 is used as a default. ##### HoconEncoder and HoconDecoder interfaces and HOCON-specific serializers These interfaces work in a way similar to `JsonEncoder` and `JsonDecoder`: they allow intercepting (de)serialization process, making writing if custom HOCON-specific serializers easier. New `ConfigMemorySizeSerializer` and `JavaDurationSerializer` already make use of them. See more details in the [PR](https://togithub.com/Kotlin/kotlinx.serialization/pull/2094). Big thanks to [Alexander Mikhailov](https://togithub.com/alexmihailov) for contributing this! ##### Ability to read buffered huge strings in custom Json deserializers New interface `ChunkedDecoder` allows you to read huge strings that may not fit in memory by chunks. Currently, this interface is only implemented by Json decoder that works with strings and streams, but we may expand it later, if there's a demand for it. See more details in the [PR](https://togithub.com/Kotlin/kotlinx.serialization/pull/2012) authored by [Alexey Sviridov](https://togithub.com/fred01). ##### Bugfixes - Improve runtime exceptions messages ([#​2180](https://togithub.com/Kotlin/kotlinx.serialization/issues/2180)) - Added support for null values for nullable enums in lenient mode ([#​2176](https://togithub.com/Kotlin/kotlinx.serialization/issues/2176)) - Prevent class loaders from leaking when using ClassValue cache ([#​2175](https://togithub.com/Kotlin/kotlinx.serialization/issues/2175))

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Mend Renovate. View repository job log here.

TWiStErRob commented 1 year ago

@chao2zhang @cortinico is it going to be a problem to upgrade this and then use it in Detekt? It would expose as transitive dependency.

cortinico commented 1 year ago

It would expose as transitive dependency.

Not for our users though right? 🤔 I see no problem in bumping this but maybe I'm missing something

TWiStErRob commented 1 year ago

Depends on who you count as a "user". If anyone who applies the Gradle plugin, then they will be affected:

+--- io.gitlab.arturbosch.detekt:detekt-gradle-plugin:1.22.0
|    \--- io.github.detekt.sarif4k:sarif4k:0.0.1
|         +--- org.jetbrains.kotlinx:kotlinx-serialization-json:1.1.0
|         |    \--- org.jetbrains.kotlinx:kotlinx-serialization-json-jvm:1.1.0
|         |         +--- org.jetbrains.kotlin:kotlin-stdlib:1.4.30 -> 1.8.10 (*)
|         |         +--- org.jetbrains.kotlin:kotlin-stdlib-common:1.4.30 -> 1.8.10
|         |         \--- org.jetbrains.kotlinx:kotlinx-serialization-core:1.1.0
|         |              \--- org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.1.0
|         |                   +--- org.jetbrains.kotlin:kotlin-stdlib:1.4.30 -> 1.8.10 (*)
|         |                   \--- org.jetbrains.kotlin:kotlin-stdlib-common:1.4.30 -> 1.8.10
|         \--- org.jetbrains.kotlin:kotlin-stdlib:1.4.31 -> 1.8.10 (*)

This applies to classpath, plugins { } or includeBuild + implementation/api uses, and ever for plugins that configure Detekt as per a user's convention. The ->s in the above code are because I'm using KGP 1.8.10.

AGP, KGP and any other plugin could be using the same, if we use the latest Gradle will resolve the latest. Which may be fine, just be aware 😁.

Note: https://github.com/Kotlin/kotlinx.serialization/blob/master/docs/compatibility.md#compatibility-with-kotlin-compiler-plugin, which is promising, because it looks very similar to Kotlin's.

cortinico commented 1 year ago

Depends on who you count as a "user". If anyone who applies the Gradle plugin, then they will be affected:

Oh yeah this can be a problem.

From what I can see, we use sarif4k inside DGP only here: https://github.com/detekt/detekt/blob/4719e71bbddad8934b7641abd574b286c1718a32/detekt-gradle-plugin/src/main/kotlin/io/gitlab/arturbosch/detekt/report/SarifReportMerger.kt#L3

IMHO We should be able to perform that JSON merging task without having to rely on a implementation or sarif4k (or kotlinx.serialization) which introduces those transitive dependencies.

Especially also considered that we have a compileOnly dep on KGP: https://github.com/detekt/detekt/blob/4719e71bbddad8934b7641abd574b286c1718a32/detekt-gradle-plugin/build.gradle.kts#L69

chao2zhang commented 1 year ago

Is the remaining action that we should refactor DGP off Sarif4k so that