search

eu-digital-identity-wallet / eudi-lib-jvm-sdjwt-kt

A library for issuing and verifying SD-JWT
Apache License 2.0
14 stars 4 forks source link

Bump the libs group with 3 updates #177

Closed dependabot[bot] closed 3 months ago

dependabot[bot] commented 3 months ago

Bumps the libs group with 3 updates: com.google.crypto.tink:tink, org.owasp.dependencycheck and org.sonarqube.

Updates com.google.crypto.tink:tink from 1.12.0 to 1.13.0

Release notes

Sourced from com.google.crypto.tink:tink's releases.

Tink Java 1.13.0

Tink is a multi-language, cross-platform library that provides simple and misuse-proof APIs for common cryptographic tasks.

This is Tink Java 1.13.0

To get started using Tink, see the setup guide.

What's new?

Bugs fixed:

  • JwkSetConverter now encodes RSA public keys without leading zero, as required by RFC 7518.

Performance improvements:

  • Encrypted keysets produced with BinaryKeysetWriter or TinkProtoKeysetFormat are now smaller, because the unused keyset info metadata is not written anymore. JsonKeysetWriter and TinkJsonProtoKeysetFormat still output this metadata.
  • Tink now uses the JCE implementation of ChaCha20Poly1305 if available. This makes encryption with ChaCha20Poly1305 and XChaCha20Poly1305 about 2-3 times faster.
  • AES-GCM is now about 20% faster.

API changes:

  • For Android: Support for SDK 19 has been removed.
  • Removed PrimitiveSet and Registry.registerPrimitiveWrapper from the public API. While these were in the public API, they have changed semantics in the past and will change more in the future. Code using either PrimitiveSet or Registry.registerPrimitiveWrapper will not work after upcoming changes. Instead of breaking users silently, we prefer to break during compilation. If affected, please file an issue on github.com/tink-crypto/tink-java/.
  • For keyset that contain JWT keys, JwtSignatureConfig.register() or JwtMacConfig.register() now need to be called before the keyset is parsed. If not, calling keysetHandle.getPrimitive(...) will fail with an error message: "Unable to get primitive interface com.google.crypto.tink.jwt.JwtPublicKeySign for key of type ..." or "Unable to get primitive interface com.google.crypto.tink.jwt.JwtPublicKeyVerify for key of type ...".
  • Removed the constructors of HmacKeyManager and HmacPrfKeyManager from the public API. These were never intended to be public, and we expect that nobody used either of them.
  • Removed the constructors of com.google.crypto.tink.subtle.EciesAeadHkdfHybridDecrypt and com.google.crypto.tink.subtle.EciesAeadHkdfHybridEncrypt from the public API. These took as argument a EciesAeadHkdfDemHelper object whose only implementation was private to Tink. We are hence confident that this is unused.
  • Removed test-only AndroidKeystoreKmsClient.setKeyStore. This function didn't work as expected, as in some places, still the real KeyStore was used. If you

... (truncated)

Commits
  • e55411d Bump version to 1.13.0
  • 7f3e968 Use parametrized tests in JwkSetConverterTest.java.
  • 3bef329 Add validation to HpkeUtil.intToByteArray.
  • 9de8d44 Add TINK output prefix to LegacyKmsEnvelopeAeadKey.
  • 5d2eb06 Simplify KmsEnvelopeAeadKeyManager.create.
  • 65c25bc Test error message from the release notes.
  • 7794100 Also test signatures and JWT signatures in LateRegistrationTest.
  • 32cdbf0 Use OutputPrefixUtil in keys to create the prefix.
  • 7e62465 Add TINK output prefix to KmsAeadKey.
  • fe0cea5 Remove TODO in ConfigurationV0.
  • Additional commits viewable in compare view


Updates org.owasp.dependencycheck from 9.0.9 to 9.1.0

Updates org.sonarqube from 4.4.1.3373 to 5.0.0.4638

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions