shaimael / keycloak

Open Source Identity and Access Management For Modern Applications and Services
https://www.keycloak.org
Apache License 2.0
0 stars 0 forks source link

Update dependency com.webauthn4j:webauthn4j-core to v0.15.0.RELEASE - autoclosed #1355

Closed mend-for-github-com[bot] closed 2 years ago

mend-for-github-com[bot] commented 2 years ago

This PR contains the following updates:

Package Type Update Change
com.webauthn4j:webauthn4j-core compile minor 0.12.0.RELEASE -> 0.15.0.RELEASE

By merging this PR, the below issues will be automatically resolved and closed:

Severity CVSS Score CVE GitHub Issue
High 7.5 CVE-2020-28491 #140

Release Notes

webauthn4j/webauthn4j ### [`v0.15.0.RELEASE`](https://togithub.com/webauthn4j/webauthn4j/releases/0.15.0.RELEASE) [Compare Source](https://togithub.com/webauthn4j/webauthn4j/compare/0.14.1.RELEASE...0.15.0.RELEASE) **This release is broken (Not published properly to Maven Central). Please use [0.15.1.RELEASE](https://togithub.com/webauthn4j/webauthn4j/releases/tag/0.15.1.RELEASE) instead.** #### :warning: Breaking Changes - Clarify nullability for better Kotlin interoperability - Clarify nullability for better Kotlin interoperability [#​372](https://togithub.com/webauthn4j/webauthn4j/pull/372) - Correct WebAuthn data class nullability [#​429](https://togithub.com/webauthn4j/webauthn4j/pull/429) - Make AuthenticationData member nullable [#​376](https://togithub.com/webauthn4j/webauthn4j/pull/376) - Redesign converter return value nullability [#​401](https://togithub.com/webauthn4j/webauthn4j/pull/401) - Clarify webauthn4j-device-check module classes nullability [#​394](https://togithub.com/webauthn4j/webauthn4j/pull/394) - Make AndroidSafetyNetAttestationStatement Response members nullable [#​383](https://togithub.com/webauthn4j/webauthn4j/pull/383) - Make AuthenticatorSelectionCriteria.requireResidentKey nullable [#​382](https://togithub.com/webauthn4j/webauthn4j/pull/382) - Refine ServerProperty nullability and remove getOrigin method [#​375](https://togithub.com/webauthn4j/webauthn4j/pull/375) - Redesign Converters not to pass through null value [#​373](https://togithub.com/webauthn4j/webauthn4j/pull/373) - Add null check assertion to non-null marked members [#​400](https://togithub.com/webauthn4j/webauthn4j/pull/400) - Polish Nullability annotations [#​476](https://togithub.com/webauthn4j/webauthn4j/pull/476) - Polish null check logic [#​475](https://togithub.com/webauthn4j/webauthn4j/pull/475) - Move Parameters classes non-null check into these classes [#​377](https://togithub.com/webauthn4j/webauthn4j/pull/377) - Refine COSEKey classes nullability [#​374](https://togithub.com/webauthn4j/webauthn4j/pull/374) - Revisit nullability [#​402](https://togithub.com/webauthn4j/webauthn4j/pull/402) - Correct userHandle nullability [#​422](https://togithub.com/webauthn4j/webauthn4j/pull/422) - Update UserVerificationMethod [#​445](https://togithub.com/webauthn4j/webauthn4j/pull/445) - Deprecate a ServerProperty constructor whose origins arg is Collection [#​415](https://togithub.com/webauthn4j/webauthn4j/pull/415) - Redesign JWS classes [#​388](https://togithub.com/webauthn4j/webauthn4j/pull/388) #### :star: Enhancements - Add error member to Android Safetynet Attestation Response [#​386](https://togithub.com/webauthn4j/webauthn4j/pull/386) - Add revocationCheckEnabled option [#​460](https://togithub.com/webauthn4j/webauthn4j/pull/460) - Expose OriginValidator to public [#​459](https://togithub.com/webauthn4j/webauthn4j/pull/459) - Make DeviceCheckManager.createObjectConverter public [#​458](https://togithub.com/webauthn4j/webauthn4j/pull/458) - Make converters to throw DataConversionException when null check failed [#​430](https://togithub.com/webauthn4j/webauthn4j/pull/430) - Add NullAppleAnonymousAttestationStatementValidator to createNonStrictWebAuthnRegistrationManager() [#​419](https://togithub.com/webauthn4j/webauthn4j/pull/419) - Make AuthenticatorResponse public [#​414](https://togithub.com/webauthn4j/webauthn4j/pull/414) - Make DCAssertion class public [#​395](https://togithub.com/webauthn4j/webauthn4j/pull/395) - Polish CertPathSerializer [#​387](https://togithub.com/webauthn4j/webauthn4j/pull/387) - Reformat code [#​390](https://togithub.com/webauthn4j/webauthn4j/pull/390) - Remove deprecated suppressions [#​391](https://togithub.com/webauthn4j/webauthn4j/pull/391) - Move docs build from Travis-CI to GitHub Actions [#​452](https://togithub.com/webauthn4j/webauthn4j/pull/452) - Remove bintray dependency as it shutdowns [#​473](https://togithub.com/webauthn4j/webauthn4j/pull/473) #### :package: Dependency Upgrades - Bump dependency-check-gradle from 6.1.0 to 6.1.5 [#​478](https://togithub.com/webauthn4j/webauthn4j/pull/478) [#​477](https://togithub.com/webauthn4j/webauthn4j/pull/477) [#​472](https://togithub.com/webauthn4j/webauthn4j/pull/472) [#​468](https://togithub.com/webauthn4j/webauthn4j/pull/468) [#​461](https://togithub.com/webauthn4j/webauthn4j/pull/461) - Bump spring-boot-dependencies from 2.3.4.RELEASE to 2.4.4 [#​469](https://togithub.com/webauthn4j/webauthn4j/pull/469) [#​463](https://togithub.com/webauthn4j/webauthn4j/pull/463) [#​443](https://togithub.com/webauthn4j/webauthn4j/pull/443) [#​424](https://togithub.com/webauthn4j/webauthn4j/pull/424) [#​393](https://togithub.com/webauthn4j/webauthn4j/pull/393) [#​370](https://togithub.com/webauthn4j/webauthn4j/pull/370) - Bump build-info-extractor-gradle from 4.13.0 to 4.21.0 [#​466](https://togithub.com/webauthn4j/webauthn4j/pull/466) [#​451](https://togithub.com/webauthn4j/webauthn4j/pull/451) [#​368](https://togithub.com/webauthn4j/webauthn4j/pull/368) - Bump asciidoctor-gradle-jvm from 3.2.0 to 3.3.0 [#​464](https://togithub.com/webauthn4j/webauthn4j/pull/464) [#​457](https://togithub.com/webauthn4j/webauthn4j/pull/457) [#​384](https://togithub.com/webauthn4j/webauthn4j/pull/384) - Bump mockitoVersion from 3.5.13 to 3.8.0 [#​465](https://togithub.com/webauthn4j/webauthn4j/pull/465) [#​444](https://togithub.com/webauthn4j/webauthn4j/pull/444) [#​437](https://togithub.com/webauthn4j/webauthn4j/pull/437) [#​411](https://togithub.com/webauthn4j/webauthn4j/pull/411) [#​369](https://togithub.com/webauthn4j/webauthn4j/pull/369) [#​367](https://togithub.com/webauthn4j/webauthn4j/pull/367) - Bump dependency-check-gradle from 6.0.2 to 6.1.0 [#​450](https://togithub.com/webauthn4j/webauthn4j/pull/450) [#​439](https://togithub.com/webauthn4j/webauthn4j/pull/439) [#​436](https://togithub.com/webauthn4j/webauthn4j/pull/436) [#​385](https://togithub.com/webauthn4j/webauthn4j/pull/385) - Bump checker-qual from 3.9.1 to 3.11.1 [#​467](https://togithub.com/webauthn4j/webauthn4j/pull/467) [#​454](https://togithub.com/webauthn4j/webauthn4j/pull/454) - Bump sonarqube-gradle-plugin from 3.0 to 3.1.1 [#​449](https://togithub.com/webauthn4j/webauthn4j/pull/449) [#​440](https://togithub.com/webauthn4j/webauthn4j/pull/440) - Bump checker-qual from 2.5.5 to 3.9.1 [#​441](https://togithub.com/webauthn4j/webauthn4j/pull/441) [#​438](https://togithub.com/webauthn4j/webauthn4j/pull/438) [#​417](https://togithub.com/webauthn4j/webauthn4j/pull/417) [#​379](https://togithub.com/webauthn4j/webauthn4j/pull/379) - Bump bouncyCastleVersion from 1.66 to 1.68 [#​434](https://togithub.com/webauthn4j/webauthn4j/pull/434) [#​371](https://togithub.com/webauthn4j/webauthn4j/pull/371) #### :heart: Contributors We'd like to thank all the contributors who worked on this release! - [@​DTonoki](https://togithub.com/DTonoki) ### [`v0.14.1.RELEASE`](https://togithub.com/webauthn4j/webauthn4j/releases/0.14.1.RELEASE) [Compare Source](https://togithub.com/webauthn4j/webauthn4j/compare/0.14.0.RELEASE...0.14.1.RELEASE) #### :star: Enhancements - Remove BouncyCastle from webauthn4j-util dependency [#​423](https://togithub.com/webauthn4j/webauthn4j/pull/423) ### [`v0.14.0.RELEASE`](https://togithub.com/webauthn4j/webauthn4j/releases/0.14.0.RELEASE) [Compare Source](https://togithub.com/webauthn4j/webauthn4j/compare/0.13.0.RELEASE...0.14.0.RELEASE) #### :warning: Breaking Changes - Bugfix: Failed to parse attestatation certificate DN [#​359](https://togithub.com/webauthn4j/webauthn4j/pull/359) - Relax origin scheme requirement [#​354](https://togithub.com/webauthn4j/webauthn4j/pull/354) - Redesign registration timestamp handling [#​352](https://togithub.com/webauthn4j/webauthn4j/pull/352) - Remove expectedExtensionIds member [#​344](https://togithub.com/webauthn4j/webauthn4j/pull/344) - Segregate client independent logic from validators [#​343](https://togithub.com/webauthn4j/webauthn4j/pull/343) - Deprecate SignatureUtil#getRS256, getES256 [#​336](https://togithub.com/webauthn4j/webauthn4j/pull/336) #### :star: Enhancements - Support Apple App Attest attestation statement [#​329](https://togithub.com/webauthn4j/webauthn4j/pull/329) - Support Apple Anonymous attestation statement [#​357](https://togithub.com/webauthn4j/webauthn4j/pull/357) - Support fido2 api for android Origin and support validation against multiple origins [#​353](https://togithub.com/webauthn4j/webauthn4j/pull/353) - Update SonarCloud runner java version to 11 [#​361](https://togithub.com/webauthn4j/webauthn4j/pull/361) - Normalize Origin scheme and host & assign schemeSpecificPart value for http/https [#​356](https://togithub.com/webauthn4j/webauthn4j/pull/356) - CodeQL scanning [#​355](https://togithub.com/webauthn4j/webauthn4j/pull/355) - Add doc about how to serialize/deserialize authenticator [#​350](https://togithub.com/webauthn4j/webauthn4j/pull/350) - Add CoreAuthenticatorImpl [#​349](https://togithub.com/webauthn4j/webauthn4j/pull/349) - Add documentation about how to validate FIDO2 CTAP authenticator attestation and assertion [#​347](https://togithub.com/webauthn4j/webauthn4j/pull/347) #### :package: Dependency Upgrades - Bump spring-boot-dependencies from 2.3.3.RELEASE to 2.3.4.RELEASE [#​341](https://togithub.com/webauthn4j/webauthn4j/pull/341) - Align Mockito version and update to 3.5.13 [#​364](https://togithub.com/webauthn4j/webauthn4j/pull/364) - Bump dependency-check-gradle from 5.3.2.1 to 6.0.2 [#​334](https://togithub.com/webauthn4j/webauthn4j/pull/334) [#​339](https://togithub.com/webauthn4j/webauthn4j/pull/339) [#​351](https://togithub.com/webauthn4j/webauthn4j/pull/351) - Bump build-info-extractor-gradle from 4.17.1 to 4.17.2 [#​333](https://togithub.com/webauthn4j/webauthn4j/pull/333) #### :heart: Contributors We'd like to thank all the contributors who worked on this release! - [@​veehaitch](https://togithub.com/veehaitch) - [@​dayasakti-2020](https://togithub.com/dayasakti-2020) - [@​VinodAnandan](https://togithub.com/VinodAnandan) ### [`v0.13.0.RELEASE`](https://togithub.com/webauthn4j/webauthn4j/releases/0.13.0.RELEASE) [Compare Source](https://togithub.com/webauthn4j/webauthn4j/compare/0.12.0.RELEASE...0.13.0.RELEASE) #### :warning: Breaking Changes - Redesign Exntesions [#​306](https://togithub.com/webauthn4j/webauthn4j/pull/306) [#​318](https://togithub.com/webauthn4j/webauthn4j/pull/318) - Deprecate expectedExtensionIds member [#​330](https://togithub.com/webauthn4j/webauthn4j/pull/330) - Remove deprecated features [#​295](https://togithub.com/webauthn4j/webauthn4j/pull/295) #### :star: Enhancements - Improve extension builder [#​311](https://togithub.com/webauthn4j/webauthn4j/pull/311) - Add CredentialProptectionExtension [#​309](https://togithub.com/webauthn4j/webauthn4j/pull/309) - Add stale bot definition [#​299](https://togithub.com/webauthn4j/webauthn4j/pull/299) #### :package: Dependency Upgrades - Bump spring-boot-dependencies from 2.3.0.RELEASE to 2.3.3.RELEASE [#​302](https://togithub.com/webauthn4j/webauthn4j/pull/302) [#​317](https://togithub.com/webauthn4j/webauthn4j/pull/317) [#​324](https://togithub.com/webauthn4j/webauthn4j/pull/324) - Bump kerby-asn1 from 2.0.0 to 2.0.1 [#​297](https://togithub.com/webauthn4j/webauthn4j/pull/297) - Bump bouncyCastleVersion from 1.65 to 1.66 [#​315](https://togithub.com/webauthn4j/webauthn4j/pull/315) - Bump sonarqube-gradle-plugin from 2.8.0.1969 to 3.0 [#​301](https://togithub.com/webauthn4j/webauthn4j/pull/301) - Bump build-info-extractor-gradle from 4.15.2 to 4.17.1 [#​305](https://togithub.com/webauthn4j/webauthn4j/pull/305) [#​314](https://togithub.com/webauthn4j/webauthn4j/pull/314) [#​323](https://togithub.com/webauthn4j/webauthn4j/pull/323) [#​327](https://togithub.com/webauthn4j/webauthn4j/pull/327) - Update AsciiDoctorJ [#​307](https://togithub.com/webauthn4j/webauthn4j/pull/307) - Create Dependabot config file [#​303](https://togithub.com/webauthn4j/webauthn4j/pull/303)