build(deps): bump jetty-servlet from 9.4.27.v20200227 to 11.0.3 #22

Closed

dependabot[bot] wants to merge 1 commit from dependabot/gradle/org.eclipse.jetty-jetty-servlet-11.0.3 into helma-🐜

dependabot[bot] commented

2021-05-24 07:39:07 +00:00

(Migrated from github.com)

Bumps jetty-servlet from 9.4.27.v20200227 to 11.0.3.

Release notes

Sourced from jetty-servlet's releases.

11.0.3

Changelog

#3764 DeprecationWarning Decorator

#5684 Review disabled tests

#5798 jetty-runner startup error with jetty-10

#5817 Provide more filtering for CustomRequestLog

#6049 Default provider [files] section always executed

#6084 GzipHandler: NPE in setDeflaterPoolCapacity and setInflaterPoolCapacity

#6098 jetty-cdi is missing from jetty-bom

#6099 Cipher preference may break SNI if certificates have different key types

#6105 HttpConnection.getBytesIn() incorrect for requests with chunked content

#6106 WebSocket/CDI integration is broken in Jetty 10

#6125 Do not allow override of jakarta.* container classes by webapps per Servlet 5.0 Section 15.2.1

#6132 Ambiguous segment in URI in DELETE /a/projects/foo/branches/refs%2Fheads%2Ftest request after upgrade from 10.0.0 to 10.0.2

#6153 jetty-maven-plugin does not correctly pass JVM arguments for external deployMode

#6159 Jetty with Conscrypt unable to handle any HTTPS requests when connected by IP rather than hostname.

#6166 WebSocket MessageInputStream.read() spends a lot of time in ByteBuffer.compact()

#6205 OpenIdAuthenticator may use incorrect redirect

#6208 HTTP/2 max local stream count exceeded

#6224 make jetty-jspc-maven-plugin @threadsafe

#6227 Better resolve race between AsyncListener.onTimeout and AsyncContext.dispatch

#6238 jetty-keystore Invalid manifest header Bundle-SymbolicName: ""

#6250 Lazily allocate HTTP2Stream data queue

#6251 Use CyclicTimeout for HTTP2Streams

#6254 Total timeout not enforced for queued requests

#6263 Review URI encoding in ConcatServlet & WelcomeFilter

#6277 Better handle exceptions thrown from session destroy listener

#6280 Copy ServletHolder class/instance properly during startWebapp

#6287 Class loading broken for WebSocketClient used inside webapp

11.0.2

Changelog

⚠️ Important Security related Changes

CVE-2021-28165 - #6072 - jetty server high CPU when client send data length > 17408

CVE-2021-28164 - #6101 - Normalize ambiguous URIs

CVE-2021-28163 - #6102 - Exclude webapps directory from deployment scan

Other Changes

#4275 - Path Normalization/Traversal - Context Matching

#5828 - Allow to create a WebSocketContainer passing HttpClient

#5832 - Ctrl-C after jetty:run produces NoClassDefFoundError

#5835 - Review Durable Filters, Servlets and Listeners

#5977 - Cache-Control header set by a filter is override by the value from DefaultServlet configuration

#5994 - QueuedThreadPool "free" threads

#5996 - ERROR : No module found to provide logback-impl for logback-access{enabled}

#5999 - HttpURI ArrayIndexOutOfBounds

... (truncated)

Commits

d97980b Updating to version 11.0.3
2d08ed6 Merged branch 'jetty-10.0.x' into 'jetty-11.0.x'.
cd73338 Remove WebSocketComponents & HouseKeeper on Server restart. (#6218)
28562d6 Merged branch 'jetty-10.0.x' into 'jetty-11.0.x'.
802d32d Fixes #6207 - Make ALPN optional in HTTP2Client over TLS
0e2a809 Merge remote-tracking branch 'origin/jetty-10.0.x' into jetty-11.0.x
455e798 Merge pull request #6293 from eclipse/jetty-10.0.x-6287-WebSocketClientClassL...
462aff3 Merged branch 'jetty-10.0.x' into 'jetty-11.0.x'.
67e2b4a Fixes #5306 - Default jetty.*.acceptors should be 1. (#6236)
ddbf8e2 Merge remote-tracking branch 'origin/jetty-10.0.x' into jetty-11.0.x
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [jetty-servlet](https://github.com/eclipse/jetty.project) from 9.4.27.v20200227 to 11.0.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/eclipse/jetty.project/releases">jetty-servlet's releases</a>.</em></p> <blockquote> <h2>11.0.3</h2> <h1>Changelog</h1> <ul> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/3764">#3764</a> DeprecationWarning Decorator</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5684">#5684</a> Review disabled tests</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5798">#5798</a> jetty-runner startup error with jetty-10</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5817">#5817</a> Provide more filtering for CustomRequestLog</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6049">#6049</a> Default provider [files] section always executed</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6084">#6084</a> GzipHandler: NPE in setDeflaterPoolCapacity and setInflaterPoolCapacity</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6098">#6098</a> jetty-cdi is missing from jetty-bom</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6099">#6099</a> Cipher preference may break SNI if certificates have different key types</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6105">#6105</a> HttpConnection.getBytesIn() incorrect for requests with chunked content</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6106">#6106</a> WebSocket/CDI integration is broken in Jetty 10</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6125">#6125</a> Do not allow override of jakarta.* container classes by webapps per Servlet 5.0 Section 15.2.1</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6132">#6132</a> Ambiguous segment in URI in DELETE /a/projects/foo/branches/refs%2Fheads%2Ftest request after upgrade from 10.0.0 to 10.0.2</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6153">#6153</a> jetty-maven-plugin does not correctly pass JVM arguments for external deployMode</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6159">#6159</a> Jetty with Conscrypt unable to handle any HTTPS requests when connected by IP rather than hostname.</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6166">#6166</a> WebSocket MessageInputStream.read() spends a lot of time in ByteBuffer.compact()</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6205">#6205</a> OpenIdAuthenticator may use incorrect redirect</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6208">#6208</a> HTTP/2 max local stream count exceeded</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6224">#6224</a> make jetty-jspc-maven-plugin <code>@threadsafe</code></li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6227">#6227</a> Better resolve race between <code>AsyncListener.onTimeout</code> and <code>AsyncContext.dispatch</code></li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6238">#6238</a> jetty-keystore Invalid manifest header Bundle-SymbolicName: ""</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6250">#6250</a> Lazily allocate HTTP2Stream data queue</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6251">#6251</a> Use CyclicTimeout for HTTP2Streams</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6254">#6254</a> Total timeout not enforced for queued requests</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6263">#6263</a> Review URI encoding in ConcatServlet & WelcomeFilter</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6277">#6277</a> Better handle exceptions thrown from session destroy listener</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6280">#6280</a> Copy ServletHolder class/instance properly during startWebapp</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6287">#6287</a> Class loading broken for WebSocketClient used inside webapp</li> </ul> <h2>11.0.2</h2> <h1>Changelog</h1> <h1>:warning: Important Security related Changes</h1> <ul> <li><a href="https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w">CVE-2021-28165</a> - <a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6072">#6072</a> - jetty server high CPU when client send data length > 17408</li> <li><a href="https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5">CVE-2021-28164</a> - <a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6101">#6101</a> - Normalize ambiguous URIs</li> <li><a href="https://github.com/eclipse/jetty.project/security/advisories/GHSA-j6qj-j888-vvgq">CVE-2021-28163</a> - <a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6102">#6102</a> - Exclude webapps directory from deployment scan</li> </ul> <h1>Other Changes</h1> <ul> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/4275">#4275</a> - Path Normalization/Traversal - Context Matching</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5828">#5828</a> - Allow to create a WebSocketContainer passing HttpClient</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5832">#5832</a> - Ctrl-C after jetty:run produces NoClassDefFoundError</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5835">#5835</a> - Review Durable Filters, Servlets and Listeners</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5977">#5977</a> - Cache-Control header set by a filter is override by the value from DefaultServlet configuration</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5994">#5994</a> - QueuedThreadPool "free" threads</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5996">#5996</a> - ERROR : No module found to provide logback-impl for logback-access{enabled}</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5999">#5999</a> - HttpURI ArrayIndexOutOfBounds</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/eclipse/jetty.project/commit/d97980b614821651dc801f14c9c73a3f098cf886"><code>d97980b</code></a> Updating to version 11.0.3</li> <li><a href="https://github.com/eclipse/jetty.project/commit/2d08ed6ca09ff95fd58c2641b59a4b6252d34eae"><code>2d08ed6</code></a> Merged branch 'jetty-10.0.x' into 'jetty-11.0.x'.</li> <li><a href="https://github.com/eclipse/jetty.project/commit/cd73338b846515be4692fa7d8fa08acffcfad36b"><code>cd73338</code></a> Remove WebSocketComponents & HouseKeeper on Server restart. (<a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6218">#6218</a>)</li> <li><a href="https://github.com/eclipse/jetty.project/commit/28562d6d6de5d35a25096a58bc1a323a4e225142"><code>28562d6</code></a> Merged branch 'jetty-10.0.x' into 'jetty-11.0.x'.</li> <li><a href="https://github.com/eclipse/jetty.project/commit/802d32d2a8f754ab0075942b0baab3b31d729b42"><code>802d32d</code></a> Fixes <a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6207">#6207</a> - Make ALPN optional in HTTP2Client over TLS</li> <li><a href="https://github.com/eclipse/jetty.project/commit/0e2a809ceb5e0e46612976f2a70f981c5597b9ec"><code>0e2a809</code></a> Merge remote-tracking branch 'origin/jetty-10.0.x' into jetty-11.0.x</li> <li><a href="https://github.com/eclipse/jetty.project/commit/455e7989060569fc76608608c76ea0dbfc809ed0"><code>455e798</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6293">#6293</a> from eclipse/jetty-10.0.x-6287-WebSocketClientClassL...</li> <li><a href="https://github.com/eclipse/jetty.project/commit/462aff39bc601dcf650ab30dea6fb69b7513135b"><code>462aff3</code></a> Merged branch 'jetty-10.0.x' into 'jetty-11.0.x'.</li> <li><a href="https://github.com/eclipse/jetty.project/commit/67e2b4af2facade1aa17f0fb82397f4766de1667"><code>67e2b4a</code></a> Fixes <a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5306">#5306</a> - Default jetty.*.acceptors should be 1. (<a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6236">#6236</a>)</li> <li><a href="https://github.com/eclipse/jetty.project/commit/ddbf8e290df170c0ad431161ff21b3d9a41bc173"><code>ddbf8e2</code></a> Merge remote-tracking branch 'origin/jetty-10.0.x' into jetty-11.0.x</li> <li>Additional commits viewable in <a href="https://github.com/eclipse/jetty.project/compare/jetty-9.4.27.v20200227...jetty-11.0.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.eclipse.jetty:jetty-servlet&package-manager=gradle&previous-version=9.4.27.v20200227&new-version=11.0.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

dependabot[bot] commented

2021-06-09 06:20:41 +00:00

(Migrated from github.com)

Superseded by #25.