build(deps): bump jetty-servlet from 9.4.27.v20200227 to 11.0.4 #25

Closed

dependabot[bot] wants to merge 1 commit from dependabot/gradle/org.eclipse.jetty-jetty-servlet-11.0.4 into helma-🐜

dependabot[bot] commented

2021-06-09 06:20:38 +00:00

(Migrated from github.com)

Bumps jetty-servlet from 9.4.27.v20200227 to 11.0.4.

Release notes

Sourced from jetty-servlet's releases.

11.0.3

Changelog

#3764 DeprecationWarning Decorator

#5684 Review disabled tests

#5798 jetty-runner startup error with jetty-10

#5817 Provide more filtering for CustomRequestLog

#6049 Default provider [files] section always executed

#6084 GzipHandler: NPE in setDeflaterPoolCapacity and setInflaterPoolCapacity

#6098 jetty-cdi is missing from jetty-bom

#6099 Cipher preference may break SNI if certificates have different key types

#6105 HttpConnection.getBytesIn() incorrect for requests with chunked content

#6106 WebSocket/CDI integration is broken in Jetty 10

#6125 Do not allow override of jakarta.* container classes by webapps per Servlet 5.0 Section 15.2.1

#6132 Ambiguous segment in URI in DELETE /a/projects/foo/branches/refs%2Fheads%2Ftest request after upgrade from 10.0.0 to 10.0.2

#6153 jetty-maven-plugin does not correctly pass JVM arguments for external deployMode

#6159 Jetty with Conscrypt unable to handle any HTTPS requests when connected by IP rather than hostname.

#6166 WebSocket MessageInputStream.read() spends a lot of time in ByteBuffer.compact()

#6205 OpenIdAuthenticator may use incorrect redirect

#6208 HTTP/2 max local stream count exceeded

#6224 make jetty-jspc-maven-plugin @threadsafe

#6227 Better resolve race between AsyncListener.onTimeout and AsyncContext.dispatch

#6238 jetty-keystore Invalid manifest header Bundle-SymbolicName: ""

#6250 Lazily allocate HTTP2Stream data queue

#6251 Use CyclicTimeout for HTTP2Streams

#6254 Total timeout not enforced for queued requests

#6263 Review URI encoding in ConcatServlet & WelcomeFilter

#6277 Better handle exceptions thrown from session destroy listener

#6280 Copy ServletHolder class/instance properly during startWebapp

#6287 Class loading broken for WebSocketClient used inside webapp

11.0.2

Changelog

⚠️ Important Security related Changes

CVE-2021-28165 - #6072 - jetty server high CPU when client send data length > 17408

CVE-2021-28164 - #6101 - Normalize ambiguous URIs

CVE-2021-28163 - #6102 - Exclude webapps directory from deployment scan

Other Changes

#4275 - Path Normalization/Traversal - Context Matching

#5828 - Allow to create a WebSocketContainer passing HttpClient

#5832 - Ctrl-C after jetty:run produces NoClassDefFoundError

#5835 - Review Durable Filters, Servlets and Listeners

#5977 - Cache-Control header set by a filter is override by the value from DefaultServlet configuration

#5994 - QueuedThreadPool "free" threads

#5996 - ERROR : No module found to provide logback-impl for logback-access{enabled}

#5999 - HttpURI ArrayIndexOutOfBounds

... (truncated)

Commits

5bcdeb5 Updating to version 11.0.4
d96588e Merged branch 'jetty-10.0.x' into 'jetty-11.0.x'.
3a8af44 Fixes #6330 - CustomRequestLog is missing HTTP version format option. (#6362)
c11c8bb Merged branch 'jetty-10.0.x' into 'jetty-11.0.x'.
e3faf81 Fix #6114 Deploy symlink webapps (#6317)
de37267 Issue #6327 Fix cookie leak test (#6344)
9cc7517 Issue #6330 - Improve javadoc for CustomRequestLog %H
f50c4fd Issue #6327 Remove an invalid RequestTest
eee4a1a Merged branch 'jetty-10.0.x' into 'jetty-11.0.x'.
21aba4a Fixes #6323 - HttpClient requests with redirects gets stuck/never calls onCom...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [jetty-servlet](https://github.com/eclipse/jetty.project) from 9.4.27.v20200227 to 11.0.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/eclipse/jetty.project/releases">jetty-servlet's releases</a>.</em></p> <blockquote> <h2>11.0.3</h2> <h1>Changelog</h1> <ul> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/3764">#3764</a> DeprecationWarning Decorator</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5684">#5684</a> Review disabled tests</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5798">#5798</a> jetty-runner startup error with jetty-10</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5817">#5817</a> Provide more filtering for CustomRequestLog</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6049">#6049</a> Default provider [files] section always executed</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6084">#6084</a> GzipHandler: NPE in setDeflaterPoolCapacity and setInflaterPoolCapacity</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6098">#6098</a> jetty-cdi is missing from jetty-bom</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6099">#6099</a> Cipher preference may break SNI if certificates have different key types</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6105">#6105</a> HttpConnection.getBytesIn() incorrect for requests with chunked content</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6106">#6106</a> WebSocket/CDI integration is broken in Jetty 10</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6125">#6125</a> Do not allow override of jakarta.* container classes by webapps per Servlet 5.0 Section 15.2.1</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6132">#6132</a> Ambiguous segment in URI in DELETE /a/projects/foo/branches/refs%2Fheads%2Ftest request after upgrade from 10.0.0 to 10.0.2</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6153">#6153</a> jetty-maven-plugin does not correctly pass JVM arguments for external deployMode</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6159">#6159</a> Jetty with Conscrypt unable to handle any HTTPS requests when connected by IP rather than hostname.</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6166">#6166</a> WebSocket MessageInputStream.read() spends a lot of time in ByteBuffer.compact()</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6205">#6205</a> OpenIdAuthenticator may use incorrect redirect</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6208">#6208</a> HTTP/2 max local stream count exceeded</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6224">#6224</a> make jetty-jspc-maven-plugin <code>@threadsafe</code></li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6227">#6227</a> Better resolve race between <code>AsyncListener.onTimeout</code> and <code>AsyncContext.dispatch</code></li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6238">#6238</a> jetty-keystore Invalid manifest header Bundle-SymbolicName: ""</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6250">#6250</a> Lazily allocate HTTP2Stream data queue</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6251">#6251</a> Use CyclicTimeout for HTTP2Streams</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6254">#6254</a> Total timeout not enforced for queued requests</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6263">#6263</a> Review URI encoding in ConcatServlet & WelcomeFilter</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6277">#6277</a> Better handle exceptions thrown from session destroy listener</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6280">#6280</a> Copy ServletHolder class/instance properly during startWebapp</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6287">#6287</a> Class loading broken for WebSocketClient used inside webapp</li> </ul> <h2>11.0.2</h2> <h1>Changelog</h1> <h1>:warning: Important Security related Changes</h1> <ul> <li><a href="https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w">CVE-2021-28165</a> - <a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6072">#6072</a> - jetty server high CPU when client send data length > 17408</li> <li><a href="https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5">CVE-2021-28164</a> - <a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6101">#6101</a> - Normalize ambiguous URIs</li> <li><a href="https://github.com/eclipse/jetty.project/security/advisories/GHSA-j6qj-j888-vvgq">CVE-2021-28163</a> - <a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6102">#6102</a> - Exclude webapps directory from deployment scan</li> </ul> <h1>Other Changes</h1> <ul> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/4275">#4275</a> - Path Normalization/Traversal - Context Matching</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5828">#5828</a> - Allow to create a WebSocketContainer passing HttpClient</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5832">#5832</a> - Ctrl-C after jetty:run produces NoClassDefFoundError</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5835">#5835</a> - Review Durable Filters, Servlets and Listeners</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5977">#5977</a> - Cache-Control header set by a filter is override by the value from DefaultServlet configuration</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5994">#5994</a> - QueuedThreadPool "free" threads</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5996">#5996</a> - ERROR : No module found to provide logback-impl for logback-access{enabled}</li> <li><a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/5999">#5999</a> - HttpURI ArrayIndexOutOfBounds</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/eclipse/jetty.project/commit/5bcdeb52aecbdeaf7f870d61fb03223c5944152f"><code>5bcdeb5</code></a> Updating to version 11.0.4</li> <li><a href="https://github.com/eclipse/jetty.project/commit/d96588efd978abfbb8c4eaa356bde2e3f7d44238"><code>d96588e</code></a> Merged branch 'jetty-10.0.x' into 'jetty-11.0.x'.</li> <li><a href="https://github.com/eclipse/jetty.project/commit/3a8af443f59ea140ec520c74f80c62ff9bfdf4f6"><code>3a8af44</code></a> Fixes <a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6330">#6330</a> - CustomRequestLog is missing HTTP version format option. (<a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6362">#6362</a>)</li> <li><a href="https://github.com/eclipse/jetty.project/commit/c11c8bbd5c8a0caf746c9506f269831a3d771a65"><code>c11c8bb</code></a> Merged branch 'jetty-10.0.x' into 'jetty-11.0.x'.</li> <li><a href="https://github.com/eclipse/jetty.project/commit/e3faf81860073f5adabb73ed46c74715e0b1ee8e"><code>e3faf81</code></a> Fix <a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6114">#6114</a> Deploy symlink webapps (<a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6317">#6317</a>)</li> <li><a href="https://github.com/eclipse/jetty.project/commit/de37267ae5cac405d044e49679e340d7913e3bd5"><code>de37267</code></a> Issue <a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6327">#6327</a> Fix cookie leak test (<a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6344">#6344</a>)</li> <li><a href="https://github.com/eclipse/jetty.project/commit/9cc7517d65b4dce64e0c115fbb722fac80ded033"><code>9cc7517</code></a> Issue <a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6330">#6330</a> - Improve javadoc for CustomRequestLog %H</li> <li><a href="https://github.com/eclipse/jetty.project/commit/f50c4fd4b417addd7c092a68cbedd492dc82b7ff"><code>f50c4fd</code></a> Issue <a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6327">#6327</a> Remove an invalid RequestTest</li> <li><a href="https://github.com/eclipse/jetty.project/commit/eee4a1a4fee8134eb440b47d6d9b6d915d407339"><code>eee4a1a</code></a> Merged branch 'jetty-10.0.x' into 'jetty-11.0.x'.</li> <li><a href="https://github.com/eclipse/jetty.project/commit/21aba4a72443a50081065ee64746c590c6a992c9"><code>21aba4a</code></a> Fixes <a href="https://github-redirect.dependabot.com/eclipse/jetty.project/issues/6323">#6323</a> - HttpClient requests with redirects gets stuck/never calls onCom...</li> <li>Additional commits viewable in <a href="https://github.com/eclipse/jetty.project/compare/jetty-9.4.27.v20200227...jetty-11.0.4">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.eclipse.jetty:jetty-servlet&package-manager=gradle&previous-version=9.4.27.v20200227&new-version=11.0.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

dependabot[bot] commented

2021-06-14 07:53:34 +00:00

(Migrated from github.com)

Superseded by #26.