Skip to content

Pin dependency no.nav.security:mock-oauth2-server to 0.5.16 to remain java 11 compatible. (branch_9x) - #4719

Closed
solrbot wants to merge 5 commits into
apache:branch_9xfrom
solrbot:renovate-9x/no.nav.security-mock-oauth2-server-6.x
Closed

Pin dependency no.nav.security:mock-oauth2-server to 0.5.16 to remain java 11 compatible. (branch_9x)#4719
solrbot wants to merge 5 commits into
apache:branch_9xfrom
solrbot:renovate-9x/no.nav.security-mock-oauth2-server-6.x

Conversation

@solrbot

@solrbot solrbot commented Aug 8, 2026

Copy link
Copy Markdown
Collaborator

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
no.nav.security:mock-oauth2-server test major 0.5.10 → 6.0.0

Release Notes

navikt/mock-oauth2-server (no.nav.security:mock-oauth2-server)

v6.0.0

Compare Source

What's Changed

⚠️ Breaking Changes

  • mock-oauth2-server no longer bundles ch.qos.logback:logback-classic nor kotlinx-serialization-json in its library.
    • If your test logs went quiet, add testRuntimeOnly("ch.qos.logback:logback-classic:<version>"). slf4j-api still comes transitively.
  • The debugger UI (/<issuer>/debugger and /<issuer>/debugger/callback) can no longer target an external identity provider.
  • DebuggerRequestHandler now takes an OAuth2HttpServer instead of an Ssl?.
  • With (#​1002), the library now uses Jackson 3 (tools.jackson.*) instead of Jackson 2 (com.fasterxml.jackson.*).
    • Consumers on Jackson 2 are unaffected. Jackson 3 uses a different group ID and package, and still depends on jackson-annotations 2.x.
    • no.nav.security.mock.oauth2.http.objectMapper and the deserializers nested in OAuth2Config are now internal. Construct your own mapper if you used objectMapper.
  • NettyWrapper rejects request bodies above 1 MiB with 413. This affects the standalone server and Docker image; MockWebServerWrapper is unaffected.

See also the migration guide.

🐛 Bug Fixes

🧰 Maintenance

⬆️ Dependency upgrades

New Contributors

Full Changelog: navikt/mock-oauth2-server@5.0.2...5.0.3

v5.0.2

Compare Source

What's Changed

🐛 Bug Fixes

⬆️ Dependency upgrades

v5.0.1

Compare Source

Why 5.0.1

This is a roll-forward patch release after 5.0.0.

5.0.0 was already published to GitHub Packages, and re-running publish for the same version fail with 409 Conflict (artifact already exists).
5.0.1 is created to proceed with a clean publish attempt from a new version.

No intended library API changes in 5.0.1.

v5.0.0

Compare Source

What's Changed

This release introduces interactive-login claim mapping improvements, including a breaking claim-precedence change, plus CI and maintenance updates.

  • Added support for interactive login with requestMapping claim selection.
  • Breaking: when keys collide, claims from matching requestMappings now override login-page claims.
  • Added migration guidance for this behavior in MIGRATION.md.
  • Hardened release workflows (version resolution via release tag + fail-fast/debug logging).
  • Migrated Release Drafter config away from deprecated fields.
  • Included formatting cleanup, test/build follow-ups, and dependency upgrades.

🚀 Features

⚠️ Breaking Changes

Before: claims submitted on the login page could overwrite claims from matching requestMappings.
Now: claims from matching requestMappings take precedence on key collisions.

Login-page claims still apply for keys not already set by the mapping.

👉 See full migration details: MIGRATION.md

🧰 Maintenance

⬆️ Dependency upgrades

v4.0.1

Compare Source

What's Changed

🧰 Maintenance

🔒 Security

⬆️ Dependency upgrades

v4.0.0

Compare Source

What's Changed

🚀 Features

⚠️ Breaking Changes

Previously any arbitrary string was accepted as a refresh_token.
Tests relying on this behavior will now receive 400 invalid_grant.
See the migration guide for details.

Affected test patterns:

❌ Passing a hardcoded or arbitrary string as refresh_token
❌ Expecting refresh to succeed after revocation
❌ Presenting a refresh token issued by issuer A to issuer B

🐛 Bug Fixes

🧰 Maintenance

⬆️ Dependency upgrades

  • chore(deps): bump release-drafter/release-drafter from 7.2.1 to 7.3.0 in the github-actions group (#​939) @​dependabot[bot]

v3.0.3

Compare Source

What's Changed

v3.0.2

Compare Source

What's Changed

⬆️ Dependency upgrades

v3.0.1

Compare Source

What's Changed

⬆️ Dependency upgrades

v3.0.0

Compare Source

What's Changed

  • feat(build): use chainguard jre:latest-dev base image for docker healthcheck support (#​882) @​tronghn
  • fix(introspect): exp, iat, nbf claims were always null (#​865) @​Lutonite

⚠️ Breaking Changes

  • refactor: replace custom TokenExchangeGrant with Nimbus SDK grant (#​732) @​tommytroen
    • TokenExchangeGrant.kt has been removed in favor of com.nimbusds.oauth2.sdk.tokenexchange.TokenExchangeGrant
    • this affects the extension function fun TokenRequest.tokenExchangeGrantOrNull()
  • The aud property in IntrospectResponse is now a List<String> instead of String
  • The Docker image now uses Chainguard's jre:latest-dev base image for Docker healthcheck support

⬆️ Dependency upgrades

v2.3.0

Compare Source

What's Changed

🚀 Features

⬆️ Dependency upgrades

  • build(deps): bump various dependencies to latest minor and patch (5505ba) @​tronghn

v2.2.1

Compare Source

What's Changed

Full Changelog: navikt/mock-oauth2-server@2.2.0...2.2.1

v2.2.0

Compare Source

What's Changed

  • feat: prefer issuer as client assertion audience for private_key_jwt auth (#​847) @​tronghn

⬆️ Dependency upgrades

Full Changelog: navikt/mock-oauth2-server@2.1.11...2.2.0

v2.1.11

Compare Source

What's Changed

⬆️ Dependency upgrades

  • chore(deps): bump the github group across 1 directory with 19 updates (#​833) @​dependabot[bot]
  • chore(deps): bump JamesIves/github-pages-deploy-action from 4.7.2 to 4.7.3 in the github group (#​812) @​dependabot[bot]
  • chore(deps): bump the github group across 1 directory with 13 updates (#​818) @​dependabot[bot]
  • chore(deps): bump dependabot/fetch-metadata from 2.2.0 to 2.3.0 in the github group (#​801) @​dependabot[bot]
  • chore(deps): bump the github group across 1 directory with 14 updates (#​810) @​dependabot[bot]
  • chore(deps): bump the github group across 1 directory with 32 updates (#​789) @​dependabot[bot]
  • chore(deps): bump JamesIves/github-pages-deploy-action from 4.6.8 to 4.7.2 in the github group across 1 directory (#​776) @​dependabot[bot]
  • chore(deps): bump JamesIves/github-pages-deploy-action from 4.6.3 to 4.6.8 in the github group across 1 directory (#​747) @​dependabot[bot]
  • chore(deps): bump the github group across 1 directory with 21 updates (#​765) @​dependabot[bot]

v2.1.10

Compare Source

What's Changed

⬆️ Dependency upgrades

v2.1.9

Compare Source

What's Changed

⬆️ Dependency upgrades

v2.1.8

Compare Source

What's Changed

🐛 Bug Fixes

⬆️ Dependency upgrades

  • chore(deps): bump the github group across 1 directory with 20 updates (#​709) @​dependabot
  • chore(deps): bump org.jetbrains.kotlinx:kotlinx-serialization-json from 1.6.3 to 1.7.0 in the github group (#​702) @​dependabot

v2.1.7

Compare Source

What's Changed

🚀 Features

v2.1.6

Compare Source

What's Changed

⬆️ Dependency upgrades

v2.1.5

Compare Source

What's Changed

🚀 Features

⬆️ Dependency upgrades

v2.1.4

Compare Source

What's Changed

⬆️ Dependency upgrades

v2.1.3

Compare Source

What's Changed

Breaking changes

  • The constructor for the OAuth2Config class accepts a new parameter rotateRefreshToken. This has a default value of false. You may need to update your code if you're instantiating a OAuth2Config without named parameters.

🚀 Features

⬆️ Dependency upgrades

v2.1.2

Compare Source

What's Changed

⬆️ Dependency upgrades

v2.1.1

Compare Source

What's Changed

⬆️ Dependency upgrades

v2.1.0

Compare Source

What's Changed

🚀 Features

  • Regex based matching in RequestMappingTokenCallback and request parameters used as variables inside claims (#​578) @​kvokacka

⬆️ Dependency upgrades

v2.0.1

Compare Source

What's Changed

🚀 Features

🐛 Bug Fixes

  • fix: use hostname instead of canonicalHostname (#​586) @​tronghn
    • this should resolve issues with inconsistent URLs for Windows users
  • fix(httpRequest): naming clash, update nimbus sdk to latest (#​576) @​ybelMekk

⬆️ Dependency upgrades

v2.0.0

Compare Source

What's Changed

🚀 Features

⚠️ Breaking Changes

⬆️ Dependency upgrades

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Every minute (* * * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot

@solrbot solrbot added the exempt-stale Prevent a PR from going stale label Aug 8, 2026
@solrbot

solrbot commented Aug 8, 2026

Copy link
Copy Markdown
Collaborator Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined
Command failed: ./gradlew updateLicenses
SLF4J(W): No SLF4J providers were found.
SLF4J(W): Defaulting to no-operation (NOP) logger implementation
SLF4J(W): See https://www.slf4j.org/codes.html#noProviders for further details.
Note: Some input files use or override a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
Note: Some input files use or override a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
Note: Some input files use or override a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
Note: Some input files use or override a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
Note: /tmp/renovate/repos/github/apache/solr/solr/modules/analysis-extras/src/java/org/apache/solr/schema/ICUCollationField.java uses or overrides a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
Note: Some input files use or override a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
Note: Some input files use or override a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
Note: Some input files use or override a deprecated API.
Note: Recompile with -Xlint:deprecation for details.

FAILURE: Build failed with an exception.

* Where:
Script '/tmp/renovate/repos/github/apache/solr/gradle/validation/jar-checks.gradle' line: 132

* What went wrong:
Execution failed for task ':solr:modules:jwt-auth:collectJarInfos'.
> Could not resolve all dependencies for configuration ':solr:modules:jwt-auth:testRuntimeClasspath'.
   > Could not resolve no.nav.security:mock-oauth2-server.
     Required by:
         project :solr:modules:jwt-auth
      > Dependency resolution is looking for a library compatible with JVM runtime version 11, but 'no.nav.security:mock-oauth2-server:6.0.0' is only compatible with JVM runtime version 17 or newer.
   > Could not resolve no.nav.security:mock-oauth2-server.
     Required by:
         project :solr:modules:jwt-auth > root project :
      > Dependency resolution is looking for a library compatible with JVM runtime version 11, but 'no.nav.security:mock-oauth2-server:6.0.0' is only compatible with JVM runtime version 17 or newer.
> There is 1 more failure with an identical cause.

* Try:
> Change the dependency on 'no.nav.security:mock-oauth2-server:6.0.0' to an earlier version that supports JVM runtime version 11.
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Get more help at https://help.gradle.org.

BUILD FAILED in 40s

@github-actions github-actions Bot added the dependencies Dependency upgrades label Aug 8, 2026
@github-actions github-actions Bot removed the dependencies Dependency upgrades label Aug 12, 2026
@epugh epugh changed the title Update dependency no.nav.security:mock-oauth2-server to v6 (branch_9x) Pin dependency no.nav.security:mock-oauth2-server to 0.5.16 to remain java 11 compatible. (branch_9x) Aug 12, 2026
@solrbot

solrbot commented Aug 13, 2026

Copy link
Copy Markdown
Collaborator Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

janhoy
janhoy approved these changes Aug 13, 2026
View reviewed changes

@janhoy janhoy left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. Personally I'd have closed the renovate PR and created a new one for thiese renovate rules, linking the solrbot-pr, thus explaining why it was closed. But the end game will be the same I guess

@epugh

epugh commented Aug 13, 2026

Copy link
Copy Markdown
Contributor

Looks good. Personally I'd have closed the renovate PR and created a new one for thiese renovate rules, linking the solrbot-pr, thus explaining why it was closed. But the end game will be the same I guess

i can do that. Sometimes I struggle with all the ceremony around just the writing code and fixing the problem. The pr, the jira, the review. But then I remember that is part of what makes us work as an effective community.

This was referenced Aug 13, 2026
Closed
Merged
@github-actions github-actions Bot added the dependencies Dependency upgrades label Aug 13, 2026
@epugh

epugh commented Aug 13, 2026

Copy link
Copy Markdown
Contributor

Closing as these dependencies require moving past java 11 to java 17... And we use java 11 on branch_9x.

@epugh epugh closed this Aug 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@janhoy janhoy janhoy approved these changes

Assignees

No one assigned

Labels

dependencies Dependency upgrades exempt-stale Prevent a PR from going stale

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@solrbot @epugh @janhoy