chore: bump version to 1.13.94Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0178DcBtadBBn3kNx6qBp1si
chore(deps): resolve vendored jars for the merged Renovate bumpsCo-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0178DcBtadBBn3kNx6qBp1si
chore(renovate): pin jackson-annotations to 2.x and group tools.jacksonJackson 3 uses the 2.x annotations (its BOM manages them at 2.22), and Maven
Central's newest com.fasterxml.jackson.core:jackson-annotations is 3.0-rc5, a
release candidate that sorts above every 2.x. allowedVersions keeps Renovate
from offering it. The Jackson group rule also matches tools.jackson now, so the
Jackson 3 jars still update together.
Co-Authored-By: Claude Sonnet 5.5 <noreply@ant...
feat(deps): move to Jackson 3 and Swagger 3swagger-core 3.0.0 is built on Jackson 3 (tools.jackson), so the framework's
Jackson 2 jars no longer serve it. Jackson 2 core, databind, xml, yaml and
jsr310 give way to tools.jackson core, databind, dataformat-xml and
dataformat-yaml 3.2.4, plus snakeyaml-engine 3.0.1 (the YAML module's parser).
jackson-annotations stays at 2.22: its package is unchanged.
renderXml(Object) now serializes wit...
fix: findById(null) returns null; 500.json/xml/txt hide exception detail outside DEV (PF-198)JPQL.findById returns null for a null id, as JPAModelLoader.findById does,
instead of Hibernate's "Identifier may not be null". A wrong-type id still
throws.
The default 500.json, 500.xml and 500.txt now show the exception only in DEV,
as 500.html does. Other modes get a fixed message and the incident id. The DEV
JSON is escaped with Gson so a multi-line message stays valid.
Co-Authored-By: C...
chore(deps): resolve vendored jars for the merged Renovate bumpsbrotli4j family 1.23.0 -> 1.24.0 (#71), hibernate-core and
hibernate-jcache 7.4.13.Final -> 7.4.14.Final (#72).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
build(testrunner): move FirePhoque to HtmlUnit 5.6.0 and drop the Jetty 9.4 suppressions (PF-196)play autotest's FirePhoque ran HtmlUnit 4.14.0, whose websocket client
shades Jetty 9.4.57. The release scan (PF-195) found CVE-2026-2332
there, request smuggling in Jetty's HTTP/1.1 parser, risk-accepted
until 2027-01-31 because no HtmlUnit 4.x shades a fixed Jetty (4.21.0
still has 9.4.58). Three more Jetty CVEs were suppressed because their
server code is not in the jar.
modules/testrunner/...
fix(play): run Gradle without a shared daemon under CI (PF-197)On a CI server every build runs as one user, so builds that overlap share
one pool of Gradle daemons, and Jenkins kills every process a build
started when that build ends. On the Academy Jenkins host that killed a
daemon Academy_Payments #467 had started while Abundent_API #3629 was
using it for `play autotest`: "Gradle build daemon disappeared
unexpectedly", a second after #467 ended, before a...
chore(renovate): hold the fork's dependency-check plugin to the applications' version (PF-195)Every dependency-check scan on a machine shares one NVD database, and a
dependency-check release may change its schema. On the Jenkins host the
nightly Dependency_Check_NVD_Update job, from the payments repo, writes
it at 12.2.2, and the fork's nightly scan reads it. A Renovate bump of
framework/dependency-check alone could leave the database unreadable to
one side, and /renovate would merge it...
build: write the dependency-check XML report for Jenkins (PF-195)The nightly Jenkins job that scans the fork publishes its findings with
the Dependency-Check publisher, as the Academy jobs do, and that reads
dependency-check-report.xml.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat(gradle-plugin): import the BOMs of the library families framework/lib ships (PF-193)Since PF-192 an application runs on the fork's copy of each library in
framework/lib, but a member of the same family that the fork does not
ship (mockwebserver3 beside okhttp-jvm, jackson-dataformat-csv beside
jackson-databind, netty-codec-dns beside the Netty codecs) still needs a
version, kept in step with the fork's family version by hand.
play1 { importFrameworkBoms = true }, opt-in, adds...
feat(gradle-plugin): warn when a dependency asks for a newer version of a library framework/lib ships (PF-194)PF-192 excludes every library in lib-coordinates.properties from the
application's graph, and the version a dependency asked for went with
the excluded edge. A dependency built against a newer Jackson, OkHttp or
commons-codec than the fork ships then runs on the fork's older copy and
fails at run time with NoSuchMethodError or NoClassDefFoundError, while
the build stays green and says nothing.
...
build: scan the jars the release ships for known vulnerabilities (PF-195)Nothing scanned framework/lib for known vulnerabilities, and since PF-192
the applications' own dependency-check scans no longer see those
libraries either, because Gradle no longer resolves them.
`ant dependency-check` runs OWASP dependency-check 12.2.2 over every jar
the release zip carries: framework/lib, play-<version>.jar, the bundled
modules' lib/ and firephoque, the Gradle wrapper, and ...
chore(deps): resolve vendored jars for the merged Renovate bumpscommons-codec 1.22.0 -> 1.23.0 and gson 2.14.0 -> 2.15.0 (tsukhani/play1#70).
commons-codec past 1.22.0 clears the one newer request PF-194 finds on
JClaw: Tika 4.1.0's parsers ask for 1.22.1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat(gradle-plugin): make framework/lib the only copy of each library the fork ships (PF-192)The plugin adds framework/lib as plain files, which carry no coordinates,
so Gradle resolved an application's own copy of the same library beside
the fork's, and with the resolved jars first on the classpath that copy
loaded. On jclaw 20 libraries were on both sides, 7 at different versions.
`ant jar` now writes framework/lib-coordinates.properties from
dependencies.yml (play.deps.LibCoordinat...
Tarun Sukhani![renovate[bot]](https://secure.gravatar.com/avatar/8555d8629c2fc48c5a5a2280a4715590.jpg?s=48&d=mm)
renovate[bot]