Combine Dependabot PRs #11977
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -70,7 +70,7 @@ dependencies { | |
| exclude(group: 'org.jetbrains', module: 'annotations') | ||
| } | ||
|
|
||
| provided('com.google.cloud.tools:jib-core:0.28.2') { | ||
| exclude group: 'com.google.guava', module: 'guava' | ||
| exclude group: 'com.fasterxml.jackson.datatype', module: 'jackson-datatype-jsr310' | ||
| exclude group: 'com.fasterxml.jackson.core', module: 'jackson-core' | ||
|
|
@@ -96,16 +96,16 @@ dependencies { | |
|
|
||
| shaded 'org.glassfish.main.external:trilead-ssh2-repackaged:4.1.2' | ||
|
|
||
| shaded 'org.zeroturnaround:zt-exec:1.13.0' | ||
|
|
||
| testRuntimeOnly 'org.junit.platform:junit-platform-launcher:1.14.3' | ||
|
|
||
| testImplementation 'org.junit.jupiter:junit-jupiter:5.13.4' | ||
|
Comment on lines
101
to
103
There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
./gradlew :core:dependencyInsight \
--configuration testRuntimeClasspath \
--dependency org.junit.platform:junit-platform-launcher
./gradlew :core:dependencyInsight \
--configuration testRuntimeClasspath \
--dependency org.junit.platform:junit-platform-engine
./gradlew :core:dependencyInsight \
--configuration jarFileTestRuntimeClasspath \
--dependency org.junit.platform:junit-platform-launcher
./gradlew :core:test :core:jarFileTestRepository: testcontainers/testcontainers-java Length of output: 5578 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- core/build.gradle relevant sections ---'
sed -n '1,130p' core/build.gradle
printf '%s\n' '--- JUnit declarations and constraints ---'
rg -n -i 'junit|jupiter|platform|dependencyManagement|constraints|resolutionStrategy|versionCatalog' \
--glob '*.gradle' --glob '*.gradle.kts' --glob '*.toml' --glob '*.properties' .
printf '%s\n' '--- test source-set and custom configuration references ---'
rg -n 'jarFileTest|testRuntimeClasspath|testImplementation|testRuntimeOnly|sourceSets|configurations' \
core --glob '*.gradle' --glob '*.gradle.kts' --glob '*.java' --glob '*.kt'Repository: testcontainers/testcontainers-java Length of output: 15675 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- root build configuration ---'
sed -n '1,180p' build.gradle
printf '%s\n' '--- settings and Gradle dependency-management files ---'
rg -n -i 'resolutionStrategy|failOnVersionConflict|force |junit-bom|dependencyConstraints|constraints|platform\\(' \
--glob '*.gradle' --glob '*.gradle.kts' --glob '*.toml' --glob '*.properties' \
build.gradle settings.gradle gradle core 2>/dev/null || true
printf '%s\n' '--- JUnit 5.13.4 and Platform 1.13.4/1.14.3 POM dependencies ---'
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
for coordinate in \
'org.junit.jupiter:junit-jupiter:5.13.4' \
'org.junit.jupiter:junit-jupiter-engine:5.13.4' \
'org.junit.platform:junit-platform-launcher:1.14.3' \
'org.junit.platform:junit-platform-launcher:1.13.4'
do
IFS=: read -r group artifact version <<< "$coordinate"
path="${group//.//}/$artifact/$version/$artifact-$version.pom"
curl --fail --silent --show-error "https://repo.maven.apache.org/maven2/$path" \
-o "$tmpdir/$artifact-$version.pom"
printf '\n[%s]\n' "$coordinate"
python3 - "$tmpdir/$artifact-$version.pom" <<'PY'
import sys
import xml.etree.ElementTree as ET
root = ET.parse(sys.argv[1]).getroot()
ns = {'m': 'http://maven.apache.org/POM/4.0.0'}
for dep in root.findall('.//m:dependencies/m:dependency', ns):
g = dep.findtext('m:groupId', namespaces=ns)
a = dep.findtext('m:artifactId', namespaces=ns)
v = dep.findtext('m:version', namespaces=ns)
scope = dep.findtext('m:scope', namespaces=ns)
if g and (g.startswith('org.junit') or a == 'junit-platform-launcher'):
print(f'{g}:{a}:{v or "(managed)"} scope={scope or "compile"}')
PY
doneRepository: testcontainers/testcontainers-java Length of output: 5237 🌐 Web query:
💡 Result: Gradle's default conflict resolution strategy is to select the highest requested version of a dependency encountered anywhere in the dependency graph [1][2][3]. Regarding JUnit compatibility, JUnit 5 is a collection of distinct modules (JUnit Platform, JUnit Jupiter, and JUnit Vintage) that are released together with aligned versions [4][5]. For JUnit 5.13.4, the aligned version for all primary components (Platform, Jupiter, and Vintage) is 5.13.4 [4][6]. Specifically, JUnit Jupiter 5.13.4 is designed to operate with JUnit Platform 1.13.4, not 1.14.3 [4][6]. Mixing different versions of JUnit 5 artifacts—such as using JUnit Jupiter 5.13.4 with JUnit Platform 1.14.3—is generally not recommended. Because Gradle's default behavior is to upgrade all components to the highest version found in the graph, it will automatically attempt to resolve conflicts by selecting the newest version of each module [2][7]. To ensure compatibility and avoid potential runtime issues, the official JUnit documentation strongly recommends using the JUnit Bill of Materials (BOM) ( Citations:
Align the JUnit versions. 🤖 Prompt for AI Agents |
||
| testImplementation('com.google.cloud.tools:jib-core:0.28.2') { | ||
| exclude group: 'com.google.guava', module: 'guava' | ||
| } | ||
| testImplementation 'org.apache.httpcomponents:httpclient:4.5.14' | ||
| testImplementation 'redis.clients:jedis:7.5.3' | ||
| testImplementation 'com.rabbitmq:amqp-client:5.26.0' | ||
| testImplementation 'org.mongodb:mongo-java-driver:3.12.14' | ||
|
|
||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,7 +3,7 @@ description = "Testcontainers :: JDBC :: CrateDB" | |
| dependencies { | ||
| api project(':testcontainers-jdbc') | ||
|
|
||
| testRuntimeOnly 'org.postgresql:postgresql:42.7.12' | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
rg -n -C 2 'org\.postgresql:postgresql:' --glob 'build.gradle' .Repository: testcontainers/testcontainers-java Length of output: 2269 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' 'PostgreSQL declarations:'
rg -n -C 2 'org\.postgresql:postgresql:' --glob '*.gradle' --glob '*.gradle.kts' .
printf '\n%s\n' 'Relevant build files:'
cat -n modules/cratedb/build.gradle
cat -n modules/postgresql/build.gradle
cat -n modules/cockroachdb/build.gradle
printf '\n%s\n' 'Changes in the reviewed module:'
git diff -- modules/cratedb/build.gradleRepository: testcontainers/testcontainers-java Length of output: 3633 🌐 Web query:
💡 Result: The PostgreSQL JDBC driver version 42.7.12 was released on June 29, 2026, primarily as a security update to address a silent channel-binding authentication downgrade (CVE-2026-54291) [1][2][3]. Version 42.7.10, released on February 11, 2026, did not include security fixes for channel-binding vulnerabilities [4][5]. Instead, the 42.7.10 release focused on bug fixes, such as resolving a regression regarding proleptic dates, and general maintenance [4][6][5]. Security context for 42.7.10 and 42.7.12: 1. CVE-2026-54291 (Silent Channel-Binding Authentication Downgrade): Affects driver versions 42.7.4 through 42.7.11 [2][7]. When using channelBinding=require, the driver could be silently downgraded to plain SCRAM-SHA-256 if the server presented a certificate with a signature algorithm lacking a tls-server-end-point channel-binding hash (e.g., Ed25519) [1][2][7]. This was patched in 42.7.12, where the driver now enforces channel binding by failing the connection if binding data cannot be extracted or if the negotiated mechanism does not use channel binding [3][7]. 2. CVE-2026-42198 (Client-side Denial of Service): This vulnerability, involving unbounded CPU consumption during SCRAM-SHA-256 authentication (via large iteration counts), affected driver versions from 42.2.0 up to (but excluding) 42.7.11 [8]. This was patched in version 42.7.11 [8]. If you are currently on version 42.7.10, you are vulnerable to both the Denial of Service issue (CVE-2026-42198) and the channel-binding downgrade (CVE-2026-54291) [9][7][8]. Upgrading to at least version 42.7.12 is recommended to address these security risks [7][8]. Citations:
Update the remaining PostgreSQL JDBC test dependencies.
🤖 Prompt for AI Agents |
||
|
|
||
| testImplementation project(':testcontainers-jdbc-test') | ||
|
|
||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,5 +3,5 @@ description = "Testcontainers :: Milvus" | |
| dependencies { | ||
| api project(':testcontainers') | ||
|
|
||
| testImplementation 'io.milvus:milvus-sdk-java:3.0.3' | ||
|
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
rg -n \
'milvus-sdk-java:3\.0\.3|milvusdb/milvus:v2\.3\.9|isEqualTo\("v2\.3\.9"\)' \
modules/milvus/build.gradle modules/milvus/src/test/javaRepository: testcontainers/testcontainers-java Length of output: 764 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- modules/milvus/build.gradle ---'
cat -n modules/milvus/build.gradle
printf '%s\n' '--- MilvusContainerTest.java ---'
cat -n modules/milvus/src/test/java/org/testcontainers/milvus/MilvusContainerTest.java
printf '%s\n' '--- Milvus SDK references ---'
rg -n -C 2 'milvus-sdk-java|MilvusClient|MilvusContainer|v2\.3\.9|3\.0\.3' \
modules/milvus gradle* settings.gradle* 2>/dev/null || trueRepository: testcontainers/testcontainers-java Length of output: 8571 🌐 Web query:
💡 Result: The Milvus Java SDK version 3.0.3 is not compatible with Milvus server version v2.3.9. According to official Milvus Java SDK documentation, the Milvus Java SDK v3.0.x series is designed to be compatible with Milvus server v3.0.x [1][2][3]. For Milvus server version v2.3.x, the recommended Java SDK version is v2.3.9 [2][4]. You should use the version that matches your server deployment to ensure stability and compatibility [2]. Using a 3.0.x SDK with a 2.3.x server is not recommended, as the SDK versions are mapped to specific Milvus server releases [1][2]. Citations:
Align the Milvus client and server versions.
🤖 Prompt for AI Agents |
||
| } | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,7 +3,7 @@ description = "Testcontainers :: Qdrant" | |
| dependencies { | ||
| api project(':testcontainers') | ||
|
|
||
| testImplementation 'io.qdrant:client:1.18.3' | ||
|
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
rg -n \
'io\.qdrant:client:1\.18\.3|qdrant/qdrant:v1\.7\.4|isEqualTo\("1\.7\.4"\)' \
modules/qdrant/build.gradle modules/qdrant/src/test/javaRepository: testcontainers/testcontainers-java Length of output: 1237 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- build.gradle ---'
cat -n modules/qdrant/build.gradle
printf '%s\n' '--- QdrantContainerTest.java ---'
cat -n modules/qdrant/src/test/java/org/testcontainers/qdrant/QdrantContainerTest.java
printf '%s\n' '--- Qdrant client usage ---'
rg -n -C 3 'io\.qdrant|QdrantClient|QdrantGrpcClient|HealthCheck' modules/qdrantRepository: testcontainers/testcontainers-java Length of output: 12008 🌐 Web query:
💡 Result: The Qdrant Java client 1.18.3 is not considered compatible with Qdrant server 1.7.4. Qdrant enforces a compatibility policy where the client and server minor versions should not differ by more than one [1][2][3]. Specifically, the client's internal version check logic determines compatibility based on whether the absolute difference between the major versions is zero and the absolute difference between the minor versions is at most one [1][3][4]. For Qdrant Java client 1.18.x, the expected compatible range for the Qdrant server is generally within the 1.17.x to 1.19.x series [5][6]. Because the version gap between client 1.18.x and server 1.7.x is significantly greater than one minor version, the client's automatic compatibility check will likely flag this as incompatible during initialization [1][3][4]. While you can bypass this check by setting the Citations:
🌐 Web query:
💡 Result: In the Qdrant Java client, Citations:
🌐 Web query:
💡 Result: The official Qdrant documentation states that all client SDKs, including the Java client, are tested to be backwards compatible with the latest 3 minor versions of the Qdrant server [1][2]. When performing upgrades, it is recommended to update your client SDKs before updating the cluster to ensure a smooth transition [1][2]. If you are running a self-hosted Qdrant instance and planning an upgrade across multiple minor versions, the standard practice is to upgrade sequentially through each intermediate minor version (e.g., 1.16.x to 1.17.x to 1.18.x) [1][2][3]. For detailed information regarding specific API changes or requirements associated with a particular release, you should consult the Qdrant release notes and the Java client repository [4][5]. Citations:
🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- repository references to compatibility configuration ---'
rg -n -C 4 'newBuilder\(|checkCompatibility|QdrantGrpcClient' --glob '*.java' --glob '*.kt' --glob '*.md' .Repository: testcontainers/testcontainers-java Length of output: 37761 Use a supported Qdrant client/server version pair.
🤖 Prompt for AI Agents |
||
| testImplementation platform('io.grpc:grpc-bom:1.80.0') | ||
| testImplementation 'io.grpc:grpc-stub' | ||
| testImplementation 'io.grpc:grpc-protobuf' | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: testcontainers/testcontainers-java
Length of output: 172
🏁 Script executed:
Repository: testcontainers/testcontainers-java
Length of output: 11147
🏁 Script executed:
Repository: testcontainers/testcontainers-java
Length of output: 1536
🏁 Script executed:
Repository: testcontainers/testcontainers-java
Length of output: 268
🏁 Script executed:
Repository: testcontainers/testcontainers-java
Length of output: 399
Align the pinned SHA and version annotation.
The SHA resolves to Release Drafter
v7.6.0, but the annotation remainsv5.19.0. Ifv7.6.0is intended, update the annotation and validate v6-to-v7 workflow compatibility. Otherwise, pin the intended version.🤖 Prompt for AI Agents