From ef19af3beadd68a00bca58630d244878bae37fbe Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 3 Nov 2026 05:27:23 +0000 Subject: [PATCH 1/7] Bump the maven-minor-and-patch group with 9 updates Bumps the maven-minor-and-patch group with 9 updates: | Package | From | To | | --- | --- | --- | | [com.nimbusds:nimbus-jose-jwt](https://bitbucket.org/connect2id/nimbus-jose-jwt) | `10.0.2` | `10.10` | | [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) | `3.11.0` | `3.16.0` | | [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.2.5` | `3.6.1` | | [org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin) | `3.6.0` | `3.6.2` | | [org.apache.maven.plugins:maven-source-plugin](https://github.com/apache/maven-source-plugin) | `3.3.1` | `3.4.0` | | [org.apache.maven.plugins:maven-javadoc-plugin](https://github.com/apache/maven-javadoc-plugin) | `3.11.2` | `3.12.0` | | [org.apache.maven.plugins:maven-gpg-plugin](https://github.com/apache/maven-gpg-plugin) | `3.2.7` | `3.2.8` | | [org.codehaus.mojo:exec-maven-plugin](https://github.com/mojohaus/exec-maven-plugin) | `3.1.0` | `3.6.4` | | [org.apache.maven.plugins:maven-dependency-plugin](https://github.com/apache/maven-dependency-plugin) | `3.6.1` | `3.11.0` | Updates `com.nimbusds:nimbus-jose-jwt` from 10.0.2 to 10.10 - [Changelog](https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt) - [Commits](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/10.10..10.0.2) Updates `org.apache.maven.plugins:maven-compiler-plugin` from 3.11.0 to 3.16.0 - [Release notes](https://github.com/apache/maven-compiler-plugin/releases) - [Commits](https://github.com/apache/maven-compiler-plugin/compare/maven-compiler-plugin-3.11.0...maven-compiler-plugin-3.16.0) Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.2.5 to 3.6.1 - [Release notes](https://github.com/apache/maven-surefire/releases) - [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.2.5...surefire-3.6.1) Updates `org.codehaus.mojo:build-helper-maven-plugin` from 3.6.0 to 3.6.2 - [Release notes](https://github.com/mojohaus/build-helper-maven-plugin/releases) - [Commits](https://github.com/mojohaus/build-helper-maven-plugin/compare/3.6.0...3.6.2) Updates `org.apache.maven.plugins:maven-source-plugin` from 3.3.1 to 3.4.0 - [Release notes](https://github.com/apache/maven-source-plugin/releases) - [Commits](https://github.com/apache/maven-source-plugin/compare/maven-source-plugin-3.3.1...maven-source-plugin-3.4.0) Updates `org.apache.maven.plugins:maven-javadoc-plugin` from 3.11.2 to 3.12.0 - [Release notes](https://github.com/apache/maven-javadoc-plugin/releases) - [Commits](https://github.com/apache/maven-javadoc-plugin/compare/maven-javadoc-plugin-3.11.2...maven-javadoc-plugin-3.12.0) Updates `org.apache.maven.plugins:maven-gpg-plugin` from 3.2.7 to 3.2.8 - [Release notes](https://github.com/apache/maven-gpg-plugin/releases) - [Commits](https://github.com/apache/maven-gpg-plugin/compare/maven-gpg-plugin-3.2.7...maven-gpg-plugin-3.2.8) Updates `org.codehaus.mojo:exec-maven-plugin` from 3.1.0 to 3.6.4 - [Release notes](https://github.com/mojohaus/exec-maven-plugin/releases) - [Commits](https://github.com/mojohaus/exec-maven-plugin/compare/exec-maven-plugin-3.1.0...3.6.4) Updates `org.apache.maven.plugins:maven-dependency-plugin` from 3.6.1 to 3.11.0 - [Release notes](https://github.com/apache/maven-dependency-plugin/releases) - [Commits](https://github.com/apache/maven-dependency-plugin/compare/maven-dependency-plugin-3.6.1...maven-dependency-plugin-3.11.0) --- updated-dependencies: - dependency-name: com.nimbusds:nimbus-jose-jwt dependency-version: '10.10' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-minor-and-patch - dependency-name: org.apache.maven.plugins:maven-compiler-plugin dependency-version: 3.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-minor-and-patch - dependency-name: org.apache.maven.plugins:maven-surefire-plugin dependency-version: 3.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-minor-and-patch - dependency-name: org.codehaus.mojo:build-helper-maven-plugin dependency-version: 3.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven-minor-and-patch - dependency-name: org.apache.maven.plugins:maven-source-plugin dependency-version: 3.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: maven-minor-and-patch - dependency-name: org.apache.maven.plugins:maven-javadoc-plugin dependency-version: 3.12.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: maven-minor-and-patch - dependency-name: org.apache.maven.plugins:maven-gpg-plugin dependency-version: 3.2.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: maven-minor-and-patch - dependency-name: org.codehaus.mojo:exec-maven-plugin dependency-version: 3.6.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: maven-minor-and-patch - dependency-name: org.apache.maven.plugins:maven-dependency-plugin dependency-version: 3.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: maven-minor-and-patch ... Signed-off-by: dependabot[bot] --- demo/pom.xml | 10 +++++----- library/pom.xml | 14 +++++++------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/demo/pom.xml b/demo/pom.xml index 6ed0308..25c1141 100644 --- a/demo/pom.xml +++ b/demo/pom.xml @@ -27,14 +27,14 @@ maven-compiler-plugin - 3.11.0 + 3.16.0 17 maven-surefire-plugin - 3.2.5 + 3.6.1 ${project.basedir}/.. @@ -45,7 +45,7 @@ compiled into the test classpaths only, never into a published jar. --> org.codehaus.mojo build-helper-maven-plugin - 3.6.0 + 3.6.2 test-fixtures @@ -60,14 +60,14 @@ org.codehaus.mojo exec-maven-plugin - 3.1.0 + 3.6.4 com.iyasec.saml.demo.Demo maven-dependency-plugin - 3.6.1 + 3.11.0 copy-dependencies diff --git a/library/pom.xml b/library/pom.xml index d8142f3..3616134 100644 --- a/library/pom.xml +++ b/library/pom.xml @@ -43,7 +43,7 @@ com.nimbusds nimbus-jose-jwt - 10.0.2 + 10.10 org.junit.jupiter @@ -56,21 +56,21 @@ maven-compiler-plugin - 3.11.0 + 3.16.0 17 maven-surefire-plugin - 3.2.5 + 3.6.1 org.codehaus.mojo build-helper-maven-plugin - 3.6.0 + 3.6.2 test-fixtures @@ -99,7 +99,7 @@ org.apache.maven.plugins maven-source-plugin - 3.3.1 + 3.4.0 attach-sources @@ -110,7 +110,7 @@ org.apache.maven.plugins maven-javadoc-plugin - 3.11.2 + 3.12.0 all,-missing @@ -125,7 +125,7 @@ org.apache.maven.plugins maven-gpg-plugin - 3.2.7 + 3.2.8 bc From b7835e670141133e7acf2e2578188a99f96e9662 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 3 Nov 2026 05:27:27 +0000 Subject: [PATCH 2/7] Bump org.junit.jupiter:junit-jupiter from 5.10.2 to 6.1.3 Bumps [org.junit.jupiter:junit-jupiter](https://github.com/junit-team/junit-framework) from 5.10.2 to 6.1.3. - [Release notes](https://github.com/junit-team/junit-framework/releases) - [Commits](https://github.com/junit-team/junit-framework/compare/r5.10.2...r6.1.3) --- updated-dependencies: - dependency-name: org.junit.jupiter:junit-jupiter dependency-version: 6.1.3 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- demo/pom.xml | 2 +- library/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/demo/pom.xml b/demo/pom.xml index 6ed0308..ca548df 100644 --- a/demo/pom.xml +++ b/demo/pom.xml @@ -19,7 +19,7 @@ org.junit.jupiter junit-jupiter - 5.10.2 + 6.1.3 test diff --git a/library/pom.xml b/library/pom.xml index d8142f3..a031d45 100644 --- a/library/pom.xml +++ b/library/pom.xml @@ -48,7 +48,7 @@ org.junit.jupiter junit-jupiter - 5.10.2 + 6.1.3 test From ee27a4e9ec82ad392aade43a6b4f2856cd3fa0f2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 3 Nov 2026 05:27:30 +0000 Subject: [PATCH 3/7] Bump org.apache.santuario:xmlsec from 2.3.4 to 4.0.4 Bumps org.apache.santuario:xmlsec from 2.3.4 to 4.0.4. --- updated-dependencies: - dependency-name: org.apache.santuario:xmlsec dependency-version: 4.0.4 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- library/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/library/pom.xml b/library/pom.xml index d8142f3..c92e443 100644 --- a/library/pom.xml +++ b/library/pom.xml @@ -38,7 +38,7 @@ org.apache.santuario xmlsec - 2.3.4 + 4.0.4 com.nimbusds From 59915dc53406b634124f35d21b17dc7573d68fb2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 3 Nov 2026 05:28:07 +0000 Subject: [PATCH 4/7] Bump maven Bumps the docker-minor-and-patch group with 1 update: maven. Updates `maven` from 3.9.6-eclipse-temurin-17 to 3.9-eclipse-temurin-26 --- updated-dependencies: - dependency-name: maven dependency-version: 3.9-eclipse-temurin-26 dependency-type: direct:production dependency-group: docker-minor-and-patch ... Signed-off-by: dependabot[bot] --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 4032b63..3b603b7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ # `docker build --target test` runs the suite in this image. # The demo image below does not run it. -FROM maven:3.9.6-eclipse-temurin-17 AS test +FROM maven:3.9-eclipse-temurin-26 AS test # TrustChainTest runs the install script's trust-chain code: python3, and the # openssl CLI it reads certificate names with. RUN apt-get update && apt-get install -y --no-install-recommends python3 openssl && rm -rf /var/lib/apt/lists/* @@ -19,7 +19,7 @@ COPY scripts scripts COPY demo/saml.json demo/saml.json RUN mvn -B test -FROM maven:3.9.6-eclipse-temurin-17 AS build +FROM maven:3.9-eclipse-temurin-26 AS build WORKDIR /src COPY pom.xml . COPY library library From 6bef09cea8b22d9887e914e1d460992de6b5fc7b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 3 Nov 2026 05:28:09 +0000 Subject: [PATCH 5/7] Bump eclipse-temurin from 17-jre to 25-jre Bumps eclipse-temurin from 17-jre to 25-jre. --- updated-dependencies: - dependency-name: eclipse-temurin dependency-version: 25-jre dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 4032b63..bcef02b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -27,7 +27,7 @@ COPY demo/pom.xml demo/pom.xml COPY demo/src demo/src # The demo module copies its runtime dependencies, the library among them, to demo/target/dependency. RUN mvn -B -DskipTests package -FROM eclipse-temurin:17-jre +FROM eclipse-temurin:25-jre WORKDIR /app # The demo's jar under the name the image has always run, and beside it every # runtime dependency, the library jar among them (com.iyasec.saml.Cli is there). From 939ac4c6bec52ceff22c07b3b71b6954c4bf79d7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 6 Nov 2026 10:32:25 +0000 Subject: [PATCH 6/7] Bump actions/checkout from 4 to 7 Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/nightly.yml | 2 +- .github/workflows/publish.yml | 2 +- .github/workflows/tests.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 5c50e4b..a965570 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -15,7 +15,7 @@ jobs: suite: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Unit suite run: docker build --target test . - name: Live iya-sts diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index d020733..3035f48 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -57,7 +57,7 @@ jobs: fi # Every tag: the last release's tag is what the decision compares with. - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 if: steps.gate.outputs.publish == 'true' with: ref: ${{ github.event.workflow_run.head_sha }} diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 3525a9c..98a7dc0 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -15,5 +15,5 @@ jobs: name: Library tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - run: docker build --target test . From e516c1a5e02633229ddf61ff830c8b914624ff63 Mon Sep 17 00:00:00 2001 From: rcbjBlueMars <9321971+rcbjBlueMars@users.noreply.github.com> Date: Sun, 8 Nov 2026 12:24:32 -0800 Subject: [PATCH 7/7] Document the Java 25 runtime and Temurin 26 Maven test image. --- CLAUDE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CLAUDE.md b/CLAUDE.md index 6d64c1f..ca2cb6b 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -20,7 +20,7 @@ Request bindings are `redirect` and `post`. Response bindings are `post`, `redir docker build --target test . ``` -The `test` stage runs `mvn -B test` in `maven:3.9.6-eclipse-temurin-17`, with `python3` and `openssl` installed for `TrustChainTest` (the install script's code and `scripts/trust_chain.py` write the four-certificate chain to `idpCa`'s path; the library trusts the provider and a reissued leaf through that file, and refuses a forged leaf followed by the real CA certificates and the right chain under the wrong host name). GitHub Actions uses that command. Do not run Maven on the host. The demo stage packages with `-DskipTests` in its own Maven image. Signatures and decryption are real (JDK ciphers, Apache Santuario exclusive canonicalization). Nimbus JOSE verifies Shared Signals JWS only. The stub identity provider is in `src/test/java/com/iyasec/saml/StubIdp.java`. The stub tests do not start iya-sts. Java 17. +The `test` stage runs `mvn -B test` in `maven:3.9-eclipse-temurin-26`, with `python3` and `openssl` installed for `TrustChainTest` (the install script's code and `scripts/trust_chain.py` write the four-certificate chain to `idpCa`'s path; the library trusts the provider and a reissued leaf through that file, and refuses a forged leaf followed by the real CA certificates and the right chain under the wrong host name). GitHub Actions uses that command. Do not run Maven on the host. The demo stage packages with `-DskipTests` in its own Maven image. Signatures and decryption are real (JDK ciphers, Apache Santuario exclusive canonicalization). Nimbus JOSE verifies Shared Signals JWS only. The stub identity provider is in `src/test/java/com/iyasec/saml/StubIdp.java`. The stub tests do not start iya-sts. Java 25. `python3 scripts/live_iya_sts.py` signs the demo in to iya-sts and checks credential-change and session-revoked on `GET /live-status`. It builds the demo the way a user does: in a scratch copy of the checkout, the install script first (writing the key pair, the metadata and the `idpCa` chain; its Java CLI runs in the demo image), then the image build, then the run with only `sp.key`, `sp.crt` and `idp-metadata.xml` mounted. No CA mount, no `idpCa` rewrite; it checks the image holds the chain and no key. Secrets go to docker as `-e NAME`; no log line carries a sign-in URL. The nightly workflow runs the unit suite and that script once every 24 hours. Neither binds port 3000, 8081 or 18481-18495; the defaults are 18555 and 18655. Push CI stays the unit suite.