Merge develop into main

.github/workflows/nightly.yml

@@ -15,7 +15,7 @@ jobs:
   suite:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Unit suite
         run: docker build --target test .
       - name: Live iya-sts

.github/workflows/publish.yml

@@ -57,7 +57,7 @@ jobs:
           fi
 
       # Every tag: the last release's tag is what the decision compares with.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         if: steps.gate.outputs.publish == 'true'
         with:
           ref: ${{ github.event.workflow_run.head_sha }}

.github/workflows/tests.yml

@@ -15,5 +15,5 @@ jobs:
     name: Library tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - run: docker build --target test .

CLAUDE.md

@@ -20,7 +20,7 @@ Request bindings are `redirect` and `post`. Response bindings are `post`, `redir
 docker build --target test .
 ```
 
-The `test` stage runs `mvn -B test` in `maven:3.9.6-eclipse-temurin-17`, with `python3` and `openssl` installed for `TrustChainTest` (the install script's code and `scripts/trust_chain.py` write the four-certificate chain to `idpCa`'s path; the library trusts the provider and a reissued leaf through that file, and refuses a forged leaf followed by the real CA certificates and the right chain under the wrong host name). GitHub Actions uses that command. Do not run Maven on the host. The demo stage packages with `-DskipTests` in its own Maven image. Signatures and decryption are real (JDK ciphers, Apache Santuario exclusive canonicalization). Nimbus JOSE verifies Shared Signals JWS only. The stub identity provider is in `src/test/java/com/iyasec/saml/StubIdp.java`. The stub tests do not start iya-sts. Java 17.
+The `test` stage runs `mvn -B test` in `maven:3.9-eclipse-temurin-26`, with `python3` and `openssl` installed for `TrustChainTest` (the install script's code and `scripts/trust_chain.py` write the four-certificate chain to `idpCa`'s path; the library trusts the provider and a reissued leaf through that file, and refuses a forged leaf followed by the real CA certificates and the right chain under the wrong host name). GitHub Actions uses that command. Do not run Maven on the host. The demo stage packages with `-DskipTests` in its own Maven image. Signatures and decryption are real (JDK ciphers, Apache Santuario exclusive canonicalization). Nimbus JOSE verifies Shared Signals JWS only. The stub identity provider is in `src/test/java/com/iyasec/saml/StubIdp.java`. The stub tests do not start iya-sts. Java 25.
 
 `python3 scripts/live_iya_sts.py` signs the demo in to iya-sts and checks credential-change and session-revoked on `GET /live-status`. It builds the demo the way a user does: in a scratch copy of the checkout, the install script first (writing the key pair, the metadata and the `idpCa` chain; its Java CLI runs in the demo image), then the image build, then the run with only `sp.key`, `sp.crt` and `idp-metadata.xml` mounted. No CA mount, no `idpCa` rewrite; it checks the image holds the chain and no key. Secrets go to docker as `-e NAME`; no log line carries a sign-in URL. The nightly workflow runs the unit suite and that script once every 24 hours. Neither binds port 3000, 8081 or 18481-18495; the defaults are 18555 and 18655. Push CI stays the unit suite.
 

Dockerfile

@@ -4,7 +4,7 @@
 
 # `docker build --target test` runs the suite in this image.
 # The demo image below does not run it.
-FROM maven:3.9.6-eclipse-temurin-17 AS test
+FROM maven:3.9-eclipse-temurin-26 AS test
 # TrustChainTest runs the install script's trust-chain code: python3, and the
 # openssl CLI it reads certificate names with.
 RUN apt-get update && apt-get install -y --no-install-recommends python3 openssl && rm -rf /var/lib/apt/lists/*
@@ -19,15 +19,15 @@ COPY scripts scripts
 COPY demo/saml.json demo/saml.json
 RUN mvn -B test
 
-FROM maven:3.9.6-eclipse-temurin-17 AS build
+FROM maven:3.9-eclipse-temurin-26 AS build
 WORKDIR /src
 COPY pom.xml .
 COPY library library
 COPY demo/pom.xml demo/pom.xml
 COPY demo/src demo/src
 # The demo module copies its runtime dependencies, the library among them, to demo/target/dependency.
 RUN mvn -B -DskipTests package
-FROM eclipse-temurin:17-jre
+FROM eclipse-temurin:25-jre
 WORKDIR /app
 # The demo's jar under the name the image has always run, and beside it every
 # runtime dependency, the library jar among them (com.iyasec.saml.Cli is there).

demo/pom.xml

@@ -19,22 +19,22 @@
     <dependency>
       <groupId>org.junit.jupiter</groupId>
       <artifactId>junit-jupiter</artifactId>
-      <version>5.10.2</version>
+      <version>6.1.3</version>
       <scope>test</scope>
     </dependency>
   </dependencies>
   <build>
     <plugins>
       <plugin>
         <artifactId>maven-compiler-plugin</artifactId>
-        <version>3.11.0</version>
+        <version>3.16.0</version>
         <configuration>
           <release>17</release>
         </configuration>
       </plugin>
       <plugin>
         <artifactId>maven-surefire-plugin</artifactId>
-        <version>3.2.5</version>
+        <version>3.6.1</version>
         <configuration>
           <!-- TrustChainTest runs scripts/ and reads demo/saml.json from the repository root. -->
           <workingDirectory>${project.basedir}/..</workingDirectory>
@@ -45,7 +45,7 @@
              compiled into the test classpaths only, never into a published jar. -->
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>build-helper-maven-plugin</artifactId>
-        <version>3.6.0</version>
+        <version>3.6.2</version>
         <executions>
           <execution>
             <id>test-fixtures</id>
@@ -60,14 +60,14 @@
       <plugin>
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>exec-maven-plugin</artifactId>
-        <version>3.1.0</version>
+        <version>3.6.4</version>
         <configuration>
           <mainClass>com.iyasec.saml.demo.Demo</mainClass>
         </configuration>
       </plugin>
       <plugin>
         <artifactId>maven-dependency-plugin</artifactId>
-        <version>3.6.1</version>
+        <version>3.11.0</version>
         <executions>
           <execution>
             <id>copy-dependencies</id>

library/pom.xml

@@ -38,39 +38,39 @@
     <dependency>
       <groupId>org.apache.santuario</groupId>
       <artifactId>xmlsec</artifactId>
-      <version>2.3.4</version>
+      <version>4.0.4</version>
     </dependency>
     <dependency>
       <groupId>com.nimbusds</groupId>
       <artifactId>nimbus-jose-jwt</artifactId>
-      <version>10.0.2</version>
+      <version>10.10</version>
     </dependency>
     <dependency>
       <groupId>org.junit.jupiter</groupId>
       <artifactId>junit-jupiter</artifactId>
-      <version>5.10.2</version>
+      <version>6.1.3</version>
       <scope>test</scope>
     </dependency>
   </dependencies>
   <build>
     <plugins>
       <plugin>
         <artifactId>maven-compiler-plugin</artifactId>
-        <version>3.11.0</version>
+        <version>3.16.0</version>
         <configuration>
           <release>17</release>
         </configuration>
       </plugin>
       <plugin>
         <artifactId>maven-surefire-plugin</artifactId>
-        <version>3.2.5</version>
+        <version>3.6.1</version>
       </plugin>
       <plugin>
         <!-- StubIdp: a test fixture this module's tests and the demo's share. It is
              compiled into the test classpaths only, never into a published jar. -->
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>build-helper-maven-plugin</artifactId>
-        <version>3.6.0</version>
+        <version>3.6.2</version>
         <executions>
           <execution>
             <id>test-fixtures</id>
@@ -99,7 +99,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-source-plugin</artifactId>
-            <version>3.3.1</version>
+            <version>3.4.0</version>
             <executions>
               <execution>
                 <id>attach-sources</id>
@@ -110,7 +110,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-javadoc-plugin</artifactId>
-            <version>3.11.2</version>
+            <version>3.12.0</version>
             <configuration>
               <!-- Missing comments are not errors; malformed ones still are. -->
               <doclint>all,-missing</doclint>
@@ -125,7 +125,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-gpg-plugin</artifactId>
-            <version>3.2.7</version>
+            <version>3.2.8</version>
             <configuration>
               <signer>bc</signer>
             </configuration>