From 29d5f08793d9d8212448ca18613a6c2ba662cab8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 3 Nov 2026 05:28:57 +0000 Subject: [PATCH 1/6] Bump maven Bumps the docker-minor-and-patch group with 1 update: maven. Updates `maven` from 3.9.9-eclipse-temurin-17 to 3.9-eclipse-temurin-26 --- updated-dependencies: - dependency-name: maven dependency-version: 3.9-eclipse-temurin-26 dependency-type: direct:production dependency-group: docker-minor-and-patch ... Signed-off-by: dependabot[bot] --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 04ae352..dcfa328 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,7 +3,7 @@ # `docker build --target test` runs the suite in this image. # The demo image below does not run it. -FROM maven:3.9.9-eclipse-temurin-17 AS test +FROM maven:3.9-eclipse-temurin-26 AS test # TrustChainTest runs the install script's trust-chain code: python3, and the # openssl CLI it reads certificate names with. RUN apt-get update && apt-get install -y --no-install-recommends python3 openssl && rm -rf /var/lib/apt/lists/* @@ -18,7 +18,7 @@ COPY scripts ./scripts COPY demo/wsfed.json demo/wsfed.json RUN mvn -B test -FROM maven:3.9.9-eclipse-temurin-17 AS build +FROM maven:3.9-eclipse-temurin-26 AS build WORKDIR /src COPY pom.xml . COPY library library From 368b65577e4ef9e443d48b81fa4932a4eda4c417 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 3 Nov 2026 05:28:59 +0000 Subject: [PATCH 2/6] Bump eclipse-temurin from 17-jre to 25-jre Bumps eclipse-temurin from 17-jre to 25-jre. --- updated-dependencies: - dependency-name: eclipse-temurin dependency-version: 25-jre dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 04ae352..a310cd4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -26,7 +26,7 @@ COPY demo/pom.xml demo/pom.xml COPY demo/src demo/src # The demo module copies its runtime dependencies, the library among them, to demo/target/dependency. RUN mvn -B -DskipTests package -FROM eclipse-temurin:17-jre +FROM eclipse-temurin:25-jre WORKDIR /app RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/* # The demo's jar under the name the image has always run, and beside it every From 6947de3491a33f65fd603e0ed5f2c6c12fe9ad55 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 3 Nov 2026 05:28:59 +0000 Subject: [PATCH 3/6] Bump the maven-minor-and-patch group with 8 updates Bumps the maven-minor-and-patch group with 8 updates: | Package | From | To | | --- | --- | --- | | [com.nimbusds:nimbus-jose-jwt](https://bitbucket.org/connect2id/nimbus-jose-jwt) | `10.0.2` | `10.10` | | [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) | `3.8.1` | `3.16.0` | | [org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin) | `3.6.0` | `3.6.2` | | [org.apache.maven.plugins:maven-source-plugin](https://github.com/apache/maven-source-plugin) | `3.3.1` | `3.4.0` | | [org.apache.maven.plugins:maven-javadoc-plugin](https://github.com/apache/maven-javadoc-plugin) | `3.11.2` | `3.12.0` | | [org.apache.maven.plugins:maven-gpg-plugin](https://github.com/apache/maven-gpg-plugin) | `3.2.7` | `3.2.8` | | [org.codehaus.mojo:exec-maven-plugin](https://github.com/mojohaus/exec-maven-plugin) | `3.1.0` | `3.6.4` | | [org.apache.maven.plugins:maven-dependency-plugin](https://github.com/apache/maven-dependency-plugin) | `3.6.1` | `3.11.0` | Updates `com.nimbusds:nimbus-jose-jwt` from 10.0.2 to 10.10 - [Changelog](https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt) - [Commits](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/10.10..10.0.2) Updates `org.apache.maven.plugins:maven-compiler-plugin` from 3.8.1 to 3.16.0 - [Release notes](https://github.com/apache/maven-compiler-plugin/releases) - [Commits](https://github.com/apache/maven-compiler-plugin/compare/maven-compiler-plugin-3.8.1...maven-compiler-plugin-3.16.0) Updates `org.codehaus.mojo:build-helper-maven-plugin` from 3.6.0 to 3.6.2 - [Release notes](https://github.com/mojohaus/build-helper-maven-plugin/releases) - [Commits](https://github.com/mojohaus/build-helper-maven-plugin/compare/3.6.0...3.6.2) Updates `org.apache.maven.plugins:maven-source-plugin` from 3.3.1 to 3.4.0 - [Release notes](https://github.com/apache/maven-source-plugin/releases) - [Commits](https://github.com/apache/maven-source-plugin/compare/maven-source-plugin-3.3.1...maven-source-plugin-3.4.0) Updates `org.apache.maven.plugins:maven-javadoc-plugin` from 3.11.2 to 3.12.0 - [Release notes](https://github.com/apache/maven-javadoc-plugin/releases) - [Commits](https://github.com/apache/maven-javadoc-plugin/compare/maven-javadoc-plugin-3.11.2...maven-javadoc-plugin-3.12.0) Updates `org.apache.maven.plugins:maven-gpg-plugin` from 3.2.7 to 3.2.8 - [Release notes](https://github.com/apache/maven-gpg-plugin/releases) - [Commits](https://github.com/apache/maven-gpg-plugin/compare/maven-gpg-plugin-3.2.7...maven-gpg-plugin-3.2.8) Updates `org.codehaus.mojo:exec-maven-plugin` from 3.1.0 to 3.6.4 - [Release notes](https://github.com/mojohaus/exec-maven-plugin/releases) - [Commits](https://github.com/mojohaus/exec-maven-plugin/compare/exec-maven-plugin-3.1.0...3.6.4) Updates `org.apache.maven.plugins:maven-dependency-plugin` from 3.6.1 to 3.11.0 - [Release notes](https://github.com/apache/maven-dependency-plugin/releases) - [Commits](https://github.com/apache/maven-dependency-plugin/compare/maven-dependency-plugin-3.6.1...maven-dependency-plugin-3.11.0) --- updated-dependencies: - dependency-name: com.nimbusds:nimbus-jose-jwt dependency-version: '10.10' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-minor-and-patch - dependency-name: org.apache.maven.plugins:maven-compiler-plugin dependency-version: 3.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-minor-and-patch - dependency-name: org.codehaus.mojo:build-helper-maven-plugin dependency-version: 3.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven-minor-and-patch - dependency-name: org.apache.maven.plugins:maven-source-plugin dependency-version: 3.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: maven-minor-and-patch - dependency-name: org.apache.maven.plugins:maven-javadoc-plugin dependency-version: 3.12.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: maven-minor-and-patch - dependency-name: org.apache.maven.plugins:maven-gpg-plugin dependency-version: 3.2.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: maven-minor-and-patch - dependency-name: org.codehaus.mojo:exec-maven-plugin dependency-version: 3.6.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: maven-minor-and-patch - dependency-name: org.apache.maven.plugins:maven-dependency-plugin dependency-version: 3.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: maven-minor-and-patch ... Signed-off-by: dependabot[bot] --- demo/pom.xml | 8 ++++---- library/pom.xml | 12 ++++++------ 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/demo/pom.xml b/demo/pom.xml index d31c887..f7253ad 100644 --- a/demo/pom.xml +++ b/demo/pom.xml @@ -27,7 +27,7 @@ maven-compiler-plugin - 3.8.1 + 3.16.0 maven-surefire-plugin @@ -42,7 +42,7 @@ They are compiled into the test classpaths only, never into a published jar. --> org.codehaus.mojo build-helper-maven-plugin - 3.6.0 + 3.6.2 test-fixtures @@ -58,14 +58,14 @@ org.codehaus.mojo exec-maven-plugin - 3.1.0 + 3.6.4 com.iyasec.wsfed.demo.Demo maven-dependency-plugin - 3.6.1 + 3.11.0 copy-dependencies diff --git a/library/pom.xml b/library/pom.xml index 8983f75..2708632 100644 --- a/library/pom.xml +++ b/library/pom.xml @@ -44,7 +44,7 @@ com.nimbusds nimbus-jose-jwt - 10.0.2 + 10.10 org.junit.jupiter @@ -57,7 +57,7 @@ maven-compiler-plugin - 3.8.1 + 3.16.0 maven-surefire-plugin @@ -68,7 +68,7 @@ They are compiled into the test classpaths only, never into a published jar. --> org.codehaus.mojo build-helper-maven-plugin - 3.6.0 + 3.6.2 test-fixtures @@ -98,7 +98,7 @@ org.apache.maven.plugins maven-source-plugin - 3.3.1 + 3.4.0 attach-sources @@ -109,7 +109,7 @@ org.apache.maven.plugins maven-javadoc-plugin - 3.11.2 + 3.12.0 all,-missing @@ -124,7 +124,7 @@ org.apache.maven.plugins maven-gpg-plugin - 3.2.7 + 3.2.8 bc From dea23268e484275d90661ca891e5a0b6c6203866 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 3 Nov 2026 05:29:01 +0000 Subject: [PATCH 4/6] Bump org.apache.santuario:xmlsec from 2.3.4 to 4.0.4 Bumps org.apache.santuario:xmlsec from 2.3.4 to 4.0.4. --- updated-dependencies: - dependency-name: org.apache.santuario:xmlsec dependency-version: 4.0.4 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- library/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/library/pom.xml b/library/pom.xml index 8983f75..bec2a5b 100644 --- a/library/pom.xml +++ b/library/pom.xml @@ -39,7 +39,7 @@ org.apache.santuario xmlsec - 2.3.4 + 4.0.4 com.nimbusds From c765aca1370a2cafebcc79be57322b380ab44d76 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 6 Nov 2026 10:23:08 +0000 Subject: [PATCH 5/6] Bump actions/checkout from 4 to 7 Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/nightly.yml | 2 +- .github/workflows/publish.yml | 2 +- .github/workflows/tests.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 4b3542b..44fd170 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -15,7 +15,7 @@ jobs: suite: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Unit suite run: docker build --target test . - name: Live iya-sts diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 1d39fa6..c5bc1bc 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -57,7 +57,7 @@ jobs: fi # Every tag: the last release's tag is what the decision compares with. - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 if: steps.gate.outputs.publish == 'true' with: ref: ${{ github.event.workflow_run.head_sha }} diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 3525a9c..98a7dc0 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -15,5 +15,5 @@ jobs: name: Library tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - run: docker build --target test . From 425735d2714b3b8dce0dd9cd7d1ff802f18f4ece Mon Sep 17 00:00:00 2001 From: rcbjBlueMars <9321971+rcbjBlueMars@users.noreply.github.com> Date: Sun, 8 Nov 2026 12:24:36 -0800 Subject: [PATCH 6/6] Document the Java 25 runtime and Temurin 26 Maven test image. --- CLAUDE.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 39c98f8..7a05de3 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -5,7 +5,7 @@ SPDX-License-Identifier: MIT # wsfed-caep -Java 17 port of the server-side WS-Federation relying party. Group `com.iyasec`, artifact `wsfed-caep`, packages under `com.iyasec.wsfed`. License MIT (`LICENSE`). A pull request merged into `main` publishes the library (`library/` only; the demo never) to Maven Central after the test workflow succeeds on that commit. A direct push does not. `publish.yml` runs `mvn -Prelease -f library/pom.xml deploy` in the Maven container: the `release` profile adds the sources and javadoc jars, a GPG signature on every file, and the Central publishing plugin, which uploads, publishes and waits until the release is live. Maven Central has no trusted publishing, so the job uses four repository secrets: `CENTRAL_TOKEN_USERNAME` and `CENTRAL_TOKEN_PASSWORD` (a Central Portal user token) and `GPG_PRIVATE_KEY` and `GPG_PASSPHRASE` (the release signing key, whose public half is on a public key server). A release happens when the library's files changed since the last release's tag: `publish.yml` takes one patch above the highest published version, publishes it, and creates the matching tag and GitHub Release. A change to tests, the demo, or the docs releases nothing. To choose a version or start a new minor, raise `VERSION`; the version is stamped in CI and is not committed, so the manifests can trail what is published. `-Dcentral.skipPublishing=true` builds and signs everything and uploads nothing. When this tree is published, `develop` and `main` are the same commit. +Java 25 port of the server-side WS-Federation relying party. Group `com.iyasec`, artifact `wsfed-caep`, packages under `com.iyasec.wsfed`. License MIT (`LICENSE`). A pull request merged into `main` publishes the library (`library/` only; the demo never) to Maven Central after the test workflow succeeds on that commit. A direct push does not. `publish.yml` runs `mvn -Prelease -f library/pom.xml deploy` in the Maven container: the `release` profile adds the sources and javadoc jars, a GPG signature on every file, and the Central publishing plugin, which uploads, publishes and waits until the release is live. Maven Central has no trusted publishing, so the job uses four repository secrets: `CENTRAL_TOKEN_USERNAME` and `CENTRAL_TOKEN_PASSWORD` (a Central Portal user token) and `GPG_PRIVATE_KEY` and `GPG_PASSPHRASE` (the release signing key, whose public half is on a public key server). A release happens when the library's files changed since the last release's tag: `publish.yml` takes one patch above the highest published version, publishes it, and creates the matching tag and GitHub Release. A change to tests, the demo, or the docs releases nothing. To choose a version or start a new minor, raise `VERSION`; the version is stamped in CI and is not committed, so the manifests can trail what is published. `-Dcentral.skipPublishing=true` builds and signs everything and uploads nothing. When this tree is published, `develop` and `main` are the same commit. ## Usage @@ -29,7 +29,7 @@ Omitted or `true` means on. The resolved configuration leaves `signals` null in docker build --target test . ``` -The `test` stage runs `mvn -B test` in `maven:3.9.9-eclipse-temurin-17`. GitHub Actions uses that command. Do not run Maven on the host. The demo stage packages with `-DskipTests` in its own Maven image. +The `test` stage runs `mvn -B test` in `maven:3.9-eclipse-temurin-26`. GitHub Actions uses that command. Do not run Maven on the host. The demo stage packages with `-DskipTests` in its own Maven image. JUnit 5 covers the stub IdP (a signed SAML assertion the library accepts), replay, metadata, the self-signed certificate, the SSF poll receiver, the demo handler, and the trust chain (`TrustChainTest`: the install script's code and `scripts/trust_chain.py` write the four-certificate chain to `idpCa`'s path, the handshake fallback keeps every block, the library trusts the provider and a reissued leaf through that file, and refuses a forged leaf followed by the real CA certificates and the right chain under the wrong host name). The test stage installs python3 and openssl for it. The stub tests do not start iya-sts. `python3 scripts/live_iya_sts.py` does, unless `IYA_STS_URL` names one that is already running. It signs the demo in and checks two Shared Signals events on `GET /live-status`. iya-sts main sets the assertion SessionIndex to the assertion id, so a session-revoked subject that names the sign-on session matches nobody. The demo ends its one session from that handler. The nightly workflow, cron `51 6 * * *` plus workflow_dispatch, runs the unit image and that script. It never binds port 3000, 8081 or 18481-18495; its defaults are 18553 (iya-sts) and 18653 (the demo). It builds the demo the way a user does: install script first (writing the chain), then the image build, then the run with only `rp.key`, `rp.crt` and `idp-metadata.xml` mounted. No CA mount, no `idpCa` rewrite. Secrets go to docker as `-e NAME`; no log line carries a sign-in URL. `scripts/configure_iya_sts.py` is the same registration script as the Python tree; its plan is exercised there. Configure is host Python and does not import this library.