Merge develop into main

.github/workflows/nightly.yml

@@ -15,7 +15,7 @@ jobs:
   suite:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Unit suite
         run: docker build --target test .
       - name: Live iya-sts

.github/workflows/publish.yml

@@ -57,7 +57,7 @@ jobs:
           fi
 
       # Every tag: the last release's tag is what the decision compares with.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         if: steps.gate.outputs.publish == 'true'
         with:
           ref: ${{ github.event.workflow_run.head_sha }}

.github/workflows/tests.yml

@@ -15,5 +15,5 @@ jobs:
     name: Library tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - run: docker build --target test .

CLAUDE.md

@@ -5,7 +5,7 @@ SPDX-License-Identifier: MIT
 
 # wsfed-caep
 
-Java 17 port of the server-side WS-Federation relying party. Group `com.iyasec`, artifact `wsfed-caep`, packages under `com.iyasec.wsfed`. License MIT (`LICENSE`). A pull request merged into `main` publishes the library (`library/` only; the demo never) to Maven Central after the test workflow succeeds on that commit. A direct push does not. `publish.yml` runs `mvn -Prelease -f library/pom.xml deploy` in the Maven container: the `release` profile adds the sources and javadoc jars, a GPG signature on every file, and the Central publishing plugin, which uploads, publishes and waits until the release is live. Maven Central has no trusted publishing, so the job uses four repository secrets: `CENTRAL_TOKEN_USERNAME` and `CENTRAL_TOKEN_PASSWORD` (a Central Portal user token) and `GPG_PRIVATE_KEY` and `GPG_PASSPHRASE` (the release signing key, whose public half is on a public key server). A release happens when the library's files changed since the last release's tag: `publish.yml` takes one patch above the highest published version, publishes it, and creates the matching tag and GitHub Release. A change to tests, the demo, or the docs releases nothing. To choose a version or start a new minor, raise `VERSION`; the version is stamped in CI and is not committed, so the manifests can trail what is published. `-Dcentral.skipPublishing=true` builds and signs everything and uploads nothing. When this tree is published, `develop` and `main` are the same commit.
+Java 25 port of the server-side WS-Federation relying party. Group `com.iyasec`, artifact `wsfed-caep`, packages under `com.iyasec.wsfed`. License MIT (`LICENSE`). A pull request merged into `main` publishes the library (`library/` only; the demo never) to Maven Central after the test workflow succeeds on that commit. A direct push does not. `publish.yml` runs `mvn -Prelease -f library/pom.xml deploy` in the Maven container: the `release` profile adds the sources and javadoc jars, a GPG signature on every file, and the Central publishing plugin, which uploads, publishes and waits until the release is live. Maven Central has no trusted publishing, so the job uses four repository secrets: `CENTRAL_TOKEN_USERNAME` and `CENTRAL_TOKEN_PASSWORD` (a Central Portal user token) and `GPG_PRIVATE_KEY` and `GPG_PASSPHRASE` (the release signing key, whose public half is on a public key server). A release happens when the library's files changed since the last release's tag: `publish.yml` takes one patch above the highest published version, publishes it, and creates the matching tag and GitHub Release. A change to tests, the demo, or the docs releases nothing. To choose a version or start a new minor, raise `VERSION`; the version is stamped in CI and is not committed, so the manifests can trail what is published. `-Dcentral.skipPublishing=true` builds and signs everything and uploads nothing. When this tree is published, `develop` and `main` are the same commit.
 
 ## Usage
 
@@ -29,7 +29,7 @@ Omitted or `true` means on. The resolved configuration leaves `signals` null in
 docker build --target test .
 ```
 
-The `test` stage runs `mvn -B test` in `maven:3.9.9-eclipse-temurin-17`. GitHub Actions uses that command. Do not run Maven on the host. The demo stage packages with `-DskipTests` in its own Maven image.
+The `test` stage runs `mvn -B test` in `maven:3.9-eclipse-temurin-26`. GitHub Actions uses that command. Do not run Maven on the host. The demo stage packages with `-DskipTests` in its own Maven image.
 
 JUnit 5 covers the stub IdP (a signed SAML assertion the library accepts), replay, metadata, the self-signed certificate, the SSF poll receiver, the demo handler, and the trust chain (`TrustChainTest`: the install script's code and `scripts/trust_chain.py` write the four-certificate chain to `idpCa`'s path, the handshake fallback keeps every block, the library trusts the provider and a reissued leaf through that file, and refuses a forged leaf followed by the real CA certificates and the right chain under the wrong host name). The test stage installs python3 and openssl for it. The stub tests do not start iya-sts. `python3 scripts/live_iya_sts.py` does, unless `IYA_STS_URL` names one that is already running. It signs the demo in and checks two Shared Signals events on `GET /live-status`. iya-sts main sets the assertion SessionIndex to the assertion id, so a session-revoked subject that names the sign-on session matches nobody. The demo ends its one session from that handler. The nightly workflow, cron `51 6 * * *` plus workflow_dispatch, runs the unit image and that script. It never binds port 3000, 8081 or 18481-18495; its defaults are 18553 (iya-sts) and 18653 (the demo). It builds the demo the way a user does: install script first (writing the chain), then the image build, then the run with only `rp.key`, `rp.crt` and `idp-metadata.xml` mounted. No CA mount, no `idpCa` rewrite. Secrets go to docker as `-e NAME`; no log line carries a sign-in URL. `scripts/configure_iya_sts.py` is the same registration script as the Python tree; its plan is exercised there. Configure is host Python and does not import this library.
 

Dockerfile

@@ -3,7 +3,7 @@
 
 # `docker build --target test` runs the suite in this image.
 # The demo image below does not run it.
-FROM maven:3.9.9-eclipse-temurin-17 AS test
+FROM maven:3.9-eclipse-temurin-26 AS test
 # TrustChainTest runs the install script's trust-chain code: python3, and the
 # openssl CLI it reads certificate names with.
 RUN apt-get update && apt-get install -y --no-install-recommends python3 openssl && rm -rf /var/lib/apt/lists/*
@@ -18,15 +18,15 @@ COPY scripts ./scripts
 COPY demo/wsfed.json demo/wsfed.json
 RUN mvn -B test
 
-FROM maven:3.9.9-eclipse-temurin-17 AS build
+FROM maven:3.9-eclipse-temurin-26 AS build
 WORKDIR /src
 COPY pom.xml .
 COPY library library
 COPY demo/pom.xml demo/pom.xml
 COPY demo/src demo/src
 # The demo module copies its runtime dependencies, the library among them, to demo/target/dependency.
 RUN mvn -B -DskipTests package
-FROM eclipse-temurin:17-jre
+FROM eclipse-temurin:25-jre
 WORKDIR /app
 RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*
 # The demo's jar under the name the image has always run, and beside it every

demo/pom.xml

@@ -27,7 +27,7 @@
     <plugins>
       <plugin>
         <artifactId>maven-compiler-plugin</artifactId>
-        <version>3.8.1</version>
+        <version>3.16.0</version>
       </plugin>
       <plugin>
         <artifactId>maven-surefire-plugin</artifactId>
@@ -42,7 +42,7 @@
              They are compiled into the test classpaths only, never into a published jar. -->
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>build-helper-maven-plugin</artifactId>
-        <version>3.6.0</version>
+        <version>3.6.2</version>
         <executions>
           <execution>
             <id>test-fixtures</id>
@@ -58,14 +58,14 @@
       <plugin>
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>exec-maven-plugin</artifactId>
-        <version>3.1.0</version>
+        <version>3.6.4</version>
         <configuration>
           <mainClass>com.iyasec.wsfed.demo.Demo</mainClass>
         </configuration>
       </plugin>
       <plugin>
         <artifactId>maven-dependency-plugin</artifactId>
-        <version>3.6.1</version>
+        <version>3.11.0</version>
         <executions>
           <execution>
             <id>copy-dependencies</id>

library/pom.xml

@@ -39,12 +39,12 @@
     <dependency>
       <groupId>org.apache.santuario</groupId>
       <artifactId>xmlsec</artifactId>
-      <version>2.3.4</version>
+      <version>4.0.4</version>
     </dependency>
     <dependency>
       <groupId>com.nimbusds</groupId>
       <artifactId>nimbus-jose-jwt</artifactId>
-      <version>10.0.2</version>
+      <version>10.10</version>
     </dependency>
     <dependency>
       <groupId>org.junit.jupiter</groupId>
@@ -57,7 +57,7 @@
     <plugins>
       <plugin>
         <artifactId>maven-compiler-plugin</artifactId>
-        <version>3.8.1</version>
+        <version>3.16.0</version>
       </plugin>
       <plugin>
         <artifactId>maven-surefire-plugin</artifactId>
@@ -68,7 +68,7 @@
              They are compiled into the test classpaths only, never into a published jar. -->
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>build-helper-maven-plugin</artifactId>
-        <version>3.6.0</version>
+        <version>3.6.2</version>
         <executions>
           <execution>
             <id>test-fixtures</id>
@@ -98,7 +98,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-source-plugin</artifactId>
-            <version>3.3.1</version>
+            <version>3.4.0</version>
             <executions>
               <execution>
                 <id>attach-sources</id>
@@ -109,7 +109,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-javadoc-plugin</artifactId>
-            <version>3.11.2</version>
+            <version>3.12.0</version>
             <configuration>
               <!-- Missing comments are not errors; malformed ones still are. -->
               <doclint>all,-missing</doclint>
@@ -124,7 +124,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-gpg-plugin</artifactId>
-            <version>3.2.7</version>
+            <version>3.2.8</version>
             <configuration>
               <signer>bc</signer>
             </configuration>