The new specification represents Cookie attribute using HttpOnly: "" vs
HttpOnly: "true".
This updates the test to correspond to the new Servlet specification and
is a breaking change related to jakarta updates.
To make SpringSecurityCoreVersionSerializableTests more manageable,
this commit moves the sample class constructions to a separate file.
In this way, the tests file only changes when serialization tests are
added. When classes are introduced, they can be added to SerializationSamples,
separating the two concerns
If Instancio fails to instatiate the class sample, it will
now also delete the serialized sample file. Otherwise, it will
leave a zero-byte file on the filesystem, confusing future test runs
Given that these classes each have a consistent serialization UID
across minor versions, but that the 6.5.x serialized version is using a
different UID, these serialized files were likely generated in error.
As such, this commit replaces the serialized files with correct ones.
Issue gh-16432
Since we don't need to ensure the serializability of test components
across versions, we can ignore missing version UIDs when those
test components aren't about testing Java serialization.
Issue gh-17038
We should test that serialized files from the current minor version
can be deserialized. This ensures that serializations remain
deserializable in patch releases.
Issue gh-3737
Previously Dependabot was setup to submit PRs to every branch.
However, this does not align with the contributing guidelines which
state to only submit a PR on the oldest branch so that merge forward
strategy can be used.
This changes the dependabot configuration to better align with our
contributing guidelines:
- PRs for github actions are submitted against the oldest branch since
all branches will need updated using a merge forward stategy. Merging a
github action will require us to merge forward manually and preserve
the changes in the oldest branch to pickup the github actions update.
- Java dependencieds are submitted against each branch since they will
need to merge -s ours to preserve the correct major.minor semantics.
Merging a java dependency will now require us to do the merging manually.
Rob Winch