Security update for mockito, snakeyaml, testng
| Announcement ID: | SUSE-SU-2024:2568-1 |
|---|---|
| Rating: | important |
| References: | |
| Cross-References: | |
| CVSS scores: |
|
| Affected Products: |
|
An update that solves one vulnerability can now be installed.
Description:
This update for mockito, snakeyaml, testng fixes the following issues:
mockito was updated to version 5.11.0:
- Added bundle manifest to the mockito-core artifact
- Mockito 5 is making core changes to ensure compatibility with future JDK versions.
-
Switch the Default MockMaker to mockito-inline (not applicable to mockito-android)
-
Mockito 2.7.6 introduced the mockito-inline mockmaker based on the "inline bytecode" principle, offering compatibility advantages over the subclass mockmaker
-
This change avoids JDK restrictions, such as violating module boundaries and leaking subclass creation
-
Legitimate use cases for the subclass mockmaker:
-
Scenarios where the inline mockmaker does not function, such as on Graal VM's native image
- If avoiding mocking final classes, the subclass mockmaker remains a viable option, although issues may arise on JDK 17+
-
Mockito aims to support both mockmakers, allowing users to choose based on their requirements.
-
Update the Minimum Supported Java Version to 11
-
Mockito 5 raised the minimum supported Java version to 11
- Community member @reta contributed to this change.
-
Users still on JDK 8 can continue using Mockito 4, with minimal API differences between versions
-
New type() Method on ArgumentMatcher
-
The ArgumentMatcher interface now includes a new type() method to support varargs methods, addressing previous limitations
- Users can now differentiate between matching calls with any exact number of arguments or match any number of arguments
- Mockito 5 provides a default implementation of the new method, ensuring backward compatibility.
- No obligation for users to implement the new method; Mockito 5 considers Void.type by default for varargs handling
-
ArgumentCaptor is now fully type-aware, enabling capturing specific subclasses on a generic method.
-
byte-buddy does not bundle asm, but uses objectweb-asm as external library
snake-yaml was updated to version 2.2:
-
Changes of version 2.2:
-
Define default scalar style as PLAIN (for polyglot Maven)
-
Add missing 'exports org.yaml.snakeyaml.inspector' to module-info.java
-
Changes of version 2.1:
-
Heavy Allocation in Emitter.analyzeScalar(String) due to Regex Overhead
- Use identity in toString() for sequences to avoid OutOfMemoryError
- NumberFormatException from SnakeYAML due to int overflow for corrupt YAML version
- Document size limit should be applied to single document notthe whole input stream
- Detect invalid Unicode code point (thanks to Tatu Saloranta)
-
Remove Trusted*Inspector classes from main sources tree
-
Changes of version 2.0:
-
Rollback to Java 7 target
- Add module-info.java
- Migrate to Java 8
- Remove many deprecated constructors
- Remove long deprecated methods in FlowStyle
- Do not allow global tags by default
- Yaml.LoadAs() signature to support Class<? super T> type instead of Class<T>
- CustomClassLoaderConstructor takes LoaderOptions
- Check input parameters for non-null values
testng was updated to version 7.10.1:
-
Security issues fixed:
-
CVE-2022-4065: Fixed Zip Slip Vulnerability (bsc#1205628)
-
Changes of version 7.10.1:
-
Fixed maven build with junit5
-
Changes of version 7.10.0:
-
Minor discrepancy fixes
- Deleting TestNG eclipse plugin specific classes
- Remove deprecated JUnit related support in TestNG
- Handle exceptions in emailable Reporter
- Added wrapperbot and update workflow order
- Support ITestNGFactory customisation
- Streamlined data provider listener invocation
- Streamlined Guice Module creation in concurrency.
- Copy test result attributes when unexpected failures
- chore: use explicit dependency versions instead of refreshVersions
- Removed Ant
- Support ordering of listeners
- Added errorprone
- Allow custom thread pool executors to be wired in.
- Allow data providers to be non cacheable
- Use Locks instead of synchronised keyword
- Document pgp artifact signing keys
- Added Unique Id for all test class instances
- Added issue management workflows
- Map object to configurations
- Allow listeners to be disabled at runtime
- Streamlined Data Provider execution
- Honour inheritance when parsing listener factories
- Tweaks around accessing SuiteResult
- Streamlined random generation
-
Streamlined dependencies for configurations
-
Changes of version 7.9.0:
-
Fixed maps containing nulls can be incorrectly considered equal
- Test Results as artifacts for failed runs
- Fixed data races
- Dont honour params specified in suite-file tag
- Decouple SuiteRunner and TestRunner
- Disable Native DI for BeforeSuite methods
- Streamlined running Parallel Dataproviders+retries
- Removed extra whitespace in log for Configuration.createMethods()
- Added the link for TestNG Documentation's GitHub Repo in README.md
- FirstTimeOnlyConfig methods + Listener invocations
- Added overrideGroupsFromCliInParentChildXml test
- Ensure thread safety for attribute access
- Added @inherited to the Listeners annotation
- Restrict Group inheritance to Before|AfterGroups
- Ensure ITestResult injected to @AfterMethod is apt
- Support suite level thread pools for data provider
- Favour CompletableFuture instead of PoolService
- Favour FutureTask for concurrency support
- Shared Threadpool for normal/datadriven tests.
-
Abort for invalid combinations
-
Changes of version 7.8.0:
-
[Feature] Not exception but warning if some (not all) of the given test names are not found in suite files.
- [Feature] Generate testng-results.xml per test suite
- [Feature] Allow test classes to define "configfailurepolicy" at a per class level
- XmlTest index is not set for test suites invoked with YAML
- Listener's onAfterClass is called before @afterclass configuration methods are executed.
- After upgrading to TestNG 7.5.0, setting ITestResult.status to FAILURE doesn't fail the test anymore
- JUnitReportReporter should capture the test case output at the test case level
- TestNG.xml doesn't honour Parallel value of a clone
- before configuration and before invocation should be 'SKIP' when beforeMethod is 'skip'
- Test listeners specified in parent testng.xml file are not included in testng-failed.xml file
- Discrepancies with DataProvider and Retry of failed tests
- Skipped Tests with DataProvider appear as failed
- testng-results xml reports config skips from base classes as ignored
- Feature: Check that specific object present in List
-
Upgraded snakeyaml to 2.0
-
Changes of version 7.7.1:
-
Streamline overloaded assertion methods for Groovy
-
Changes of version 7.7.0:
-
Replace FindBugs by SpotBugs
- Gradle: Drop forUseAtConfigurationTime()
- Added ability to provide custom message to assertThrows\expectThrows methods
- Only resolve hostname once
- Prevent overlogging of debug msgs in Graph impl
- Streamlined dataprovider invoking in abstract classes
- Streamlined TestResult due to expectedExceptions
- Unexpected test runs count with retry analyzer
- Make PackageUtils compliant with JPMS
- Ability to retry a data provider during failures
- Fixing bug with DataProvider retry
- Added config key for callback discrepancy behavior
- Fixed FileAlreadyExistsException error on copy
- JarFileUtils.delete(File f) throw actual exception (instead of FileNotFound) when file cannot be deleted #2825
- Changing assertion message of the osgitest
- Enhancing the Matrix
- Avoid Compilation errors on Semeru JDK flavour.
- Add addition yml extension
- Support getting dependencies info for a test
- Honour regex in dependsOnMethods
- Ensure All tests run all the time
- Deprecate support for running Spock Tests
- Streamline dependsOnMethods for configurations
- Ensure ITestContext available for JUnit4 tests
- Deprecate support for running JUnit tests
- Changes of 7.6.1
- Fix Files.copy() such that parent dirs are created
-
Remove deprecated utility methods
-
Changes of version 7.6.0:
-
Remove redundant Parameter implementation
- Upgraded to JDK11
- Move SimpleBaseTest to be Kotlin based
- Restore testnames when using suites in suite.
- Moving ClassHelperTests into Kotlin
- IHookable and IConfigurable callback discrepancy
- Minor refactoring
- Add additional condition for assertEqualsNoOrder
- beforeConfiguration() listener method should be invoked for skipped configurations as well
- Keep the initial order of listeners
- SuiteRunner could not be initial by default Configuration
- Enable Dataprovider failures to be considered.
- BeforeGroups should run before any matched test
- Fixed possible StringIndexOutOfBoundsException exception in XmlReporter
- DataProvider: possibility to unload dataprovider class, when done with it
- Fixed possibilty that AfterGroups method is invoked before all tests
- Fixed equals implementation for WrappedTestNGMethod
- Wire-In listeners consistently
- Streamline AfterClass invocation
- Show FQMN for tests in console
- Honour custom attribute values in TestNG default reports
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
openSUSE Leap 15.5
zypper in -t patch openSUSE-SLE-15.5-2024-2568=1 -
openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2024-2568=1 -
Development Tools Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-2568=1 -
Development Tools Module 15-SP6
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP6-2024-2568=1 -
SUSE Package Hub 15 15-SP6
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-2568=1 -
SUSE Manager Server 4.3 Module 4.3
zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.3-2024-2568=1 -
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-2568=1 -
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-2568=1 -
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-2568=1 -
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-2568=1 -
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4
zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-2568=1 -
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-2568=1 -
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3
zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-2568=1 -
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4
zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-2568=1 -
SUSE Linux Enterprise Server for SAP Applications 15 SP2
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-2568=1 -
SUSE Linux Enterprise Server for SAP Applications 15 SP3
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-2568=1 -
SUSE Linux Enterprise Server for SAP Applications 15 SP4
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-2568=1 -
SUSE Enterprise Storage 7.1
zypper in -t patch SUSE-Storage-7.1-2024-2568=1
Package List:
-
openSUSE Leap 15.5 (noarch)
- snakeyaml-2.2-150200.3.15.1
- mockito-5.11.0-150200.3.7.1
- mockito-javadoc-5.11.0-150200.3.7.1
- snakeyaml-javadoc-2.2-150200.3.15.1
- testng-javadoc-7.10.1-150200.3.10.1
- testng-7.10.1-150200.3.10.1
-
openSUSE Leap 15.6 (noarch)
- snakeyaml-2.2-150200.3.15.1
- mockito-5.11.0-150200.3.7.1
- mockito-javadoc-5.11.0-150200.3.7.1
- snakeyaml-javadoc-2.2-150200.3.15.1
- testng-javadoc-7.10.1-150200.3.10.1
- testng-7.10.1-150200.3.10.1
-
Development Tools Module 15-SP5 (noarch)
- testng-7.10.1-150200.3.10.1
- snakeyaml-2.2-150200.3.15.1
-
Development Tools Module 15-SP6 (noarch)
- testng-7.10.1-150200.3.10.1
- snakeyaml-2.2-150200.3.15.1
-
SUSE Package Hub 15 15-SP6 (noarch)
- mockito-5.11.0-150200.3.7.1
-
SUSE Manager Server 4.3 Module 4.3 (noarch)
- snakeyaml-2.2-150200.3.15.1
-
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch)
- testng-7.10.1-150200.3.10.1
- snakeyaml-2.2-150200.3.15.1
-
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch)
- testng-7.10.1-150200.3.10.1
- snakeyaml-2.2-150200.3.15.1
-
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch)
- testng-7.10.1-150200.3.10.1
- snakeyaml-2.2-150200.3.15.1
-
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch)
- testng-7.10.1-150200.3.10.1
- snakeyaml-2.2-150200.3.15.1
-
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (noarch)
- testng-7.10.1-150200.3.10.1
- snakeyaml-2.2-150200.3.15.1
-
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch)
- testng-7.10.1-150200.3.10.1
- snakeyaml-2.2-150200.3.15.1
-
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch)
- testng-7.10.1-150200.3.10.1
- snakeyaml-2.2-150200.3.15.1
-
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (noarch)
- testng-7.10.1-150200.3.10.1
- snakeyaml-2.2-150200.3.15.1
-
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch)
- testng-7.10.1-150200.3.10.1
- snakeyaml-2.2-150200.3.15.1
-
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch)
- testng-7.10.1-150200.3.10.1
- snakeyaml-2.2-150200.3.15.1
-
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch)
- testng-7.10.1-150200.3.10.1
- snakeyaml-2.2-150200.3.15.1
-
SUSE Enterprise Storage 7.1 (noarch)
- testng-7.10.1-150200.3.10.1
- snakeyaml-2.2-150200.3.15.1