[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
io.rest-assured:rest-assured (source)	6.2.0 → 6.3.0

---

Release Notes

rest-assured/rest-assured (io.rest-assured:rest-assured)

v6.3.0

• Fix form authentication sending the request for the CSRF token page, the request that follows a 302 of the login page and the login request with the static RestAssured settings only, so a proxy, an SSL setting such as relaxedHTTPSValidation() or a keystore, or a config(..) set on the request (or in a request specification) wasn't used for them. They are now sent with the config and the proxy of the request, like the request for the login page already was (issue #​1965) (#​2010) (thanks to Obrams for PR)
• Fix form authentication sending the cookies set by the login page response to whatever host the 302 of a non-GET login page request pointed to. Like a browser, it only sends them when the redirect goes to the same host. The Location header is now also resolved against the URL of the login page, so a relative Location is followed on the host of the login page (issue #​1965) (#​2010) (thanks to Obrams for PR)
• Added SSLConfig.sslContext(SSLContext) and hostnameVerifier(HostnameVerifier), with getSSLContext() and getHostnameVerifier(), the same on CertificateAuthSettings, and the matching properties on CertAuthScheme. They take the JDK's javax.net.ssl types and replace sslSocketFactory(..), x509HostnameVerifier(..) and their getters, which take Apache HttpClient 4 types and are now deprecated, since HttpClient 4 types leave the API in REST Assured 7.0.0. Host names are still verified strictly by default when you set an SSLContext
• Added HttpClientConfig.connectTimeout(Duration), readTimeout(Duration), connectionRequestTimeout(Duration), keepResponseCookies(boolean), cookieDatePatterns(String...) and expectContinue(boolean), with getters, as replacements for the HttpClient 4 parameters http.connection.timeout, http.socket.timeout, http.conn-manager.timeout, http.protocol.cookie-policy, http.protocol.cookie-datepatterns and http.protocol.expect-continue. The parameter methods (the HttpClientConfig(Map) constructor, params(), setParam, withParams, setParams and addParams) are deprecated and will be removed in REST Assured 8.0.0
• Added RedirectConfig.followRedirectsForAllMethods(boolean) and followsRedirectsForAllMethods(). It follows redirects of POST, PUT, DELETE and other requests too. Use it instead of installing HttpClient 4's LaxRedirectStrategy through an HttpClientFactory
• Added REST Assured's own MultipartMode enum with HttpClientConfig.multipartMode(MultipartMode) and multipartMode(), replacing httpMultipartMode(HttpMultipartMode) and httpMultipartMode(), which are now deprecated
• Added CookieFilter.getCookies(), which returns the stored cookies as REST Assured Cookies, and CookieFilter.addCookie(Cookie), replacing getCookieStore(), which is now deprecated together with extractEffectiveUriFromContext(..)
• Deprecated HttpClientConfig.HttpClientFactory, httpClientFactory(..) and httpClientInstance(), and QueryableRequestSpecification.getHttpClient(), since HttpClient 4 types leave the API in REST Assured 7.0.0. REST Assured 7.0.0 adds customizeClient(..) to customize the HTTP client
• Added AuthenticationContext, AuthenticationScheme.authenticate(AuthenticationContext) and ContextAuthenticationScheme, so that a custom authentication scheme can set headers, answer Basic, Digest and NTLM challenges, sign with OAuth and use a client certificate without depending on HttpClient 4. Implement ContextAuthenticationScheme instead of AuthenticationScheme.authenticate(HTTPBuilder), which is now deprecated, since HTTPBuilder exposes HttpClient 4 and is removed in REST Assured 7.0.0
• Added the object mapper factory interfaces and their defaults (GsonObjectMapperFactory, Jackson2ObjectMapperFactory, Jackson3ObjectMapperFactory, JohnzonObjectMapperFactory, JsonbObjectMapperFactory, JAXBObjectMapperFactory and JakartaEEObjectMapperFactory, and DefaultGsonObjectMapperFactory and so on) to rest-assured-common in the package io.restassured.common.mapper.factory, and NumberReturnType to io.restassured.common.config. ObjectMapperConfig, JsonPathConfig, XmlPathConfig, JsonConfig, JsonPath.using(..) and XmlPath.using(..) accept them, and JsonConfig.DEFAULT_NUMBER_LENGTH_LIMIT is added. The old types in io.restassured.path.json.mapper.factory, io.restassured.path.xml.mapper.factory and JsonPathConfig.NumberReturnType are deprecated. The old factory types extend the new ones, so existing code keeps working. They're removed in REST Assured 8.0.0. Passing null to numberReturnType(..), new JsonConfig(..) or new JsonPathConfig(..) is now ambiguous and needs a cast
• Non-backward compatible change: in Groovy 4 (but not Groovy 5), passing a closure directly to a factory setter such as ObjectMapperConfig.jackson2ObjectMapperFactory { type, charset -> .. } now fails with "Ambiguous method overloading", since the setters take both the old and the new factory type. Cast the closure to the factory type, for example jackson2ObjectMapperFactory({ type, charset -> .. } as Jackson2ObjectMapperFactory)
• Deprecated the Jackson 1 object mapper factory setters (ObjectMapperConfig.jackson1ObjectMapperFactory(..), JsonPathConfig.jackson1ObjectMapperFactory(..) and JsonPath.using(Jackson1ObjectMapperFactory)), since Jackson 1 support is removed in REST Assured 7.0.0
• rest-assured-common now has optional dependencies on the JSON and XML mappers its factories use (Jackson 2 and 3, Gson, Johnzon, Yasson, JSON-B, JAXB and Jakarta XML Binding). They are optional, so nothing new ends up on your classpath
• REST Assured, RestAssuredMockMvc and RestAssuredWebTestClient now fail with an IllegalStateException that explains how to align the versions when an older rest-assured-common is on the classpath (for example one pinned by the Spring Boot 3 dependency management), instead of a NoClassDefFoundError
• Published json-path-gpath and xml-path-gpath, the REST Assured 7.0.0 names of json-path and xml-path. In 6.x they are relocation poms that resolve to json-path and xml-path at the same version, so you can switch your build to the new names before upgrading. They are also in rest-assured-bom
• Added the rest-assured-openrewrite module with the OpenRewrite recipe io.restassured.MigrateRestAssured6Deprecations, which moves Java code from the APIs deprecated in this version to their replacements: the object mapper factories and NumberReturnType in rest-assured-common, hostnameVerifier(..), multipartMode(..), and the HttpClientConfig settings that replace setParam(..) for the timeouts, the "ignoreCookies" and "default" cookie policies and expect-continue. It also marks subclasses of REST Assured's authentication schemes that only override authenticate(HTTPBuilder), which REST Assured 7.0.0 no longer calls. Run it with the rewrite-maven-plugin or the OpenRewrite Gradle plugin, with io.rest-assured:rest-assured-openrewrite as recipe dependency

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.