[dependabot]

Bumps the testing group with 2 updates in the / directory: io.rest-assured:rest-assured and org.mockito:mockito-core.

Updates io.rest-assured:rest-assured from 6.0.1 to 6.1.0

Changelog

Sourced from io.rest-assured:rest-assured's changelog.

Changelog 6.1.0 (2026-10-09)

• Strip sensitive headers (Authorization and Cookie) when a redirect crosses to a different host, so a token or session isn't leaked to the redirect target. This is on by default and can be turned off with RedirectConfig.stripSensitiveHeadersOnCrossHostRedirect(false) (#1873). Thanks to the University of Sydney security research team (Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu) for the report.
• Fix JsonPath "properties" spread over a list of objects returning null when the first element lacks a "properties" key (e.g. a GeoJSON feature carrying only a geometry), a regression from the Groovy 5 migration (fixes #1875) (thanks to HDPark95 for PR #1878). Thanks to haskiindahouse for the report.
• Fix JsonPath returning null or Groovy meta-data for a nested "properties" navigation over a list of objects (e.g. items.properties.properties.x) on Groovy 5, because the list spread result was a plain list instead of the proxy list that carries the "properties" workaround forward (fixes #1879) (thanks to kdelay for PR #1880)
• Fix JsonPath returning -Infinity for finite negative JSON numbers whose magnitude exceeds Float.MAX_VALUE under the default FLOAT_AND_DOUBLE number configuration. The float/double selection compared the signed value against Float.MAX_VALUE, so any such negative number fell into the float branch and overflowed; it now compares the magnitude and promotes to double regardless of sign (fixes #1874) (thanks to kdelay for PR #1877). Thanks to haskiindahouse for the report.
• Decode JSON responses without an explicit charset as UTF-8 also when the content-type has parameters (e.g. "application/json; version=1") or is a "+json" type (e.g. "application/problem+json", "application/hal+json"). These used to fall back to the default content charset, which garbled non-ASCII characters in the body and in logged responses (related to #1885)
• Fix MalformedURLException when a request URL has no slash before a query string that contains another URL, e.g. get("https://example.com?redirect=https://example.com/callback") (fixes #1836) (thanks to renechoi for PR #1881)
• Apply user-configured SSL settings (such as relaxed HTTPS validation, trust/key stores and certificate authentication) when an http request is redirected to https. Previously they were only applied if the original request used https, so the redirected request failed with "PKIX path building failed". For a request that starts as http the SSL settings are only applied when REST Assured's default http client factory is used, so an https scheme registered by a custom HttpClientConfig.httpClientFactory is kept (fixes #790)
• Don't let request specific SSL settings (SSLConfig such as relaxed HTTPS validation, or certificate authentication) leak into later requests when the http client instance is reused (HttpClientConfig.reuseHttpClientInstance()). The client's original https scheme is restored after each request and https connections established with request specific SSL settings are no longer kept alive for reuse.
• json-schema-validator now supports JSON Schema draft-06, draft-07, 2019-09 and 2020-12 (e.g. const, if/then/else, propertyNames, prefixItems, $defs) using the networknt json-schema-validator (com.networknt:json-schema-validator 2.0.8, which is now a dependency of the module, together with slf4j-api). The draft is taken from the "$schema" keyword of the schema, so draft-03/draft-04 schemas are validated exactly as before. Schemas without "$schema" are still validated as draft-04 unless another version is configured, e.g. matchesJsonSchemaInClasspath("schema.json").using(JsonSchemaVersion.DRAFT_2020_12) or JsonSchemaValidatorSettings.schemaVersion(..). Note that: (1) schemas that already declared a draft-06+ "$schema" were previously validated with draft-04 semantics (newer keywords were ignored) and are now validated according to their declared draft, (2) a configured JsonSchemaFactory and checkedValidation only apply to draft-03/draft-04 schemas, (3) "format" is annotation-only (not validated) in 2019-09 and 2020-12, as required by those specifications (fixes #1823)
• Add ResponseSpecBuilder.expectHeader(String, ResponseAwareMatcher) and ResponseSpecification.header(String, ResponseAwareMatcher), so a reusable response specification can match a header against a value taken from the response, e.g. expectHeader("Location", response -> endsWith("/users/" + response.path("id"))) (fixes #1884) (thanks to seethinajayadileep for PR #1887)
• java.time values (LocalDate, Instant, OffsetDateTime, Duration, ZoneId and so on) used as path, query or form parameters, headers or cookies are now sent as their ISO-8601 toString() instead of being run through the object mapper, which quoted them or failed without the JSR-310 module (fixes #1781) (thanks to seethinajayadileep for PR #1888)
• A value object used as a parameter, header or cookie value that the object mapper serializes to a plain JSON string (for example a record with a @​JsonValue accessor) is now sent without the surrounding JSON quotes (fixes #1818)
• Add support for the HTTP QUERY method (a safe, idempotent method that carries a request body), e.g. given().body(..).when().query("/search"). Method.QUERY and query(..) overloads are added to RestAssured, RequestSender/RequestSpecification, RestAssuredMockMvc and RestAssuredWebTestClient (fixes #1872)
• Fix path parameters in the Spring WebTestClient module: an unnamed path parameter that isn't a String, e.g. get("/posts/{id}", 42L), no longer fails with a ClassCastException and is serialized the same way as a named path parameter, and path parameter values are no longer encoded twice, so a value such as "John Doe" or "100%" reaches the server unchanged instead of as "John%20Doe" or "100%25" (fixes #1824) (thanks to hantsy for PR #1825)
• Fix failures when the default locale is Turkish (tr-TR), such as an exception for every response with status code 400 or above and OPTIONS requests sent from a filter or HTTP methods given in lower case, e.g. request("options", ..), not working, by using Locale.ROOT for internal upper and lower case conversions. Cookie.toString() now also formats the Expires attribute as "EEE, dd MMM yyyy HH:mm:ss zzz" in English instead of using the default locale's short date format (thanks to rdmrtn for PR #1889)
• MultiPartSpecBuilder.charset(Charset) now rejects byte[] and InputStream content with an IllegalArgumentException, like charset(String) already did, instead of silently ignoring the charset (fixes #1691) (thanks to seethinajayadileep for PR #1886)
• Fix XmlPath and JsonPath not handling a hyphenated element or key name combined with a negative (from-the-end) list index, e.g. "root.some-list[-1]". XmlPath threw "The parameter ... was used but not defined" and JsonPath returned null (fixes #1876) (thanks to kdelay for PR #1882)
• Fix unnamed path parameters in the Spring MockMvc module not being serialized like named ones, so a value object such as a record with a @​JsonValue accessor passed by position, e.g. get("/users/{id}", new Id(42)), was sent as its toString() ("Id[42]") instead of its serialized value ("42"). Note that, as for named path parameters, any other object that isn't a simple value (number, string, boolean, enum, UUID, java.time value etc) passed by position is now serialized by the object mapper instead of using its toString(). In both the Spring MockMvc and WebTestClient modules this also works for multipart requests, since unnamed path parameters are serialized using the explicitly set content type, like named ones, and not the derived "multipart/form-data" (fixes #1905)
• Fix query parameters in the Spring WebTestClient module not reaching the server as given: a value containing "+", "&", "=" or "{...}", e.g. queryParam("name", "a+b"), was received as "a b", truncated at "&" or failed as a missing URI variable. Query parameters, as well as params and form params that are added to the query string, are now strictly encoded (so reserved characters such as "!" or "," in a value are now sent percent-encoded), and a query parameter without a value, e.g. queryParam("flag"), is sent as "flag" instead of the name of an internal class (fixes #1904)
• The charset given to MultiPartSpecBuilder.charset(..) is now sent in the Content-Type of a File multi-part (e.g. "text/plain; charset=UTF-8"). Previously it was silently ignored for File content and only applied to String content. Other parameters of the part mime-type (e.g. "application/xml; version=2") are now also kept when a charset is specified, instead of being dropped (fixes #1903)
• Fix XmlPath and JsonPath not handling a list range with a negative end that is followed by more path, e.g. "root.some-list[0..-1].sub-el" or "list[-2..-1].x". The dots in the range were treated as path separators, so XmlPath threw "The parameter ... was used but not defined" (or a Groovy compilation error) and JsonPath returned null or failed. JsonPath now also supports a range on a root array, e.g. "[0..1].x", and chained indexes after a hyphenated name, e.g. "some-list[0][1].x" (fixes #1906)

Commits

• 7765379 [maven-release-plugin] prepare release rest-assured-6.1.0
• a52e86f [ci skip] Preparing changelog for release
• d9e1a3e Serialize unnamed path params like named ones in MockMvc (#1910)
• a78ec80 Strictly encode query parameters in WebTestClient (#1908)
• 549260a Send the multipart charset in the Content-Type of File parts (#1909)
• 9335c59 Handle list ranges with a negative end followed by more path in XmlPath and J...
• 88410f2 Support non-string path params and stop double encoding in WebTestClient (#1902)
• 1437357 Use a fixed locale for case conversions so REST Assured works under Turkish l...
• ffe66bb Validate charset in MultiPartSpecBuilder.charset(Charset) (#1900)
• 9db3677 Escape hyphenated XmlPath and JsonPath names with a negative list index (#1899)
• Additional commits viewable in compare view

Updates org.mockito:mockito-core from 5.23.0 to 5.24.0

Release notes

Sourced from org.mockito:mockito-core's releases.

v5.24.0

Changelog generated by Shipkit Changelog Gradle Plugin

5.24.0

• 2026-09-23 - 27 commit(s) by Andrei Solntsev, DragonFSKY, Hünkar Can Tunç, Joshua Selbo, M. Minot, Markus Gaisbauer, Mirko Alicastro, Vinod Kumar M ( codingkiddo ), dependabot[bot]
• Fix Mockito docs for -javaagent flag with Gradle [(#3866)](mockito/mockito#3866)
• Kotlin example for adding Mockito as an agent is incorrect [(#3864)](mockito/mockito#3864)
• Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 [(#3862)](mockito/mockito#3862)
• Bump gradle/actions from 6.2.0 to 6.3.0 [(#3852)](mockito/mockito#3852)
• Bump gradle/actions from 5 to 6.2.0 [(#3851)](mockito/mockito#3851)
• Preserve method parameters when clearing inline mocks [(#3847)](mockito/mockito#3847)
• Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 [(#3845)](mockito/mockito#3845)
• Print object fields via reflection when toString() is not implemented [(#3844)](mockito/mockito#3844)
• Migrate extensions-tests to JUnit Jupiter [(#3840)](mockito/mockito#3840)
• Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 [(#3839)](mockito/mockito#3839)
• docs(when-verify): fixes to explanations about redundancy [(#3838)](mockito/mockito#3838)
• Confusing inconsistency in example method calls in “stubbing and verifying is redundant” note of “when” and “verify” Javadoc [(#3837)](mockito/mockito#3837)
• Bump actions/checkout from 6 to 7 [(#3836)](mockito/mockito#3836)
• Fixes #2740 : Add mockMaker option to @Spy annotation [(#3835)](mockito/mockito#3835)
• Bump graalvm/setup-graalvm from 1.5.5 to 1.5.6 [(#3834)](mockito/mockito#3834)
• Bump graalvm/setup-graalvm from 1.5.4 to 1.5.5 [(#3833)](mockito/mockito#3833)
• Bump codecov/codecov-action from 6 to 7 [(#3831)](mockito/mockito#3831)
• Bump graalvm/setup-graalvm from 1.4.5 to 1.5.4 [(#3830)](mockito/mockito#3830)
• Fix clearInlineMocks not de-registering singleton mocks [(#3829)](mockito/mockito#3829)
• Fix NotAMockException when using mockSingleton with MockitoJUnit [(#3827)](mockito/mockito#3827)
• NotAMockException when using mockSingleton with MockitoSession or MockitoJUnit [(#3826)](mockito/mockito#3826)
• Improve Gradle agent docs for configuration cache [(#3823)](mockito/mockito#3823)
• Gradle documentation for setting up instrumentation with Gradle configuration cache [(#3822)](mockito/mockito#3822)
• Fixes #3818 : Fix data race in InvocationContainerImpl.invocationForStubbing [(#3819)](mockito/mockito#3819)
• Data race on invocationForPotentialStubbing [(#3818)](mockito/mockito#3818)
• Fixes #3814 : implement package-level clinit suppression [(#3815)](mockito/mockito#3815)
• Package-level clinit suppression [(#3814)](mockito/mockito#3814)
• Upgrade Android Gradle Plugin to 8.13.2 [(#3812)](mockito/mockito#3812)
• Replaces raw generic types with type parameters [(#3806)](mockito/mockito#3806)
• Fixes #2398 : Implement global suppress static initialization leveraging java agent [(#3801)](mockito/mockito#3801)
• Bump codecov/codecov-action from 5 to 6 [(#3800)](mockito/mockito#3800)
• Fix non-deterministic AssertionError when using MockMakers.SUBCLASS (#3406, #2823) [(#3795)](mockito/mockito#3795)
• Fixes #3536 : Implement SpyStatic API [(#3794)](mockito/mockito#3794)
• The class's MethodParameters are removed after clearAllCaches is invoked [(#3763)](mockito/mockito#3763)
• [FeatureRequest / Idea] Create Mockito.spyStatic [(#3536)](mockito/mockito#3536)
• Add option to specify mockmaker for @Spy [(#2740)](mockito/mockito#2740)
• How can I suppress static initializer? [(#2398)](mockito/mockito#2398)

Commits

• 5a2f0f8 Fix Mockito docs for -javaagent flag with Gradle (#3866)
• 9c5f36f Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 (#3862)
• e7fd06d Preserve method parameters when clearing inline mocks (#3847)
• 5a676bc Bump gradle/actions from 6.2.0 to 6.3.0 (#3852)
• 508f8e7 Bump gradle/actions from 5 to 6.2.0 (#3851)
• ee8a330 Print object fields via reflection when toString() is not implemented (#3844)
• 39b1aba Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 (#3845)
• d8638e1 Migrate extensions-tests to JUnit Jupiter (#3840)
• 0aab922 Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 (#3839)
• f3cf74c docs(when-verify): fixes to explanations about redundancy (#3838)
• Additional commits viewable in compare view