Bump playVer from 2.8.18 to 2.8.19 (#7569)
Bumps `playVer` from 2.8.18 to 2.8.19. Updates `play-guice_2.12` from 2.8.18 to 2.8.19 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/playframework/playframework/releases">play-guice_2.12's releases</a>.</em></p> <blockquote> <h2>Play 2.8.19</h2> <p>The Play Team is happy to announce the release of Play 2.8.19 🥳</p> <h2>📗 What is new?</h2> <h2>ping/pong support for WebSockets 🏓</h2> <p><a href="https://github-redirect.dependabot.com/playframework/playframework/pull/11521">Finally</a>! Check out the documentation:</p> <ul> <li><a href="https://www.playframework.com/documentation/2.8.19/ScalaWebSockets#Configuring-keep-alive-Frames">WebSockets Play Scala</a></li> <li><a href="https://www.playframework.com/documentation/2.8.19/JavaWebSockets#Configuring-keep-alive-Frames">WebSockets Play Java</a></li> </ul> <h2>Using Netty, WebSockets time out now ⏳</h2> <p><a href="https://github-redirect.dependabot.com/playframework/playframework/pull/11420">Another fix</a> for WebSockets ships with this release as well: If you are using the Netty backend the <code>play.server.http[s].idleTimeout</code> setting will now be honored for WebSocket connections. Until now, when using Netty, a WebSocket connection never timed out. That might even was desirable for some use cases, but now that we have ping/pong support you have to make use of that to keep WebSocket connections open. That is the correct way of doing things and not closing connections after an idle timeout was actually a bug. The akka-http backend was always working correctly and didn't need to be fixed.</p> <h2>Removed the shutdown hook from the default logback config 🪝</h2> <p>If you have</p> <pre lang="xml"><code><shutdownHook class="ch.qos.logback.core.hook.DelayingShutdownHook"/> </code></pre> <p>in your logback config, you should remove that line. Play handles the shutdown of the logger context, the line shown is not necassary anymore since at least Play 2.7 and is a leftover that should have been removed a while ago. More details can be found in the <a href="https://github-redirect.dependabot.com/playframework/playframework/pull/11532">according pull request</a>.</p> <h2>Correctly encode <code>Content-Disposition: form-data; name="..."; filename="..."</code> 🔠</h2> <p>When Play renders a request body containing multipart/form data it will now encode the name and the filename fields according the <a href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data">"WHATWG HTML living standard" section 4.10.21.8</a>. <code>curl</code>, Firefox, Chrome and other libraries like Python's urllib3 follow the same approach. Until now, Play didn't encode those fields which could result in security implications. Just to be clear, this is not about receiving and parsing multipart/form data from a client, but when sending multipart/form data e.g. via ws or when using the <code>RequestBuilder</code> to build a request for testing purposes. Details can be found in pull request <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11571">#11571</a>.</p> <h2>A few words on Play's compatibility with sbt 1.8 🔧</h2> <p>Now that sbt 1.8 got released there have been reports that it isn't working out of the box with Play, caused by a version conflict regarding scala-xml, see <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11522">#11522</a>. Unfortunately, right now, we don't have a fix for that yet. Even if we bump scala-xml to version 2.x in Play and all its dependencies, we can't currently make sbt 1.8 work with Play because of another problem described in <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11527">#11527</a>. The good news is, that isn't a showstopper if you still want to upgrade to sbt 1.8. You can do that right now by putting</p> <pre lang="scala"><code>ThisBuild / libraryDependencySchemes += "org.scala-lang.modules" %% "scala-xml" % VersionScheme.Always </code></pre> <p>in <code>project/plugins.sbt</code>. That is possible because scala-xml 1.x and 2.x are compatible anyway. However, like described in <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11527">#11527</a> you will not be able to use <code>PlayNonBlockingInteractionMode</code> with sbt 1.8 then (which probably not many people do anyway)</p> <h2>Further roadmap 🗺️</h2> <p>...news coming soon...</p> <h1>Merged pull requests</h1> <p>Following pull requests got merged for this release:</p> <ul> <li><a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11604">#11604</a> [2.8.x] Upgrade netty + netty reactive streams + fix backports by <a href="https://github.com/mkurz"><code>@mkurz</code></a></li> <li><a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11603">#11603</a> [2.8.x] Escape Content-Disposition params according to WHATWG HTML living standard (backport <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11571">#11571</a>) by <a href="https://github.com/mkurz"><code>@mkurz</code></a></li> <li><a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11602">#11602</a> [2.8.x] Add exceptionOverrideClassName Hikari config setting (backport <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11601">#11601</a>) by <a href="https://github.com/benwaffle"><code>@benwaffle</code></a></li> <li><a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11598">#11598</a> [2.8.x] Fix the example code to DiscardingCookie for Results#discardingCookies (backport <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11597">#11597</a>) by <a href="https://github.com/tsuyoshizawa"><code>@tsuyoshizawa</code></a></li> <li><a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11593">#11593</a> Update PlayApplicationOverview.md by <a href="https://github.com/SenthilNayagan"><code>@SenthilNayagan</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="f71c8c9d48
"><code>f71c8c9</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11604">#11604</a> from mkurz/upgrades</li> <li><a href="a0d913f1d8
"><code>a0d913f</code></a> Use --release instead of -source, -targe, -bootclasspath</li> <li><a href="cb98bbdf5e
"><code>cb98bbd</code></a> Scala 2.12 compatibility</li> <li><a href="d78a9ec953
"><code>d78a9ec</code></a> Fix backport: Keep using scala.collection.JavaConverters._</li> <li><a href="caf25fe528
"><code>caf25fe</code></a> Upgrade netty + netty reactive streams</li> <li><a href="f81bc59354
"><code>f81bc59</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11603">#11603</a> from playframework/mergify/bp/2.8.x/pr-11571</li> <li><a href="bb1c127ae4
"><code>bb1c127</code></a> Fix conflicts</li> <li><a href="f6f1b864ec
"><code>f6f1b86</code></a> Escape Content-Disposition params according to WHATWG HTML living standard</li> <li><a href="abbebe4326
"><code>abbebe4</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11602">#11602</a> from playframework/mergify/bp/2.8.x/pr-11601</li> <li><a href="baf3860434
"><code>baf3860</code></a> Only two params needed/allowed</li> <li>Additional commits viewable in <a href="https://github.com/playframework/playframework/compare/2.8.18...2.8.19">compare view</a></li> </ul> </details> <br /> Updates `play-logback_2.12` from 2.8.18 to 2.8.19 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/playframework/playframework/releases">play-logback_2.12's releases</a>.</em></p> <blockquote> <h2>Play 2.8.19</h2> <p>The Play Team is happy to announce the release of Play 2.8.19 🥳</p> <h2>📗 What is new?</h2> <h2>ping/pong support for WebSockets 🏓</h2> <p><a href="https://github-redirect.dependabot.com/playframework/playframework/pull/11521">Finally</a>! Check out the documentation:</p> <ul> <li><a href="https://www.playframework.com/documentation/2.8.19/ScalaWebSockets#Configuring-keep-alive-Frames">WebSockets Play Scala</a></li> <li><a href="https://www.playframework.com/documentation/2.8.19/JavaWebSockets#Configuring-keep-alive-Frames">WebSockets Play Java</a></li> </ul> <h2>Using Netty, WebSockets time out now ⏳</h2> <p><a href="https://github-redirect.dependabot.com/playframework/playframework/pull/11420">Another fix</a> for WebSockets ships with this release as well: If you are using the Netty backend the <code>play.server.http[s].idleTimeout</code> setting will now be honored for WebSocket connections. Until now, when using Netty, a WebSocket connection never timed out. That might even was desirable for some use cases, but now that we have ping/pong support you have to make use of that to keep WebSocket connections open. That is the correct way of doing things and not closing connections after an idle timeout was actually a bug. The akka-http backend was always working correctly and didn't need to be fixed.</p> <h2>Removed the shutdown hook from the default logback config 🪝</h2> <p>If you have</p> <pre lang="xml"><code><shutdownHook class="ch.qos.logback.core.hook.DelayingShutdownHook"/> </code></pre> <p>in your logback config, you should remove that line. Play handles the shutdown of the logger context, the line shown is not necassary anymore since at least Play 2.7 and is a leftover that should have been removed a while ago. More details can be found in the <a href="https://github-redirect.dependabot.com/playframework/playframework/pull/11532">according pull request</a>.</p> <h2>Correctly encode <code>Content-Disposition: form-data; name="..."; filename="..."</code> 🔠</h2> <p>When Play renders a request body containing multipart/form data it will now encode the name and the filename fields according the <a href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data">"WHATWG HTML living standard" section 4.10.21.8</a>. <code>curl</code>, Firefox, Chrome and other libraries like Python's urllib3 follow the same approach. Until now, Play didn't encode those fields which could result in security implications. Just to be clear, this is not about receiving and parsing multipart/form data from a client, but when sending multipart/form data e.g. via ws or when using the <code>RequestBuilder</code> to build a request for testing purposes. Details can be found in pull request <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11571">#11571</a>.</p> <h2>A few words on Play's compatibility with sbt 1.8 🔧</h2> <p>Now that sbt 1.8 got released there have been reports that it isn't working out of the box with Play, caused by a version conflict regarding scala-xml, see <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11522">#11522</a>. Unfortunately, right now, we don't have a fix for that yet. Even if we bump scala-xml to version 2.x in Play and all its dependencies, we can't currently make sbt 1.8 work with Play because of another problem described in <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11527">#11527</a>. The good news is, that isn't a showstopper if you still want to upgrade to sbt 1.8. You can do that right now by putting</p> <pre lang="scala"><code>ThisBuild / libraryDependencySchemes += "org.scala-lang.modules" %% "scala-xml" % VersionScheme.Always </code></pre> <p>in <code>project/plugins.sbt</code>. That is possible because scala-xml 1.x and 2.x are compatible anyway. However, like described in <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11527">#11527</a> you will not be able to use <code>PlayNonBlockingInteractionMode</code> with sbt 1.8 then (which probably not many people do anyway)</p> <h2>Further roadmap 🗺️</h2> <p>...news coming soon...</p> <h1>Merged pull requests</h1> <p>Following pull requests got merged for this release:</p> <ul> <li><a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11604">#11604</a> [2.8.x] Upgrade netty + netty reactive streams + fix backports by <a href="https://github.com/mkurz"><code>@mkurz</code></a></li> <li><a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11603">#11603</a> [2.8.x] Escape Content-Disposition params according to WHATWG HTML living standard (backport <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11571">#11571</a>) by <a href="https://github.com/mkurz"><code>@mkurz</code></a></li> <li><a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11602">#11602</a> [2.8.x] Add exceptionOverrideClassName Hikari config setting (backport <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11601">#11601</a>) by <a href="https://github.com/benwaffle"><code>@benwaffle</code></a></li> <li><a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11598">#11598</a> [2.8.x] Fix the example code to DiscardingCookie for Results#discardingCookies (backport <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11597">#11597</a>) by <a href="https://github.com/tsuyoshizawa"><code>@tsuyoshizawa</code></a></li> <li><a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11593">#11593</a> Update PlayApplicationOverview.md by <a href="https://github.com/SenthilNayagan"><code>@SenthilNayagan</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="f71c8c9d48
"><code>f71c8c9</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11604">#11604</a> from mkurz/upgrades</li> <li><a href="a0d913f1d8
"><code>a0d913f</code></a> Use --release instead of -source, -targe, -bootclasspath</li> <li><a href="cb98bbdf5e
"><code>cb98bbd</code></a> Scala 2.12 compatibility</li> <li><a href="d78a9ec953
"><code>d78a9ec</code></a> Fix backport: Keep using scala.collection.JavaConverters._</li> <li><a href="caf25fe528
"><code>caf25fe</code></a> Upgrade netty + netty reactive streams</li> <li><a href="f81bc59354
"><code>f81bc59</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11603">#11603</a> from playframework/mergify/bp/2.8.x/pr-11571</li> <li><a href="bb1c127ae4
"><code>bb1c127</code></a> Fix conflicts</li> <li><a href="f6f1b864ec
"><code>f6f1b86</code></a> Escape Content-Disposition params according to WHATWG HTML living standard</li> <li><a href="abbebe4326
"><code>abbebe4</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11602">#11602</a> from playframework/mergify/bp/2.8.x/pr-11601</li> <li><a href="baf3860434
"><code>baf3860</code></a> Only two params needed/allowed</li> <li>Additional commits viewable in <a href="https://github.com/playframework/playframework/compare/2.8.18...2.8.19">compare view</a></li> </ul> </details> <br /> Updates `filters-helpers_2.12` from 2.8.18 to 2.8.19 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/playframework/playframework/releases">filters-helpers_2.12's releases</a>.</em></p> <blockquote> <h2>Play 2.8.19</h2> <p>The Play Team is happy to announce the release of Play 2.8.19 🥳</p> <h2>📗 What is new?</h2> <h2>ping/pong support for WebSockets 🏓</h2> <p><a href="https://github-redirect.dependabot.com/playframework/playframework/pull/11521">Finally</a>! Check out the documentation:</p> <ul> <li><a href="https://www.playframework.com/documentation/2.8.19/ScalaWebSockets#Configuring-keep-alive-Frames">WebSockets Play Scala</a></li> <li><a href="https://www.playframework.com/documentation/2.8.19/JavaWebSockets#Configuring-keep-alive-Frames">WebSockets Play Java</a></li> </ul> <h2>Using Netty, WebSockets time out now ⏳</h2> <p><a href="https://github-redirect.dependabot.com/playframework/playframework/pull/11420">Another fix</a> for WebSockets ships with this release as well: If you are using the Netty backend the <code>play.server.http[s].idleTimeout</code> setting will now be honored for WebSocket connections. Until now, when using Netty, a WebSocket connection never timed out. That might even was desirable for some use cases, but now that we have ping/pong support you have to make use of that to keep WebSocket connections open. That is the correct way of doing things and not closing connections after an idle timeout was actually a bug. The akka-http backend was always working correctly and didn't need to be fixed.</p> <h2>Removed the shutdown hook from the default logback config 🪝</h2> <p>If you have</p> <pre lang="xml"><code><shutdownHook class="ch.qos.logback.core.hook.DelayingShutdownHook"/> </code></pre> <p>in your logback config, you should remove that line. Play handles the shutdown of the logger context, the line shown is not necassary anymore since at least Play 2.7 and is a leftover that should have been removed a while ago. More details can be found in the <a href="https://github-redirect.dependabot.com/playframework/playframework/pull/11532">according pull request</a>.</p> <h2>Correctly encode <code>Content-Disposition: form-data; name="..."; filename="..."</code> 🔠</h2> <p>When Play renders a request body containing multipart/form data it will now encode the name and the filename fields according the <a href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data">"WHATWG HTML living standard" section 4.10.21.8</a>. <code>curl</code>, Firefox, Chrome and other libraries like Python's urllib3 follow the same approach. Until now, Play didn't encode those fields which could result in security implications. Just to be clear, this is not about receiving and parsing multipart/form data from a client, but when sending multipart/form data e.g. via ws or when using the <code>RequestBuilder</code> to build a request for testing purposes. Details can be found in pull request <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11571">#11571</a>.</p> <h2>A few words on Play's compatibility with sbt 1.8 🔧</h2> <p>Now that sbt 1.8 got released there have been reports that it isn't working out of the box with Play, caused by a version conflict regarding scala-xml, see <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11522">#11522</a>. Unfortunately, right now, we don't have a fix for that yet. Even if we bump scala-xml to version 2.x in Play and all its dependencies, we can't currently make sbt 1.8 work with Play because of another problem described in <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11527">#11527</a>. The good news is, that isn't a showstopper if you still want to upgrade to sbt 1.8. You can do that right now by putting</p> <pre lang="scala"><code>ThisBuild / libraryDependencySchemes += "org.scala-lang.modules" %% "scala-xml" % VersionScheme.Always </code></pre> <p>in <code>project/plugins.sbt</code>. That is possible because scala-xml 1.x and 2.x are compatible anyway. However, like described in <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11527">#11527</a> you will not be able to use <code>PlayNonBlockingInteractionMode</code> with sbt 1.8 then (which probably not many people do anyway)</p> <h2>Further roadmap 🗺️</h2> <p>...news coming soon...</p> <h1>Merged pull requests</h1> <p>Following pull requests got merged for this release:</p> <ul> <li><a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11604">#11604</a> [2.8.x] Upgrade netty + netty reactive streams + fix backports by <a href="https://github.com/mkurz"><code>@mkurz</code></a></li> <li><a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11603">#11603</a> [2.8.x] Escape Content-Disposition params according to WHATWG HTML living standard (backport <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11571">#11571</a>) by <a href="https://github.com/mkurz"><code>@mkurz</code></a></li> <li><a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11602">#11602</a> [2.8.x] Add exceptionOverrideClassName Hikari config setting (backport <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11601">#11601</a>) by <a href="https://github.com/benwaffle"><code>@benwaffle</code></a></li> <li><a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11598">#11598</a> [2.8.x] Fix the example code to DiscardingCookie for Results#discardingCookies (backport <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11597">#11597</a>) by <a href="https://github.com/tsuyoshizawa"><code>@tsuyoshizawa</code></a></li> <li><a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11593">#11593</a> Update PlayApplicationOverview.md by <a href="https://github.com/SenthilNayagan"><code>@SenthilNayagan</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="f71c8c9d48
"><code>f71c8c9</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11604">#11604</a> from mkurz/upgrades</li> <li><a href="a0d913f1d8
"><code>a0d913f</code></a> Use --release instead of -source, -targe, -bootclasspath</li> <li><a href="cb98bbdf5e
"><code>cb98bbd</code></a> Scala 2.12 compatibility</li> <li><a href="d78a9ec953
"><code>d78a9ec</code></a> Fix backport: Keep using scala.collection.JavaConverters._</li> <li><a href="caf25fe528
"><code>caf25fe</code></a> Upgrade netty + netty reactive streams</li> <li><a href="f81bc59354
"><code>f81bc59</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11603">#11603</a> from playframework/mergify/bp/2.8.x/pr-11571</li> <li><a href="bb1c127ae4
"><code>bb1c127</code></a> Fix conflicts</li> <li><a href="f6f1b864ec
"><code>f6f1b86</code></a> Escape Content-Disposition params according to WHATWG HTML living standard</li> <li><a href="abbebe4326
"><code>abbebe4</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/playframework/playframework/issues/11602">#11602</a> from playframework/mergify/bp/2.8.x/pr-11601</li> <li><a href="baf3860434
"><code>baf3860</code></a> Only two params needed/allowed</li> <li>Additional commits viewable in <a href="https://github.com/playframework/playframework/compare/2.8.18...2.8.19">compare view</a></li> </ul> </details> <br /> You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This commit is contained in:
parent
9882f3f901
commit
95e0060985
|
@ -9,7 +9,7 @@ plugins {
|
||||||
id("org.gradle.playframework") version "0.12"
|
id("org.gradle.playframework") version "0.12"
|
||||||
}
|
}
|
||||||
|
|
||||||
val playVer = "2.8.18"
|
val playVer = "2.8.19"
|
||||||
val scalaVer = "2.12"
|
val scalaVer = "2.12"
|
||||||
|
|
||||||
play {
|
play {
|
||||||
|
|
Loading…
Reference in New Issue