Bump jupiterVersion from 5.13.1 to 5.13.2 (#334)

Bumps `jupiterVersion` from 5.13.1 to 5.13.2.

Updates `org.junit.jupiter:junit-jupiter-api` from 5.13.1 to 5.13.2
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](https://github.com/junit-team/junit-framework/compare/r5.13.1...r5.13.2)

Updates `org.junit.jupiter:junit-jupiter-engine` from 5.13.1 to 5.13.2
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](https://github.com/junit-team/junit-framework/compare/r5.13.1...r5.13.2)

Updates `org.junit.jupiter:junit-jupiter-params` from 5.13.1 to 5.13.2
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](https://github.com/junit-team/junit-framework/compare/r5.13.1...r5.13.2)

---
updated-dependencies:
- dependency-name: org.junit.jupiter:junit-jupiter-api
  dependency-version: 5.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.junit.jupiter:junit-jupiter-engine
  dependency-version: 5.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.junit.jupiter:junit-jupiter-params
  dependency-version: 5.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Max Lambrecht <maxlambrecht@gmail.com>

.github/workflows/scripts/integration-tests.sh

@@ -7,7 +7,7 @@ set -euf -o pipefail
 
 export SPIFFE_ENDPOINT_SOCKET="unix:/tmp/spire-agent/public/api.sock"
 
-spire_version="1.9.1"
+spire_version="1.11.0"
 spire_folder="spire-${spire_version}"
 spire_server_log_file="/tmp/spire-server/server.log"
 spire_agent_log_file="/tmp/spire-agent/agent.log"

CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## [0.8.12] - 2025-06-05
+
+### Dependency updates
+
+- Bump grpcVersion to 1.73.0 (#327)
+- Bump com.nimbusds:nimbus-jose-jwt to 10.3 (#323)
+- Bump io.netty:netty-transport-native-kqueue to 4.2.1.Final (#321)
+- Bump com.google.protobuf:protobuf-gradle-plugin to 0.9.5 (#314)
+- Bump org.projectlombok:lombok to 1.18.38 (#313)
+
+### Documentation
+
+- Add documentation about sslNegotiation config in java-spiffe-provider (#325)
+
+## [0.8.11] - 2024-11-18
+
+### Fixed
+
+- Fix CRLF newline removal in DER format logic for Windows compatibility (#284)
+
+### Dependency updates
+
+- Bump io.netty:netty-transport-native-kqueue from 4.1.114.Final to 4.1.115.Final (#281)
+- Bump com.nimbusds:nimbus-jose-jwt from 9.45 to 9.47 (#285)
+- Bump org.projectlombok:lombok from 1.18.34 to 1.18.36 (#286)
+ 
+
+## [0.8.10] - 2024-11-06
+
+### Dependency updates
+
+- Bump jupiterVersion from 5.11.2 to 5.11.3 (#273)
+- Bump grpcVersion from 1.68.0 to 1.68.1 (#276)
+- Bump com.nimbusds:nimbus-jose-jwt from 9.41.2 to 9.45 (#278)
+
+
+## [0.8.9] - 2024-10-09
+
+### Dependency updates
+
+- Bump `com.google.protobuf:protoc` to `3.25.5` (#271)
+
 ## [0.8.8] - 2024-10-08
 
 ### Dependency updates

README.md

@@ -26,7 +26,7 @@ X.509 and JWT SVIDs and bundles.
 Download
 --------
 
-The JARs can be downloaded from [Maven Central](https://search.maven.org/search?q=g:io.spiffe%20AND%20v:0.8.8). 
+The JARs can be downloaded from [Maven Central](https://search.maven.org/search?q=g:io.spiffe%20AND%20v:0.8.12). 
 
 The dependencies can be added to `pom.xml`
 
@@ -35,7 +35,7 @@ To import the `java-spiffe-provider` component:
 <dependency>
   <groupId>io.spiffe</groupId>
   <artifactId>java-spiffe-provider</artifactId>
-  <version>0.8.8</version>
+  <version>0.8.12</version>
 </dependency>
 ```
 The `java-spiffe-provider` component imports the `java-spiffe-core` component.
@@ -45,7 +45,7 @@ To just import the `java-spiffe-core` component:
 <dependency>
   <groupId>io.spiffe</groupId>
   <artifactId>java-spiffe-core</artifactId>
-  <version>0.8.8</version>
+  <version>0.8.12</version>
 </dependency>
 ```
 
@@ -53,12 +53,12 @@ Using Gradle:
 
 Import `java-spiffe-provider`:
 ```gradle
-implementation group: 'io.spiffe', name: 'java-spiffe-provider', version: '0.8.8'
+implementation group: 'io.spiffe', name: 'java-spiffe-provider', version: '0.8.12'
 ```
 
 Import `java-spiffe-core`:
 ```gradle
-implementation group: 'io.spiffe', name: 'java-spiffe-core', version: '0.8.8'
+implementation group: 'io.spiffe', name: 'java-spiffe-core', version: '0.8.12'
 ```
 
 ### MacOS Support
@@ -72,14 +72,14 @@ In case run on a osx-x86 architecture, add to your `pom.xml`:
 <dependency>
   <groupId>io.spiffe</groupId>
   <artifactId>grpc-netty-macos</artifactId>
-  <version>0.8.8</version>
+  <version>0.8.12</version>
   <scope>runtime</scope>
 </dependency>
 ```
 
 Using Gradle:
 ```gradle
-runtimeOnly group: 'io.spiffe', name: 'grpc-netty-macos', version: '0.8.8'
+runtimeOnly group: 'io.spiffe', name: 'grpc-netty-macos', version: '0.8.12'
 ```
 
 #### Aarch64 (M1) Architecture
@@ -91,7 +91,7 @@ If you are running the aarch64 architecture (M1 CPUs), add to your `pom.xml`:
 <dependency>
   <groupId>io.spiffe</groupId>
   <artifactId>grpc-netty-macos-aarch64</artifactId>
-  <version>0.8.8</version>
+  <version>0.8.12</version>
   <scope>runtime</scope>
 </dependency>
 ```
@@ -99,7 +99,7 @@ If you are running the aarch64 architecture (M1 CPUs), add to your `pom.xml`:
 Using Gradle:
 
 ```gradle
-runtimeOnly group: 'io.spiffe', name: 'grpc-netty-macos-aarch64', version: '0.8.8'
+runtimeOnly group: 'io.spiffe', name: 'grpc-netty-macos-aarch64', version: '0.8.12'
 ```
 
 *Caveat: not all OpenJDK distributions are aarch64 native, make sure your JDK is also running
@@ -112,7 +112,7 @@ The `java-spiffe-helper` module manages X.509 SVIDs and Bundles in Java Keystore
 
 ### Docker Image
 
-Pull the `java-spiffe-helper` image from `ghcr.io/spiffe/java-spiffe-helper:0.8.8`.
+Pull the `java-spiffe-helper` image from `ghcr.io/spiffe/java-spiffe-helper:0.8.12`.
 
 For more details, see [java-spiffe-helper/README.md](java-spiffe-helper/README.md).
 

build.gradle

@@ -16,15 +16,15 @@ subprojects {
     version = project.version
 
     ext {
-        grpcVersion = '1.68.0'
-        jupiterVersion = '5.11.2'
+        grpcVersion = '1.73.0'
+        jupiterVersion = '5.13.2'
         mockitoVersion = '4.11.0'
-        lombokVersion = '1.18.34'
-        nimbusVersion = '9.41.2'
+        lombokVersion = '1.18.38'
+        nimbusVersion = '10.3.1'
         shadowVersion = '8.1.1'
 
         //IMPORTANT: This must be in sync with the shaded netty version in gRPC
-        nettyVersion = '4.1.114.Final'
+        nettyVersion = '4.2.2.Final'
     }
 
     apply plugin: 'java-library'
@@ -117,7 +117,7 @@ subprojects {
         if (JavaVersion.current() == JavaVersion.VERSION_1_8) {
             testImplementation group: 'uk.org.webcompere', name: 'system-stubs-core', version: '2.0.3' // Last version supporting Java 8
         } else {
-            testImplementation group: 'uk.org.webcompere', name: 'system-stubs-core', version: '2.1.7'
+            testImplementation group: 'uk.org.webcompere', name: 'system-stubs-core', version: '2.1.8'
         }
 
         // Project Lombok dependency

gradle.properties

@@ -1,2 +1,2 @@
-version=0.8.8
+version=0.8.12
 mavenDeployUrl=https://oss.sonatype.org/service/local/staging/deploy/maven2

java-spiffe-core/build.gradle

@@ -4,7 +4,7 @@ buildscript {
     }
 
     dependencies {
-        classpath group: 'com.google.protobuf', name: 'protobuf-gradle-plugin', version: '0.9.4'
+        classpath group: 'com.google.protobuf', name: 'protobuf-gradle-plugin', version: '0.9.5'
     }
 }
 
@@ -50,7 +50,7 @@ task integrationTest(type: Test) {
 
 protobuf {
     protoc {
-        artifact = 'com.google.protobuf:protoc:3.25.3'
+        artifact = 'com.google.protobuf:protoc:3.25.5'
     }
     plugins {
         grpc {

java-spiffe-core/src/main/java/io/spiffe/internal/CertificateUtils.java

@@ -229,8 +229,8 @@ public class CertificateUtils {
     // Given a private key in PEM format, encode it as DER
     private static byte[] toDerFormat(final byte[] privateKeyPem) throws InvalidKeyException {
         String privateKeyAsString = new String(privateKeyPem);
-        privateKeyAsString = privateKeyAsString.replaceAll("(-+BEGIN PRIVATE KEY-+\\r?\\n|-+END PRIVATE KEY-+\\r?\\n?)", "");
-        privateKeyAsString = privateKeyAsString.replaceAll("\n", "");
+        privateKeyAsString = privateKeyAsString.replaceAll("(-+BEGIN PRIVATE KEY-+|-+END PRIVATE KEY-+)", "");
+        privateKeyAsString = privateKeyAsString.replaceAll("\r?\n", "");
         val decoder = Base64.getDecoder();
         try {
             return decoder.decode(privateKeyAsString);

java-spiffe-helper/README.md

@@ -10,11 +10,11 @@ The Helper automatically gets the SVID updates and stores them in the KeyStore a
 
 On Linux:
 
-`java -jar java-spiffe-helper-0.8.8-linux-x86_64.jar`
+`java -jar java-spiffe-helper-0.8.12-linux-x86_64.jar`
 
 On Mac OS:
 
-`java -jar java-spiffe-helper-0.8.8-osx-x86_64.jar`
+`java -jar java-spiffe-helper-0.8.12-osx-x86_64.jar`
 
 You can run the utility with the `-c` or `--config` option to specify the path to the configuration file. By default, it
 will look for a configuration file named `conf/java-spiffe-helper.properties` in the current working directory.

java-spiffe-provider/README.md

@@ -147,11 +147,12 @@ from a SPIRE Agent, keep them updated in memory, and provide them for TLS connec
 The URL to connect to Postgres using TLS and Java SPIFFE is as follows:
 
 ```
-jdbc:postgresql://localhost:5432/postgres?sslmode=require&sslfactory=io.spiffe.provider.SpiffeSslSocketFactory
+jdbc:postgresql://localhost:5432/postgres?sslmode=require&sslfactory=io.spiffe.provider.SpiffeSslSocketFactory&sslNegotiation=direct
 ```
 
 The parameter `sslfactory` in the URL configures the Postgres JDBC driver to use the `SpiffeSslSocketFactory` which wraps 
-around an SSL Socket with the Java SPIFFE functionality.
+around an SSL Socket with the Java SPIFFE functionality. Additional parameter `sslNegotiation` is needed to instantiate
+`SpiffeSslSocketFactory` correct.
 
 The Workload API socket endpoint should be configured through the Environment variable `SPIFFE_ENDPOINT_SOCKET`.