chore(deps): update dependency com.github.tomakehurst:wiremock-jre8 to v2.35.1 [security]

[dd-octo-sts]

This PR contains the following updates:

Package	Type	Update	Change
com.github.tomakehurst:wiremock-jre8 (source)	dependencies	minor	2.31.0 → 2.35.1

🚨 Security Vulnerability Fix

Severity: UNKNOWN

This PR addresses a security vulnerability detected by GitHub Dependabot. Please review and merge promptly.

---

Release Notes

wiremock/wiremock (com.github.tomakehurst:wiremock-jre8)

v2.35.1: - Security Release

Compare Source

🔒 This is a security release that addresses the following issues

• CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio
  • Overall CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)
• CVE-2023-41329 - Domain restrictions bypass via DNS
  Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes
  • Overall CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

Credits: @​W0rty, @​numacanedo, @​Mahoney, @​tomakehurst, @​oleg-nenashev

v2.35.0

Compare Source

Enhancements

• Add a negative contains matcher - thanks Damian Orzepowski
• Expose a Java API method for removing stubs by ID - thanks Patryk Fraczek
• Document the import API in the OpenAPI doc - thanks to user i-whammy
• Added the ability to restrict the addresses WireMock can proxy/record to, as a security measure.

Fixes

• Strip Maven directories from the standalone JAR as some were appearing that weren't related to dependencies actually present, confusing scanning tools - thanks to user krageon
• Dropped back to slf4j 1.7.36 and relocate it in the standalone JAR (ensuring 2.x users won't experience conflicts).

v2.34.0

Compare Source

This will be the final 2.x.x release and also the last to support Java 8.

Fixes

• Fixed #​1689 - incorrect HTTP version header - thanks to user Poojitha
• Fixed #​1882 - bug preventing matching of date/time query params/headers with custom format - thanks Klaas Dellschaft
• #​1930 - Fixed a partial path traversal vulnerability in the file source code - thanks Jonathan Leitschuh
• Fixed #​1783 - proxyUrlPrefixToRemove ignored when using a response definition transformer - thanks to user Ross-H-Projects
• Fixed #​1872 - create a request entity for POST, PUT etc. proxied requests when a content-length header is present, regardless of whether the size is 0.
• Fixed #​1946 - maths helper now supports epoch dates as inputs.

Enhancements

• Added a public, non-static getScenarios() method allowing access to all scenarios.

All dependencies brought up to date including Jetty to 9.4.48.v20220622.

v2.33.2

Compare Source

WireMock 2.33.1 was accidentally released using Java 11 rather than 8, resulting in class incompatibilities in places.

This release is functionally identical but built using Java 8.

v2.33.1

Compare Source

Fixes

• Put name field back on scenario API object having accidentally removed it.
• Improved validation of scenario set and reset so that reasonable errors are returned when attempting to use non-existent scenario names or states.

v2.33.0

Compare Source

This is primarily a maintenance release that brings all dependency versions up to date including a version of Jackson containing the fix for CVE-2020-36518.

Enhancements

• Added the ability to set and reset a single scenario's state
• Proxy will now send a request body for any request method.
• CORS response headers are now passed back from proxy responses when stub CORS is disabled.

Performance

• Improved performance of Request.getHeaders() - thanks Doug Roper.
• Improved performance of response body JSON parsing - thanks also Doug Roper.

v2.32.0

Compare Source

Enhancements

• Closes #​1614 - proper support for subclassing of the JUnit5 WireMockExtension
• Add support for put/delete file to/from a subfolder (#​1087)
• Closes #​956 - added the ability to fetch serve events for a specific stub ID
• Added ability to query unmatched serve events
• Added ability to verify requests using a custom matcher
• Upgraded to Apache HTTP Client 5.x
• Added WireMock.jsonResponse factory methods (#​1428)
• #​745 Need proxyUrlPrefixToRemove for proxy context url mapping (#​1556)
• Removed dependence on Conscrypt for ALPN and HTTP/2
• Recognize multipart/related and multipart/mixed (#​1415)
• Allow running Wiremock without HTTP Server (#​1572)
• Allow standalone runner to fetch mappings from classpath (#​1592)
• Added new command line parameters "--jetty-header-request-size" and "--jetty-header-response-size" for set a custom size of headers in Jetty. "--jetty-header-buffer-size" is deprecated.

Fixes

• Closes #​1688 - fall back to HTTPS 1.1 only when no ALPN provider can be loaded
• Fixed #​1643 - regression in date parsing preventing year and year/month only dates
• #​1612 prevent applying scientific notation and rounding to big numbers by ObjectMapper (#​1613)
• Fixed #​1608 and #​1585 - incorrect zoning of date/times in response templating when truncating

Code quality

• Enforce license headers with Spotless
• Enforce consistent code style with Spotless
• Upgrade to Gradle 7 + some Gradle config cleanup (#​1639)
• Convert AcceptanceTestBase to JUnit Jupiter to limit future violations (#​1669)
• Enable WireMock to be built on Java 11 and 17
• Drop JMock in favour of Mockito (#​1630)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.