Update dependency io.rest-assured:rest-assured to v6.2.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
io.rest-assured:rest-assured (source)	6.1.0 → 6.2.0

---

Release Notes

rest-assured/rest-assured (io.rest-assured:rest-assured)

v6.2.0

• Fix spring-web-test-client-kotlin-extensions bringing jakarta.servlet-api, jakarta.jakartaee-web-api and about 20 other Jakarta EE API jars to your classpath at runtime. They were declared with a scope that Maven doesn't know (optional), which it treated as a compile dependency, and are now provided, like in spring-mock-mvc-kotlin-extensions (#​1992)
• Upgraded scala-library in scala-support from 2.13.0 to 2.13.18, which fixes CVE-2022-36944, scala3-library_3 in scala-extensions from 3.3.3 to 3.3.8, Jackson 2 (jackson-databind, jackson-core and jackson-module-kotlin) from 2.17.1 to 2.22.3, Jackson 3 (tools.jackson) from 3.0.2 to 3.2.3, Gson from 2.9.0 to 2.14.0, Guava in json-schema-validator from 33.2.1-jre to 33.7.2-jre, commons-lang3 from 3.19.0 to 3.21.0, Yasson from 3.0.4 to 3.0.5 (now with its new group id org.eclipse.yasson, since org.eclipse:yasson 3.0.5 only relocates to it), Parsson from 1.1.7 to 1.1.9, Johnzon (johnzon-mapper) from 2.0.2 to 2.2.0 and jaxb-impl from 2.3.4 to 2.3.9 (#​1986)
• Non-backward compatible change: sending a request directly from a request specification created by RequestSpecBuilder.build() (for example spec.when().get("/x") or spec.post()) now fails with an IllegalStateException that tells you to use given().spec(spec) or given(spec), instead of a NullPointerException. then(), expect() and response() on such a specification also throw this exception, where they returned null before. The specification is meant to be added to a request, and isn't changed by the failed call. The javadoc of RequestSpecBuilder.build() now explains this (part of #​1863)
• Non-backward compatible change: sending a request directly from a response specification created by ResponseSpecBuilder.build() (for example responseSpec.when().get("/x")) now fails with an IllegalStateException that tells you to use given().spec(requestSpec).expect().spec(responseSpec), then().spec(responseSpec) or given(requestSpec, responseSpec), instead of a NullPointerException. when(), given(), with() and request() on such a specification also throw this exception, where they returned null before. Using the specification in a request, or as RestAssured.responseSpecification, works as before. The javadoc of ResponseSpecBuilder.build() now explains this (related to #​1863)
• JsonPath and JSON body assertions can now read a key that contains a colon with the dot notation, such as jsonPath.getInt("message.ErrorCode:") or body("message.ErrorCode:", equalTo(0)), which failed with "Invalid JSON expression" before. A colon in a ternary (a ? b : c) or Elvis (a ?: b) expression, in a closure or in a quoted string is left as is (fixes #​1766)
• Fix request logging of a multipart File whose mime type isn't text, such as application/octet-stream (the default) or image/png, which since 5.5.0 printed the whole file content to the log. Such a part is now logged as the path of the file, as before 5.5.0. The content of a file with a text mime type (text/*, JSON, XML or HTML) is still logged, and is now read with the charset of the part (or of its mime type), or UTF-8 if none is given, instead of the platform default charset. A text file that can't be read is logged as its path, so sending the request reports the error (fixes #​1819)
• Upgraded Groovy from 5.0.3 to 5.0.8 and Apache HttpClient (httpclient and httpmime) from 4.5.13 to 4.5.14 (#​1971)
• Fix races in the static configuration of REST Assured when tests run in parallel. RestAssured.filters(..), replaceFiltersWith(..), registerParser(..) and unregisterParser(..), and RestAssuredMockMvc.resultHandlers(..) and postProcessors(..), could make a given() in another thread fail with a ConcurrentModificationException or copy a default filter list with missing or null filters. given() (and when(), with(), expect() and the static request methods) no longer changes any shared state. The public static fields of RestAssured, RestAssuredMockMvc and RestAssuredWebTestClient, and JsonPath.config, XmlPath.config and JsonSchemaValidator.settings, are now volatile, so a value set before the tests start is seen by every thread. The javadoc of RestAssured, RestAssuredMockMvc and RestAssuredWebTestClient now explains how to use the static configuration when tests run in parallel (fixes #​1967)
• Non-backward compatible change: given() no longer writes the session id into the RestAssured.config field or RestAssured.defaultParser into the global parser registry. While RestAssured.sessionId is set, RestAssured.config() returns the config with the session id, but the RestAssured.config field doesn't contain it, also not after a request, so given().config(RestAssured.config) no longer sends the static session id (use RestAssured.config() instead). Setting RestAssured.sessionId or RestAssured.defaultParser back to null now takes effect without RestAssured.reset(). A list returned by RestAssured.filters() before replaceFiltersWith(..) keeps showing the old filters (fixes #​1967)
• Fix HttpClientConfig.reuseHttpClientInstance() creating more than one HttpClient when several threads send their first request at the same time, and make the default Yasson (JSON-B) object mapper share one Jsonb instance between threads in the same way. Note that the reused HttpClient is reconfigured by every request, so it still must not be used by requests that run at the same time (fixes #​1967)
• Non-backward compatible change: auth().certificate(certURL, password) and RestAssured.certificate(certURL, password), with or without CertificateAuthSettings, now use the file at certURL as key store, as documented, so the client certificate in it is sent to servers that ask for one (mutual TLS). Before, the file was only used as trust store, which it still is. This means that a private key in the file is now offered to any server that asks for a client certificate, also where it's optional (such as nginx with ssl_verify_client optional), which may then reject a certificate it doesn't trust, and that the private key must have the password of the file. To avoid this, or to use the JVM's default trust store, use RestAssured.certificate(trustStorePath, trustStorePassword, keyStorePath, keyStorePassword, CertificateAuthSettings) (as RestAssured.authentication or with RequestSpecBuilder.setAuth(..)), where an empty path means no key store or the default trust store (fixes #​1158, related to #​1325)
• Fix a root path with more than one placeholder left for a later withArgs(..), such as rootPath("a.%s.%s.%s", withArgs("x")).body(withArgs("y", "z"), ..), which failed with a MissingFormatArgumentException. All placeholders without an argument, including ones such as %d, are now kept for later arguments. body(withArgs(..), matcher) also no longer adds a trailing dot to the path, which showed up in failure messages such as "JSON path a.d.e. doesn't match." (fixes #​1949)
• The rest-assured module is now written entirely in Java and no longer depends on Groovy (org.apache.groovy:groovy and groovy-xml) directly. Groovy still comes transitively through json-path and xml-path, which use it for GPath, so the dependencies on the classpath are unchanged. The rest-assured and rest-assured-common OSGi bundles no longer import the groovy packages, and rest-assured-common no longer depends on Groovy at all (#​1917, #​1932)
• Non-backward compatible change: a Groovy closure used as request body now fails with an IllegalArgumentException. This could only happen when a custom ObjectMapper returned a Closure from serialize(..), in which case the closure was run as a builder (a JsonBuilder for JSON, a StreamingMarkupBuilder for XML and HTML, or with a Writer or OutputStream for text and binary content). Return a String, byte[] or InputStream from the ObjectMapper instead (#​1914)
• Non-backward compatible change: a request body that isn't a String (for example a byte[], InputStream or File) sent with content-type application/x-www-form-urlencoded now fails with an IllegalArgumentException explaining that a form url-encoded body must be a String, instead of a groovy.lang.MissingMethodException (#​1914)
• Non-backward compatible change: a groovy.lang.Writable request body sent with a text content-type is now sent as its toString() instead of what its writeTo(..) method writes. Groovy's own Writables (such as JsonBuilder and GString) produce the same output either way. A Groovy WritableFile (file.asWritable()) is now sent like any other File, read with the charset of the request content-type (#​1914)
• Fix the failure message of a body path assertion when the response body can't be parsed into something the path can navigate (for example a JSON body that is just a string), which showed the literal text $contentParser instead of the response body (#​1922)
• Fix form authentication failing with "IllegalArgumentException: parameterValues cannot be null" when an additional input field given to FormAuthConfig.withAdditionalField(s)(..) is an input tag without a value attribute on the login page. The field is now sent as a form parameter without a value (#​1921)
• Fix matchesDtd(URL) in RestAssuredMatchers, RestAssuredMockMvcMatchers and RestAssuredWebTestClientMatchers, which always failed with a GroovyCastException ("Cannot cast object '' with class 'java.lang.String' to class 'java.io.InputStream'") when the response was validated. The DTD is now read from the URL, every time the matcher is used (#​1920)
• Non-backward compatible change: matchesXsdInClasspath(..) and matchesDtdInClasspath(..) (in RestAssuredMatchers, RestAssuredMockMvcMatchers and RestAssuredWebTestClientMatchers) now fail with an IllegalArgumentException saying that the XSD or DTD couldn't be found in classpath, instead of a groovy.lang.GroovyRuntimeException ("Ambiguous method overloading"). The XSD and DTD matchers now also fail with an IllegalArgumentException when asked to match something that isn't a String, for example body("some.path", matchesXsd(..)) where the path returns an element that has child elements, instead of a Groovy exception (#​1920)
• Non-backward compatible change: io.restassured.assertion.HeaderMatcher, DetailedCookieAssertion, ResponseTimeMatcher and StreamVerifier are now written in Java and no longer implement groovy.lang.GroovyObject. HeaderMatcher.validateHeader(..), DetailedCookieAssertion.validateCookies(..) and ResponseTimeMatcher.validate(..) now return Map<String, Object> instead of Object, HeaderMatcher.validateHeader(..) takes a Response, and HeaderMatcher.getMatcher() and get/setResponseAwareMatcher(..) are now generically typed (Matcher<?> and ResponseAwareMatcher) (#​1919)
• A header expectation whose header name is neither a String nor a GString (for example an Integer key in the map passed to headers(Map)) now checks the header named by the key's string form instead of failing with a groovy.lang.MissingMethodException (#​1919)
• Non-backward compatible change: io.restassured.internal.http.HTTPBuilder, which a custom AuthenticationScheme receives in authenticate(..), no longer uses Groovy closures. Its get(..) methods, the request(..) overloads that took a Closure, getHandler() and the post(..) and patch(..) overloads without a response handler are removed. post(..), patch(..) and request(..) now take an HttpResponseHandler or a RequestConfigurer, and response handlers always take two arguments (the response and its parsed content) (#​1923)
• A parameter name that is neither a String nor a GString (for example an Integer key in the map passed to params(Map), queryParams(Map), formParams(Map) or pathParams(Map)) is now used in its string form, so 1 becomes "1", instead of failing with a groovy.lang.MissingMethodException (#​1927)
• Non-backward compatible change: io.restassured.internal.RestAssuredResponseOptionsGroovyImpl is removed and its logic now lives in RestAssuredResponseOptionsImpl, so getGroovyResponse(), setGroovyResponse(..) and the protected groovyResponse field of RestAssuredResponseOptionsImpl are gone. This affects code that calls these methods or subclasses the internal response classes. A subclass that overrides a method such as asString() now also sees that override used by path(..), jsonPath(), as(..) and the other methods that read the body (#​1926)
• Fix asByteArray() on a response with body expectations whose body was replaced by an InputStream (for example by a filter using ResponseBuilder.clone(..).setBody(inputStream)), which failed with a groovy.lang.MissingMethodException (#​1926)
• Non-backward compatible change: the authentication schemes in io.restassured.authentication (BasicAuthScheme, CertAuthScheme, ExplicitNoAuthScheme, FormAuthScheme, NTLMAuthScheme, NoAuthScheme, OAuth2Scheme, OAuthScheme, PreemptiveBasicAuthScheme and PreemptiveOAuth2HeaderScheme), and the AuthenticationScheme interface are now written in Java, and the classes no longer implement groovy.lang.GroovyObject. Their constructors, getters and setters are unchanged. A custom AuthenticationScheme written in Java can now get the authentication configuration from HTTPBuilder.getAuth() (#​1925)
• Non-backward compatible change: io.restassured.internal.matcher.xml.XmlXsdMatcher (the return type of RestAssuredMatchers.matchesXsd(..)) and XmlDtdMatcher are now written in Java and no longer implement groovy.lang.GroovyObject (#​1920)
• A CertAuthScheme whose key store or trust store path (setPathToKeyStore(..) or setPathToTrustStore(..)) is neither a String nor a java.io.File now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#​1925)
• Fix FilterContext.send(..) for a request whose HTTP method has no method of its own in RequestSender, such as TRACE or a custom method given to request(..) (for example request("PURGE", "/x")). It failed with a groovy.lang.MissingMethodException and now sends the request. FilterContext.send(..) now always calls RequestSender.request(method, path) on the request sender it is given, instead of get(path), post(path) and so on (#​1929)
• Fix getResponseContentType() of the response specification that filters receive (FilterableResponseSpecification), which always failed with a StackOverflowError. It now returns the expected content type, the description of the expected content type matcher, or "/" when no content type is expected (#​1928)
• Non-backward compatible change: using a ResponseSpecification that wasn't created by REST Assured, with spec(..) or specification(..) on a response specification or as RestAssured.responseSpecification, now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#​1928)
• A body expectation path that is neither a String nor a GString (for example an Integer key among the additional key/matcher pairs of body(..)) is now used in its string form instead of failing with a groovy.lang.MissingMethodException. A list given as path, or as path arguments to body(..), rootPath(..), root(..) or appendRootPath(..), whose elements aren't all io.restassured.specification.Argument (as created by withArgs(..)) now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#​1928)
• Fix cookies(Map) and cookies(String, Object, Object...) on a request specification, which failed with a groovy.lang.GroovyRuntimeException ("Could not find matching constructor for: io.restassured.http.Cookie$Builder(String, Integer)") when a cookie value wasn't a String, for example an Integer. Such a value is now converted the same way as a value given to cookie(String, Object, Object...), so 1 becomes "1" (#​1930)
• Fix keyStore(KeyStore) on a request specification and RequestSpecBuilder.setKeyStore(KeyStore), which always failed with a groovy.lang.MissingMethodException. SSLConfig gets the keyStore(KeyStore) method that the documentation of keyStore(KeyStore) refers to. A password-protected key store needs its password set with SSLConfig.keyStore(String) on the same SSLConfig, for example config(config().sslConfig(sslConfig().keyStore(keyStore).keyStore("password"))). Calling config(..) after keyStore(KeyStore) replaces the config and drops the key store. relaxedHTTPSValidation() only uses a key store given by path, not a KeyStore object (#​1930)
• Fix multiPart(String, Object) with a String and no request content type, which failed with a groovy.lang.GroovyRuntimeException ("Ambiguous method overloading"). It now adds a text/plain part (#​1930)
• Non-backward compatible change: using a RequestSpecification that wasn't created by REST Assured with spec(..) or specification(..) on a request specification now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#​1930)
• A header or cookie name given to headers(..) or cookies(..) (as a map key or in the name/value varargs) that isn't a String (for example an Integer) is now used in its string form instead of failing with a groovy.lang.GroovyRuntimeException (#​1931)
• Fix merging a request specification that has unnamed path parameters, for example the request specification that a filter receives for get("/users/{id}", 1), with spec(..) or RequestSpecBuilder.addRequestSpecification(..). The resulting specification failed with a groovy.lang.MissingPropertyException when it was sent with unnamed path parameters, merged again, or asked for its URI or unnamed path parameters (for example getURI() or getUnnamedPathParamValues()). It now gets the unnamed path parameters of the specification it was merged with (#​1931)
• Fix form authentication failing with "IllegalArgumentException: Invalid number of path parameters" when the login page is fetched for a request with path parameters, for example given().auth().form("John", "Doe").get("/secured/{id}", 1). The login page is now also fetched at the right URL when the path or a path parameter contains characters that need URL encoding, such as a space or a non-ASCII character, which used to be URL encoded twice (fixes #​1940)
• Non-backward compatible change: form authentication now fails with an IllegalArgumentException that names the field when an additional input field given to FormAuthConfig.withAdditionalField(s)(..) isn't on the login page. Such a field used to be sent with the value "[]" (fixes #​1941)
• Fix form authentication not passing the session filter of the request on to the login request when the filter is a subclass of SessionFilter (for example new SessionFilter() {}), so the subclass didn't get the session id (fixes #​1941)
• Fix form authentication failing with a NullPointerException when the login form has no action attribute. Such a form is now posted to the path and query of the URL of the login page, like a browser does: the URL that the request for the login page was redirected to, or the CSRF token page (including the base path) when CSRF is enabled. As for any form action, it is posted to the host of the request (fixes #​1941)
• Non-backward compatible change: form authentication now posts a login form with an empty action (action="") to the URL of the login page, like a browser does, instead of to "/" (fixes #​1941)
• Fix form authentication URL encoding the path and query of a form action read from the login page twice, so for example a form with action "/login?r=a%20b" was posted to /login?r=a%2520b. A "+" in the query of such a form action is decoded as a space, as servlet containers do, an encoded "/", "?", "#", "{" or "}" in its path is kept encoded, and a fragment ("#..") is left out. A form action given to FormAuthConfig is still used as it is (#​1954)
• Non-backward compatible change: form authentication now resolves a relative form action read from the login page against the URL of the login page (or its ), like a browser does. An action without a leading slash used to be resolved against the root, so for example action="login" on the page /secured/page was posted to /login and is now posted to /secured/login (#​1954)
• Fix form authentication for an absolute form action read from the login page (for example action="http://localhost:8080/login"), which was appended as a path to the host of the request. Like any other form action, its path and query are now posted to the host of the request (#​1954)
• Form authentication now fails with a message saying that the Location header is missing when the request for the login page is redirected (302) without a Location header, instead of "IllegalArgumentException: path cannot be null" (fixes #​1941)
• Non-backward compatible change: a key store configured without a trust store (with keyStore(..) on a request specification, RequestSpecBuilder, RestAssured or SSLConfig) is now used, so REST Assured offers its client certificate to a server that asks for one. Previously the key store was loaded but ignored unless a trust store was configured too, so a server that requires a client certificate rejected the connection. How the server certificate is validated is unchanged (the JVM's default trust when no trust store is configured). A server that only requests a client certificate (for example nginx with "ssl_verify_client optional") and doesn't trust it now rejects a connection that used to work. A key store whose private key can't be read with the key store password now fails the request instead of being ignored, and a key store given as a KeyStore without a password, whose private key needs one, fails with an IllegalArgumentException that says how to set the password (fixes #​1942)
• When the SSL settings can't be applied to an http request that is redirected to https, the SSLException now ends with the message of the cause, for example a FileNotFoundException for a missing trust store, instead of "null" (fixes #​1942)
• Fix sending a String body or form parameters with noContentType(), which failed with an IllegalArgumentException ("Don't know how to encode ... as a byte stream") unless an expected response content type was set, or with a NullPointerException for form parameters in a PATCH request. The body is now sent as text in the default content charset (EncoderConfig#defaultContentCharset), so the encodeContentTypeAs("/", ContentType.TEXT) workaround is no longer needed (fixes #​1947)
• Non-backward compatible change: a request body sent with noContentType() no longer gets a Content-Type header. Previously a binary body (byte[], InputStream or File) got "Content-Type: /", and when an expected response content type was set (for example expect().contentType(ContentType.JSON)) that content type was sent as the request Content-Type (fixes #​1947)
• Non-backward compatible change: merging a request specification with spec(..), specification(..) or RequestSpecBuilder.addRequestSpecification(..) no longer resets values that the merged specification never set. The base URI, base path, port, authentication scheme, request body, proxy, HTTP method, path (together with its unnamed path parameters), whether url encoding is enabled, whether a Content-Type is allowed (noContentType()) and whether CSRF is disabled (disableCsrf()) now survive a merge, and are only overwritten when the merged specification sets them. Before, for example, given().auth().oauth2("token").spec(specWithOnlyAHeader) sent no Authorization header, and given().baseUri("http://host").port(8081).spec(specWithOnlyAHeader) fell back to RestAssured.baseURI and RestAssured.port. Values that the merged specification only got from the defaults (such as RestAssured.baseURI, RestAssured.port, RestAssured.authentication or RestAssured.requestSpecification) don't overwrite anything either. This also affects a plain given(), which merges RestAssured.requestSpecification: it now uses the current values of RestAssured.baseURI, RestAssured.port, RestAssured.basePath and RestAssured.urlEncodingEnabled instead of the values they had when RestAssured.requestSpecification was built, unless that specification set them itself. To remove the authentication with a merged specification, set it to none explicitly, for example with RequestSpecBuilder.setAuth(new ExplicitNoAuthScheme()) (fixes #​1939)
• Fix a request hanging forever when its path contains a "{" that is never closed, for example get("/x{b"), or when an unnamed path parameter value contains "{", for example get("/{a}", "{"). An unclosed "{" is now kept as literal text, and path parameter placeholders after it still work, so get("/x{b") goes to /x%7Bb and given().pathParam("a", "A").get("/x{b/{a}") goes to /x%7Bb/A (fixes #​1935)
• Fix a byte[] multi-part being sent empty the second time a request specification is used, for example when a specification built with RequestSpecBuilder.addMultiPart(..) is used for several requests, or when the same given() is sent twice. The content of a byte[] multi-part also stays a byte[] after the request is sent (as seen by getMultiPartParams() on a FilterableRequestSpecification), instead of being replaced by a ByteArrayInputStream (fixes #​1938)
• Fix matchesXsdInClasspath(..) and matchesDtdInClasspath(..) (in RestAssuredMatchers, RestAssuredMockMvcMatchers and RestAssuredWebTestClientMatchers) on a thread that has no context class loader, where they failed with a NullPointerException, or whose context class loader can't see the XSD or DTD (for example in some custom thread pools), where they failed with "Couldn't find the XSD/DTD in classpath". The XSD or DTD is now also looked up in the class loader that loaded REST Assured (fixes #​1937)
• Fix the XSD and DTD matchers (matchesXsd(..), matchesXsdInClasspath(..), matchesDtd(..) and matchesDtdInClasspath(..) in RestAssuredMatchers, RestAssuredMockMvcMatchers and RestAssuredWebTestClientMatchers) so that the same matcher can be used more than once, for example in a shared ResponseSpecification. Matchers created from a String, InputStream, Reader or a classpath resource, and matchesDtd(File), only worked the first time and then failed, for example with a SAXParseException ("Failed to read schema document 'null'") or an IOException ("Stream Closed"). An InputStream or Reader given to these matchers is now read and closed when the matcher is created, and matchesDtd(File) no longer keeps the file open until the matcher is used (fixes #​1936)
• Fix JsonPath, and JSON body expectations such as body("lotto.lottoId", equalTo(5)), failing with "java.lang.ClassNotFoundException: groovy.lang.Script" in an OSGi container, or whenever the thread context class loader can't see Groovy. JsonPath now falls back to Groovy's own class loader when the thread context class loader can't see Groovy (fixes #​1933)
• Non-backward compatible change: path(..) on a response with an HTML content type (for example get("/page.html").path("html.head.title") or then().extract().path(..)) now returns the value the path points to, like it does for JSON and XML responses and like body("html.head.title", ..) does. Previously it returned the XmlPath itself, so extracting the value to a String failed with a ClassCastException. Use htmlPath() to get an XmlPath for an HTML response (fixes #​1943)
• Fix sessionId() and getSessionId() on responses from spring-mock-mvc and spring-web-test-client, and on responses built with ResponseBuilder, which always failed with "IllegalArgumentException: name cannot be null". They now return the value of the cookie named by the configured session id name (JSESSIONID by default). Also fix header(name) and getHeader(name) on a response without headers (for example one built with ResponseBuilder without setting any headers), which failed with a NullPointerException and now return null (fixes #​1944)
• Fix a ResponseAwareMatcher in a static RestAssuredMockMvc.responseSpecification or RestAssuredWebTestClient.responseSpecification failing with a NullPointerException when it calls path(..) on the response, and ignoring the configured session id name in sessionId(). The response it gets now has the config of the request (fixes #​1944)
• Fix a multipart boundary given in the request content type that contains "=", for example contentType("multipart/form-data; boundary="a=b"") or a JavaMail-style boundary such as ----=_Part_0_123. Before, such a boundary was replaced by a random one, or cut short when it ended with "=" (for example abc==). The boundary is now used as given, and the content type of the request specification (and, for "+multipart" content types, the Content-Type header that is sent) no longer gets a second boundary parameter (fixes #​1948)
• Fix CsrfConfig.csrfMetaTagName(..), which also set the CSRF input field name to the meta tag name. A page with both a CSRF input field and a meta tag then had its input field ignored and the token from the meta tag was sent as a header instead. The input field name is now kept (fixes #​1945)
• Fix LogConfig.defaultStream(..), which always turned pretty printing back on, so logConfig().enablePrettyPrinting(false).defaultStream(..) logged pretty printed bodies. The pretty printing setting is now kept (fixes #​1946)
• Fix PATCH requests with form parameters or multipart content, which were sent without their query parameters. Query parameters given with queryParam(..), in the path (for example patch("/x?a=1")) or, for form parameters, with param(..) are now added to the request URI, like for PUT and DELETE (fixes #​1001)
• Non-backward compatible change: EncoderConfig.defaultCharsetForContentType(charset, contentType) now only sets the default charset of the given content type. It used to also change the default content charset (defaultContentCharset()), so the charset was used for every content type without a charset of its own. For example, after encoderConfig().defaultCharsetForContentType("UTF-16", ContentType.JSON) a plain text body was sent as "text/plain; charset=UTF-16" and is now sent as "text/plain; charset=ISO-8859-1". If you relied on this, also call defaultContentCharset(..) (fixes #​1962)
• Non-backward compatible change: DecoderConfig.defaultCharsetForContentType(charset, contentType) now only sets the default charset of the given content type. It used to also change the default content charset (defaultContentCharset()), so a response without a charset in its content-type was decoded with that charset even when its content type had no charset of its own. For example, after decoderConfig().defaultCharsetForContentType("UTF-16", ContentType.JSON) a text/plain response without a charset was decoded as UTF-16 and is now decoded with the default content charset. If you relied on this, also call defaultContentCharset(..) (fixes #​1962)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: gradle/libs.versions.toml

Command failed: ./gradlew -Dorg.gradle.jvmargs=-Xms512m -Xmx512m --console=plain --dependency-verification lenient -q --write-verification-metadata sha256 dependencies

FAILURE: Build completed with 2 failures.

1: Task failed with an exception.
-----------
* What went wrong:
A problem occurred configuring project ':testdata:android-app-valid'.
> com.android.builder.sdk.LicenceNotAcceptedException: Failed to install the following Android SDK packages as some licences have not been accepted.
     ndk;28.2.13676358 NDK (Side by side) 28.2.13676358
  To build this project, accept the SDK license agreements and install the missing components using the Android Studio SDK Manager.
  All licenses can be accepted using the sdkmanager command line tool:
  sdkmanager --licenses
  Or, to transfer the license agreements from one workstation to another, see https://developer.android.com/studio/intro/update.html#download-with-gradle
  
  Using Android SDK: /home/ubuntu/.android-sdk

* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights from a Build Scan (powered by Develocity).
> Get more help at https://help.gradle.org.
==============================================================================

2: Task failed with an exception.
-----------
* What went wrong:
A problem occurred configuring project ':testdata:android-app-valid'.
> com.android.builder.sdk.LicenceNotAcceptedException: Failed to install the following Android SDK packages as some licences have not been accepted.
     ndk;28.2.13676358 NDK (Side by side) 28.2.13676358
  To build this project, accept the SDK license agreements and install the missing components using the Android Studio SDK Manager.
  All licenses can be accepted using the sdkmanager command line tool:
  sdkmanager --licenses
  Or, to transfer the license agreements from one workstation to another, see https://developer.android.com/studio/intro/update.html#download-with-gradle
  
  Using Android SDK: /home/ubuntu/.android-sdk

* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights from a Build Scan (powered by Develocity).
> Get more help at https://help.gradle.org.
==============================================================================

BUILD FAILED in 25s