What's Changed

• Bump com.fasterxml.jackson.core:jackson-databind from 2.13.4.2 to 2.18.9

This release addresses a reported security vulnerability (GHSA-pq2g-wx69-c263) in the json-smart dependency. The following changes have been made to ensure the project remains secure and up-to-date:

What's Changed

• Bump net.minidev:json-smart from 2.5.0 to 2.5.2 by @dependabot[bot] in #112
• Fix for sonar - major reliability rating issue by @ShimonaR-MC in #113
• Create maven-publish.yml by @cormacdalton in #114

New Contributors

• @cormacdalton made their first contribution in #114

Full Changelog: v1.8.6...v1.8.7

• Fix for decrypting primitive types: #111

• #105

• Fixed issue with empty fields being left behind after JWE decryption

What's Changed

• Bump org.json:json from 20230227 to 20231013 by @dependabot in #77
• EncryptionUtils - added support for passing key and certificate as bytes array by @nchandran10 in #99

New Contributors

• @nchandran10 made their first contribution in #99

Full Changelog: v1.8.2...v1.8.3

• io.github.openfeign:feign-core:9.7.0 -> upgrade to 13.2.1
• com.squareup.okhttp:okhttp:2.7.5 -> move to com.squareup.okhttp3
• com.google.api-client:google-api-client:2.3.0 -> upgrade to 2.4.0

• Updated the com.jayway.jsonpath:json-path library to 2.9.0 to address CVE-2023-51074
• Updated the org.json:json library to 20240303 to address CVE-2023-5072

There are scenarios the client is using C# for decrypting the payload encrypted by the Java library. However, the IV size supported by the C# library is 12.

This release will support IV with a size of 12 bytes.