Use jspecify by sh-cho · Pull Request #2 · sh-cho/armeria

sh-cho · 2025-10-25T14:32:31Z

No description provided.

Automated changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action Co-authored-by: Meri Kim <dl_armeria@linecorp.com>

Signed-off-by: Seonghyeon Cho <seonghyeoncho96@gmail.com>

Automated changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action Co-authored-by: Meri Kim <dl_armeria@linecorp.com>

Signed-off-by: Seonghyeon Cho <seonghyeoncho96@gmail.com> Remove temp comment Signed-off-by: Seonghyeon Cho <seonghyeoncho96@gmail.com> Add deprecated comment Signed-off-by: Seonghyeon Cho <seonghyeoncho96@gmail.com> Add indent on imports Signed-off-by: Seonghyeon Cho <seonghyeoncho96@gmail.com> Add indent more Signed-off-by: Seonghyeon Cho <seonghyeoncho96@gmail.com>

Signed-off-by: Seonghyeon Cho <seonghyeoncho96@gmail.com>

`Type argument is not within its bounds: should be subtype of 'kotlin.Any'.`, etc Signed-off-by: Seonghyeon Cho <seonghyeoncho96@gmail.com>

Automated changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action Co-authored-by: Meri Kim <dl_armeria@linecorp.com>

Motivation: The `site-new` branch and the `site-new/` directory became obsolete due to the changes after branching out. Modifications: - Merge the `main` branch into the `site-new` branch (212 commits) - Reflect site changes in the `site-new/` directory (65daf72) Result: The `site-new` branch is now synced with `main` and includes all latest site updates.

Motivation: Athenz ZTS server defined in the Docker Compose file fails to start up because of changes introduced in Athenz 1.12.28. ```java WARN o.e.jetty.ee10.webapp.WebAppContext - Failed startup of context oeje10w.WebAppContext@79f227a9{zts,/zts,b=file:///tmp/jetty-0_0_0_0-8443-zts_war-_zts-any-1237552957018305555/webapp/,a=AVAILABLE,h=oeje10s.SessionHandler@14f3c6fc{STARTED}}{/opt/athenz/zts/webapps/zts.war} jakarta.servlet.ServletException: zts-server==org.glassfish.jersey.servlet.ServletContainer@5aa3f717{jsp=null,order=1,inst=true,async=true,src=DESCRIPTOR:file:///tmp/jetty-0_0_0_0-8443-zts_war-_zts-any-1237552957018305555/webapp/WEB-INF/web.xml,STARTED} ... Caused by: com.yahoo.athenz.auth.util.CryptoException: Invalid jwks uri: athenz-zts-server/oauth2/keys?rfc=true at com.yahoo.athenz.auth.token.jwts.JwtsSigningKeyResolver.addKeySource(JwtsSigningKeyResolver.java:181) at com.yahoo.athenz.auth.token.jwts.JwtsSigningKeyResolver.addJwksUriKeySource(JwtsSigningKeyResolver.java:140) at com.yahoo.athenz.auth.token.jwts.JwtsSigningKeyResolver.createKeyResolver(JwtsSigningKeyResolver.java:135) at com.yahoo.athenz.auth.token.jwts.JwtsSigningKeyResolver.<init>(JwtsSigningKeyResolver.java:92) at com.yahoo.athenz.auth.token.jwts.JwtsHelper.getJWTProcessor(JwtsHelper.java:241) at com.yahoo.athenz.zts.ZTSImpl.loadJWTProcessors(ZTSImpl.java:501) at com.yahoo.athenz.zts.ZTSImpl.<init>(ZTSImpl.java:412) at com.yahoo.athenz.zts.ZTSImpl.<init>(ZTSImpl.java:289) at com.yahoo.athenz.zts.ZTSImplFactory.<clinit>(ZTSImplFactory.java:20) ... 75 common frames omitted ``` It seems that a valid jwks_url is required in zts.property to start the server correctly. If it is not set, the system hostname is used instead, which leads a `MalformedURLException`. Modifications: - Set `https://athenz.io` as a dummy oauth_issuer in zts.properties - Use athenz/athenz-zts-db:latest for the base image of zts-db - Using athenz-zms-db works by initializing it with `/zts-init-db.sql`, but it’s not the intended value. Result: - Revive broken Athenz tests - Closes line#6458

I found this: ``` Thread[line#54,armeria-common-worker-epoll-3-1,5,main] java.lang.Exception: jdk.internal.misc.Unsafe#park at com.linecorp.armeria.internal.testing.InternalTestingBlockHoundIntegration.writeBlockingMethod(InternalTestingBlockHoundIntegration.java:86) at reactor.blockhound.BlockHound$Builder.lambda$install$8(BlockHound.java:488) at reactor.blockhound.BlockHoundRuntime.checkBlocking(BlockHoundRuntime.java:89) at java.base/jdk.internal.misc.Unsafe.park(Unsafe.java) at java.base/java.util.concurrent.locks.LockSupport.park(LockSupport.java:221) at java.base/java.util.concurrent.locks.AbstractQueuedSynchronizer.acquire(AbstractQueuedSynchronizer.java:754) at java.base/java.util.concurrent.locks.AbstractQueuedSynchronizer.acquire(AbstractQueuedSynchronizer.java:990) at java.base/java.util.concurrent.locks.ReentrantLock$Sync.lock(ReentrantLock.java:153) at java.base/java.util.concurrent.locks.ReentrantLock.lock(ReentrantLock.java:322) at java.base/java.util.concurrent.LinkedBlockingDeque.offerLast(LinkedBlockingDeque.java:353) at java.base/java.util.concurrent.LinkedBlockingDeque.addLast(LinkedBlockingDeque.java:327) at java.base/java.util.concurrent.LinkedBlockingDeque.add(LinkedBlockingDeque.java:626) at com.linecorp.armeria.xds.TestResourceWatcher.snapshotUpdated(TestResourceWatcher.java:51) at com.linecorp.armeria.xds.TestResourceWatcher.snapshotUpdated(TestResourceWatcher.java:31) at com.linecorp.armeria.xds.AbstractRoot.addSnapshotWatcher(AbstractRoot.java:75) at com.linecorp.armeria.xds.ClusterRoot.addSnapshotWatcher(ClusterRoot.java:28) at com.linecorp.armeria.xds.AbstractRoot.lambda$addSnapshotWatcher$0(AbstractRoot.java:66) at io.netty.util.concurrent.AbstractEventExecutor.runTask(AbstractEventExecutor.java:148) at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:141) at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:535) at io.netty.channel.SingleThreadIoEventLoop.run(SingleThreadIoEventLoop.java:201) at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:1193) at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) at java.base/java.lang.Thread.run(Thread.java:1583) ```

Automated changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action Co-authored-by: Meri Kim <dl_armeria@linecorp.com>

…ne#6442) Motivation: DocService debug console sets `content-type: application/json` for all HTTP methods. `content-type` is unnecessary for methods without a method. Additionally, the fall-through logic may not work in `RequestConverterFunction` if `content-type` exists. Modifications: - Set `content-type: application/json` to request headers for `POST`, `PUT` and `PATCH` methods in `AnnotatedHttpTransport` by default Result: DocService no longer sets the `Content-Type` header for methods without a body.

This is an automatic PR created by github action workflow: - Updated protobuf files Signed-off-by: Meri Kim <dl_armeria@linecorp.com> Co-authored-by: Meri Kim <dl_armeria@linecorp.com>

Motivation: Both CN and SAN would be absent if a certicate is public root CA. Warning for CA is false positive and noisy. In addition, since this is related to metrics, strict validation isn’t necessary. If there’s an issue with the certificate, it will fail at the TLS handshake level and the user will notice it. Discord discussion: https://discord.com/channels/1087271586832318494/1390342361770365020/1433043355566211254 Modifications: - Change the log level in `CertificateUtil` to debug from warn. Result: You no longer see false positive warnings for certificate metrics.

Motivation: line#6451 line#6408 I'm not 100% sure but test failures seem to have decreased after increasing the timeout. Modifications: - Wait up to 60 seconds for the zookeeper test server to start. Result: - Closes line#6451 - Closes line#6408

…ine#6485) Motivation: When no `ContentPreviewer` is selected to produce a content preview, `TextContentPreviewer` acts as a fallback not only when the content type is textual but also when a charset is specified. For example, a request with a `Content-Type` header of `image/png; charset=utf-8` will still be recorded because the charset is specified. Modifications: - Stop producing text content preview for non-text types with charset. Result: - **Breaking change**: non-textual content with charset is no longer recorded by the `ContentPreviewer` fallback.

Motivation: Following the introduction of the `xds-api` module, we can now use `pgv` to validate resources according to validations defined upstream. As a bonus, this will be useful for the upcoming error-handling PR, as it gives us a reliable way to test how invalid resources should notify users. Modifications: - Applied pgv validation to each resource type - Fixed failing tests so that they pass `pgv` Result: - proto-gen validation is applied to `XdsBootstrap`

Motivation: When recording metrics, it is important that each listener/cluster is uniquely identifiable by it's name. For this reason, a `XdsListenerManager` is introduced which is equivalent to `XdsClusterManager`. ref: https://www.envoyproxy.io/docs/envoy/latest/configuration/listeners/stats#listener-manager Additionally, in preparation for config-source related metrics the logic for `ConfigSourceMapper` has been cleaned up to match upstream's implementation. In detail: - lds, cds will only use the config source specified in Bootstrap.dynamic_resources - rds, eds will use the config source specified in each resource's respective configuration. Lastly, Modifications: - `BootstrapListeners` has been replaced with `XdsListenerManager` - `ConfigSourceMapper` has been refactored to match upstream's implementation - `ConfigSourceClient` now maps ads to the matching config source in the constructor. This will allow us to later on tag `ConfigSourceClient` as `ads` or `non-ads` when recording metrics/logs. - Misc) `XdsClusterManager`, `XdsListenerManager` registers resources asynchronously in event loops, and notifies if a failure occurs via `onError` Result: - `XdsListenerManager` is added

Motivation: In order to gain insight into an xDS-based client, it is important to know the version of the resource being used. This PR attempts to introduce `XdsResource#version` which represents the version sent by the server for a specific resource. Additionally, `version` is represented as a string which may be difficult to reason about or record as metrics efficiently. For this reason, an additional `XdsResource#revision` field is introduced which denotes how many times a `version` has been changed for a ConfigSourceClient. In order to denote which resources resulted in errors, a `resourceName` field has been added to `SnapshotWatcher`. If a name is not found, Refactoring) While implementing this approach, a bug was found where a nonce is not reset per gRPC stream. As such, SotwXdsStream has been refactored and a `ActualStream` has been extracted which represents an actual gRPC stream. The nonce lives on the `ActualStream`, whereas the version lives on the conceptual stream level which is consistent with upstream implementation. Additionally, a per-type resource cache has also been introduced to cache resources immediately after a version has been incremented. This is necessary if a resource is 1) quickly subscribed 2) unsubscribed 3) and subscribed again. Modifications: - Introduced `version`/`revision` fields for each resource - `SnapshotWatcher` now also notifies the resource name on error - `onError` is also emitted for `sotw` type objects so that users can be aware of these errors - `SotwXdsStream` has been refactored so that it better follows the behavior of upstream - `VersionManager` now updates the version for the sotw stream and manages the revision - `SubscriberStorage#ResourceCache` caches resources for the most recent version - Misc) `XdsResource` now only outputs `(name, type, version, revision)` by default for simplicity Result: - `XdsResource#version`, `XdsResource#revision` can be used to record logs/metrics

…ine#6474) Motivation: In the current `RouteConfig`, there are certain logic such as instantiating filters that can throw an exception due to incorrectly set filters. (e.g. A filter may be defined for a route and set as non-optional, but the registry may not contain the filter) I propose that this logic is moved to the bootstrap level for the following reasons: - Error notification for users is applied to the bootstrap level as a centralized location - Otherwise, users will be notified of the same error for each PreProcessor instantiated with the same bootstrap. - It makes more sense that a filter is defined per-bootstrap instead of per-client I propose that: - `FilterConfig` decision and `Filter` instantiation related logic is moved to the `Snapshot` level - As `Filter` for a route can be influenced by the parent resource `FilterConfig`, related information is passed from listeners down to the route on instantiation. - As a consequence, `RetryStateFactory`, `FilterUtil`, etc. have been moved to the core package level Misc) The timeout behavior utilizing `max_stream_duration` seemed over-complicated on a second look. Given that the 1) introduction of this field was as a workaround in upstream 2) in a client-only setting, the field doesn't have much distinction I propose that only the `RouteAction#timeout` is used when determining `responseTimeout` Modifications: - `Filter` related logic is moved to the `Snapshot` level - An `internal` package has been introduced to keep common utilities - Only `RouteAction#timeout` is used when determining `responseTimeout` Result: - Exceptions raised by filters will now be detectable from the Bootstrap level

Motivation: If you register a decorator such as LoggingClient to `ZtsBaseClient` via `configureWebClient`, the same decorator will be registered to the webClient twice. In this case, the same log is displayed twice. Modifications: - Remove this setting. - https://github.com/line/armeria/blob/armeria-1.33.4/athenz/src/main/java/com/linecorp/armeria/client/athenz/ZtsBaseClient.java#L125 - Because we already set it in `webClient(Consumer<? super WebClientBuilder> configurer)`. - https://github.com/line/armeria/blob/armeria-1.33.4/athenz/src/main/java/com/linecorp/armeria/client/athenz/ZtsBaseClient.java#L182 Result: - The `webClientConfigurer` is registered only once.

Motivation: This PR adds support for spring boot 4. The most impacted part of the upgrade is the module structure update which also caused some package renamings. ref: https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-4.0-Migration-Guide#module-dependencies Modifications: - The previous logic for re-using spring sources was inconsistent. The script has been organized so that: - For spring-boot4 modules, copy* is used. This is done so that each 2,3 module can use the most recent corresponding source and not depend on other modules. - For spring-boot2,3 modules, use* is used if possible. An exception is spring-boot2, where copy is necessary to translate `jakarta` -> `javax` - `spring-boot-health` has newly been introduced, and corresponding package names have changed. In order to share other sources, `health` related classes have been grouped from `WebOperationServiceUtil`, `ArmeriaSpringActuatorAutoConfiguration` to `HealthConfiguration`. - `HttpCodeStatusMapper` also has a different package. hence it is replaced iwth `StatusMapperWrapper`. - The package for `WebClientCustomizer`, `WebClientConfiguration` has been moved and hence, been moved to an internal `WebClientConfiguration` class - A new `WebServerConfiguration` has been introduced to handle moved package for `ServerProperties`. Also, `ManagementContextFactory` is now manadatory and has been added. Result: - Spring Boot 4 integrations are published

@4

…e#6555) Motivation: Even with line#6532, we received reports that the following was observed when using `armeria-xds-api` with proto3 runtime. ``` com/linecorp/armeria/internal/shaded/xds/pgv/validate/Validate$StringRules.internalGetFieldAccessorTable()Lcom/google/protobuf/GeneratedMessage$FieldAccessorTable; @4: areturn Type ``` ``` 'com/google/protobuf/GeneratedMessageV3$FieldAccessorTable' (current frame, stack[0]) is not assignable to 'com/google/protobuf/GeneratedMessage$FieldAccessorTable' (from method signature) ``` The direct cause of this is using protobuf 4 compiled jars with protobuf 3 runtime. ``` user@AL02437565 Downloads % javap -classpath ~/Downloads/protobuf-java-4.33.2.jar -public com.google.protobuf.GeneratedMessageV3\$FieldAccessorTable | head -n 2 Compiled from "GeneratedMessageV3.java" public final class com.google.protobuf.GeneratedMessageV3$FieldAccessorTable extends com.google.protobuf.GeneratedMessage$FieldAccessorTable { user@AL02437565 Downloads % javap -classpath ~/Downloads/protobuf-java-3.25.8.jar -public com.google.protobuf.GeneratedMessageV3\$FieldAccessorTable | head -n 2 Compiled from "GeneratedMessageV3.java" public final class com.google.protobuf.GeneratedMessageV3$FieldAccessorTable { user@AL02437565 Downloads % ``` The issue for this is that Validate$StringRules contains a bridge method which assumes an inheritance relationship between `GeneratedMessageV3$FieldAccessorTable` and `GeneratedMessage$FieldAccessorTable` ``` user@AL02437565 Downloads % javap -classpath pgv-java-stub-1.2.1.jar -v 'io.envoyproxy.pgv.validate.Validate$StringRules' | grep -n -A4 'internalGetFieldAccessorTable();' 876: protected com.google.protobuf.GeneratedMessageV3$FieldAccessorTable internalGetFieldAccessorTable(); 877- descriptor: ()Lcom/google/protobuf/GeneratedMessageV3$FieldAccessorTable; 878- flags: (0x0004) ACC_PROTECTED 879- Code: 880- stack=3, locals=1, args_size=1 -- 5137: protected com.google.protobuf.GeneratedMessage$FieldAccessorTable internalGetFieldAccessorTable(); 5138- descriptor: ()Lcom/google/protobuf/GeneratedMessage$FieldAccessorTable; 5139- flags: (0x1044) ACC_PROTECTED, ACC_BRIDGE, ACC_SYNTHETIC 5140- Code: 5141- stack=1, locals=1, args_size=1 user@AL02437565 Downloads % ``` whereas in proto3 runtime, this isn't assumed ``` user@AL02437565 Downloads % javap -classpath ~/.m2/repository/com/linecorp/armeria/armeria-xds-api/1.34.2-SNAPSHOT/armeria-xds-api-1.34.2-SNAPSHOT.jar -v 'com.linecorp.armeria.internal.shaded.xds.pgv.validate.Validate$StringRules' | grep -n -A4 'internalGetFieldAccessorTable();' 872: protected com.google.protobuf.GeneratedMessageV3$FieldAccessorTable internalGetFieldAccessorTable(); 873- descriptor: ()Lcom/google/protobuf/GeneratedMessageV3$FieldAccessorTable; 874- flags: (0x0004) ACC_PROTECTED 875- Code: 876- stack=3, locals=1, args_size=1 user@AL02437565 Downloads % ``` While the previous fix in line#6532 attempted to avoid this issue by using the Copy task's `DuplicateStrategy` method, it seems like both classes were included for some reason: https://github.com/line/armeria/blob/c6e61549c09e7186cba7ed6a1701ca68c85167a3/xds-api/build.gradle#L15-L19 ``` user@AL02437565 Downloads % unzip -Z -v armeria-xds-api-1.34.1.jar | grep -F 'com/linecorp/armeria/internal/shaded/xds/pgv/validate/Validate$StringRules.class' com/linecorp/armeria/internal/shaded/xds/pgv/validate/Validate$StringRules.class com/linecorp/armeria/internal/shaded/xds/pgv/validate/Validate$StringRules.class user@AL02437565 Downloads % ``` The requirement is: - The proto3-compiled `Validate.class` should be bundled in the final jar - The proto4-compiled `Validate.class` shouldn't be bundled in the final jar - The remaining validation related runtime classes (e.g. `ValidatorIndex`) should be included in the final jar Since it seems it is difficult to achieve this for a single module using `ShadowJar`, I propose that a separate module is defined for simplicity where the only purpose is to shade the `pgv-java-stub` dependency. Modifications: - Introduced a `shadowExclusions` property which can be defined per project. Specifying this excludes a certain pattern from being included in the final jar. This is moved to the `afterEvaluate` block to let individual projects configure the property before running the `ShadowJar` task. - Introduced a new `armeria-xds-pgv-shaded` module which shades the `pgv-java-stub` dependency - `armeria-xds-api` has a compile time dependency on the new `armeria-xds-pgv-shaded` jar Result: - Users no longer see a `VerifyError` due to files compiled with `protobuf-java` 4 runtime.

Modifications: - Migrate the blog mdx content - Move the MDX resources directories into src/content - Implement the remaining UI elements: header, navbar, footer, StarBegging, CookieConsent, and 404 error page - Migrate the short-url plugin and the release-note script - Apply the latest changes from the original site - Configure SEO and Google Analytics - Implement a custom plugin for generating an RSS feed and a script for merging RSS feeds - Add Algolia site verification (FYI, Algolia's `apikey` in the docusaurous.config.js is [safe to commit](https://docsearch.algolia.com/docs/docsearch-program#can-i-share-the-apikey-in-my-repo).) Result: - The new site is now ready for testing.

As described in https://docusaurus.io/docs/deployment

armeria.dev is temporarily down. Use line.githut.io/armeria until it's back. Related: line#2818

Motivation: In an effort to generalize usage of the `TlsSpec` abstraction introduced in line#6542, I propose that a new `ServerTlsSpec` is introduced. Note that this PR is a refactoring change which doesn't introduce new features, but organizes the previous logic so that TLS-related logic is applied consistently. Modifications: - `ServerTlsSpec`, `ServerTlsSpecBuilder` is introduced - `ClientSslContextFactory` is removed, and `SslContextFactory` is used as the main factory to convert `TlsSpec` to `SslContext`. - `IgnoreHostsTrustManager` is now removed as the functionality is replaced with `TlsPeerVerifier`s - `SslContextUtil#createSslContext` is removed and replaced with `SslContextUtil#toSslContext` - A single `SslContextFactory` is instantiated for a single server - `SslContextFactory` acts as the main source of recording metrics, hence `Server`-specific metric logic has been removed - `TlsProviderMapping` has been modified to use `SslContextFactory` to maintain `SslContext`s - The previous logic using `SslContextBuilder` has been removed and abstracted to a `VirtualHostTlsSetter` - `VirtualHostTlsSetter` sets TLS related parameters, and generates a `ServerTlsSpec` Result: - `SslContextFactory`, `ServerTlsSpec` is used to create `SslContext`s for server-side.

Motivation: Following line#6555, it seems like doing a simple `./gradlew assemble` fails. ``` /Users/user/Projects/upstream-armeria/xds-api/src/main/java/com/linecorp/armeria/xds/api/DefaultXdsValidatorIndex.java:22: error: cannot find symbol import io.envoyproxy.pgv.ReflectiveValidatorIndex; ``` where the dependency is defined as follows: https://github.com/line/armeria/blob/d4811bda9906076e18e0f9da0b2087b0e1191f31/xds-pgv-shaded/build.gradle#L11-L13 The current CI seems to pass since `shadedJar` is always run first, which means each module compiles its source based on the shaded artifact. In practice, relocated dependencies are excluded from the final pom and the dependency itself is embedded in the jar which makes it act similar to the `api` configuration https://github.com/line/armeria/blob/d4811bda9906076e18e0f9da0b2087b0e1191f31/gradle/scripts/lib/java-publish.gradle#L50 For this reason, I propose that `shade` extends from the `api` configuration. Conceptually, this can be thought as: wherever the containing module is imported, the shaded dependency is also included (since it's shaded) which acts identically to the `api` configuration Modifications: - Modified so that the `shade` configuration extends from the `api` configuration Result: - Running `./gradlew assemble` no longer fails

Bumps [min-document](https://github.com/Raynos/min-document) from 2.19.0 to 2.19.2. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Raynos/min-document/commit/0d14150640e4dd159e092eb551b3aca8f3378991"><code>0d14150</code></a> 2.19.2</li> <li><a href="https://github.com/Raynos/min-document/commit/49c2e0607bece7a041b8935bfb044ce6b65777d8"><code>49c2e06</code></a> Merge pull request <a href="https://redirect.github.com/Raynos/min-document/issues/56">#56</a> from wasabina67/fix/prototype-pollution-removeAttribut...</li> <li><a href="https://github.com/Raynos/min-document/commit/966646172d9063f880aeaf79882edfc3a0ceaca4"><code>9666461</code></a> Fix prototype pollution vulnerability in removeAttributeNS</li> <li><a href="https://github.com/Raynos/min-document/commit/4490b40cbb19feb26b09f217690a0969d1a89d51"><code>4490b40</code></a> 2.19.1</li> <li><a href="https://github.com/Raynos/min-document/commit/2cd587153733d3346365df6033067f64f07690f5"><code>2cd5871</code></a> update ignore</li> <li><a href="https://github.com/Raynos/min-document/commit/fe32e8da464cef622528725f647029a8fd7d95a6"><code>fe32e8d</code></a> Merge pull request <a href="https://redirect.github.com/Raynos/min-document/issues/55">#55</a> from jameswassink/fix/prototype-pollution-removeAttrib...</li> <li><a href="https://github.com/Raynos/min-document/commit/6c5f31aa57e2122fcedd4c7eae58b82f477e09f5"><code>6c5f31a</code></a> Better prototype pollution fix</li> <li><a href="https://github.com/Raynos/min-document/commit/0d4e8192ef723fb869645256102a56ed922efd68"><code>0d4e819</code></a> Fix prototype pollution in removeAttributeNS</li> <li><a href="https://github.com/Raynos/min-document/commit/bf7b69130a364b5c6fcb8e623bffe43054994c65"><code>bf7b691</code></a> Update package.json</li> <li><a href="https://github.com/Raynos/min-document/commit/1b5402dcd5df3bf2575e71d463baa44dc2c05571"><code>1b5402d</code></a> Merge pull request <a href="https://redirect.github.com/Raynos/min-document/issues/49">#49</a> from PixnBits/patch-1</li> <li>Additional commits viewable in <a href="https://github.com/Raynos/min-document/compare/v2.19.0...v2.19.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=min-document&package-manager=npm_and_yarn&previous-version=2.19.0&new-version=2.19.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/line/armeria/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [jws](https://github.com/brianloveswords/node-jws) from 3.2.2 to 3.2.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/brianloveswords/node-jws/releases">jws's releases</a>.</em></p> <blockquote> <h2>v3.2.3</h2> <h3>Changed</h3> <ul> <li>Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.</li> <li>Upgrading JWA version to 1.4.2, addressing a compatibility issue for Node >= 25.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/auth0/node-jws/blob/master/CHANGELOG.md">jws's changelog</a>.</em></p> <blockquote> <h2>[3.2.3]</h2> <h3>Changed</h3> <ul> <li>Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.</li> <li>Upgrading JWA version to 1.4.2, adressing a compatibility issue for Node >= 25.</li> </ul> <h2>[3.0.0]</h2> <h3>Changed</h3> <ul> <li><strong>BREAKING</strong>: <code>jwt.verify</code> now requires an <code>algorithm</code> parameter, and <code>jws.createVerify</code> requires an <code>algorithm</code> option. The <code>"alg"</code> field signature headers is ignored. This mitigates a critical security flaw in the library which would allow an attacker to generate signatures with arbitrary contents that would be accepted by <code>jwt.verify</code>. See <a href="https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/">https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/</a> for details.</li> </ul> <h2><a href="https://github.com/brianloveswords/node-jws/compare/v1.0.1...v2.0.0">2.0.0</a> - 2015-01-30</h2> <h3>Changed</h3> <ul> <li> <p><strong>BREAKING</strong>: Default payload encoding changed from <code>binary</code> to <code>utf8</code>. <code>utf8</code> is a is a more sensible default than <code>binary</code> because many payloads, as far as I can tell, will contain user-facing strings that could be in any language. (<a href="https://github.com/brianloveswords/node-jws/commit/6b6de48">6b6de48</a>)</p> </li> <li> <p>Code reorganization, thanks <a href="https://github.com/fearphage"><code>@fearphage</code></a>! (<a href="https://github.com/brianloveswords/node-jws/commit/7880050">7880050</a>)</p> </li> </ul> <h3>Added</h3> <ul> <li>Option in all relevant methods for <code>encoding</code>. For those few users that might be depending on a <code>binary</code> encoding of the messages, this is for them. (<a href="https://github.com/brianloveswords/node-jws/commit/6b6de48">6b6de48</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/auth0/node-jws/commit/4f6e73f24df42f07d632dec6431ade8eda8d11a6"><code>4f6e73f</code></a> Merge commit from fork</li> <li><a href="https://github.com/auth0/node-jws/commit/bd0fea57f35a97b6749a632b19ae5100d6d35729"><code>bd0fea5</code></a> version 3.2.3</li> <li><a href="https://github.com/auth0/node-jws/commit/7c3b4b411004c206af8901fa3f8e644127bbf8d9"><code>7c3b4b4</code></a> Enhance tests for HMAC streaming sign and verify</li> <li><a href="https://github.com/auth0/node-jws/commit/a9b8ed999de8f8fff486ac9167514577a0fae323"><code>a9b8ed9</code></a> Improve secretOrKey initialization in VerifyStream</li> <li><a href="https://github.com/auth0/node-jws/commit/6707fde62cbae465a7f11e52760fb994dbc0e0dc"><code>6707fde</code></a> Improve secret handling in SignStream</li> <li>See full diff in <a href="https://github.com/brianloveswords/node-jws/compare/v3.2.2...v3.2.3">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~julien.wollscheid">julien.wollscheid</a>, a new releaser for jws since your current version.</p> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=jws&package-manager=npm_and_yarn&previous-version=3.2.2&new-version=3.2.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/line/armeria/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

So that 1.34.2 can be released without a dependency to Netty

Motivation: We currently lack observability into `KeepAliveHandler`. This PR attempts to expose events so that users can be aware of when pings are sent/received for the client-side. Additionally, a `CloseHint` is added to the `connectionClosed` interface so users can better understand why a connection has been closed. In order to better define the behavior when `ConnectionPoolListener` is invoked, a `ConnectionEventListener` is introduced. This class is attached to the `Channel` for bookkeeping, and eventually delegating events to the `ConnectionPoolListener`. The current `MetricCollectingConnectionPoolListener` hasn't been modified for this iteration as it is complex, and removing the purging logic is probably better than applying changes in the current PR. I don't think handling this is necessary in this PR, but can do so if other maintainers feel it is useful. Modifications: - Added `ConnectionPoolListener#pingWrite`, `ConnectionPoolListener#pingAck`, and a variant of `ConnectionPoolListener#connectionClosed` which exposes a `closeHint` - `pingWrite` is invoked every time a ping is written - `pingAck` is invoked every time a written ping is acknowledged - `onPingAck()` represents an acknowledgement of a ping. Hence, `ClientHttp1KeepAliveHandler` has been modified to be able to handle `onPingAck()`. - A `ConnectionEventListener` is attached to a `Channel` on bootstrap registration. - Lifecycle methods are invoked for the `ConnectionEventListener`, which in turn delegates these to the `ConnectionPoolListener` - `KeepAliveHandler` maintains a reference to a `ConnectionEventListener`, and notifies events to the listener. Result: - Closes line#6539

Motivation: This is the last PR of the series for line#6464 . The changeset attempts to add observability into `ResourceNode`s in the `xds` module. More specifically, `onChanged` records the current revision of the node, and `onError` records how many errors were recorded for a specific `ResourceNode`. The `resourceName` and `type` is used as the default differentiator. If there are duplicates, the expectation is that only one of the nodes will be recorded. Currently, child `ResourceNode`s are created before they are closed. https://github.com/line/armeria/blob/adbf8755c8b2ae84f38ab1da72cf23e98f1c0f86/xds/src/main/java/com/linecorp/armeria/xds/ClusterResourceNode.java#L47-L51 This is in order to ensure that `XdsLoadBalancer`'s state is propagated across resource updates. (i.e. ClusterA updates doesn't result in calling `ClusterResourceNode.close`, which in turn allows ramping-up behavior so survive updates). On the other hand, metrics that are bound to a `ResourceNode` must be closed before a new `ResourceNode` is created. Otherwise, a cached `Gauge` may be returned which doesn't reflect the state of the new `ResourceNode`. For this, I propose a new `preClose` lifecycle method is introduced. This is called before the child node's `close` is called and will be used to unbind metrics before creating a new node. Modifications: - Added `AbstractNodeSnapshotWatcher` which abstracts logic for handling `closed` early return and calling `preClose` to child nodes - Added `ResourceNodeMeterBinder` which binds metrics for a `ResourceNode` - `AbstractResourceNode` binds to a `ResourceNodeMeterBinder` and calls callback methods for i - Each `ResourceNode` implementation calls `preClose` before updating the child node. Also, `preClose` calls are propagated to child nodes for cases where only the top-level node is updated. Result: - `ResourceNode` specific metrics are exported

Motivation: This PR allows users to specify `ClientTlsSpec` for each request using `RequestOptions#clientTlsSpec` or `ClientRequestContext#setClientTlsSpec`. `tlsCustomizer`, `alpnProtocols` are not allowed to be specified by users, and are set based on the `SessionProtocol` and `ClientFactory` when reaching the `HttpClientDelegate` I'm unsure whether client-level APIs (`AbstractClientOptionsBuilder`) will end up using the `TlsProvider`-style API, or `ClientTlsSpec`-style API. For this iteration, only request-level constructs can specify `ClientTlsSpec`. Modifications: - Added `RequestOptions#clientTlsSpec`, `ClientRequestContext#setClientTlsSpec` to allow users to specify `ClientTlsSpec` - `HttpClientDelegate` sets `tlsCustomizer`, `alpnProtocols` before finalizing the `ClientTlsSpec` Result: - Users can specify `ClientTlsSpec` for each request using `RequestOptions#clientTlsSpec` or `ClientRequestContext#setClientTlsSpec`

### Motivation: - Currently, `armeria` supports only `1-depth` context paths. Sometimes, user want deeper context paths than 1-depth when they use `contextPaths()`. ### Modifications: - Make `ContextPathServiceBuilder` tree to support nested context paths. - Add public functions. - `before()` is for going back previous node. - `contextPath()` is for adding context paths and making child `ContextPathServiceBuilder` - Add package-private and private functions. - `parent()`: To give Child `contextPathServiceBuilder` parent object. because of this, child can return parent object when `and()` is called. - `virtualHostbuilder()`: to relay their context via `ContextPathServiceBuilder` tree. - `mergeContextPaths()`: to merge previous context paths and current context paths. ### Example - I make a example armeria codes and test codes - repository : https://github.com/chickenchickenlove/nestedcontext - armeria example : https://github.com/chickenchickenlove/nestedcontext/blob/master/src/main/java/org/example/Main.java - test example: https://github.com/chickenchickenlove/nestedcontext/blob/master/pytest/my_test.py ### Result: - Closes line#5758 - User can use nested context paths. for example, ```java sb.contextPath("/rest") .contextPath("/catalog") .service("/product", new GetProductService()) .service("/products", new ProductsHandler()) .before() .contextPath("/cart") .contextPath("/foo") .contextPath("/bar") .service("/checkout", new CheckoutService()); .and() .contextPath("/gql") .service("/catalog", new GraphQLService()); ``` `/rest/catalog/product` => `getProductService` `/rest/catalog/products` => `productsHandler` `/rest/cart/foo/bar/checkout` => `checkoutService` `/gql/catalog` => `GraphQLService`

… the Armeria site. (line#6572) Motivation: - The design resources inquiry link is outdated. - The default pagination buttons in the release notes aren’t intuitive. Modifications: - Update the point of contact for using design resource requests. - Update email addresses in the Community guide. - Customize the pagination buttons for the release notes. - Change the UI text “Previous/Next” to “Newer release/Older release”. - Hide pagination buttons on version category pages and any pagination buttons that navigate to version category pages.

Motivation: As the `initialize()` method of `AbstractEndpointSelector` may access member fields of subclasses, `initialize()` couldn't be called in the constructor of `AbstractEndpointSelector`. Although the requirement is stated in the Javadoc, many users overlooked calling `initialize()` in their implementations. I propose adding a fallback logic that automatically initializes `AbstractEndpointSelector` if it hasn't been initialized by the time the first endpoint selection occurs, so users are protected from implementation mistakes. Modifications: - Try to initialize `AbstractEndpointSelector` if it hasn't been initialized when `select(...)` method is called. - Breaking) A subclass of `AbstractEndpointSelector` should implement `doSelectNow(ctx)` instead of `selectNow(ctx)`, which is now a final method. Result: Make `AbstractEndpointSelector` auto-initialize to avoid user-side implementation errors.

Motivation: The query string in a path of `Route` is treated as a part of routing path. However, when a service is actually resolved, the query string of the request path is excluded from the target path. As a result, the router fails to locate the service. https://github.com/line/armeria/blob/95ed9e1cfb075da4f04d7e5d5fa5adc63627282d/core/src/main/java/com/linecorp/armeria/server/RoutingContext.java#L82-L88 Modifications: - Raise `IllegalArgumentException` if the path of `route()` contains query strings and guide users to use `RouteBuilder.matchParams()` Result: - `Route` now properly rejects paths with query strings to avoid incorrect routing behavior. - Closes line#5054

) Motivation: Spring Framework warning was logged: ``` Bean 'com.linecorp.armeria.spring.ArmeriaBeanPostProcessorConfiguration' ... is not eligible for getting processed by all BeanPostProcessors... The currently created BeanPostProcessor [armeriaBeanPostProcessor] is declared through a non-static factory method on that class; consider declaring it as static instead. ``` This warning is raised because `BeanPostProcessor` beans must be initialized very early in the container's lifecycle to ensure they can process all other beans. Modifications: - Added the `static` keyword to the method declaration, as recommended by the Spring warning. Result: - The Spring startup warning is resolved.

Bumps [qs](https://github.com/ljharb/qs) and [express](https://github.com/expressjs/express). These dependencies needed to be updated together. Updates `qs` from 6.13.0 to 6.14.1 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md">qs's changelog</a>.</em></p> <blockquote> <h2><strong>6.14.1</strong></h2> <ul> <li>[Fix] ensure arrayLength applies to <code>[]</code> notation as well</li> <li>[Fix] <code>parse</code>: when a custom decoder returns <code>null</code> for a key, ignore that key</li> <li>[Refactor] <code>parse</code>: extract key segment splitting helper</li> <li>[meta] add threat model</li> <li>[actions] add workflow permissions</li> <li>[Tests] <code>stringify</code>: increase coverage</li> <li>[Dev Deps] update <code>eslint</code>, <code>@ljharb/eslint-config</code>, <code>npmignore</code>, <code>es-value-fixtures</code>, <code>for-each</code>, <code>object-inspect</code></li> </ul> <h2><strong>6.14.0</strong></h2> <ul> <li>[New] <code>parse</code>: add <code>throwOnParameterLimitExceeded</code> option (<a href="https://redirect.github.com/ljharb/qs/issues/517">#517</a>)</li> <li>[Refactor] <code>parse</code>: use <code>utils.combine</code> more</li> <li>[patch] <code>parse</code>: add explicit <code>throwOnLimitExceeded</code> default</li> <li>[actions] use shared action; re-add finishers</li> <li>[meta] Fix changelog formatting bug</li> <li>[Deps] update <code>side-channel</code></li> <li>[Dev Deps] update <code>es-value-fixtures</code>, <code>has-bigints</code>, <code>has-proto</code>, <code>has-symbols</code></li> <li>[Tests] increase coverage</li> </ul> <h2><strong>6.13.1</strong></h2> <ul> <li>[Fix] <code>stringify</code>: avoid a crash when a <code>filter</code> key is <code>null</code></li> <li>[Fix] <code>utils.merge</code>: functions should not be stringified into keys</li> <li>[Fix] <code>parse</code>: avoid a crash with interpretNumericEntities: true, comma: true, and iso charset</li> <li>[Fix] <code>stringify</code>: ensure a non-string <code>filter</code> does not crash</li> <li>[Refactor] use <code>__proto__</code> syntax instead of <code>Object.create</code> for null objects</li> <li>[Refactor] misc cleanup</li> <li>[Tests] <code>utils.merge</code>: add some coverage</li> <li>[Tests] fix a test case</li> <li>[actions] split out node 10-20, and 20+</li> <li>[Dev Deps] update <code>es-value-fixtures</code>, <code>mock-property</code>, <code>object-inspect</code>, <code>tape</code></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ljharb/qs/commit/3fa11a5f643c76896387bd2d86904a2d0141fdf7"><code>3fa11a5</code></a> v6.14.1</li> <li><a href="https://github.com/ljharb/qs/commit/a62670423c1ccab0dd83c621bfb98c7c024e314d"><code>a626704</code></a> [Dev Deps] update <code>npmignore</code></li> <li><a href="https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"><code>3086902</code></a> [Fix] ensure arrayLength applies to <code>[]</code> notation as well</li> <li><a href="https://github.com/ljharb/qs/commit/fc7930e86c2264c1568c9f5606830e19b0bc2af2"><code>fc7930e</code></a> [Dev Deps] update <code>eslint</code>, <code>@ljharb/eslint-config</code></li> <li><a href="https://github.com/ljharb/qs/commit/0b06aac566abee45ef0327667a7cc89e7aed8b58"><code>0b06aac</code></a> [Dev Deps] update <code>@ljharb/eslint-config</code></li> <li><a href="https://github.com/ljharb/qs/commit/64951f6200a1fb72cc003c6e8226dde3d2ef591f"><code>64951f6</code></a> [Refactor] <code>parse</code>: extract key segment splitting helper</li> <li><a href="https://github.com/ljharb/qs/commit/e1bd2599cdff4c936ea52fb1f16f921cbe7aa88c"><code>e1bd259</code></a> [Dev Deps] update <code>@ljharb/eslint-config</code></li> <li><a href="https://github.com/ljharb/qs/commit/f4b3d39709fef6ddbd85128d1ba4c6b566c4902e"><code>f4b3d39</code></a> [eslint] add eslint 9 optional peer dep</li> <li><a href="https://github.com/ljharb/qs/commit/6e94d9596ca50dffafcef40a5f64eca89962cf34"><code>6e94d95</code></a> [Dev Deps] update <code>eslint</code>, <code>@ljharb/eslint-config</code>, <code>npmignore</code></li> <li><a href="https://github.com/ljharb/qs/commit/973dc3c51c86da9f4e30edeb4b1725158d439102"><code>973dc3c</code></a> [actions] add workflow permissions</li> <li>Additional commits viewable in <a href="https://github.com/ljharb/qs/compare/v6.13.0...v6.14.1">compare view</a></li> </ul> </details> <br /> Updates `express` from 4.21.2 to 4.22.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/expressjs/express/releases">express's releases</a>.</em></p> <blockquote> <h2>v4.22.1</h2> <h2>What's Changed</h2> <blockquote> <p>[!IMPORTANT]<br /> The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.</p> </blockquote> <ul> <li>Release: 4.22.1 by <a href="https://github.com/UlisesGascon"><code>@UlisesGascon</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6934">expressjs/express#6934</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/express/compare/4.22.0...v4.22.1">https://github.com/expressjs/express/compare/4.22.0...v4.22.1</a></p> <h2>4.22.0</h2> <h2>Important: Security</h2> <ul> <li>Security fix for <a href="https://www.cve.org/CVERecord?id=CVE-2024-51999">CVE-2024-51999</a> (<a href="https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6">GHSA-pj86-cfqh-vqx6</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>Refactor: improve readability by <a href="https://github.com/sazk07"><code>@sazk07</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6190">expressjs/express#6190</a></li> <li>ci: add support for Node.js@23.0 by <a href="https://github.com/UlisesGascon"><code>@UlisesGascon</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6080">expressjs/express#6080</a></li> <li>Method functions with no path should error by <a href="https://github.com/wesleytodd"><code>@wesleytodd</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/5957">expressjs/express#5957</a></li> <li>ci: updated github actions ci workflow by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6323">expressjs/express#6323</a></li> <li>ci: reorder <code>npm i</code> steps to fix ci for older node versions by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6336">expressjs/express#6336</a></li> <li>Backport: ci: add node.js 24 to test matrix by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6506">expressjs/express#6506</a></li> <li>chore(4.x): wider range for query test skip by <a href="https://github.com/jonchurch"><code>@jonchurch</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6513">expressjs/express#6513</a></li> <li>use tilde notation for certain dependencies by <a href="https://github.com/UlisesGascon"><code>@UlisesGascon</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6905">expressjs/express#6905</a></li> <li>deps: qs@6.14.0 by <a href="https://github.com/UlisesGascon"><code>@UlisesGascon</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6909">expressjs/express#6909</a></li> <li>deps: use tilde notation for <code>qs</code> by <a href="https://github.com/Phillip9587"><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6919">expressjs/express#6919</a></li> <li>Release: 4.22.0 by <a href="https://github.com/UlisesGascon"><code>@UlisesGascon</code></a> in <a href="https://redirect.github.com/expressjs/express/pull/6921">expressjs/express#6921</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/express/compare/4.21.2...4.22.0">https://github.com/expressjs/express/compare/4.21.2...4.22.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/expressjs/express/blob/v4.22.1/History.md">express's changelog</a>.</em></p> <blockquote> <h1>4.22.1 / 2025-12-01</h1> <ul> <li>Revert security fix for <a href="https://www.cve.org/CVERecord?id=CVE-2024-51999">CVE-2024-51999</a> (<a href="https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6">GHSA-pj86-cfqh-vqx6</a>)</li> </ul> <h1>4.22.0 / 2025-12-01</h1> <ul> <li>Security fix for <a href="https://www.cve.org/CVERecord?id=CVE-2024-51999">CVE-2024-51999</a> (<a href="https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6">GHSA-pj86-cfqh-vqx6</a>)</li> <li>deps: use tilde notation for dependencies</li> <li>deps: qs@6.14.0</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/expressjs/express/commit/12fae14531a78f19a2caaa5d4f58d9b01eaf3194"><code>12fae14</code></a> 4.22.1</li> <li><a href="https://github.com/expressjs/express/commit/5ddf311af32e772a77fd48b6266ce2f1ba330e1a"><code>5ddf311</code></a> Revert "sec: security patch for CVE-2024-51999"</li> <li><a href="https://github.com/expressjs/express/commit/49744abd1120484fe64d7bde1cd3197c32523b6e"><code>49744ab</code></a> 4.22.0 (<a href="https://redirect.github.com/expressjs/express/issues/6921">#6921</a>)</li> <li><a href="https://github.com/expressjs/express/commit/6e97452f600a3b01719fbc5517d833c7646b0bb7"><code>6e97452</code></a> sec: security patch for CVE-2024-51999</li> <li><a href="https://github.com/expressjs/express/commit/6a23d34d652b9e69a4486d2a2a0dea54b9685fa5"><code>6a23d34</code></a> deps: use tilde notation for <code>qs</code> (<a href="https://redirect.github.com/expressjs/express/issues/6919">#6919</a>)</li> <li><a href="https://github.com/expressjs/express/commit/8c12cdf93b89a4628b59179e3cc0722fc517d6b3"><code>8c12cdf</code></a> deps: qs@6.14.0 (<a href="https://redirect.github.com/expressjs/express/issues/6909">#6909</a>)</li> <li><a href="https://github.com/expressjs/express/commit/7fea74fcf02764580f38f2a7f1932dfa54cddd90"><code>7fea74f</code></a> deps: use tilde notation for certain dependencies (<a href="https://redirect.github.com/expressjs/express/issues/6905">#6905</a>)</li> <li><a href="https://github.com/expressjs/express/commit/dac7a0475a99e9dfc57b3b8e6d5bdf52813f1944"><code>dac7a04</code></a> chore: wider range for query test skip (<a href="https://redirect.github.com/expressjs/express/issues/6513">#6513</a>)</li> <li><a href="https://github.com/expressjs/express/commit/997919b48879bbd53171c3b4e5dd1b04ad139241"><code>997919b</code></a> ci: add node.js 24 to test matrix (<a href="https://redirect.github.com/expressjs/express/issues/6506">#6506</a>)</li> <li><a href="https://github.com/expressjs/express/commit/36fb59c6c7d9dfca0b08dfeafb5b6e4a249234a1"><code>36fb59c</code></a> fix(ci): reorder <code>npm i</code> steps to fix ci for older node versions (<a href="https://redirect.github.com/expressjs/express/issues/6336">#6336</a>)</li> <li>Additional commits viewable in <a href="https://github.com/expressjs/express/compare/4.21.2...v4.22.1">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/line/armeria/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Update public suffix list (line#6455)

369ef51

Automated changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action Co-authored-by: Meri Kim <dl_armeria@linecorp.com>

sh-cho force-pushed the jspecify-nullable branch from 2df65ee to 6fe0e5e Compare October 25, 2025 16:10

sh-cho added 3 commits October 26, 2025 13:09

Add jspecify to version catalog

469a613

Signed-off-by: Seonghyeon Cho <seonghyeoncho96@gmail.com>

Add jspecify dependency to core

8e9285d

Signed-off-by: Seonghyeon Cho <seonghyeoncho96@gmail.com>

Support type-use @Nullable annotation in annotated service

5515e0f

Signed-off-by: Seonghyeon Cho <seonghyeoncho96@gmail.com>

sh-cho force-pushed the jspecify-nullable branch from 65442a8 to a329f31 Compare October 26, 2025 04:54

Checkstyle - Line length

eed6b4f

Signed-off-by: Seonghyeon Cho <seonghyeoncho96@gmail.com>

sh-cho force-pushed the jspecify-nullable branch from a329f31 to b4e359d Compare October 26, 2025 05:11

github-actions Bot and others added 4 commits October 26, 2025 10:07

Update public suffix list (line#6459)

5d8fde5

Automated changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action Co-authored-by: Meri Kim <dl_armeria@linecorp.com>

Change nearly all @Nullable to use jspecify's one

e199f27

Signed-off-by: Seonghyeon Cho <seonghyeoncho96@gmail.com>

Fix compile errors

a03482b

`Type argument is not within its bounds: should be subtype of 'kotlin.Any'.`, etc Signed-off-by: Seonghyeon Cho <seonghyeoncho96@gmail.com>

sh-cho force-pushed the jspecify-nullable branch from b4e359d to a03482b Compare October 26, 2025 11:17

github-actions Bot and others added 17 commits October 27, 2025 10:08

Update public suffix list (line#6463)

1a31f3e

Automated changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action Co-authored-by: Meri Kim <dl_armeria@linecorp.com>

Update public suffix list (line#6467)

aa4246d

Automated changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action Co-authored-by: Meri Kim <dl_armeria@linecorp.com>

Update public suffix list (line#6472)

80408a3

Automated changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action Co-authored-by: Meri Kim <dl_armeria@linecorp.com>

Update public suffix list (line#6478)

2a661f2

Automated changes by [create-pull-request](https://github.com/peter-evans/create-pull-request) GitHub action Co-authored-by: Meri Kim <dl_armeria@linecorp.com>

[xds] Update protobuf definitions to v1.36.2 (line#6461)

33d2d8f

This is an automatic PR created by github action workflow: - Updated protobuf files Signed-off-by: Meri Kim <dl_armeria@linecorp.com> Co-authored-by: Meri Kim <dl_armeria@linecorp.com>

jrhee17 and others added 28 commits December 17, 2025 12:44

Introduce ClientTlsSpec (line#6542)

c6e6154

Add release notes for 1.34.2 (line#6556)

c382bf0

<img width="1234" height="1029" alt="localhost_8000_release-notes_1 34 2" src="https://github.com/user-attachments/assets/33569205-bc44-45c5-b0f7-21e785db4a04" />

Add CNAME file for site

b66d74a

As described in https://docusaurus.io/docs/deployment

Use line.github.io/armeria (line#6561)

0cc56ea

armeria.dev is temporarily down. Use line.githut.io/armeria until it's back. Related: line#2818

Revert Netty upgrade for 1.34.2 (line#6562)

0dd12b2

So that 1.34.2 can be released without a dependency to Netty

Revert "Use line.github.io/armeria (line#6561)" (line#6565)

6777284

Revmoe site module and add 1.34.2 release note (line#6568)

9a4a946

Bump qs from 6.14.0 to 6.14.1 in /site-new (line#6575)

b171bb4

[xds] Update protobuf definitions to v1.36.4 (line#6547)

712b637

Merge branch 'main' into pr-6456-sh-cho-jspecify-nullable

e5b5bfb

Replace more

44a902f

github-actions Bot removed the Stale label Jan 3, 2026

github-actions Bot added the Stale label Feb 2, 2026

Navigation Menu

Use jspecify - #2

Use jspecify#2
sh-cho wants to merge 110 commits into
mainfrom
jspecify-nullable

sh-cho commented Oct 25, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

Conversation

sh-cho commented Oct 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

sh-cho commented Oct 25, 2025 •

edited

Loading