Skip to content

build(deps): update test JSONPath to 2.10.0#790

Open
jbeckwith-oai wants to merge 1 commit into
mainfrom
codex/update-test-jsonpath
Open

build(deps): update test JSONPath to 2.10.0#790
jbeckwith-oai wants to merge 1 commit into
mainfrom
codex/update-test-jsonpath

Conversation

@jbeckwith-oai

Copy link
Copy Markdown
Contributor

Summary

  • constrain test-only JSONPath from 2.7.0 to 2.10.0 in the WireMock graphs for openai-java-core and openai-java-client-okhttp, and the Spring Boot starter test graph
  • remediate Dependabot alert 28 (GHSA-pfh2-hfmq-phg5 / CVE-2023-51074)
  • move those graphs from vulnerable json-smart 2.4.7/2.4.8 to 2.6.0, addressing their Dependabot alert 10 paths
  • leave WireMock 2.35.2, Spring Boot 2.7.18, and the Jackson 2.14.0 compatibility floor unchanged

JSONPath 2.10.0 is the latest stable release on the Java 8-compatible 2.x line; JSONPath 3.0.0 requires Java 17. Both JSONPath 2.10.0 and its json-smart 2.6.0 dependency have Java 8 classfile level 52.

Alert #37's separate json-smart 2.5.1 path comes from Azure Identity in the example module, not JSONPath. It is outside this PR's scope and is already addressed by #779.

Downstream compatibility

This is limited to testImplementation constraints. Generated Maven POMs and Gradle module metadata for all three affected published modules contain neither JSONPath nor json-smart. There are no production source, bytecode, public API, runtime dependency, Java baseline, or release-version changes for SDK consumers.

A japicmp comparison of JSONPath 2.7.0 and 2.10.0 found no public binary or source incompatibilities. The reported changes are additions and a visibility widening.

Validation

  • dependency insight for core, okhttp, Spring Boot starter, and core's published-Jackson runtime resolves JSONPath to 2.10.0's Java 8 variant
  • all affected runtime graphs resolve json-smart and accessors-smart to 2.6.0
  • WireMock's matchingJsonPath integration passes under Jackson 2.14.0 and 2.18.9
  • focused okhttp and Spring Boot starter tests pass
  • all repository test tasks, ProGuard/R8 checks, testJacksonPublished, and the published-Jackson WireMock check pass (external generated-API mock-server tests skipped locally)
  • ./scripts/build --no-configuration-cache
  • ./scripts/lint
  • ./scripts/detect-breaking-changes origin/main
  • generated Maven POM and Gradle module metadata inspection for all three affected modules
  • all-resolvable-configuration scan for remaining JSONPath/json-smart versions
  • Java 8 classfile inspection for JSONPath and json-smart

@jbeckwith-oai jbeckwith-oai requested a review from a team as a code owner July 15, 2026 22:59
@openai-sdks

openai-sdks Bot commented Jul 15, 2026

Copy link
Copy Markdown

OkTest Summary

237/237 SDK tests passed in 16.342s for Java SDK PR #790.

Test results — 42 files
Test Result Time
tests/chat-completions-complex-body.test.ts ✅ Passed 231ms
tests/chat-completions-create.test.ts ✅ Passed 817ms
tests/chat-completions-stream.test.ts ✅ Passed 358ms
tests/files-content-binary.test.ts ✅ Passed 249ms
tests/files-create-multipart.test.ts ✅ Passed 318ms
tests/files-list-pagination.test.ts ✅ Passed 254ms
tests/initialize-config.test.ts ✅ Passed 245ms
tests/instance-isolation.test.ts ✅ Passed 221ms
tests/models-list.test.ts ✅ Passed 160ms
tests/responses-background-lifecycle.test.ts ✅ Passed 664ms
tests/responses-body-method-errors.test.ts ✅ Passed 441ms
tests/responses-cancel-timeout.test.ts ✅ Passed 242ms
tests/responses-cancel.test.ts ✅ Passed 440ms
tests/responses-compact-retries.test.ts ✅ Passed 485ms
tests/responses-compact.test.ts ✅ Passed 273ms
tests/responses-create-advanced-stream.test.ts ✅ Passed 385ms
tests/responses-create-advanced.test.ts ✅ Passed 1.241s
tests/responses-create-disconnect.test.ts ✅ Passed 1.098s
tests/responses-create-errors.test.ts ✅ Passed 305ms
tests/responses-create-malformed-api-responses.test.ts ✅ Passed 327ms
tests/responses-create-retries.test.ts ✅ Passed 223ms
tests/responses-create-stream-failures.test.ts ✅ Passed 217ms
tests/responses-create-stream-timeout.test.ts ✅ Passed 221ms
tests/responses-create-stream-wire.test.ts ✅ Passed 6.144s
tests/responses-create-stream.test.ts ✅ Passed 349ms
tests/responses-create-terminal-states.test.ts ✅ Passed 395ms
tests/responses-create-timeout.test.ts ✅ Passed 233ms
tests/responses-create.test.ts ✅ Passed 267ms
tests/responses-delete.test.ts ✅ Passed 262ms
tests/responses-input-items-errors.test.ts ✅ Passed 290ms
tests/responses-input-items-list.test.ts ✅ Passed 410ms
tests/responses-input-items-options.test.ts ✅ Passed 541ms
tests/responses-input-tokens-count-timeout.test.ts ✅ Passed 207ms
tests/responses-input-tokens-count.test.ts ✅ Passed 300ms
tests/responses-malformed-inputs.test.ts ✅ Passed 5.062s
tests/responses-not-found-errors.test.ts ✅ Passed 416ms
tests/responses-parse.test.ts ✅ Passed 772ms
tests/responses-retrieve-retries.test.ts ✅ Passed 268ms
tests/responses-retrieve.test.ts ✅ Passed 461ms
tests/responses-stored-method-errors.test.ts ✅ Passed 1.068s
tests/retry-behavior.test.ts ✅ Passed 3.405s
tests/sdk-error-shape.test.ts ✅ Passed 484ms

View OkTest run #29462769500

SDK merge (29eff8b20529) · head (d6801e0e19b1) · base (845b2bc87fb0) · OkTest (fd7a761c81c1)

@jbeckwith-oai jbeckwith-oai force-pushed the codex/update-test-jsonpath branch from 0fc81b1 to d6801e0 Compare July 16, 2026 00:55
@jbeckwith-oai jbeckwith-oai changed the title fix(deps): update test JSONPath to 2.10.0 build(deps): update test JSONPath to 2.10.0 Jul 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant