Skip to content

build(deps): update test JSONPath to 2.10.0#790

Open
jbeckwith-oai wants to merge 1 commit into
mainfrom
codex/update-test-jsonpath
Open

build(deps): update test JSONPath to 2.10.0#790
jbeckwith-oai wants to merge 1 commit into
mainfrom
codex/update-test-jsonpath

Conversation

@jbeckwith-oai

@jbeckwith-oai jbeckwith-oai commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

Summary

  • constrain test-only JSONPath from 2.7.0 to 2.10.0 in the WireMock graphs for openai-java-core and openai-java-client-okhttp, and the Spring Boot starter test graph
  • remediate Dependabot alert 28 (GHSA-pfh2-hfmq-phg5 / CVE-2023-51074)
  • move those graphs from vulnerable json-smart 2.4.7/2.4.8 to 2.6.0, addressing their Dependabot alert 10 paths
  • leave WireMock 2.35.2, Spring Boot 2.7.18, and the Jackson 2.14.0 compatibility floor unchanged

JSONPath 2.10.0 is the latest stable release on the Java 8-compatible 2.x line; JSONPath 3.0.0 requires Java 17. Both JSONPath 2.10.0 and its json-smart 2.6.0 dependency have Java 8 classfile level 52.

Alert #37's separate json-smart 2.5.1 path comes from Azure Identity in the example module, not JSONPath. It is outside this PR's scope and is already addressed by #779.

Downstream compatibility

This is limited to testImplementation constraints. Generated Maven POMs and Gradle module metadata for all three affected published modules contain neither JSONPath nor json-smart. There are no production source, bytecode, public API, runtime dependency, Java baseline, or release-version changes for SDK consumers.

A japicmp comparison of JSONPath 2.7.0 and 2.10.0 found no public binary or source incompatibilities. The reported changes are additions and a visibility widening.

Validation

  • dependency insight for core, okhttp, Spring Boot starter, and core's published-Jackson runtime resolves JSONPath to 2.10.0's Java 8 variant
  • all affected runtime graphs resolve json-smart and accessors-smart to 2.6.0
  • WireMock's matchingJsonPath integration passes under Jackson 2.14.0 and 2.18.9
  • focused okhttp and Spring Boot starter tests pass
  • all repository test tasks, ProGuard/R8 checks, testJacksonPublished, and the published-Jackson WireMock check pass (external generated-API mock-server tests skipped locally)
  • ./scripts/build --no-configuration-cache
  • ./scripts/lint
  • ./scripts/detect-breaking-changes origin/main
  • generated Maven POM and Gradle module metadata inspection for all three affected modules
  • all-resolvable-configuration scan for remaining JSONPath/json-smart versions
  • Java 8 classfile inspection for JSONPath and json-smart

@jbeckwith-oai jbeckwith-oai requested a review from a team as a code owner July 15, 2026 22:59
@openai-sdks

openai-sdks Bot commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown

OkTest Summary

✅ 237/237 SDK tests passed in 13.818s for Java SDK PR #790.

Test results — 42 files
Test Result Time
tests/chat-completions-complex-body.test.ts ✅ Passed 241ms
tests/chat-completions-create.test.ts ✅ Passed 660ms
tests/chat-completions-stream.test.ts ✅ Passed 303ms
tests/files-content-binary.test.ts ✅ Passed 243ms
tests/files-create-multipart.test.ts ✅ Passed 376ms
tests/files-list-pagination.test.ts ✅ Passed 247ms
tests/initialize-config.test.ts ✅ Passed 120ms
tests/instance-isolation.test.ts ✅ Passed 122ms
tests/models-list.test.ts ✅ Passed 213ms
tests/responses-background-lifecycle.test.ts ✅ Passed 773ms
tests/responses-body-method-errors.test.ts ✅ Passed 465ms
tests/responses-cancel-timeout.test.ts ✅ Passed 188ms
tests/responses-cancel.test.ts ✅ Passed 266ms
tests/responses-compact-retries.test.ts ✅ Passed 353ms
tests/responses-compact.test.ts ✅ Passed 244ms
tests/responses-create-advanced-stream.test.ts ✅ Passed 440ms
tests/responses-create-advanced.test.ts ✅ Passed 904ms
tests/responses-create-disconnect.test.ts ✅ Passed 1.055s
tests/responses-create-errors.test.ts ✅ Passed 371ms
tests/responses-create-malformed-api-responses.test.ts ✅ Passed 150ms
tests/responses-create-retries.test.ts ✅ Passed 206ms
tests/responses-create-stream-failures.test.ts ✅ Passed 185ms
tests/responses-create-stream-timeout.test.ts ✅ Passed 207ms
tests/responses-create-stream-wire.test.ts ✅ Passed 4.794s
tests/responses-create-stream.test.ts ✅ Passed 475ms
tests/responses-create-terminal-states.test.ts ✅ Passed 226ms
tests/responses-create-timeout.test.ts ✅ Passed 192ms
tests/responses-create.test.ts ✅ Passed 293ms
tests/responses-delete.test.ts ✅ Passed 273ms
tests/responses-input-items-errors.test.ts ✅ Passed 272ms
tests/responses-input-items-list.test.ts ✅ Passed 218ms
tests/responses-input-items-options.test.ts ✅ Passed 206ms
tests/responses-input-tokens-count-timeout.test.ts ✅ Passed 195ms
tests/responses-input-tokens-count.test.ts ✅ Passed 221ms
tests/responses-malformed-inputs.test.ts ✅ Passed 4.02s
tests/responses-not-found-errors.test.ts ✅ Passed 323ms
tests/responses-parse.test.ts ✅ Passed 524ms
tests/responses-retrieve-retries.test.ts ✅ Passed 199ms
tests/responses-retrieve.test.ts ✅ Passed 293ms
tests/responses-stored-method-errors.test.ts ✅ Passed 941ms
tests/retry-behavior.test.ts ✅ Passed 3.548s
tests/sdk-error-shape.test.ts ✅ Passed 407ms

View OkTest run #29525007625

SDK merge (c22b28a944fe) · head (b9154dc44ef3) · base (7cf5b737e442) · OkTest (fd7a761c81c1)

@jbeckwith-oai jbeckwith-oai force-pushed the codex/update-test-jsonpath branch from 0fc81b1 to d6801e0 Compare July 16, 2026 00:55
@jbeckwith-oai jbeckwith-oai changed the title fix(deps): update test JSONPath to 2.10.0 build(deps): update test JSONPath to 2.10.0 Jul 16, 2026
HAYDEN-OAI
HAYDEN-OAI previously approved these changes Jul 16, 2026
View reviewed changes

@HAYDEN-OAI HAYDEN-OAI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good, nice focused fix!

@jbeckwith-oai jbeckwith-oai force-pushed the codex/update-test-jsonpath branch from d6801e0 to b9154dc Compare July 16, 2026 18:41
@jbeckwith-oai jbeckwith-oai requested a review from HAYDEN-OAI July 16, 2026 18:42
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Jul 16, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b9154dc44e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread openai-java-spring-boot-starter/build.gradle.kts

dependencies {
constraints {
testImplementation("com.jayway.jsonpath:json-path:2.10.0") {

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve Spring Boot 2.7's SLF4J 1.7 runtime

When a starter test initializes Boot's logging system, such as with @SpringBootTest, JSONPath 2.10.0 also raises the test runtime to slf4j-api 2.0.x, while spring-boot-starter-test:2.7.18 brings Logback 1.2 and its SLF4J 1.7 binding. SLF4J 2 ignores that older binding, so Boot receives a NOP ILoggerFactory instead of Logback's LoggerContext and logging initialization can fail; the current ApplicationContextRunner tests do not exercise that path. Exclude or strictly constrain JSONPath's SLF4J transitive to Boot's 1.7 line in this configuration.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
@HAYDEN-OAI HAYDEN-OAI Awaiting requested review from HAYDEN-OAI

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jbeckwith-oai @HAYDEN-OAI