Bump jjwt-impl from 0.10.7 to 0.11.2

[dependabot]

Bumps jjwt-impl from 0.10.7 to 0.11.2.

Changelog

Sourced from jjwt-impl's changelog.

0.11.2

This patch release:

• Allows empty JWS bodies to support RFC 8555 and similar initiatives. Pull Request 540
• Ensures OSGi environments can access JJWT implementation bundles (jjwt-jackson, jjwt-gson, etc) as fragments to jjwt-api bundle. Pull Request 580
• Rejects allowedClockSkewSeconds values that would cause numeric overflow. Issue 583
• Upgrades Jackson dependency to version 2.9.10.4 to address all known Jackson CVE vulnerabilities. Issue 585
• Updates SecretKey algorithm name validation to allow PKCS12 KeyStore OIDs in addition to JCA Names. Issue 588
• Enabled CI builds on JDK 14. Pull Request 590
• Adds missing parameters type to Maps.add(), which removes an unchecked type warning. Issue 591
• Ensures GsonDeserializer always uses UTF-8 for encoding bytes to Strings. Pull Request 592

All issues and PRs are listed in the Github JJWT 0.11.2 milestone.

0.11.1

This patch release:

• Upgrades the jjwt-jackson module's Jackson dependency to 2.9.10.3.
• Fixes an issue when using Java 9+ Map.of with JacksonDeserializer that resulted in an NullPointerException.
• Fixes an issue that prevented the jjwt-gson .jar's seralizer/deserializer implementation from being detected automatically.
• Ensures service implementations are now loaded from the context class loader, Services.class.classLoader, and the system classloader, the first classloader with a service wins, and the others are ignored. This mimics how Classes.forName() works, and how JJWT attempted to auto-discover various implementations in previous versions.
• Fixes a minor error in the Claims#getIssuedAt JavaDoc.

0.11.0

This minor release:

• Adds Google's Gson as a natively supported JSON parser. Installation instructions have been updated and new JJWT Gson usage guidelines have been added.

• Updates the Jackson dependency version to 2.9.10 to address three security vulnerabilities in Jackson.

• A new JwtParserBuilder interface has been added and is the recommended way of creating an immutable and thread-safe JwtParser instance. Mutable methods in JwtParser will be removed before v1.0. Migration to the new signatures is straightforward, for example:

  Previous Version:

   Jwts.parser()
       .requireAudience("string")
       .parse(jwtString)

  Current Version:

  Jwts.parserBuilder()
      .requireAudience("string")
      .build()
      .parse(jwtString)

... (truncated)

Commits

• 2747493 [maven-release-plugin] prepare release 0.11.2
• 0596bea Updating readme dependency references to reflect the 0.11.2 release
• 5c8064b Updated changelog to link to the 0.11.2 milestone
• 26527bd Updated the pom snapshot versions to prepare for the upcoming 0.11.2 release
• 2f897cb Updated the changelog for the upcoming 0.11.2 release
• 72973f9 Argument validation for allowedClockSkewSeconds (#601)
• 2b00ed1 Add DefaultJwtParser functionality to parse JWSs with empty body. (#540)
• 82b870e Add support for jdk14 (#590)
• d8c313c Fix GsonDeserializer to support unicode characters independently of "file.enc...
• 43de9a3 Add parameterized return type to Maps.and() (#597)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

The following labels could not be found: master, dependencies, java.

[dependabot]

Superseded by #33.