[dependabot]

Bumps io.rest-assured:rest-assured from 6.0.1 to 6.2.0.

Changelog

Sourced from io.rest-assured:rest-assured's changelog.

Changelog 6.2.0 (2026-10-16)

• Fix spring-web-test-client-kotlin-extensions bringing jakarta.servlet-api, jakarta.jakartaee-web-api and about 20 other Jakarta EE API jars to your classpath at runtime. They were declared with a scope that Maven doesn't know (optional), which it treated as a compile dependency, and are now provided, like in spring-mock-mvc-kotlin-extensions (#1992)
• Upgraded scala-library in scala-support from 2.13.0 to 2.13.18, which fixes CVE-2022-36944, scala3-library_3 in scala-extensions from 3.3.3 to 3.3.8, Jackson 2 (jackson-databind, jackson-core and jackson-module-kotlin) from 2.17.1 to 2.22.3, Jackson 3 (tools.jackson) from 3.0.2 to 3.2.3, Gson from 2.9.0 to 2.14.0, Guava in json-schema-validator from 33.2.1-jre to 33.7.2-jre, commons-lang3 from 3.19.0 to 3.21.0, Yasson from 3.0.4 to 3.0.5 (now with its new group id org.eclipse.yasson, since org.eclipse:yasson 3.0.5 only relocates to it), Parsson from 1.1.7 to 1.1.9, Johnzon (johnzon-mapper) from 2.0.2 to 2.2.0 and jaxb-impl from 2.3.4 to 2.3.9 (#1986)
• Non-backward compatible change: sending a request directly from a request specification created by RequestSpecBuilder.build() (for example spec.when().get("/x") or spec.post()) now fails with an IllegalStateException that tells you to use given().spec(spec) or given(spec), instead of a NullPointerException. then(), expect() and response() on such a specification also throw this exception, where they returned null before. The specification is meant to be added to a request, and isn't changed by the failed call. The javadoc of RequestSpecBuilder.build() now explains this (part of #1863)
• Non-backward compatible change: sending a request directly from a response specification created by ResponseSpecBuilder.build() (for example responseSpec.when().get("/x")) now fails with an IllegalStateException that tells you to use given().spec(requestSpec).expect().spec(responseSpec), then().spec(responseSpec) or given(requestSpec, responseSpec), instead of a NullPointerException. when(), given(), with() and request() on such a specification also throw this exception, where they returned null before. Using the specification in a request, or as RestAssured.responseSpecification, works as before. The javadoc of ResponseSpecBuilder.build() now explains this (related to #1863)
• JsonPath and JSON body assertions can now read a key that contains a colon with the dot notation, such as jsonPath.getInt("message.ErrorCode:") or body("message.ErrorCode:", equalTo(0)), which failed with "Invalid JSON expression" before. A colon in a ternary (a ? b : c) or Elvis (a ?: b) expression, in a closure or in a quoted string is left as is (fixes #1766)
• Fix request logging of a multipart File whose mime type isn't text, such as application/octet-stream (the default) or image/png, which since 5.5.0 printed the whole file content to the log. Such a part is now logged as the path of the file, as before 5.5.0. The content of a file with a text mime type (text/*, JSON, XML or HTML) is still logged, and is now read with the charset of the part (or of its mime type), or UTF-8 if none is given, instead of the platform default charset. A text file that can't be read is logged as its path, so sending the request reports the error (fixes #1819)
• Upgraded Groovy from 5.0.3 to 5.0.8 and Apache HttpClient (httpclient and httpmime) from 4.5.13 to 4.5.14 (#1971)
• Fix races in the static configuration of REST Assured when tests run in parallel. RestAssured.filters(..), replaceFiltersWith(..), registerParser(..) and unregisterParser(..), and RestAssuredMockMvc.resultHandlers(..) and postProcessors(..), could make a given() in another thread fail with a ConcurrentModificationException or copy a default filter list with missing or null filters. given() (and when(), with(), expect() and the static request methods) no longer changes any shared state. The public static fields of RestAssured, RestAssuredMockMvc and RestAssuredWebTestClient, and JsonPath.config, XmlPath.config and JsonSchemaValidator.settings, are now volatile, so a value set before the tests start is seen by every thread. The javadoc of RestAssured, RestAssuredMockMvc and RestAssuredWebTestClient now explains how to use the static configuration when tests run in parallel (fixes #1967)
• Non-backward compatible change: given() no longer writes the session id into the RestAssured.config field or RestAssured.defaultParser into the global parser registry. While RestAssured.sessionId is set, RestAssured.config() returns the config with the session id, but the RestAssured.config field doesn't contain it, also not after a request, so given().config(RestAssured.config) no longer sends the static session id (use RestAssured.config() instead). Setting RestAssured.sessionId or RestAssured.defaultParser back to null now takes effect without RestAssured.reset(). A list returned by RestAssured.filters() before replaceFiltersWith(..) keeps showing the old filters (fixes #1967)
• Fix HttpClientConfig.reuseHttpClientInstance() creating more than one HttpClient when several threads send their first request at the same time, and make the default Yasson (JSON-B) object mapper share one Jsonb instance between threads in the same way. Note that the reused HttpClient is reconfigured by every request, so it still must not be used by requests that run at the same time (fixes #1967)
• Non-backward compatible change: auth().certificate(certURL, password) and RestAssured.certificate(certURL, password), with or without CertificateAuthSettings, now use the file at certURL as key store, as documented, so the client certificate in it is sent to servers that ask for one (mutual TLS). Before, the file was only used as trust store, which it still is. This means that a private key in the file is now offered to any server that asks for a client certificate, also where it's optional (such as nginx with ssl_verify_client optional), which may then reject a certificate it doesn't trust, and that the private key must have the password of the file. To avoid this, or to use the JVM's default trust store, use RestAssured.certificate(trustStorePath, trustStorePassword, keyStorePath, keyStorePassword, CertificateAuthSettings) (as RestAssured.authentication or with RequestSpecBuilder.setAuth(..)), where an empty path means no key store or the default trust store (fixes #1158, related to #1325)
• Fix a root path with more than one placeholder left for a later withArgs(..), such as rootPath("a.%s.%s.%s", withArgs("x")).body(withArgs("y", "z"), ..), which failed with a MissingFormatArgumentException. All placeholders without an argument, including ones such as %d, are now kept for later arguments. body(withArgs(..), matcher) also no longer adds a trailing dot to the path, which showed up in failure messages such as "JSON path a.d.e. doesn't match." (fixes #1949)
• The rest-assured module is now written entirely in Java and no longer depends on Groovy (org.apache.groovy:groovy and groovy-xml) directly. Groovy still comes transitively through json-path and xml-path, which use it for GPath, so the dependencies on the classpath are unchanged. The rest-assured and rest-assured-common OSGi bundles no longer import the groovy packages, and rest-assured-common no longer depends on Groovy at all (#1917, #1932)
• Non-backward compatible change: a Groovy closure used as request body now fails with an IllegalArgumentException. This could only happen when a custom ObjectMapper returned a Closure from serialize(..), in which case the closure was run as a builder (a JsonBuilder for JSON, a StreamingMarkupBuilder for XML and HTML, or with a Writer or OutputStream for text and binary content). Return a String, byte[] or InputStream from the ObjectMapper instead (#1914)
• Non-backward compatible change: a request body that isn't a String (for example a byte[], InputStream or File) sent with content-type application/x-www-form-urlencoded now fails with an IllegalArgumentException explaining that a form url-encoded body must be a String, instead of a groovy.lang.MissingMethodException (#1914)
• Non-backward compatible change: a groovy.lang.Writable request body sent with a text content-type is now sent as its toString() instead of what its writeTo(..) method writes. Groovy's own Writables (such as JsonBuilder and GString) produce the same output either way. A Groovy WritableFile (file.asWritable()) is now sent like any other File, read with the charset of the request content-type (#1914)
• Fix the failure message of a body path assertion when the response body can't be parsed into something the path can navigate (for example a JSON body that is just a string), which showed the literal text $contentParser instead of the response body (#1922)
• Fix form authentication failing with "IllegalArgumentException: parameterValues cannot be null" when an additional input field given to FormAuthConfig.withAdditionalField(s)(..) is an input tag without a value attribute on the login page. The field is now sent as a form parameter without a value (#1921)
• Fix matchesDtd(URL) in RestAssuredMatchers, RestAssuredMockMvcMatchers and RestAssuredWebTestClientMatchers, which always failed with a GroovyCastException ("Cannot cast object '' with class 'java.lang.String' to class 'java.io.InputStream'") when the response was validated. The DTD is now read from the URL, every time the matcher is used (#1920)
• Non-backward compatible change: matchesXsdInClasspath(..) and matchesDtdInClasspath(..) (in RestAssuredMatchers, RestAssuredMockMvcMatchers and RestAssuredWebTestClientMatchers) now fail with an IllegalArgumentException saying that the XSD or DTD couldn't be found in classpath, instead of a groovy.lang.GroovyRuntimeException ("Ambiguous method overloading"). The XSD and DTD matchers now also fail with an IllegalArgumentException when asked to match something that isn't a String, for example body("some.path", matchesXsd(..)) where the path returns an element that has child elements, instead of a Groovy exception (#1920)
• Non-backward compatible change: io.restassured.assertion.HeaderMatcher, DetailedCookieAssertion, ResponseTimeMatcher and StreamVerifier are now written in Java and no longer implement groovy.lang.GroovyObject. HeaderMatcher.validateHeader(..), DetailedCookieAssertion.validateCookies(..) and ResponseTimeMatcher.validate(..) now return Map<String, Object> instead of Object, HeaderMatcher.validateHeader(..) takes a Response, and HeaderMatcher.getMatcher() and get/setResponseAwareMatcher(..) are now generically typed (Matcher<?> and ResponseAwareMatcher) (#1919)
• A header expectation whose header name is neither a String nor a GString (for example an Integer key in the map passed to headers(Map)) now checks the header named by the key's string form instead of failing with a groovy.lang.MissingMethodException (#1919)
• Non-backward compatible change: io.restassured.internal.http.HTTPBuilder, which a custom AuthenticationScheme receives in authenticate(..), no longer uses Groovy closures. Its get(..) methods, the request(..) overloads that took a Closure, getHandler() and the post(..) and patch(..) overloads without a response handler are removed. post(..), patch(..) and request(..) now take an HttpResponseHandler or a RequestConfigurer, and response handlers always take two arguments (the response and its parsed content) (#1923)
• A parameter name that is neither a String nor a GString (for example an Integer key in the map passed to params(Map), queryParams(Map), formParams(Map) or pathParams(Map)) is now used in its string form, so 1 becomes "1", instead of failing with a groovy.lang.MissingMethodException (#1927)
• Non-backward compatible change: io.restassured.internal.RestAssuredResponseOptionsGroovyImpl is removed and its logic now lives in RestAssuredResponseOptionsImpl, so getGroovyResponse(), setGroovyResponse(..) and the protected groovyResponse field of RestAssuredResponseOptionsImpl are gone. This affects code that calls these methods or subclasses the internal response classes. A subclass that overrides a method such as asString() now also sees that override used by path(..), jsonPath(), as(..) and the other methods that read the body (#1926)
• Fix asByteArray() on a response with body expectations whose body was replaced by an InputStream (for example by a filter using ResponseBuilder.clone(..).setBody(inputStream)), which failed with a groovy.lang.MissingMethodException (#1926)
• Non-backward compatible change: the authentication schemes in io.restassured.authentication (BasicAuthScheme, CertAuthScheme, ExplicitNoAuthScheme, FormAuthScheme, NTLMAuthScheme, NoAuthScheme, OAuth2Scheme, OAuthScheme, PreemptiveBasicAuthScheme and PreemptiveOAuth2HeaderScheme), and the AuthenticationScheme interface are now written in Java, and the classes no longer implement groovy.lang.GroovyObject. Their constructors, getters and setters are unchanged. A custom AuthenticationScheme written in Java can now get the authentication configuration from HTTPBuilder.getAuth() (#1925)
• Non-backward compatible change: io.restassured.internal.matcher.xml.XmlXsdMatcher (the return type of RestAssuredMatchers.matchesXsd(..)) and XmlDtdMatcher are now written in Java and no longer implement groovy.lang.GroovyObject (#1920)
• A CertAuthScheme whose key store or trust store path (setPathToKeyStore(..) or setPathToTrustStore(..)) is neither a String nor a java.io.File now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#1925)
• Fix FilterContext.send(..) for a request whose HTTP method has no method of its own in RequestSender, such as TRACE or a custom method given to request(..) (for example request("PURGE", "/x")). It failed with a groovy.lang.MissingMethodException and now sends the request. FilterContext.send(..) now always calls RequestSender.request(method, path) on the request sender it is given, instead of get(path), post(path) and so on (#1929)
• Fix getResponseContentType() of the response specification that filters receive (FilterableResponseSpecification), which always failed with a StackOverflowError. It now returns the expected content type, the description of the expected content type matcher, or "/" when no content type is expected (#1928)
• Non-backward compatible change: using a ResponseSpecification that wasn't created by REST Assured, with spec(..) or specification(..) on a response specification or as RestAssured.responseSpecification, now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#1928)
• A body expectation path that is neither a String nor a GString (for example an Integer key among the additional key/matcher pairs of body(..)) is now used in its string form instead of failing with a groovy.lang.MissingMethodException. A list given as path, or as path arguments to body(..), rootPath(..), root(..) or appendRootPath(..), whose elements aren't all io.restassured.specification.Argument (as created by withArgs(..)) now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#1928)
• Fix cookies(Map) and cookies(String, Object, Object...) on a request specification, which failed with a groovy.lang.GroovyRuntimeException ("Could not find matching constructor for: io.restassured.http.Cookie$Builder(String, Integer)") when a cookie value wasn't a String, for example an Integer. Such a value is now converted the same way as a value given to cookie(String, Object, Object...), so 1 becomes "1" (#1930)
• Fix keyStore(KeyStore) on a request specification and RequestSpecBuilder.setKeyStore(KeyStore), which always failed with a groovy.lang.MissingMethodException. SSLConfig gets the keyStore(KeyStore) method that the documentation of keyStore(KeyStore) refers to. A password-protected key store needs its password set with SSLConfig.keyStore(String) on the same SSLConfig, for example config(config().sslConfig(sslConfig().keyStore(keyStore).keyStore("password"))). Calling config(..) after keyStore(KeyStore) replaces the config and drops the key store. relaxedHTTPSValidation() only uses a key store given by path, not a KeyStore object (#1930)
• Fix multiPart(String, Object) with a String and no request content type, which failed with a groovy.lang.GroovyRuntimeException ("Ambiguous method overloading"). It now adds a text/plain part (#1930)
• Non-backward compatible change: using a RequestSpecification that wasn't created by REST Assured with spec(..) or specification(..) on a request specification now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#1930)
• A header or cookie name given to headers(..) or cookies(..) (as a map key or in the name/value varargs) that isn't a String (for example an Integer) is now used in its string form instead of failing with a groovy.lang.GroovyRuntimeException (#1931)
• Fix merging a request specification that has unnamed path parameters, for example the request specification that a filter receives for get("/users/{id}", 1), with spec(..) or RequestSpecBuilder.addRequestSpecification(..). The resulting specification failed with a groovy.lang.MissingPropertyException when it was sent with unnamed path parameters, merged again, or asked for its URI or unnamed path parameters (for example getURI() or getUnnamedPathParamValues()). It now gets the unnamed path parameters of the specification it was merged with (#1931)
• Fix form authentication failing with "IllegalArgumentException: Invalid number of path parameters" when the login page is fetched for a request with path parameters, for example given().auth().form("John", "Doe").get("/secured/{id}", 1). The login page is now also fetched at the right URL when the path or a path parameter contains characters that need URL encoding, such as a space or a non-ASCII character, which used to be URL encoded twice (fixes #1940)
• Non-backward compatible change: form authentication now fails with an IllegalArgumentException that names the field when an additional input field given to FormAuthConfig.withAdditionalField(s)(..) isn't on the login page. Such a field used to be sent with the value "[]" (fixes #1941)
• Fix form authentication not passing the session filter of the request on to the login request when the filter is a subclass of SessionFilter (for example new SessionFilter() {}), so the subclass didn't get the session id (fixes #1941)
• Fix form authentication failing with a NullPointerException when the login form has no action attribute. Such a form is now posted to the path and query of the URL of the login page, like a browser does: the URL that the request for the login page was redirected to, or the CSRF token page (including the base path) when CSRF is enabled. As for any form action, it is posted to the host of the request (fixes #1941)
• Non-backward compatible change: form authentication now posts a login form with an empty action (action="") to the URL of the login page, like a browser does, instead of to "/" (fixes #1941)
• Fix form authentication URL encoding the path and query of a form action read from the login page twice, so for example a form with action "/login?r=a%20b" was posted to /login?r=a%2520b. A "+" in the query of such a form action is decoded as a space, as servlet containers do, an encoded "/", "?", "#", "{" or "}" in its path is kept encoded, and a fragment ("#..") is left out. A form action given to FormAuthConfig is still used as it is (#1954)
• Non-backward compatible change: form authentication now resolves a relative form action read from the login page against the URL of the login page (or its ), like a browser does. An action without a leading slash used to be resolved against the root, so for example action="login" on the page /secured/page was posted to /login and is now posted to /secured/login (#1954)
• Fix form authentication for an absolute form action read from the login page (for example action="http://localhost:8080/login"), which was appended as a path to the host of the request. Like any other form action, its path and query are now posted to the host of the request (#1954)
• Form authentication now fails with a message saying that the Location header is missing when the request for the login page is redirected (302) without a Location header, instead of "IllegalArgumentException: path cannot be null" (fixes #1941)

... (truncated)

Commits

• a75cb9a [maven-release-plugin] prepare release rest-assured-6.2.0
• 28af02d [ci skip] Preparing changelog for release
• 9673680 [ci skip] Updated changelog to reflect the latest changes (#1994)
• 45d4a64 Stop spring-web-test-client-kotlin-extensions from bringing Jakarta EE APIs a...
• 21877e4 Give a clear error when a ResponseSpecBuilder spec sends a request directly (...
• c2415c4 Upgrade vulnerable dependencies in examples and tests (#1993)
• 5dd9f3b Upgrade published dependencies for 6.2.0, including scala-library for CVE-202...
• fd9efcc [ci skip] Updated changelog to reflect the latest changes (#1978)
• 83bcbda Give a clear error when a RequestSpecBuilder spec sends a request directly (#...
• 670f51f Read JSON keys that contain a colon with the dot notation (#1970)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)