Chore/maintenance for 5.2.3

.github/workflows/sbom.yml

@@ -22,11 +22,49 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: advanced-security/sbom-generator-action@6fe43abf522b2e7a19bc769aec1e6c848614b517 # v0.0.2
+      # advanced-security/sbom-generator-action is deprecated; the GitHub REST API's synchronous
+      # export endpoint is also deprecated (closing down 2026-11-13), so this uses the
+      # asynchronous generate-report/fetch-report flow instead. See:
+      # https://docs.github.com/en/rest/dependency-graph/sboms
+      - name: Request SBOM generation
+        id: sbom_request
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          sbom_url=$(gh api "/repos/${{ github.repository }}/dependency-graph/sbom/generate-report" --jq '.sbom_url')
+          if [ -z "${sbom_url}" ] || [ "${sbom_url}" = "null" ]; then
+            echo "Failed to request SBOM generation"
+            exit 1
+          fi
+          echo "sbom_url=${sbom_url}" >> "${GITHUB_OUTPUT}"
+      - name: Fetch generated SBOM
         id: sbom
         env:
-          GITHUB_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ github.token }}
+          SBOM_URL: ${{ steps.sbom_request.outputs.sbom_url }}
+        run: |
+          file_name="sbom.spdx.json"
+          # SBOM_URL is a path like /repos/OWNER/REPO/dependency-graph/sbom/fetch-report/UUID.
+          # While the report is still processing, the endpoint returns 202 with an empty JSON
+          # body ("{}"); `gh api` treats that as a successful 2xx response, so we must also
+          # verify the body actually contains the completed SBOM document before accepting it.
+          ready="false"
+          for attempt in $(seq 1 30); do
+            if gh api "${SBOM_URL}" > "${file_name}" 2>fetch.log && jq -e '.spdxVersion' "${file_name}" >/dev/null 2>&1; then
+              ready="true"
+              break
+            fi
+            echo "SBOM not ready yet (attempt ${attempt}), retrying in 10s..."
+            cat fetch.log
+            sleep 10
+          done
+          rm -f fetch.log
+          if [ "${ready}" != "true" ]; then
+            echo "Timed out waiting for SBOM generation"
+            exit 1
+          fi
+          echo "fileName=${file_name}" >> "${GITHUB_OUTPUT}"
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          path: ${{steps.sbom.outputs.fileName }}
+          path: ${{ steps.sbom.outputs.fileName }}
           name: "SBOM"

CHANGELOG.md

@@ -9,6 +9,7 @@ Whenever a 3rd party library is updated, S3Mock will update its MINOR version.
   * [Planned changes](#planned-changes)
 * [CURRENT - 5.x - THIS VERSION IS UNDER ACTIVE DEVELOPMENT](#current---5x---this-version-is-under-active-development)
   * [5.3.0 - PLANNED](#530---planned)
+  * [5.2.3](#523)
   * [5.2.2](#522)
   * [5.2.1](#521)
   * [5.2.0](#520)
@@ -155,12 +156,35 @@ Version 5.x is JDK17 LTS bytecode compatible, with Docker and JUnit / direct Jav
 ## 5.3.0 - PLANNED
 
 * Features and fixes
-  * fix: `GetObjectTagging` now always returns a `Tagging` document with an empty `TagSet` when the object has no tags, instead of a `200` with no body. ([#3149](https://github.com/adobe/S3Mock/issues/3149))
+  * TBD
 * Version updates (deliverable dependencies)
   * TBD
 * Version updates (build dependencies)
   * TBD
 
+## 5.2.3
+
+* Features and fixes
+  * fix: `GetObjectTagging` now always returns a `Tagging` document with an empty `TagSet` when the object has no tags, instead of a `200` with no body. ([#3149](https://github.com/adobe/S3Mock/issues/3149))
+  * fix: TestNG test support module now supports Maven Surefire 3.6+ and documented the required listener and client initialization configuration.
+  * fix: SBOM generation now uses new GitHub.com APIs
+* Version updates (deliverable dependencies)
+  * none
+* Version updates (build dependencies)
+  * Bump actions/setup-java from 6.0.0 to 6.0.1
+  * Bump docker/setup-buildx-action from 4.3.0 to 4.4.0
+  * Bump docker/setup-qemu-action from 4.3.0 to 4.4.0
+  * Bump github/codeql-action from 4.37.9 to 4.38.0
+  * Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.0 to 3.10.2
+  * Bump com.puppycrawl.tools:checkstyle from 14.0.0 to 14.1.0
+  * Bump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0
+  * Bump org.apache.maven.plugins:maven-deploy-plugin from 3.1.4 to 3.2.0
+  * Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.6 to 3.6.0
+  * Bump org.apache.maven.plugins:maven-install-plugin from 3.1.4 to 3.2.0
+  * Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0
+  * Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2
+  * Bump org.codehaus.mojo:exec-maven-plugin from 3.6.3 to 3.6.4
+
 ## 5.2.2
 
 * Features and fixes