chore(deps): bump org.http4k:http4k-core from 5.14.0.0 to 5.41.0.0 in /run/http4k-hello-world

[dependabot]

Bumps org.http4k:http4k-core from 5.14.0.0 to 5.41.0.0.

Release notes

Sourced from org.http4k:http4k-core's releases.

5.41.0.0

Changelog:

• http4k-format-xml : [Fix CVE-2024-55875: Possible Break] Fixed XML processing by disabling entity expansion in DocumentBuilderFactory configuration. Note: This change affects how XML entity references are handled. If your code relies on XML entity expansion (like replacing &entity; references with their defined content), it will need to be updated to provide the correct configuration when deserialising the XML body. Entity references will now remain as unexpanded text in the document.

Full details at: https://www.http4k.org/security/cve-2024-12345/ H/T to @@​JAckLosingHeart for the report

5.40.0.0

Changelog:

• http4k-core : Allow invalidation of cookie with a path. H/T @​ollieabbey
• http4k-core : Allow setting cookie value without quotes. H/T @​ollieabbey
• http4k-core : Fix cookie format for cookie with no attributes. H/T @​ollieabbey
• http4k-testing-webdriver : Remove usages of deprecated getAttribute API. Now use getDomAttribute instead.
• http4k-cloudnative : Deprecation of various functions and re-homing into http4k-platform-k8s module.
• http4k-* : [PRE RELEASE PREPARATION] As a part of the upcoming V6, several modules are being rehoused to new Maven coordinates. In preparation, we have introduced these modules to give users the time to migrate without taking on-board other breaking changes from v6 - essentially allowing the upgrade cycle to be:

1. Upgrade to latest v5 release. Deal with deprecations and module changes.
2. Upgrade to v6 when it is released. Deal with other breaking changes. We expect these to be mainly imports and will be detailed in the v6 release note when we have the chance. In the meantime, this is the list of modules that are being rehoused:

SOURCE MODULE - v5.X.X.X	DESTINATION MODULE(S) - v6.X.X.X
http4k-aws	http4k-platform-aws
http4k-azure	http4k-platform-azure
http4k-cloudevents	http4k-api-cloudevents
http4k-cloudnative	Split into http4k-config, http4k-platform-core, http4k-platform-k8s
http4k-contract	http4k-api-openapi
http4k-contract-jsonschema	http4k-api-jsonschema
http4k-contract-ui-redoc	http4k-api-ui-redoc
http4k-contract-ui-swagger	http4k-api-ui-swagger
http4k-failsafe	http4k-ops-failsafe
http4k-gcp	http4k-platform-gcp
http4k-graphql	http4k-api-graphql
http4k-htmx	http4k-web-htmx
http4k-jsonrpc	http4k-api-jsonrpc
http4k-metrics-micrometer	http4k-ops-micrometer
http4k-opentelemetry	http4k-ops-opentelemetry
http4k-resilience4j	http4k-ops-resilience4j

5.39.0.0

Changelog:

• http4k-* : Upgrade some dependency versions.
• http4k-amazon-*-fake : [Unlikely break] Rename AmazonRestfulFake to AmazonRestJsonFake
• http4k-amazon-evidently-fake : Fixed Project status value to be a valid value instead of an empty string

5.38.0.0

Changelog:

• http4k-* : Upgrade some dependency versions.

... (truncated)

Changelog

Sourced from org.http4k:http4k-core's changelog.

v5.41.0.0

• http4k-format-xml : [Fix CVE-2024-55875: Possible Break] Fixed XML processing by disabling entity expansion in DocumentBuilderFactory configuration. Note: This change affects how XML entity references are handled. If your code relies on XML entity expansion (like replacing &entity; references with their defined content), it will need to be updated to provide the correct configuration when deserialising the XML body. Entity references will now remain as unexpanded text in the document.

Full details at: https://www.http4k.org/security/cve-2024-12345/

H/T to @@​JAckLosingHeart for the report.

v5.40.0.0

• http4k-core : Allow invalidation of cookie with a path. H/T @​ollieabbey
• http4k-core : Allow setting cookie value without quotes. H/T @​ollieabbey
• http4k-core : Fix cookie format for cookie with no attributes. H/T @​ollieabbey
• http4k-testing-webdriver : Remove usages of deprecated getAttribute API. Now use getDomAttribute instead.
• http4k-cloudnative : [Breaking] Deprecation of various functions and re-homing into http4k-platform-k8s module. Some classes and functions have been repackaged.
• http4k-* : [PRE RELEASE PREPARATION] As a part of the upcoming V6, several modules are being rehoused to new Maven coordinates within http4k Community edition (and retaining the Apache2 license). In preparation, we have introduced these modules to give users the time to migrate without taking on-board other breaking changes from v6 - essentially allowing the upgrade cycle to be:

1. Upgrade to latest v5 release. Deal with deprecations and module changes.
2. Upgrade to v6 when it is released. Deal with other breaking changes. We expect these to be mainly imports and will be detailed in the v6 release note when we have the chance. In the meantime, this is the list of modules that are being rehoused:

SOURCE MODULE - v5.X.X.X	DESTINATION MODULE(S) - v6.X.X.X
http4k-aws	http4k-platform-aws
http4k-azure	http4k-platform-azure
http4k-cloudevents	http4k-api-cloudevents
http4k-cloudnative	Split into http4k-config, http4k-platform-core, http4k-platform-k8s
http4k-contract	http4k-api-openapi
http4k-contract-jsonschema	http4k-api-jsonschema
http4k-contract-ui-redoc	http4k-api-ui-redoc
http4k-contract-ui-swagger	http4k-api-ui-swagger
http4k-failsafe	http4k-ops-failsafe
http4k-gcp	http4k-platform-gcp
http4k-graphql	http4k-api-graphql
http4k-htmx	http4k-web-htmx
http4k-jsonrpc	http4k-api-jsonrpc
http4k-metrics-micrometer	http4k-ops-micrometer
http4k-opentelemetry	http4k-ops-opentelemetry
http4k-resilience4j	http4k-ops-resilience4j

v5.39.0.0

• http4k-* : Upgrade some dependency versions.
• http4k-amazon-*-fake : [Unlikely break] Rename AmazonRestfulFake to AmazonRestJsonFake
• http4k-amazon-evidently-fake : Fixed Project status value to be a valid value instead of an empty string

v5.38.0.0

• http4k-* : Upgrade some dependency versions.
• http4k-core : [Unlikely break] Split of RequestWithRoute into Request and RoutedMessage
• http4k-realtime-core-* : Further rework on Sse and Ws to add functionalities missing (which are present in HTTP)

... (truncated)

Commits

• 42baae8 Release 5.41.0.0
• 013f82f Rename CVE test
• f7d01b2 Don't need Request class in AwsQueryAction
• 93dfe47 Adding some routers to queries
• 35297ad Merge commit from fork
• 25696df update docs
• ab005df update docs
• fe0d599 update docs
• 897271d Removed hardcoded version numbers
• 25616b5 Remove hardcoded version
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #1605.