[dependabot]

Bumps io.rest-assured:rest-assured from 6.2.0 to 6.3.0.

Changelog

Sourced from io.rest-assured:rest-assured's changelog.

Changelog 6.3.0 (2026-10-23)

• Fix form authentication sending the request for the CSRF token page, the request that follows a 302 of the login page and the login request with the static RestAssured settings only, so a proxy, an SSL setting such as relaxedHTTPSValidation() or a keystore, or a config(..) set on the request (or in a request specification) wasn't used for them. They are now sent with the config and the proxy of the request, like the request for the login page already was (issue #1965) (#2010) (thanks to Obrams for PR)
• Fix form authentication sending the cookies set by the login page response to whatever host the 302 of a non-GET login page request pointed to. Like a browser, it only sends them when the redirect goes to the same host. The Location header is now also resolved against the URL of the login page, so a relative Location is followed on the host of the login page (issue #1965) (#2010) (thanks to Obrams for PR)
• Added SSLConfig.sslContext(SSLContext) and hostnameVerifier(HostnameVerifier), with getSSLContext() and getHostnameVerifier(), the same on CertificateAuthSettings, and the matching properties on CertAuthScheme. They take the JDK's javax.net.ssl types and replace sslSocketFactory(..), x509HostnameVerifier(..) and their getters, which take Apache HttpClient 4 types and are now deprecated, since HttpClient 4 types leave the API in REST Assured 7.0.0. Host names are still verified strictly by default when you set an SSLContext
• Added HttpClientConfig.connectTimeout(Duration), readTimeout(Duration), connectionRequestTimeout(Duration), keepResponseCookies(boolean), cookieDatePatterns(String...) and expectContinue(boolean), with getters, as replacements for the HttpClient 4 parameters http.connection.timeout, http.socket.timeout, http.conn-manager.timeout, http.protocol.cookie-policy, http.protocol.cookie-datepatterns and http.protocol.expect-continue. The parameter methods (the HttpClientConfig(Map) constructor, params(), setParam, withParams, setParams and addParams) are deprecated and will be removed in REST Assured 8.0.0
• Added RedirectConfig.followRedirectsForAllMethods(boolean) and followsRedirectsForAllMethods(). It follows redirects of POST, PUT, DELETE and other requests too. Use it instead of installing HttpClient 4's LaxRedirectStrategy through an HttpClientFactory
• Added REST Assured's own MultipartMode enum with HttpClientConfig.multipartMode(MultipartMode) and multipartMode(), replacing httpMultipartMode(HttpMultipartMode) and httpMultipartMode(), which are now deprecated
• Added CookieFilter.getCookies(), which returns the stored cookies as REST Assured Cookies, and CookieFilter.addCookie(Cookie), replacing getCookieStore(), which is now deprecated together with extractEffectiveUriFromContext(..)
• Deprecated HttpClientConfig.HttpClientFactory, httpClientFactory(..) and httpClientInstance(), and QueryableRequestSpecification.getHttpClient(), since HttpClient 4 types leave the API in REST Assured 7.0.0. REST Assured 7.0.0 adds customizeClient(..) to customize the HTTP client
• Added AuthenticationContext, AuthenticationScheme.authenticate(AuthenticationContext) and ContextAuthenticationScheme, so that a custom authentication scheme can set headers, answer Basic, Digest and NTLM challenges, sign with OAuth and use a client certificate without depending on HttpClient 4. Implement ContextAuthenticationScheme instead of AuthenticationScheme.authenticate(HTTPBuilder), which is now deprecated, since HTTPBuilder exposes HttpClient 4 and is removed in REST Assured 7.0.0
• Added the object mapper factory interfaces and their defaults (GsonObjectMapperFactory, Jackson2ObjectMapperFactory, Jackson3ObjectMapperFactory, JohnzonObjectMapperFactory, JsonbObjectMapperFactory, JAXBObjectMapperFactory and JakartaEEObjectMapperFactory, and DefaultGsonObjectMapperFactory and so on) to rest-assured-common in the package io.restassured.common.mapper.factory, and NumberReturnType to io.restassured.common.config. ObjectMapperConfig, JsonPathConfig, XmlPathConfig, JsonConfig, JsonPath.using(..) and XmlPath.using(..) accept them, and JsonConfig.DEFAULT_NUMBER_LENGTH_LIMIT is added. The old types in io.restassured.path.json.mapper.factory, io.restassured.path.xml.mapper.factory and JsonPathConfig.NumberReturnType are deprecated. The old factory types extend the new ones, so existing code keeps working. They're removed in REST Assured 8.0.0. Passing null to numberReturnType(..), new JsonConfig(..) or new JsonPathConfig(..) is now ambiguous and needs a cast
• Non-backward compatible change: in Groovy 4 (but not Groovy 5), passing a closure directly to a factory setter such as ObjectMapperConfig.jackson2ObjectMapperFactory { type, charset -> .. } now fails with "Ambiguous method overloading", since the setters take both the old and the new factory type. Cast the closure to the factory type, for example jackson2ObjectMapperFactory({ type, charset -> .. } as Jackson2ObjectMapperFactory)
• Deprecated the Jackson 1 object mapper factory setters (ObjectMapperConfig.jackson1ObjectMapperFactory(..), JsonPathConfig.jackson1ObjectMapperFactory(..) and JsonPath.using(Jackson1ObjectMapperFactory)), since Jackson 1 support is removed in REST Assured 7.0.0
• rest-assured-common now has optional dependencies on the JSON and XML mappers its factories use (Jackson 2 and 3, Gson, Johnzon, Yasson, JSON-B, JAXB and Jakarta XML Binding). They are optional, so nothing new ends up on your classpath
• REST Assured, RestAssuredMockMvc and RestAssuredWebTestClient now fail with an IllegalStateException that explains how to align the versions when an older rest-assured-common is on the classpath (for example one pinned by the Spring Boot 3 dependency management), instead of a NoClassDefFoundError
• Published json-path-gpath and xml-path-gpath, the REST Assured 7.0.0 names of json-path and xml-path. In 6.x they are relocation poms that resolve to json-path and xml-path at the same version, so you can switch your build to the new names before upgrading. They are also in rest-assured-bom
• Added the rest-assured-openrewrite module with the OpenRewrite recipe io.restassured.MigrateRestAssured6Deprecations, which moves Java code from the APIs deprecated in this version to their replacements: the object mapper factories and NumberReturnType in rest-assured-common, hostnameVerifier(..), multipartMode(..), and the HttpClientConfig settings that replace setParam(..) for the timeouts, the "ignoreCookies" and "default" cookie policies and expect-continue. It also marks subclasses of REST Assured's authentication schemes that only override authenticate(HTTPBuilder), which REST Assured 7.0.0 no longer calls. Run it with the rewrite-maven-plugin or the OpenRewrite Gradle plugin, with io.rest-assured:rest-assured-openrewrite as recipe dependency

Commits

• b2fa63a [maven-release-plugin] prepare release rest-assured-6.3.0
• 9bee82b [ci skip] Preparing changelog for release
• 6511a84 [ci skip] Updated changelog to reflect the latest changes
• d1266d6 Send the extra requests of form authentication with the config and proxy of t...
• 0639bb3 Stop PathParamITest from calling google.se (#1995)
• 5de3595 Stop SSLITest from calling duckduckgo.com (#2009)
• 9078ee0 Fix issues found in the review of the 6.3.0 changes (#2008)
• 91576d5 Compile with maven.compiler.release=17 and run CI on JDK 17, 21 and 25 (#2007)
• 6cc8d43 Add rest-assured-openrewrite with the MigrateRestAssured6Deprecations recipe ...
• d35f1ca Publish json-path-gpath and xml-path-gpath as relocation poms (#2005)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)