.github/workflows/codeql-analysis.yml

@@ -25,11 +25,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@v2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -40,4 +40,4 @@ jobs:
     - run: "mvn clean compile -Dmaven.test.skip=true -Dmaven.site.skip=true -Dmaven.javadoc.skip=true"
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@v2

.github/workflows/pipeline.yml

@@ -10,46 +10,21 @@ on:
     branches: [ master ]
 
 jobs:
-  # old-school build and jar method. No tests run or compiled.
-  build-1_6: 
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        # build for java 1.6, however don't run any tests
-        java: [ 1.6 ]
-    name: Java ${{ matrix.java }}
-    steps:
-      - uses: actions/checkout@v2
-      - name: Setup java
-        uses: actions/setup-java@v1
-        with:
-          java-version: ${{ matrix.java }}
-      - name: Compile Java ${{ matrix.java }}
-        run: |
-          mkdir -p target/classes
-          javac -d target/classes/ src/main/java/org/json/*.java
-      - name: Create java ${{ matrix.java }} JAR
-        run: |
-          jar cvf target/org.json.jar -C target/classes .
-      - name: Upload Java ${{ matrix.java }} JAR
-        uses: actions/upload-artifact@v1
-        with:
-          name: Java ${{ matrix.java }} JAR
-          path: target/org.json.jar
-
   build:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         # build against supported Java LTS versions:
-        java: [ 8, 11 ]
+        java: [ 8, 11, 17 ]
     name: Java ${{ matrix.java }}
     steps:
-      - uses: actions/checkout@v2
-      - name: Setup java
-        uses: actions/setup-java@v1
+      - uses: actions/checkout@v3
+      - name: Set up JDK ${{ matrix.java }}
+        uses: actions/setup-java@v3
         with:
+          distribution: 'temurin'
           java-version: ${{ matrix.java }}
+          cache: 'maven'
       - name: Compile Java ${{ matrix.java }}
         run: mvn clean compile -Dmaven.compiler.source=${{ matrix.java }} -Dmaven.compiler.target=${{ matrix.java }} -Dmaven.test.skip=true -Dmaven.site.skip=true -Dmaven.javadoc.skip=true
       - name: Run Tests ${{ matrix.java }}

CONTRIBUTING.md

@@ -1,8 +1,8 @@
 # Contribution Guidelines
 
-Feel free to work on any issue with a #hacktoberfest label.
+Feel free to work on any open issue, you don't need to ask permission first. This year, the hacktoberfest label will be added to any PR and associated issue during the month of October.
 
-If you discover an issue you would like to work on, you can add a new issue to the list. If it meets our criteria, a hacktoberfest label will be added.
+If you discover an issue you would like to work on, you can add a new issue to the list. If it meets our criteria, it will be available to work on (if not, it will be closed after review).
 
 # Who is allowed to submit pull requests for this project?
 

README.md

@@ -8,7 +8,7 @@ JSON in Java [package org.json]
 
 [![Maven Central](https://img.shields.io/maven-central/v/org.json/json.svg)](https://mvnrepository.com/artifact/org.json/json)
 
-**[Click here if you just want the latest release jar file.](https://search.maven.org/remotecontent?filepath=org/json/json/20230618/json-20230618.jar)**
+**[Click here if you just want the latest release jar file.](https://search.maven.org/remotecontent?filepath=org/json/json/20231013/json-20231013.jar)**
 
 
 # Overview

build.gradle

@@ -20,19 +20,19 @@ repositories {
 }
 
 dependencies {
-    testImplementation 'junit:junit:4.13.1'
+    testImplementation 'junit:junit:4.13.2'
     testImplementation 'com.jayway.jsonpath:json-path:2.1.0'
-    testImplementation 'org.mockito:mockito-core:1.9.5'
+    testImplementation 'org.mockito:mockito-core:4.2.0'
 }
 
 subprojects {
     tasks.withType(Javadoc).all { enabled = false }
 }
 
 group = 'org.json'
-version = 'v20211205-SNAPSHOT'
+version = 'v20230618-SNAPSHOT'
 description = 'JSON in Java'
-sourceCompatibility = '1.7'
+sourceCompatibility = '1.8'
 
 configurations.all {
 }

docs/RELEASES.md

@@ -5,6 +5,8 @@ and artifactId "json". For example:
 [https://search.maven.org/search?q=g:org.json%20AND%20a:json&core=gav](https://search.maven.org/search?q=g:org.json%20AND%20a:json&core=gav)
 
 ~~~
+20231013    First release with minimum Java version 1.8. Recent commits, including fixes for CVE-2023-5072.
+
 20230618    Final release with Java 1.6 compatibility. Future releases will require Java 1.8 or greater.
 
 20230227    Fix for CVE-2022-45688 and recent commits

pom.xml

@@ -3,7 +3,7 @@
 
     <groupId>org.json</groupId>
     <artifactId>json</artifactId>
-    <version>20230618</version>
+    <version>20231013</version>
     <packaging>bundle</packaging>
 
     <name>JSON in Java</name>
@@ -15,7 +15,7 @@
         It also includes the capability to convert between JSON and XML, HTTP
         headers, Cookies, and CDL.
 
-        This is a reference implementation. There is a large number of JSON packages
+        This is a reference implementation. There are a large number of JSON packages
         in Java. Perhaps someday the Java community will standardize on one. Until
         then, choose carefully.
     </description>
@@ -57,7 +57,7 @@
         <dependency>
             <groupId>junit</groupId>
             <artifactId>junit</artifactId>
-            <version>4.13.1</version>
+            <version>4.13.2</version>
             <scope>test</scope>
         </dependency>
         <dependency>
@@ -69,7 +69,7 @@
         <dependency>
             <groupId>org.mockito</groupId>
             <artifactId>mockito-core</artifactId>
-            <version>1.9.5</version>
+            <version>4.2.0</version>
             <scope>test</scope>
         </dependency>
     </dependencies>
@@ -79,7 +79,7 @@
             <plugin>
                 <groupId>org.apache.felix</groupId>
                 <artifactId>maven-bundle-plugin</artifactId>
-                <version>3.0.1</version>
+                <version>5.1.9</version>
                 <extensions>true</extensions>
                 <configuration>
                     <instructions>
@@ -93,16 +93,16 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
-                <version>2.3.2</version>
+                <version>3.11.0</version>
                 <configuration>
-                    <source>1.6</source>
-                    <target>1.6</target>
+                    <source>1.8</source>
+                    <target>1.8</target>
                 </configuration>
             </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-source-plugin</artifactId>
-                <version>2.1.2</version>
+                <version>3.3.0</version>
                 <executions>
                     <execution>
                         <id>attach-sources</id>
@@ -115,7 +115,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-javadoc-plugin</artifactId>
-                <version>2.7</version>
+                <version>3.5.0</version>
                 <executions>
                     <execution>
                         <id>attach-javadocs</id>
@@ -131,7 +131,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-gpg-plugin</artifactId>
-                <version>1.5</version>
+                <version>1.6</version>
                 <executions>
                     <execution>
                         <id>sign-artifacts</id>
@@ -162,7 +162,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-jar-plugin</artifactId>
-                <version>3.2.0</version>
+                <version>3.3.0</version>
                 <configuration>
                     <archive>
                         <manifestEntries>