build(deps): bump org.jasig.portal:uPortal-soffit-renderer from 5.13.1 to 5.17.3

[dependabot]

Bumps org.jasig.portal:uPortal-soffit-renderer from 5.13.1 to 5.17.3.

Release notes

Sourced from org.jasig.portal:uPortal-soffit-renderer's releases.

v5.17.3

uPortal 5.17.3

This is a maintenance release of uPortal. The headline change is a substantial frontend modernization that's been in flight for a long time finally landing — Bootstrap 3 → 5, jQuery 4, LESS → SCSS, and removal of Fluid Infusion across the respondr skin. The release also folds in security updates (commons-lang3, commons-beanutils, guava, hsqldb), refactor work on the LimitingTee output stream, and the routine Renovate dependency-hygiene cycle.

Thanks to @​Naenyn (Bill Smith) for owning the frontend modernization end-to-end, and to all the contributors who made this release possible — including the Renovate and Dependabot bots whose dep-hygiene PRs accumulated to a meaningful chunk of the changeset.

Changes Affecting Deployments

• Frontend modernization in #2915: Bootstrap upgraded from 3 → 5, jQuery upgraded to 4, LESS migrated to SCSS, and Fluid Infusion removed from the respondr skin. Customized skins will need updating. Review your overrides under uPortal-webapp/src/main/webapp/media/skins/ for:
  • .less files (now .scss)
  • Bootstrap 3/4 class names (replaced by their BS5 equivalents)
  • Any direct uses of the Fluid library (replaced with vanilla JS components for layout preferences, tab manager, group admin, entity selector, permissions, customize/gallery, and flyout)

Features / Refactors

• Frontend modernization (#2915) — see Changes Affecting Deployments above.
• Refactor LimitingTee callbacks from Function<T,?> to Consumer<T> (#2945) and silence the corresponding ErrorProne CheckReturnValue (#2943).
• Pin Spring/Hibernate majors in the Renovate config (#2948) so major-bump PRs that won't be merged stop being proposed.

Fixes

• Exclude Spring from resource-server-utils transitive deps to avoid version pinning conflicts (#2944).
• Fix off-by-21 in LimitingTeeOutputStreamTest (latent bug surfaced by the commons-io 2.22 bounds tightening, folded into #2964).
• Pin commons-compress in the uPortal-webapp buildscript classpath to avoid a commons-lang3 split between Gradle's bundled version and the version transitively pulled in via resource-server (folded into #2964).

Documentation

• Align AGENTS.md with the project's actual Java 11 baseline, replacing inaccurate "ban Java 9+" wording (#2947).

Security Updates

• org.hsqldb:hsqldb → 2.7.1 (#2671) and 2.7.4 (#2949)
• commons-beanutils:commons-beanutils → 1.11.0 (#2934)
• org.apache.commons:commons-lang3 → 3.18.0 (#2936) and 3.20.0 (#2951)
• com.google.guava:guava → v32 (#2939)

Other Dependency Updates

• org.jasig.resourceserver:resource-server → 1.5.3 (#2964)
• Routine Renovate / Dependabot updates: aws-java-sdk-s3, joda-time, ant, lombok, spotbugs, groovy, jackson, logback-classic, codenarc, prettier, errorprone plugin, immutable. PRs: #2946, #2952, #2953, #2954, #2955, #2956, #2957, #2958, #2959, #2960, #2962, #2963.

Full Changelog: uPortal-Project/uPortal@v5.17.2...v5.17.3

v5.17.2

What's Changed

Fixes

• fix: handle IllegalArgumentException for stale portlet URLs by @​bjagg in uPortal-Project/uPortal#2924
• fix(deps): correct jacksonVersion to 2.21.2 by @​bjagg in uPortal-Project/uPortal#2928

... (truncated)

Changelog

Sourced from org.jasig.portal:uPortal-soffit-renderer's changelog.

v5.17.3

• substantial frontend modernization landed in #2915: Bootstrap 3 → 5, jQuery upgraded, LESS → SCSS, and Fluid Infusion removed from the respondr skin. Customized skins will need updating — review your overrides under uPortal-webapp/src/main/webapp/media/skins/ for .less files (now .scss), Bootstrap 3/4 class names, and any direct uses of the Fluid library.

v5.17.2

• Java 11 is now the minimum required version. sourceCompatibility was bumped from 1.8 to 11 in build.gradle. Deployers running Java 8 must upgrade their JVM before deploying this release. The bump was driven by a CVE fix in a transitive dependency that required Java 11; uPortal-start's Tomcat runtime should already be on Java 11.

v5.15.2

• new external storage option (Redis) for sessions; see README.md under new uPortal-session submodule

v5.15.0

• new cache, org.apereo.portal.i18n.RDBMLocaleStore.userLocales in ehcache.xml/ehcache-no-jgroups.xml

       <!--
       | Caches Window State Collection -
       | - Many-to-One join of StyleSheet and Window State
       | - not replicated - represents local file system data
       +-->
      <cache name="org.apereo.portal.portlet.registry.PersistentPortletEntityWrapper.windowStates"
          eternal="false" maxElementsInMemory="50" overflowToDisk="false" diskPersistent="false"
          timeToIdleSeconds="0" timeToLiveSeconds="1800" memoryStoreEvictionPolicy="LRU" statistics="true" />
  &lt;!--
   | Caches search results from findParentGroups() in RDBMEntityGroupStore.
   | - 1 x search criteria
   +--&gt;
  &lt;cache name=&quot;org.apereo.portal.groups.RDBMEntityGroupStore.parentGroupEntity&quot;
      eternal=&quot;false&quot; maxElementsInMemory=&quot;500&quot; overflowToDisk=&quot;false&quot; diskPersistent=&quot;false&quot;
      timeToIdleSeconds=&quot;0&quot; timeToLiveSeconds=&quot;300&quot; memoryStoreEvictionPolicy=&quot;LRU&quot; statistics=&quot;true&quot; &gt;
      &lt;cacheEventListenerFactory class=&quot;org.apereo.portal.utils.cache.SpringCacheEventListenerFactory&quot; properties=&quot;beanName=insufficientSizeCacheEventListener&quot; listenFor=&quot;local&quot; /&gt;
  &lt;/cache&gt;
  &lt;!--
  | Caches search results from findParentGroups() in RDBMEntityGroupStore.
  | - 1 x search criteria
  +--&gt;
  

... (truncated)

Commits

• 1fe7cab [Gradle Release Plugin] - pre tag commit: 'v5.17.3'.
• 8fea974 chore: bump resourceServerVersion 1.5.2 → 1.5.3 (#2964)
• 8456c22 fix(deps): update dependency codenarc to v3.7.0-groovy-4.0 (#2963)
• 8b85796 fix(deps): update dependency ch.qos.logback:logback-classic to v1.5.32 (#2962)
• a7e3456 fix(deps): update dependency org.apache.ant:ant to v1.10.17 (#2954)
• a951c78 fix(deps): update jackson monorepo to v2.21.3 (#2960)
• d874304 chore(deps): update plugin net.ltgt.errorprone to v4.4.0 (#2959)
• 032c1fd chore(deps): update dependency prettier to ~3.8.0 (#2958)
• 48b03dd fix(deps): update groovy to v3.0.25 (#2957)
• f68ded2 fix(deps): update dependency spotbugs to v4.9.8 (#2956)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
org.jasig.portal:uPortal-soffit-renderer	[>= 5.16.a, < 5.17]
org.jasig.portal:uPortal-soffit-renderer	[>= 5.15.a, < 5.16]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)