Merge branch 'main' into fix/deprecate-disable-transactions

Author: curfew-marathon

.github/workflows/main.yaml

@@ -154,4 +154,4 @@ jobs:
     needs: [publish-maven-central, publish-github-packages]
     permissions:
       contents: write
-    uses: openfga/.github/.github/workflows/undraft-release.yml@main
+    uses: openfga/.github/.github/workflows/undraft-release.yml@835baf31562809ad9eb884c73efc5b79318f700f # pin@main

.github/workflows/pr-title-check.yml

@@ -13,5 +13,5 @@ jobs:
   pr-title-check:
     permissions:
       pull-requests: read
-    uses: openfga/.github/.github/workflows/pr-title-check.yml@main
+    uses: openfga/.github/.github/workflows/pr-title-check.yml@835baf31562809ad9eb884c73efc5b79318f700f # pin@main
 

.github/workflows/release-please.yml

@@ -36,7 +36,7 @@ jobs:
     if: |
       github.event_name == 'workflow_dispatch' ||
       startsWith(github.event.head_commit.message, 'release:')
-    uses: openfga/.github/.github/workflows/release-please.yml@main
+    uses: openfga/.github/.github/workflows/release-please.yml@835baf31562809ad9eb884c73efc5b79318f700f # pin@main
     with:
       trigger-event:   ${{ github.event_name }}
       bump-type:       ${{ inputs.bump-type || 'auto' }}

build.gradle

@@ -58,6 +58,14 @@ ext {
     jackson_version = "2.22.0"
 }
 
+configurations.testRuntimeClasspath {
+    // handlebars 4.3.1 (pulled in by wiremock) has a path traversal CVE fixed in 4.5.2.
+    // WireMock 3.x hasn't backported the fix — only the 4.x beta line has.
+    // We force the core jar only; handlebars-helpers cannot be forced to 4.5.2 because
+    // NumberHelper moved packages between versions, which breaks WireMock at runtime.
+    resolutionStrategy.force 'com.github.jknack:handlebars:4.5.2'
+}
+
 dependencies {
     implementation "com.google.code.findbugs:jsr305:3.0.2"