Release 2.4.1

Changes:

- Added explicit version constraint on `jackson-bom`.

Fixes:

- Fixed incompatibility with Jackson version 2.15.0-rc1 and later.
- Fixed linking issue when running in Java 8.

.github/workflows/build.yml

@@ -8,6 +8,9 @@ on:
   pull_request:
     branches-ignore:
       - 'tmp**'
+  schedule:
+    # Run once a week to check compatibility with new versions of dependencies
+    - cron: '0 0 * * 1'
 
 jobs:
   test:
@@ -32,14 +35,26 @@ jobs:
     - name: Check out code
       uses: actions/checkout@v3
 
-    - name: Set up JDK
+    - name: Set up JDK 17
+      uses: actions/setup-java@v3
+      with:
+        java-version: 17
+        distribution: ${{ matrix.distribution }}
+
+    - name: Compile libraries and tests
+      run: ./gradlew clean testClasses
+
+    - name: Build archives
+      run: ./gradlew assemble
+
+    - name: Set up JDK ${{ matrix.java }}
       uses: actions/setup-java@v3
       with:
         java-version: ${{ matrix.java }}
         distribution: ${{ matrix.distribution }}
 
-    - name: Run tests
-      run: ./gradlew cleanTest test
+    - name: Run tests against JDK17-compiled code
+      run: ./gradlew test --exclude-task compileJava
 
     - name: Archive HTML test report
       if: ${{ always() }}
@@ -55,8 +70,12 @@ jobs:
         name: test-reports-java${{ matrix.java }}-${{ matrix.distribution }}-xml
         path: "*/build/test-results/**/*.xml"
 
-    - name: Build JavaDoc
-      run: ./gradlew assembleJavadoc
+    - name: Check binary reproducibility
+      run: |
+        ./gradlew clean primaryPublishJar
+        find . -name '*.jar' | xargs sha256sum | tee checksums.sha256sum
+        ./gradlew clean primaryPublishJar && sha256sum -c checksums.sha256sum
+        ./gradlew clean primaryPublishJar && sha256sum -c checksums.sha256sum
 
   publish-test-results:
     name: Publish test results

.github/workflows/release-verify-signatures.yml

@@ -59,6 +59,14 @@ jobs:
         java --version
         ./gradlew jar
 
+    - name: Print checksums
+      run: |
+        for sumprog in md5sum sha1sum sha256sum; do
+          echo $sumprog
+          $sumprog webauthn-server-attestation/build/libs/webauthn-server-attestation-${{ github.ref_name }}.jar
+          $sumprog webauthn-server-core/build/libs/webauthn-server-core-${{ github.ref_name }}.jar
+        done
+
     - name: Retrieve keyring and signatures
       uses: actions/download-artifact@v3
       with:

NEWS

@@ -1,3 +1,15 @@
+== Version 2.4.1 ==
+
+Changes:
+
+* Added explicit version constraint on `jackson-bom`.
+
+Fixes:
+
+* Fixed incompatibility with Jackson version 2.15.0-rc1 and later.
+* Fixed linking issue when running in Java 8.
+
+
 == Version 2.4.0 ==
 
 `webauthn-server-core`: