build(deps): bump org.jasig.portal:uPortal-soffit-renderer from 5.13.1 to 5.17.9

[dependabot]

Bumps org.jasig.portal:uPortal-soffit-renderer from 5.13.1 to 5.17.9.

Release notes

Sourced from org.jasig.portal:uPortal-soffit-renderer's releases.

uPortal v5.17.9

Patch release on top of v5.17.8. Removes two out-of-support / vulnerability-prone transitive dependencies (log4j-core and AWS SDK v1), fixes JGroups discovery-table growth and a LESS skin path bug, and adds a Gradle release-cut script.

Security

• Drop transitive log4j-core, bridge log4j2 to slf4j (#2999)

  grouperClient pulled org.apache.logging.log4j:log4j-core onto the runtime classpath transitively. uPortal logs through slf4j/logback, so log4j-core was unused and a standing CVE surface (the Log4Shell-family vulnerabilities all live in log4j-core). Excludes log4j-core globally and adds the log4j-to-slf4j bridge so any log4j2 API calls (e.g. from grouperClient) still route to slf4j.

• Migrate dynamic-skin S3 storage to AWS SDK v2 (#3000)

  The dynamic-skin S3 storage backend used AWS SDK v1 (com.amazonaws:aws-java-sdk-s3), which AWS has placed out of security support. Migrates to software.amazon.awssdk:s3 2.46.7 (v2 builder API, headObject existence check, try-with-resources client) with no change to stored object layout or returned URLs.

Fixes

• Clear JDBC_PING table on view change (#3001)

  The JGroups JDBC_PING discovery table accumulated stale rows: a node terminated abruptly (e.g. kill -9) never deregistered, so its row lingered across restarts. Sets clear_table_on_view_change="true" so the coordinator wipes the table on each view change and live members re-register.

• Use @import (inline) for bootstrap.css in common.less (#2997)

  LESS treats @import "x.css" as a passthrough, emitting a literal CSS @import whose relative path resolves incorrectly at runtime (404). The (inline) keyword embeds the file at compile time, where the path resolves. Affects skins still on the LESS compilation path.

Tooling

• Add release-uportal.sh (#2986)

  A Gradle release preflight + cut script at the repo root, mirroring the Maven ecosystem release process: tree/upstream sync checks, signing-key + keyserver verification, license-header scan, non-interactive version flags, and the post-release upstream tag push.

Docs

• Trim AGENTS.md under 200 lines (#2993)

Upgrade notes

• Drop-in for deployers on uPortal-start ≤ 5.17.8. No required action for the common case.
• log4j2: if your deployment relied on log4j-core being on the classpath (e.g. a custom log4j2 appender config), note that log4j-core is now excluded; log4j2 API calls are routed to slf4j/logback via the bridge.
• Dynamic-skin S3 backend (opt-in; off by default): AWS SDK v2 resolves the region strictly via the default provider chain (AWS_REGION / profile / instance metadata) and fails fast if none is set, whereas v1 sometimes defaulted to us-east-1. Deployers who enabled the S3 skin storage backend should set a region explicitly. Deployers on the default filesystem skin storage are unaffected.

uPortal v5.17.8

Patch release on top of v5.17.7, completing uPortal core's side of the resource-server consolidation. Swaps every internal /ResourceServingWebapp/ reference in skin descriptors, admin JSPs, and chrome assets onto /resource-server/, and trims a set of 2008–2015 utility-lib webjar dependencies that are either CVE-prone or native-replaceable on modern browsers.

Refactor

• Consolidate skin + JSP onto /resource-server/ (#2983)

  Moves uPortal core's skin descriptors, admin JSPs, and chrome-asset references off the legacy /ResourceServingWebapp/ context onto /resource-server/. Drops a bundle of 2008–2015 utility libraries (lodash 4.17.4, modernizr 2.6.2, normalize.css 2.1.2, four polyfill webjars) that were either CVE-prone, native-replaceable on modern browsers, or both. Also removes dead <rs:compressJs> taglib wrappers (already a no-op upstream now that minification has moved to esbuild).

  Two commits land together: the main consolidation (~30 files: JSP cleanup, SCSS path swaps, tango/famfamfam icon URL swaps, dead webjar deps removed) and a finishing touch in respondr/common/common_skin.xml for the three resource="true" entries (underscore, backbone, jquery-plugins/rating) that the first pass missed. All three libs are served at byte-identical relative paths under the modern overlay.

... (truncated)

Changelog

Sourced from org.jasig.portal:uPortal-soffit-renderer's changelog.

Next Release

v5.17.3

• substantial frontend modernization landed in #2915: Bootstrap 3 → 5, jQuery upgraded, LESS → SCSS, and Fluid Infusion removed from the respondr skin. Customized skins will need updating — review your overrides under uPortal-webapp/src/main/webapp/media/skins/ for .less files (now .scss), Bootstrap 3/4 class names, and any direct uses of the Fluid library.

v5.17.2

• Java 11 is now the minimum required version. sourceCompatibility was bumped from 1.8 to 11 in build.gradle. Deployers running Java 8 must upgrade their JVM before deploying this release. The bump was driven by a CVE fix in a transitive dependency that required Java 11; uPortal-start's Tomcat runtime should already be on Java 11.

v5.15.2

• new external storage option (Redis) for sessions; see README.md under new uPortal-session submodule

v5.15.0

• new cache, org.apereo.portal.i18n.RDBMLocaleStore.userLocales in ehcache.xml/ehcache-no-jgroups.xml

       <!--
       | Caches Window State Collection -
       | - Many-to-One join of StyleSheet and Window State
       | - not replicated - represents local file system data
       +-->
      <cache name="org.apereo.portal.portlet.registry.PersistentPortletEntityWrapper.windowStates"
          eternal="false" maxElementsInMemory="50" overflowToDisk="false" diskPersistent="false"
          timeToIdleSeconds="0" timeToLiveSeconds="1800" memoryStoreEvictionPolicy="LRU" statistics="true" />
  &lt;!--
   | Caches search results from findParentGroups() in RDBMEntityGroupStore.
   | - 1 x search criteria
   +--&gt;
  &lt;cache name=&quot;org.apereo.portal.groups.RDBMEntityGroupStore.parentGroupEntity&quot;
      eternal=&quot;false&quot; maxElementsInMemory=&quot;500&quot; overflowToDisk=&quot;false&quot; diskPersistent=&quot;false&quot;
      timeToIdleSeconds=&quot;0&quot; timeToLiveSeconds=&quot;300&quot; memoryStoreEvictionPolicy=&quot;LRU&quot; statistics=&quot;true&quot; &gt;
      &lt;cacheEventListenerFactory class=&quot;org.apereo.portal.utils.cache.SpringCacheEventListenerFactory&quot; properties=&quot;beanName=insufficientSizeCacheEventListener&quot; listenFor=&quot;local&quot; /&gt;
  &lt;/cache&gt;
  &lt;!--
  | Caches search results from findParentGroups() in RDBMEntityGroupStore.
  

... (truncated)

Commits

• b44ad0f [Gradle Release Plugin] - pre tag commit: 'v5.17.9'.
• 30bab65 Merge pull request #3001 from bjagg/fix/jgroups-clear-table-on-view-change
• f97fc63 Merge pull request #3000 from bjagg/chore/aws-sdk-v2-dynamicskin
• 2c0aa69 Merge pull request #2986 from bjagg/chore/add-release-script
• 3d40326 Merge pull request #2999 from bjagg/fix/grouper-log4j2-removal
• d26567e fix(jgroups): clear JDBC_PING table on view change
• 3521972 build(deps): migrate dynamic-skin S3 storage to AWS SDK v2
• 854739d fix(deps): drop transitive log4j-core, bridge log4j2 to slf4j
• 781c906 Merge pull request #2997 from Naenyn/less_relative_path_fix
• 241f42f Merge pull request #2993 from bjagg/docs/trim-agents-md
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
org.jasig.portal:uPortal-soffit-renderer	[>= 5.16.a, < 5.17]
org.jasig.portal:uPortal-soffit-renderer	[>= 5.15.a, < 5.16]

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.