build(deps): update test JSONPath to 2.10.0

[jbeckwith-oai]

Summary

• constrain test-only JSONPath from 2.7.0 to 2.10.0 in the WireMock graphs for openai-java-core and openai-java-client-okhttp, and the Spring Boot starter test graph
• remediate Dependabot alert 28 (GHSA-pfh2-hfmq-phg5 / CVE-2023-51074)
• move those graphs from vulnerable json-smart 2.4.7/2.4.8 to 2.6.0, addressing their Dependabot alert 10 paths
• leave WireMock 2.35.2, Spring Boot 2.7.18, and the Jackson 2.14.0 compatibility floor unchanged

JSONPath 2.10.0 is the latest stable release on the Java 8-compatible 2.x line; JSONPath 3.0.0 requires Java 17. Both JSONPath 2.10.0 and its json-smart 2.6.0 dependency have Java 8 classfile level 52.

Alert #37's separate json-smart 2.5.1 path comes from Azure Identity in the example module, not JSONPath. It is outside this PR's scope and is already addressed by #779.

Downstream compatibility

This is limited to testImplementation constraints. Generated Maven POMs and Gradle module metadata for all three affected published modules contain neither JSONPath nor json-smart. There are no production source, bytecode, public API, runtime dependency, Java baseline, or release-version changes for SDK consumers.

A japicmp comparison of JSONPath 2.7.0 and 2.10.0 found no public binary or source incompatibilities. The reported changes are additions and a visibility widening.

Validation

• dependency insight for core, okhttp, Spring Boot starter, and core's published-Jackson runtime resolves JSONPath to 2.10.0's Java 8 variant
• all affected runtime graphs resolve json-smart and accessors-smart to 2.6.0
• WireMock's matchingJsonPath integration passes under Jackson 2.14.0 and 2.18.9
• focused okhttp and Spring Boot starter tests pass
• all repository test tasks, ProGuard/R8 checks, testJacksonPublished, and the published-Jackson WireMock check pass (external generated-API mock-server tests skipped locally)
• ./scripts/build --no-configuration-cache
• ./scripts/lint
• ./scripts/detect-breaking-changes origin/main
• generated Maven POM and Gradle module metadata inspection for all three affected modules
• all-resolvable-configuration scan for remaining JSONPath/json-smart versions
• Java 8 classfile inspection for JSONPath and json-smart

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 16.811s for Java SDK PR #790.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	311ms
tests/chat-completions-create.test.ts	✅ Passed	828ms
tests/chat-completions-stream.test.ts	✅ Passed	418ms
tests/files-content-binary.test.ts	✅ Passed	204ms
tests/files-create-multipart.test.ts	✅ Passed	247ms
tests/files-list-pagination.test.ts	✅ Passed	245ms
tests/initialize-config.test.ts	✅ Passed	264ms
tests/instance-isolation.test.ts	✅ Passed	252ms
tests/models-list.test.ts	✅ Passed	193ms
tests/responses-background-lifecycle.test.ts	✅ Passed	309ms
tests/responses-body-method-errors.test.ts	✅ Passed	440ms
tests/responses-cancel-timeout.test.ts	✅ Passed	199ms
tests/responses-cancel.test.ts	✅ Passed	273ms
tests/responses-compact-retries.test.ts	✅ Passed	504ms
tests/responses-compact.test.ts	✅ Passed	298ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	409ms
tests/responses-create-advanced.test.ts	✅ Passed	1.536s
tests/responses-create-disconnect.test.ts	✅ Passed	1.078s
tests/responses-create-errors.test.ts	✅ Passed	416ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	287ms
tests/responses-create-retries.test.ts	✅ Passed	258ms
tests/responses-create-stream-failures.test.ts	✅ Passed	179ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	292ms
tests/responses-create-stream-wire.test.ts	✅ Passed	6.313s
tests/responses-create-stream.test.ts	✅ Passed	616ms
tests/responses-create-terminal-states.test.ts	✅ Passed	379ms
tests/responses-create-timeout.test.ts	✅ Passed	207ms
tests/responses-create.test.ts	✅ Passed	847ms
tests/responses-delete.test.ts	✅ Passed	279ms
tests/responses-input-items-errors.test.ts	✅ Passed	329ms
tests/responses-input-items-list.test.ts	✅ Passed	348ms
tests/responses-input-items-options.test.ts	✅ Passed	439ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	294ms
tests/responses-input-tokens-count.test.ts	✅ Passed	332ms
tests/responses-malformed-inputs.test.ts	✅ Passed	4.998s
tests/responses-not-found-errors.test.ts	✅ Passed	380ms
tests/responses-parse.test.ts	✅ Passed	612ms
tests/responses-retrieve-retries.test.ts	✅ Passed	482ms
tests/responses-retrieve.test.ts	✅ Passed	499ms
tests/responses-stored-method-errors.test.ts	✅ Passed	1.044s
tests/retry-behavior.test.ts	✅ Passed	3.282s
tests/sdk-error-shape.test.ts	✅ Passed	451ms

View OkTest run #29598539228

_{SDK merge (0576854673bf) · head (7369cf469730) · base (f50d19be803f) · OkTest (fd7a761c81c1)}

[HAYDEN-OAI]

looks good, nice focused fix!

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b9154dc44e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[HAYDEN-OAI]

thanks for keeping this focused. i found one test-graph compatibility issue before approving: json-path 2.10.0 brings slf4j-api 2.0.17, while Spring Boot 2.7.18 uses Logback 1.2 and SLF4J 1.7. Gradle resolves the higher SLF4J version, so a test that starts SpringApplication or uses @SpringBootTest can get the NOP factory and fail logging initialization. could you exclude that transitive dependency or strictly constrain this test configuration to SLF4J 1.7.x? happy to recheck once that is in.

[HAYDEN-OAI]

looks good, thanks! the current head fixes the earlier slf4j compatibility issue with a strict 1.7.36 test constraint and a focused startup regression test.

[HAYDEN-OAI]

looks good, thanks for keeping this focused!