# REST Assured 6.3.0 > Release notes for REST Assured 6.3.0. ## Highlights * **6.3.0 prepares for REST Assured 7.0.0.** REST Assured 7.0.0 removes Apache HttpClient 4 and Groovy from the default dependencies. It sends requests with the JDK’s own HTTP client, and GPath (`json-path` and `xml-path`) becomes a dependency that you add yourself. 6.3.0 adds a replacement for every API that 7.0.0 removes and deprecates the old ones, so you can move your code over while it still compiles and runs on 6.x. Code without deprecation warnings on 6.3.0 should need little more than a version change and a dependency in 7.0.0. Read [Preparing for REST Assured 7.0](/docs/upgrading/preparing-for-7-0/) for what to change. * A new `rest-assured-openrewrite` module with the [OpenRewrite](https://docs.openrewrite.org) recipe `io.restassured.MigrateRestAssured6Deprecations`, which moves most of your Java code to the replacements automatically. With Maven: ```bash mvn -U org.openrewrite.maven:rewrite-maven-plugin:run \ -Drewrite.recipeArtifactCoordinates=io.rest-assured:rest-assured-openrewrite:6.3.0 \ -Drewrite.activeRecipes=io.restassured.MigrateRestAssured6Deprecations ``` See [Preparing for REST Assured 7.0](/docs/upgrading/preparing-for-7-0/#let-openrewrite-do-it) for Gradle and for what the recipe doesn’t change. * New settings that don’t depend on HttpClient 4: * Timeouts and other HTTP settings in `HttpClientConfig`: `connectTimeout(Duration)`, `readTimeout(Duration)`, `connectionRequestTimeout(Duration)`, `keepResponseCookies(boolean)`, `cookieDatePatterns(String...)`, `expectContinue(boolean)` and `multipartMode(MultipartMode)`: ```java RestAssured.config = RestAssured.config().httpClient(httpClientConfig() .connectTimeout(Duration.ofSeconds(5)) .readTimeout(Duration.ofSeconds(10))); ``` * `SSLConfig.sslContext(SSLContext)` and `hostnameVerifier(HostnameVerifier)`, with the JDK’s `javax.net.ssl` types, and the same on `CertificateAuthSettings`. * `RedirectConfig.followRedirectsForAllMethods(true)` follows redirects of `POST`, `PUT`, `DELETE` and other requests too. Use it instead of installing HttpClient 4’s `LaxRedirectStrategy` through an `HttpClientFactory`. * `CookieFilter.getCookies()` and `addCookie(Cookie)`, instead of `getCookieStore()`. * `ContextAuthenticationScheme` and `AuthenticationContext` for custom authentication schemes, instead of `authenticate(HTTPBuilder)`: ```java ContextAuthenticationScheme apiKey = context -> context.header("X-Api-Key", "my-key"); ``` * The object mapper factories (`Jackson2ObjectMapperFactory`, `GsonObjectMapperFactory` and so on) and `NumberReturnType` are now also in `rest-assured-common`, in `io.restassured.common.mapper.factory` and `io.restassured.common.config`. The old types in `json-path` and `xml-path` extend the new ones, so existing code keeps working. * `json-path-gpath` and `xml-path-gpath` are published. They’re the 7.0.0 names of `json-path` and `xml-path`, and in 6.x they resolve to `json-path` and `xml-path`, so you can switch your build to the new names now. * Form authentication sends its extra requests (the CSRF token page, the follow-up of a 302 of the login page, and the login request) with the config and the proxy of your request. Before, only the static `RestAssured` settings applied to them, so for example `relaxedHTTPSValidation()`, a key store or a proxy set on the request was lost after the first request. It also no longer sends the login page cookies to another host when it follows a 302 of the login page (thanks to Obrams for the PR). * When an older `rest-assured-common` ends up on the classpath, for example one pinned by the Spring Boot 3 dependency management, REST Assured, `RestAssuredMockMvc` and `RestAssuredWebTestClient` now fail with an `IllegalStateException` that explains how to align the versions, instead of a `NoClassDefFoundError`. ## Preparing for 7.0.0 These APIs are deprecated in 6.3.0. The ones that expose HttpClient 4 or Jackson 1 are removed in 7.0.0, and the rest in 8.0.0: | Deprecated | Use instead | | ------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `HttpClientConfig.setParam(..)` and the other parameter methods | `connectTimeout(..)`, `readTimeout(..)`, `connectionRequestTimeout(..)`, `keepResponseCookies(..)`, `cookieDatePatterns(..)`, `expectContinue(..)`, `RedirectConfig` and a `User-Agent` header | | `HttpClientConfig.httpClientFactory(..)`, `HttpClientFactory` and `httpClientInstance()` | Nothing in 6.x. REST Assured 7.0.0 adds `customizeClient(..)` | | `HttpClientConfig.httpMultipartMode(..)` | `multipartMode(MultipartMode)` | | `SSLConfig.sslSocketFactory(..)` and `x509HostnameVerifier(..)`, and the same on `CertificateAuthSettings` and `CertAuthScheme` | `sslContext(..)` and `hostnameVerifier(..)` | | `CookieFilter.getCookieStore()` | `getCookies()` and `addCookie(..)` | | `AuthenticationScheme.authenticate(HTTPBuilder)` | `ContextAuthenticationScheme` | | `QueryableRequestSpecification.getHttpClient()` | Nothing | | The object mapper factories in `io.restassured.path.json.mapper.factory` and `io.restassured.path.xml.mapper.factory` | The same names in `io.restassured.common.mapper.factory` | | `JsonPathConfig.NumberReturnType` | `io.restassured.common.config.NumberReturnType` | | `jackson1ObjectMapperFactory(..)` and `JsonPath.using(Jackson1ObjectMapperFactory)` | Jackson 2 or 3 | [Preparing for REST Assured 7.0](/docs/upgrading/preparing-for-7-0/) has examples for each of these. ## Non-backward compatible changes * In Groovy 4 (but not Groovy 5), passing a closure directly to an object mapper factory setter, such as `objectMapperConfig().jackson2ObjectMapperFactory { type, charset -> new ObjectMapper() }`, now fails with “Ambiguous method overloading”, since the setters take both the old and the new factory type. Cast the closure to the factory type: ```groovy objectMapperConfig().jackson2ObjectMapperFactory({ type, charset -> new ObjectMapper() } as Jackson2ObjectMapperFactory) ``` * Passing `null` to `numberReturnType(..)`, `new JsonConfig(..)` or `new JsonPathConfig(..)` is now ambiguous and needs a cast, since they take both the old and the new `NumberReturnType`. ## Other changes `rest-assured-common` now has optional dependencies on the JSON and XML mappers its factories use. They are optional, so nothing new ends up on your classpath. See the [change log](https://raw.githubusercontent.com/rest-assured/rest-assured/master/changelog.txt) for all changes.