REST Assured 6.3.0

Highlights

6.3.0 prepares for REST Assured 7.0.0. REST Assured 7.0.0 removes Apache HttpClient 4 and Groovy from the default dependencies. It sends requests with the JDK’s own HTTP client, and GPath (json-path and xml-path) becomes a dependency that you add yourself. 6.3.0 adds a replacement for every API that 7.0.0 removes and deprecates the old ones, so you can move your code over while it still compiles and runs on 6.x. Code without deprecation warnings on 6.3.0 should need little more than a version change and a dependency in 7.0.0. Read Preparing for REST Assured 7.0 for what to change.
A new rest-assured-openrewrite module with the OpenRewrite recipe io.restassured.MigrateRestAssured6Deprecations, which moves most of your Java code to the replacements automatically. With Maven:
Terminal window
```
mvn -U org.openrewrite.maven:rewrite-maven-plugin:run \
  -Drewrite.recipeArtifactCoordinates=io.rest-assured:rest-assured-openrewrite:6.3.0 \
  -Drewrite.activeRecipes=io.restassured.MigrateRestAssured6Deprecations
```
See Preparing for REST Assured 7.0 for Gradle and for what the recipe doesn’t change.
New settings that don’t depend on HttpClient 4:
- Timeouts and other HTTP settings in HttpClientConfig: connectTimeout(Duration), readTimeout(Duration), connectionRequestTimeout(Duration), keepResponseCookies(boolean), cookieDatePatterns(String...), expectContinue(boolean) and multipartMode(MultipartMode):
```
RestAssured.config = RestAssured.config().httpClient(httpClientConfig()
        .connectTimeout(Duration.ofSeconds(5))
        .readTimeout(Duration.ofSeconds(10)));
```
- SSLConfig.sslContext(SSLContext) and hostnameVerifier(HostnameVerifier), with the JDK’s javax.net.ssl types, and the same on CertificateAuthSettings.
- RedirectConfig.followRedirectsForAllMethods(true) follows redirects of POST, PUT, DELETE and other requests too. Use it instead of installing HttpClient 4’s LaxRedirectStrategy through an HttpClientFactory.
- CookieFilter.getCookies() and addCookie(Cookie), instead of getCookieStore().
- ContextAuthenticationScheme and AuthenticationContext for custom authentication schemes, instead of authenticate(HTTPBuilder):
```
ContextAuthenticationScheme apiKey = context -> context.header("X-Api-Key", "my-key");
```
The object mapper factories (Jackson2ObjectMapperFactory, GsonObjectMapperFactory and so on) and NumberReturnType are now also in rest-assured-common, in io.restassured.common.mapper.factory and io.restassured.common.config. The old types in json-path and xml-path extend the new ones, so existing code keeps working.
json-path-gpath and xml-path-gpath are published. They’re the 7.0.0 names of json-path and xml-path, and in 6.x they resolve to json-path and xml-path, so you can switch your build to the new names now.
Form authentication sends its extra requests (the CSRF token page, the follow-up of a 302 of the login page, and the login request) with the config and the proxy of your request. Before, only the static RestAssured settings applied to them, so for example relaxedHTTPSValidation(), a key store or a proxy set on the request was lost after the first request. It also no longer sends the login page cookies to another host when it follows a 302 of the login page (thanks to Obrams for the PR).
When an older rest-assured-common ends up on the classpath, for example one pinned by the Spring Boot 3 dependency management, REST Assured, RestAssuredMockMvc and RestAssuredWebTestClient now fail with an IllegalStateException that explains how to align the versions, instead of a NoClassDefFoundError.

Preparing for 7.0.0

These APIs are deprecated in 6.3.0. The ones that expose HttpClient 4 or Jackson 1 are removed in 7.0.0, and the rest in 8.0.0:

Deprecated	Use instead
`HttpClientConfig.setParam(..)` and the other parameter methods	`connectTimeout(..)`, `readTimeout(..)`, `connectionRequestTimeout(..)`, `keepResponseCookies(..)`, `cookieDatePatterns(..)`, `expectContinue(..)`, `RedirectConfig` and a `User-Agent` header
`HttpClientConfig.httpClientFactory(..)`, `HttpClientFactory` and `httpClientInstance()`	Nothing in 6.x. REST Assured 7.0.0 adds `customizeClient(..)`
`HttpClientConfig.httpMultipartMode(..)`	`multipartMode(MultipartMode)`
`SSLConfig.sslSocketFactory(..)` and `x509HostnameVerifier(..)`, and the same on `CertificateAuthSettings` and `CertAuthScheme`	`sslContext(..)` and `hostnameVerifier(..)`
`CookieFilter.getCookieStore()`	`getCookies()` and `addCookie(..)`
`AuthenticationScheme.authenticate(HTTPBuilder)`	`ContextAuthenticationScheme`
`QueryableRequestSpecification.getHttpClient()`	Nothing
The object mapper factories in `io.restassured.path.json.mapper.factory` and `io.restassured.path.xml.mapper.factory`	The same names in `io.restassured.common.mapper.factory`
`JsonPathConfig.NumberReturnType`	`io.restassured.common.config.NumberReturnType`
`jackson1ObjectMapperFactory(..)` and `JsonPath.using(Jackson1ObjectMapperFactory)`	Jackson 2 or 3

Preparing for REST Assured 7.0 has examples for each of these.

Non-backward compatible changes

In Groovy 4 (but not Groovy 5), passing a closure directly to an object mapper factory setter, such as objectMapperConfig().jackson2ObjectMapperFactory { type, charset -> new ObjectMapper() }, now fails with “Ambiguous method overloading”, since the setters take both the old and the new factory type. Cast the closure to the factory type:
```
objectMapperConfig().jackson2ObjectMapperFactory({ type, charset -> new ObjectMapper() } as Jackson2ObjectMapperFactory)
```
Passing null to numberReturnType(..), new JsonConfig(..) or new JsonPathConfig(..) is now ambiguous and needs a cast, since they take both the old and the new NumberReturnType.

Other changes

rest-assured-common now has optional dependencies on the JSON and XML mappers its factories use. They are optional, so nothing new ends up on your classpath.

See the change log for all changes.