updated to latest deps and cleaned lint warnings

Author: puredanger

.github/workflows/test.yml

@@ -11,7 +11,7 @@ jobs:
         clojure-version: ["1.10.3", "1.11.1"]
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Set up Java
       uses: actions/setup-java@v4
       with:

CHANGELOG.md

@@ -5,6 +5,8 @@ Changelog
 
 * next
   * TDEPS-259 Improve error reporting on deps.edn spec errors
+  * Use latest tools.deps.cli in root deps.edn
+  * Update deps to latest
 * 0.24.1523 on June 3, 2025
   * Update to latest tools.deps.cli
 * 0.24.1519 on June 3, 2025

deps.edn

@@ -1,6 +1,6 @@
 {:paths ["src/main/clojure" "src/main/resources"]
  :deps {
-   org.clojure/clojure {:mvn/version "1.12.0"}
+   org.clojure/clojure {:mvn/version "1.12.1"}
    org.apache.maven.resolver/maven-resolver-api {:mvn/version "1.8.2"}
    org.apache.maven.resolver/maven-resolver-spi {:mvn/version "1.8.2"}
    org.apache.maven.resolver/maven-resolver-impl {:mvn/version "1.8.2"}
@@ -14,23 +14,25 @@
    org.clojure/data.xml {:mvn/version "0.2.0-alpha9"}
    org.clojure/tools.gitlibs {:mvn/version "2.6.206"}
    org.clojure/tools.cli {:mvn/version "1.1.230"}
-   com.cognitect.aws/api {:mvn/version "0.8.723" :exclusions [org.eclipse.jetty/jetty-http org.eclipse.jetty/jetty-client org.eclipse.jetty/jetty-util]}  ;; override for CVEs
-     org.eclipse.jetty/jetty-http {:mvn/version "9.4.56.v20240826"}
-     org.eclipse.jetty/jetty-client {:mvn/version "9.4.56.v20240826"}
-     org.eclipse.jetty/jetty-util {:mvn/version "9.4.56.v20240826"}
-   com.cognitect.aws/endpoints {:mvn/version "871.2.29.39"}
-   com.cognitect.aws/s3 {:mvn/version "871.2.29.35"}
+   com.cognitect.aws/api {:mvn/version "0.8.762"}
+   ;; override jetty stuff under http-client for CVEs
+   com.cognitect/http-client {:mvn/version "1.0.127" :exclusions [org.eclipse.jetty/jetty-http org.eclipse.jetty/jetty-client org.eclipse.jetty/jetty-util]}
+     org.eclipse.jetty/jetty-http {:mvn/version "9.4.58.v20250814"}
+     org.eclipse.jetty/jetty-client {:mvn/version "9.4.58.v20250814"}
+     org.eclipse.jetty/jetty-util {:mvn/version "9.4.58.v20250814"}
+   com.cognitect.aws/endpoints {:mvn/version "871.2.32.21"}
+   com.cognitect.aws/s3 {:mvn/version "871.2.32.2"}
    javax.inject/javax.inject {:mvn/version "1"}
  }
  :aliases {
    :test {:extra-paths ["src/test/clojure"]}
 
    ;; clj -M:lint
-   :lint {:replace-deps {clj-kondo/clj-kondo {:mvn/version "2024.11.14"}}
+   :lint {:replace-deps {clj-kondo/clj-kondo {:mvn/version "2025.07.28"}}
           :main-opts ["-m" "clj-kondo.main" "--lint" "src/main/clojure" "--lint" "src/test/clojure"]}
 
    ;; clj -M:cve
-   :cve {:extra-deps {io.github.clj-holmes/clj-watson {:git/tag "v6.0.0" :git/sha "cb02879"}}
+   :cve {:extra-deps {io.github.clj-holmes/clj-watson {:git/tag "v6.0.1" :git/sha "b520351"}}
          :extra-paths [".clj-watson"]
          :jvm-opts ["--illegal-access=deny"]
          :main-opts ["-m" "clj-watson.cli" "scan" "-p" "deps.edn"]}

pom.xml

@@ -20,7 +20,7 @@
   <properties>
     <!-- used for build -->
     <clojure.warnOnReflection>true</clojure.warnOnReflection>
-    <clojure.version>1.12.0</clojure.version>
+    <clojure.version>1.12.1</clojure.version>
     <resolverVersion>1.8.2</resolverVersion>
     <mavenVersion>3.8.8</mavenVersion>
 
@@ -109,7 +109,12 @@
     <dependency>
       <groupId>com.cognitect.aws</groupId>
       <artifactId>api</artifactId>
-      <version>0.8.723</version>
+      <version>0.8.762</version>
+    </dependency>
+    <dependency>
+      <groupId>com.cognitect</groupId>
+      <artifactId>http-client</artifactId>
+      <version>1.0.127</version>
       <exclusions>
         <exclusion>
           <groupId>org.eclipse.jetty</groupId>
@@ -128,27 +133,27 @@
     <dependency> <!-- override for CVE fixes -->
       <groupId>org.eclipse.jetty</groupId>
       <artifactId>jetty-http</artifactId>
-      <version>9.4.56.v20240826</version>
+      <version>9.4.58.v20250814</version>
     </dependency>
     <dependency> <!-- override for CVE fixes -->
       <groupId>org.eclipse.jetty</groupId>
       <artifactId>jetty-client</artifactId>
-      <version>9.4.56.v20240826</version>
+      <version>9.4.58.v20250814</version>
     </dependency>
     <dependency> <!-- override for CVE fixes -->
       <groupId>org.eclipse.jetty</groupId>
       <artifactId>jetty-client</artifactId>
-      <version>9.4.56.v20240826</version>
+      <version>9.4.58.v20250814</version>
     </dependency>
     <dependency>
       <groupId>com.cognitect.aws</groupId>
       <artifactId>endpoints</artifactId>
-      <version>871.2.29.39</version>
+      <version>871.2.32.21</version>
     </dependency>
     <dependency>
       <groupId>com.cognitect.aws</groupId>
       <artifactId>s3</artifactId>
-      <version>871.2.29.35</version>
+      <version>871.2.32.2</version>
     </dependency>
     <dependency>
       <groupId>javax.inject</groupId>

src/main/clojure/clojure/tools/deps.clj

@@ -288,15 +288,15 @@
     (if (seq path)
       (let [lib (last path)
             check-path (vec (butlast path))
-            {:keys [paths select]} (get vmap lib)]
-        (let [paths-to-selected (get paths select)]
-          (if (contains? paths-to-selected check-path)
-            ;; add alternative paths to root that include the selected lib
-            (recur check-path (concat more-paths (remove #(= % check-path) paths-to-selected)))
-            (if (seq more-paths)
-              ;; consider alternative paths before considering lib to be omitted
-              (recur (first more-paths) (rest more-paths))
-              true))))
+            {:keys [paths select]} (get vmap lib)
+            paths-to-selected (get paths select)]
+        (if (contains? paths-to-selected check-path)
+          ;; add alternative paths to root that include the selected lib
+          (recur check-path (concat more-paths (remove #(= % check-path) paths-to-selected)))
+          (if (seq more-paths)
+            ;; consider alternative paths before considering lib to be omitted
+            (recur (first more-paths) (rest more-paths))
+            true)))
       false)))
 
 (defn- deselect-orphans

src/main/clojure/clojure/tools/deps/script/parse.clj

@@ -10,7 +10,6 @@
   clojure.tools.deps.script.parse
   (:require
     [clojure.java.io :as jio]
-    [clojure.string :as s]
     [clojure.string :as str]
     [clojure.edn :as edn]
     [clojure.tools.deps :as deps])
@@ -41,6 +40,6 @@
   [s]
   (#'deps/canonicalize-all-syms  ;; to be removed in the future
     (cond
-      (s/blank? s) (throw (ex-info (str "-Sdeps must be non-blank") {}))
-      (s/starts-with? (s/trim s) "{") (edn/read-string {:default tagged-literal} s)
+      (str/blank? s) (throw (ex-info "-Sdeps must be non-blank" {}))
+      (str/starts-with? (str/trim s) "{") (edn/read-string {:default tagged-literal} s)
       :else s)))

src/main/resources/clojure/tools/deps/deps.edn

@@ -7,7 +7,7 @@
 
   :aliases {
     :deps {:replace-paths []
-           :replace-deps {org.clojure/tools.deps.cli {:mvn/version "0.11.93"}}
+           :replace-deps {org.clojure/tools.deps.cli {:mvn/version "0.11.100"}}
            :ns-default clojure.tools.deps.cli.api
            :ns-aliases {help clojure.tools.deps.cli.help}}
     :test {:extra-paths ["test"]}

src/test/clojure/clojure/tools/deps/script/test_make_classpath2.clj

@@ -152,7 +152,7 @@
 (deftest skip-cp-flag
   (let [{:keys [basis]} (mc/run-core {:config-project {:deps {'org.clojure/clojure {:mvn/version "1.10.0"}}}
                                       :skip-cp true})]
-    (= {} (select-keys basis [:libs :classpath :classpath-roots]))))
+    (is (= {} (select-keys basis [:libs :classpath :classpath-roots])))))
 
 ;; skip-cp flag still passes exec-args for -X or -T
 (deftest skip-cp-exec

src/test/clojure/clojure/tools/deps/script/test_parse.clj

@@ -1,6 +1,6 @@
 (ns clojure.tools.deps.script.test-parse
   (:require
-    [clojure.test :refer :all]
+    [clojure.test :refer [deftest is]]
     [clojure.tools.deps.script.parse :as parse]))
 
 (deftest test-parse-config