Release 7.15.0 - Sessions model refresh + ChallengeIndicator/SessionChallengeIndicator alignment + security update

[david-ruiz-cko]

Release 7.15.0 bundles the 3DS challenge indicator alignment plus a broader refresh of the Sessions model (#631), and a dependency/security update (#632).

3DS Challenge Indicator Modeling

• Introduced a new SessionChallengeIndicator enum in sessions to represent all nine possible challenge indicator values for session endpoints, including exemption requests, with detailed documentation for each value. (src/main/java/com/checkout/sessions/SessionChallengeIndicator.java)
• Updated ChallengeIndicator in common to clarify its use for payment-related endpoints and to deprecate exemption values, which are now only valid for sessions. Improved documentation for each enum value and marked exemptions as deprecated. (src/main/java/com/checkout/common/ChallengeIndicator.java)
• Changed the type of the challengeIndicator field in both CreateSessionAcceptedResponse and GetSessionResponse from ChallengeIndicator to SessionChallengeIndicator, ensuring correct deserialization and alignment with API behaviour.
• Removed the now unnecessary imports of ChallengeIndicator from CreateSessionAcceptedResponse, GetSessionResponse and SessionRequest.

Sessions Model Additions

• Added Google SPA support with four new classes: GoogleSpa, GoogleSpaInfo, GoogleSpaIframe and GoogleSpaToken. (src/main/java/com/checkout/sessions/GoogleSpa*.java)
• Added the preferred experiences model: SessionPreferredExperiences, Experience, ExperienceStatus and ExperienceOutcome.
• Added ThreeDSInfo and ThreeDSErrorDetails to model the 3DS information and error detail objects returned by the session endpoints.
• Added the SessionScheme enum with the full set of spec values, replacing loosely typed scheme fields.
• Extended SessionRequest with the new fields (Google SPA, preferred experiences, device information) and fixed the priorTransactionReference handling.
• Updated TransactionType and SessionsCardMetadataResponse to match the current spec.

Documentation

• Added comprehensive Javadoc for every field in CreateSessionAcceptedResponse, GetSessionResponse and SessionRequest, clarifying requirements, formats, patterns and default values.

Test Coverage

• New serialization suites: CreateSessionAcceptedResponseSerializationTest, GetSessionResponseSerializationTest, SessionRequestSerializationTest.
• New enum conformance suites: ChallengeIndicatorTest, SessionChallengeIndicatorTest, SessionSchemeTest, TransactionTypeTest.
• Updated the sessions integration tests (AbstractSessionsTestIT, RequestAndGetSessionsTestIT) for the new indicator type.

Security and Dependency Update

Dependency updates:

• sonarqube to 7.3.1.8318
• log4j to log4j-api:2.25.5, log4j-core:2.25.5, log4j-slf4j2-impl:2.25.5

Dependabot configuration:

• Added a test-deps group to combine updates for testing-related dependencies (org.junit*, org.mockito*, org.apache.logging.log4j*, org.hamcrest*) into single pull requests.
• Increased open-pull-requests-limit to 10 for the main package ecosystem.
• Added a github-actions ecosystem entry with a weekly update schedule.

[agent-wall-e]

🟡 Risk Classification: MINOR

Approval route: AI Review + Human Approval
Rollback controls: Staged rollout + rollback

Classification reasons

• no_low_class_matched
• prod_source_modified

Operational gates

• ✅ jira_ticket
• ✅ independent_review

Files analysed: 1

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
no_low_class_matched	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
prod_source_modified	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud