Skip to content

build(deps): bump the backend-deps group across 1 directory with 6 updates - #157

Merged
WolfTasks merged 18 commits into
mainfrom
dependabot/gradle/backend/backend-deps-e038530b44
Oct 24, 2026
Merged

build(deps): bump the backend-deps group across 1 directory with 6 updates#157
WolfTasks merged 18 commits into
mainfrom
dependabot/gradle/backend/backend-deps-e038530b44

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the backend-deps group with 6 updates in the /backend directory:

Package From To
tools.jackson.core:jackson-core 3.1.7 3.2.3
tools.jackson.core:jackson-databind 3.1.7 3.2.3
jvm 2.4.20 2.4.21
plugin.spring 2.4.20 2.4.21
plugin.jpa 2.4.20 2.4.21
gradle-wrapper 9.8.0 9.8.1

Updates tools.jackson.core:jackson-core from 3.1.7 to 3.2.3

Commits
  • 8c64e64 [maven-release-plugin] prepare release jackson-core-3.2.3
  • 0b437c9 Prep for 3.2.3 release
  • 0119b26 Merge branch '3.1' into 3.2
  • 0a382d9 Post-release dep version bump
  • 4952c6b [maven-release-plugin] prepare for next development iteration
  • 33d567b Merge branch '3.1' into 3.2
  • See full diff in compare view

Updates tools.jackson.core:jackson-databind from 3.1.7 to 3.2.3

Commits
  • 4179a66 [maven-release-plugin] prepare release jackson-databind-3.2.3
  • 37c8a72 Prep for 3.2.3 release
  • 5fa7881 Merge branch '3.1' into 3.2
  • c9f17a2 Post-release dep version bump
  • 1ea1c40 [maven-release-plugin] prepare for next development iteration
  • 55fcbc7 Avoid quadratic Object Id rebinding for Builder- and delegate-based values (#...
  • See full diff in compare view

Updates jvm from 2.4.20 to 2.4.21

Release notes

Sourced from jvm's releases.

Kotlin 2.4.21

Changelog

Backend. Wasm

  • KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

  • KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
  • KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

  • KT-89449 Kotlin/JS: Member names no longer minified in production
  • KT-89363 KJS. Regular class with companion can't extend external class

Tools. Compiler plugins. Serialization

  • KT-89275 Kotlin/Wasm: Invalid Wasm is emitted for a @Serializable generic class with a class upper bound

Tools. Gradle. Native

  • KT-89285 SwiftPM import results in flooded log
  • KT-86251 K/N: Flaky linkDebugTestLinuxX64 failure with "truncated or malformed archive" on libstdlib-cache.a

Tools. Scripts

  • KT-89247 Kotlin Script: NoClassDefFoundError on 2nd execution with transitive dependency from imported script
  • KT-89220 JSR-223: generic Java bindings break all subsequent eval() calls
  • KT-88458 Audit closeable resource usage
  • KT-88453 VirtualFileScriptSource.text leaks an unclosed file stream — script source file handle held until GC, blocks file deletion on Windows

Kotlin 2.4.21-RC

Changelog

Backend. Wasm

  • KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

  • KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
  • KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

  • KT-89449 Kotlin/JS: Member names no longer minified in production
  • KT-89363 KJS. Regular class with companion can't extend external class

... (truncated)

Changelog

Sourced from jvm's changelog.

2.4.21

Backend. Wasm

  • KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

  • KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
  • KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

  • KT-89449 Kotlin/JS: Member names no longer minified in production
  • KT-89363 KJS. Regular class with companion can't extend external class

Tools. Compiler plugins. Serialization

  • KT-89275 Kotlin/Wasm: Invalid Wasm is emitted for a @Serializable generic class with a class upper bound

Tools. Gradle. Native

  • KT-89285 SwiftPM import results in flooded log
  • KT-86251 K/N: Flaky linkDebugTestLinuxX64 failure with "truncated or malformed archive" on libstdlib-cache.a

Tools. Scripts

  • KT-89247 Kotlin Script: NoClassDefFoundError on 2nd execution with transitive dependency from imported script
  • KT-89220 JSR-223: generic Java bindings break all subsequent eval() calls
  • KT-88458 Audit closeable resource usage
  • KT-88453 VirtualFileScriptSource.text leaks an unclosed file stream — script source file handle held until GC, blocks file deletion on Windows
Commits
  • 9180ce6 Add changelog for 2.4.21-RC
  • 851077b [Serialization] Copy type parameter bounds onto generated serializers (#8421)
  • 1b6b624 [Wasm]: Generate a Kotlin-level cast for bridged lambda functions. (#8404)
  • 3c223c2 Rrr/2.4.20/core docs (#8322)
  • c681c2e [2.4.20] [KT-89285] Stop the xcodebuild logs being output by default (#8277)
  • f0645d1 [2.4.20] [JS] Reorder CompilerConfiguration properties initialization (#8282)
  • f507ecd [JS] Don't try to initialize an external class's companion object
  • c60d7d8 Reflection: fix NoSuchElementException in ConvertFromJava.kt
  • 05d1cde REPL: render correct reflected binding type
  • 5acec47 Scripting: store collected dependencies recursively
  • Additional commits viewable in compare view

Updates plugin.spring from 2.4.20 to 2.4.21

Release notes

Sourced from plugin.spring's releases.

Kotlin 2.4.21

Changelog

Backend. Wasm

  • KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

  • KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
  • KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

  • KT-89449 Kotlin/JS: Member names no longer minified in production
  • KT-89363 KJS. Regular class with companion can't extend external class

Tools. Compiler plugins. Serialization

  • KT-89275 Kotlin/Wasm: Invalid Wasm is emitted for a @Serializable generic class with a class upper bound

Tools. Gradle. Native

  • KT-89285 SwiftPM import results in flooded log
  • KT-86251 K/N: Flaky linkDebugTestLinuxX64 failure with "truncated or malformed archive" on libstdlib-cache.a

Tools. Scripts

  • KT-89247 Kotlin Script: NoClassDefFoundError on 2nd execution with transitive dependency from imported script
  • KT-89220 JSR-223: generic Java bindings break all subsequent eval() calls
  • KT-88458 Audit closeable resource usage
  • KT-88453 VirtualFileScriptSource.text leaks an unclosed file stream — script source file handle held until GC, blocks file deletion on Windows

Kotlin 2.4.21-RC

Changelog

Backend. Wasm

  • KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

  • KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
  • KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

  • KT-89449 Kotlin/JS: Member names no longer minified in production
  • KT-89363 KJS. Regular class with companion can't extend external class

... (truncated)

Changelog

Sourced from plugin.spring's changelog.

2.4.21

Backend. Wasm

  • KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

  • KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
  • KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

  • KT-89449 Kotlin/JS: Member names no longer minified in production
  • KT-89363 KJS. Regular class with companion can't extend external class

Tools. Compiler plugins. Serialization

  • KT-89275 Kotlin/Wasm: Invalid Wasm is emitted for a @Serializable generic class with a class upper bound

Tools. Gradle. Native

  • KT-89285 SwiftPM import results in flooded log
  • KT-86251 K/N: Flaky linkDebugTestLinuxX64 failure with "truncated or malformed archive" on libstdlib-cache.a

Tools. Scripts

  • KT-89247 Kotlin Script: NoClassDefFoundError on 2nd execution with transitive dependency from imported script
  • KT-89220 JSR-223: generic Java bindings break all subsequent eval() calls
  • KT-88458 Audit closeable resource usage
  • KT-88453 VirtualFileScriptSource.text leaks an unclosed file stream — script source file handle held until GC, blocks file deletion on Windows
Commits
  • 9180ce6 Add changelog for 2.4.21-RC
  • 851077b [Serialization] Copy type parameter bounds onto generated serializers (#8421)
  • 1b6b624 [Wasm]: Generate a Kotlin-level cast for bridged lambda functions. (#8404)
  • 3c223c2 Rrr/2.4.20/core docs (#8322)
  • c681c2e [2.4.20] [KT-89285] Stop the xcodebuild logs being output by default (#8277)
  • f0645d1 [2.4.20] [JS] Reorder CompilerConfiguration properties initialization (#8282)
  • f507ecd [JS] Don't try to initialize an external class's companion object
  • c60d7d8 Reflection: fix NoSuchElementException in ConvertFromJava.kt
  • 05d1cde REPL: render correct reflected binding type
  • 5acec47 Scripting: store collected dependencies recursively
  • Additional commits viewable in compare view

Updates plugin.jpa from 2.4.20 to 2.4.21

Release notes

Sourced from plugin.jpa's releases.

Kotlin 2.4.21

Changelog

Backend. Wasm

  • KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

  • KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
  • KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

  • KT-89449 Kotlin/JS: Member names no longer minified in production
  • KT-89363 KJS. Regular class with companion can't extend external class

Tools. Compiler plugins. Serialization

  • KT-89275 Kotlin/Wasm: Invalid Wasm is emitted for a @Serializable generic class with a class upper bound

Tools. Gradle. Native

  • KT-89285 SwiftPM import results in flooded log
  • KT-86251 K/N: Flaky linkDebugTestLinuxX64 failure with "truncated or malformed archive" on libstdlib-cache.a

Tools. Scripts

  • KT-89247 Kotlin Script: NoClassDefFoundError on 2nd execution with transitive dependency from imported script
  • KT-89220 JSR-223: generic Java bindings break all subsequent eval() calls
  • KT-88458 Audit closeable resource usage
  • KT-88453 VirtualFileScriptSource.text leaks an unclosed file stream — script source file handle held until GC, blocks file deletion on Windows

Kotlin 2.4.21-RC

Changelog

Backend. Wasm

  • KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

  • KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
  • KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

  • KT-89449 Kotlin/JS: Member names no longer minified in production
  • KT-89363 KJS. Regular class with companion can't extend external class

... (truncated)

Changelog

Sourced from plugin.jpa's changelog.

2.4.21

Backend. Wasm

  • KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

  • KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
  • KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

  • KT-89449 Kotlin/JS: Member names no longer minified in production
  • KT-89363 KJS. Regular class with companion can't extend external class

Tools. Compiler plugins. Serialization

  • KT-89275 Kotlin/Wasm: Invalid Wasm is emitted for a @Serializable generic class with a class upper bound

Tools. Gradle. Native

  • KT-89285 SwiftPM import results in flooded log
  • KT-86251 K/N: Flaky linkDebugTestLinuxX64 failure with "truncated or malformed archive" on libstdlib-cache.a

Tools. Scripts

  • KT-89247 Kotlin Script: NoClassDefFoundError on 2nd execution with transitive dependency from imported script
  • KT-89220 JSR-223: generic Java bindings break all subsequent eval() calls
  • KT-88458 Audit closeable resource usage
  • KT-88453 VirtualFileScriptSource.text leaks an unclosed file stream — script source file handle held until GC, blocks file deletion on Windows
Commits
  • 9180ce6 Add changelog for 2.4.21-RC
  • 851077b [Serialization] Copy type parameter bounds onto generated serializers (#8421)
  • 1b6b624 [Wasm]: Generate a Kotlin-level cast for bridged lambda functions. (#8404)
  • 3c223c2 Rrr/2.4.20/core docs (#8322)
  • c681c2e [2.4.20] [KT-89285] Stop the xcodebuild logs being output by default (#8277)
  • f0645d1 [2.4.20] [JS] Reorder CompilerConfiguration properties initialization (#8282)
  • f507ecd [JS] Don't try to initialize an external class's companion object
  • c60d7d8 Reflection: fix NoSuchElementException in ConvertFromJava.kt
  • 05d1cde REPL: render correct reflected binding type
  • 5acec47 Scripting: store collected dependencies recursively
  • Additional commits viewable in compare view

Updates gradle-wrapper from 9.8.0 to 9.8.1

Release notes

Sourced from gradle-wrapper's releases.

9.8.1

This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.

This release addresses three high rated vulnerabilities:

The following issues were resolved:

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam, Björn Kautler, Eng Zer Jun, Hashim Khan, Julian Krannich, KBS, Labh R Jethe, Mark Dodgson, Maxim, monkey, nataphon-ktsystems, Paul King, Qiu Tian, rg_sandesh, Roberto Perez Alcolea, Sean, Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

... (truncated)

Commits
  • 39daf39 Release notes for Gradle 9.8.1 (#39409)
  • 4fc92e5 Release notes for Gradle 9.8.1
  • bfbd14a Make repository disabling stricter (#39403)
  • 95e0bf9 Check daemon & worker preamble earlier (#39402)
  • 7aa9a5b Improve display for distribution url in wrapper (#39401)
  • 74a7720 Wrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...
  • 651110a Check worker token before any serialization similarly to daemon
  • 8a6b9d9 Harden repository disabling: disable them by default on failure unless there'...
  • f28e514 Check the daemon token before any serialization
  • 86ab273 Replace credentials for distribution url with *** and avoid showing the plain...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Oct 19, 2026
@dependabot
build(deps): bump the backend-deps group across 1 directory with 6 up…
d9b4819 
…dates

Bumps the backend-deps group with 6 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [tools.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core) | `3.1.7` | `3.2.3` |
| [tools.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) | `3.1.7` | `3.2.3` |
| [jvm](https://github.com/JetBrains/kotlin) | `2.4.20` | `2.4.21` |
| [plugin.spring](https://github.com/JetBrains/kotlin) | `2.4.20` | `2.4.21` |
| [plugin.jpa](https://github.com/JetBrains/kotlin) | `2.4.20` | `2.4.21` |
| [gradle-wrapper](https://github.com/gradle/gradle) | `9.8.0` | `9.8.1` |



Updates `tools.jackson.core:jackson-core` from 3.1.7 to 3.2.3
- [Commits](FasterXML/jackson-core@jackson-core-3.1.7...jackson-core-3.2.3)

Updates `tools.jackson.core:jackson-databind` from 3.1.7 to 3.2.3
- [Commits](FasterXML/jackson-databind@jackson-databind-3.1.7...jackson-databind-3.2.3)

Updates `jvm` from 2.4.20 to 2.4.21
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.20...v2.4.21)

Updates `plugin.spring` from 2.4.20 to 2.4.21
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.20...v2.4.21)

Updates `plugin.jpa` from 2.4.20 to 2.4.21
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.20...v2.4.21)

Updates `gradle-wrapper` from 9.8.0 to 9.8.1
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](gradle/gradle@v9.8.0...v9.8.1)

---
updated-dependencies:
- dependency-name: gradle-wrapper
  dependency-version: 9.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-deps
- dependency-name: jvm
  dependency-version: 2.4.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-deps
- dependency-name: plugin.jpa
  dependency-version: 2.4.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-deps
- dependency-name: plugin.spring
  dependency-version: 2.4.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-deps
- dependency-name: tools.jackson.core:jackson-core
  dependency-version: 3.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-deps
- dependency-name: tools.jackson.core:jackson-databind
  dependency-version: 3.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/gradle/backend/backend-deps-e038530b44 branch from 2e431c5 to d9b4819 Compare October 21, 2026 19:31
WolfTasks and others added 17 commits October 21, 2026 21:42
@WolfTasks Wolfgang Kozian @claude
fix(m3): restore IMAP ingestion under Spring Boot 4 (#166)
698cf9b 
* fix(m3): restore IMAP ingestion under Spring Boot 4

Boot 4 moved the Spring Integration auto-configuration into its own module.
With only spring-integration-core on the classpath, @EnableIntegration is
never applied, so the imapFlow bean was registered but no poller ran and
service-desk e-mails were silently ignored (regression vs v1.0.20, found in
a GreenMail IMAPS smoke). Use spring-boot-starter-integration; guard:
ImapIngestionFlowStartedIntegrationTest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: backlog — SSO wiring gaps, IMAP Boot 4 fix

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Wolfgang Kozian <kozian.wolfgang@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Wolfgang Kozian @claude
chore(release): v1.0.21
9f51120 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Wolfgang Kozian @claude
docs: backlog — M3 shipped (v1.0.21), park follow-ups B4–B7, H4
e83540d 
B4 transition-guard 500, B5 SSO UI wiring, B6 unknown paths 500,
B7 dev profile H2, H4 Jackson 3 polish (deferred review minors).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@WolfTasks Wolfgang Kozian @claude
fix(security): dompurify 3.4.17 + brotli-libs 1.2.1 (nightly red) (#169)
718080a 
* fix(security): dompurify 3.4.17 (nightly red)

GHSA-cg2g-xh64-v4q7 (CRITICAL) + GHSA-mrv2-3pqr-j5jr (HIGH) in 3.4.16.
Lockfile patched surgically to keep npm's libc fields.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(security): brotli-libs 1.2.1-r0 in both images (CVE-2026-111497)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Wolfgang Kozian <kozian.wolfgang@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@WolfTasks Wolfgang Kozian @claude
fix(b6): Spring MVC errors keep their 4xx status instead of 500 (#170)
426d586 
handleGeneric swallowed NoResourceFoundException & co. It now honours
Spring's ErrorResponse status (404 NOT_FOUND, 405 METHOD_NOT_ALLOWED,
other 4xx); malformed path variables map to 400.

Co-authored-by: Wolfgang Kozian <kozian.wolfgang@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@WolfTasks Wolfgang Kozian @claude
fix(b4): persist transition guards with their type discriminator (#171)
57b9b52 
updateGuards serialized List<TransitionGuard> without "type" (type
erasure), so every move over a guarded transition failed with 500.
Write/read via writerFor(TypeReference); V31 repairs stored guards.

Co-authored-by: Wolfgang Kozian <kozian.wolfgang@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@WolfTasks Wolfgang Kozian @claude
fix(b7): dev profile runs on PostgreSQL instead of H2 (#172)
5e15bb1 
The migrations are PostgreSQL-only (gen_random_uuid() since V11), so the
H2 dev profile could not start. dev now targets a local Postgres
(docker-compose.dev.yml db service); bootRun defaults to dev. H2 stays
for the @DataJpaTest slices only, so it and the H2 console leave the
production classpath; the H2-only permitAll + frameOptions opt-out go.

Co-authored-by: Wolfgang Kozian <kozian.wolfgang@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@WolfTasks Wolfgang Kozian @claude
fix(b2): regression test for read-only tickets + admin-gated config UI (
51a9843 
#173)

- ProjectWriteEnforcementIntegrationTest: VIEWER PATCH/DELETE issue -> 403,
  issue unchanged (was untested)
- Workflow editor, automation, project dashboard, API keys, webhooks and
  integrations only show write affordances to project admins (the server
  already rejects non-admin writes with 403); reads stay available

Co-authored-by: Wolfgang Kozian <kozian.wolfgang@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@WolfTasks Wolfgang Kozian @claude
fix(b5): make SSO usable from the UI (#174)
fc8e0aa 
- login button targets Spring's /oauth2/authorization/{id}
- nginx + Vite proxy /oauth2/ and /login/oauth2/ to the backend
- new SPA route /auth/sso/callback stores the token pair
- success handler returns access AND refresh token, in the URL fragment
  (not the query), on the public TW_BASE_URL; redirect URI uses it too
- rejected/failed SSO logins land on /login with a message
- Admin -> SSO shows each provider's redirect URI

Co-authored-by: Wolfgang Kozian <kozian.wolfgang@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@WolfTasks Wolfgang Kozian @claude
docs: backlog — B2, B4–B7 merged, new H5 finding (#175)
cae575b 
* docs: backlog — B2, B4–B7 PRs open (#170–#174), new H5 rate-limit finding

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: backlog — B2, B4–B7 merged (#170–#174), not yet released

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Wolfgang Kozian <kozian.wolfgang@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@WolfTasks Wolfgang Kozian @claude
fix(h5): auth rate limit keys on an IP the client cannot choose (#177)
4af75ce 
AuthRateLimitFilter took the first X-Forwarded-For value, which nginx
passes through untouched: rotating the header bypassed the login/register
limit, and without it every client shared nginx's bucket. Now
X-Forwarded-For is ignored; X-Real-IP (overwritten by nginx with
$remote_addr) is trusted only from private/loopback peers. 429 message
is keyed (auth.rateLimited, en/de). api.md: correct the limit description.

Co-authored-by: Wolfgang Kozian <kozian.wolfgang@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@WolfTasks Wolfgang Kozian @claude
fix(h4): Jackson 3 polish (webhook asString 500, mapper guidance, gua…
300f910 
…rd asserts) (#178)

* fix(h4): Jackson 3 polish — defaulted asString in webhooks, mapper guidance

- IncomingWebhookService: no-arg JsonNode.asString() throws on object/array
  nodes under Jackson 3, so a correctly signed but unusual payload gave 500.
  All call sites use asString(""); regression test with null/object/array
  fields (was 500, now 200)
- StringListConverter: JsonMapper.builderWithJackson2Defaults() to match
  the app-wide use-jackson2-defaults
- ai-guide: inject Spring's mapper / builderWithJackson2Defaults, warn
  about asString() on untrusted JSON
- JsonWireFormatGuardIntegrationTest: pin enum name() read/write and ISO
  durations

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: backlog — H4/H5 PRs open (#178/#177), new H6 (Postgres port published)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Wolfgang Kozian <kozian.wolfgang@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@WolfTasks Wolfgang Kozian @claude
fix(h6): publish PostgreSQL on loopback only (#179)
9322891 
docker-compose.prod.yml mapped 5432:5432, i.e. on all interfaces, and
Docker's port mapping usually bypasses host firewalls: the database was
reachable from the network, protected only by TW_DB_PASS. The app talks
to it over the Docker network, so bind to 127.0.0.1 (host tools still
work). Same for docker-compose.dev.yml, whose password is public.
getting-started: TW_DB_PASS/TW_BASE_URL hints, SSH tunnel for remote
access. Backlog: H4/H5 merged, H6 done.

Co-authored-by: Wolfgang Kozian <kozian.wolfgang@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@dependabot @WolfTasks
build(deps): bump the frontend-deps group across 1 directory with 25 …
82790d4 
…updates (#176)

Bumps the frontend-deps group with 25 updates in the /frontend directory:

| Package | From | To |
| --- | --- | --- |
| [@radix-ui/react-dialog](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dialog) | `1.1.23` | `1.3.1` |
| [@radix-ui/react-dropdown-menu](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dropdown-menu) | `2.1.24` | `2.2.1` |
| [@radix-ui/react-label](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/label) | `2.1.15` | `2.1.17` |
| [@radix-ui/react-select](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/select) | `2.3.7` | `2.4.1` |
| [@radix-ui/react-slot](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slot) | `1.3.3` | `1.5.0` |
| [@stomp/stompjs](https://github.com/stomp-js/stompjs) | `7.3.0` | `7.5.0` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.102.8` | `5.104.4` |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.10` | `3.14.21` |
| [@tiptap/extension-link](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-link) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-placeholder](https://github.com/ueberdosis/tiptap/tree/HEAD/packages-deprecated/extension-placeholder) | `3.31.3` | `3.32.0` |
| [@tiptap/react](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/react) | `3.31.3` | `3.32.0` |
| [@tiptap/starter-kit](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/starter-kit) | `3.31.3` | `3.32.0` |
| [i18next](https://github.com/i18next/i18next) | `26.4.2` | `26.5.2` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.42.0` | `1.59.0` |
| [qs](https://github.com/ljharb/qs) | `6.16.0` | `6.16.1` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.1` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.1` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.7` | `19.3.0` |
| [react-grid-layout](https://github.com/STRML/react-grid-layout) | `2.2.4` | `2.3.0` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.13` | `17.1.0` |
| [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `8.3.1` | `8.4.0` |
| [tailwind-merge](https://github.com/dcastil/tailwind-merge/tree/HEAD/packages/tailwind-merge) | `3.6.0` | `3.7.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.0` | `26.6.5` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.7` | `19.3.0` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.1` | `6.1.2` |



Updates `@radix-ui/react-dialog` from 1.1.23 to 1.3.1
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dialog/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dialog)

Updates `@radix-ui/react-dropdown-menu` from 2.1.24 to 2.2.1
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dropdown-menu/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dropdown-menu)

Updates `@radix-ui/react-label` from 2.1.15 to 2.1.17
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/label/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/label)

Updates `@radix-ui/react-select` from 2.3.7 to 2.4.1
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/select/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/select)

Updates `@radix-ui/react-slot` from 1.3.3 to 1.5.0
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/slot/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slot)

Updates `@stomp/stompjs` from 7.3.0 to 7.5.0
- [Release notes](https://github.com/stomp-js/stompjs/releases)
- [Commits](stomp-js/stompjs@v7.3.0...v7.5.0)

Updates `@tanstack/react-query` from 5.102.8 to 5.104.4
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.104.4/packages/react-query)

Updates `@tanstack/react-virtual` from 3.14.10 to 3.14.21
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.21/packages/react-virtual)

Updates `@tiptap/extension-link` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-link/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-link)

Updates `@tiptap/extension-placeholder` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages-deprecated/extension-placeholder/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages-deprecated/extension-placeholder)

Updates `@tiptap/react` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/react/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/react)

Updates `@tiptap/starter-kit` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/starter-kit/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/starter-kit)

Updates `i18next` from 26.4.2 to 26.5.2
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.4.2...v26.5.2)

Updates `lucide-react` from 1.42.0 to 1.59.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.59.0/packages/lucide-react)

Updates `qs` from 6.16.0 to 6.16.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.16.0...v6.16.1)

Updates `react` from 19.2.8 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.2.8 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `@types/react-dom` from 19.2.7 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `react-grid-layout` from 2.2.4 to 2.3.0
- [Release notes](https://github.com/STRML/react-grid-layout/releases)
- [Changelog](https://github.com/react-grid-layout/react-grid-layout/blob/master/CHANGELOG.md)
- [Commits](react-grid-layout/react-grid-layout@v2.2.4...2.3.0)

Updates `react-i18next` from 17.0.13 to 17.1.0
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v17.0.13...v17.1.0)

Updates `react-router` from 8.3.1 to 8.4.0
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@8.4.0/packages/react-router)

Updates `tailwind-merge` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/dcastil/tailwind-merge/releases)
- [Commits](https://github.com/dcastil/tailwind-merge/commits/tailwind-merge@3.7.0/packages/tailwind-merge)

Updates `@types/node` from 26.5.0 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.7 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitejs/plugin-react` from 6.1.1 to 6.1.2
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.2/packages/plugin-react)

---
updated-dependencies:
- dependency-name: "@radix-ui/react-dialog"
  dependency-version: 1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@radix-ui/react-dropdown-menu"
  dependency-version: 2.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@radix-ui/react-label"
  dependency-version: 2.1.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: "@radix-ui/react-select"
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@radix-ui/react-slot"
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@stomp/stompjs"
  dependency-version: 7.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.104.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: "@tiptap/extension-link"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@tiptap/extension-placeholder"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@tiptap/react"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@tiptap/starter-kit"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: i18next
  dependency-version: 26.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: lucide-react
  dependency-version: 1.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: qs
  dependency-version: 6.16.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: react-grid-layout
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: react-i18next
  dependency-version: 17.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: react-router
  dependency-version: 8.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: tailwind-merge
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-deps
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Wolfgang <kozian.wolfgang+git@gmail.com>
Wolfgang Kozian @claude
chore(release): v1.0.22
aa5c153 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Wolfgang Kozian
Merge remote-tracking branch 'origin/dependabot/gradle/backend/backen…
3a9454d 
…d-deps-e038530b44' into worktree-dependabot-review
Wolfgang Kozian @claude
build(deps): regenerate gradle.lockfile for Kotlin 2.4.21
86e08e7 
Dependabot left kotlinCompilerClasspath and friends locked at 2.4.20
while Gradle resolves them to 2.4.21 (lock mode is lenient, so it went
unnoticed). Regenerated with --write-locks; only Kotlin entries change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@WolfTasks
WolfTasks merged commit d4f1c5f into main Oct 24, 2026
11 checks passed
@dependabot
dependabot Bot deleted the dependabot/gradle/backend/backend-deps-e038530b44 branch October 24, 2026 13:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@WolfTasks