Skip to content

build(deps): bump the maven-minor-and-patch group with 34 updates - #117

Closed
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/maven/maven-minor-and-patch-34a514ca3d
Closed

build(deps): bump the maven-minor-and-patch group with 34 updates#117
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/maven/maven-minor-and-patch-34a514ca3d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2026

Copy link
Copy Markdown

Bumps the maven-minor-and-patch group with 34 updates:

Package From To
tools.jackson:jackson-bom 3.1.7 3.2.4
com.fasterxml.jackson:jackson-bom 2.21.7 2.22.4
org.apache.tomcat.embed:tomcat-embed-core 11.0.26 11.0.27
org.apache.tomcat.embed:tomcat-embed-el 11.0.26 11.0.27
org.apache.tomcat.embed:tomcat-embed-websocket 11.0.26 11.0.27
org.springframework.boot:spring-boot-dependencies 4.1.1 4.1.2
org.springdoc:springdoc-openapi-starter-webmvc-api 3.1.1 3.2.0
net.jqwik:jqwik 1.9.3 1.10.2
dk.brics:automaton 1.12-4 1.13-1
com.nimbusds:nimbus-jose-jwt 10.4 10.10
org.apache.zookeeper:zookeeper 3.6.4 3.9.6
com.google.errorprone:error_prone_core 2.50.0 2.51.0
com.uber.nullaway:nullaway 0.14.2 0.14.3
org.apache.maven.plugins:maven-surefire-plugin 3.6.0 3.6.1
org.apache.maven.plugins:maven-failsafe-plugin 3.6.0 3.6.1
org.apache.maven.plugins:maven-dependency-plugin 3.7.0 3.11.0
org.jacoco:jacoco-maven-plugin 0.8.15 0.8.16
com.github.spotbugs:spotbugs-maven-plugin 4.10.4.1 4.10.5.0
org.apache.maven.plugins:maven-source-plugin 3.3.1 3.4.0
org.sonatype.central:central-publishing-maven-plugin 0.11.0 0.12.0
io.dropwizard.metrics:metrics-core 4.1.12.1 4.2.40
commons-logging:commons-logging 1.3.6 1.4.0
org.codehaus.mojo:build-helper-maven-plugin 3.6.1 3.6.2
io.netty:netty-bom 4.1.137.Final 4.2.19.Final
org.apache.hive:hive-jdbc 4.0.1 4.2.1
org.apache.hbase:hbase-shaded-client-byo-hadoop 2.5.16-hadoop3 2.6.7-hadoop3
org.apache.hbase:hbase-server 2.5.16-hadoop3 2.6.7-hadoop3
commons-io:commons-io 2.21.0 2.22.0
commons-cli:commons-cli 1.9.0 1.11.0
org.apache.maven.plugins:maven-shade-plugin 3.6.1 3.6.2
org.codehaus.woodstox:stax2-api 4.2.2 4.3.2
org.apache.commons:commons-text 1.14.0 1.15.0
org.apache.hadoop.thirdparty:hadoop-shaded-guava 1.1.1 1.5.0
org.apache.commons:commons-collections4 4.4 4.6.0

Updates tools.jackson:jackson-bom from 3.1.7 to 3.2.4

Commits
  • 47303b4 [maven-release-plugin] prepare release jackson-bom-3.2.4
  • cad7311 Prep for 3.2.4 release
  • 2e47c28 Merge branch '3.1' into 3.2
  • c41bfec Post-release dep version bump
  • 86e94b2 [maven-release-plugin] prepare for next development iteration
  • c70e58a [maven-release-plugin] prepare release jackson-bom-3.1.8
  • 7d4ab97 Prep for 3.1.8 release
  • 3244f25 Merge branch '2.x' into 3.1
  • 6439613 Merge branch '2.22' into 2.x
  • a7d1c9f Post-release dep version bump
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson:jackson-bom from 2.21.7 to 2.22.4

Commits
  • 267bf9a [maven-release-plugin] prepare release jackson-bom-2.22.4
  • d41cad1 Prep for 2.22.4 release
  • 8fd9ace Merge branch '2.21' into 2.22
  • e1b27ed Post-release dep version bump
  • 5dfe489 [maven-release-plugin] prepare for next development iteration
  • b23db92 [maven-release-plugin] prepare release jackson-bom-2.21.8
  • 8937d04 Prep for 2.21.8 release
  • c44e739 Merge branch '2.20' into 2.21
  • b86d50e Merge branch '2.19' into 2.20
  • 7756e79 Merge branch '2.18' into 2.19
  • Additional commits viewable in compare view

Updates org.apache.tomcat.embed:tomcat-embed-core from 11.0.26 to 11.0.27

Updates org.apache.tomcat.embed:tomcat-embed-el from 11.0.26 to 11.0.27

Updates org.apache.tomcat.embed:tomcat-embed-websocket from 11.0.26 to 11.0.27

Updates org.apache.tomcat.embed:tomcat-embed-el from 11.0.26 to 11.0.27

Updates org.apache.tomcat.embed:tomcat-embed-websocket from 11.0.26 to 11.0.27

Updates org.springframework.boot:spring-boot-dependencies from 4.1.1 to 4.1.2

Release notes

Sourced from org.springframework.boot:spring-boot-dependencies's releases.

v4.1.2

⭐ New Features

  • Add TWENTY_SEVEN to JavaVersion enum #51426

🐞 Bug Fixes

  • OriginTrackedResource does not implement equals correctly #52267
  • OriginTrackedPropertiesLoader drops properties whose name starts with # or ! #52265
  • JWTs are rejected when issuer-uri is empty and jwk-set-uri is set #52260
  • Package manifest attributes are missing for nested jars without directory entries #52258
  • Logback ColorConverter unnecessarily parses its options for every log event #52228
  • Empty system property in TestPropertyValues is cleared instead of being restored to its empty value #52208
  • Graceful shutdown of Tomcat or Jetty may call back with REQUESTS_ACTIVE when stop is called immediately after shutDownGracefully on an idle server #52197
  • NettyWebServer stop may hang when called immediately after shutDownGracefully #52196
  • gRPC client 'grpc' load balancing fails to bind with a NullPointerException when no child policies are configured #52193
  • Prevent gRPC client properties from overriding user customizations #52175
  • MongoDB fails to connect when credentials contain a space #52168
  • Authentication fails when password configured in spring.elasticsearch.uris contains a colon #52166
  • Logging can be lost when a context is paused by the test context framework #52088
  • Docker Compose support for MongoDB fails to connect when credentials contain a character that requires URL encoding #52084
  • Jersey does not use the endpoint ObjectMapper when Actuator is running on a separate port #51982
  • Fractions of a second are handled incorrectly when configuring gRPC service config durations #51957
  • Configuration property descriptions may be lost when building incrementally with Gradle #51925
  • BasicJsonParser mishandles escaped characters in nested lists and maps #51908
  • Zero week value conversion fails with 'intValue cannot be extracted from WEEKS' exception #51894
  • App fails to start when using DevTools and manually configuring JDBC or R2DBC without spring-boot-jdbc or spring-boot-r2dbc #51890
  • Docker Compose support incorrectly recognizes MARIADB_ALLOW_EMPTY_PASSWORD instead of MARIADB_ALLOW_EMPTY_ROOT_PASSWORD #51888
  • Auto-configured Kotlinx Serialization JSON codec customization is not applied #51877
  • NullPointerException can be thrown when using uber jars due to a race condition in NestedJarFileResources #51745
  • DevTools does not detect a reactive web environment #51730
  • spring.http.clients.cookie-handling has no effect when using a reactive client backed by an HttpComponents connector #51724
  • Connection fails when rabbitmq Docker Compose service is configured to use SSL #51667
  • SBOM-related manifest attributes are missing from Maven-packaged wars #51651
  • When server.reactive.session.cookie.same-site is not set, session cookies have no SameSite attribute #51639
  • OAuth2 resource server ignores authorities-claim-delimiter when set on its own #51630
  • developmentOnly and testAndDevelopmentOnly configurations do not specify any attributes causing potential resolution problems #51623
  • In a reactive web application, Cloud Foundry security integration returns a 500 rather than a 503 when the cloud controller URL is unavailable #51614
  • Layer temp file is not deleted when layer creation fails #51581
  • Docker Compose integration for RabbitMQ skips credential fallbacks when an environment variable has no value #51578
  • Some assertion messages name the wrong parameter #51574
  • OAuth2ResourceServerProperties.Jwt has a setter that does not match its getter #51562
  • jarmode tools commands print stacktrace instead of an error message #51547
  • Docker Compose ProcessRunner can hang or leave orphan processes #51538
  • NestedByteChannel.read(ByteBuffer) incorrectly returns 0 when buffer could not be filled #51520
  • Customizer null checks in HTTP client builders assert the wrong attribute #51513
  • SSL host config customizations may be lost during Tomcat initialization #51511
  • SQL Server Docker Compose integration may duplicate the JDBC URL's encrypt parameter #51481
  • WritableJson.toByteArray() may corrupt supplementary characters #51464
  • SSL host config customizations are lost when reloading SSL bundles #51457

... (truncated)

Commits
  • 634e6fd Release 4.1.2
  • 6b43cf1 Upgrade to Spring WS 5.0.3
  • a73dfad Upgrade to Spring Security 7.1.2
  • 0485f1e Upgrade to Spring RESTDocs 4.0.2
  • de2c11a Upgrade to Spring Pulsar 2.0.8
  • 8d0359e Upgrade to Spring LDAP 4.1.2
  • f22c6e6 Upgrade to Spring Kafka 4.1.2
  • ed55709 Upgrade to Spring Integration 7.1.2
  • 2e88a38 Upgrade to Spring HATEOAS 3.1.3
  • 0d69ce5 Upgrade to Spring gRPC 1.1.2
  • Additional commits viewable in compare view

Updates org.springdoc:springdoc-openapi-starter-webmvc-api from 3.1.1 to 3.2.0

Release notes

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-api's releases.

springdoc-openapi v3.2.0 released!

Spring Boot 4.1.x line (built on Spring Boot 4.1.2).

⚠️ Changes you may notice

  • Default API version (#3354): the default API version is now only listed in the version header or query parameter of the operations that actually serve it (a handler mapped to it, or one without a version). Operations mapped only to other versions no longer show it as an allowed value or as their default. This also fixes the HTTP 500 raised when the version parameter declared @Schema(allowableValues).
  • Newly required properties (#3360, #3361): the PagedModel / PageMetadata properties and the amount / currency properties of MonetaryAmount are now marked as required, as they are always serialized. Generated clients will see them as non-nullable.
  • Scalar 0.6 (#3359): upgraded to 0.6.83. The first tag is now open by default, and model links changed from #model/name to #models/Name.
  • Scalar's standalone integration (#3387): with the Swagger UI or API-only starters, Scalar's own auto-configuration is no longer disabled by springdoc. If you have com.scalar.maven on the classpath and don't want it, set scalar.enabled=false.

New

  • Opt-in nullability for Java models (#3382): springdoc.model-converters.java-nullable-property-customizer.enabled=true marks properties annotated with @Nullable (JSpecify, Spring, JSR-305) as nullable, including $ref and oneOf properties, without changing shared components.
  • Polymorphic oneOf as reusable components (#3390): springdoc.model-converters.polymorphic-converter.one-of-as-ref=true, with the name suffix set by springdoc.model-converters.polymorphic-converter.one-of-ref-suffix (Variant by default).
  • ParameterCustomizer can read type-use annotations, including inside Optional<@MyAnnotation Foo> (#3370).
  • MCP tools are registered with a McpStatelessSyncServer, for the Spring AI STATELESS protocol (#3388).

Fixed

  • @ResponseStatus on a controller class is applied to its operations (#3352).
  • An injected WebSession is no longer documented as a query parameter in WebFlux (#3355).
  • The application no longer fails to start with Spring HATEOAS on the classpath but no LinkRelationProvider bean (#3364).
  • WebAsyncTask return types are unwrapped (#3368).
  • A JSpecify @Nullable on a controller parameter makes its schema nullable (#3377).
  • Nullable Kotlin properties described by a oneOf (e.g. sealed classes) are documented as nullable (#3381).
  • Gradle builds no longer lift Jackson 2 above the version managed by Spring Boot (#3373).

Security

  • The MCP dashboard no longer pre-fills the OAuth2 token endpoint, client id and client secret, and warns when the token endpoint is not HTTPS.

Dependencies

Spring Boot 4.1.2 · swagger-ui 5.34.0 · Scalar 0.6.83 · Spring AI 2.0.1 · Spring Cloud Function 5.0.5 · spring-security-oauth2-authorization-server managed by Spring Boot (7.1.2)

Thanks to all the contributors of this release: @​MaxFreedomPollard, @​kdelay, @​arimu1, @​dpkass, @​anupamchaubey, @​Mattias-Sehlstedt, @​Naresh7175, @​ys0v9, @​sharanggupta, @​itd-sw, @​gwr0-0, @​Tework123, @​awinishere.

Changelog

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-api's changelog.

[3.2.0] - 2026-10-24

Added

  • #3370 – A ParameterCustomizer can read the type-use annotations of a parameter, including the ones declared on the value wrapped in an Optional, such as Optional<@MyAnnotation Foo>
  • #3382 – Mark the Java properties annotated with @Nullable (JSpecify, Spring, JSR-305) as nullable in their schema, including $ref and oneOf properties. Opt-in with springdoc.model-converters.java-nullable-property-customizer.enabled=true
  • #3390 – Add springdoc.model-converters.polymorphic-converter.one-of-as-ref to emit the polymorphic oneOf unions as reusable component schemas, named after the parent schema with the suffix set by springdoc.model-converters.polymorphic-converter.one-of-ref-suffix (Variant by default)
  • #3388 – Register the MCP tools with a McpStatelessSyncServer, for the STATELESS protocol

Changed

  • The MCP dashboard no longer pre-fills the OAuth2 token endpoint, client id and client secret. The form shows hints instead, and warns when the token endpoint is not HTTPS
  • #3354 – The default API version is only listed in the header or query parameter of the operations that serve it: a handler method mapped to it, or one without a version
  • #3360 – The properties of Spring Data PagedModel and its PageMetadata are now marked as required, as they are always serialized
  • #3361 – The amount and currency properties of MonetaryAmount are now marked as required
  • #3359 – Upgrade Scalar to version 0.6.83. The first tag is now open by default, and the links to models changed from #model/name to #models/Name
  • #3383 – Upgrade Spring AI to version 2.0.1. The MCP SDK version is now the one required by Spring AI
  • Upgrade spring-boot to version 4.1.2
  • Upgrade swagger-ui to version 5.34.0
  • Upgrade spring-cloud-function to version 5.0.5
  • Use the spring-security-oauth2-authorization-server version managed by Spring Boot (7.1.2) instead of 2.0.0-M2

Fixed

  • #3352 – A @ResponseStatus on a controller class is now applied to the responses of its operations
  • #3355 – An injected WebSession parameter is no longer documented as a query parameter in WebFlux applications
  • #3354 – /v3/api-docs no longer fails when an API version parameter declares @Schema(allowableValues)
  • #3364 – The application no longer fails to start when Spring HATEOAS is on the classpath without a LinkRelationProvider bean
  • #3368 – A WebAsyncTask return type is now unwrapped, so its response is described by its result type
  • #3377 – A JSpecify @Nullable on a controller method parameter now makes its schema nullable
  • #3381 – A nullable Kotlin property described by a oneOf schema, such as a sealed class, is now documented as nullable
  • #3387 – Scalar's own integration works again with the Swagger UI and API-only starters: only the Springdoc Scalar starters replace it
  • #3373 – springdoc no longer lifts Jackson 2 above the version managed by Spring Boot in Gradle builds
Commits
  • 6b79ced [maven-release-plugin] prepare release v3.2.0
  • 689fc13 Describe the nullable property customizer flags in the configuration metadata
  • 7a1b506 Correct the LocalTime format in the changelog entry of gh-3351
  • 96245a2 Upgrade Scalar to 0.6.83
  • c494456 Build against the GA versions of the optional Spring dependencies
  • 2d4595f Restore the changelog entries lost in the unreleased fixed section
  • dd807bd Upgrade swagger-ui to version 5.34.0
  • e649960 Upgrade spring-boot to 4.1.2
  • b170ca8 Use the Jackson 2 managed by Spring Boot
  • ae52fe7 Register the MCP tools with a McpStatelessSyncServer
  • Additional commits viewable in compare view

Updates net.jqwik:jqwik from 1.9.3 to 1.10.2

Release notes

Sourced from net.jqwik:jqwik's releases.

Little Fix for IDEs

New and Enhanced Features

  • Annotation @Provide has now @Keep as meta-annotation, which enables IDEs to recognise that methods using this annotation are indeed used. See issue 733 for details. Many thanks to JarvisCraft for finding and fixing it.

Dependency Upgrades and Bug Fixes

  • Upgraded build system to Gradle 9.8.0

Anti-AI Release

Warning: Starting with version 1.10 jqwik comes with an Anti-AI Usage Clause! Usage with any "AI" agent is strongly discouraged. Jqwik's log output may confuse the agent.

This will probably be the last release of Jqwik using JUnit Platform version 1.x. Upcoming releases, if ever realised, will be built on JUnit Platform 6 and thus Java >= 21.

New and Enhanced Features

  • Added paragraph about intended AI usage to user guide: This project is not meant to be used by any “AI” coding agents at all.

  • Made @NotBlank configurator compatible with UTF-8 whitespace. See issue 663 for details.

Breaking Changes

  • Use of jqwik >= 1.10 with coding agents is strongly discouraged. Jqwik's output to stdout may confuse AI-based agents.

Dependency Upgrades and Bug Fixes

  • Upgraded to Kotlin 2.3.21
  • Upgraded to JUnit Platform 1.14.4
Commits
  • c8e1d6a Set release version 1.10.2
  • c15cb3f Set Kotlin base version to 2.1
  • ce65e4d Upgraded to Gradle 9.8.0
  • b4c84f8 Mark @Provide as @Keep
  • ac192eb Bump archunitVersion from 1.5.0 to 1.5.1
  • c66e898 Updated CONTRIBUTING.md
  • b915f62 Bump actions/setup-java from 5 to 6
  • 91d608c Bump archunitVersion from 1.4.2 to 1.5.0
  • 46a33cb Bump com.github.vlsi.gradle-extensions:com.github.vlsi.gradle-extensions.grad...
  • f6e23bd Bump actions/checkout from 6 to 7
  • Additional commits viewable in compare view

Updates dk.brics:automaton from 1.12-4 to 1.13-1

Changelog

Sourced from dk.brics:automaton's changelog.

1.12-4 -> 1.13-1

  • added MatchOnlyRunAutomaton for fast substring matching - contributed by J. McCartney
  • RegExp allows empty union/intersection branches, e.g. "(|a)", and rejects unescaped reserved characters, e.g. "*a" - contributed by D. Robertson
  • fixed getFiniteStrings omitting the empty string and returning null for singleton automata with negative limits - reported by A. Omori, fixed by J. Park
  • fixed year format in XML Schema date/time datatypes - thanks to S. Gregersen
  • fixed getShortestExample for rejected strings
  • fixed surrogate pair handling in shuffleSubsetOf
  • fixed makeDecimalValue to accept all valid lexical forms, e.g. ".5" and "1."
  • fixed makeIntegerValue and makeDecimalValue to accept any sign for zero, e.g. "-0" and "+0.0"
  • fixed U+FEFF missing from the Specials block in Datatypes
  • fixed unintended mutation of inputs or shared automata
  • fixed RegExp.toString to escape ~ and to print negated character classes as [^...]
  • fixed shuffleSubsetOf counterexamples that split surrogate pairs or suspended regions
  • fixed toAutomatonAllowMutate leaving the mutation flag set on exceptions
  • fixed NullPointerException in Datatypes.exists and Datatypes.get for unknown names (get now throws IllegalArgumentException)
  • fixed Automaton.load losing transitions of some automata, e.g. non-minimized automata from regular expressions
  • fixed isTotal for non-minimal automata
  • fixed minus to always return a deterministic automaton as documented
  • fixed complement not minimizing its result when minimize-always is set
  • fixed equals after SpecialOperations.reverse and setInitialState (stale hash code)
  • fixed compress and trim missing strings, in particular for nondeterministic automata
  • fixed prefixClose for the empty language
  • fixed projectChars for singleton automata
  • fixed RegExp.toString for numerical intervals without a fixed number of digits
  • fixed makeStringUnion failing with assertions enabled if the empty string is included
  • fixed makeMinInteger rejecting larger numbers with more digits, e.g. 10 for minimum 3
  • fixed makeMaxInteger accepting the empty string for maximum 0
  • fixed makeTotalDigits and makeFractionDigits for decimals without integer digits, e.g. ".5"
  • fixed Unicode category automata missing code points in ranges, e.g. most CJK ideographs and Hangul syllables
  • fixed gDay datatype to require three leading hyphens
  • fixed XML Schema integer datatypes to accept a plus sign and leading zeros, and decimal and float to accept e.g. "1." and ".5"
  • build updates
  • added randomized and metamorphic tests of all operations

1.12-3 -> 1.12-4

  • re-enable Java 8 support - thanks to D. Lowe

1.12-2 -> 1.12-3

  • upgrade to Java 11 - thanks to L.J. McGibbney

1.12-1 -> 1.12-2

  • fixed RegExp.toString - thanks to A. Gargantini

1.11-8 -> 1.12-1

  • added Valmari's minimization algorithm - contributed by S. Gregersen

... (truncated)

Commits

Updates com.nimbusds:nimbus-jose-jwt from 10.4 to 10.10

Changelog

Sourced from com.nimbusds:nimbus-jose-jwt's changelog.

10.4 (2025-07-19) * Creates a hierarchy of Option interfaces, extended by JWSSignerOption, JWEEncrypterOption and JWEDecrypterOption. Intended to provide optional configuration parameters to RSASSASigner, ECDSASigner, RSADecrypter, etc. * Introduces CipherMode implementing JWEEncrypterOption and JWEDecrypterOption, to specify a preferred JCA Cipher mode, such as MODE_ENCRYPT / MODE_DECRYPT when the default MODE_WRAP / MODE_UNWRAP is not supported by the JCA provider (iss #576). * Updates RSAEncrypter and RSADecrypter to support the JWEEncrypterOption CipherMode.ENCRYPT_DECRYPT (iss #576). * Factors out OptionUtils.ensureMinRSAPrivateKeySize. * Deprecates OptionUtils.optionIsPresent.

10.4.1 (2025-08-05) * Adds "requires java.sql" to module com.nimbusds.jose.jwt (iss #595).

10.4.2 (2025-08-14) * Updates GSon to 2.13.1. * Updates BouncyCastle to 1.81.

10.5 (2025-09-05) * Support for specifying a ScheduledExecutorService instance in RefreshAheadCachingJWKSetSource and JWKSourceBuilder (iss #592).

10.6 (2025-11-06) * Adds static CollectionUtils.containsNull(Set) method. * DefaultJWTClaimsVerifier accepted "aud" (audience) argument must be compatible with Set.of (iss #499). * The DefaultJWTClaimsVerifier must not include JWT claim values in BadJWTException messages (iss #605).

10.7 (2026-01-08) * Adds MaxCompressedCipherTextLength that implements JWEDecrypterOption, to to configure the maximum allowed length of compressed cipher text. * Adds JWEObject.decrypt(JWEDecrypter, Set) method to support the MaxCompressedCipherTextLength option.

10.8 (2026-02-19) * Adds a PasswordBasedDecrypter(byte[], Set) constructor to specify names of the critical header parameters that are deferred to the application for processing. Aligns with other JWEDecrypter and CriticalHeaderParamsAware implementations (iss #610). * Fixes getDeferredCriticalHeaderParams() in AESDecrypter, DirectDecrypter, RSADecrypter, ECDHDecrypter, X25519Decrypter, ECDH1PUDecrypter, ECDH1PUX25519Decrypter, MultiDecrypter, MACVerifier, ECDSAVerifier and Ed25519Verifier. Must internally call critPolicy.getDeferredCriticalHeaderParams(), not critPolicy.getProcessedCriticalHeaderParams() (iss #612).

10.9 (2026-04-02)

... (truncated)

Commits
  • 78e86f8 DefaultJWTClaimsVerifier accepted "aud" (audience) argument must be compatibl...
  • d4c1e05 [maven-release-plugin] prepare release 10.6
  • 6a6d0b3 [maven-release-plugin] prepare for next development iteration
  • 72ba7d2 Add configurable max compressed cipher text length for JWE decryption (iss #570)
  • 74d1dd1 Merged in feature/configurable-max-compressed-ciphertext-length (pull request...
  • 1b4a3eb Edits JavaDocs, CHANGELOG.txt for 10.7 release
  • 9f4752d Adds casts to tests
  • ebdea4e [maven-release-plugin] prepare release 10.7
  • 9509dc5 [maven-release-plugin] prepare for next development iteration
  • 0e27c9c Adds a PasswordBasedDecrypter(byte[], Set<String>) constructor to specify nam...
  • Additional commits viewable in compare view

Updates org.apache.zookeeper:zookeeper from 3.6.4 to 3.9.6

Updates com.google.errorprone:error_prone_core from 2.50.0 to 2.51.0

Release notes

Sourced from com.google.errorprone:error_prone_core's releases.

Error Prone 2.51.0

New checks:

  • HashCodeInObjectsHash: Detect redundant hashCode() or Objects.hash() calls inside Objects.hash(...), and simplify single-argument Objects.hash(x) calls to Objects.hashCode(x).
  • LoopToTestParameter: Suggest migrating loops in unit tests to TestParameterInjector.
  • MissingJavadoc: Flag public types that are missing Javadoc comments (disabled by default).
  • PreferCharsetOverload: Prefer calling method and constructor overloads that accept a Charset over those that accept a String encoding name.
  • PreferPreconditions: Suggest using Guava's Preconditions instead of explicit if-throw statements for parameter validation (disabled by default).
  • RequireNonNullRefactoring: Refactor explicit if (x == null) { throw new NullPointerException(...); } checks to Objects.requireNonNull (disabled by default).
  • SimplifyTestParameter: Remove redundant explicit value lists on @TestParameter annotations for boolean and Enum types when all values are specified (disabled by default).
  • TraditionalJavadocToMarkdown: Convert traditional /** ... */ Javadoc comments into /// Markdown Javadoc comments (disabled by default).
  • ValueClassIdentity: Flag reliance on identity semantics (such as synchronization, WeakReference, IdentityHashMap, or System.identityHashCode) of value-based classes (disabled by default).

Other changes:

  • CompareToZero: Upgraded from warning to error, and expanded to flag non-relational operations, unary negation, and switch statements/expressions on compareTo and compare results without Integer.signum.
  • IfChainToSwitch: Enabled by default as a warning.
  • UndefinedEquals: Merged ArrayAsKeyOfSetOrMap and CollectionUndefinedEquality into UndefinedEquals (retaining their names as altNames), and generalized detection of types without well-defined equals or hashCode across direct equality, collection containment, and hash-based containers.
  • EqualsIncompatibleType / TruthIncompatibleType: Flag equality comparisons between distinct record types (#6107).
  • ReferenceEquality: Allow == comparisons on private classes whose type hierarchy does not override Object.equals (#5865), private static final sentinel fields, Thread (#5900), and com.sun.source.tree.Tree.
  • PatternMatchingInstanceof: Support while and for loops, parenthesized expressions (#5843), and replacing additional redundant casts when the instanceof already introduces a pattern variable.
  • DistinctVarargsChecker: Expanded to check Objects.hash, CompletableFuture.allOf/anyOf, EnumSet.of, Sets.union/intersection/difference, Stream.concat, Math.min/max, and additional JDK, Guava, Protobuf, Truth, and Mockito methods.
  • MustBeClosedChecker: Require java.lang.foreign.Arena.ofConfined and Arena.ofShared to be closed.
  • ImpossibleNullComparison: Flag null checks on the return value of Class.forName.
  • RestrictedApi / RestrictedInheritance: Added an allowedPaths attribute to allow calls or inheritance from matching file paths without a regular expression.
  • InlineMeInliner: Support substituting type arguments at call sites when inlining generic @InlineMe methods.
  • WellKnownKeep: Recognize Apache Beam DoFn annotations and retain open-source library annotations (Gson, Mockito, Guice, Objectify, TestParameterInjector, AutoFactory).
  • Per-check timing collection is now disabled by default, reducing Error Prone compile-time overhead by ~3–5%; pass -XepPrintTimings to print a timing report after compilation or -XepRecordTimings to record timings programmatically (#6079).
  • CompilationTestHelper now reports all lines with mismatched diagnostic expectations in a single test run rather than failing on the first mismatch (#6116).
  • Replaced the RE2/J dependency with SafeRE.

Closed issues: #4914, #5182, #5843, #5857, #5865, #5878, #5900, #6029, #6079, #6107, #6116, #6133

Commits
  • 3e9c316 Release Error Prone 2.51.0
  • 4f83ec3 Add Maven 3.9.16 setup to release workflow
  • 47eb5be Exempt Apache Beam DoFn method annotations in WellKnownKeep
  • 7e2efea [IfChainToSwitch] Lower the minimum if-chain length from 5 to 4
  • 0a97086 [IfChainToSwitch] address issue where deleting trailing code can cause compil...
  • f61d405 [Reachability] drop skipLabel from visitContinue
  • 854665b Collapse duplicated package prefixes in _javac source jar paths.
  • 3588433 Introduce -XepOpt:Nullness:LikelyPublicApiOnly=true for annotating only API...
  • b8a8390 Merge CollectionUndefinedEquality and ArrayAsKeyOfSetOrMap into UndefinedEquals.
  • 59f98c3 Allow == comparisons on Tree instances.
  • Additional commits viewable in compare view

Updates com.uber.nullaway:nullaway from 0.14.2 to 0.14.3

Release notes

Sourced from com.uber.nullaway:nullaway's releases.

NullAway 0.14.3

Many bug fixes in this release. Thanks especially to @​vlsi and @​subhramit for all the contributions! As they are now committers, their many contributions are not credited individually below.

Two bug fixes of note are #2005 and #2003, which may lead to new warnings even outside JSpecify mode.

We have also added initial support for @PolyNull in library models in #1813. We will continue to enhance this support, but it should be helpful in removing some false positives from JSpecifyExperimental mode.

  • Allow configuring suppression-remover source encoding (#1894)
  • Compute a call's executable type once per generic inference by @​ericschlarmann (#1896)
  • Skip nested annotation restoration from raw source types (#1898)
  • Refine argument nullness after Objects.equals calls by @​Beluomini (#1900)
  • Keep nullable map values nullable after containsKey (#1902)
  • Read nullable fields from JSpecify JDK models into astubx (#1901)
  • Avoid initialization-check crashes in @NullMarked constructors by @​ZedingZhang (#1929)
  • Store types of implicit lambda parameters during inference (#1930)
  • Compute erasure before binary promotion (#1935)
  • Preserve captured type variables during constraint generation (#1941)
  • Cache conversion of MethodSymbols to MethodRefs (#1964)
  • Restore nullness annotations from implicit wildcard bounds (#1967)
  • Use call-specific generic inference variables (#1965)
  • Account for nullable map values in getOrDefault (#1985)
  • Fix crash in map callbacks after an unmarked or suppressed filter predicate (#1996)
  • Strip reference casts when computing access paths (#1997)
  • Handle negated null checks in multi-argument boolean contracts (#1998)
  • Skip parentheses around a lambda or method reference passed to unmarked code (#1999)
  • Fix crash on method references to annotated array types (#2000)
  • Skip a lower-bounded wildcard when restoring annotations on a call type (#2001)
  • Strip parentheses before handlers match stream callbacks and boolean literals (#2002)
  • Check explicitly typed lambda parameters against unmarked interface methods (#2003)
  • Add PolyNull library models and apply them to Optional.orElseGet and Map.computeIfAbsent (#1813)
  • Report unboxing of a @​Nullable operand inside a primitive conditional expression (#2005)
  • Report unboxing of a @​Nullable result inside a primitive switch expression (#2006)
  • Fix crash on null-marked code nested in unmarked lambdas and local classes (#2007)
  • Strip parentheses before the futures and gRPC handlers match an argument (#2010)
  • Recognize boolean constants behind a cast in EnsuresNonNullIf and stream filters (#2011)
  • Treat a parenthesized lambda or method reference like an unwrapped one in generics checks (#2012)
  • Recognize a cast null check in a boolean contract argument (#2013)
  • Keep the access path of a map key, call argument, or array index cast to its own type (#2014)
  • Check nested nullness of explicitly typed lambda parameters (#2015)
  • Keep distinct constant map keys and call arguments on distinct access paths (#2016)
  • Apply conditional library return models to method references (#1968)
  • Reject conflicting fixed parameter models regardless of PolyNull (#2025)
  • Keep the boxing wrapper in the identity of a variable map key (#2017)
  • Maintenance
    • Report diff coverage after each test run, quoting the changed lines the run did not execute and the branches it took one way, and writing the whole report to <module>/build/reports/diff-coverage/test.txt; a // diff-coverage: ignore comment moves a line out of that list without changing the counts (#1833)

... (truncated)

Changelog

Sourced from com.uber.nullaway:nullaway's changelog.

Version 0.14.3

Many bug fixes in this release. Thanks especially to @​vlsi and @​subhramit for all the contributions! As they are now committers, their many contributions are not credited individually below.

Two bug fixes of note are #2005 and #2003, which may lead to new warnings even outside JSpecify mode.

We have also added initial support for @PolyNull in library models in #1813. We will continue to enhance this support, but it should be helpful in removing some false positives from JSpecifyExperimental mode.

  • Allow configuring suppression-remover source encoding (#1894)
  • Compute a call's executable type once per generic inference by @​ericschlarmann (#1896)
  • Skip nested annotation restoration from raw source types (#1898)
  • Refine argument nullness after Objects.equals calls by @​Beluomini (#1900)
  • Keep nullable map values nullable after containsKey (#1902)
  • Read nullable fields from JSpecify JDK models into astubx (#1901)
  • Avoid initialization-check crashes in @NullMarked constructors by @​Z...

    Description has been truncated

@dependabot
build(deps): bump the maven-minor-and-patch group with 34 updates
aa9323b 
Bumps the maven-minor-and-patch group with 34 updates:

| Package | From | To |
| --- | --- | --- |
| [tools.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) | `3.1.7` | `3.2.4` |
| [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) | `2.21.7` | `2.22.4` |
| org.apache.tomcat.embed:tomcat-embed-core | `11.0.26` | `11.0.27` |
| org.apache.tomcat.embed:tomcat-embed-el | `11.0.26` | `11.0.27` |
| org.apache.tomcat.embed:tomcat-embed-websocket | `11.0.26` | `11.0.27` |
| [org.springframework.boot:spring-boot-dependencies](https://github.com/spring-projects/spring-boot) | `4.1.1` | `4.1.2` |
| [org.springdoc:springdoc-openapi-starter-webmvc-api](https://github.com/springdoc/springdoc-openapi) | `3.1.1` | `3.2.0` |
| [net.jqwik:jqwik](https://github.com/jqwik-team/jqwik) | `1.9.3` | `1.10.2` |
| [dk.brics:automaton](https://github.com/cs-au-dk/dk.brics.automaton) | `1.12-4` | `1.13-1` |
| [com.nimbusds:nimbus-jose-jwt](https://bitbucket.org/connect2id/nimbus-jose-jwt) | `10.4` | `10.10` |
| org.apache.zookeeper:zookeeper | `3.6.4` | `3.9.6` |
| [com.google.errorprone:error_prone_core](https://github.com/google/error-prone) | `2.50.0` | `2.51.0` |
| [com.uber.nullaway:nullaway](https://github.com/uber/NullAway) | `0.14.2` | `0.14.3` |
| [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.6.0` | `3.6.1` |
| [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire) | `3.6.0` | `3.6.1` |
| [org.apache.maven.plugins:maven-dependency-plugin](https://github.com/apache/maven-dependency-plugin) | `3.7.0` | `3.11.0` |
| [org.jacoco:jacoco-maven-plugin](https://github.com/jacoco/jacoco) | `0.8.15` | `0.8.16` |
| [com.github.spotbugs:spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) | `4.10.4.1` | `4.10.5.0` |
| [org.apache.maven.plugins:maven-source-plugin](https://github.com/apache/maven-source-plugin) | `3.3.1` | `3.4.0` |
| [org.sonatype.central:central-publishing-maven-plugin](https://github.com/sonatype-nexus-community/central-publishing-maven-plugin) | `0.11.0` | `0.12.0` |
| [io.dropwizard.metrics:metrics-core](https://github.com/dropwizard/metrics) | `4.1.12.1` | `4.2.40` |
| [commons-logging:commons-logging](https://github.com/apache/commons-logging) | `1.3.6` | `1.4.0` |
| [org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin) | `3.6.1` | `3.6.2` |
| [io.netty:netty-bom](https://github.com/netty/netty) | `4.1.137.Final` | `4.2.19.Final` |
| org.apache.hive:hive-jdbc | `4.0.1` | `4.2.1` |
| org.apache.hbase:hbase-shaded-client-byo-hadoop | `2.5.16-hadoop3` | `2.6.7-hadoop3` |
| org.apache.hbase:hbase-server | `2.5.16-hadoop3` | `2.6.7-hadoop3` |
| commons-io:commons-io | `2.21.0` | `2.22.0` |
| [commons-cli:commons-cli](https://github.com/apache/commons-cli) | `1.9.0` | `1.11.0` |
| [org.apache.maven.plugins:maven-shade-plugin](https://github.com/apache/maven-shade-plugin) | `3.6.1` | `3.6.2` |
| [org.codehaus.woodstox:stax2-api](https://github.com/FasterXML/stax2-api) | `4.2.2` | `4.3.2` |
| [org.apache.commons:commons-text](https://github.com/apache/commons-text) | `1.14.0` | `1.15.0` |
| org.apache.hadoop.thirdparty:hadoop-shaded-guava | `1.1.1` | `1.5.0` |
| org.apache.commons:commons-collections4 | `4.4` | `4.6.0` |


Updates `tools.jackson:jackson-bom` from 3.1.7 to 3.2.4
- [Commits](FasterXML/jackson-bom@jackson-bom-3.1.7...jackson-bom-3.2.4)

Updates `com.fasterxml.jackson:jackson-bom` from 2.21.7 to 2.22.4
- [Commits](FasterXML/jackson-bom@jackson-bom-2.21.7...jackson-bom-2.22.4)

Updates `org.apache.tomcat.embed:tomcat-embed-core` from 11.0.26 to 11.0.27

Updates `org.apache.tomcat.embed:tomcat-embed-el` from 11.0.26 to 11.0.27

Updates `org.apache.tomcat.embed:tomcat-embed-websocket` from 11.0.26 to 11.0.27

Updates `org.apache.tomcat.embed:tomcat-embed-el` from 11.0.26 to 11.0.27

Updates `org.apache.tomcat.embed:tomcat-embed-websocket` from 11.0.26 to 11.0.27

Updates `org.springframework.boot:spring-boot-dependencies` from 4.1.1 to 4.1.2
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v4.1.1...v4.1.2)

Updates `org.springdoc:springdoc-openapi-starter-webmvc-api` from 3.1.1 to 3.2.0
- [Release notes](https://github.com/springdoc/springdoc-openapi/releases)
- [Changelog](https://github.com/springdoc/springdoc-openapi/blob/main/CHANGELOG.md)
- [Commits](springdoc/springdoc-openapi@v3.1.1...v3.2.0)

Updates `net.jqwik:jqwik` from 1.9.3 to 1.10.2
- [Release notes](https://github.com/jqwik-team/jqwik/releases)
- [Commits](jqwik-team/jqwik@1.9.3...1.10.2)

Updates `dk.brics:automaton` from 1.12-4 to 1.13-1
- [Release notes](https://github.com/cs-au-dk/dk.brics.automaton/releases)
- [Changelog](https://github.com/cs-au-dk/dk.brics.automaton/blob/master/ChangeLog)
- [Commits](https://github.com/cs-au-dk/dk.brics.automaton/commits)

Updates `com.nimbusds:nimbus-jose-jwt` from 10.4 to 10.10
- [Changelog](https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt)
- [Commits](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/10.10..10.4)

Updates `org.apache.zookeeper:zookeeper` from 3.6.4 to 3.9.6

Updates `com.google.errorprone:error_prone_core` from 2.50.0 to 2.51.0
- [Release notes](https://github.com/google/error-prone/releases)
- [Commits](google/error-prone@v2.50.0...v2.51.0)

Updates `com.uber.nullaway:nullaway` from 0.14.2 to 0.14.3
- [Release notes](https://github.com/uber/NullAway/releases)
- [Changelog](https://github.com/uber/NullAway/blob/master/CHANGELOG.md)
- [Commits](uber/NullAway@v0.14.2...v0.14.3)

Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.6.0 to 3.6.1
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.6.0...surefire-3.6.1)

Updates `org.apache.maven.plugins:maven-failsafe-plugin` from 3.6.0 to 3.6.1
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.6.0...surefire-3.6.1)

Updates `org.apache.maven.plugins:maven-failsafe-plugin` from 3.6.0 to 3.6.1
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.6.0...surefire-3.6.1)

Updates `org.apache.maven.plugins:maven-dependency-plugin` from 3.7.0 to 3.11.0
- [Release notes](https://github.com/apache/maven-dependency-plugin/releases)
- [Commits](apache/maven-dependency-plugin@maven-dependency-plugin-3.7.0...maven-dependency-plugin-3.11.0)

Updates `org.jacoco:jacoco-maven-plugin` from 0.8.15 to 0.8.16
- [Release notes](https://github.com/jacoco/jacoco/releases)
- [Commits](jacoco/jacoco@v0.8.15...v0.8.16)

Updates `com.github.spotbugs:spotbugs-maven-plugin` from 4.10.4.1 to 4.10.5.0
- [Release notes](https://github.com/spotbugs/spotbugs-maven-plugin/releases)
- [Commits](spotbugs/spotbugs-maven-plugin@spotbugs-maven-plugin-4.10.4.1...spotbugs-maven-plugin-4.10.5.0)

Updates `org.apache.maven.plugins:maven-source-plugin` from 3.3.1 to 3.4.0
- [Release notes](https://github.com/apache/maven-source-plugin/releases)
- [Commits](apache/maven-source-plugin@maven-source-plugin-3.3.1...maven-source-plugin-3.4.0)

Updates `org.sonatype.central:central-publishing-maven-plugin` from 0.11.0 to 0.12.0
- [Release notes](https://github.com/sonatype-nexus-community/central-publishing-maven-plugin/releases)
- [Commits](https://github.com/sonatype-nexus-community/central-publishing-maven-plugin/commits/release-0.12.0)

Updates `io.dropwizard.metrics:metrics-core` from 4.1.12.1 to 4.2.40
- [Release notes](https://github.com/dropwizard/metrics/releases)
- [Commits](dropwizard/metrics@v4.1.12.1...v4.2.40)

Updates `commons-logging:commons-logging` from 1.3.6 to 1.4.0
- [Changelog](https://github.com/apache/commons-logging/blob/master/RELEASE-NOTES.txt)
- [Commits](apache/commons-logging@rel/commons-logging-1.3.6...rel/commons-logging-1.4.0)

Updates `org.codehaus.mojo:build-helper-maven-plugin` from 3.6.1 to 3.6.2
- [Release notes](https://github.com/mojohaus/build-helper-maven-plugin/releases)
- [Commits](mojohaus/build-helper-maven-plugin@3.6.1...3.6.2)

Updates `io.netty:netty-bom` from 4.1.137.Final to 4.2.19.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.137.Final...netty-4.2.19.Final)

Updates `org.apache.hive:hive-jdbc` from 4.0.1 to 4.2.1

Updates `org.apache.hbase:hbase-shaded-client-byo-hadoop` from 2.5.16-hadoop3 to 2.6.7-hadoop3

Updates `org.apache.hbase:hbase-server` from 2.5.16-hadoop3 to 2.6.7-hadoop3

Updates `commons-io:commons-io` from 2.21.0 to 2.22.0

Updates `commons-cli:commons-cli` from 1.9.0 to 1.11.0
- [Changelog](https://github.com/apache/commons-cli/blob/master/RELEASE-NOTES.txt)
- [Commits](apache/commons-cli@rel/commons-cli-1.9.0...rel/commons-cli-1.11.0)

Updates `org.apache.maven.plugins:maven-shade-plugin` from 3.6.1 to 3.6.2
- [Release notes](https://github.com/apache/maven-shade-plugin/releases)
- [Commits](apache/maven-shade-plugin@maven-shade-plugin-3.6.1...maven-shade-plugin-3.6.2)

Updates `org.codehaus.woodstox:stax2-api` from 4.2.2 to 4.3.2
- [Commits](FasterXML/stax2-api@stax2-api-4.2.2...stax2-api-4.3.2)

Updates `org.apache.commons:commons-text` from 1.14.0 to 1.15.0
- [Changelog](https://github.com/apache/commons-text/blob/master/RELEASE-NOTES.txt)
- [Commits](apache/commons-text@rel/commons-text-1.14.0...rel/commons-text-1.15.0)

Updates `org.apache.hadoop.thirdparty:hadoop-shaded-guava` from 1.1.1 to 1.5.0

Updates `org.apache.commons:commons-collections4` from 4.4 to 4.6.0

Updates `org.apache.hbase:hbase-server` from 2.5.16-hadoop3 to 2.6.7-hadoop3

---
updated-dependencies:
- dependency-name: tools.jackson:jackson-bom
  dependency-version: 3.2.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: com.fasterxml.jackson:jackson-bom
  dependency-version: 2.22.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.tomcat.embed:tomcat-embed-core
  dependency-version: 11.0.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.tomcat.embed:tomcat-embed-el
  dependency-version: 11.0.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.tomcat.embed:tomcat-embed-websocket
  dependency-version: 11.0.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.tomcat.embed:tomcat-embed-el
  dependency-version: 11.0.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.tomcat.embed:tomcat-embed-websocket
  dependency-version: 11.0.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.springframework.boot:spring-boot-dependencies
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.springdoc:springdoc-openapi-starter-webmvc-api
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: net.jqwik:jqwik
  dependency-version: 1.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: dk.brics:automaton
  dependency-version: 1.13-1
  dependency-type: direct:production
  dependency-group: maven-minor-and-patch
- dependency-name: com.nimbusds:nimbus-jose-jwt
  dependency-version: '10.10'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.zookeeper:zookeeper
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: com.google.errorprone:error_prone_core
  dependency-version: 2.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: com.uber.nullaway:nullaway
  dependency-version: 0.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-failsafe-plugin
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-failsafe-plugin
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-dependency-plugin
  dependency-version: 3.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.jacoco:jacoco-maven-plugin
  dependency-version: 0.8.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: com.github.spotbugs:spotbugs-maven-plugin
  dependency-version: 4.10.5.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-source-plugin
  dependency-version: 3.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.sonatype.central:central-publishing-maven-plugin
  dependency-version: 0.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: io.dropwizard.metrics:metrics-core
  dependency-version: 4.2.40
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: commons-logging:commons-logging
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.codehaus.mojo:build-helper-maven-plugin
  dependency-version: 3.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: io.netty:netty-bom
  dependency-version: 4.2.19.Final
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.hive:hive-jdbc
  dependency-version: 4.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.hbase:hbase-shaded-client-byo-hadoop
  dependency-version: 2.6.7-hadoop3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.hbase:hbase-server
  dependency-version: 2.6.7-hadoop3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: commons-io:commons-io
  dependency-version: 2.22.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: commons-cli:commons-cli
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-shade-plugin
  dependency-version: 3.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.codehaus.woodstox:stax2-api
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.commons:commons-text
  dependency-version: 1.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.hadoop.thirdparty:hadoop-shaded-guava
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.commons:commons-collections4
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.hbase:hbase-server
  dependency-version: 2.6.7-hadoop3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added Dependencies Pull requests that update a dependency file Java Pull requests that update Java code labels Oct 29, 2026
@github-actions

github-actions Bot commented Oct 29, 2026

Copy link
Copy Markdown

Dependency Review

The following issues were found:

  • ✅ 0 vulnerable package(s)
  • ❌ 11 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.

View full job summary

@qianmoQ qianmoQ closed this Nov 1, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/maven/maven-minor-and-patch-34a514ca3d branch November 1, 2026 04:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Dependencies Pull requests that update a dependency file Java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@qianmoQ