Skip to content

chore(deps): bump the maven-version-updates group across 1 directory with 21 updates - #104

Closed
dependabot[bot] wants to merge 1 commit into
betafrom
dependabot/maven/maven-version-updates-a016f5f852
Closed

chore(deps): bump the maven-version-updates group across 1 directory with 21 updates#104
dependabot[bot] wants to merge 1 commit into
betafrom
dependabot/maven/maven-version-updates-a016f5f852

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 30, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the maven-version-updates group with 21 updates in the / directory:

Package From To
org.bouncycastle:bcprov-jdk18on 1.81 1.82
org.bouncycastle:bcpkix-jdk18on 1.81 1.82
com.google.errorprone:error_prone_core 2.40.0 2.42.0
com.uber.nullaway:nullaway 0.12.7 0.12.10
com.nimbusds:nimbus-jose-jwt 10.4 10.5
com.nimbusds:oauth2-oidc-sdk 11.26 11.29.1
org.apache.httpcomponents.client5:httpclient5 5.5 5.5.1
com.fasterxml.jackson.core:jackson-core 2.19.2 2.20.0
com.fasterxml.jackson.core:jackson-annotations 2.19.2 2.20.0
com.fasterxml.jackson.core:jackson-databind 2.19.2 2.20.0
com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider 2.19.2 2.20.0
com.fasterxml.jackson.datatype:jackson-datatype-jsr310 2.19.2 2.20.0
org.openapitools:jackson-databind-nullable 0.2.6 0.2.7
com.google.errorprone:error_prone_annotations 2.40.0 2.42.0
com.github.spotbugs:spotbugs-maven-plugin 4.9.3.2 4.9.6.0
org.apache.maven.plugins:maven-compiler-plugin 3.14.0 3.14.1
org.apache.maven.plugins:maven-surefire-plugin 3.5.3 3.5.4
org.apache.maven.plugins:maven-javadoc-plugin 3.11.2 3.12.0
org.apache.maven.plugins:maven-failsafe-plugin 3.5.3 3.5.4
com.diffplug.spotless:spotless-maven-plugin 2.46.0 3.0.0
org.sonatype.central:central-publishing-maven-plugin 0.8.0 0.9.0

Updates org.bouncycastle:bcprov-jdk18on from 1.81 to 1.82

Changelog

Sourced from org.bouncycastle:bcprov-jdk18on's changelog.

2.1.1 Version Release: 1.82 Date:      2025, 17th September.

... (truncated)

Commits

Updates org.bouncycastle:bcpkix-jdk18on from 1.81 to 1.82

Changelog

Sourced from org.bouncycastle:bcpkix-jdk18on's changelog.

2.1.1 Version Release: 1.82 Date:      2025, 17th September.

... (truncated)

Commits

Updates com.google.errorprone:error_prone_core from 2.40.0 to 2.42.0

Release notes

Sourced from com.google.errorprone:error_prone_core's releases.

Error Prone 2.42.0

New checks:

Changes:

  • The return type of ASTHelpers.asFlagSet has changed. The previous type was EnumSet<Flags.Flag>, where Flags.Flag is an enum in the javac class Flags. A recent JDK change has replaced that enum with a new top-level enum called FlagsEnum. It is not possible to change ASTHelpers.asFlagSet in a way that would be type-safe and compatible with the enums from JDKs both before and after the change. Instead, the method now returns ImmutableSet<String>, where the strings come from the toString() of the enum constants. That means they are "native", "abstract", etc.
  • Flag IO.print[ln]() in SystemOut.

Full changelog: google/error-prone@v2.41.0...v2.42.0

Error Prone 2.41.0

New checks:

  • EffectivelyPrivate: Detect declarations that have public or protected modifiers, but are effectively private

Changes:

  • Skip BooleanLiteral findings if the target type is boxed (#5134)

Full changelog: google/error-prone@v2.40.0...v2.41.0

Commits
  • 52b6180 Release Error Prone 2.42.0
  • 691c64a Flag IO.print[ln]() in SystemOut.
  • 0b751cd ExpicitArrayForVarargs: flag unnecessary explicit construction of an array to...
  • 982fe20 Tweak links to point to newer versions.
  • a2df97f [StatementSwitchToExpressionSwitch] fix bug where case null can sometimes b...
  • e691be5 Fix (behind a flag) a silly bug in RedundantSetterCall.
  • ce1a422 Add Durations.wait() to WaitMatchers.waitMethodWithTimeout (and make them...
  • da03fea Update MethodCanBeStatic to be able to detect and trigger on Guice @​Provides ...
  • 83e6582 RedundantSetterCall: note that setFooValue and setFooBytes can be aliases for...
  • db62c8c Automated rollback of commit e1b16e24461d90f2b11f8213a68bfccc0426d4f3.
  • Additional commits viewable in compare view

Updates com.uber.nullaway:nullaway from 0.12.7 to 0.12.10

Release notes

Sourced from com.uber.nullaway:nullaway's releases.

NullAway 0.12.10

This release contains significant improvements to inference support for generic method calls in JSpecify mode (#1075). We expect that many more valid calls will pass NullAway, but that some new bugs may have been introduced. Please report any issues that you see. There is also a new flag, -XepOpt:NullAway:WarnOnGenericInferenceFailure to make NullAway report a warning when inference fails, to help identify any issues.

  • Improved inference for generic method calls (#1244)
  • Suppress CastToNonNull warnings for @NullUnmarked method calls by @​raccoonback (#1258)
  • JSpecify: Fix crash when overriding with raw types (#1265)
  • Better handle calls to super constructors and superclass methods in JSpecify mode (#1248)
  • issue-1250 pattern matching for instanceof in switch case by @​dhruv-agr (#1259)
  • Account for annotations in extends / implements when computing view as supertype (#1266)
  • Bug fix with type substitutions after inference (#1277)
  • JSpecify: Improve error messages for type incompatibility at pseudo-assignments (#1279)
  • Support java.util.Objects.toString() by @​gulikoza (#1283)
  • Record when generic method inference fails (#1280)
  • issue 1275 - report unboxing warning for for-each loop by @​dhruv-agr (#1281)
  • Abstract iterating over invocation arguments (#1284)
  • Invoke generic method inference in more places (#1286)
  • Maintenance
    • Build Spring with snapshot build as a CI job (#1251)
    • Add more instance fields to GenericsChecks (#1256)
    • remove unneeded checkNotCall call (#1257)
    • Fail build on JDK 21 versions before 21.0.8 (#1261)
    • Clarify JDK version to use for best JSpecify support (#1269)
    • Simplified set of CI jobs (#1271)
    • Build: upgrade to Gradle 9 + AGP 8.7.2 (#1270)
    • Compile with JDK 24 (#1276)
    • Don't use deprecated buildDir by @​mernst (#1278)

NullAway 0.12.9

  • Add a case in our inference for generic method calls (#1240)
  • Add library model for Apache Commons CollectionUtils.isNotEmpty, Amazon CollectionUtils.IsNullOrEmpty, and a couple Amazon StringUtils methods (#1242)
  • Maintenance
    • Fix maven central link in RELEASING.md (#1237)
    • Update to Error Prone 2.41.0 (#1239)
    • Add tests for gh-1246 (#1247)
    • Test reading JSpecify annotations from bytecodes on JDK 21 (#1245)

NullAway 0.12.8

  • Document interactions between Guava and JSpecify mode in README (#1208)
  • JSpecify: handle nullness annotations from extends / inherits clauses (#1211)
  • Allowing NewClassTree to be passed into getGenericParameterNullnessAtInvocation (#1210)
  • Support @​NullMarked on modules (#1216)
  • Handle NewClassTree in compareGenericTypeParameterNullabilityForCall(#1212) (#1217)
  • More flexible handling of AssertJ isNotNull methods (#1221)
  • Support AssertJ hasSize() (#1229)
  • Inference of generic method type arguments based on returns and parameter passing (#1226)
  • Prototype implementation of javac plugin to serialize nullness annotations (#1225)
  • Add AdditionalSuppressionNames configuration option (#1231)

... (truncated)

Changelog

Sourced from com.uber.nullaway:nullaway's changelog.

Version 0.12.10

This release contains significant improvements to inference support for generic method calls in JSpecify mode (#1075). We expect that many more valid calls will pass NullAway, but that some new bugs may have been introduced. Please report any issues that you see. There is also a new flag, -XepOpt:NullAway:WarnOnGenericInferenceFailure to make NullAway report a warning when inference fails, to help identify any issues.

  • Improved inference for generic method calls (#1244)
  • Suppress CastToNonNull warnings for @NullUnmarked method calls by @​raccoonback (#1258)
  • JSpecify: Fix crash when overriding with raw types (#1265)
  • Better handle calls to super constructors and superclass methods in JSpecify mode (#1248)
  • issue-1250 pattern matching for instanceof in switch case by @​dhruv-agr (#1259)
  • Account for annotations in extends / implements when computing view as supertype (#1266)
  • Bug fix with type substitutions after inference (#1277)
  • JSpecify: Improve error messages for type incompatibility at pseudo-assignments (#1279)
  • Support java.util.Objects.toString() by @​gulikoza (#1283)
  • Record when generic method inference fails (#1280)
  • issue 1275 - report unboxing warning for for-each loop by @​dhruv-agr (#1281)
  • Abstract iterating over invocation arguments (#1284)
  • Invoke generic method inference in more places (#1286)
  • Maintenance
    • Build Spring with snapshot build as a CI job (#1251)
    • Add more instance fields to GenericsChecks (#1256)
    • remove unneeded checkNotCall call (#1257)
    • Fail build on JDK 21 versions before 21.0.8 (#1261)
    • Clarify JDK version to use for best JSpecify support (#1269)
    • Simplified set of CI jobs (#1271)
    • Build: upgrade to Gradle 9 + AGP 8.7.2 (#1270)
    • Compile with JDK 24 (#1276)
    • Don't use deprecated buildDir by @​mernst (#1278)

Version 0.12.9

  • Add a case in our inference for generic method calls (#1240)
  • Add library model for Apache Commons CollectionUtils.isNotEmpty, Amazon CollectionUtils.IsNullOrEmpty, and a couple Amazon StringUtils methods (#1242)
  • Maintenance
    • Fix maven central link in RELEASING.md (#1237)
    • Update to Error Prone 2.41.0 (#1239)
    • Add tests for gh-1246 (#1247)
    • Test reading JSpecify annotations from bytecodes on JDK 21 (#1245)

Version 0.12.8

  • Document interactions between Guava and JSpecify mode in README (#1208)
  • JSpecify: handle nullness annotations from extends / inherits clauses (#1211)
  • Allowing NewClassTree to be passed into getGenericParameterNullnessAtInvocation (#1210)
  • Support @​NullMarked on modules (#1216)
  • Handle NewClassTree in compareGenericTypeParameterNullabilityForCall(#1212) (#1217)
  • More flexible handling of AssertJ isNotNull methods (#1221)

... (truncated)

Commits
  • 13580d5 Prepare for release 0.12.10.
  • f8c214b Update changelog for release 0.12.10 (#1292)
  • 2e578d6 Invoke generic method inference in more places (#1286)
  • c187bf5 Abstract iterating over invocation arguments (#1284)
  • dd0da6d issue 1275 - report unboxing warning for for-each loop (#1281)
  • 533986c Record when generic method inference fails (#1280)
  • cb72c5a Support java.util.Objects.toString() (#1283)
  • 8f40500 JSpecify: Improve error messages for type incompatibility at pseudo-assignmen...
  • 9272d8b Bug fix with type substitutions after inference (#1277)
  • 66e9f57 Don't use deprecated buildDir (#1278)
  • Additional commits viewable in compare view

Updates com.nimbusds:nimbus-jose-jwt from 10.4 to 10.5

Changelog

Sourced from com.nimbusds:nimbus-jose-jwt's changelog.

10.4 (2025-07-19) * Creates a hierarchy of Option interfaces, extended by JWSSignerOption, JWEEncrypterOption and JWEDecrypterOption. Intended to provide optional configuration parameters to RSASSASigner, ECDSASigner, RSADecrypter, etc. * Introduces CipherMode implementing JWEEncrypterOption and JWEDecrypterOption, to specify a preferred JCA Cipher mode, such as MODE_ENCRYPT / MODE_DECRYPT when the default MODE_WRAP / MODE_UNWRAP is not supported by the JCA provider (iss #576). * Updates RSAEncrypter and RSADecrypter to support the JWEEncrypterOption CipherMode.ENCRYPT_DECRYPT (iss #576). * Factors out OptionUtils.ensureMinRSAPrivateKeySize. * Deprecates OptionUtils.optionIsPresent.

10.4.1 (2025-08-05) * Adds "requires java.sql" to module com.nimbusds.jose.jwt (iss #595).

10.4.2 (2025-08-14) * Updates GSon to 2.13.1. * Updates BouncyCastle to 1.81.

10.5 (2025-09-05) * Support for specifying a ScheduledExecutorService instance in RefreshAheadCachingJWKSetSource and JWKSourceBuilder (iss #592).

Commits
  • 584951f Adds support for specifying the ScheduledExecutorService-instance in RefreshA...
  • adf2576 [maven-release-plugin] prepare for next development iteration
  • 436fb18 Add tests for JWKSourceBuilder and RefreshAheadCachingJWKSetSource
  • d4137db Adds "requires java.sql" to module com.nimbusds.jose.jwt (iss #595)
  • c6c8025 [maven-release-plugin] prepare release 10.4.1
  • e7c7a8c [maven-release-plugin] prepare for next development iteration
  • b33b54b Bumps GSon and BouncyCastle
  • 3eeaada [maven-release-plugin] prepare release 10.4.2
  • 2aa473f [maven-release-plugin] prepare for next development iteration
  • d52acf5 Merged in iss592 (pull request #129)
  • Additional commits viewable in compare view

Updates com.nimbusds:oauth2-oidc-sdk from 11.26 to 11.29.1

Changelog

Sourced from com.nimbusds:oauth2-oidc-sdk's changelog.

version 1.0 (2012-05-29) * First official release with authorisation endpoint, token endpoint, check ID endpoint and UserInfo endpoint support. * JSON Web Tokens (JWTs) support through the Nimbus-JWT library. * Language Tags (RFC 5646) support through the Nimbus-LangTag library. * JSON support through the JSON Smart library.

version 2.0 (2013-05-13) * Intermediary development release with Maven build, published to Maven Central.

version 2.1 (2013-06-06) * Updates the APIs to OpenID Connect Messages draft 20, OpenID Connect Standard draft 21, OpenID Connect Discovery draft 17 and OpenID Connect Registration draft 19. * Major refactoring of the APIs for greater simplicity. * Adds JUnit tests.

version 2.2 (2013-06-18) * Refactors dynamic OpenID Connect client registration. * Adds partial support of the OAuth 2.0 Dynamic Client Registration Protocol (draft-ietf-oauth-dyn-reg-12). * Optimises parsing of request parameters consisting of one or more tokens (scope, response type, etc).

version 2.3 (2013-06-19) * Renames OAuth 2.0 dynamic client registration package. * Adds ClientInformation.getClientMetadata() method. * Adds OIDCClientInformation class.

version 2.4 (2013-06-20) * Adds static OIDCClientInformation.parse(JSONObject) method.

version 2.5 (2013-06-22) * Adds support OAuth 2.0 dynamic client update. * Adds OpenID Connect dynamic client registration classes.

version 2.6 (2013-06-25) * Enforces order of preference of ACR values in OpenID Connect client metadata, as required by the specification. * Documentation and performance improvements.

version 2.7 (2013-06-26) * Switches Identifier generation to java.security.SecureRandom.

version 2.8 (2013-06-30) * Fixes serialisation and assignment bugs in ClientMetadata. * Switches Secret generation to java.security.SecureRandom.

version 2.9 (2013-09-17)

... (truncated)

Commits
  • 04a94cf [maven-release-plugin] prepare for next development iteration
  • 6ef84cc fix: allow some leniency with uri comparisons for issuer
  • ef401a7 Fixes JakartaServletUtils JavaDoc typos
  • 6f727b4 JakartaServletUtils.createHTTPRequest must parse query string params for POST...
  • f0faf6e Updates to Nimbus JOSE+JWT 10.4
  • 0eb6157 Migrates to central-publishing-maven-plugin
  • f210078 [maven-release-plugin] prepare release 11.26.1
  • 38e6027 [maven-release-plugin] prepare for next development iteration
  • 1488221 Merge branch 'master' of https://bitbucket.org/connect2id/oauth-2.0-sdk-with-...
  • 6eafee5 feat: rework issuer compare with new resolve method
  • Additional commits viewable in compare view

Updates org.apache.httpcomponents.client5:httpclient5 from 5.5 to 5.5.1

Changelog

Sourced from org.apache.httpcomponents.client5:httpclient5's changelog.

Release 5.5.1

This is a maintenance release that fixes several defects in the connection management code and a regression in the DIGEST authentication reported since the previous release. It also upgrades HttpCore to version 5.3.6.

Change Log

  • HTTPCLIENT-2391: Improved GRACEGUL shutdown of ExecutorService used internally by async clients. Contributed by Oleg Kalnichevski

  • Bug fix: Use a 1 second timeout when closing out connections inside a connection pool lock. Contributed by Oleg Kalnichevski

  • Clarified the behavior of the protocol-level responseTimeout and the connection management level socketTimeout and their interrelation. Contributed by ChangYong

  • Bug fix: Connection managers to ensure open connections have a socket timeout set based on ConnectionConfig upon lease. Contributed by Oleg Kalnichevski

  • HTTPCLIENT-2393: Remove rspauth attribute from Authorization DIGEST header (#716) RFC 7616 compliance: rspauth is server-side (Authentication-Info 3.5) only. Contributed by Arturo Bernal

  • HTTPCLIENT-2386: Classic transport to use the connect timeout as a default if the TLS timeout has not been explicitly set. Contributed by Oleg Kalnichevski

  • HTTPCLIENT-2384: Socket options related to TcpKeepAlive are ignored. Contributed by Oleg Kalnichevski

  • HTTPCLIENT-2371: Logging of request re-execution at INFO priority. Contributed by Oleg Kalnichevski

  • HTTPCLIENT-2379: Fixed a defect in H2SharingConnPool causing an IllegalStateException when releasing the same connection from multiple threads. (#663) Contributed by Arturo Bernal abernal@apache.org

  • Fixed the behavior of the validateAfterInactivity connection setting by the async connection manager. Contributed by Ryan Schmitt

  • HTTPCLIENT-2376: Fixed the problem with ContentCompressionExec not taking acceptEncoding parameter into account.

... (truncated)

Commits
  • 6a3d332 HttpClient 5.5.1 release
  • 66dea80 Updated release notes for HttpClient 5.5.1 release
  • 61f21a5 Upgraded HttpCore to version 5.3.6
  • 694394c HTTPCLIENT-2391: improved GRACEGUL shutdown of ExecutorService used internall...
  • 038b74f Bug fix: Use 1 second timeout when closing out connections inside a connectio...
  • 6675520 Clarify behavior of the protocol level responseTimeout and the connection man...
  • cb2ccda Bug fix: connections managers to ensure open connections have socket timeout ...
  • 4466cca HTTPCLIENT-2393 - remove rspauth from Authorization (#716)
  • da1a8e0 Imporved TestAsyncClient wiring; added internal methods to get the underlying...
  • ab40ec9 Upgraded HttpCore to version 5.3.5
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-core from 2.19.2 to 2.20.0

Commits
  • ea0830a [maven-release-plugin] prepare release jackson-core-2.20.0
  • e16733a Prep for 2.20.0
  • 93deb38 Drop RC from version pre-2.20.0 release
  • f0bcc3c Handle deprecation warnings
  • 6e70d08 Fix #1462: deprecate JsonFactory.createParser(URL) (#1464)
  • 588cc76 Post release version bump
  • 018f9e1 [maven-release-plugin] prepare for next development iteration
  • 360e498 [maven-release-plugin] prepare release jackson-core-2.20.0-rc1
  • 538ac44 Prep for 2.20.0-rc1
  • dfbf47b Merge branch '2.19' into 2.x
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-annotations from 2.19.2 to 2.20.0

Updates com.fasterxml.jackson.core:jackson-databind from 2.19.2 to 2.20.0

Commits

Updates com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider from 2.19.2 to 2.20.0

Updates com.fasterxml.jackson.datatype:jackson-datatype-jsr310 from 2.19.2 to 2.20.0

Updates com.fasterxml.jackson.core:jackson-annotations from 2.19.2 to 2.20.0

Updates com.fasterxml.jackson.core:jackson-databind from 2.19.2 to 2.20.0

Commits

Updates com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider from 2.19.2 to 2.20.0

Updates com.fasterxml.jackson.datatype:jackson-datatype-jsr310 from 2.19.2 to 2.20.0

Updates org.openapitools:jackson-databind-nullable from 0.2.6 to 0.2.7

Release notes

Sourced from org.openapitools:jackson-databind-nullable's releases.

v0.2.7 released

What's Changed

New Contributors

Full Changelog: OpenAPITools/jackson-databind-nullable@v0.2.6...v0.2.7

Commits

Updates com.google.errorprone:error_prone_annotations from 2.40.0 to 2.42.0

Release notes

Sourced from com.google.errorprone:error_prone_annotations's releases.

Error Prone 2.42.0

New checks:

Changes:

  • The return type of ASTHelpers.asFlagSet has changed. The previous type was EnumSet<Flags.Flag>, where Flags.Flag is an enum in the javac class Flags. A recent JDK change has replaced that enum with a new top-level enum called FlagsEnum. It is not possible to change ASTHelpers.asFlagSet in a way that would be type-safe and compatible with the enums from JDKs both before and after the change. Instead, the method now returns ImmutableSet<String>, where the strings come from the toString() of the enum constants. That means they are "native", "abstract", etc.
  • Flag IO.print[ln]() in SystemOut.

Full changelog: google/error-prone@v2.41.0...v2.42.0

Error Prone 2.41.0

New checks:

  • EffectivelyPrivate: Detect declarations that have public or protected modifiers, but are effectively private

Changes:

  • Skip BooleanLiteral findings if the target type is boxed (#5134)

Full changelog: google/error-prone@v2.40.0...v2.41.0

Commits
  • 52b6180 Release Error Prone 2.42.0
  • 691c64a Flag IO.print[ln]() in SystemOut.
  • 0b751cd ExpicitArrayForVarargs: flag unnecessary explicit construction of an array to...
  • 982fe20 Tweak links to point to newer versions.
  • a2df97f [StatementSwitchToExpressionSwitch] fix bug where case null can sometimes b...
  • e691be5 Fix (behind a flag) a silly bug in RedundantSetterCall.
  • ce1a422 Add Durations.wait() to WaitMatchers.waitMethodWithTimeout (and make them...
  • da03fea Update MethodCanBeStatic to be able to detect and trigger on Guice @​Provides ...
  • 83e6582 RedundantSetterCall: note that setFooValue and setFooBytes can be aliases for...
  • db62c8c Automated rollback of commit e1b16e24461d90f2b11f8213a68bfccc0426d4f3.
  • Additional commits viewable in compare view

Updates com.github.spotbugs:spotbugs-maven-plugin from 4.9.3.2 to 4.9.6.0

Release notes

Sourced from com.github.spotbugs:spotbugs-maven-plugin's releases.

Spotbugs Maven Plugin 4.9.6.0

  • Supports spotbugs 4.9.6
  • note: 4.9.5 had a defect with detection of jakarta in servlets that was unexpected and quickly patched for this release.

Spotbugs Maven Plugin 4.9.5.0

  • Support spotbugs 4.9.5

Spotbugs Maven Plugin 4.9.4.2

Consumer

  • Add support for 'chooseVisitors'
  • Minor code cleanup
  • Still supports spotbugs 4.9.4

Producer

  • Remove add opens from jvm.config as no longer needed

Spotbugs Maven Plugin 4.9.4.1

Consumer

  • Cleanup readme to better support plugin
  • Dropped direct usage of plexus utils and commons io
  • Groovy 5 now run engine
  • Correct issue since 4.9.2.0 resulting in most runs getting spotbugs.html file incorrectly. This has been refactored to restore doxia 1 overrides to produce xml report only when not running in site lifecycle
  • Correct defects with handling of various files on disk such as exclusion filters that were introduced into 4.9.4.0. Integration tests have been applied to prevent future regression.
  • Commons io fileutils replaced by files.walk with detailed output moved to debug collection only rather than all runs
  • Normalization of path to linux style
  • Any regex usage is now precompiled
  • Use re-entrant lock for source indexer
  • Correct locale usage to use default if not given
  • Block doctype and XXE when processing xml files
  • Cleanup some fields from resources and in code never used

Producer

  • Pin versions of github actions tools
  • Run maven 3.6.3 integration test on windows to get more broad support
  • Run maven integration test on mac to get more broad support
  • Maven 4 integration tests will continue on linux
  • Fix maven wrapper perceived path traversal issue
  • Corrections to invoker to re-establish integration test verification's
  • Fix bugs in integration tests
  • Better secure xml usage in integration tests
  • Cleanup integration test warnings
  • Make sure transfer of artifacts is correctly disabled on integration tests

Spotbugs Maven Plugin 4.9.4.0

Release is large but mainly rewriting of underlying code. This supports spotbugs 4.9.4, additional details below.

Consumer

  • Supporting spotbugs 4.9.4
  • Updated all underlying dependencies

... (truncated)

Commits
  • 9e8ce9d [maven-release-plugin] prepare release spotbugs-maven-plugin-4.9.6.0
  • 96d5347 [pom] Bump spotbugs to 4.9.6
  • 3408913 Merge pull request #1210 from spotbugs/renovate/spotbugs.version
  • 13c11ab Update dependency com.github.spotbugs:spotbugs to v4.9.6
  • 560c469 Merge pull request #1208 from spotbugs/release/4.9.5.0
  • 7cf0beb [maven-release-plugin] prepare for next development iteration
  • 9cd9b6f [maven-release-plugin] prepare release spotbugs-maven-plugin-4.9.5.0
  • 3171de8 Set version for next release to 4.9.5.0 snapshot
  • 7770420 Merge pull request #1207 from spotbugs/renovate/spotbugs.version
  • 03f9784 Update dependency com.github.spotbugs:spotbugs to v4.9.5
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-compiler-plugin from 3.14.0 to 3.14.1

Release notes

Sourced from org.apache.maven.plugins:maven-compiler-plugin's releases.

3.14.1

🚀 New features and improvements

🐛 Bug Fixes

📦 Dependency updates

Commits
  • 0df6940 [maven-release-plugin] prepare release maven-compiler-plugin-3.14.1
  • 1bf9e5a Enforce asm version used here, to not depend on brittle transitive (#964)
  • f5161c4 Bump mavenVersion from 3.9.10 to 3.9.11 (#952)
  • 63846f1 Improve DeltaList behavior for large projects (#335)
  • ab3f845 Bump org.apache.maven.plugins:maven-plugins from 44 to 45
  • 164bad4 Allow to not use --module-version for the Java compiler
  • 0b76ccd Bump mavenVersion from 3.9.9 to 3.9.10
  • 5dbc9c3 Bump org.codehaus.plexus:plexus-java from 1.4.0 to 1.5.0
  • 17949d1 Bump org.apache.maven.plugins:maven-plugins from 43 to 44 (#316)
  • d44d1be Add generatedSourcesPath back to the maven project
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-surefire-plugin from 3.5.3 to 3.5.4

Release notes

Sourced from org.apache.maven.plugins:maven-surefire-plugin's releases.

3.5.4

🚀 New features and improvements

🐛 Bug Fixes

👻 Maintenance

📦 Dependency updates

@dependabot
chore(deps): bump the maven-version-updates group across 1 directory …
ba84850 
…with 21 updates

Bumps the maven-version-updates group with 21 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java) | `1.81` | `1.82` |
| [org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java) | `1.81` | `1.82` |
| [com.google.errorprone:error_prone_core](https://github.com/google/error-prone) | `2.40.0` | `2.42.0` |
| [com.uber.nullaway:nullaway](https://github.com/uber/NullAway) | `0.12.7` | `0.12.10` |
| [com.nimbusds:nimbus-jose-jwt](https://bitbucket.org/connect2id/nimbus-jose-jwt) | `10.4` | `10.5` |
| [com.nimbusds:oauth2-oidc-sdk](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions) | `11.26` | `11.29.1` |
| [org.apache.httpcomponents.client5:httpclient5](https://github.com/apache/httpcomponents-client) | `5.5` | `5.5.1` |
| [com.fasterxml.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core) | `2.19.2` | `2.20.0` |
| com.fasterxml.jackson.core:jackson-annotations | `2.19.2` | `2.20.0` |
| [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson) | `2.19.2` | `2.20.0` |
| com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider | `2.19.2` | `2.20.0` |
| com.fasterxml.jackson.datatype:jackson-datatype-jsr310 | `2.19.2` | `2.20.0` |
| [org.openapitools:jackson-databind-nullable](https://github.com/OpenAPITools/jackson-databind-nullable) | `0.2.6` | `0.2.7` |
| [com.google.errorprone:error_prone_annotations](https://github.com/google/error-prone) | `2.40.0` | `2.42.0` |
| [com.github.spotbugs:spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) | `4.9.3.2` | `4.9.6.0` |
| [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) | `3.14.0` | `3.14.1` |
| [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.5.3` | `3.5.4` |
| [org.apache.maven.plugins:maven-javadoc-plugin](https://github.com/apache/maven-javadoc-plugin) | `3.11.2` | `3.12.0` |
| [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire) | `3.5.3` | `3.5.4` |
| [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) | `2.46.0` | `3.0.0` |
| [org.sonatype.central:central-publishing-maven-plugin](https://github.com/sonatype/central-publishing-maven-plugin) | `0.8.0` | `0.9.0` |



Updates `org.bouncycastle:bcprov-jdk18on` from 1.81 to 1.82
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcpkix-jdk18on` from 1.81 to 1.82
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `com.google.errorprone:error_prone_core` from 2.40.0 to 2.42.0
- [Release notes](https://github.com/google/error-prone/releases)
- [Commits](google/error-prone@v2.40.0...v2.42.0)

Updates `com.uber.nullaway:nullaway` from 0.12.7 to 0.12.10
- [Release notes](https://github.com/uber/NullAway/releases)
- [Changelog](https://github.com/uber/NullAway/blob/master/CHANGELOG.md)
- [Commits](uber/NullAway@v0.12.7...v0.12.10)

Updates `com.nimbusds:nimbus-jose-jwt` from 10.4 to 10.5
- [Changelog](https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt)
- [Commits](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/10.5..10.4)

Updates `com.nimbusds:oauth2-oidc-sdk` from 11.26 to 11.29.1
- [Changelog](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/src/master/CHANGELOG.txt)
- [Commits](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/branches/compare/11.29.1..11.26)

Updates `org.apache.httpcomponents.client5:httpclient5` from 5.5 to 5.5.1
- [Changelog](https://github.com/apache/httpcomponents-client/blob/rel/v5.5.1/RELEASE_NOTES.txt)
- [Commits](apache/httpcomponents-client@rel/v5.5...rel/v5.5.1)

Updates `com.fasterxml.jackson.core:jackson-core` from 2.19.2 to 2.20.0
- [Commits](FasterXML/jackson-core@jackson-core-2.19.2...jackson-core-2.20.0)

Updates `com.fasterxml.jackson.core:jackson-annotations` from 2.19.2 to 2.20.0

Updates `com.fasterxml.jackson.core:jackson-databind` from 2.19.2 to 2.20.0
- [Commits](https://github.com/FasterXML/jackson/commits)

Updates `com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider` from 2.19.2 to 2.20.0

Updates `com.fasterxml.jackson.datatype:jackson-datatype-jsr310` from 2.19.2 to 2.20.0

Updates `com.fasterxml.jackson.core:jackson-annotations` from 2.19.2 to 2.20.0

Updates `com.fasterxml.jackson.core:jackson-databind` from 2.19.2 to 2.20.0
- [Commits](https://github.com/FasterXML/jackson/commits)

Updates `com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider` from 2.19.2 to 2.20.0

Updates `com.fasterxml.jackson.datatype:jackson-datatype-jsr310` from 2.19.2 to 2.20.0

Updates `org.openapitools:jackson-databind-nullable` from 0.2.6 to 0.2.7
- [Release notes](https://github.com/OpenAPITools/jackson-databind-nullable/releases)
- [Commits](OpenAPITools/jackson-databind-nullable@v0.2.6...v0.2.7)

Updates `com.google.errorprone:error_prone_annotations` from 2.40.0 to 2.42.0
- [Release notes](https://github.com/google/error-prone/releases)
- [Commits](google/error-prone@v2.40.0...v2.42.0)

Updates `com.github.spotbugs:spotbugs-maven-plugin` from 4.9.3.2 to 4.9.6.0
- [Release notes](https://github.com/spotbugs/spotbugs-maven-plugin/releases)
- [Commits](spotbugs/spotbugs-maven-plugin@spotbugs-maven-plugin-4.9.3.2...spotbugs-maven-plugin-4.9.6.0)

Updates `org.apache.maven.plugins:maven-compiler-plugin` from 3.14.0 to 3.14.1
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.14.0...maven-compiler-plugin-3.14.1)

Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.5.3 to 3.5.4
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.5.3...surefire-3.5.4)

Updates `org.apache.maven.plugins:maven-javadoc-plugin` from 3.11.2 to 3.12.0
- [Release notes](https://github.com/apache/maven-javadoc-plugin/releases)
- [Commits](apache/maven-javadoc-plugin@maven-javadoc-plugin-3.11.2...maven-javadoc-plugin-3.12.0)

Updates `org.apache.maven.plugins:maven-failsafe-plugin` from 3.5.3 to 3.5.4
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.5.3...surefire-3.5.4)

Updates `com.diffplug.spotless:spotless-maven-plugin` from 2.46.0 to 3.0.0
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](diffplug/spotless@maven/2.46.0...lib/3.0.0)

Updates `org.sonatype.central:central-publishing-maven-plugin` from 0.8.0 to 0.9.0
- [Commits](https://github.com/sonatype/central-publishing-maven-plugin/commits)

---
updated-dependencies:
- dependency-name: org.bouncycastle:bcprov-jdk18on
  dependency-version: '1.82'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-version-updates
- dependency-name: org.bouncycastle:bcpkix-jdk18on
  dependency-version: '1.82'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-version-updates
- dependency-name: com.google.errorprone:error_prone_core
  dependency-version: 2.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-version-updates
- dependency-name: com.uber.nullaway:nullaway
  dependency-version: 0.12.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-version-updates
- dependency-name: com.nimbusds:nimbus-jose-jwt
  dependency-version: '10.5'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-version-updates
- dependency-name: com.nimbusds:oauth2-oidc-sdk
  dependency-version: 11.29.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-version-updates
- dependency-name: org.apache.httpcomponents.client5:httpclient5
  dependency-version: 5.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-version-updates
- dependency-name: com.fasterxml.jackson.core:jackson-core
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-version-updates
- dependency-name: com.fasterxml.jackson.core:jackson-annotations
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-version-updates
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-version-updates
- dependency-name: com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-version-updates
- dependency-name: com.fasterxml.jackson.datatype:jackson-datatype-jsr310
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-version-updates
- dependency-name: com.fasterxml.jackson.core:jackson-annotations
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-version-updates
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-version-updates
- dependency-name: com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-version-updates
- dependency-name: com.fasterxml.jackson.datatype:jackson-datatype-jsr310
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-version-updates
- dependency-name: org.openapitools:jackson-databind-nullable
  dependency-version: 0.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-version-updates
- dependency-name: com.google.errorprone:error_prone_annotations
  dependency-version: 2.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-version-updates
- dependency-name: com.github.spotbugs:spotbugs-maven-plugin
  dependency-version: 4.9.6.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-version-updates
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-version: 3.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-version-updates
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-version: 3.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-version-updates
- dependency-name: org.apache.maven.plugins:maven-javadoc-plugin
  dependency-version: 3.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-version-updates
- dependency-name: org.apache.maven.plugins:maven-failsafe-plugin
  dependency-version: 3.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-version-updates
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: maven-version-updates
- dependency-name: org.sonatype.central:central-publishing-maven-plugin
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-version-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 30, 2025
@dependabot @github

dependabot Bot commented on behalf of github Oct 6, 2025

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 6, 2025
@dependabot
dependabot Bot deleted the dependabot/maven/maven-version-updates-a016f5f852 branch October 6, 2025 22:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants