Skip to content

Bump the maven-dependencies group across 1 directory with 16 updates - #4313

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/maven-dependencies-143025596b
Closed

Bump the maven-dependencies group across 1 directory with 16 updates#4313
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/maven-dependencies-143025596b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the maven-dependencies group with 16 updates in the / directory:

Package From To
org.junit:junit-bom 6.1.0 6.1.3
ch.qos.logback:logback-classic 1.5.36 1.6.3
io.smallrye.config:smallrye-config 3.17.2 3.18.1
org.mongodb:mongodb-driver-sync 5.8.0 5.10.0
org.mongodb:mongodb-driver-legacy 5.8.0 5.10.0
org.zeroturnaround:zt-exec 1.12 1.13.0
com.fasterxml.jackson.core:jackson-databind 2.22.0 2.22.2
com.fasterxml.jackson.dataformat:jackson-dataformat-yaml 2.22.0 2.22.2
org.jsoup:jsoup 1.22.2 1.23.1
com.github.spotbugs:spotbugs-annotations 4.10.2 4.10.3
net.bytebuddy:byte-buddy 1.18.10 1.18.12
io.github.classgraph:classgraph 4.8.184 4.8.192
com.google.devtools.ksp:symbol-processing-api 2.3.9 2.3.11
com.google.devtools.ksp:symbol-processing-common-deps 2.3.9 2.3.11
com.google.devtools.ksp:symbol-processing-aa-embeddable 2.3.9 2.3.11
org.apache.maven.plugins:maven-jar-plugin 3.5.0 3.5.1

Updates org.junit:junit-bom from 6.1.0 to 6.1.3

Release notes

Sourced from org.junit:junit-bom's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.1...r6.1.2

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

Commits
  • f59f60d Release 6.1.3
  • cd8ec92 Finalize 6.1.3 release notes
  • c8729f2 Restore compatibility with GraalVM 25 (#5901)
  • ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
  • fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
  • 62afc02 Delay GraalVM plugin updates for 3 days
  • 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
  • f6bbfc5 Move GraalVM tests to separate test task (#5903)
  • e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
  • 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
  • Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.5.36 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

  • In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

  • Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

  • The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

  • ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

  • Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

  • The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

-- Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

  • Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

  • Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

    <property name="logback.skipCallerContradictionAnalysis" value="true"/>

  • SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

  • Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

  • Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

  • Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

... (truncated)

Commits
  • e8e824d prepare release 1.6.3
  • 761821b MDCBasedDiscriminator has a gated warning mechanism
  • 53ed122 update copyright year
  • c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
  • b5aa931 added BatchedSimpleInvocationGate
  • 1f22af7 add javadocs to SimpleInvocationGate
  • 638ffa7 prevent forward and backward slashes to escape to other directories
  • 7d6b9a4 add missing ch.qos.logback.core.property package
  • fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
  • c73b43f deprecate the withJansi path
  • Additional commits viewable in compare view

Updates io.smallrye.config:smallrye-config from 3.17.2 to 3.18.1

Release notes

Sourced from io.smallrye.config:smallrye-config's releases.

3.18.1

3.18.0

  • #1544 Release 3.18.0
  • #1543 Bump io.smallrye:smallrye-parent from 50 to 51
  • #1541 Fix ConfigMapping hashCode collision for Map properties with equal keys and values
  • #1540 Bump Python version from 3.9 to 3.12 in CI documentation workflows
  • #1539 Remove deprecated Jasypt support
  • #1538 Support nested config classes in class-based mappings
  • #1537 Bump actions/checkout from 6 to 7
  • #1536 Configure Surefire to display parameterized test names in reports
  • #1535 Fix HOCON property name rendering
  • #1534 Reproduce issue with @WithUnnamedKey config group considered present even if unconfigured
  • #1533 Bump io.smallrye:smallrye-parent from 49 to 50
  • #1532 Add SPI ConfigMappingHandler to split handling of @​ConfigMapping and @​ConfigProperties
  • #1531 Bump io.smallrye.common:smallrye-common-bom from 2.18.1 to 2.19.0
  • #1530 Bump com.typesafe:config from 1.4.8 to 1.4.9
  • #1529 Bump kotlin.version from 2.3.21 to 2.4.0
  • #1528 Update MicroProfile Config to 3.1.1
  • #1527 Stabilize hashCode of ConfigClass
  • #1526 Bump org.ow2.asm:asm from 9.10 to 9.10.1
  • #1525 Bump idna from 3.11 to 3.15 in /documentation
  • #1524 Bump pymdown-extensions from 10.21.2 to 10.21.3 in /documentation
  • #1523 Bump org.ow2.asm:asm from 9.9.1 to 9.10
  • #1522 Bump io.smallrye.common:smallrye-common-bom from 2.18.0 to 2.18.1
  • #1520 Bump urllib3 from 2.6.3 to 2.7.0 in /documentation
  • #1519 Bump io.smallrye.common:smallrye-common-bom from 2.17.1 to 2.18.0
  • #1518 Bump com.typesafe:config from 1.4.7 to 1.4.8
  • #1516 Bump com.typesafe:config from 1.4.6 to 1.4.7
  • #1515 Bump io.smallrye:smallrye-parent from 48 to 49
  • #1514 Bump kotlin.version from 2.3.20 to 2.3.21
  • #1513 Bump org.jboss.bridger:bridger from 1.6.Final to 1.8
  • #1510 Bump io.sundr:sundr-maven-plugin from 0.240.1 to 0.300.0
Commits
  • d576664 [maven-release-plugin] prepare release 3.18.1
  • c628013 Release 3.18.1 (#1547)
  • 8a86d44 @​WithUnnamedKey#eager to control if default keys are present in the mapping M...
  • fb0c3bf [maven-release-plugin] prepare for next development iteration
  • 21ceb75 [maven-release-plugin] prepare release 3.18.0
  • a7bafe6 Update release preparation condition in workflow
  • c94a186 Add workflow_dispatch trigger to release workflow
  • e93eddf Release 3.18.0 (#1544)
  • 0daa482 Reproduce issue with @WithUnnamedKey config group considered present even i...
  • 3d6d5dc Bump io.smallrye:smallrye-parent from 50 to 51 (#1543)
  • Additional commits viewable in compare view

Updates org.mongodb:mongodb-driver-sync from 5.8.0 to 5.10.0

Release notes

Sourced from org.mongodb:mongodb-driver-sync's releases.

Java Driver 5.10.0 (August 14, 2026)

What's Changed

  • Added $scoreFusion hybrid search stage for combining and normalizing the scores of multiple search pipelines (MongoDB 8.2+) #2024 by @​nhachicha
  • Added a fluent builder API for the $score aggregation stage, with normalization, weighting, and score details (MongoDB 8.2+) #2023 by @​strogiyotec
  • Added $vectorSearch support for nested embeddings and arrays of embeddings via parentFilter and nestedOptions #2026 by @​rozza
  • Removed stale @Beta from SearchOptions and VectorSearchOptions in the Java and Scala drivers #2026 by @​rozza
  • Encoded Kotlin ByteArray data class fields as BSON Binary, and added an opt-in ByteArray BSON Binary serializer for bson-kotlinx #2019 by @​rozza
  • Included the fix for CVE-2026-18710 / JAVA-6266, where ProxySettings.toString() rendered the SOCKS5 proxy username and password into application logs. First shipped in 5.9.2 #2035 by @​strogiyotec
  • ByteArray fields in Kotlin data classes are once again encoded as BSON Binary rather than a BSON array of int32, restoring the behavior from before 5.1.3. Decoding accepts both forms, so documents written by 5.1.3–5.9.x still read back correctly, but newly written documents change BSON type. Review any non-driver consumers of those fields before upgrading. See JAVA-6224

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: mongodb/mongo-java-driver@r5.9.0...r5.10.0

Java Driver 5.9.2 (August 11, 2026)

What's Changed

[!WARNING] Starting from driver version 4.11.0, ProxySettings.toString() included the SOCKS5 proxy username and password in application logs.

See JAVA-6266 / CVE-2026-18710

The username and password are no longer included in toString() starting in this release.

If you cannot upgrade, set the org.mongodb.driver.client logger to WARN or higher to suppress the client-construction message. We do not recommend this as a long-term measure: it silences diagnostic information that is valuable for support, and it does not remove credentials already written to existing logs.

Full Changelog: mongodb/mongo-java-driver@r5.9.1...r5.9.2

Java Driver 5.9.1 (July 23, 2026)

What's Changed

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

... (truncated)

Commits
  • 6acf4b6 Version: bump 5.10.0
  • 09aa019 Merge commit from fork (#2035)
  • d751950 Evergreen CI windows fixes
  • 533b2b6 Ensure Kotlin can encode ByteArrays efficiently (#2019)
  • 94863fa Support $vectorSearch against nested embeddings and arrays of embeddings (#2026)
  • 1b958ae JAVA-5990 Hybrid Search Score Fusion (#2024)
  • dd814f8 JAVA-6146 Move detail out of the root AGENTS.md into references
  • d87d93a Fluent API for $score (#2023)
  • 0956b9f Resolve forwarded type arguments across POJO hierarchy edges (#2014)
  • cab37d0 Improve readability of NettyStreamCloseFutureListenerTest
  • Additional commits viewable in compare view

Updates org.mongodb:mongodb-driver-legacy from 5.8.0 to 5.10.0

Release notes

Sourced from org.mongodb:mongodb-driver-legacy's releases.

Java Driver 5.10.0 (August 14, 2026)

What's Changed

  • Added $scoreFusion hybrid search stage for combining and normalizing the scores of multiple search pipelines (MongoDB 8.2+) #2024 by @​nhachicha
  • Added a fluent builder API for the $score aggregation stage, with normalization, weighting, and score details (MongoDB 8.2+) #2023 by @​strogiyotec
  • Added $vectorSearch support for nested embeddings and arrays of embeddings via parentFilter and nestedOptions #2026 by @​rozza
  • Removed stale @Beta from SearchOptions and VectorSearchOptions in the Java and Scala drivers #2026 by @​rozza
  • Encoded Kotlin ByteArray data class fields as BSON Binary, and added an opt-in ByteArray BSON Binary serializer for bson-kotlinx #2019 by @​rozza
  • Included the fix for CVE-2026-18710 / JAVA-6266, where ProxySettings.toString() rendered the SOCKS5 proxy username and password into application logs. First shipped in 5.9.2 #2035 by @​strogiyotec
  • ByteArray fields in Kotlin data classes are once again encoded as BSON Binary rather than a BSON array of int32, restoring the behavior from before 5.1.3. Decoding accepts both forms, so documents written by 5.1.3–5.9.x still read back correctly, but newly written documents change BSON type. Review any non-driver consumers of those fields before upgrading. See JAVA-6224

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: mongodb/mongo-java-driver@r5.9.0...r5.10.0

Java Driver 5.9.2 (August 11, 2026)

What's Changed

[!WARNING] Starting from driver version 4.11.0, ProxySettings.toString() included the SOCKS5 proxy username and password in application logs.

See JAVA-6266 / CVE-2026-18710

The username and password are no longer included in toString() starting in this release.

If you cannot upgrade, set the org.mongodb.driver.client logger to WARN or higher to suppress the client-construction message. We do not recommend this as a long-term measure: it silences diagnostic information that is valuable for support, and it does not remove credentials already written to existing logs.

Full Changelog: mongodb/mongo-java-driver@r5.9.1...r5.9.2

Java Driver 5.9.1 (July 23, 2026)

What's Changed

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

... (truncated)

Commits
  • 6acf4b6 Version: bump 5.10.0
  • 09aa019 Merge commit from fork (#2035)
  • d751950 Evergreen CI windows fixes
  • 533b2b6 Ensure Kotlin can encode ByteArrays efficiently (#2019)
  • 94863fa Support $vectorSearch against nested embeddings and arrays of embeddings (#2026)
  • 1b958ae JAVA-5990 Hybrid Search Score Fusion (#2024)
  • dd814f8 JAVA-6146 Move detail out of the root AGENTS.md into references
  • d87d93a Fluent API for $score (#2023)
  • 0956b9f Resolve forwarded type arguments across POJO hierarchy edges (#2014)
  • cab37d0 Improve readability of NettyStreamCloseFutureListenerTest
  • Additional commits viewable in compare view

Updates org.mongodb:mongodb-driver-legacy from 5.8.0 to 5.10.0

Release notes

Sourced from org.mongodb:mongodb-driver-legacy's releases.

Java Driver 5.10.0 (August 14, 2026)

What's Changed

  • Added $scoreFusion hybrid search stage for combining and normalizing the scores of multiple search pipelines (MongoDB 8.2+) #2024 by @​nhachicha
  • Added a fluent builder API for the $score aggregation stage, with normalization, weighting, and score details (MongoDB 8.2+) #2023 by @​strogiyotec
  • Added $vectorSearch support for nested embeddings and arrays of embeddings via parentFilter and nestedOptions #2026 by @​rozza
  • Removed stale @Beta from SearchOptions and VectorSearchOptions in the Java and Scala drivers #2026 by @​rozza
  • Encoded Kotlin ByteArray data class fields as BSON Binary, and added an opt-in ByteArray BSON Binary serializer for bson-kotlinx #2019 by @​rozza
  • Included the fix for CVE-2026-18710 / JAVA-6266, where ProxySettings.toString() rendered the SOCKS5 proxy username and password into application logs. First shipped in 5.9.2 #2035 by @​strogiyotec
  • ByteArray fields in Kotlin data classes are once again encoded as BSON Binary rather than a BSON array of int32, restoring the behavior from before 5.1.3. Decoding accepts both forms, so documents written by 5.1.3–5.9.x still read back correctly, but newly written documents change BSON type. Review any non-driver consumers of those fields before upgrading. See JAVA-6224

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: mongodb/mongo-java-driver@r5.9.0...r5.10.0

Java Driver 5.9.2 (August 11, 2026)

What's Changed

[!WARNING] Starting from driver version 4.11.0, ProxySettings.toString() included the SOCKS5 proxy username and password in application logs.

See JAVA-6266 / CVE-2026-18710

The username and password are no longer included in toString() starting in this release.

If you cannot upgrade, set the org.mongodb.driver.client logger to WARN or higher to suppress the client-construction message. We do not recommend this as a long-term measure: it silences diagnostic information that is valuable for support, and it does not remove credentials already written to existing logs.

Full Changelog: mongodb/mongo-java-driver@r5.9.1...r5.9.2

Java Driver 5.9.1 (July 23, 2026)

What's Changed

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

... (truncated)

Commits
  • 6acf4b6 Version: bump 5.10.0
  • 09aa019 Merge commit from fork (#2035)
  • d751950 Evergreen CI windows fixes
  • 533b2b6 Ensure Kotlin can encode ByteArrays efficiently (#2019)
  • 94863fa Support $vectorSearch against nested embeddings and arrays of embeddings (#2026)
  • 1b958ae JAVA-5990 Hybrid Search Score Fusion (#2024)
  • dd814f8 JAVA-6146 Move detail out of the root AGENTS.md into references
  • d87d93a Fluent API for $score (#2023)
  • 0956b9f Resolve forwarded type arguments across POJO hierarchy edges (#2014)
  • cab37d0 Improve readability of NettyStreamCloseFutureListenerTest
  • Additional commits viewable in compare view

Updates org.zeroturnaround:zt-exec from 1.12 to 1.13.0

Release notes

Sourced from org.zeroturnaround:zt-exec's releases.

v1.13.0

What's Changed

New Contributors

Full Changelog: https://github.com/zeroturnaround/zt-exec/commits/v1.13.0

Changelog

Sourced from org.zeroturnaround:zt-exec's changelog.

[1.13.0] - 2026-07-10

Added

  • LogOutputStream.create(LineConsumer) to build a LogOutputStream from a lambda (#107).
  • LogOutputStream.setOutputCharset(String) to control the charset used to decode the process output (#89).
  • An OSGi bundle manifest (Bundle-SymbolicName, Export-Package) in the published jar (#85).
  • A JPMS module descriptor for module org.zeroturnaround.exec, shipped as a Java 9 multi-release entry (#106).

Changed

  • Raised the minimum Java runtime from 6 to 8 (bytecode target moved from 1.6 to 1.8).
  • Upgraded the slf4j-api dependency from 1.7.2 to 1.7.32.
  • Migrated the build from Maven to Gradle; releases now publish to Maven Central through the Sonatype Central Portal.
Commits
  • f71a22a Release 1.13.0
  • 13ca7bd List all consumer-facing changes since 1.12 in the changelog
  • a614f50 Bump the minor-and-patch group across 1 directory with 4 updates
  • d20fae7 Bump org.apache.commons:commons-lang3 from 3.12.0 to 3.18.0
  • f16fd4e Bump commons-io:commons-io from 2.11.0 to 2.14.0
  • 09612ed Suppress automatic-module warning on the slf4j requires directive
  • 38f6ee9 Add CHANGELOG.md, security policy, and changelog release automation
  • 1711820 Adopt vMAJOR.MINOR.PATCH release tags
  • 6e8e4a6 Bump build tooling to current versions
  • 5e0b895 Drop defunct ZeroTurnaround references from POM metadata
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-databind from 2.22.0 to 2.22.2

Commits

Updates com.fasterxml.jackson.dataformat:jackson-dataformat-yaml from 2.22.0 to 2.22.2

Commits
  • 3aab026 [maven-release-plugin] prepare release jackson-dataformats-text-2.22.2
  • 0e4e5b9 Prep for 2.22.2 release
  • 3fd4238 Merge branch '2.21' into 2.22
  • f0f9689 Merge branch '2.20' into 2.21
  • 50d9dfa Merge branch '2.19' into 2.20
  • 0e9bdd4 Merge branch '2.18' into 2.19
  • 613de08 Post-release dep version bump
  • 49dc929 [maven-release-plugin] prepare for next development iteration
  • c09cd3f [maven-release-plugin] prepare release jackson-dataformats-text-2.18.10
  • 096a670 Prep for 2.18.10 release
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson.dataformat:jackson-dataformat-yaml from 2.22.0 to 2.22.2

Commits
  • 3aab026 [maven-release-plugin] prepare release jackson-dataformats-text-2.22.2
  • 0e4e5b9 Prep for 2.22.2 release
  • 3fd4238 Merge branch '2.21' into 2.22
  • f0f9689 Merge branch '2.20' into 2.21
  • 50d9dfa Merge branch '2.19' into 2.20
  • 0e9bdd4 Merge branch '2.18' into 2.19
  • 613de08 Post-release dep version bump
  • 49dc929 [maven-release-plugin] prepare for next development iteration
  • c09cd3f [maven-release-plugin] prepare release jackson-dataformats-text-2.18.10
  • 096a670 Prep for 2.18.10 release
  • Additional commits viewable in compare view

Updates org.jsoup:jsoup from 1.22.2 to 1.23.1

Release notes

Sourced from org.jsoup:jsoup's releases.

jsoup 1.23.1

jsoup Java HTML Parser release 1.23.1

jsoup 1.23.1 is out now, with a faster and more memory-efficient HTML parser, improved alignment with the HTML standard across noscript, CDATA, SVG, and MathML parsing, and safer, specification-correct HTTP redirects. The release also adds a fast immutable Element#classList(), direct outer-HTML output to an Appendable, and fixes across RCDATA parsing, XML conversion, tag-name handling, and Cleaner link detection.

Performance optimization was a major focus for this release. In our OpenJDK 21 benchmarks, ordinary string parsing is now 18% faster on average, parsing from an InputStream is 11% faster, and parsing with source position tracking is 70% faster while allocating 64% fewer bytes per document.

Source-tracked DOMs retain 58-65% less memory on representative medium-to-large documents, and the improvements hold under concurrent parsing without introducing new contention. Exact gains will naturally vary with document shape, JVM, and hardware.

This release also fixes a security issue in the Cleaner that could expose markup when malformed HTML is cleaned with a custom Safelist permitting certain raw-text elements. The built-in Safelists are unaffected.

jsoup is a Java library for working with real-world HTML and XML. It provides a very convenient API for extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors.

Download jsoup now.

Improvements

  • Reduced retained memory when parsing with source position tracking enabled (Parser#setTrackPosition(true)). Source ranges are now stored in compact parser-owned span records instead of node and attribute user data, and Position objects are created lazily when source ranges are read. This cuts tracked DOM retained size by about 50-60% on representative benchmark documents, while keeping Node#sourceRange(), Element#endSourceRange(), and Attribute#sourceRange() behavior intact. #2498
  • Added Element#classList(), an immutable snapshot of an element's class names in attribute order. Use hasClass() when you just need to test for one ...

    Description has been truncated

@dependabot
Bump the maven-dependencies group across 1 directory with 16 updates
263949b 
Bumps the maven-dependencies group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [org.junit:junit-bom](https://github.com/junit-team/junit-framework) | `6.1.0` | `6.1.3` |
| [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.5.36` | `1.6.3` |
| [io.smallrye.config:smallrye-config](https://github.com/smallrye/smallrye-config) | `3.17.2` | `3.18.1` |
| [org.mongodb:mongodb-driver-sync](https://github.com/mongodb/mongo-java-driver) | `5.8.0` | `5.10.0` |
| [org.mongodb:mongodb-driver-legacy](https://github.com/mongodb/mongo-java-driver) | `5.8.0` | `5.10.0` |
| [org.zeroturnaround:zt-exec](https://github.com/zeroturnaround/zt-exec) | `1.12` | `1.13.0` |
| [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson) | `2.22.0` | `2.22.2` |
| [com.fasterxml.jackson.dataformat:jackson-dataformat-yaml](https://github.com/FasterXML/jackson-dataformats-text) | `2.22.0` | `2.22.2` |
| [org.jsoup:jsoup](https://github.com/jhy/jsoup) | `1.22.2` | `1.23.1` |
| [com.github.spotbugs:spotbugs-annotations](https://github.com/spotbugs/spotbugs) | `4.10.2` | `4.10.3` |
| [net.bytebuddy:byte-buddy](https://github.com/raphw/byte-buddy) | `1.18.10` | `1.18.12` |
| [io.github.classgraph:classgraph](https://github.com/classgraph/classgraph) | `4.8.184` | `4.8.192` |
| [com.google.devtools.ksp:symbol-processing-api](https://github.com/google/ksp) | `2.3.9` | `2.3.11` |
| [com.google.devtools.ksp:symbol-processing-common-deps](https://github.com/google/ksp) | `2.3.9` | `2.3.11` |
| [com.google.devtools.ksp:symbol-processing-aa-embeddable](https://github.com/google/ksp) | `2.3.9` | `2.3.11` |
| [org.apache.maven.plugins:maven-jar-plugin](https://github.com/apache/maven-jar-plugin) | `3.5.0` | `3.5.1` |



Updates `org.junit:junit-bom` from 6.1.0 to 6.1.3
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](junit-team/junit-framework@r6.1.0...r6.1.3)

Updates `ch.qos.logback:logback-classic` from 1.5.36 to 1.6.3
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.5.36...v_1.6.3)

Updates `io.smallrye.config:smallrye-config` from 3.17.2 to 3.18.1
- [Release notes](https://github.com/smallrye/smallrye-config/releases)
- [Commits](smallrye/smallrye-config@3.17.2...3.18.1)

Updates `org.mongodb:mongodb-driver-sync` from 5.8.0 to 5.10.0
- [Release notes](https://github.com/mongodb/mongo-java-driver/releases)
- [Commits](mongodb/mongo-java-driver@r5.8.0...r5.10.0)

Updates `org.mongodb:mongodb-driver-legacy` from 5.8.0 to 5.10.0
- [Release notes](https://github.com/mongodb/mongo-java-driver/releases)
- [Commits](mongodb/mongo-java-driver@r5.8.0...r5.10.0)

Updates `org.mongodb:mongodb-driver-legacy` from 5.8.0 to 5.10.0
- [Release notes](https://github.com/mongodb/mongo-java-driver/releases)
- [Commits](mongodb/mongo-java-driver@r5.8.0...r5.10.0)

Updates `org.zeroturnaround:zt-exec` from 1.12 to 1.13.0
- [Release notes](https://github.com/zeroturnaround/zt-exec/releases)
- [Changelog](https://github.com/zeroturnaround/zt-exec/blob/main/CHANGELOG.md)
- [Commits](zeroturnaround/zt-exec@zt-exec-1.12...v1.13.0)

Updates `com.fasterxml.jackson.core:jackson-databind` from 2.22.0 to 2.22.2
- [Commits](https://github.com/FasterXML/jackson/commits)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` from 2.22.0 to 2.22.2
- [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.22.0...jackson-dataformats-text-2.22.2)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` from 2.22.0 to 2.22.2
- [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.22.0...jackson-dataformats-text-2.22.2)

Updates `org.jsoup:jsoup` from 1.22.2 to 1.23.1
- [Release notes](https://github.com/jhy/jsoup/releases)
- [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES.md)
- [Commits](jhy/jsoup@jsoup-1.22.2...jsoup-1.23.1)

Updates `com.github.spotbugs:spotbugs-annotations` from 4.10.2 to 4.10.3
- [Release notes](https://github.com/spotbugs/spotbugs/releases)
- [Changelog](https://github.com/spotbugs/spotbugs/blob/master/CHANGELOG.md)
- [Commits](spotbugs/spotbugs@4.10.2...4.10.3)

Updates `net.bytebuddy:byte-buddy` from 1.18.10 to 1.18.12
- [Release notes](https://github.com/raphw/byte-buddy/releases)
- [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md)
- [Commits](raphw/byte-buddy@byte-buddy-1.18.10...byte-buddy-1.18.12)

Updates `io.github.classgraph:classgraph` from 4.8.184 to 4.8.192
- [Release notes](https://github.com/classgraph/classgraph/releases)
- [Commits](classgraph/classgraph@classgraph-4.8.184...classgraph-4.8.192)

Updates `com.google.devtools.ksp:symbol-processing-api` from 2.3.9 to 2.3.11
- [Release notes](https://github.com/google/ksp/releases)
- [Commits](google/ksp@2.3.9...2.3.11)

Updates `com.google.devtools.ksp:symbol-processing-common-deps` from 2.3.9 to 2.3.11
- [Release notes](https://github.com/google/ksp/releases)
- [Commits](google/ksp@2.3.9...2.3.11)

Updates `com.google.devtools.ksp:symbol-processing-aa-embeddable` from 2.3.9 to 2.3.11
- [Release notes](https://github.com/google/ksp/releases)
- [Commits](google/ksp@2.3.9...2.3.11)

Updates `com.google.devtools.ksp:symbol-processing-common-deps` from 2.3.9 to 2.3.11
- [Release notes](https://github.com/google/ksp/releases)
- [Commits](google/ksp@2.3.9...2.3.11)

Updates `com.google.devtools.ksp:symbol-processing-aa-embeddable` from 2.3.9 to 2.3.11
- [Release notes](https://github.com/google/ksp/releases)
- [Commits](google/ksp@2.3.9...2.3.11)

Updates `org.apache.maven.plugins:maven-jar-plugin` from 3.5.0 to 3.5.1
- [Release notes](https://github.com/apache/maven-jar-plugin/releases)
- [Commits](apache/maven-jar-plugin@maven-jar-plugin-3.5.0...maven-jar-plugin-3.5.1)

---
updated-dependencies:
- dependency-name: org.junit:junit-bom
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: io.smallrye.config:smallrye-config
  dependency-version: 3.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.mongodb:mongodb-driver-sync
  dependency-version: 5.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.mongodb:mongodb-driver-legacy
  dependency-version: 5.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.mongodb:mongodb-driver-legacy
  dependency-version: 5.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.zeroturnaround:zt-exec
  dependency-version: 1.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.22.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml
  dependency-version: 2.22.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml
  dependency-version: 2.22.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.jsoup:jsoup
  dependency-version: 1.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: com.github.spotbugs:spotbugs-annotations
  dependency-version: 4.10.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: net.bytebuddy:byte-buddy
  dependency-version: 1.18.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: io.github.classgraph:classgraph
  dependency-version: 4.8.192
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.google.devtools.ksp:symbol-processing-api
  dependency-version: 2.3.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.google.devtools.ksp:symbol-processing-common-deps
  dependency-version: 2.3.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.google.devtools.ksp:symbol-processing-aa-embeddable
  dependency-version: 2.3.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.google.devtools.ksp:symbol-processing-common-deps
  dependency-version: 2.3.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.google.devtools.ksp:symbol-processing-aa-embeddable
  dependency-version: 2.3.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.apache.maven.plugins:maven-jar-plugin
  dependency-version: 3.5.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 22, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) August 22, 2026 20:00
@dependabot @github

dependabot Bot commented on behalf of github Sep 4, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 4, 2026
auto-merge was automatically disabled September 4, 2026 09:52

Pull request was closed

@dependabot
dependabot Bot deleted the dependabot/maven/maven-dependencies-143025596b branch September 4, 2026 09:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants