Skip to content

build(deps): Bump the monthly-batch group across 1 directory with 26 updates - #204

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/monthly-batch-fba64eb782
Open

build(deps): Bump the monthly-batch group across 1 directory with 26 updates#204
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/monthly-batch-fba64eb782

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown

Bumps the monthly-batch group with 26 updates in the / directory:

Package From To
jakarta.enterprise:jakarta.enterprise.cdi-api 4.1.0 5.0.0
jakarta.json.bind:jakarta.json.bind-api 3.0.2 3.0.4
org.eclipse.microprofile.config:microprofile-config-api 3.1.1 3.1.3
org.postgresql:postgresql 42.7.13 42.7.14
org.slf4j:slf4j-api 2.0.18 2.0.20
ch.qos.logback:logback-classic 1.6.1 1.6.6
org.flywaydb:flyway-core 13.1.0 13.11.1
org.flywaydb:flyway-database-postgresql 13.1.0 13.11.1
org.flywaydb:flyway-database-postgresql 13.1.0 13.11.1
org.freemarker:freemarker 2.3.34 2.3.35
org.bouncycastle:bcprov-jdk18on 1.85 1.86
org.bouncycastle:bcpg-jdk18on 1.85 1.86
org.bouncycastle:bcutil-jdk18on 1.85 1.86
org.bouncycastle:bcpg-jdk18on 1.85 1.86
org.bouncycastle:bcutil-jdk18on 1.85 1.86
org.apache.cxf:cxf-rt-frontend-jaxrs 4.2.2 4.2.4
org.apache.cxf:cxf-rt-rs-client 4.2.2 4.2.4
org.apache.cxf:cxf-rt-rs-client 4.2.2 4.2.4
org.apache.johnzon:johnzon-core 2.1.0 2.2.0
org.apache.johnzon:johnzon-jsonb 2.1.0 2.2.0
org.apache.johnzon:johnzon-jsonb 2.1.0 2.2.0
org.junit:junit-bom 6.1.2 6.1.3
com.palantir.javaformat:palantir-java-format 2.96.0 2.102.0
org.apache.maven.plugins:maven-compiler-plugin 3.15.0 3.16.0
org.apache.maven.plugins:maven-failsafe-plugin 3.5.6 3.6.1
org.apache.maven.plugins:maven-install-plugin 3.1.4 3.2.0
org.apache.maven.plugins:maven-surefire-plugin 3.5.6 3.6.1
com.diffplug.spotless:spotless-maven-plugin 3.9.0 3.10.4
io.openliberty.tools:liberty-maven-plugin 3.12.1 3.12.4
org.codehaus.mojo:build-helper-maven-plugin 3.6.1 3.6.2
org.apache.maven:apache-maven 3.9.16 3.10.0

Updates jakarta.enterprise:jakarta.enterprise.cdi-api from 4.1.0 to 5.0.0

Release notes

Sourced from jakarta.enterprise:jakarta.enterprise.cdi-api's releases.

5.0.0.CR1

A candidate release for CDI 5 which contains all the code changes intended for the Final version.

What's Changed

Full Changelog: jakartaee/cdi@5.0.0.Beta1...5.0.0.CR1

5.0.0.Beta1

What's Changed

... (truncated)

Commits
  • bb2b53b Release 5.0.0
  • 4249566 Remove reference to external copy of the EFSL license
  • 9c0bee1 Update spec and javadoc license to EFSL 2.0
  • 0bd65e6 Add 5.0 changes summary to the spec preface
  • 47a27e1 Update copyright year to 2026 in javadoc footers and spec license
  • 63655f8 Prepare for next development iteration 5.0.1-SNAPSHOT
  • bdeb731 Release 5.0.0
  • d03f8dc Prepare for next development iteration 5.0.0.CR2-SNAPSHOT
  • d9e49aa Release 5.0.0.CR1
  • f36baa2 clarify wildcards in the bean assignability rules
  • Additional commits viewable in compare view

Updates jakarta.json.bind:jakarta.json.bind-api from 3.0.2 to 3.0.4

Release notes

Sourced from jakarta.json.bind:jakarta.json.bind-api's releases.

3.0.4

What's Changed

Full Changelog: jakartaee/jsonb-api@3.0.3...3.0.4

3.0.3

What's Changed

Full Changelog: jakartaee/jsonb-api@3.0.2...3.0.3

Commits
  • 499e095 Prepare release jakarta.json.bind:jakarta.json.bind-parent:3.0.4
  • 002c703 dep: update enforcer plugin
  • 3221c51 Merge pull request #478 from KyleAure/3.0.3-BRANCH
  • 8c5b8a0 dep: update parent
  • cc33a86 Merge pull request #432 from KyleAure/426-yasson-in-manifest
  • 744cf1f fix: remove maven-scm-publish-plugin from tck-user-guide
  • e4f98c5 fix: #425 OSGi yasson in 3.0
  • 59333e0 Prepare next development cycle jakarta.json.bind:jakarta.json.bind-parent:3.0...
  • d2beb53 Prepare release jakarta.json.bind:jakarta.json.bind-parent:3.0.3
  • ca865cd Merge pull request #419 from KyleAure/fix-char-encoding-test-failures-downstream
  • Additional commits viewable in compare view

Updates org.eclipse.microprofile.config:microprofile-config-api from 3.1.1 to 3.1.3

Release notes

Sourced from org.eclipse.microprofile.config:microprofile-config-api's releases.

MicroProfile Config 3.1.3

Javadocs | Spec PDF | Spec html

This release includes the following changes:

To get started with MicroProfile Config 3.1, add the following dependency to your pom:

<dependency>
  <groupId>org.eclipse.microprofile.config</groupId>
  <artifactId>microprofile-config-api</artifactId>
  <version>3.1.3</version>
</dependency>

MicroProfile Config 3.1.2

Javadocs | Spec PDF | Spec html

This release includes the following changes:

To get started with MicroProfile Config 3.1, add the following dependency to your pom:

<dependency>
  <groupId>org.eclipse.microprofile.config</groupId>
  <artifactId>microprofile-config-api</artifactId>
  <version>3.1.2</version>
</dependency>
Commits
  • 7f3f701 [maven-release-plugin] prepare release 3.1.3
  • e6a3cb9 Exclude PropertyExpressionsTest#arrayEscapes due to challenge (#827)
  • dd8b97c Revert "Ship an explicit module descriptor in microprofile-config-api (#816)"...
  • 0959b3a Bump org.eclipse.microprofile:microprofile-tck-bom from 2.13 to 2.14 (#824)
  • 135d606 Bump org.eclipse.microprofile:microprofile-parent from 2.13 to 2.14 (#825)
  • c2fa776 Bump biz.aQute.bnd:biz.aQute.bnd.annotation from 7.1.0 to 7.4.0 (#819)
  • 4a7f559 Bump biz.aQute.bnd:biz.aQute.bnd.annotation from 6.4.1 to 7.1.0 (#805)
  • d8bea93 [maven-release-plugin] prepare for next development iteration
  • 5fe40c3 [maven-release-plugin] prepare release 3.1.2
  • 6e951b0 [maven-release-plugin] prepare for next development iteration
  • Additional commits viewable in compare view

Updates org.postgresql:postgresql from 42.7.13 to 42.7.14

Release notes

Sourced from org.postgresql:postgresql's releases.

v42.7.14

Security

This release fixes two security vulnerabilities.

requireAuth is silently not enforced when the value excludes every authentication method (GHSA-rhp9-mr79-r74h, CVE-2026-107314)

Severity: Moderate (CVSS 5.9) | Affected versions: 42.7.11 – 42.7.13

If the requireAuth connection property excluded all six authentication methods the driver knows (for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none) or contained no method at all (for example requireAuth=,), the driver applied no restriction and accepted whatever method the server asked for, including cleartext password. An attacker positioned between the application and the server could use this to request cleartext password authentication and receive the database password.

Unset values, positive lists (such as requireAuth=scram-sha-256) and partial exclusions (such as requireAuth=!password,!md5) were not affected, and neither were deployments that do not set requireAuth.

Behavior after upgrading:

  • A value that excludes every method now refuses the connection with SQLState 08004 and the message Authentication method is not allowed by requireAuth (or the channel binding error when channelBinding=require is also set).
  • A value that names no method is rejected as an invalid requireAuth value.

Because affected deployments had this value by mistake, and connections worked normally on affected versions, connections with such a value will fail after upgrading. Replace it with a positive list of the methods your server uses, for example requireAuth=scram-sha-256.

Independently of this fix, use sslmode=verify-full with a trusted CA so that an attacker cannot present a substitute server.

Thanks to @​manus-pi for finding and reporting this issue.

Driver stores bytes of earlier statements when it pads a value shorter than its declared length (GHSA-f64h-wr5q-3qf3, CVE-2026-107315)

Severity: Moderate (CVSS 5.3) | Affected versions: 42.7.4 – 42.7.13

When an application sent a value shorter than the length it declared, the driver padded the missing bytes with data from earlier messages on the same connection instead of zeros, and the server stored them. The stored value could contain SQL text and parameter values of earlier, unrelated statements (up to 8192 bytes, or 16320 with GSS encryption). On pooled connections, those statements could come from other requests. 42.7.3 and earlier padded with zeros.

This is reachable through the following public API when the declared length is larger than the data:

  • PreparedStatement.setObject(int, ByteStreamWriter)
  • CopyIn.writeToCopy(ByteStreamWriter) and CopyIn.writeToCopy(byte[], int, int)
  • PGCopyOutputStream.write(byte[], int, int) (writes over 64 KiB)
  • LargeObject.write(byte[], int, int)
  • java.sql.Blob.setBytes(long, byte[], int, int)

Padding is now always zeros. Applications whose declared length always matches the data were not affected. Values stored by an affected version through such a call may already contain leaked data, so you may want to review affected columns. There is no connection property to disable the old behavior; the workaround on older versions is to make the declared length match the data.

Thanks to @​vlsi for finding and reporting this issue.

Full Changelog: pgjdbc/pgjdbc@REL42.7.13...REL42.7.14

Changelog

Sourced from org.postgresql:postgresql's changelog.

[42.7.14] (2026-10-07)

Security

  • fix: a requireAuth value that excludes every authentication method, such as !password,!md5,!gss,!sspi,!scram-sha-256,!none, now refuses every method. A connection with such a value now fails with SQLState 08004. Before, the driver treated the value as if requireAuth were not set, and used any method the server asked for, even a cleartext password. This affects 42.7.11 through 42.7.13 GHSA-rhp9-mr79-r74h
  • fix: a requireAuth value without a method in it, such as , or ,,, now fails with SQLState 22023. Before, the driver treated it as if requireAuth were not set. Commas at the very end of a value are still ignored, as in password,. This affects 42.7.11 through 42.7.13 GHSA-rhp9-mr79-r74h
  • fix: a value shorter than its declared length, such as one from a ByteStreamWriter whose getLength() is larger than what writeTo() writes, is now padded with zeros. Before, the driver padded it with bytes of messages sent earlier on the same connection, so the stored value could contain SQL text and parameter values of earlier statements. This affects 42.7.4 through 42.7.13 GHSA-f64h-wr5q-3qf3
Commits
  • ebdd9d0 chore: bump version to 42.7.14
  • 0e764c8 test: Add additional PgBufferedOutputStream.writeZeros(...) tests
  • c8998c8 fix: writeZeros() could send stale buffer contents instead of zeros
  • a65ef98 fix: refuse every method when requireAuth excludes them all
  • See full diff in compare view

Updates org.slf4j:slf4j-api from 2.0.18 to 2.0.20

Updates ch.qos.logback:logback-classic from 1.6.1 to 1.6.6

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.6

2026-10-25 Release of logback version 1.6.6

• LoggingEventVO now rejects, during deserialization, throwable proxies whose cause or suppressed entries point back into the graph of proxies, for example to their own parent. Such graphs cannot be produced by logback itself. However, a crafted stream sent to a socket receiver could use serialization back-references to build them, after which DefaultThrowableRenderer and SyslogAppender would loop forever and the recursive converters would overflow the stack. These streams are now rejected with an InvalidObjectException. Circular exceptions logged by the application are still transmitted correctly. This issue was reported and fixed in [PR #1079](qos-ch/logback#1079) by arfa-21.

• FileNamePattern now escapes characters with a special meaning in regular expressions, such as (, [ or +, when converting the literal parts of a file name pattern into a regex. Previously, RollingFileAppender failed to start when the path contained an unbalanced parenthesis, as in C:/Users/Michael(Financ. This issue was reported in issues/914 by danamlund. Moreover, with SizeAndTimeBasedRollingPolicy and a pattern such as app.%d.(%i).log, existing archives were not recognized. After a restart within the same period, the next rollover could overwrite an existing archive, and maxHistory and totalSizeCap never removed such archives. This issue was reported in issues/933 by GeoffreyBoulay. The fix was contributed in [PR #1077](qos-ch/logback#1077) by Jialin Chen. Regex metacharacters in %d{...} date patterns are now escaped as well.

• The conversion of date patterns into regular expressions now follows the rules of DateTimeFormatter, which logback uses to format dates, instead of those of SimpleDateFormat. In particular, the L (stand-alone month) pattern letter is now supported.

• SyslogOutputStream now connects its DatagramSocket to the syslog host. Previously, the socket was bound to the wildcard address, so that hardened environments saw an unconnected UDP listener on all interfaces for as long as the application ran. This issue was reported in issues/939 by joao-rebelo. The fix was contributed in [PR #1076](qos-ch/logback#1076) by Lyin-OTTF.

If the socket cannot be connected, for example because the network is not yet available, SyslogOutputStream falls back to an unconnected socket and SyslogAppenderBase emits a warning. When a datagram sent on a connected socket fails due to an ICMP "port unreachable" message caused by an earlier datagram, the datagram is sent once more so that no message is lost. If the retry also fails, a single warning is emitted instead of one error per event.

• OutputStreamAppender now stops its encoder when the appender is stopped. Previously, encoders holding resources until they were stopped, such as those of logstash-logback-encoder, were never released, causing heap growth at each reconfiguration. This issue was fixed in [PR #1072](qos-ch/logback#1072) by Samuel Fernandes.

• During variable substitution, an unmatched right curly brace now causes an error to be reported, with the original value left unchanged. Previously, the brace and all subsequent characters were silently dropped, so that %m}some text became %m. This issue was reported in issues/836 by philsttr.

• LogbackMDCAdapter now stores MDC entries in a LinkedHashMap, so that the %X converter outputs them in insertion order. This issue was reported in LOGBACK-1337 and fixed by Craig P. Motlin.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit a9ee8019ee183e076ff5477957dbf90c4b04dd92 associated with the tag v_1.6.6. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.5

2026-09-30 Release of logback version 1.6.5

• Fixed a vulnerability CVE-2026-104721 closely related to CVE-2026-19880. The fix in version 1.6.3, which strips forward and backward slashes from MDC values, was insufficient. An MDC value could still contain relative path components such as .., variable references such as /, or characters that are special in file name patterns and email addresses. This latest vulnerability was found and reported by François Martin (GitHub: @​martinfrancois, https://github.com/martinfrancois).

MDCBasedDiscriminator, used by SiftingAppender, now rejects MDC values instead of stripping characters from them. An MDC value is rejected if it is empty, if it is longer than 64 characters, if it contains the sequence .., or if it contains any of the following characters: / \ $ { } [ ] ( ) | ? * + % , @. When an MDC value is rejected, the discriminator returns the value of its DefaultValue property. A warning is emitted for each rejected value. These warnings are rate-limited.

• When compression is enabled, TimeBasedRollingPolicy and SizeAndTimeBasedRollingPolicy now also remove old log files that were never compressed, for example because the application was not running at rollover time. Previously, such files were ignored by maxHistory and accumulated indefinitely. This issue was discussed in discussions/1032. See TimeBasedRollingPolicy.

• SimpleInvocationGate, deprecated in version 1.6.3, is now marked for removal. Use FixedIntervalInvocationGate instead.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit d1b829dcdb9fd98511c64401beb1419a9c9384aa associated with the tag v_1.6.5. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.4

2026-09-24 Release of logback version 1.6.4

• Variable substitution is again applied to the scan attribute of the <configuration> element. The scanning refactoring in version 1.5.27 had dropped substitution, so values such as ${logback.scan.enabled:-true} were no longer resolved. As before version 1.5.27, an unrecognized non-empty value turns scanning on. The same substitution now applies to the scan attribute of <propertiesConfigurator>. This regression was reported in issues/1065 by vaibhavjain2.

• OutputStreamAppender and FileAppender now handle stateful encoders. The Encoder interface has a new default method called isStateful(), which returns false. An encoder that keeps state between calls to encode() can return true. For such encoders, the appender holds its write lock while encoding and while writing, so the output of concurrent appends cannot interleave. Stateless encoders still encode outside the lock, so their performance does not change. Existing encoders need no changes.

• Several race conditions in OutputStreamAppender and FileAppender were fixed. The appender is now marked started and the encoder header is written while the same lock is held, so a concurrent append can no longer write an event before the header. After acquiring the lock, the appender checks again whether it has been stopped, so no event is written after the footer. In prudent mode, FileAppender now encodes and writes each event while holding the lock.

• Fixed a data race on the logger count in LoggerContext. Loggers are created under the lock of their parent logger, so loggers with different parents could be created at the same time and increments of the shared counter could be lost. As a result, LoggerContext.size() could return a value lower than the actual number of loggers. The counter is now an AtomicInteger. This issue was reported in issues/1038 by hcantunc. The fix was contributed in PR #1055 by seonwoo_jung.

• TimeBasedRollingPolicy now supports half-day periods. Date patterns with the AM/PM marker, for example %d{yyyy-MM-dd-a}, used to be detected as daily and rolled over only at midnight. They now roll over at both 00:00 and 12:00. This issue was reported in issues/976 by shakthifuture. The fix was contributed in PR #1051 by seonwoo_jung. See TimeBasedRollingPolicy.

• If org.jline.jansi.AnsiConsole cannot be found on the class path, JansiConsoleAppender now emits warnings that explain how to add org.jline:jansi-core and then writes to the plain console stream. See codes.html#missingJlineJansi.

• The unused ch.qos.logback.classic.util.LogbackMDCAdapterSimple class was removed. LogbackMDCAdapter remains the default MDC adapter.

... (truncated)

Commits
  • a9ee801 prepare release 1.6.6
  • 7fa8e8e throw ScanException on unmatched '}' during variable substitution, fixes #836
  • 355b931 Test round trip of circular exceptions through LoggingEventVO
  • c7b8e2f reject cyclic throwable proxies in LoggingEventVO.readObject
  • 6217f11 fix loging of ThrowableProxy constructor taking isCyclic boolean
  • 0b95858 LOGBACK-1337 LogbackMDCAdapter should store mdc in LinkedHashMap to predict o...
  • 5c1f577 add LinkedHashMap to HardenedObjectInputStream whitelist
  • 7c36c71 Escape regex metacharacters in date patterns, harden rolling tests
  • d268774 Align date pattern to regex conversion with DateTimeFormatter
  • b4b4828 Escape regex metacharacters of literal text in FileNamePattern regexes
  • Additional commits viewable in compare view

Updates org.flywaydb:flyway-core from 13.1.0 to 13.11.1

Updates org.flywaydb:flyway-database-postgresql from 13.1.0 to 13.11.1

Updates org.flywaydb:flyway-database-postgresql from 13.1.0 to 13.11.1

Updates org.freemarker:freemarker from 2.3.34 to 2.3.35

Updates org.bouncycastle:bcprov-jdk18on from 1.85 to 1.86

Changelog

Sourced from org.bouncycastle:bcprov-jdk18on's changelog.

Bouncy Castle Crypto Package - Release Notes

1.0 Introduction

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. The package is organised so that it contains a light-weight API suitable for use in any environment (including the J2ME) with the additional infrastructure to conform the algorithms to the JCE framework.

2.0 Release History

2.1.1 Version

Release: 1.87
Date: 2026, TBD

2.1.2 Defects Fixed

  • PrivateKeyFactory, and so the ML-DSA and ML-KEM KeyFactory services, did not use the tag of the RFC 9881 / RFC 9935 private key CHOICE to decide which arm it had been given and applied no length checks of its own: a [0]-tagged value was treated as a seed whatever its length, so an expanded key under the seed tag was accepted, and the SEQUENCE of the both form accepted an expanded key in its seed position and compared the expandedKey position against it, so a both value carrying the expanded key twice, or a seed twice, was accepted or failed with an unhelpful message. The seed arm must now be exactly 32 (ML-DSA) or 64 (ML-KEM) bytes, the expandedKey arm the parameter set's expanded key length, and the both form exactly two elements with a seed of the seed length and an expandedKey of the expanded length that it expands to, with a tag other than [0] rejected. The three forms of the pre-RFC drafts - the raw seed or raw expanded key as the privateKey OCTET STRING's content, and the seed in an untagged OCTET STRING - are still read, as before.
  • X500Name.equals compared two names that are equal but not byte-identical - the same RDNs in another order, or in another string type - by searching the second name for each RDN of the first and canonicalising both values on every candidate comparison, so the comparison was quadratic in the number of RDNs, and CMSSignedData.getSignerInfos(), the CMSEnvelopedData, CMSAuthEnvelopedData and CMSEnvelopedDataParser constructors, TimeStampToken, the S/MIME classes built on them and X509CertificateHolderSelector.match() all compare names taken from the message before anything in it is verified: a 1.1 MB signed or enveloped message carrying two 40,000 RDN issuer names took about 90 seconds of CPU to parse. The signer and recipient stores also indexed their entries in a HashMap keyed on the signer or recipient id, whose hash code is easy to make collide, so a message with 16,000 signers or recipients chosen to collide took several seconds to index. AbstractX500NameStyle.areEqual now compares the RDNs positionally and otherwise sorts the canonical form of each RDN once and compares the two multisets, so a comparison is n log n in the number of RDNs, the two stores now scan their entries on lookup instead of indexing them, and the selector checks the serial number before the issuer name.
  • The hash code of an ASN.1 object is a short fold over its content octets that a sender can make collide at will, and several tables built while a message is parsed were keyed on one: the extension table behind Extensions, so every certificate, CRL, OCSP and timestamp request parse, the deprecated X509Extensions, ExtendedKeyUsage, the CMS AttributeTable built from a SignerInfo's signed and unsigned attributes (the unsigned ones lying outside the signature), the EST CSRAttributesResponse index, and the Set of digest AlgorithmIdentifiers that the CMSSignedDataParser constructor and CMSSignedData.getDigestAlgorithmIDs() build from the SignedData digestAlgorithms field. With every key sharing one hash code each insert scanned all those before it, so a 6 MB certificate or message holding 65,000 such entries took about 35 seconds of CPU to parse and the parser's digest algorithm set about 140 seconds. Those tables are now ordered maps keyed on the OID's string form and the digest algorithm sets are ordered on the identifier's DER encoding, so each is n log n in the number of entries whatever their hash codes. AttributeTable.add() and remove() also no longer share a multi-valued entry's Vector with the table they were derived from.
  • CMSSignedData digested the encapsulated or detached content once for every signer it verified, so a message carrying many SignerInfos over a large content cost their product in digesting before any signature was checked, where CMSSignedDataParser digests once per algorithm named in the digestAlgorithms field. The signers of a CMSSignedData now share the content digests computed under each digest algorithm identifier, so signers using the same algorithm digest the content once. The new org.bouncycastle.cms.max_digest_algorithms property bounds the number of distinct digest algorithms either class will compute over one message's content, each algorithm past the limit raising a CMSException; it is unlimited unless set.
  • The verify side of the ML-DSA-CALCULATE-MU signature service, and MLDSASigner.verifyMu beneath it, compared the supplied mu with a value derived from the key's tr and the context alone, never absorbing the message passed to update(), so a correct mu was accepted only for an empty message and rejected for every other, while the sign side of the same service computed mu correctly. The comparison also finalised the engine's shared digest, so an ordinary verifySignature on the same MLDSASigner afterwards failed for a valid signature, and a mu of the wrong length escaped Signature.verify() as an unchecked DataLengthException. verifyMu now derives the expected mu from the message digest exactly as generateMu does and compares in constant time, the signer stays usable afterwards, the service answers a wrong-length mu with a SignatureException, and the contract - the verify side accepts exactly the mu the sign side returns for the same key, context and data - is now in the javadoc of both.
  • The SM2 key pair generator of the BC provider, KeyPairGenerator.getInstance("SM2", "BC"), was built on the generic EC key pair generator rather than the lightweight SM2KeyPairGenerator the 1.73 release notes described, so it could draw a private key of n - 1, which Section 6.1 of GB/T 32918.1 excludes and which the SM2 signer rejects. It now uses SM2KeyPairGenerator and draws from [1, n - 2].
  • ESTResponse added each header line of an EST server's response to its header table by copying that header's value array, so a response repeating one header many times was quadratic to parse - about 7 seconds of CPU per megabyte of header lines - and a read limit set through JsseESTServiceBuilder.withReadLimit() only applied once the header block had been read. The values of each header are now collected once, and the header block counts against the read limit of the source.
  • The C509 encoding of an RFC 6955 proof-of-possession value (the sa-ecdhPop signature algorithms, values 14 to 16 of the C509 Signature Algorithms Registry) copied the DER DhSigStatic into the signature value byte string, where Section 4.2 of draft-ietf-cose-cbor-encoded-cert-21 defines the value as the bare hashValue when the DhSigStatic names no issuer and serial number and as the [issuer, certificateSerialNumber, hashValue] array when it does. The converter now produces both forms from the DER and reconstructs the DER from either; previously the array form was rejected outright and the byte-string form reconstructed a signature value four bytes short of the DER it came from, so a type 3 request carrying one could not verify. The privateKeyPossessionStatement certification request attribute (RFC 9883, Section 4.3.3 of the draft) was carried in the generic ~oid form on conversion and refused on reconstruction; it is now converted to and from its int-coded [issuer, certificateSerialNumber, cert] form, with an embedded signature certificate re-encoded as a type 3 C509 certificate. The certificate, certification request and template vectors of draft-ietf-cose-c509-test-vectors-02 now drive the util and pkix test suites.
  • The DANE SMIMEA support in org.bouncycastle.cert.dane had three defects. JndiDANEFetcherFactory, when asked for every entry under a bare domain name, removed the first and last characters of the owner name the JNDI DNS provider reports for each listed record, assuming a quoted name; the provider returns the name unquoted with a trailing root dot, so the first hex digit of the hash label was lost and the lookup that followed could never find the record. It now removes only the root dot. DANEEntryStore kept one entry per owner name, so an address with more than one SMIMEA record (a signing and an encryption certificate, say) only ever showed its last; every entry is now kept. DANEEntrySelectorFactory split an address at its first '@', mis-handling a quoted local-part containing one, and threw StringIndexOutOfBoundsException rather than DANEException for an address with none; it now splits at the last '@', removes enclosing quotes and backslash quoting from the local-part before hashing as RFC 8162 sec. 3 describes, and rejects an address with no '@'. The DANEEntry(String, byte[]) constructor also now rejects, with an IOException, a record whose flags do not describe a full certificate entry rather than parsing whatever follows the flags as a certificate.
  • TimeStampToken accepted a token whose signing-time signed attribute disagreed with the genTime in its TSTInfo. Both are the TSA's statement of when the token was produced, and the disagreement is what distinguishes an RFC 3161 token from a signature a TSA has put over a supplied TSTInfo through another service using the same key, such as a legacy countersignature endpoint, which some TSAs still offer. The constructor now rejects a token whose signing-time, when present, is further from genTime than the token's accuracy plus one minute; the check can be switched off with the org.bouncycastle.tsp.allow_inconsistent_signing_time property. TimeStampTokenGenerator now sets a signing-time attribute from the genTime it is given rather than the clock, so its tokens are consistent whatever genTime is passed.
  • TimeStampToken.validate() accepted a token whose message imprint was calculated with MD5, for which collisions can be computed, and TSPAlgorithms.ALLOWED, the set the request side is typically checked against, included MD5. MD5 has been removed from TSPAlgorithms.ALLOWED, and validate() now rejects a token whose imprint algorithm is not in it (failure code badAlg). The new TSPAlgorithms.LEGACY is ALLOWED plus MD5; validate(SignerInformationVerifier, Set) takes the set of acceptable imprint algorithms, and the org.bouncycastle.tsp.allowed_imprint_algorithms property, a comma separated list of digest names or OIDs, replaces ALLOWED as the default for validate(SignerInformationVerifier). TSPAlgorithms.ALLOWED and LEGACY are now unmodifiable.
  • CRL-based revocation checking (the PKIX CertPathValidator and the pkix X509RevocationChecker) tracked a CRL entry's reasonCode in the same field as its own status markers and did not range-check it, so a CRL entry whose reasonCode was outside the RFC 5280 sec. 5.3.1 set was mishandled: 11 left the certificate unrevoked, other out-of-range values threw an unchecked exception out of validation. The revocation date and the reason code are now kept separately; an undefined reasonCode is processed as unspecified and reported as "(unknown code: N)".
  • OERDefinition.enumItem(label, value) discarded the explicit enumerand value: Builder.enumValue() set it on the builder it had just copied and returned the copy without it, so every item was numbered by its position in the definition instead. The value is now kept, and the items without one are numbered as X.680 sec. 20.3 and 20.6 specify: a root item takes the successive integers from 0, skipping any explicit root number, and an extension item takes the smallest value not defined in the root and greater than every preceding extension item (the old loop restarted its count after an explicit number, so an explicit 0 followed by an unnumbered item was a duplicate). The three ETSI TS 102 941 response-code definitions that use explicit values give "ok" the value 0 at position 0, so their encodings are unchanged.
  • OERInputStream read the two length-prefixed INTEGER forms and BIT STRING with Streams.readFully and did not check its best-effort return, so a stream that ended inside the value decoded the zero-padded buffer as a value rather than failing. Every length-driven read in the decoder now goes through Streams.readLenBytesFully, which fails with EOFException at the real end of input and, for a long length, does not allocate the full array until the stream has delivered a fair part of it - so a hostile length that is within the decoder's allocation cap, or a cap a caller has raised, cannot drive a large allocation from a short input.
  • The OER codec gave a signed INTEGER whose upper bound is exactly the maximum of a fixed-size word the next word up: X.696 sec. 10.4 a)-d) make both bounds inclusive, but the upper-bound comparison was strict, so INTEGER (-128..127) was a two-octet word rather than one, and likewise at the 16-, 32- and 64-bit boundaries. The two signed ranges shipped with the library, NinetyDegreeInt and OneEightyDegreeInt, lie inside the four-octet word and are unaffected.
  • The ETSI TS 102 941 response code wrappers AuthorizationResponseCode, AuthorizationValidationResponseCode and EnrolmentResponseCode checked their range on BigInteger.intValue(), which truncates, so a value past the int range whose low 32 bits were in range was accepted - 2^32 as "ok". The check now rejects a negative value or one over 31 bits before consulting intValue().
  • OERInputStream accepted an empty group of octets as the value zero in four places where X.696 requires at least one: a variable-size INTEGER with a length determinant of 0 (sec. 3.7.11 and 3.7.12 define the number forms as one or more octets), an ENUMERATED long form with 0 subsequent octets (sec. 11.4 says 1 to 127), a length determinant long form with 0 subsequent octets (sec. 8.6.5, likewise) and a sequence-of quantity of 0 octets (sec. 17.2). Each now fails with an IOException; the one-octet encodings of zero decode as before.
  • OEROutputStream could not encode a CHOICE whose chosen alternative has a tag number of 63 or more. X.696 sec. 8.7.2.2 keeps a tag number below 63 in the first octet and sec. 8.7.2.3 continues one of 63 or more in 7-bit groups, most significant first, with bit 8 as the continuation flag; the encoder used the single octet up to and including 63, so 63 went out as the continuation escape with nothing after it, and BitBuilder.write7BitBytes took its groups from bit 31 downward rather than from the low end, so 63 encoded as 83 78, which decodes as 504. Both forms of write7BitBytes now write the fewest 7-bit groups of the value, and the boundary is at 63. No CHOICE in the shipped ITS definitions has that many alternatives.
  • OEROutputStream rejected a required SEQUENCE component as absent whenever it arrived wrapped in an OEROptional, the form the ITS classes' toASN1Primitive methods produce for present values, rather than only when the wrapper is the undefined ABSENT. A defined wrapper at a required position is now unwrapped and written like the bare value.
  • OERInputStream, for an absent optional SEQUENCE component selected through a switch, tested the selected alternative for a default value but then took the default from the switch itself, which has none, so the alternative's default was added as null and the decode failed with NullPointerException. The default now comes from the selected alternative. No definition shipped with the library has a switched component with a default.
  • OERInputStream read a SEQUENCE OF count through BigInteger.intValue(), which keeps only the low 32 bits, so a count of 2^32 + 3 decoded as 3 elements and the rest of the input was left in place for the next field. A count that does not fit in 31 bits is now rejected as out of range, and the fixed sizes taken from a definition go through BigIntegers.intValueExact() rather than silently truncating.
  • OERInputStream rejected a valid SEQUENCE OF as "out of range" on any stream whose available() reported fewer bytes than the element count: available() is an estimate of what can be read without blocking, 0 from the base InputStream and from wrappers such as CipherInputStream, and the decoder had been using it as a bound on the count. The count is now bounded by the decoder's allocation ceiling (maxByteAllocation, 1 MiB by default) instead, and a count within it over a short input fails at the first element that is not there.
  • OERInputStream could not decode a variable-size BIT STRING. X.696 sec. 13.3 encodes one as a length determinant covering an initial octet, which gives the number of unused bits in the final octet, and the octets of the value, which is what OEROutputStream writes; the decoder read the determinant as a bit count, divided it by 8 and never read the initial octet, so it took no data at all for a two-octet value, and a stray third branch keyed on a negative size bound threw NullPointerException for an unbounded schema. The decoder now has the two forms of clause 13: a fixed size reads the whole octets the size occupies and derives the unused bits from it (a 12-bit string is two octets with four unused bits, where it was one octet), and any other size reads the determinant, the initial octet (rejected over 7, or non-zero for an empty value, 13.3.4) and the data, carrying the unused-bit count into the DERBitString. OERDefinition gains bitString() and bitString(lower, upper) alongside bitString(size). The single BIT STRING in the shipped ITS definitions is a fixed 8 bits and decodes as before.
  • OEROutputStream wrote a negative INTEGER value under a type whose lower bound is zero or more through the unsigned encodings, so it went out as a different, positive value: -1 under INTEGER (0..255) as FF, the encoding of 255, and under INTEGER (0..MAX) as 01 FF. A negative value is now rejected with IllegalArgumentException on both unsigned paths.
  • OERInputStream.uint64() read its eight octets as a signed number, so a value with the top bit set came back negative; the other uintN readers were unsigned. It now reads unsigned.
  • The OER codec treated an INTEGER with a positive lower bound as signed. X.696 sec. 10.2 a) gives the unsigned encodings to an integer whose lower bound is zero or positive; OERInputStream and OEROutputStream tested for a lower bound of exactly zero, so INTEGER (1..255) went out as a two-octet signed word rather than one unsigned octet and INTEGER (1..MAX) as a variable-size signed number, where 128 is 00 80 rather than 80. No OER definition shipped with the library puts a positive lower bound on an INTEGER.
  • The OER codec encoded and decoded a negative ENUMERATED value wrongly. X.696 sec. 11.4 reserves the one-octet short form for the values 0 to 127 and puts every other value, negative ones included, in the long form as a two's-complement signed integer; OEROutputStream chose the long form only for values above 127, so a negative value went out in the short form masked to seven bits (-1 as 7F, the encoding of 127), and OERInputStream read a long-form value as unsigned (81 FF, the encoding of -1, as 255). Both now follow sec. 11.4. No OER definition shipped with the library dec...

    Description has been truncated

@dependabot
build(deps): Bump the monthly-batch group across 1 directory with 26 …
60d33cc 
…updates

Bumps the monthly-batch group with 26 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [jakarta.enterprise:jakarta.enterprise.cdi-api](https://github.com/eclipse-ee4j/cdi) | `4.1.0` | `5.0.0` |
| [jakarta.json.bind:jakarta.json.bind-api](https://github.com/jakartaee/jsonb-api) | `3.0.2` | `3.0.4` |
| [org.eclipse.microprofile.config:microprofile-config-api](https://github.com/eclipse/microprofile-config) | `3.1.1` | `3.1.3` |
| [org.postgresql:postgresql](https://github.com/pgjdbc/pgjdbc) | `42.7.13` | `42.7.14` |
| org.slf4j:slf4j-api | `2.0.18` | `2.0.20` |
| [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.6.1` | `1.6.6` |
| org.flywaydb:flyway-core | `13.1.0` | `13.11.1` |
| org.flywaydb:flyway-database-postgresql | `13.1.0` | `13.11.1` |
| org.flywaydb:flyway-database-postgresql | `13.1.0` | `13.11.1` |
| org.freemarker:freemarker | `2.3.34` | `2.3.35` |
| [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java) | `1.85` | `1.86` |
| [org.bouncycastle:bcpg-jdk18on](https://github.com/bcgit/bc-java) | `1.85` | `1.86` |
| [org.bouncycastle:bcutil-jdk18on](https://github.com/bcgit/bc-java) | `1.85` | `1.86` |
| [org.bouncycastle:bcpg-jdk18on](https://github.com/bcgit/bc-java) | `1.85` | `1.86` |
| [org.bouncycastle:bcutil-jdk18on](https://github.com/bcgit/bc-java) | `1.85` | `1.86` |
| org.apache.cxf:cxf-rt-frontend-jaxrs | `4.2.2` | `4.2.4` |
| org.apache.cxf:cxf-rt-rs-client | `4.2.2` | `4.2.4` |
| org.apache.cxf:cxf-rt-rs-client | `4.2.2` | `4.2.4` |
| org.apache.johnzon:johnzon-core | `2.1.0` | `2.2.0` |
| org.apache.johnzon:johnzon-jsonb | `2.1.0` | `2.2.0` |
| org.apache.johnzon:johnzon-jsonb | `2.1.0` | `2.2.0` |
| [org.junit:junit-bom](https://github.com/junit-team/junit-framework) | `6.1.2` | `6.1.3` |
| [com.palantir.javaformat:palantir-java-format](https://github.com/palantir/palantir-java-format) | `2.96.0` | `2.102.0` |
| [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) | `3.15.0` | `3.16.0` |
| [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire) | `3.5.6` | `3.6.1` |
| [org.apache.maven.plugins:maven-install-plugin](https://github.com/apache/maven-install-plugin) | `3.1.4` | `3.2.0` |
| [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.5.6` | `3.6.1` |
| [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) | `3.9.0` | `3.10.4` |
| [io.openliberty.tools:liberty-maven-plugin](https://github.com/OpenLiberty/ci.maven) | `3.12.1` | `3.12.4` |
| [org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin) | `3.6.1` | `3.6.2` |
| org.apache.maven:apache-maven | `3.9.16` | `3.10.0` |



Updates `jakarta.enterprise:jakarta.enterprise.cdi-api` from 4.1.0 to 5.0.0
- [Release notes](https://github.com/eclipse-ee4j/cdi/releases)
- [Commits](jakartaee/cdi@4.1.0...5.0.0)

Updates `jakarta.json.bind:jakarta.json.bind-api` from 3.0.2 to 3.0.4
- [Release notes](https://github.com/jakartaee/jsonb-api/releases)
- [Commits](jakartaee/jsonb-api@3.0.2...3.0.4)

Updates `org.eclipse.microprofile.config:microprofile-config-api` from 3.1.1 to 3.1.3
- [Release notes](https://github.com/eclipse/microprofile-config/releases)
- [Commits](microprofile/microprofile-config@3.1.1...3.1.3)

Updates `org.postgresql:postgresql` from 42.7.13 to 42.7.14
- [Release notes](https://github.com/pgjdbc/pgjdbc/releases)
- [Changelog](https://github.com/pgjdbc/pgjdbc/blob/master/CHANGELOG.md)
- [Commits](pgjdbc/pgjdbc@REL42.7.13...REL42.7.14)

Updates `org.slf4j:slf4j-api` from 2.0.18 to 2.0.20

Updates `ch.qos.logback:logback-classic` from 1.6.1 to 1.6.6
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.6.1...v_1.6.6)

Updates `org.flywaydb:flyway-core` from 13.1.0 to 13.11.1

Updates `org.flywaydb:flyway-database-postgresql` from 13.1.0 to 13.11.1

Updates `org.flywaydb:flyway-database-postgresql` from 13.1.0 to 13.11.1

Updates `org.freemarker:freemarker` from 2.3.34 to 2.3.35

Updates `org.bouncycastle:bcprov-jdk18on` from 1.85 to 1.86
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcpg-jdk18on` from 1.85 to 1.86
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcutil-jdk18on` from 1.85 to 1.86
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcpg-jdk18on` from 1.85 to 1.86
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcutil-jdk18on` from 1.85 to 1.86
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.apache.cxf:cxf-rt-frontend-jaxrs` from 4.2.2 to 4.2.4

Updates `org.apache.cxf:cxf-rt-rs-client` from 4.2.2 to 4.2.4

Updates `org.apache.cxf:cxf-rt-rs-client` from 4.2.2 to 4.2.4

Updates `org.apache.johnzon:johnzon-core` from 2.1.0 to 2.2.0

Updates `org.apache.johnzon:johnzon-jsonb` from 2.1.0 to 2.2.0

Updates `org.apache.johnzon:johnzon-jsonb` from 2.1.0 to 2.2.0

Updates `org.junit:junit-bom` from 6.1.2 to 6.1.3
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](junit-team/junit-framework@r6.1.2...r6.1.3)

Updates `com.palantir.javaformat:palantir-java-format` from 2.96.0 to 2.102.0
- [Release notes](https://github.com/palantir/palantir-java-format/releases)
- [Commits](palantir/palantir-java-format@2.96.0...2.102.0)

Updates `org.apache.maven.plugins:maven-compiler-plugin` from 3.15.0 to 3.16.0
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.15.0...maven-compiler-plugin-3.16.0)

Updates `org.apache.maven.plugins:maven-failsafe-plugin` from 3.5.6 to 3.6.1
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.5.6...surefire-3.6.1)

Updates `org.apache.maven.plugins:maven-install-plugin` from 3.1.4 to 3.2.0
- [Release notes](https://github.com/apache/maven-install-plugin/releases)
- [Commits](apache/maven-install-plugin@maven-install-plugin-3.1.4...maven-install-plugin-3.2.0)

Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.5.6 to 3.6.1
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.5.6...surefire-3.6.1)

Updates `com.diffplug.spotless:spotless-maven-plugin` from 3.9.0 to 3.10.4
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](diffplug/spotless@maven/3.9.0...maven/3.10.4)

Updates `io.openliberty.tools:liberty-maven-plugin` from 3.12.1 to 3.12.4
- [Release notes](https://github.com/OpenLiberty/ci.maven/releases)
- [Commits](OpenLiberty/ci.maven@liberty-maven-3.12.1...liberty-maven-3.12.4)

Updates `org.codehaus.mojo:build-helper-maven-plugin` from 3.6.1 to 3.6.2
- [Release notes](https://github.com/mojohaus/build-helper-maven-plugin/releases)
- [Commits](mojohaus/build-helper-maven-plugin@3.6.1...3.6.2)

Updates `org.apache.maven:apache-maven` from 3.9.16 to 3.10.0

---
updated-dependencies:
- dependency-name: jakarta.enterprise:jakarta.enterprise.cdi-api
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: monthly-batch
- dependency-name: jakarta.json.bind:jakarta.json.bind-api
  dependency-version: 3.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: monthly-batch
- dependency-name: org.eclipse.microprofile.config:microprofile-config-api
  dependency-version: 3.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: monthly-batch
- dependency-name: org.postgresql:postgresql
  dependency-version: 42.7.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: monthly-batch
- dependency-name: org.slf4j:slf4j-api
  dependency-version: 2.0.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: monthly-batch
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: monthly-batch
- dependency-name: org.flywaydb:flyway-core
  dependency-version: 13.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
- dependency-name: org.flywaydb:flyway-database-postgresql
  dependency-version: 13.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
- dependency-name: org.flywaydb:flyway-database-postgresql
  dependency-version: 13.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
- dependency-name: org.freemarker:freemarker
  dependency-version: 2.3.35
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: monthly-batch
- dependency-name: org.bouncycastle:bcprov-jdk18on
  dependency-version: '1.86'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
- dependency-name: org.bouncycastle:bcpg-jdk18on
  dependency-version: '1.86'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
- dependency-name: org.bouncycastle:bcutil-jdk18on
  dependency-version: '1.86'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
- dependency-name: org.bouncycastle:bcpg-jdk18on
  dependency-version: '1.86'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
- dependency-name: org.bouncycastle:bcutil-jdk18on
  dependency-version: '1.86'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
- dependency-name: org.apache.cxf:cxf-rt-frontend-jaxrs
  dependency-version: 4.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: monthly-batch
- dependency-name: org.apache.cxf:cxf-rt-rs-client
  dependency-version: 4.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: monthly-batch
- dependency-name: org.apache.cxf:cxf-rt-rs-client
  dependency-version: 4.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: monthly-batch
- dependency-name: org.apache.johnzon:johnzon-core
  dependency-version: 2.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
- dependency-name: org.apache.johnzon:johnzon-jsonb
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
- dependency-name: org.apache.johnzon:johnzon-jsonb
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
- dependency-name: org.junit:junit-bom
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: monthly-batch
- dependency-name: com.palantir.javaformat:palantir-java-format
  dependency-version: 2.102.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-version: 3.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
- dependency-name: org.apache.maven.plugins:maven-failsafe-plugin
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
- dependency-name: org.apache.maven.plugins:maven-install-plugin
  dependency-version: 3.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-version: 3.10.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
- dependency-name: io.openliberty.tools:liberty-maven-plugin
  dependency-version: 3.12.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: monthly-batch
- dependency-name: org.codehaus.mojo:build-helper-maven-plugin
  dependency-version: 3.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: monthly-batch
- dependency-name: org.apache.maven:apache-maven
  dependency-version: 3.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: monthly-batch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Nov 1, 2026
@codecov

codecov Bot commented Nov 1, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.30%. Comparing base (44b9081) to head (60d33cc).

Additional details and impacted files 
@@            Coverage Diff            @@
##               main     #204   +/-   ##
=========================================
  Coverage     77.30%   77.30%           
  Complexity      187      187           
=========================================
  Files            40       40           
  Lines           608      608           
  Branches         53       53           
=========================================
  Hits            470      470           
  Misses          108      108           
  Partials         30       30

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants