[dependabot]

Bumps the maven-minor-and-patch group with 37 updates:

Package	From	To
tools.jackson:jackson-bom	3.1.7	3.2.4
com.fasterxml.jackson:jackson-bom	2.21.7	2.22.4
org.apache.tomcat.embed:tomcat-embed-core	11.0.26	11.0.27
org.apache.tomcat.embed:tomcat-embed-el	11.0.26	11.0.27
org.apache.tomcat.embed:tomcat-embed-websocket	11.0.26	11.0.27
org.springframework.boot:spring-boot-dependencies	4.1.1	4.1.2
org.springdoc:springdoc-openapi-starter-webmvc-api	3.1.1	3.2.0
net.jqwik:jqwik	1.9.3	1.10.2
co.elastic.clients:elasticsearch-rest5-client	9.5.5	9.5.6
dk.brics:automaton	1.12-4	1.13-1
com.nimbusds:nimbus-jose-jwt	10.4	10.10
org.apache.zookeeper:zookeeper	3.6.4	3.9.7
com.google.errorprone:error_prone_core	2.50.0	2.52.0
com.uber.nullaway:nullaway	0.14.2	0.14.3
org.apache.maven.plugins:maven-surefire-plugin	3.6.0	3.6.1
org.apache.maven.plugins:maven-failsafe-plugin	3.6.0	3.6.1
org.apache.maven.plugins:maven-dependency-plugin	3.7.0	3.11.0
org.apache.maven.plugins:maven-enforcer-plugin	3.6.3	3.7.0
org.jacoco:jacoco-maven-plugin	0.8.15	0.8.16
com.github.spotbugs:spotbugs-maven-plugin	4.10.4.1	4.10.5.0
org.apache.maven.plugins:maven-source-plugin	3.3.1	3.4.0
org.sonatype.central:central-publishing-maven-plugin	0.11.0	0.12.0
io.dropwizard.metrics:metrics-core	4.1.12.1	4.2.40
commons-logging:commons-logging	1.3.6	1.4.0
org.codehaus.mojo:build-helper-maven-plugin	3.6.1	3.6.2
io.netty:netty-bom	4.1.137.Final	4.2.20.Final
org.apache.hive:hive-jdbc	4.0.1	4.2.1
org.apache.hbase:hbase-shaded-client-byo-hadoop	2.5.16-hadoop3	2.6.7-hadoop3
org.apache.hbase:hbase-server	2.5.16-hadoop3	2.6.7-hadoop3
commons-io:commons-io	2.21.0	2.22.0
commons-cli:commons-cli	1.9.0	1.11.0
org.apache.maven.plugins:maven-shade-plugin	3.6.1	3.6.2
org.codehaus.woodstox:stax2-api	4.2.2	4.3.2
org.apache.commons:commons-text	1.14.0	1.15.0
org.apache.hadoop.thirdparty:hadoop-shaded-guava	1.1.1	1.6.0
org.apache.hadoop.thirdparty:hadoop-shaded-protobuf_3_25	1.5.0	1.6.0
org.apache.commons:commons-collections4	4.4	4.6.0

Updates tools.jackson:jackson-bom from 3.1.7 to 3.2.4

Commits

• 47303b4 [maven-release-plugin] prepare release jackson-bom-3.2.4
• cad7311 Prep for 3.2.4 release
• 2e47c28 Merge branch '3.1' into 3.2
• c41bfec Post-release dep version bump
• 86e94b2 [maven-release-plugin] prepare for next development iteration
• c70e58a [maven-release-plugin] prepare release jackson-bom-3.1.8
• 7d4ab97 Prep for 3.1.8 release
• 3244f25 Merge branch '2.x' into 3.1
• 6439613 Merge branch '2.22' into 2.x
• a7d1c9f Post-release dep version bump
• Additional commits viewable in compare view

Updates com.fasterxml.jackson:jackson-bom from 2.21.7 to 2.22.4

Commits

• 267bf9a [maven-release-plugin] prepare release jackson-bom-2.22.4
• d41cad1 Prep for 2.22.4 release
• 8fd9ace Merge branch '2.21' into 2.22
• e1b27ed Post-release dep version bump
• 5dfe489 [maven-release-plugin] prepare for next development iteration
• b23db92 [maven-release-plugin] prepare release jackson-bom-2.21.8
• 8937d04 Prep for 2.21.8 release
• c44e739 Merge branch '2.20' into 2.21
• b86d50e Merge branch '2.19' into 2.20
• 7756e79 Merge branch '2.18' into 2.19
• Additional commits viewable in compare view

Updates org.apache.tomcat.embed:tomcat-embed-core from 11.0.26 to 11.0.27

Updates org.apache.tomcat.embed:tomcat-embed-el from 11.0.26 to 11.0.27

Updates org.apache.tomcat.embed:tomcat-embed-websocket from 11.0.26 to 11.0.27

Updates org.apache.tomcat.embed:tomcat-embed-el from 11.0.26 to 11.0.27

Updates org.apache.tomcat.embed:tomcat-embed-websocket from 11.0.26 to 11.0.27

Updates org.springframework.boot:spring-boot-dependencies from 4.1.1 to 4.1.2

Release notes

Sourced from org.springframework.boot:spring-boot-dependencies's releases.

v4.1.2

⭐ New Features

• Add TWENTY_SEVEN to JavaVersion enum #51426

🐞 Bug Fixes

• OriginTrackedResource does not implement equals correctly #52267
• OriginTrackedPropertiesLoader drops properties whose name starts with # or ! #52265
• JWTs are rejected when issuer-uri is empty and jwk-set-uri is set #52260
• Package manifest attributes are missing for nested jars without directory entries #52258
• Logback ColorConverter unnecessarily parses its options for every log event #52228
• Empty system property in TestPropertyValues is cleared instead of being restored to its empty value #52208
• Graceful shutdown of Tomcat or Jetty may call back with REQUESTS_ACTIVE when stop is called immediately after shutDownGracefully on an idle server #52197
• NettyWebServer stop may hang when called immediately after shutDownGracefully #52196
• gRPC client 'grpc' load balancing fails to bind with a NullPointerException when no child policies are configured #52193
• Prevent gRPC client properties from overriding user customizations #52175
• MongoDB fails to connect when credentials contain a space #52168
• Authentication fails when password configured in spring.elasticsearch.uris contains a colon #52166
• Logging can be lost when a context is paused by the test context framework #52088
• Docker Compose support for MongoDB fails to connect when credentials contain a character that requires URL encoding #52084
• Jersey does not use the endpoint ObjectMapper when Actuator is running on a separate port #51982
• Fractions of a second are handled incorrectly when configuring gRPC service config durations #51957
• Configuration property descriptions may be lost when building incrementally with Gradle #51925
• BasicJsonParser mishandles escaped characters in nested lists and maps #51908
• Zero week value conversion fails with 'intValue cannot be extracted from WEEKS' exception #51894
• App fails to start when using DevTools and manually configuring JDBC or R2DBC without spring-boot-jdbc or spring-boot-r2dbc #51890
• Docker Compose support incorrectly recognizes MARIADB_ALLOW_EMPTY_PASSWORD instead of MARIADB_ALLOW_EMPTY_ROOT_PASSWORD #51888
• Auto-configured Kotlinx Serialization JSON codec customization is not applied #51877
• NullPointerException can be thrown when using uber jars due to a race condition in NestedJarFileResources #51745
• DevTools does not detect a reactive web environment #51730
• spring.http.clients.cookie-handling has no effect when using a reactive client backed by an HttpComponents connector #51724
• Connection fails when rabbitmq Docker Compose service is configured to use SSL #51667
• SBOM-related manifest attributes are missing from Maven-packaged wars #51651
• When server.reactive.session.cookie.same-site is not set, session cookies have no SameSite attribute #51639
• OAuth2 resource server ignores authorities-claim-delimiter when set on its own #51630
• developmentOnly and testAndDevelopmentOnly configurations do not specify any attributes causing potential resolution problems #51623
• In a reactive web application, Cloud Foundry security integration returns a 500 rather than a 503 when the cloud controller URL is unavailable #51614
• Layer temp file is not deleted when layer creation fails #51581
• Docker Compose integration for RabbitMQ skips credential fallbacks when an environment variable has no value #51578
• Some assertion messages name the wrong parameter #51574
• OAuth2ResourceServerProperties.Jwt has a setter that does not match its getter #51562
• jarmode tools commands print stacktrace instead of an error message #51547
• Docker Compose ProcessRunner can hang or leave orphan processes #51538
• NestedByteChannel.read(ByteBuffer) incorrectly returns 0 when buffer could not be filled #51520
• Customizer null checks in HTTP client builders assert the wrong attribute #51513
• SSL host config customizations may be lost during Tomcat initialization #51511
• SQL Server Docker Compose integration may duplicate the JDBC URL's encrypt parameter #51481
• WritableJson.toByteArray() may corrupt supplementary characters #51464
• SSL host config customizations are lost when reloading SSL bundles #51457

... (truncated)

Commits

• 634e6fd Release 4.1.2
• 6b43cf1 Upgrade to Spring WS 5.0.3
• a73dfad Upgrade to Spring Security 7.1.2
• 0485f1e Upgrade to Spring RESTDocs 4.0.2
• de2c11a Upgrade to Spring Pulsar 2.0.8
• 8d0359e Upgrade to Spring LDAP 4.1.2
• f22c6e6 Upgrade to Spring Kafka 4.1.2
• ed55709 Upgrade to Spring Integration 7.1.2
• 2e88a38 Upgrade to Spring HATEOAS 3.1.3
• 0d69ce5 Upgrade to Spring gRPC 1.1.2
• Additional commits viewable in compare view

Updates org.springdoc:springdoc-openapi-starter-webmvc-api from 3.1.1 to 3.2.0

Release notes

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-api's releases.

springdoc-openapi v3.2.0 released!

Spring Boot 4.1.x line (built on Spring Boot 4.1.2).

⚠️ Changes you may notice

• Default API version (#3354): the default API version is now only listed in the version header or query parameter of the operations that actually serve it (a handler mapped to it, or one without a version). Operations mapped only to other versions no longer show it as an allowed value or as their default. This also fixes the HTTP 500 raised when the version parameter declared @Schema(allowableValues).
• Newly required properties (#3360, #3361): the PagedModel / PageMetadata properties and the amount / currency properties of MonetaryAmount are now marked as required, as they are always serialized. Generated clients will see them as non-nullable.
• Scalar 0.6 (#3359): upgraded to 0.6.83. The first tag is now open by default, and model links changed from #model/name to #models/Name.
• Scalar's standalone integration (#3387): with the Swagger UI or API-only starters, Scalar's own auto-configuration is no longer disabled by springdoc. If you have com.scalar.maven on the classpath and don't want it, set scalar.enabled=false.

New

• Opt-in nullability for Java models (#3382): springdoc.model-converters.java-nullable-property-customizer.enabled=true marks properties annotated with @Nullable (JSpecify, Spring, JSR-305) as nullable, including $ref and oneOf properties, without changing shared components.
• Polymorphic oneOf as reusable components (#3390): springdoc.model-converters.polymorphic-converter.one-of-as-ref=true, with the name suffix set by springdoc.model-converters.polymorphic-converter.one-of-ref-suffix (Variant by default).
• ParameterCustomizer can read type-use annotations, including inside Optional<@MyAnnotation Foo> (#3370).
• MCP tools are registered with a McpStatelessSyncServer, for the Spring AI STATELESS protocol (#3388).

Fixed

• @ResponseStatus on a controller class is applied to its operations (#3352).
• An injected WebSession is no longer documented as a query parameter in WebFlux (#3355).
• The application no longer fails to start with Spring HATEOAS on the classpath but no LinkRelationProvider bean (#3364).
• WebAsyncTask return types are unwrapped (#3368).
• A JSpecify @Nullable on a controller parameter makes its schema nullable (#3377).
• Nullable Kotlin properties described by a oneOf (e.g. sealed classes) are documented as nullable (#3381).
• Gradle builds no longer lift Jackson 2 above the version managed by Spring Boot (#3373).

Security

• The MCP dashboard no longer pre-fills the OAuth2 token endpoint, client id and client secret, and warns when the token endpoint is not HTTPS.

Dependencies

Spring Boot 4.1.2 · swagger-ui 5.34.0 · Scalar 0.6.83 · Spring AI 2.0.1 · Spring Cloud Function 5.0.5 · spring-security-oauth2-authorization-server managed by Spring Boot (7.1.2)

Thanks to all the contributors of this release: @​MaxFreedomPollard, @​kdelay, @​arimu1, @​dpkass, @​anupamchaubey, @​Mattias-Sehlstedt, @​Naresh7175, @​ys0v9, @​sharanggupta, @​itd-sw, @​gwr0-0, @​Tework123, @​awinishere.

Changelog

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-api's changelog.

[3.2.0] - 2026-10-24

Added

• #3370 – A ParameterCustomizer can read the type-use annotations of a parameter, including the ones declared on the value wrapped in an Optional, such as Optional<@MyAnnotation Foo>
• #3382 – Mark the Java properties annotated with @Nullable (JSpecify, Spring, JSR-305) as nullable in their schema, including $ref and oneOf properties. Opt-in with springdoc.model-converters.java-nullable-property-customizer.enabled=true
• #3390 – Add springdoc.model-converters.polymorphic-converter.one-of-as-ref to emit the polymorphic oneOf unions as reusable component schemas, named after the parent schema with the suffix set by springdoc.model-converters.polymorphic-converter.one-of-ref-suffix (Variant by default)
• #3388 – Register the MCP tools with a McpStatelessSyncServer, for the STATELESS protocol

Changed

• The MCP dashboard no longer pre-fills the OAuth2 token endpoint, client id and client secret. The form shows hints instead, and warns when the token endpoint is not HTTPS
• #3354 – The default API version is only listed in the header or query parameter of the operations that serve it: a handler method mapped to it, or one without a version
• #3360 – The properties of Spring Data PagedModel and its PageMetadata are now marked as required, as they are always serialized
• #3361 – The amount and currency properties of MonetaryAmount are now marked as required
• #3359 – Upgrade Scalar to version 0.6.83. The first tag is now open by default, and the links to models changed from #model/name to #models/Name
• #3383 – Upgrade Spring AI to version 2.0.1. The MCP SDK version is now the one required by Spring AI
• Upgrade spring-boot to version 4.1.2
• Upgrade swagger-ui to version 5.34.0
• Upgrade spring-cloud-function to version 5.0.5
• Use the spring-security-oauth2-authorization-server version managed by Spring Boot (7.1.2) instead of 2.0.0-M2

Fixed

• #3352 – A @ResponseStatus on a controller class is now applied to the responses of its operations
• #3355 – An injected WebSession parameter is no longer documented as a query parameter in WebFlux applications
• #3354 – /v3/api-docs no longer fails when an API version parameter declares @Schema(allowableValues)
• #3364 – The application no longer fails to start when Spring HATEOAS is on the classpath without a LinkRelationProvider bean
• #3368 – A WebAsyncTask return type is now unwrapped, so its response is described by its result type
• #3377 – A JSpecify @Nullable on a controller method parameter now makes its schema nullable
• #3381 – A nullable Kotlin property described by a oneOf schema, such as a sealed class, is now documented as nullable
• #3387 – Scalar's own integration works again with the Swagger UI and API-only starters: only the Springdoc Scalar starters replace it
• #3373 – springdoc no longer lifts Jackson 2 above the version managed by Spring Boot in Gradle builds

Commits

• 6b79ced [maven-release-plugin] prepare release v3.2.0
• 689fc13 Describe the nullable property customizer flags in the configuration metadata
• 7a1b506 Correct the LocalTime format in the changelog entry of gh-3351
• 96245a2 Upgrade Scalar to 0.6.83
• c494456 Build against the GA versions of the optional Spring dependencies
• 2d4595f Restore the changelog entries lost in the unreleased fixed section
• dd807bd Upgrade swagger-ui to version 5.34.0
• e649960 Upgrade spring-boot to 4.1.2
• b170ca8 Use the Jackson 2 managed by Spring Boot
• ae52fe7 Register the MCP tools with a McpStatelessSyncServer
• Additional commits viewable in compare view

Updates net.jqwik:jqwik from 1.9.3 to 1.10.2

Release notes

Sourced from net.jqwik:jqwik's releases.

Little Fix for IDEs

New and Enhanced Features

• Annotation @Provide has now @Keep as meta-annotation, which enables IDEs to recognise that methods using this annotation are indeed used. See issue 733 for details. Many thanks to JarvisCraft for finding and fixing it.

Dependency Upgrades and Bug Fixes

• Upgraded build system to Gradle 9.8.0

Anti-AI Release

Warning: Starting with version 1.10 jqwik comes with an Anti-AI Usage Clause! Usage with any "AI" agent is strongly discouraged. Jqwik's log output may confuse the agent.

This will probably be the last release of Jqwik using JUnit Platform version 1.x. Upcoming releases, if ever realised, will be built on JUnit Platform 6 and thus Java >= 21.

New and Enhanced Features

• Added paragraph about intended AI usage to user guide: This project is not meant to be used by any “AI” coding agents at all.

• Made @NotBlank configurator compatible with UTF-8 whitespace. See issue 663 for details.

Breaking Changes

• Use of jqwik >= 1.10 with coding agents is strongly discouraged. Jqwik's output to stdout may confuse AI-based agents.

Dependency Upgrades and Bug Fixes

• Upgraded to Kotlin 2.3.21
• Upgraded to JUnit Platform 1.14.4

Commits

• c8e1d6a Set release version 1.10.2
• c15cb3f Set Kotlin base version to 2.1
• ce65e4d Upgraded to Gradle 9.8.0
• b4c84f8 Mark @Provide as @Keep
• ac192eb Bump archunitVersion from 1.5.0 to 1.5.1
• c66e898 Updated CONTRIBUTING.md
• b915f62 Bump actions/setup-java from 5 to 6
• 91d608c Bump archunitVersion from 1.4.2 to 1.5.0
• 46a33cb Bump com.github.vlsi.gradle-extensions:com.github.vlsi.gradle-extensions.grad...
• f6e23bd Bump actions/checkout from 6 to 7
• Additional commits viewable in compare view

Updates co.elastic.clients:elasticsearch-rest5-client from 9.5.5 to 9.5.6

Commits

• d99e92e [codegen] update to latest spec (#1357)
• 3f0f0fd update otel dependency (#1360) (#1362)
• 3294481 bump version
• See full diff in compare view

Updates dk.brics:automaton from 1.12-4 to 1.13-1

Changelog

Sourced from dk.brics:automaton's changelog.

1.12-4 -> 1.13-1

• added MatchOnlyRunAutomaton for fast substring matching - contributed by J. McCartney
• RegExp allows empty union/intersection branches, e.g. "(|a)", and rejects unescaped reserved characters, e.g. "*a" - contributed by D. Robertson
• fixed getFiniteStrings omitting the empty string and returning null for singleton automata with negative limits - reported by A. Omori, fixed by J. Park
• fixed year format in XML Schema date/time datatypes - thanks to S. Gregersen
• fixed getShortestExample for rejected strings
• fixed surrogate pair handling in shuffleSubsetOf
• fixed makeDecimalValue to accept all valid lexical forms, e.g. ".5" and "1."
• fixed makeIntegerValue and makeDecimalValue to accept any sign for zero, e.g. "-0" and "+0.0"
• fixed U+FEFF missing from the Specials block in Datatypes
• fixed unintended mutation of inputs or shared automata
• fixed RegExp.toString to escape ~ and to print negated character classes as [^...]
• fixed shuffleSubsetOf counterexamples that split surrogate pairs or suspended regions
• fixed toAutomatonAllowMutate leaving the mutation flag set on exceptions
• fixed NullPointerException in Datatypes.exists and Datatypes.get for unknown names (get now throws IllegalArgumentException)
• fixed Automaton.load losing transitions of some automata, e.g. non-minimized automata from regular expressions
• fixed isTotal for non-minimal automata
• fixed minus to always return a deterministic automaton as documented
• fixed complement not minimizing its result when minimize-always is set
• fixed equals after SpecialOperations.reverse and setInitialState (stale hash code)
• fixed compress and trim missing strings, in particular for nondeterministic automata
• fixed prefixClose for the empty language
• fixed projectChars for singleton automata
• fixed RegExp.toString for numerical intervals without a fixed number of digits
• fixed makeStringUnion failing with assertions enabled if the empty string is included
• fixed makeMinInteger rejecting larger numbers with more digits, e.g. 10 for minimum 3
• fixed makeMaxInteger accepting the empty string for maximum 0
• fixed makeTotalDigits and makeFractionDigits for decimals without integer digits, e.g. ".5"
• fixed Unicode category automata missing code points in ranges, e.g. most CJK ideographs and Hangul syllables
• fixed gDay datatype to require three leading hyphens
• fixed XML Schema integer datatypes to accept a plus sign and leading zeros, and decimal and float to accept e.g. "1." and ".5"
• build updates
• added randomized and metamorphic tests of all operations

1.12-3 -> 1.12-4

• re-enable Java 8 support - thanks to D. Lowe

1.12-2 -> 1.12-3

• upgrade to Java 11 - thanks to L.J. McGibbney

1.12-1 -> 1.12-2

• fixed RegExp.toString - thanks to A. Gargantini

1.11-8 -> 1.12-1

• added Valmari's minimization algorithm - contributed by S. Gregersen

... (truncated)

Commits

• See full diff in compare view

Updates com.nimbusds:nimbus-jose-jwt from 10.4 to 10.10

Changelog

Sourced from com.nimbusds:nimbus-jose-jwt's changelog.

10.4 (2025-07-19) * Creates a hierarchy of Option interfaces, extended by JWSSignerOption, JWEEncrypterOption and JWEDecrypterOption. Intended to provide optional configuration parameters to RSASSASigner, ECDSASigner, RSADecrypter, etc. * Introduces CipherMode implementing JWEEncrypterOption and JWEDecrypterOption, to specify a preferred JCA Cipher mode, such as MODE_ENCRYPT / MODE_DECRYPT when the default MODE_WRAP / MODE_UNWRAP is not supported by the JCA provider (iss #576). * Updates RSAEncrypter and RSADecrypter to support the JWEEncrypterOption CipherMode.ENCRYPT_DECRYPT (iss #576). * Factors out OptionUtils.ensureMinRSAPrivateKeySize. * Deprecates OptionUtils.optionIsPresent.

10.4.1 (2025-08-05) * Adds "requires java.sql" to module com.nimbusds.jose.jwt (iss #595).

10.4.2 (2025-08-14) * Updates GSon to 2.13.1. * Updates BouncyCastle to 1.81.

10.5 (2025-09-05) * Support for specifying a ScheduledExecutorService instance in RefreshAheadCachingJWKSetSource and JWKSourceBuilder (iss #592).

10.6 (2025-11-06) * Adds static CollectionUtils.containsNull(Set) method. * DefaultJWTClaimsVerifier accepted "aud" (audience) argument must be compatible with Set.of (iss #499). * The DefaultJWTClaimsVerifier must not include JWT claim values in BadJWTException messages (iss #605).

10.7 (2026-01-08) * Adds MaxCompressedCipherTextLength that implements JWEDecrypterOption, to to configure the maximum allowed length of compressed cipher text. * Adds JWEObject.decrypt(JWEDecrypter, Set) method to support the MaxCompressedCipherTextLength option.

10.8 (2026-02-19) * Adds a PasswordBasedDecrypter(byte[], Set) constructor to specify names of the critical header parameters that are deferred to the application for processing. Aligns with other JWEDecrypter and CriticalHeaderParamsAware implementations (iss #610). * Fixes getDeferredCriticalHeaderParams() in AESDecrypter, DirectDecrypter, RSADecrypter, ECDHDecrypter, X25519Decrypter, ECDH1PUDecrypter, ECDH1PUX25519Decrypter, MultiDecrypter, MACVerifier, ECDSAVerifier and Ed25519Verifier. Must internally call critPolicy.getDeferredCriticalHeaderParams(), not critPolicy.getProcessedCriticalHeaderParams() (iss #612).

10.9 (2026-04-02)

... (truncated)

Commits

• 78e86f8 DefaultJWTClaimsVerifier accepted "aud" (audience) argument must be compatibl...
• d4c1e05 [maven-release-plugin] prepare release 10.6
• 6a6d0b3 [maven-release-plugin] prepare for next development iteration
• 72ba7d2 Add configurable max compressed cipher text length for JWE decryption (iss #570)
• 74d1dd1 Merged in feature/configurable-max-compressed-ciphertext-length (pull request...
• 1b4a3eb Edits JavaDocs, CHANGELOG.txt for 10.7 release
• 9f4752d Adds casts to tests
• ebdea4e [maven-release-plugin] prepare release 10.7
• 9509dc5 [maven-release-plugin] prepare for next development iteration
• 0e27c9c Adds a PasswordBasedDecrypter(byte[], Set<String>) constructor to specify nam...
• Additional commits viewable in compare view

Updates org.apache.zookeeper:zookeeper from 3.6.4 to 3.9.7

Updates com.google.errorprone:error_prone_core from 2.50.0 to 2.52.0

Release notes

Sourced from com.google.errorprone:error_prone_core's releases.

Error Prone 2.52.0

New checks:

• AlmostExhaustiveTestParameter: Prefer an exhaustive @TestParameter with an assumption to filter out specific enum values, so newly added enum values are automatically tested (disabled by default).
• SingleTestParameter: Suggest @TestParameter on the parameter instead of @TestParameters when there is only one test parameter, replacing PreferTestParameter (disabled by default).
• SingleValueTestParameter: Suggest replacing a @TestParameter that has only a single value with a local variable in the test method (disabled by default).
• ValueClassEquals: Require non-record concrete value classes to explicitly override equals and hashCode.

Other changes:

• LoopToTestParameter: Changed severity to SUGGESTION (disabled by default).
• DistinctVarargsChecker: Allow duplicate arguments to Iterables.concat (#6239) and Mockito argument matchers such as any() (#6240).
• UnusedVariable: Treat fields accessed via MethodHandles.Lookup (VarHandle/getter/setter lookups) or Atomic*FieldUpdater.newUpdater as used.
• StringBuilderInitWithChar / StringBuffer refactoring: Refactor StringBuffer to StringBuilder even when used with Matcher.appendReplacement and appendTail (when supported by the target JDK or Android minSdkVersion).
• CompileTimeConstant: Treat record and interface fields and field accesses on compile-time constants (compileTimeConstant.compileTimeConstantField) as compile-time constants.
• ValueClassIdentity / ReferenceEquality: Handle JEP 401 value classes.
• FieldCanBeFinal / ThreadSafety: Improve compile-time performance on large classes and deep type hierarchies, and update SafeRE to 1.1.0 (#6230).
• Added ClassName for caching resolved ClassSymbol, Type, and binary Name lookups across a compilation.

Closed issues: #5964, #6165, #6230, #6239, #6240, #6275

Full changelog: google/error-prone@v2.51.0...v2.52.0

Error Prone 2.51.0

New checks:

• HashCodeInObjectsHash: Detect redundant hashCode() or Objects.hash() calls inside Objects.hash(...), and simplify single-argument Objects.hash(x) calls to Objects.hashCode(x).
• LoopToTestParameter: Suggest migrating loops in unit tests to TestParameterInjector.
• MissingJavadoc: Flag public types that are missing Javadoc comments (disabled by default).
• PreferCharsetOverload: Prefer calling method and constructor overloads that accept a Charset over those that accept a String encoding name.
• PreferPreconditions: Suggest using Guava's Preconditions instead of explicit if-throw statements for parameter validation (disabled by default).
• RequireNonNullRefactoring: Refactor explicit if (x == null) { throw new NullPointerException(...); } checks to Objects.requireNonNull (disabled by default).
• SimplifyTestParameter: Remove redundant explicit value lists on @TestParameter annotations for boolean and Enum types when all values are specified (disabled by default).
• TraditionalJavadocToMarkdown: Convert traditional /** ... */ Javadoc comments into /// Markdown Javadoc comments (disabled by default).
• ValueClassIdentity: Flag reliance on identity semantics (such as synchronization, WeakReference, IdentityHashMap, or System.identityHashCode) of value-based classes (disabled by default).

Other changes:

• CompareToZero: Upgraded from warning to error, and expanded to flag non-relational operations, unary negation, and switch statements/expressions on compareTo and compare results without Integer.signum.
• IfChainToSwitch: Enabled by default as a warning.
• UndefinedEquals: Merged ArrayAsKeyOfSetOrMap and CollectionUndefinedEquality into UndefinedEquals (retaining their names as altNames), and generalized detection of types without well-defined equals or hashCode across direct equality, collection containment, and hash-based containers.
• EqualsIncompatibleType / TruthIncompatibleType: Flag equality comparisons between distinct record types (#6107).
• ReferenceEquality: Allow == comparisons on private classes whose type hierarchy does not override Object.equals (#5865), private static final sentinel fields, Thread (#5900), and com.sun.source.tree.Tree.
• PatternMatchingInstanceof: Support while and for loops, parenthesized expressions (#5843), and replacing additional redundant casts when the instanceof already introduces a pattern variable.
• DistinctVarargsChecker: Expanded to check Objects.hash, CompletableFuture.allOf/anyOf, EnumSet.of, Sets.union/intersection/difference, Stream.concat, Math.min/max, and additional JDK, Guava, Protobuf, Truth, and Mockito methods.
• MustBeClosedChecker: Require java.lang.foreign.Arena.ofConfined and Arena.ofShared to be closed.
• ImpossibleNullComparison: Flag null checks on the return value of Class.forName.
• RestrictedApi / RestrictedInheritance: Added an allowedPaths attribute to allow calls or inheritance from matching file paths without a regular expression.
• InlineMeInliner: Support substituting type arguments at call sites when inlining generic @InlineMe methods.
• WellKnownKeep: Recognize Apache Beam DoFn annotations and retain open-source library annotations (Gson, Mockito, Guice, Objectify, TestParameterInjector, AutoFactory).

... (truncated)

Commits

• 1e32314 Release Error Prone 2.52.0
• ea4c6df Avoid calling SuggestedFixes.compilesWithFix in FieldCanBeFinal
• 04640b8 Update SafeRE to 1.1.0
• 6034e09 Bump the dependencies group across 1 directory with 8 updates
• 3cc36d5 Bump actions/setup-java from 6.0.1 to 6.1.0 in the github-actions group (#6270)
• 0202185 Migrate class and annotation name constants in Error Prone to ClassName.
• cdf0d94 Add ASTHelpers.overridesObjectEquals and overridesObjectHashCode helpers.
• 208015e Update MemoizeConstantVisitorStateLookups to suggest ClassName.
• e1a8a3e Add ValueClassEquals to require non-record concrete value classes to over...
• 2c6baed Handle JEP 401 value classes in ValueClassIdentity and ReferenceEquality
• Additional commits viewable in compare view

Updates com.uber.nullaway:nullaway from 0.14.2 to 0.14.3

Release notes

Sourced from com.uber.nullaway:nullaway's releases.

NullAway 0.14.3

Many bug fixes in this release. Thanks especially to @​vlsi and @​subhramit for all the contributions! As they are now committers, their many contributions are not credited individually below.

Two bug fixes of note are #2005 and #2003, which may lead to new warnings even outside JSpecify mode.

We have also added initial support for @PolyNull in library models in #1813. We will continue to enhance this support, but it should be helpful in removing some false positives from JSpecifyExperimental mode.

• Allow configuring suppression-remover source encoding (#1894)
• Compute a call's executable type once per generic inference by @​ericschlarmann (#1896)
• Skip nested annotation restoration from raw source types (#1898)
• Refine argument nullness after Objects.equals calls by @​Beluomini (#1900)
• Keep nullable map values nullable after containsKey (#1902)
• Read nullable fields from JSpecify JDK models into astubx (#1901)
• Avoid initialization-check crashes in @NullMarked constructors by @​ZedingZhang (#1929)
• Store types of implicit lambda parameters during inference (#1930)
• Compute erasure before binary promotion (#1935)
• Preserve captured type variables during constraint generation (#1941)
• Cache conversion of MethodSymbols to MethodRefs (#1964)
• Restore nullness annotations from implicit wildcard bounds (#1967)
• Use call-specific generic inference variables (#1965)
• Account for nullable map values in getOrDefault (#1985)
• Fix crash in map callbacks after an unmarked or suppressed filter predicate (#1996)
• Strip reference casts when computing access paths (#1997)
• Handle negated null checks in multi-argument boolean contracts (#1998)
• Skip parentheses around a lambda or method reference passed to unmarked code (#1999)
• Fix crash on method references to annotated array types (#2000)
• Skip a lower-bounded wildcard when restoring annotations on a call type (#2001)
• Strip parentheses before handlers match stream callbacks and boolean literals (#2002)
• Check explicitly typed lambda parameters against unmarked interface methods (#2003)
• Add PolyNull library models and apply them to Optional.orElseGet and Map.computeIfAbsent (#1813)
• Report unboxing of a @​Nullable operand inside a primitive conditional expression (#2005)
• Report unboxing of a @​Nullable result inside a primitive switch expression (#2006)
• Fix crash on null-marked code nested in unmarked lambdas and local classes (#2007)
• Strip parentheses before the futures and gRPC handlers match an argument (

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ❌ 11 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

View full job summary

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml