Skip to content

Bump the dependencies group across 1 directory with 8 updates - #1447

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/dependencies-ca7ea8206e
Open

Bump the dependencies group across 1 directory with 8 updates#1447
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/dependencies-ca7ea8206e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 8 updates in the / directory:

Package From To
com.google.guava:guava 33.6.0-jre 33.7.1-jre
com.google.guava:guava-testlib 33.6.0-jre 33.7.1-jre
org.commonmark:commonmark 0.29.0 0.30.0
org.commonmark:commonmark-ext-gfm-tables 0.29.0 0.30.0
org.graalvm.buildtools:native-maven-plugin 1.1.7 1.1.10
org.eclipse.tycho:tycho-maven-plugin 5.0.3 5.0.4
org.eclipse.tycho:tycho-versions-plugin 5.0.3 5.0.4
org.eclipse.tycho:target-platform-configuration 5.0.3 5.0.4

Updates com.google.guava:guava from 33.6.0-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

Javadoc

JDiff

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
</tr></table>

... (truncated)

Commits

Updates com.google.guava:guava-testlib from 33.6.0-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava-testlib's releases.

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

Javadoc

JDiff

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
</tr></table>

... (truncated)

Commits

Updates com.google.guava:guava-testlib from 33.6.0-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava-testlib's releases.

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

Javadoc

JDiff

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
</tr></table>

... (truncated)

Commits

Updates org.commonmark:commonmark from 0.29.0 to 0.30.0

Release notes

Sourced from org.commonmark:commonmark's releases.

commonmark-java 0.30.0

Added

  • New option lineSeparator for MarkdownRenderer.Builder to change the default line separator from \n (e.g. to \r\n) (#442)
  • YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (#391)

Changed

  • Tables extension: Limit max number of parsed table cells by default (1 million cells), see option maxCells in TablesExtension.Builder. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.
  • The default for maxOpenBlockParsers for Parser.Builder is now 100; configure the option to remove the limit.
  • Limit how deeply inline nodes may nest by default (100), see option maxInlineNesting in Parser.Builder; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. * or the ins extension's +) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.

Fixed

  • Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished):
    • Inline HTML like "x <!--".repeat(100_000) (#447)
    • Autolink starts like "<".repeat(100_000)
    • Emphasis like "a**b" + "c* ".repeat(100_000)
    • Backticks runs of different lengths
  • Fix stack overflow errors when parsing pathological inputs with repeated syntax:
    • HTML block attributes
    • Autolink email addresses
    • Deeply nested emphasis
  • Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see maxInlineNesting above). This can happen with emphasis, e.g. "*".repeat(n) + "x" + "*".repeat(n) or "*a ".repeat(n) + " b*".repeat(n), as well as with images, e.g. "![".repeat(https://github.com/commonmark/commonmark-java/blob/HEAD/n) + "x" + "](u)".repeat(n)
  • YAML front matter extension: Fix inefficient string concatenation for literal-block values (|)
Changelog

Sourced from org.commonmark:commonmark's changelog.

[0.30.0] - 2026-08-06

Added

  • New option lineSeparator for MarkdownRenderer.Builder to change the default line separator from \n (e.g. to \r\n) (#442)
  • YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (#391)

Changed

  • Tables extension: Limit max number of parsed table cells by default (1 million cells), see option maxCells in TablesExtension.Builder. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.
  • The default for maxOpenBlockParsers for Parser.Builder is now 100; configure the option to remove the limit.
  • Limit how deeply inline nodes may nest by default (100), see option maxInlineNesting in Parser.Builder; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. * or the ins extension's +) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.

Fixed

  • Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished):
    • Inline HTML like "x <!--".repeat(100_000) (#447)
    • Autolink starts like "<".repeat(100_000)
    • Emphasis like "a**b" + "c* ".repeat(100_000)
    • Backticks runs of different lengths
  • Fix stack overflow errors when parsing pathological inputs with repeated syntax:
    • HTML block attributes
    • Autolink email addresses
    • Deeply nested emphasis
  • Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see maxInlineNesting above). This can happen with emphasis, e.g. "*".repeat(n) + "x" + "*".repeat(n) or "*a ".repeat(n) + " b*".repeat(n), as well as with images, e.g. "![".repeat(https://github.com/commonmark/commonmark-java/blob/main/n) + "x" + "](u)".repeat(n)
  • YAML front matter extension: Fix inefficient string concatenation for literal-block values (|)
Commits
  • 64037cf [maven-release-plugin] prepare release commonmark-parent-0.30.0
  • bd3e066 Fix Javadoc
  • 4aaf754 mvn versions:set -DnewVersion=0.30.0-SNAPSHOT
  • 42b4fb7 Prepare CHANGELOG for version 0.30.0
  • b76e09d Limit how deep inline nodes may nest by default (100)
  • 49f65cb Fix StackOverflowError when parsing deeply nested emphasis
  • 610f84b Fix StackOverflowError when parsing pathological autolink email addresses
  • 9f1d738 Fix StackOverflowError when parsing pathological HTML block attributes
  • e13297e Fix quadratic runtime when parsing pathological backticks
  • 89d1bd3 Fix quadratic runtime when parsing with lots of <
  • Additional commits viewable in compare view

Updates org.commonmark:commonmark-ext-gfm-tables from 0.29.0 to 0.30.0

Release notes

Sourced from org.commonmark:commonmark-ext-gfm-tables's releases.

commonmark-java 0.30.0

Added

  • New option lineSeparator for MarkdownRenderer.Builder to change the default line separator from \n (e.g. to \r\n) (#442)
  • YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (#391)

Changed

  • Tables extension: Limit max number of parsed table cells by default (1 million cells), see option maxCells in TablesExtension.Builder. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.
  • The default for maxOpenBlockParsers for Parser.Builder is now 100; configure the option to remove the limit.
  • Limit how deeply inline nodes may nest by default (100), see option maxInlineNesting in Parser.Builder; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. * or the ins extension's +) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.

Fixed

  • Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished):
    • Inline HTML like "x <!--".repeat(100_000) (#447)
    • Autolink starts like "<".repeat(100_000)
    • Emphasis like "a**b" + "c* ".repeat(100_000)
    • Backticks runs of different lengths
  • Fix stack overflow errors when parsing pathological inputs with repeated syntax:
    • HTML block attributes
    • Autolink email addresses
    • Deeply nested emphasis
  • Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see maxInlineNesting above). This can happen with emphasis, e.g. "*".repeat(n) + "x" + "*".repeat(n) or "*a ".repeat(n) + " b*".repeat(n), as well as with images, e.g. "![".repeat(https://github.com/commonmark/commonmark-java/blob/HEAD/n) + "x" + "](u)".repeat(n)
  • YAML front matter extension: Fix inefficient string concatenation for literal-block values (|)
Changelog

Sourced from org.commonmark:commonmark-ext-gfm-tables's changelog.

[0.30.0] - 2026-08-06

Added

  • New option lineSeparator for MarkdownRenderer.Builder to change the default line separator from \n (e.g. to \r\n) (#442)
  • YAML front matter extension: Support extracting the raw YAML content so that you can do the YAML parsing using a library (instead of the limited built-in parsing) (#391)

Changed

  • Tables extension: Limit max number of parsed table cells by default (1 million cells), see option maxCells in TablesExtension.Builder. Parsing will throw an error if the limit would be exceeded, to protect against malicious input.
  • The default for maxOpenBlockParsers for Parser.Builder is now 100; configure the option to remove the limit.
  • Limit how deeply inline nodes may nest by default (100), see option maxInlineNesting in Parser.Builder; configure the option to remove the limit. This covers emphasis-like delimiters (e.g. * or the ins extension's +) as well as images, which can otherwise nest arbitrarily deep for a small amount of input. Anything over the limit is treated as plain text instead.

Fixed

  • Fix quadratic runtime on various pathological inputs (where inline syntax to start a node is used repeatedly but never finished):
    • Inline HTML like "x <!--".repeat(100_000) (#447)
    • Autolink starts like "<".repeat(100_000)
    • Emphasis like "a**b" + "c* ".repeat(100_000)
    • Backticks runs of different lengths
  • Fix stack overflow errors when parsing pathological inputs with repeated syntax:
    • HTML block attributes
    • Autolink email addresses
    • Deeply nested emphasis
  • Fix stack overflow error when rendering/visiting deeply nested inline nodes, by capping nesting depth during parsing (see maxInlineNesting above). This can happen with emphasis, e.g. "*".repeat(n) + "x" + "*".repeat(n) or "*a ".repeat(n) + " b*".repeat(n), as well as with images, e.g. "![".repeat(https://github.com/commonmark/commonmark-java/blob/main/n) + "x" + "](u)".repeat(n)
  • YAML front matter extension: Fix inefficient string concatenation for literal-block values (|)
Commits
  • 64037cf [maven-release-plugin] prepare release commonmark-parent-0.30.0
  • bd3e066 Fix Javadoc
  • 4aaf754 mvn versions:set -DnewVersion=0.30.0-SNAPSHOT
  • 42b4fb7 Prepare CHANGELOG for version 0.30.0
  • b76e09d Limit how deep inline nodes may nest by default (100)
  • 49f65cb Fix StackOverflowError when parsing deeply nested emphasis
  • 610f84b Fix StackOverflowError when parsing pathological autolink email addresses
  • 9f1d738 Fix StackOverflowError when parsing pathological HTML block attributes
  • e13297e Fix quadratic runtime when parsing pathological backticks
  • 89d1bd3 Fix quadratic runtime when parsing with lots of <
  • Additional commits viewable in compare view

Updates org.graalvm.buildtools:native-maven-plugin from 1.1.7 to 1.1.10

Release notes

Sourced from org.graalvm.buildtools:native-maven-plugin's releases.

1.1.10

What's Changed

Full Changelog: graalvm/native-build-tools@1.1.9...1.1.10

1.1.9

What's Changed

Full Changelog: graalvm/native-build-tools@1.1.8...1.1.9

1.1.8

What's Changed

Full Changelog: graalvm/native-build-tools@1.1.7...1.1.8

Commits
  • aa59858 Release 1.1.10
  • eb02d62 Bump version to 1.1.10-SNAPSHOT (#1023)
  • 6662144 Merge pull request #1022 from graalvm/release/1.1.9
  • 70a22ad Release 1.1.9
  • 226c2f2 Merge pull request #1021 from graalvm/update-metadata-to-1.0.10
  • 750e24d Update reachability metadata to 1.0.10
  • f9d090c Clarify layer selector and test suite support
  • 8a62507 Skip later Gradle layer consumers on GraalVM 25.0
  • fa9cb64 Narrow GraalVM 25.0 layer test skips
  • a7f0ca4 Skip Gradle layer consumers on GraalVM 25.0
  • Additional commits viewable in compare view

Updates org.eclipse.tycho:tycho-maven-plugin from 5.0.3 to 5.0.4

Release notes

Sourced from org.eclipse.tycho:tycho-maven-plugin's releases.

Tycho 5.0.4 has been released and is available from Maven Central repository.

🆕 https://github.com/eclipse-tycho/tycho/blob/tycho-5.0.4/RELEASE_NOTES.md 🏷️ https://github.com/eclipse-tycho/tycho/tree/tycho-5.0.4 👔 https://projects.eclipse.org/projects/technology.tycho/releases/5.0.4 🙏 contributors who contributed patches for this release:

  • Andreas Schwarz
  • Christoph Läubrich
  • dependabot[bot]
  • Ed Merks
  • Hannes Wellmann
  • janosch24
  • Lars Vogel
  • Patrick Ziegler
  • Raffi Khatchadourian
  • Rene Muehle
  • Titouan Vervack
  • Vasili Gulevich
  • Александър Куртаков

💰 we would like to also thank the Eclipse IDE Workingroup for funding the release work and thanks to everyone who helped us with testing the snapshot version.

and thanks to everyone who helped us with testing the snapshot version.

Regards,

The Tycho Team

What's Changed

... (truncated)

Changelog

Sourced from org.eclipse.tycho:tycho-maven-plugin's changelog.

5.0.4

Features

  • Add support for Require-Capability filtering: a new disable-require-capability profile property lets you break P2 capability/Require-Bundle resolution cycles by stripping Require-Capability from the resolver state
  • tycho-p2-extras:mirror and related P2 Manager tooling gains an ecfProvider parameter to select the file transfer provider used to fetch content, defaulting to org.eclipse.ecf.provider.filetransfer.httpclientjava
  • Add generic bnd-run properties parameter and a debugPort parameter to the bnd-test mojo
  • Add a content-redirections parameter to tycho-p2-extras:mirror (fixes #6155)
  • Add capability to override an existing manifest in bundles via a new attribute on the Maven target location
  • Distinguish cache hits from real downloads in the p2 transport log, so warm-cache builds no longer look like they are re-downloading everything and real network activity remains visible in CI logs
  • Deduplicate versions by major.minor.micro in the baseline EclipseIndexArtifactVersionProvider, significantly speeding up baseline checks against indices (e.g. Orbit) that contain many qualifier-only builds of the same bundle (e.g. org.eclipse.swt)
  • ECLIPSE_LATEST now resolves to the 2026-06 Eclipse release

Bug Fixes

  • Fix tycho-p2-extras:p2-manager (P2ManagerMojo) failing to start: the default JustJ tools repository URL was invalid, and the mojo now supports customizable managerRepository and eclipseRepository properties along with a default for the relative parameter
  • Fix double URL-encoding of paths with spaces in category-p2-metadata, which previously caused the P2 publisher to fail with ProvisionException: Error reading update site for update sites containing spaces
  • Fix exclusion of Plexus defaults on useDefaultExcludes (#6196)
  • Fix BOM dependency expansion in Maven target locations, including a version range resolution failure in tests and an operator precedence NPE in MavenDependencyCollector.isVersionRanged(); wrapped bundle versions are now normalized to 3-part OSGi format so raw Bundle-Version matches the P2-normalized version used in IUs and generated feature plugin references
  • Port m2e changes for BOM dependencies in m2e target locations
  • Add missing version ranges to the implicit imports of tycho.surefire.junit5, preventing JUnit 6+ bundles from being pulled into the test runtime just because a test project depends on JUnit 5 packages/bundles

Dependency Upgrades

The following notable dependencies have been upgraded:

Eclipse Platform

Eclipse Platform and related components have been updated to the 2026-06 release train, including:

  • JDT (ECJ 3.45.0 → 3.46.0, JDT Core, JDT Launching, JDT Core Manipulation, JDT UI)
  • PDE (PDE Core 3.21.200 → 3.21.300, PDE API Tools 1.3.1100 → 1.3.1200, PDE UI 3.16.400 → 3.16.500)
  • Equinox (OSGi 3.24.100 → 3.24.200, Common, Concurrent, Frameworkadmin, Simpleconfigurator Manipulator)
  • Platform UI (Workbench, IDE 3.23.0 → 3.23.100, JFace 3.39.0 → 3.39.100, LTK Core Refactoring)
  • Help Base: 4.6.0 → 4.6.100

Build Tools & Libraries

  • ASM: 9.10 → 9.10.1
  • BND: 7.2.3 → 7.3.0
  • BouncyCastle: 1.84 → 1.85
  • Apache Commons Codec: 1.22.0 → 1.22.1
  • Apache Maven Dependency Plugin, Jar Plugin (3.5.0 → 3.5.1), Resolver Transport File
  • CycloneDX Core Java: 12.2.0 → 13.1.0
  • CycloneDX Maven Plugin: 2.9.1 → 2.9.3
  • domtrip-core: 1.2.0 → 1.6.0
  • JGit: 7.6.0 → 7.7.1
  • JUnit: 6.1.0 → 6.1.3 (now imported via junit-bom)
  • Jetty: 12.1.9 → 12.1.12
  • jfiveparse: 2.0.0 → 2.1.0
  • Maven Njord Extension: 0.9.6 → 0.9.10

... (truncated)

Commits
  • c4349ee Perform 5.0.4 release
  • 4d7a54e Update RELEASE_NOTES.md for 5.0.4 release
  • 585506a Bump ch.digitalfondue.jfiveparse:jfiveparse from 2.0.1 to 2.1.0
  • 82f7ad5 Bump eu.maveniverse.maven.domtrip:domtrip-core from 1.2.0 to 1.6.0
  • 7a4a210 Bump org.cyclonedx:cyclonedx-core-java from 13.0.0 to 13.1.0
  • d9ef632 Bump eu.maveniverse.maven.njord:extension3 from 0.9.9 to 0.9.10
  • b0396c4 Bump org.junit:junit-bom from 6.1.2 to 6.1.3
  • 7a4f6de Add support for Require-Capability filtering
  • 8b83f15 Add integration test for category-p2-metadata path with spaces
  • f7d34ab Fix double URL-encoding of paths with spaces in category-p2-metadata
  • Additional commits viewable in compare view

Updates org.eclipse.tycho:tycho-versions-plugin from 5.0.3 to 5.0.4

Release notes

Sourced from org.eclipse.tycho:tycho-versions-plugin's releases.

Tycho 5.0.4 has been released and is available from Maven Central repository.

🆕 https://github.com/eclipse-tycho/tycho/blob/tycho-5.0.4/RELEASE_NOTES.md 🏷️ https://github.com/eclipse-tycho/tycho/tree/tycho-5.0.4 👔 https://projects.eclipse.org/projects/technology.tycho/releases/5.0.4 🙏 contributors who contributed patches for this release:

  • Andreas Schwarz
  • Christoph Läubrich
  • dependabot[bot]
  • Ed Merks
  • Hannes Wellmann
  • janosch24
  • Lars Vogel
  • Patrick Ziegler
  • Raffi Khatchadourian
  • Rene Muehle
  • Titouan Vervack
  • Vasili Gulevich
  • Александър Куртаков

💰 we would like to also thank the Eclipse IDE Workingroup for funding the release work and thanks to everyone who helped us with testing the snapshot version.

and thanks to everyone who helped us with testing the snapshot version.

Regards,

The Tycho Team

What's Changed

... (truncated)

Changelog

Sourced from org.eclipse.tycho:tycho-versions-plugin's changelog.

5.0.4

Features

  • Add support for Require-Capability filtering: a new disable-require-capability profile property lets you break P2 capability/Require-Bundle resolution cycles by stripping Require-Capability from the resolver state
  • tycho-p2-extras:mirror and related P2 Manager tooling gains an ecfProvider parameter to select the file transfer provider used to fetch content, defaulting to org.eclipse.ecf.provider.filetransfer.httpclientjava
  • Add generic bnd-run properties parameter and a debugPort parameter to the bnd-test mojo
  • Add a content-redirections parameter to tycho-p2-extras:mirror (fixes #6155)
  • Add capability to override an existing manifest in bundles via a new attribute on the Maven target location
  • Distinguish cache hits from real downloads in the p2 transport log, so warm-cache builds no longer look like they are re-downloading everything and real network activity remains visible in CI logs
  • Deduplicate versions by major.minor.micro in the baseline EclipseIndexArtifactVersionProvider, significantly speeding up baseline checks against indices (e.g. Orbit) that contain many qualifier-only builds of the same bundle (e.g. org.eclipse.swt)
  • ECLIPSE_LATEST now resolves to the 2026-06 Eclipse release

Bug Fixes

  • Fix tycho-p2-extras:p2-manager (P2ManagerMojo) failing to start: the default JustJ tools repository URL was invalid, and the mojo now supports customizable managerRepository and eclipseRepository properties along with a default for the relative parameter
  • Fix double URL-encoding of paths with spaces in category-p2-metadata, which previously caused the P2 publisher to fail with ProvisionException: Error reading update site for update sites containing spaces
  • Fix exclusion of Plexus defaults on useDefaultExcludes (#6196)
  • Fix BOM dependency expansion in Maven target locations, including a version range resolution failure in tests and an operator precedence NPE in MavenDependencyCollector.isVersionRanged(); wrapped bundle versions are now normalized to 3-part OSGi format so raw Bundle-Version matches the P2-normalized version used in IUs and generated feature plugin references
  • Port m2e changes for BOM dependencies in m2e target locations
  • Add missing version ranges to the implicit imports of tycho.surefire.junit5, preventing JUnit 6+ bundles from being pulled into the test runtime just because a test project depends on JUnit 5 packages/bundles

Dependency Upgrades

The following notable dependencies have been upgraded:

Eclipse Platform

Eclipse Platform and related components have been updated to the 2026-06 release train, including:

  • JDT (ECJ 3.45.0 → 3.46.0, JDT Core, JDT Launching, JDT Core Manipulation, JDT UI)
  • PDE (PDE Core 3.21.200 → 3.21.300, PDE API Tools 1.3.1100 → 1.3.1200, PDE UI 3.16.400 → 3.16.500)
  • Equinox (OSGi 3.24.100 → 3.24.200, Common, Concurrent, Frameworkadmin, Simpleconfigurator Manipulator)
  • Platform UI (Workbench, IDE 3.23.0 → 3.23.100, JFace 3.39.0 → 3.39.100, LTK Core Refactoring)
  • Help Base: 4.6.0 → 4.6.100

Build Tools & Libraries

  • ASM: 9.10 → 9.10.1
  • BND: 7.2.3 → 7.3.0
  • BouncyCastle: 1.84 → 1.85
  • Apache Commons Codec: 1.22.0 → 1.22.1
  • Apache Maven Dependency Plugin, Jar Plugin (3.5.0 → 3.5.1), Resolver Transport File
  • CycloneDX Core Java: 12.2.0 → 13.1.0
  • CycloneDX Maven Plugin: 2.9.1 → 2.9.3
  • domtrip-core: 1.2.0 → 1.6.0
  • JGit: 7.6.0 → 7.7.1
  • JUnit: 6.1.0 → 6.1.3 (now imported via junit-bom)
  • Jetty: 12.1.9 → 12.1.12
  • jfiveparse: 2.0.0 → 2.1.0
  • Maven Njord Extension: 0.9.6 → 0.9.10

... (truncated)

Commits
  • c4349ee Perform 5.0.4 release
  • 4d7a54e Update RELEASE_NOTES.md for 5.0.4 release
  • 585506a Bump ch.digitalfondue.jfiveparse:jfiveparse from 2.0.1 to 2.1.0
  • 82f7ad5 Bump eu.maveniverse.maven.domtrip:domtrip-core from 1.2.0 to 1.6.0
  • 7a4a210 Bump org.cyclonedx:cyclonedx-core-java from 13.0.0 to 13.1.0
  • d9ef632 Bump eu.maveniverse.maven.njord:extension3 from 0.9.9 to 0.9.10
  • b0396c4 Bump org.junit:junit-bom from 6.1.2 to 6.1.3
  • 7a4f6de Add support for Require-Capability filtering
  • 8b83f15 Add integration test for category-p2-metadata path with spaces
  • f7d34ab Fix double URL-encoding of paths with spaces in category-p2-metadata
  • Additional commits viewable in compare view

Updates org.eclipse.tycho:target-platform-configuration from 5.0.3 to 5.0.4

Release notes

Sourced from org.eclipse.tycho:target-platform-configuration's releases.

Tycho 5.0.4 has been released and is available from Maven Central repository.

🆕 https://github.com/eclipse-tycho/tycho/blob/tycho-5.0.4/RELEASE_NOTES.md 🏷️ https://github.com/eclipse-tycho/tycho/tree/tycho-5.0.4 👔 https://projects.eclipse.org/projects/technology.tycho/releases/5.0.4 🙏 contributors who contributed patches for this release:

  • Andreas Schwarz
  • Christoph Läubrich
  • dependabot[bot]
  • Ed Merks
  • Hannes Wellmann
  • janosch24
  • Lars Vogel
  • Patrick Ziegler
  • Raffi Khatchadourian
  • Rene Muehle
  • Titouan Vervack
  • Vasili Gulevich
  • Александър Куртаков

💰 we would like to also thank the Eclipse IDE Workingroup for funding the release work and thanks to everyone who helped us with testing the snapshot version.

and thanks to everyone who helped us with testing the snapshot version.

Regards,

The Tycho Team

What's Changed

@dependabot
Bump the dependencies group across 1 directory with 8 updates
4deb5c2 
Bumps the dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [com.google.guava:guava](https://github.com/google/guava) | `33.6.0-jre` | `33.7.1-jre` |
| [com.google.guava:guava-testlib](https://github.com/google/guava) | `33.6.0-jre` | `33.7.1-jre` |
| [org.commonmark:commonmark](https://github.com/commonmark/commonmark-java) | `0.29.0` | `0.30.0` |
| [org.commonmark:commonmark-ext-gfm-tables](https://github.com/commonmark/commonmark-java) | `0.29.0` | `0.30.0` |
| [org.graalvm.buildtools:native-maven-plugin](https://github.com/graalvm/native-build-tools) | `1.1.7` | `1.1.10` |
| [org.eclipse.tycho:tycho-maven-plugin](https://github.com/eclipse-tycho/tycho) | `5.0.3` | `5.0.4` |
| [org.eclipse.tycho:tycho-versions-plugin](https://github.com/eclipse-tycho/tycho) | `5.0.3` | `5.0.4` |
| [org.eclipse.tycho:target-platform-configuration](https://github.com/eclipse-tycho/tycho) | `5.0.3` | `5.0.4` |



Updates `com.google.guava:guava` from 33.6.0-jre to 33.7.1-jre
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

Updates `com.google.guava:guava-testlib` from 33.6.0-jre to 33.7.1-jre
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

Updates `com.google.guava:guava-testlib` from 33.6.0-jre to 33.7.1-jre
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

Updates `org.commonmark:commonmark` from 0.29.0 to 0.30.0
- [Release notes](https://github.com/commonmark/commonmark-java/releases)
- [Changelog](https://github.com/commonmark/commonmark-java/blob/main/CHANGELOG.md)
- [Commits](commonmark/commonmark-java@commonmark-parent-0.29.0...commonmark-parent-0.30.0)

Updates `org.commonmark:commonmark-ext-gfm-tables` from 0.29.0 to 0.30.0
- [Release notes](https://github.com/commonmark/commonmark-java/releases)
- [Changelog](https://github.com/commonmark/commonmark-java/blob/main/CHANGELOG.md)
- [Commits](commonmark/commonmark-java@commonmark-parent-0.29.0...commonmark-parent-0.30.0)

Updates `org.graalvm.buildtools:native-maven-plugin` from 1.1.7 to 1.1.10
- [Release notes](https://github.com/graalvm/native-build-tools/releases)
- [Commits](graalvm/native-build-tools@1.1.7...1.1.10)

Updates `org.eclipse.tycho:tycho-maven-plugin` from 5.0.3 to 5.0.4
- [Release notes](https://github.com/eclipse-tycho/tycho/releases)
- [Changelog](https://github.com/eclipse-tycho/tycho/blob/tycho-5.0.4/RELEASE_NOTES.md)
- [Commits](eclipse-tycho/tycho@tycho-5.0.3...tycho-5.0.4)

Updates `org.eclipse.tycho:tycho-versions-plugin` from 5.0.3 to 5.0.4
- [Release notes](https://github.com/eclipse-tycho/tycho/releases)
- [Changelog](https://github.com/eclipse-tycho/tycho/blob/tycho-5.0.4/RELEASE_NOTES.md)
- [Commits](eclipse-tycho/tycho@tycho-5.0.3...tycho-5.0.4)

Updates `org.eclipse.tycho:target-platform-configuration` from 5.0.3 to 5.0.4
- [Release notes](https://github.com/eclipse-tycho/tycho/releases)
- [Changelog](https://github.com/eclipse-tycho/tycho/blob/tycho-5.0.4/RELEASE_NOTES.md)
- [Commits](eclipse-tycho/tycho@tycho-5.0.3...tycho-5.0.4)

Updates `org.eclipse.tycho:tycho-versions-plugin` from 5.0.3 to 5.0.4
- [Release notes](https://github.com/eclipse-tycho/tycho/releases)
- [Changelog](https://github.com/eclipse-tycho/tycho/blob/tycho-5.0.4/RELEASE_NOTES.md)
- [Commits](eclipse-tycho/tycho@tycho-5.0.3...tycho-5.0.4)

Updates `org.eclipse.tycho:target-platform-configuration` from 5.0.3 to 5.0.4
- [Release notes](https://github.com/eclipse-tycho/tycho/releases)
- [Changelog](https://github.com/eclipse-tycho/tycho/blob/tycho-5.0.4/RELEASE_NOTES.md)
- [Commits](eclipse-tycho/tycho@tycho-5.0.3...tycho-5.0.4)

---
updated-dependencies:
- dependency-name: com.google.guava:guava
  dependency-version: 33.7.1-jre
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.google.guava:guava-testlib
  dependency-version: 33.7.1-jre
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.google.guava:guava-testlib
  dependency-version: 33.7.1-jre
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: org.commonmark:commonmark
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: org.commonmark:commonmark-ext-gfm-tables
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: org.graalvm.buildtools:native-maven-plugin
  dependency-version: 1.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.tycho:tycho-maven-plugin
  dependency-version: 5.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.tycho:tycho-versions-plugin
  dependency-version: 5.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.tycho:target-platform-configuration
  dependency-version: 5.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.tycho:tycho-versions-plugin
  dependency-version: 5.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.tycho:target-platform-configuration
  dependency-version: 5.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants