Skip to content

Bump the gradle group with 16 updates - #1

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/gradle-7b0fa4c5b6
Open

Bump the gradle group with 16 updates#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/gradle-7b0fa4c5b6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 4, 2026

Copy link
Copy Markdown
Contributor

Bumps the gradle group with 16 updates:

Package From To
org.junit:junit-bom 5.12.0 6.1.3
org.junit.jupiter:junit-jupiter 5.12.0 6.1.3
org.junit.platform:junit-platform-launcher 1.12.0 6.1.3
com.google.guava:guava 33.4.0-jre 33.7.2-jre
org.projectlombok:lombok 1.18.36 1.18.48
org.json:json 20250107 20260814
commons-io:commons-io 2.18.0 2.22.0
io.netty:netty-all 4.1.119.Final 4.2.18.Final
org.springframework.boot:spring-boot-starter-web 3.4.3 4.1.1
io.jsonwebtoken:jjwt 0.12.6 0.13.0
com.stripe:stripe-java 28.4.0 34.0.0
com.maxmind.geoip2:geoip2 4.2.1 5.2.0
com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer 20240325.1 20260924.2
org.springframework.boot 3.4.3 4.1.1
io.freefair.lombok 8.13 9.8.0
gradle-wrapper 8.13 9.8.0

Updates org.junit:junit-bom from 5.12.0 to 6.1.3

Release notes

Sourced from org.junit:junit-bom's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.1...r6.1.2

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

JUnit 6.1.0 = Platform 6.1.0 + Jupiter 6.1.0 + Vintage 6.1.0

See Release Notes.

New Contributors

Full Changelog: junit-team/junit-framework@r6.0.3...r6.1.0

JUnit 6.1.0-RC1 = Platform 6.1.0-RC1 + Jupiter 6.1.0-RC1 + Vintage 6.1.0-RC1

See Release Notes.

New Contributors

Full Changelog: junit-team/junit-framework@r6.1.0-M1...r6.1.0-RC1

JUnit 6.1.0-M1 = Platform 6.1.0-M1 + Jupiter 6.1.0-M1 + Vintage 6.1.0-M1

See Release Notes.

New Contributors

... (truncated)

Commits
  • f59f60d Release 6.1.3
  • cd8ec92 Finalize 6.1.3 release notes
  • c8729f2 Restore compatibility with GraalVM 25 (#5901)
  • ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
  • fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
  • 62afc02 Delay GraalVM plugin updates for 3 days
  • 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
  • f6bbfc5 Move GraalVM tests to separate test task (#5903)
  • e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
  • 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
  • Additional commits viewable in compare view

Updates org.junit.jupiter:junit-jupiter from 5.12.0 to 6.1.3

Release notes

Sourced from org.junit.jupiter:junit-jupiter's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.1...r6.1.2

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

JUnit 6.1.0 = Platform 6.1.0 + Jupiter 6.1.0 + Vintage 6.1.0

See Release Notes.

New Contributors

Full Changelog: junit-team/junit-framework@r6.0.3...r6.1.0

JUnit 6.1.0-RC1 = Platform 6.1.0-RC1 + Jupiter 6.1.0-RC1 + Vintage 6.1.0-RC1

See Release Notes.

New Contributors

Full Changelog: junit-team/junit-framework@r6.1.0-M1...r6.1.0-RC1

JUnit 6.1.0-M1 = Platform 6.1.0-M1 + Jupiter 6.1.0-M1 + Vintage 6.1.0-M1

See Release Notes.

New Contributors

... (truncated)

Commits
  • f59f60d Release 6.1.3
  • cd8ec92 Finalize 6.1.3 release notes
  • c8729f2 Restore compatibility with GraalVM 25 (#5901)
  • ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
  • fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
  • 62afc02 Delay GraalVM plugin updates for 3 days
  • 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
  • f6bbfc5 Move GraalVM tests to separate test task (#5903)
  • e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
  • 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
  • Additional commits viewable in compare view

Updates org.junit.platform:junit-platform-launcher from 1.12.0 to 6.1.3

Release notes

Sourced from org.junit.platform:junit-platform-launcher's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.1...r6.1.2

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

JUnit 6.1.0 = Platform 6.1.0 + Jupiter 6.1.0 + Vintage 6.1.0

See Release Notes.

New Contributors

Full Changelog: junit-team/junit-framework@r6.0.3...r6.1.0

JUnit 6.1.0-RC1 = Platform 6.1.0-RC1 + Jupiter 6.1.0-RC1 + Vintage 6.1.0-RC1

See Release Notes.

New Contributors

Full Changelog: junit-team/junit-framework@r6.1.0-M1...r6.1.0-RC1

JUnit 6.1.0-M1 = Platform 6.1.0-M1 + Jupiter 6.1.0-M1 + Vintage 6.1.0-M1

See Release Notes.

New Contributors

... (truncated)

Commits

Updates com.google.guava:guava from 33.4.0-jre to 33.7.2-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.2

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.2-jre</version>
  <!-- or, for Android: -->
  <version>33.7.2-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

Javadoc

JDiff

Changelog

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>
</tr></table>

... (truncated)

Commits

Updates org.projectlombok:lombok from 1.18.36 to 1.18.48

Changelog

Sourced from org.projectlombok:lombok's changelog.

v1.18.48 (September 1st, 2026)

  • BREAKING CHANGE/BUGFIX: @Builder(builderClassName = "Builder") now generates an error, because the type names collide. #3857 (found after release)
  • PLATFORM: JDK27 support added #4072.
  • BUGFIX: @SneakyThrows usage on JDK26 no longer results in class files that require lombok.jar to be on the runtime classpath (which should not be neccessary). #4040.
  • FEATURE: New config key lombok.checkReturnValueAnnotation (values: none, lombok; default: none) lets lombok generate @lombok.CheckReturnValue on generated methods where the return value should not be ignored, such as @With methods and @Builder.build(). A future lombok release may flip the default to lombok. #4013.
  • PROMOTION: @SuperBuilder has been promoted to the main package. Otherwise, no changes have been made to the annotation. The old experimental annotation will remain for a few versions, at which point it will be marked as a deprecated annotation. Eventually it'll be removed. If you had lombok.config configuration for this annotation, the configuration keys for this feature have been renamed. #2209.
  • OLD-CRUFT: lombok.experimental.Wither and lombok.Delegate are deprecated remnants; these features were moved (to respectively lombok.With and lombok.experimental.Delegate over 5 years ago. They are now removed entirely. If your project is dependent on an older version of lombok which still has those; fret not, lombok still processes these annotations. It just no longer includes them in the jar.
  • FEATURE: CheckerFramework: Lombok now adds @SideEffectFree to constructors it makes if you have enabled checker framework via lombok.config.
  • BUGFIX: CheckerFramework: Lombok would add @SideEffectFree to the build() method of any generated builder, even if it is a builder for invoking a method; in that case, the side-effect-free nature of build() mirrors the side-effect-free nature of the method invocation you've built. Lombok now checks if the method it generated a builder for is side effect free / 'check return type'.

v1.18.46 (April 22nd, 2026)

  • PLATFORM: JDK26 support added #4019.
  • PLATFORM: Spring Tools Suite 5 supported #3985.
  • BUGFIX: @Jacksonized no longer stops generating @JsonProperty once an explicit @JsonIgnore annotations is encountered #4022.
  • BUGFIX: In eclipse, mixing @Jacksonized and fluent = true no longer causes the error com.fasterxml.jackson.annotation.JsonProperty is not a repeatable annotation interface. #3934.
  • BUGFIX: Some finishing touches for v1.18.44's support of Jackson3 #4004.

v1.18.44 (March 11th, 2026)

  • FEATURE: @Jacksonized now supports both Jackson2 and Jackson3; you'll get a warning until you configure which one (or even both!) you want lombok to generate. #3950.
  • BUGFIX: On JDK25, val and @ExtensionMethod could sometimes cause erroneous errors (in that you see errors but compilation succeeds anyway) using javac. #3947.
  • BUGFIX: @Jacksonized + fields marked transient would result in those transient fields being serialised which is surprising (and thus undesired) behaviour. #3936.

v1.18.42 (September 18th, 2025)

  • FEATURE: All the various @Log annotations now allow you to change their access level (they still default to private). #2280. Thanks to new contributor Liam Pace!
  • BUGFIX: Javadoc parsing was broken in Netbeans and ErrorProne for JDK25 #3940.

v1.18.40 (September 4th, 2025)

  • PLATFORM: JDK25 support added #3859.
  • BUGFIX: Recent versions of eclipse (or the eclipse-based java lang server for VSCode) caused java.lang.IllegalArgumentException: Document does not match the AST. [Issue #3886](projectlombok/lombok#3886).
  • PERFORMANCE: @ExtensionMethod is now significantly faster [Issue #3866](projectlombok/lombok#3866).
  • BUGFIX: the command line config tool would emit incorrect output for nullity annotations. [Issue #3931](projectlombok/lombok#3931).
  • FEATURE: @Jacksonized @Accessors(fluent=true) automatically creates the relevant annotations such that Jackson correctly identifies fluent accessors. [Issue #3265](projectlombok/lombok#3265), [Issue #3270](projectlombok/lombok#3270).
  • IMPROBABLE BREAKING CHANGE: From versions 1.18.16 to 1.18.38, lombok automatically copies certain Jackson annotations (e.g., @JsonProperty) from fields to the corresponding accessors (getters/setters). However, it turned out to be harmful in certain situations. Thus, Lombok does not automatically copy those annotations any more. You can restore the old behavior using the config key lombok.copyJacksonAnnotationsToAccessors = true.

v1.18.38 (March 31st, 2025)

  • PLATFORM: JDK24 support added.
  • FEATURE: Lombok's nullity annotation now supports JSpecify out of the box, using config key jspecify.
  • BUGFIX: Recent eclipse releases would get you 'negative length' error. The bug had always been in lombok but didn't matter until recent releases. [Issue #3823](projectlombok/lombok#3823).
  • BUGFIX: The 'extract local variable' refactor script of VSCode wouldn't replace all occurrences if run on a method call to a lombok generated method. [Issue #3783](projectlombok/lombok#3783).
Commits
  • b48657c [version] pre-release version bump v1.18.48
  • d1d0039 Merge branch 'jdk27'
  • 1a23dad [review][refactor] No meaningful changes: Improved comments, javadoc, and cle...
  • 40cdde8 [changelog] JDK27 support
  • 25eae29 Add Danish Nawab to AUTHORS
  • 10ab92b Support JDK27: end positions moved from EndPosTable to JCTree.endpos
  • af01b7a Document the new configuration syntax for listy things
  • 1be3857 There is no more HtAccess
  • 405985d Semantic sections for website
  • 04b7340 [trivial] fixing some outdated tests (tests were broken, not lombok).
  • Additional commits viewable in compare view

Updates org.json:json from 20250107 to 20260814

Release notes

Sourced from org.json:json's releases.

20260814

Pull Request Description
#1070 Fix XML.unescape for valid whitespace chars

20260719

Pull Request Description
#1069 pre-release-20260719 prep for next release
#1068 Max number length config for BigInteger and BigDecimal
#1067 bound BigDecimal→BigInteger expansion in objectToBigInteger (completes CVE-2026-59171 fix)
#1065 Fixes CVE-2026-59171
#1062 Refactor CDL row serialization for readability
#1061 Restore lenient jsonarray allow consecutive commas and insert null
#1058 Docs and warnings cleanup

20260522

Pull Request Description
#1054 pre-release-20260522 prep for next release
#1053 update security.md with key data
#1046 Validate XML numeric character references before string construction
#1044 Ignore static fields in JSONObject.fromJson()
#1041 Enhance README with license clarification
#1039 Fix XML forceList parsing issue
#1038 Fix input validation in XMLTokener.unescapeEntity()
#1037 Fix ClassCastException in JSONML.toJSONArray and toJSONObject
#1029 add badge to external hosted javadoc
#1028 Refactoring: Fix sonarqube reliability issues
#1027 Save/restore default locale in test

20251224

Pull Request Description
#1021 Add LTS JDK 25 build to github actions
#1020 Record type support
#1017 Refactoring: Fix some SonarQube issues
#1014 Refactoring: String check logic in CDL
#1013 Refactoring: FIx Sonarqube issues in JSONArray
#1011 Refactoring: Fix SonarQube issues in JSONObject
#1009 Fix strict mode check for period after number
#1008 Fixed JSONArray strict mode check for leading comma
#1006 JSONObject.fromJson() with unit tests
#1005 Refactoring: Fix sonarQube issues in JSONObject
#1004 Refactoring: Fix sonarcube issues in JSONObject
#1001 Refactoring: sonarqube issues in JSONObject
#1000 Refactoring: Fix some sonarcube issues from recent commits
#999 fixed some strict mode issues
#995 Fix regression XML parsing null with keepStrings

... (truncated)

Changelog

Sourced from org.json:json's changelog.

20260814 Fixes XML.unescape whitespace handling

20260719 Fixes CVE-2026-59171 very large BigInteger, BigDecimal

20260522 Publish key data, recent commits for minor fixes

20251224 Records, fromJson(), and recent commits

20250517 Strict mode hardening and recent commits

Commits
  • 6c14048 Merge pull request #1073 from stleary/pre-release-20260814
  • 34efda6 pre-release-20260814 initial commit
  • 22ab2fb Update jar file link in README
  • 392a352 Fix formatting of the latest release jar file link
  • b594a32 Merge pull request #1070 from dong0713/fix/xml-unescape-whitespace-control-chars
  • 94854a1 Fix XML.unescape rejecting valid whitespace numeric character references
  • 1795e8c Merge pull request #1069 from stleary/pre-release-20260719
  • da757c6 pre-release-20260719 oops forgot to update new unit tests for strict mode
  • d24bc9e pre-release-20260719 initial commit
  • 80efb52 Merge pull request #1068 from stleary/max-number-length-config
  • Additional commits viewable in compare view

Updates commons-io:commons-io from 2.18.0 to 2.22.0

Updates io.netty:netty-all from 4.1.119.Final to 4.2.18.Final

Release notes

Sourced from io.netty:netty-all's releases.

netty-4.2.18.Final

Security fixes

  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
  • CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility Notes

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

... (truncated)

Commits
  • 2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final
  • 6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...
  • c44a052 SPDY: SpdySessionHandler must limit the concurrent streams
  • 374d965 HTTP: Limit the maximum number of concurrent pipelined requests
  • 7e8b325 HTTP/2: Limit HPACK encoding table size
  • e3ebf70 OCSP: Correctly handle that nextUpdate is optional
  • 5388535 STOMP: Correctly release partial content on handler removal
  • 3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
  • 1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers
  • 3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop...
  • Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-starter-web from 3.4.3 to 4.1.1

Release notes

Sourced from org.springframework.boot:spring-boot-starter-web's releases.

v4.1.1

⚠️ Attention Required

  • Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied. This behavior caused problems for those using Protobuf without gRPC. To opt in to the configuration of gRPC, configure the protobuf extension with the grpc plugin using an empty block. The Spring Boot Gradle plugin will then automatically configure the use of protoc-gen-grpc-java as before. #50822

🐞 Bug Fixes

  • Kafka consumer-specific security protocol is not taken into account #51369
  • Structured logging: a failed JSON encode corrupts the next log event written on the same thread #51156
  • Micrometer registries pin the application context #51135
  • Temporary file is not deleted when ExportedImageTar construction fails #51132
  • Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records #51098
  • spring-boot-h2-console pulls servlet-api as transitive dependency #51095
  • PropertiesLauncher does not log nested archive paths #51089
  • Methods that return the result of Map#remove are not declared with a @Nullable return type #51087
  • NativeImageResourceProvider flattens Flyway migration paths in subdirectories #50964
  • Fix ordering of Kotlinx Serialization CodecCustomizer #50961
  • JarFile is not closed when finding main class from archive #50959
  • Application-managed JUL bridge handler should only be removed if installed #50950
  • CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined #50944
  • Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health #50942
  • Resources are not cleaned up when resolving an image that is not yet present in the builder #50941
  • GraphQlWebMvcAutoConfiguration should apply customizers in order #50914
  • Auto-configured RedisMessageListenerContainer does not use virtual threads when spring.threads.virtual.enabled is true #50884
  • Context refresh fails when using Actuator on Jersey without spring-boot-health #50872
  • Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health #50871
  • IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard #50856
  • High number of connections due to Mongo health indicator #50852
  • Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri #50849
  • Return type nullability of ApplicationContextAssert's getBean methods does not indicate that bean may be null #50845
  • PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #50843
  • Exposing gRPC test server port should backoff if gRPC is not present #50825
  • JpaBaseConfiguration#entityManagerConfiguration can cause a dependency loop on beans declaring AsyncTaskExecutor #50801
  • spring.grpc.server.health.include-overall-health is not taken into account #50799
  • Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute #50790
  • Managed version of Prometheus Client is not aligned with Micrometer's micrometer-registry-prometheus #50780
  • Map properties bound from empty strings fail with ConverterNotFoundException #50773
  • Protobuf Common Protos should not be a managed dependency #50772
  • An application that depends on spring-boot-security-oauth2-resource-server may fail to start with a ClassNotFoundException when Reactor is on the classpath but WebFlux is not #50764
  • W3CHeaderParser's decoding is not compliant with RFC 3986 #50650

📔 Documentation

  • Description of spring.graphql.websocket.connection-init-timeout does not render correctly in the reference guide #51348
  • spring.profiles.group should have a 'spring-profile-name' hint provider #51284
  • Remove reference to removed InfluxDB auto-configuration #51176
  • Use JacksonJsonSerde in Kafka Streams documentation #51161
  • Document alternatives to HttpMessageConverters #51129
  • Fix stale type reference for OTLP logging transport metadata #51119
  • Metadata for spring.test.mockmvc.htmlunit.url declares the wrong type #51115

... (truncated)

Commits
  • 6fdf67e Release 4.1.1
  • fde599b Upgrade to Spring Pulsar 2.0.7
  • 9daa58f Upgrade to Spring HATEOAS 3.1.2
  • 353993e Upgrade to Spring Data Bom 2026.0.1
  • 24ba596 Upgrade to Spring Session 4.1.1
  • 5cb5c29 Upgrade to Spring Security 7.1.1
  • 4adc8eb Upgrade to Spring LDAP 4.1.1
  • 4d9c19c Upgrade to Spring Kafka 4.1.1
  • f30f612 Upgrade to Spring Integration 7.1.1
  • b930283 Upgrade to Spring gRPC 1.1.1
  • Additional commits viewable in compare view

Updates io.jsonwebtoken:jjwt from 0.12.6 to 0.13.0

Release notes

Sourced from io.jsonwebtoken:jjwt's releases.

0.13.0

This is the last minor JJWT release branch that will support Java 7.

Any necessary emergency bug fixes will be fixed in subsequent 0.13.x patch releases, but all new development, including Java 8 compatible changes, will be in the next minor (0.14.0) release.

All future JJWT major and minor versions ( 0.14.0 and later) will require Java 8 or later.

What's Changed

This release contains a single change:

  • The previously private JacksonDeserializer(ObjectMapper objectMapper, Map<String, Class<?>> claimTypeMap) constructor is now public for those that want register a claims type converter on their own specified ObjectMapper instance. Thank you to @​kesrishubham2510 for PR #972. See Issue 914.

Full Changelog: jwtk/jjwt@0.12.7...0.13.0

0.12.7

This patch release:

  • Adds a new Maven BOM! This is useful for multi-module projects. See

@dependabot
Bump the gradle group with 16 updates
1485a09 
Bumps the gradle group with 16 updates:

| Package | From | To |
| --- | --- | --- |
| [org.junit:junit-bom](https://github.com/junit-team/junit-framework) | `5.12.0` | `6.1.3` |
| [org.junit.jupiter:junit-jupiter](https://github.com/junit-team/junit-framework) | `5.12.0` | `6.1.3` |
| [org.junit.platform:junit-platform-launcher](https://github.com/junit-team/junit-framework) | `1.12.0` | `6.1.3` |
| [com.google.guava:guava](https://github.com/google/guava) | `33.4.0-jre` | `33.7.2-jre` |
| [org.projectlombok:lombok](https://github.com/projectlombok/lombok) | `1.18.36` | `1.18.48` |
| [org.json:json](https://github.com/douglascrockford/JSON-java) | `20250107` | `20260814` |
| commons-io:commons-io | `2.18.0` | `2.22.0` |
| [io.netty:netty-all](https://github.com/netty/netty) | `4.1.119.Final` | `4.2.18.Final` |
| [org.springframework.boot:spring-boot-starter-web](https://github.com/spring-projects/spring-boot) | `3.4.3` | `4.1.1` |
| [io.jsonwebtoken:jjwt](https://github.com/jwtk/jjwt) | `0.12.6` | `0.13.0` |
| [com.stripe:stripe-java](https://github.com/stripe/stripe-java) | `28.4.0` | `34.0.0` |
| [com.maxmind.geoip2:geoip2](https://github.com/maxmind/GeoIP2-java) | `4.2.1` | `5.2.0` |
| [com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer](https://github.com/OWASP/java-html-sanitizer) | `20240325.1` | `20260924.2` |
| [org.springframework.boot](https://github.com/spring-projects/spring-boot) | `3.4.3` | `4.1.1` |
| [io.freefair.lombok](https://github.com/freefair/gradle-plugins) | `8.13` | `9.8.0` |
| [gradle-wrapper](https://github.com/gradle/gradle) | `8.13` | `9.8.0` |


Updates `org.junit:junit-bom` from 5.12.0 to 6.1.3
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](junit-team/junit-framework@r5.12.0...r6.1.3)

Updates `org.junit.jupiter:junit-jupiter` from 5.12.0 to 6.1.3
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](junit-team/junit-framework@r5.12.0...r6.1.3)

Updates `org.junit.platform:junit-platform-launcher` from 1.12.0 to 6.1.3
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](https://github.com/junit-team/junit-framework/commits/r6.1.3)

Updates `com.google.guava:guava` from 33.4.0-jre to 33.7.2-jre
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

Updates `org.projectlombok:lombok` from 1.18.36 to 1.18.48
- [Changelog](https://github.com/projectlombok/lombok/blob/master/doc/changelog.markdown)
- [Commits](projectlombok/lombok@v1.18.36...v1.18.48)

Updates `org.json:json` from 20250107 to 20260814
- [Release notes](https://github.com/douglascrockford/JSON-java/releases)
- [Changelog](https://github.com/stleary/JSON-java/blob/master/docs/RELEASES.md)
- [Commits](stleary/JSON-java@2025010...2026081)

Updates `commons-io:commons-io` from 2.18.0 to 2.22.0

Updates `io.netty:netty-all` from 4.1.119.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.119.Final...netty-4.2.18.Final)

Updates `org.springframework.boot:spring-boot-starter-web` from 3.4.3 to 4.1.1
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.4.3...v4.1.1)

Updates `io.jsonwebtoken:jjwt` from 0.12.6 to 0.13.0
- [Release notes](https://github.com/jwtk/jjwt/releases)
- [Changelog](https://github.com/jwtk/jjwt/blob/main/CHANGELOG.md)
- [Commits](jwtk/jjwt@0.12.6...0.13.0)

Updates `com.stripe:stripe-java` from 28.4.0 to 34.0.0
- [Release notes](https://github.com/stripe/stripe-java/releases)
- [Changelog](https://github.com/stripe/stripe-java/blob/master/CHANGELOG.md)
- [Commits](stripe/stripe-java@v28.4.0...v34.0.0)

Updates `com.maxmind.geoip2:geoip2` from 4.2.1 to 5.2.0
- [Release notes](https://github.com/maxmind/GeoIP2-java/releases)
- [Changelog](https://github.com/maxmind/GeoIP2-java/blob/main/CHANGELOG.md)
- [Commits](maxmind/GeoIP2-java@v4.2.1...v5.2.0)

Updates `com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer` from 20240325.1 to 20260924.2
- [Release notes](https://github.com/OWASP/java-html-sanitizer/releases)
- [Commits](OWASP/java-html-sanitizer@release-20240325.1...release-20260924.2)

Updates `org.springframework.boot` from 3.4.3 to 4.1.1
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.4.3...v4.1.1)

Updates `io.freefair.lombok` from 8.13 to 9.8.0
- [Release notes](https://github.com/freefair/gradle-plugins/releases)
- [Commits](freefair/gradle-plugins@8.13...9.8.0)

Updates `gradle-wrapper` from 8.13 to 9.8.0
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](gradle/gradle@v8.13.0...v9.8.0)

---
updated-dependencies:
- dependency-name: org.junit:junit-bom
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
- dependency-name: org.junit.jupiter:junit-jupiter
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
- dependency-name: org.junit.platform:junit-platform-launcher
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
- dependency-name: com.google.guava:guava
  dependency-version: 33.7.2-jre
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: org.projectlombok:lombok
  dependency-version: 1.18.48
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: org.json:json
  dependency-version: '20260814'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
- dependency-name: commons-io:commons-io
  dependency-version: 2.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: io.netty:netty-all
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: org.springframework.boot:spring-boot-starter-web
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
- dependency-name: io.jsonwebtoken:jjwt
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: com.stripe:stripe-java
  dependency-version: 34.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
- dependency-name: com.maxmind.geoip2:geoip2
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
- dependency-name: com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer
  dependency-version: '20260924.2'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
- dependency-name: org.springframework.boot
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
- dependency-name: io.freefair.lombok
  dependency-version: 9.8.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
- dependency-name: gradle-wrapper
  dependency-version: 9.8.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Oct 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants