Skip to content

Bump the gradle group with 10 updates - #1

Merged
breuerlukas merged 1 commit into
mainfrom
dependabot/gradle/gradle-a9d4089b94
Oct 7, 2026
Merged

Bump the gradle group with 10 updates#1
breuerlukas merged 1 commit into
mainfrom
dependabot/gradle/gradle-a9d4089b94

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 4, 2026

Copy link
Copy Markdown
Contributor

Bumps the gradle group with 10 updates:

Package From To
org.junit:junit-bom 5.12.0 6.1.3
org.junit.jupiter:junit-jupiter 5.12.0 6.1.3
com.google.guava:guava 33.4.0-jre 33.7.2-jre
org.projectlombok:lombok 1.18.36 1.18.48
org.json:json 20250107 20260814
commons-io:commons-io 2.18.0 2.22.0
org.springframework.boot:spring-boot-starter-web 3.4.3 4.1.1
com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer 20240325.1 20260924.2
io.freefair.lombok 8.13 9.8.0
gradle-wrapper 8.13 9.8.0

Updates org.junit:junit-bom from 5.12.0 to 6.1.3

Release notes

Sourced from org.junit:junit-bom's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.1...r6.1.2

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

JUnit 6.1.0 = Platform 6.1.0 + Jupiter 6.1.0 + Vintage 6.1.0

See Release Notes.

New Contributors

Full Changelog: junit-team/junit-framework@r6.0.3...r6.1.0

JUnit 6.1.0-RC1 = Platform 6.1.0-RC1 + Jupiter 6.1.0-RC1 + Vintage 6.1.0-RC1

See Release Notes.

New Contributors

Full Changelog: junit-team/junit-framework@r6.1.0-M1...r6.1.0-RC1

JUnit 6.1.0-M1 = Platform 6.1.0-M1 + Jupiter 6.1.0-M1 + Vintage 6.1.0-M1

See Release Notes.

New Contributors

... (truncated)

Commits
  • f59f60d Release 6.1.3
  • cd8ec92 Finalize 6.1.3 release notes
  • c8729f2 Restore compatibility with GraalVM 25 (#5901)
  • ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
  • fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
  • 62afc02 Delay GraalVM plugin updates for 3 days
  • 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
  • f6bbfc5 Move GraalVM tests to separate test task (#5903)
  • e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
  • 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
  • Additional commits viewable in compare view

Updates org.junit.jupiter:junit-jupiter from 5.12.0 to 6.1.3

Release notes

Sourced from org.junit.jupiter:junit-jupiter's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.1...r6.1.2

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

JUnit 6.1.0 = Platform 6.1.0 + Jupiter 6.1.0 + Vintage 6.1.0

See Release Notes.

New Contributors

Full Changelog: junit-team/junit-framework@r6.0.3...r6.1.0

JUnit 6.1.0-RC1 = Platform 6.1.0-RC1 + Jupiter 6.1.0-RC1 + Vintage 6.1.0-RC1

See Release Notes.

New Contributors

Full Changelog: junit-team/junit-framework@r6.1.0-M1...r6.1.0-RC1

JUnit 6.1.0-M1 = Platform 6.1.0-M1 + Jupiter 6.1.0-M1 + Vintage 6.1.0-M1

See Release Notes.

New Contributors

... (truncated)

Commits
  • f59f60d Release 6.1.3
  • cd8ec92 Finalize 6.1.3 release notes
  • c8729f2 Restore compatibility with GraalVM 25 (#5901)
  • ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
  • fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
  • 62afc02 Delay GraalVM plugin updates for 3 days
  • 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
  • f6bbfc5 Move GraalVM tests to separate test task (#5903)
  • e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
  • 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
  • Additional commits viewable in compare view

Updates com.google.guava:guava from 33.4.0-jre to 33.7.2-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.2

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.2-jre</version>
  <!-- or, for Android: -->
  <version>33.7.2-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

Javadoc

JDiff

Changelog

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>
</tr></table>

... (truncated)

Commits

Updates org.projectlombok:lombok from 1.18.36 to 1.18.48

Changelog

Sourced from org.projectlombok:lombok's changelog.

v1.18.48 (September 1st, 2026)

  • BREAKING CHANGE/BUGFIX: @Builder(builderClassName = "Builder") now generates an error, because the type names collide. #3857 (found after release)
  • PLATFORM: JDK27 support added #4072.
  • BUGFIX: @SneakyThrows usage on JDK26 no longer results in class files that require lombok.jar to be on the runtime classpath (which should not be neccessary). #4040.
  • FEATURE: New config key lombok.checkReturnValueAnnotation (values: none, lombok; default: none) lets lombok generate @lombok.CheckReturnValue on generated methods where the return value should not be ignored, such as @With methods and @Builder.build(). A future lombok release may flip the default to lombok. #4013.
  • PROMOTION: @SuperBuilder has been promoted to the main package. Otherwise, no changes have been made to the annotation. The old experimental annotation will remain for a few versions, at which point it will be marked as a deprecated annotation. Eventually it'll be removed. If you had lombok.config configuration for this annotation, the configuration keys for this feature have been renamed. #2209.
  • OLD-CRUFT: lombok.experimental.Wither and lombok.Delegate are deprecated remnants; these features were moved (to respectively lombok.With and lombok.experimental.Delegate over 5 years ago. They are now removed entirely. If your project is dependent on an older version of lombok which still has those; fret not, lombok still processes these annotations. It just no longer includes them in the jar.
  • FEATURE: CheckerFramework: Lombok now adds @SideEffectFree to constructors it makes if you have enabled checker framework via lombok.config.
  • BUGFIX: CheckerFramework: Lombok would add @SideEffectFree to the build() method of any generated builder, even if it is a builder for invoking a method; in that case, the side-effect-free nature of build() mirrors the side-effect-free nature of the method invocation you've built. Lombok now checks if the method it generated a builder for is side effect free / 'check return type'.

v1.18.46 (April 22nd, 2026)

  • PLATFORM: JDK26 support added #4019.
  • PLATFORM: Spring Tools Suite 5 supported #3985.
  • BUGFIX: @Jacksonized no longer stops generating @JsonProperty once an explicit @JsonIgnore annotations is encountered #4022.
  • BUGFIX: In eclipse, mixing @Jacksonized and fluent = true no longer causes the error com.fasterxml.jackson.annotation.JsonProperty is not a repeatable annotation interface. #3934.
  • BUGFIX: Some finishing touches for v1.18.44's support of Jackson3 #4004.

v1.18.44 (March 11th, 2026)

  • FEATURE: @Jacksonized now supports both Jackson2 and Jackson3; you'll get a warning until you configure which one (or even both!) you want lombok to generate. #3950.
  • BUGFIX: On JDK25, val and @ExtensionMethod could sometimes cause erroneous errors (in that you see errors but compilation succeeds anyway) using javac. #3947.
  • BUGFIX: @Jacksonized + fields marked transient would result in those transient fields being serialised which is surprising (and thus undesired) behaviour. #3936.

v1.18.42 (September 18th, 2025)

  • FEATURE: All the various @Log annotations now allow you to change their access level (they still default to private). #2280. Thanks to new contributor Liam Pace!
  • BUGFIX: Javadoc parsing was broken in Netbeans and ErrorProne for JDK25 #3940.

v1.18.40 (September 4th, 2025)

  • PLATFORM: JDK25 support added #3859.
  • BUGFIX: Recent versions of eclipse (or the eclipse-based java lang server for VSCode) caused java.lang.IllegalArgumentException: Document does not match the AST. [Issue #3886](projectlombok/lombok#3886).
  • PERFORMANCE: @ExtensionMethod is now significantly faster [Issue #3866](projectlombok/lombok#3866).
  • BUGFIX: the command line config tool would emit incorrect output for nullity annotations. [Issue #3931](projectlombok/lombok#3931).
  • FEATURE: @Jacksonized @Accessors(fluent=true) automatically creates the relevant annotations such that Jackson correctly identifies fluent accessors. [Issue #3265](projectlombok/lombok#3265), [Issue #3270](projectlombok/lombok#3270).
  • IMPROBABLE BREAKING CHANGE: From versions 1.18.16 to 1.18.38, lombok automatically copies certain Jackson annotations (e.g., @JsonProperty) from fields to the corresponding accessors (getters/setters). However, it turned out to be harmful in certain situations. Thus, Lombok does not automatically copy those annotations any more. You can restore the old behavior using the config key lombok.copyJacksonAnnotationsToAccessors = true.

v1.18.38 (March 31st, 2025)

  • PLATFORM: JDK24 support added.
  • FEATURE: Lombok's nullity annotation now supports JSpecify out of the box, using config key jspecify.
  • BUGFIX: Recent eclipse releases would get you 'negative length' error. The bug had always been in lombok but didn't matter until recent releases. [Issue #3823](projectlombok/lombok#3823).
  • BUGFIX: The 'extract local variable' refactor script of VSCode wouldn't replace all occurrences if run on a method call to a lombok generated method. [Issue #3783](projectlombok/lombok#3783).
Commits
  • b48657c [version] pre-release version bump v1.18.48
  • d1d0039 Merge branch 'jdk27'
  • 1a23dad [review][refactor] No meaningful changes: Improved comments, javadoc, and cle...
  • 40cdde8 [changelog] JDK27 support
  • 25eae29 Add Danish Nawab to AUTHORS
  • 10ab92b Support JDK27: end positions moved from EndPosTable to JCTree.endpos
  • af01b7a Document the new configuration syntax for listy things
  • 1be3857 There is no more HtAccess
  • 405985d Semantic sections for website
  • 04b7340 [trivial] fixing some outdated tests (tests were broken, not lombok).
  • Additional commits viewable in compare view

Updates org.json:json from 20250107 to 20260814

Release notes

Sourced from org.json:json's releases.

20260814

Pull Request Description
#1070 Fix XML.unescape for valid whitespace chars

20260719

Pull Request Description
#1069 pre-release-20260719 prep for next release
#1068 Max number length config for BigInteger and BigDecimal
#1067 bound BigDecimal→BigInteger expansion in objectToBigInteger (completes CVE-2026-59171 fix)
#1065 Fixes CVE-2026-59171
#1062 Refactor CDL row serialization for readability
#1061 Restore lenient jsonarray allow consecutive commas and insert null
#1058 Docs and warnings cleanup

20260522

Pull Request Description
#1054 pre-release-20260522 prep for next release
#1053 update security.md with key data
#1046 Validate XML numeric character references before string construction
#1044 Ignore static fields in JSONObject.fromJson()
#1041 Enhance README with license clarification
#1039 Fix XML forceList parsing issue
#1038 Fix input validation in XMLTokener.unescapeEntity()
#1037 Fix ClassCastException in JSONML.toJSONArray and toJSONObject
#1029 add badge to external hosted javadoc
#1028 Refactoring: Fix sonarqube reliability issues
#1027 Save/restore default locale in test

20251224

Pull Request Description
#1021 Add LTS JDK 25 build to github actions
#1020 Record type support
#1017 Refactoring: Fix some SonarQube issues
#1014 Refactoring: String check logic in CDL
#1013 Refactoring: FIx Sonarqube issues in JSONArray
#1011 Refactoring: Fix SonarQube issues in JSONObject
#1009 Fix strict mode check for period after number
#1008 Fixed JSONArray strict mode check for leading comma
#1006 JSONObject.fromJson() with unit tests
#1005 Refactoring: Fix sonarQube issues in JSONObject
#1004 Refactoring: Fix sonarcube issues in JSONObject
#1001 Refactoring: sonarqube issues in JSONObject
#1000 Refactoring: Fix some sonarcube issues from recent commits
#999 fixed some strict mode issues
#995 Fix regression XML parsing null with keepStrings

... (truncated)

Changelog

Sourced from org.json:json's changelog.

20260814 Fixes XML.unescape whitespace handling

20260719 Fixes CVE-2026-59171 very large BigInteger, BigDecimal

20260522 Publish key data, recent commits for minor fixes

20251224 Records, fromJson(), and recent commits

20250517 Strict mode hardening and recent commits

Commits
  • 6c14048 Merge pull request #1073 from stleary/pre-release-20260814
  • 34efda6 pre-release-20260814 initial commit
  • 22ab2fb Update jar file link in README
  • 392a352 Fix formatting of the latest release jar file link
  • b594a32 Merge pull request #1070 from dong0713/fix/xml-unescape-whitespace-control-chars
  • 94854a1 Fix XML.unescape rejecting valid whitespace numeric character references
  • 1795e8c Merge pull request #1069 from stleary/pre-release-20260719
  • da757c6 pre-release-20260719 oops forgot to update new unit tests for strict mode
  • d24bc9e pre-release-20260719 initial commit
  • 80efb52 Merge pull request #1068 from stleary/max-number-length-config
  • Additional commits viewable in compare view

Updates commons-io:commons-io from 2.18.0 to 2.22.0

Updates org.springframework.boot:spring-boot-starter-web from 3.4.3 to 4.1.1

Release notes

Sourced from org.springframework.boot:spring-boot-starter-web's releases.

v4.1.1

⚠️ Attention Required

  • Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied. This behavior caused problems for those using Protobuf without gRPC. To opt in to the configuration of gRPC, configure the protobuf extension with the grpc plugin using an empty block. The Spring Boot Gradle plugin will then automatically configure the use of protoc-gen-grpc-java as before. #50822

🐞 Bug Fixes

  • Kafka consumer-specific security protocol is not taken into account #51369
  • Structured logging: a failed JSON encode corrupts the next log event written on the same thread #51156
  • Micrometer registries pin the application context #51135
  • Temporary file is not deleted when ExportedImageTar construction fails #51132
  • Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records #51098
  • spring-boot-h2-console pulls servlet-api as transitive dependency #51095
  • PropertiesLauncher does not log nested archive paths #51089
  • Methods that return the result of Map#remove are not declared with a @Nullable return type #51087
  • NativeImageResourceProvider flattens Flyway migration paths in subdirectories #50964
  • Fix ordering of Kotlinx Serialization CodecCustomizer #50961
  • JarFile is not closed when finding main class from archive #50959
  • Application-managed JUL bridge handler should only be removed if installed #50950
  • CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined #50944
  • Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health #50942
  • Resources are not cleaned up when resolving an image that is not yet present in the builder #50941
  • GraphQlWebMvcAutoConfiguration should apply customizers in order #50914
  • Auto-configured RedisMessageListenerContainer does not use virtual threads when spring.threads.virtual.enabled is true #50884
  • Context refresh fails when using Actuator on Jersey without spring-boot-health #50872
  • Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health #50871
  • IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard #50856
  • High number of connections due to Mongo health indicator #50852
  • Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri #50849
  • Return type nullability of ApplicationContextAssert's getBean methods does not indicate that bean may be null #50845
  • PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #50843
  • Exposing gRPC test server port should backoff if gRPC is not present #50825
  • JpaBaseConfiguration#entityManagerConfiguration can cause a dependency loop on beans declaring AsyncTaskExecutor #50801
  • spring.grpc.server.health.include-overall-health is not taken into account #50799
  • Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute #50790
  • Managed version of Prometheus Client is not aligned with Micrometer's micrometer-registry-prometheus #50780
  • Map properties bound from empty strings fail with ConverterNotFoundException #50773
  • Protobuf Common Protos should not be a managed dependency #50772
  • An application that depends on spring-boot-security-oauth2-resource-server may fail to start with a ClassNotFoundException when Reactor is on the classpath but WebFlux is not #50764
  • W3CHeaderParser's decoding is not compliant with RFC 3986 #50650

📔 Documentation

  • Description of spring.graphql.websocket.connection-init-timeout does not render correctly in the reference guide #51348
  • spring.profiles.group should have a 'spring-profile-name' hint provider #51284
  • Remove reference to removed InfluxDB auto-configuration #51176
  • Use JacksonJsonSerde in Kafka Streams documentation #51161
  • Document alternatives to HttpMessageConverters #51129
  • Fix stale type reference for OTLP logging transport metadata #51119
  • Metadata for spring.test.mockmvc.htmlunit.url declares the wrong type #51115

... (truncated)

Commits
  • 6fdf67e Release 4.1.1
  • fde599b Upgrade to Spring Pulsar 2.0.7
  • 9daa58f Upgrade to Spring HATEOAS 3.1.2
  • 353993e Upgrade to Spring Data Bom 2026.0.1
  • 24ba596 Upgrade to Spring Session 4.1.1
  • 5cb5c29 Upgrade to Spring Security 7.1.1
  • 4adc8eb Upgrade to Spring LDAP 4.1.1
  • 4d9c19c Upgrade to Spring Kafka 4.1.1
  • f30f612 Upgrade to Spring Integration 7.1.1
  • b930283 Upgrade to Spring gRPC 1.1.1
  • Additional commits viewable in compare view

Updates com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer from 20240325.1 to 20260924.2

Release notes

Sourced from com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer's releases.

Release 20260924.2

Changelog

  • 2e944e7 Release version 20260924.2 (GitHub Actions)
  • b203767 Add the change log entry for 20260924.2 (Jim Manico)
  • 9b3233d Make the denial-of-service invariant promise what can be kept (Jim Manico)
  • dfe357e Take the review: size the churn test for an ordinary heap (Jim Manico)
  • 4c910d3 Take the review: keep the walk's guard, drop the dead growth cap (Jim Manico)
  • f95efad Take the review: say the depth scan's over-count can drop valid CSS (Jim Manico)
  • de57cff Take the review: count open brackets in three ints, not 126 (Jim Manico)
  • cf9567f Take the review: make the depth scan's marking plain to read (Jim Manico)
  • 33e8d34 Prepare for next development version (GitHub Actions)
  • afac176 Record GHSA-x6fc-6qh4-g3wr (Jim Manico)

Contributors

We'd like to thank the following people for their contributions:

  • Jim Manico

Release 20260924.1

Changelog

  • 4fd25f3 Release version 20260924.1 (GitHub Actions)
  • 1231831 Take the review: mark function depths in a plain array, not a BitSet (Jim Manico)
  • 82e9b10 Add the denial-of-service invariant to AGENTS.md (Jim Manico)
  • d0b06bd Drop an unmatched CSS close bracket in constant time (Jim Manico)
  • 8a55b77 Drop CSS declarations that nest functions deeper than sixteen (Jim Manico)
  • a310fe4 Harden release and build verification (Jim Manico)
  • 3b122bb Record GHSA-6rfr-g8xv-xrp3 (Jim Manico)
  • 393d86d Prepare for next development version (GitHub Actions)

Contributors

We'd like to thank the following people for their contributions:

  • Jim Manico

Release 20260922.1

Changelog

  • c2042c0 Release version 20260922.1 (GitHub Actions)
  • ea86ffa Encode CSS URL content after rewriting (Jim Manico)
  • de7555c Record GHSA-vqwm-jvq2-mfwc and pin its reported cases (Jim Manico)
  • 0261fc6 Prepare for next development version (GitHub Actions)

Contributors

We'd like to thank the following people for their contributions:

  • Jim Manico

Release 20260921.1

... (truncated)

Commits
  • 2e944e7 Release version 20260924.2
  • 78de192 Merge pull request #512 from OWASP/release-notes-20260924-2
  • b203767 Add the change log entry for 20260924.2
  • 05895ea Merge pull request #511 from OWASP/agents-dos-wording
  • 9b3233d Make the denial-of-service invariant promise what can be kept
  • 05ca527 Merge pull request #510 from OWASP/css-scan-cleanups
  • dfe357e Take the review: size the churn test for an ordinary heap
  • 4c910d3 Take the review: keep the walk's guard, drop the dead growth cap
  • f95efad Take the review: say the depth scan's over-count can drop valid CSS
  • de57cff Take the review: count open brackets in three ints, not 126
  • Additional commits viewable in compare view

Updates io.freefair.lombok from 8.13 to 9.8.0

Release notes

Sourced from io.freefair.lombok's releases.

9.8.0

What's Changed

Full Changelog: freefair/gradle-plugins@9.7.0...9.8.0

9.7.0

What's Changed

... (truncated)

Commits
  • 8e31f66 chore(deps): bump ...

    Description has been truncated

@dependabot
Bump the gradle group with 10 updates
3f9a0dd 
Bumps the gradle group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [org.junit:junit-bom](https://github.com/junit-team/junit-framework) | `5.12.0` | `6.1.3` |
| [org.junit.jupiter:junit-jupiter](https://github.com/junit-team/junit-framework) | `5.12.0` | `6.1.3` |
| [com.google.guava:guava](https://github.com/google/guava) | `33.4.0-jre` | `33.7.2-jre` |
| [org.projectlombok:lombok](https://github.com/projectlombok/lombok) | `1.18.36` | `1.18.48` |
| [org.json:json](https://github.com/douglascrockford/JSON-java) | `20250107` | `20260814` |
| commons-io:commons-io | `2.18.0` | `2.22.0` |
| [org.springframework.boot:spring-boot-starter-web](https://github.com/spring-projects/spring-boot) | `3.4.3` | `4.1.1` |
| [com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer](https://github.com/OWASP/java-html-sanitizer) | `20240325.1` | `20260924.2` |
| [io.freefair.lombok](https://github.com/freefair/gradle-plugins) | `8.13` | `9.8.0` |
| [gradle-wrapper](https://github.com/gradle/gradle) | `8.13` | `9.8.0` |


Updates `org.junit:junit-bom` from 5.12.0 to 6.1.3
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](junit-team/junit-framework@r5.12.0...r6.1.3)

Updates `org.junit.jupiter:junit-jupiter` from 5.12.0 to 6.1.3
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](junit-team/junit-framework@r5.12.0...r6.1.3)

Updates `com.google.guava:guava` from 33.4.0-jre to 33.7.2-jre
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

Updates `org.projectlombok:lombok` from 1.18.36 to 1.18.48
- [Changelog](https://github.com/projectlombok/lombok/blob/master/doc/changelog.markdown)
- [Commits](projectlombok/lombok@v1.18.36...v1.18.48)

Updates `org.json:json` from 20250107 to 20260814
- [Release notes](https://github.com/douglascrockford/JSON-java/releases)
- [Changelog](https://github.com/stleary/JSON-java/blob/master/docs/RELEASES.md)
- [Commits](stleary/JSON-java@2025010...2026081)

Updates `commons-io:commons-io` from 2.18.0 to 2.22.0

Updates `org.springframework.boot:spring-boot-starter-web` from 3.4.3 to 4.1.1
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.4.3...v4.1.1)

Updates `com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer` from 20240325.1 to 20260924.2
- [Release notes](https://github.com/OWASP/java-html-sanitizer/releases)
- [Commits](OWASP/java-html-sanitizer@release-20240325.1...release-20260924.2)

Updates `io.freefair.lombok` from 8.13 to 9.8.0
- [Release notes](https://github.com/freefair/gradle-plugins/releases)
- [Commits](freefair/gradle-plugins@8.13...9.8.0)

Updates `gradle-wrapper` from 8.13 to 9.8.0
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](gradle/gradle@v8.13.0...v9.8.0)

---
updated-dependencies:
- dependency-name: org.junit:junit-bom
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
- dependency-name: org.junit.jupiter:junit-jupiter
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
- dependency-name: com.google.guava:guava
  dependency-version: 33.7.2-jre
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: org.projectlombok:lombok
  dependency-version: 1.18.48
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: org.json:json
  dependency-version: '20260814'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
- dependency-name: commons-io:commons-io
  dependency-version: 2.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: org.springframework.boot:spring-boot-starter-web
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
- dependency-name: com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer
  dependency-version: '20260924.2'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
- dependency-name: io.freefair.lombok
  dependency-version: 9.8.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
- dependency-name: gradle-wrapper
  dependency-version: 9.8.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gradle
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Oct 4, 2026
@breuerlukas
breuerlukas merged commit ef93cf6 into main Oct 7, 2026
2 checks passed
@dependabot
dependabot Bot deleted the dependabot/gradle/gradle-a9d4089b94 branch October 7, 2026 07:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@breuerlukas