Skip to content

Bump the maven-minor-updates group across 2 directories with 10 updates - #418

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/maven-minor-updates-2abdc90959
Open

Bump the maven-minor-updates group across 2 directories with 10 updates#418
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/maven-minor-updates-2abdc90959

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the maven-minor-updates group with 6 updates in the / directory:

Package From To
org.jspecify:jspecify 1.0.0 1.0.1
joda-time:joda-time 2.14.2 2.14.3
org.springframework.cloud:spring-cloud-dependencies 2025.0.0 2025.1.2
io.netty:netty-bom 4.1.135.Final 4.2.17.Final
org.apache.maven:apache-maven 3.9.9 3.9.16
org.apache.maven.wrapper:maven-wrapper 3.3.2 3.3.4

Bumps the maven-minor-updates group with 4 updates in the /log4j-samples-graalvm directory: org.junit:junit-bom, ch.qos.logback:logback-classic, net.javacrumbs.json-unit:json-unit-assertj and org.graalvm.buildtools:native-maven-plugin.

Updates org.jspecify:jspecify from 1.0.0 to 1.0.1

Release notes

Sourced from org.jspecify:jspecify's releases.

1.0.1

JSpecify 1.0.1 makes small changes to documentation and build setup but no semantic changes.

Artifacts

Changes since version 1.0.0

  • The JSpecify module-info.class is now present at the root of the jar instead of under a multi-release root. This prevents the jar from containing a file at META-INF/versions/9/OSGI-INF/MANIFEST.MF, which was causing trouble for some users, particularly on Android.
  • The JSpecify module-info.class now contains its version number.
  • We have made various improvements to our Javadoc. While the latest docs are always available at jspecify.dev/docs/api, this release makes our improvements visible in the source files in your IDE.
Commits
  • ce9bec0 Set version to 1.0.1.
  • 7c7f0cf Migrate to com.vanniktech.maven.publish.
  • 2789f67 Bump yaml from 1.10.2 to 1.10.3 in /docs (#853)
  • 1638ca0 Bump svgo from 3.3.2 to 3.3.4 in /docs (#852)
  • 4e80178 Place module-info in the root of the jar. (#809)
  • 5b679e0 Codex found a few more questions the FAQ already answers. (#848)
  • 2019899 Link to the new location of the design FAQ and to specific sections. (#845)
  • f01eac9 batch of javadoc revisions for clarity and completeness (#671)
  • c4eff31 Import the nullness design FAQ as Markdown. (#838)
  • 75fb9cf Bump websocket-driver from 0.7.4 to 0.7.5 in /docs (#835)
  • Additional commits viewable in compare view

Updates joda-time:joda-time from 2.14.2 to 2.14.3

Release notes

Sourced from joda-time:joda-time's releases.

Release v2.14.3

See the change notes for more information.

What's Changed

Full Changelog: JodaOrg/joda-time@v2.14.2...v2.14.3

Commits

Updates org.springframework.cloud:spring-cloud-dependencies from 2025.0.0 to 2025.1.2

Release notes

Sourced from org.springframework.cloud:spring-cloud-dependencies's releases.

v2025.1.2

What's Included

  • Spring Cloud Netflix 5.0.2 (issues)
  • Spring Cloud Stream 5.0.2 (issues)
  • Spring Cloud Config 5.0.4 (issues)
  • Spring Cloud Consul 5.0.2 (issues)
  • Spring Cloud Circuitbreaker 5.0.2 (issues)
  • Spring Cloud Starter Build 2025.1.2 (issues)
  • Spring Cloud Build 5.0.2 (issues)
  • Spring Cloud Gateway 5.0.2 (issues)
  • Spring Cloud Bus 5.0.2 (issues)
  • Spring Cloud Contract 5.0.3 (issues)
  • Spring Cloud Vault 5.0.2 (issues)
  • Spring Cloud Task 5.0.2 (issues)
  • Spring Cloud Function 5.0.3 (issues)
  • Spring Cloud Kubernetes 5.0.2 (issues)
  • Spring Cloud Commons 5.0.2 (issues)
  • Spring Cloud Openfeign 5.0.2 (issues)
  • Spring Cloud Zookeeper 5.0.2 (issues)

What's Changed

Full Changelog: spring-cloud/spring-cloud-release@v2025.1.1...v2025.1.2

v2025.1.1

What's Changed

... (truncated)

Commits
  • bda306d Update SNAPSHOT to 2025.1.2
  • 4fd3272 Merge pull request #517 from spring-cloud/dependabot/npm_and_yarn/docs/main/s...
  • be421f5 Bump @​springio/antora-extensions from 1.14.11 to 1.14.12 in /docs
  • 6ad8d9d Merge pull request #513 from spring-cloud/dependabot/maven/main/org.apache.ma...
  • bc10fd4 Merge pull request #514 from spring-cloud/dependabot/maven/org.apache.maven-m...
  • 57ecb39 Bump org.apache.maven:maven-model from 3.9.15 to 3.9.16
  • 3963ec2 Bump org.apache.maven:maven-model from 3.9.15 to 3.9.16
  • def3e63 Upgrading antora to 3.2.0-alpha.12
  • 145f1d6 Bumping versions
  • 0a141a4 Update spring-cloud-config.version to 5.0.4-SNAPSHOT
  • Additional commits viewable in compare view

Updates io.netty:netty-bom from 4.1.135.Final to 4.2.17.Final

Release notes

Sourced from io.netty:netty-bom's releases.

netty-4.2.17.Final

What's Changed

New Contributors

... (truncated)

Commits
  • e0789d3 [maven-release-plugin] prepare release netty-4.2.17.Final
  • 1b5abc6 Merge changes from forks (#17213)
  • 36fbf57 Update surefire plugin to latest version (#17210)
  • a96226c Add .editorconfig to enforce consistent coding style (#17052)
  • 14a4e6a OpenSSL: Allow to obtain used named group via OpenSslSession (#17058)
  • 26255b1 Weakly reference engines from the OpenSSL engine map (#17199)
  • ae41417 HttpServerCodec: do not consume the method queue for 1xx interim responses ...
  • 41f1db5 Do not write WebSocket handshake response to the tail of the pipeline (#17192)
  • 035d76e Update compress-lzf to 1.2.1 (#17194)
  • 7681aff Fix JdkZlibDecompressor losing the tail of highly compressible streams (#17191)
  • Additional commits viewable in compare view

Updates org.apache.maven:apache-maven from 3.9.9 to 3.9.16

Updates org.apache.maven.wrapper:maven-wrapper from 3.3.2 to 3.3.4

Release notes

Sourced from org.apache.maven.wrapper:maven-wrapper's releases.

3.3.4

🐛 Bug Fixes

👻 Maintenance

  • Ensure Path Traversal is fully addressed in MavenWrapperDownloader (#363) @​hazendaz

3.3.3

💥 Breaking changes

🚀 New features and improvements

  • Fix Maven wrapper support for snapshot distributions (#335) @​gnodet

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

... (truncated)

Commits
  • 524486a [maven-release-plugin] prepare release maven-wrapper-3.3.4
  • 17c1ec9 Revert wrapper version removal (#365)
  • 366207f Ensure Path Traversal is fully addressed in MavenWrapperDownloader
  • 086b1c9 [maven-release-plugin] prepare for next development iteration
  • e2a0c81 [maven-release-plugin] prepare release maven-wrapper-3.3.3
  • 80952cd Clarify usage of MAVEN_USER_HOME
  • 08e7200 Remove wrapper lifecycle
  • 36886fa Support for snapshot distributions - fix (#352)
  • d02d845 Use invoker version from parent
  • af7671b Bump mavenVersion from 3.9.6 to 3.9.11 (#360)
  • Additional commits viewable in compare view

Updates org.junit:junit-bom from 6.1.2 to 6.1.3

Release notes

Sourced from org.junit:junit-bom's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

Commits
  • f59f60d Release 6.1.3
  • cd8ec92 Finalize 6.1.3 release notes
  • c8729f2 Restore compatibility with GraalVM 25 (#5901)
  • ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
  • fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
  • 62afc02 Delay GraalVM plugin updates for 3 days
  • 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
  • f6bbfc5 Move GraalVM tests to separate test task (#5903)
  • e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
  • 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
  • Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.6.0 to 1.6.2

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

  • Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

  • Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

    <property name="logback.skipCallerContradictionAnalysis" value="true"/>

  • SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

  • Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

  • Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

  • Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

• On GZ, ZIP, or XZ compression failure, the original (uncompressed) log file is no longer deleted. Compression strategies now delete the source file only after successful compression and emit a warning that the original was left intact.

• ConsoleAppender with now probes JLine's org.jline.jansi.AnsiConsole first and falls back to the legacy FuseSource org.fusesource.jansi.AnsiConsole class. This keeps ANSI coloring working after Jansi moved under the JLine project. The optional org.jline:jansi-core artifact is declared as a dependency alongside the existing FuseSource jansi dependency. A preferredJansiClassName property was added for tests. This issue was reported in issues/1043 by seonwoo_jung who also provided the relevant PR.

• LayoutWrappingEncoder now reports an error at start() when no layout is set and guards encode() against a null layout. Previously, a missing layout (for example after an ignored // branch) allowed the encoder to start and then fail with a NullPointerException on every event, resulting in silent log loss. This issue was reported in issues/1046 by seonwoo_jung who also provided the relevant PR.

• FileCollisionAnalyser now detects file collisions involving nested appenders of SiftingAppender. When the nested file or fileNamePattern does not textually reference the discriminator key (e.g. ${userId}), a warning is issued at configuration time naming the appender, the key, and the shared target. This closes a gap where statically declared file appenders were checked but sifted nested appenders were not. This enhancement was contributed in [PR #1041](qos-ch/logback#1041) by seonwoo_jung.

• More defensive handling in SyslogOutputStream and SyslogAppenderBase: the close() method now ensures that resources are closed, writes and flushes check that the underlying resources are in a valid state and fallback to no-op otherwise.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 57759f433000a133088ef0441038963134437fbd associated with the tag v_1.6.1. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

• See https://logback.qos.ch/news.html#1.6.1 for the original text.

Commits
  • e3d7833 prepare release 1.6.2
  • 919127d test for skipping contradiction analysis
  • 67dcd40 allow skipping caller contradiction analysis
  • 2619c6d remove unused message string in CallerContradictionWarnAnalyser
  • 22cfade add support for SMTPAppender in caller data contradiction analysis
  • 656fb6d minor javadoc change in SMTPAppenderBase
  • efb1ce2 cover SocketAppender in caller contradiction analysis
  • d3a01f8 more tests for caller contradiction analysis
  • b1a80d6 more complete logic in caller contradiction analysis
  • 0678954 SimpleSocketServer and SLLSimpleSocketServer now accept whitelisted
  • Additional commits viewable in compare view

Updates net.javacrumbs.json-unit:json-unit-assertj from 6.0.1 to 6.1.0

Changelog

Sourced from net.javacrumbs.json-unit:json-unit-assertj's changelog.

6.1.0 (2026-08-10)

  • Support for ${json-unit.missing-or-null}
  • Dependency updates
Commits
  • c76ec18 [maven-release-plugin] prepare release json-unit-parent-6.1.0
  • adb4556 Support for json-unit.missing-or-null
  • 623d004 Bump org.json:json from 20260522 to 20260719
  • 0feaf90 Merge pull request #1160 from lukas-krecan/dependabot/maven/org.apache.felix-...
  • eb44087 Bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.0
  • 309d0fc Merge pull request #1159 from lukas-krecan/dependabot/maven/org.jspecify-jspe...
  • 9b0b9d8 Bump org.jspecify:jspecify from 1.0.0 to 1.0.1
  • c86469a Merge pull request #1158 from lukas-krecan/dependabot/maven/ch.qos.logback-lo...
  • 66c7b7b Bump ch.qos.logback:logback-classic from 1.6.0 to 1.6.1
  • fc1c11e Merge pull request #1157 from lukas-krecan/dependabot/maven/com.diffplug.spot...
  • Additional commits viewable in compare view

Updates org.graalvm.buildtools:native-maven-plugin from 1.1.5 to 1.1.8

Release notes

Sourced from org.graalvm.buildtools:native-maven-plugin's releases.

1.1.8

What's Changed

Full Changelog: graalvm/native-build-tools@1.1.7...1.1.8

1.1.7

What's Changed

Full Changelog: graalvm/native-build-tools@1.1.6...1.1.7

1.1.6

What's Changed

@dependabot
Bump the maven-minor-updates group across 2 directories with 10 updates
bd35b59 
Bumps the maven-minor-updates group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [org.jspecify:jspecify](https://github.com/jspecify/jspecify) | `1.0.0` | `1.0.1` |
| [joda-time:joda-time](https://github.com/JodaOrg/joda-time) | `2.14.2` | `2.14.3` |
| [org.springframework.cloud:spring-cloud-dependencies](https://github.com/spring-cloud/spring-cloud-release) | `2025.0.0` | `2025.1.2` |
| [io.netty:netty-bom](https://github.com/netty/netty) | `4.1.135.Final` | `4.2.17.Final` |
| org.apache.maven:apache-maven | `3.9.9` | `3.9.16` |
| [org.apache.maven.wrapper:maven-wrapper](https://github.com/apache/maven-wrapper) | `3.3.2` | `3.3.4` |

Bumps the maven-minor-updates group with 4 updates in the /log4j-samples-graalvm directory: [org.junit:junit-bom](https://github.com/junit-team/junit-framework), [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback), [net.javacrumbs.json-unit:json-unit-assertj](https://github.com/lukas-krecan/JsonUnit) and [org.graalvm.buildtools:native-maven-plugin](https://github.com/graalvm/native-build-tools).


Updates `org.jspecify:jspecify` from 1.0.0 to 1.0.1
- [Release notes](https://github.com/jspecify/jspecify/releases)
- [Commits](jspecify/jspecify@v1.0.0...v1.0.1)

Updates `joda-time:joda-time` from 2.14.2 to 2.14.3
- [Release notes](https://github.com/JodaOrg/joda-time/releases)
- [Changelog](https://github.com/JodaOrg/joda-time/blob/main/RELEASE-NOTES.txt)
- [Commits](JodaOrg/joda-time@v2.14.2...v2.14.3)

Updates `org.springframework.cloud:spring-cloud-dependencies` from 2025.0.0 to 2025.1.2
- [Release notes](https://github.com/spring-cloud/spring-cloud-release/releases)
- [Changelog](https://github.com/spring-cloud/spring-cloud-release/blob/main/release-train-settings.xml)
- [Commits](spring-cloud/spring-cloud-release@v2025.0.0...v2025.1.2)

Updates `io.netty:netty-bom` from 4.1.135.Final to 4.2.17.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.135.Final...netty-4.2.17.Final)

Updates `org.apache.maven:apache-maven` from 3.9.9 to 3.9.16

Updates `org.apache.maven.wrapper:maven-wrapper` from 3.3.2 to 3.3.4
- [Release notes](https://github.com/apache/maven-wrapper/releases)
- [Commits](apache/maven-wrapper@maven-wrapper-3.3.2...maven-wrapper-3.3.4)

Updates `org.junit:junit-bom` from 6.1.2 to 6.1.3
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](junit-team/junit-framework@r6.1.2...r6.1.3)

Updates `ch.qos.logback:logback-classic` from 1.6.0 to 1.6.2
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.6.0...v_1.6.2)

Updates `net.javacrumbs.json-unit:json-unit-assertj` from 6.0.1 to 6.1.0
- [Changelog](https://github.com/lukas-krecan/JsonUnit/blob/master/RELEASES.md)
- [Commits](lukas-krecan/JsonUnit@json-unit-parent-6.0.1...json-unit-parent-6.1.0)

Updates `org.graalvm.buildtools:native-maven-plugin` from 1.1.5 to 1.1.8
- [Release notes](https://github.com/graalvm/native-build-tools/releases)
- [Commits](graalvm/native-build-tools@1.1.5...1.1.8)

---
updated-dependencies:
- dependency-name: org.jspecify:jspecify
  dependency-version: 1.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-updates
- dependency-name: joda-time:joda-time
  dependency-version: 2.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-updates
- dependency-name: org.springframework.cloud:spring-cloud-dependencies
  dependency-version: 2025.1.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-updates
- dependency-name: io.netty:netty-bom
  dependency-version: 4.2.17.Final
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-updates
- dependency-name: org.apache.maven:apache-maven
  dependency-version: 3.9.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-updates
- dependency-name: org.apache.maven.wrapper:maven-wrapper
  dependency-version: 3.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-updates
- dependency-name: org.junit:junit-bom
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-updates
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-updates
- dependency-name: net.javacrumbs.json-unit:json-unit-assertj
  dependency-version: 6.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor-updates
- dependency-name: org.graalvm.buildtools:native-maven-plugin
  dependency-version: 1.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants