Skip to content

Bump the maven-dependencies group across 1 directory with 17 updates - #4306

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/maven-dependencies-977c9f2c26
Open

Bump the maven-dependencies group across 1 directory with 17 updates#4306
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/maven-dependencies-977c9f2c26

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the maven-dependencies group with 17 updates in the / directory:

Package From To
org.junit:junit-bom 6.1.0 6.1.2
ch.qos.logback:logback-classic 1.5.36 1.6.1
org.apache.maven:maven-model 4.0.0-rc-5 4.0.0-rc-6
io.smallrye.config:smallrye-config 3.17.2 3.18.1
org.mongodb:mongodb-driver-sync 5.8.0 5.9.1
org.mongodb:mongodb-driver-legacy 5.8.0 5.9.1
org.zeroturnaround:zt-exec 1.12 1.13.0
com.fasterxml.jackson.core:jackson-databind 2.22.0 2.22.1
com.fasterxml.jackson.dataformat:jackson-dataformat-yaml 2.22.0 2.22.1
org.jsoup:jsoup 1.22.2 1.23.1
com.github.spotbugs:spotbugs-annotations 4.10.2 4.10.3
net.bytebuddy:byte-buddy 1.18.10 1.18.11
io.github.classgraph:classgraph 4.8.184 4.8.186
com.google.devtools.ksp:symbol-processing-api 2.3.9 2.3.11
com.google.devtools.ksp:symbol-processing-common-deps 2.3.9 2.3.11
com.google.devtools.ksp:symbol-processing-aa-embeddable 2.3.9 2.3.11
org.apache.maven.plugins:maven-jar-plugin 3.5.0 3.5.1

Updates org.junit:junit-bom from 6.1.0 to 6.1.2

Release notes

Sourced from org.junit:junit-bom's releases.

JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.1...r6.1.2

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

Commits
  • b685426 Release 6.1.2
  • ae244a6 Remove blanket outputDirectoryCreator from SuiteEngineTests (#5793)
  • 43bd154 Finalize 6.1.2 release notes
  • 0cd9510 Fix order of release note sections
  • a1507cb Add initial 6.1.2 release notes to release notes index
  • 9326641 Fix NoTestsDiscoveredException for suites containing only dynamic tests (#5839)
  • 2ef1123 Create initial 6.1.2 release notes from template
  • 83fa9ab Back to snapshots for further development
  • 0d85889 Release 6.1.1
  • 0363eee Finalize 6.1.1 release notes
  • Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.5.36 to 1.6.1

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

• On GZ, ZIP, or XZ compression failure, the original (uncompressed) log file is no longer deleted. Compression strategies now delete the source file only after successful compression and emit a warning that the original was left intact.

• ConsoleAppender with now probes JLine's org.jline.jansi.AnsiConsole first and falls back to the legacy FuseSource org.fusesource.jansi.AnsiConsole class. This keeps ANSI coloring working after Jansi moved under the JLine project. The optional org.jline:jansi-core artifact is declared as a dependency alongside the existing FuseSource jansi dependency. A preferredJansiClassName property was added for tests. This issue was reported in issues/1043 by seonwoo_jung who also provided the relevant PR.

• LayoutWrappingEncoder now reports an error at start() when no layout is set and guards encode() against a null layout. Previously, a missing layout (for example after an ignored // branch) allowed the encoder to start and then fail with a NullPointerException on every event, resulting in silent log loss. This issue was reported in issues/1046 by seonwoo_jung who also provided the relevant PR.

• FileCollisionAnalyser now detects file collisions involving nested appenders of SiftingAppender. When the nested file or fileNamePattern does not textually reference the discriminator key (e.g. ${userId}), a warning is issued at configuration time naming the appender, the key, and the shared target. This closes a gap where statically declared file appenders were checked but sifted nested appenders were not. This enhancement was contributed in [PR #1041](qos-ch/logback#1041) by seonwoo_jung.

• More defensive handling in SyslogOutputStream and SyslogAppenderBase: the close() method now ensures that resources are closed, writes and flushes check that the underlying resources are in a valid state and fallback to no-op otherwise.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 57759f433000a133088ef0441038963134437fbd associated with the tag v_1.6.1. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

• See https://logback.qos.ch/news.html#1.6.1 for the original text.

Logback 1.6.0

2026-07-23 Release of logback version 1.6.0

• Removed certain deprecated variables, methods, and classes. For the list of removed members see release_1.6.0.txt.

• In AsyncAppenderBase, the put(ILoggingEvent) method now has the protected modifier to allow access from derived classes. This change was requested by Thomas Skjølberg in pr#1053.

• Bump SLF4J dependency to version 2.0.18.

• See also the overview of the 1.6.x series.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit b07adf36019b51a10f824fdd94009985c587b1d3 associated with the tag v_1.6.0. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.38

2026-07-09 Release of logback version 1.5.38

• In HardenedObjectInputStream, fixed a typo preventing Throwable objects from being white-filtered. This issue was reported in [PR #1045](qos-ch/logback#1045) by t0rchwo0d.

• A bitwise identical binary of this version can be reproduced by building from source code at commit d04984a41fce42977466f45a2f076f0ee5cc4207 associated with the tag v_1.5.38. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.37

2026-06-26 Release of logback version 1.5.37

  1. • Given the numerous vulnerabilities related to conditional configuration processing based on the evaluation of Java expressions using the Janino library, support for such expressions has been removed. Users are offered the an online migration service or the <condition> element introduced in version 1.5.20. See the relevant documentation for more details.

• A bitwise identical binary of this version can be reproduced by building from source code at commit c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag v_1.5.37. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits
  • 57759f4 prepare release 1.6.1
  • 175f99f fix imports
  • 4b8773e add compressionFailureLeavesOriginalFileIntact test for XZ compression
  • cafaf11 do not delete original file if compression fails
  • ee50125 let the temporary file before compression be target file without the .gz or ....
  • 5626acc minor refactoring
  • d97da4f minor refactoring
  • 159c045 more defensive coding in SyslogOutputStream and in SyslogAppenderBase
  • 9427d6b slight refactoring for clarity
  • 79c4179 slight refactoring
  • Additional commits viewable in compare view

Updates org.apache.maven:maven-model from 4.0.0-rc-5 to 4.0.0-rc-6

Updates io.smallrye.config:smallrye-config from 3.17.2 to 3.18.1

Release notes

Sourced from io.smallrye.config:smallrye-config's releases.

3.18.1

3.18.0

  • #1544 Release 3.18.0
  • #1543 Bump io.smallrye:smallrye-parent from 50 to 51
  • #1541 Fix ConfigMapping hashCode collision for Map properties with equal keys and values
  • #1540 Bump Python version from 3.9 to 3.12 in CI documentation workflows
  • #1539 Remove deprecated Jasypt support
  • #1538 Support nested config classes in class-based mappings
  • #1537 Bump actions/checkout from 6 to 7
  • #1536 Configure Surefire to display parameterized test names in reports
  • #1535 Fix HOCON property name rendering
  • #1534 Reproduce issue with @WithUnnamedKey config group considered present even if unconfigured
  • #1533 Bump io.smallrye:smallrye-parent from 49 to 50
  • #1532 Add SPI ConfigMappingHandler to split handling of @​ConfigMapping and @​ConfigProperties
  • #1531 Bump io.smallrye.common:smallrye-common-bom from 2.18.1 to 2.19.0
  • #1530 Bump com.typesafe:config from 1.4.8 to 1.4.9
  • #1529 Bump kotlin.version from 2.3.21 to 2.4.0
  • #1528 Update MicroProfile Config to 3.1.1
  • #1527 Stabilize hashCode of ConfigClass
  • #1526 Bump org.ow2.asm:asm from 9.10 to 9.10.1
  • #1525 Bump idna from 3.11 to 3.15 in /documentation
  • #1524 Bump pymdown-extensions from 10.21.2 to 10.21.3 in /documentation
  • #1523 Bump org.ow2.asm:asm from 9.9.1 to 9.10
  • #1522 Bump io.smallrye.common:smallrye-common-bom from 2.18.0 to 2.18.1
  • #1520 Bump urllib3 from 2.6.3 to 2.7.0 in /documentation
  • #1519 Bump io.smallrye.common:smallrye-common-bom from 2.17.1 to 2.18.0
  • #1518 Bump com.typesafe:config from 1.4.7 to 1.4.8
  • #1516 Bump com.typesafe:config from 1.4.6 to 1.4.7
  • #1515 Bump io.smallrye:smallrye-parent from 48 to 49
  • #1514 Bump kotlin.version from 2.3.20 to 2.3.21
  • #1513 Bump org.jboss.bridger:bridger from 1.6.Final to 1.8
  • #1510 Bump io.sundr:sundr-maven-plugin from 0.240.1 to 0.300.0
Commits
  • d576664 [maven-release-plugin] prepare release 3.18.1
  • c628013 Release 3.18.1 (#1547)
  • 8a86d44 @​WithUnnamedKey#eager to control if default keys are present in the mapping M...
  • fb0c3bf [maven-release-plugin] prepare for next development iteration
  • 21ceb75 [maven-release-plugin] prepare release 3.18.0
  • a7bafe6 Update release preparation condition in workflow
  • c94a186 Add workflow_dispatch trigger to release workflow
  • e93eddf Release 3.18.0 (#1544)
  • 0daa482 Reproduce issue with @WithUnnamedKey config group considered present even i...
  • 3d6d5dc Bump io.smallrye:smallrye-parent from 50 to 51 (#1543)
  • Additional commits viewable in compare view

Updates org.mongodb:mongodb-driver-sync from 5.8.0 to 5.9.1

Release notes

Sourced from org.mongodb:mongodb-driver-sync's releases.

Java Driver 5.9.1 (July 23, 2026)

What's Changed

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: mongodb/mongo-java-driver@r5.9.0...r5.9.1

Java Driver 5.9.0 (July 07, 2026)

What's Changed

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: mongodb/mongo-java-driver@r5.8.0...r5.9.0

Java Driver 5.8.1 (July 16, 2026)

What's Changed

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8
</tr></table>

... (truncated)

Commits
  • cfc4ad3 Version: bump 5.9.1
  • 4f5924e Resolve forwarded type arguments across POJO hierarchy edges (#2020)
  • 2baa2c9 Version: bump 5.9.1-SNAPSHOT
  • 90d54c4 Version: bump 5.9.0
  • 32cbe4b JAVA-6168 JAVA-6244 JAVA-6196: QE prefix/suffix/substring GA + rename Text AP...
  • 6612f5d JAVA-6237: Explicit Encryption Case 2 uses contention-10 collection (#2003)
  • d84dabb Fix reactive streams MongoClient.getTimeout always returning null (#2009)
  • aad04d1 Update Specs to latest (#2001)
  • 4d81e85 Add Windows CI testing (#1935)
  • 8aa3242 Update the Git specifications submodule from 25bee54 to 4484038 (#1992)
  • Additional commits viewable in compare view

Updates org.mongodb:mongodb-driver-legacy from 5.8.0 to 5.9.1

Release notes

Sourced from org.mongodb:mongodb-driver-legacy's releases.

Java Driver 5.9.1 (July 23, 2026)

What's Changed

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: mongodb/mongo-java-driver@r5.9.0...r5.9.1

Java Driver 5.9.0 (July 07, 2026)

What's Changed

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: mongodb/mongo-java-driver@r5.8.0...r5.9.0

Java Driver 5.8.1 (July 16, 2026)

What's Changed

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8
</tr></table>

... (truncated)

Commits
  • cfc4ad3 Version: bump 5.9.1
  • 4f5924e Resolve forwarded type arguments across POJO hierarchy edges (#2020)
  • 2baa2c9 Version: bump 5.9.1-SNAPSHOT
  • 90d54c4 Version: bump 5.9.0
  • 32cbe4b JAVA-6168 JAVA-6244 JAVA-6196: QE prefix/suffix/substring GA + rename Text AP...
  • 6612f5d JAVA-6237: Explicit Encryption Case 2 uses contention-10 collection (#2003)
  • d84dabb Fix reactive streams MongoClient.getTimeout always returning null (#2009)
  • aad04d1 Update Specs to latest (#2001)
  • 4d81e85 Add Windows CI testing (#1935)
  • 8aa3242 Update the Git specifications submodule from 25bee54 to 4484038 (#1992)
  • Additional commits viewable in compare view

Updates org.mongodb:mongodb-driver-legacy from 5.8.0 to 5.9.1

Release notes

Sourced from org.mongodb:mongodb-driver-legacy's releases.

Java Driver 5.9.1 (July 23, 2026)

What's Changed

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: mongodb/mongo-java-driver@r5.9.0...r5.9.1

Java Driver 5.9.0 (July 07, 2026)

What's Changed

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: mongodb/mongo-java-driver@r5.8.0...r5.9.0

Java Driver 5.8.1 (July 16, 2026)

What's Changed

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8
</tr></table>

... (truncated)

Commits
  • cfc4ad3 Version: bump 5.9.1
  • 4f5924e Resolve forwarded type arguments across POJO hierarchy edges (#2020)
  • 2baa2c9 Version: bump 5.9.1-SNAPSHOT
  • 90d54c4 Version: bump 5.9.0
  • 32cbe4b JAVA-6168 JAVA-6244 JAVA-6196: QE prefix/suffix/substring GA + rename Text AP...
  • 6612f5d JAVA-6237: Explicit Encryption Case 2 uses contention-10 collection (#2003)
  • d84dabb Fix reactive streams MongoClient.getTimeout always returning null (#2009)
  • aad04d1 Update Specs to latest (#2001)
  • 4d81e85 Add Windows CI testing (#1935)
  • 8aa3242 Update the Git specifications submodule from 25bee54 to 4484038 (#1992)
  • Additional commits viewable in compare view

Updates org.zeroturnaround:zt-exec from 1.12 to 1.13.0

Release notes

Sourced from org.zeroturnaround:zt-exec's releases.

v1.13.0

What's Changed

New Contributors

Full Changelog: https://github.com/zeroturnaround/zt-exec/commits/v1.13.0

Changelog

Sourced from org.zeroturnaround:zt-exec's changelog.

[1.13.0] - 2026-07-10

Added

  • LogOutputStream.create(LineConsumer) to build a LogOutputStream from a lambda (#107).
  • LogOutputStream.setOutputCharset(String) to control the charset used to decode the process output (#89).
  • An OSGi bundle manifest (Bundle-SymbolicName, Export-Package) in the published jar (#85).
  • A JPMS module descriptor for module org.zeroturnaround.exec, shipped as a Java 9 multi-release entry (#106).

Changed

  • Raised the minimum Java runtime from 6 to 8 (bytecode target moved from 1.6 to 1.8).
  • Upgraded the slf4j-api dependency from 1.7.2 to 1.7.32.
  • Migrated the build from Maven to Gradle; releases now publish to Maven Central through the Sonatype Central Portal.
Commits
  • f71a22a Release 1.13.0
  • 13ca7bd List all consumer-facing changes since 1.12 in the changelog
  • a614f50 Bump the minor-and-patch group across 1 directory with 4 updates
  • d20fae7 Bump org.apache.commons:commons-lang3 from 3.12.0 to 3.18.0
  • f16fd4e Bump commons-io:commons-io from 2.11.0 to 2.14.0
  • 09612ed Suppress automatic-module warning on the slf4j requires directive
  • 38f6ee9 Add CHANGELOG.md, security policy, and changelog release automation
  • 1711820 Adopt vMAJOR.MINOR.PATCH release tags
  • 6e8e4a6 Bump build tooling to current versions
  • 5e0b895 Drop defunct ZeroTurnaround references from POM metadata
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-databind from 2.22.0 to 2.22.1

Commits

Updates com.fasterxml.jackson.dataformat:jackson-dataformat-yaml from 2.22.0 to 2.22.1

Commits
  • 681f699 [maven-release-plugin] prepare release jackson-dataformats-text-2.22.1
  • 8e25852 Prep for 2.22.1 release
  • e1ed4d2 Merge branch '2.21' into 2.22
  • 3f3257c Post-release dep version bump
  • 3348a1a [maven-release-plugin] prepare for next development iteration
  • 687ad4f [maven-release-plugin] prepare release jackson-dataformats-text-2.21.5
  • 955c59f Prep for 2.21.5 release
  • 588933e Post-release dep version bump
  • 38f3683 [maven-release-plugin] prepare for next development iteration
  • See full diff in compare view

Updates com.fasterxml.jackson.dataformat:jackson-dataformat-yaml from 2.22.0 to 2.22.1

Commits
  • 681f699 [maven-release-plugin] prepare release jackson-dataformats-text-2.22.1
  • 8e25852 Prep for 2.22.1 release
  • e1ed4d2 Merge branch '2.21' into 2.22
  • 3f3257c Post-release dep version bump
  • 3348a1a [maven-release-plugin] prepare for next development iteration
  • 687ad4f [maven-release-plugin] prepare release jackson-dataformats-text-2.21.5
  • 955c59f Prep for 2.21.5 release
  • 588933e Post-release dep version bump
  • 38f3683 [maven-release-plugin] prepare for next development iteration
  • See full diff in compare view

Updates org.jsoup:jsoup from 1.22.2 to 1.23.1

Release notes

Sourced from org.jsoup:jsoup's releases.

jsoup 1.23.1

jsoup Java HTML Parser release 1.23.1

jsoup 1.23.1 is out now, with a faster and more memory-efficient HTML parser, improved alignment with the HTML standard across noscript, CDATA, SVG, and MathML parsing, and safer, specification-correct HTTP redirects. The release also adds a fast immutable Element#classList(), direct outer-HTML output to an Appendable, and fixes across RCDATA parsing, XML conversion, tag-name handling, and Cleaner link detection.

Performance optimization was a major focus for this release. In our OpenJDK 21 benchmarks, ordinary string parsing is now 18% faster on average, parsing from an InputStream is 11% faster, and parsing with source position tracking is 70% faster while allocating 64% fewer bytes per document.

Source-tracked DOMs retain 58-65% less memory on representative medium-to-large documents, and the improvements hold under concurrent parsing without introducing new contention. Exact gains will naturally vary with document shape, JVM, and hardware.

This release also fixes a security issue in the Cleaner that could expose markup when malformed HTML is cleaned with a custom Safelist permitting certain raw-text elements. The built-in Safelists are unaffected.

jsoup is a Java library for working with real-world HTML and XML. It provides a very convenient API for extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors.

Download jsoup now.

Improvements

  • Reduced retained memory when parsing with source position tracking enabled (Parser#setTrackPosition(true)). Source ranges are now stored in compact parser-owned span records instead of node and attribute user data, and Position objects are created lazily when source ranges are read. This cuts tracked DOM retained size by about 50-60% on representative benchmark documents, while keeping Node#sourceRange(), Element#endSourceRange(), and Attribute#sourceRange() behavior intact. #2498
  • Added Element#classList(), an immutable snapshot of an element's class names in attribute order. Use hasClass() when you just need to test for one class, classList() when you want to read or iterate classes without needing a mutable result, and classNames() when you want the existing mutable, deduplicated set that can be written back with classNames(Set). The class APIs now share an HTML-whitespace scanner, which also makes classNames() faster and lighter on allocation, especially when walking many elements without class names. #2500
  • Aligned HTML parser scope classification with the current HTML spec for select, foreignObject, and template. #2501
  • Simplified the HTML tree builder's scope, implied-end-tag, and special-element checks by caching parser-only options on Tag. That improves HTML parser throughput by about 10% on small inputs and up to about 30% on larger inputs in the benchmark fixtures. #2502
  • Improved HTML parser throughput stability by making hot tokeniser scan paths compile more predictably. #2507
  • <noscript> fallback markup is now parsed into an inspectable DOM subtree in both the document head and body. The fallback acts as a contained parsing island, so malformed markup cannot disrupt the surrounding document structure, while normal HTML tokenization still applies within it. This also improves round-trip serialization. #2537
  • Improved redirect credential handling as a defense-in-depth measure: explicit authorization headers and request cookies are no longer forwarded across origins, reducing exposure through open redirects and aligning with HTTP guidance. Cookies managed by a CookieStore continue to follow their configured scope. #2540
  • Elements can now append their outer HTML, including their own tags, directly to an Appendable with Node#outerHtml(Appendable), without first creating a String. This complements Element#html(Appendable), which appends inner HTML only. #2532
  • Aligned CDATA tokenization with the HTML spec: CDATA syntax in HTML content is parsed as a bogus comment, while it remains supported in SVG, MathML, and XML. Also improved namespace-aware fragment parsing so SVG and MathML contexts, HTML integration points, and context-sen...

    Description has been truncated

@dependabot
Bump the maven-dependencies group across 1 directory with 17 updates
30b8119 
Bumps the maven-dependencies group with 17 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [org.junit:junit-bom](https://github.com/junit-team/junit-framework) | `6.1.0` | `6.1.2` |
| [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.5.36` | `1.6.1` |
| org.apache.maven:maven-model | `4.0.0-rc-5` | `4.0.0-rc-6` |
| [io.smallrye.config:smallrye-config](https://github.com/smallrye/smallrye-config) | `3.17.2` | `3.18.1` |
| [org.mongodb:mongodb-driver-sync](https://github.com/mongodb/mongo-java-driver) | `5.8.0` | `5.9.1` |
| [org.mongodb:mongodb-driver-legacy](https://github.com/mongodb/mongo-java-driver) | `5.8.0` | `5.9.1` |
| [org.zeroturnaround:zt-exec](https://github.com/zeroturnaround/zt-exec) | `1.12` | `1.13.0` |
| [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson) | `2.22.0` | `2.22.1` |
| [com.fasterxml.jackson.dataformat:jackson-dataformat-yaml](https://github.com/FasterXML/jackson-dataformats-text) | `2.22.0` | `2.22.1` |
| [org.jsoup:jsoup](https://github.com/jhy/jsoup) | `1.22.2` | `1.23.1` |
| [com.github.spotbugs:spotbugs-annotations](https://github.com/spotbugs/spotbugs) | `4.10.2` | `4.10.3` |
| [net.bytebuddy:byte-buddy](https://github.com/raphw/byte-buddy) | `1.18.10` | `1.18.11` |
| [io.github.classgraph:classgraph](https://github.com/classgraph/classgraph) | `4.8.184` | `4.8.186` |
| [com.google.devtools.ksp:symbol-processing-api](https://github.com/google/ksp) | `2.3.9` | `2.3.11` |
| [com.google.devtools.ksp:symbol-processing-common-deps](https://github.com/google/ksp) | `2.3.9` | `2.3.11` |
| [com.google.devtools.ksp:symbol-processing-aa-embeddable](https://github.com/google/ksp) | `2.3.9` | `2.3.11` |
| [org.apache.maven.plugins:maven-jar-plugin](https://github.com/apache/maven-jar-plugin) | `3.5.0` | `3.5.1` |



Updates `org.junit:junit-bom` from 6.1.0 to 6.1.2
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](junit-team/junit-framework@r6.1.0...r6.1.2)

Updates `ch.qos.logback:logback-classic` from 1.5.36 to 1.6.1
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.5.36...v_1.6.1)

Updates `org.apache.maven:maven-model` from 4.0.0-rc-5 to 4.0.0-rc-6

Updates `io.smallrye.config:smallrye-config` from 3.17.2 to 3.18.1
- [Release notes](https://github.com/smallrye/smallrye-config/releases)
- [Commits](smallrye/smallrye-config@3.17.2...3.18.1)

Updates `org.mongodb:mongodb-driver-sync` from 5.8.0 to 5.9.1
- [Release notes](https://github.com/mongodb/mongo-java-driver/releases)
- [Commits](mongodb/mongo-java-driver@r5.8.0...r5.9.1)

Updates `org.mongodb:mongodb-driver-legacy` from 5.8.0 to 5.9.1
- [Release notes](https://github.com/mongodb/mongo-java-driver/releases)
- [Commits](mongodb/mongo-java-driver@r5.8.0...r5.9.1)

Updates `org.mongodb:mongodb-driver-legacy` from 5.8.0 to 5.9.1
- [Release notes](https://github.com/mongodb/mongo-java-driver/releases)
- [Commits](mongodb/mongo-java-driver@r5.8.0...r5.9.1)

Updates `org.zeroturnaround:zt-exec` from 1.12 to 1.13.0
- [Release notes](https://github.com/zeroturnaround/zt-exec/releases)
- [Changelog](https://github.com/zeroturnaround/zt-exec/blob/main/CHANGELOG.md)
- [Commits](zeroturnaround/zt-exec@zt-exec-1.12...v1.13.0)

Updates `com.fasterxml.jackson.core:jackson-databind` from 2.22.0 to 2.22.1
- [Commits](https://github.com/FasterXML/jackson/commits)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` from 2.22.0 to 2.22.1
- [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.22.0...jackson-dataformats-text-2.22.1)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` from 2.22.0 to 2.22.1
- [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.22.0...jackson-dataformats-text-2.22.1)

Updates `org.jsoup:jsoup` from 1.22.2 to 1.23.1
- [Release notes](https://github.com/jhy/jsoup/releases)
- [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES.md)
- [Commits](jhy/jsoup@jsoup-1.22.2...jsoup-1.23.1)

Updates `com.github.spotbugs:spotbugs-annotations` from 4.10.2 to 4.10.3
- [Release notes](https://github.com/spotbugs/spotbugs/releases)
- [Changelog](https://github.com/spotbugs/spotbugs/blob/master/CHANGELOG.md)
- [Commits](spotbugs/spotbugs@4.10.2...4.10.3)

Updates `net.bytebuddy:byte-buddy` from 1.18.10 to 1.18.11
- [Release notes](https://github.com/raphw/byte-buddy/releases)
- [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md)
- [Commits](raphw/byte-buddy@byte-buddy-1.18.10...byte-buddy-1.18.11)

Updates `io.github.classgraph:classgraph` from 4.8.184 to 4.8.186
- [Release notes](https://github.com/classgraph/classgraph/releases)
- [Commits](classgraph/classgraph@classgraph-4.8.184...classgraph-4.8.186)

Updates `com.google.devtools.ksp:symbol-processing-api` from 2.3.9 to 2.3.11
- [Release notes](https://github.com/google/ksp/releases)
- [Commits](google/ksp@2.3.9...2.3.11)

Updates `com.google.devtools.ksp:symbol-processing-common-deps` from 2.3.9 to 2.3.11
- [Release notes](https://github.com/google/ksp/releases)
- [Commits](google/ksp@2.3.9...2.3.11)

Updates `com.google.devtools.ksp:symbol-processing-aa-embeddable` from 2.3.9 to 2.3.11
- [Release notes](https://github.com/google/ksp/releases)
- [Commits](google/ksp@2.3.9...2.3.11)

Updates `com.google.devtools.ksp:symbol-processing-common-deps` from 2.3.9 to 2.3.11
- [Release notes](https://github.com/google/ksp/releases)
- [Commits](google/ksp@2.3.9...2.3.11)

Updates `com.google.devtools.ksp:symbol-processing-aa-embeddable` from 2.3.9 to 2.3.11
- [Release notes](https://github.com/google/ksp/releases)
- [Commits](google/ksp@2.3.9...2.3.11)

Updates `org.apache.maven.plugins:maven-jar-plugin` from 3.5.0 to 3.5.1
- [Release notes](https://github.com/apache/maven-jar-plugin/releases)
- [Commits](apache/maven-jar-plugin@maven-jar-plugin-3.5.0...maven-jar-plugin-3.5.1)

---
updated-dependencies:
- dependency-name: org.junit:junit-bom
  dependency-version: 6.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.apache.maven:maven-model
  dependency-version: 4.0.0-rc-6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: io.smallrye.config:smallrye-config
  dependency-version: 3.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.mongodb:mongodb-driver-sync
  dependency-version: 5.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.mongodb:mongodb-driver-legacy
  dependency-version: 5.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.mongodb:mongodb-driver-legacy
  dependency-version: 5.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.zeroturnaround:zt-exec
  dependency-version: 1.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.22.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml
  dependency-version: 2.22.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml
  dependency-version: 2.22.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.jsoup:jsoup
  dependency-version: 1.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: com.github.spotbugs:spotbugs-annotations
  dependency-version: 4.10.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: net.bytebuddy:byte-buddy
  dependency-version: 1.18.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: io.github.classgraph:classgraph
  dependency-version: 4.8.186
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.google.devtools.ksp:symbol-processing-api
  dependency-version: 2.3.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.google.devtools.ksp:symbol-processing-common-deps
  dependency-version: 2.3.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.google.devtools.ksp:symbol-processing-aa-embeddable
  dependency-version: 2.3.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.google.devtools.ksp:symbol-processing-common-deps
  dependency-version: 2.3.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.google.devtools.ksp:symbol-processing-aa-embeddable
  dependency-version: 2.3.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.apache.maven.plugins:maven-jar-plugin
  dependency-version: 3.5.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants