Skip to content

build(deps): bump the maven group across 3 directories with 20 updates - #17

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/maven-869304db0b
Closed

build(deps): bump the maven group across 3 directories with 20 updates#17
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/maven-869304db0b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the maven group with 12 updates in the / directory:

Package From To
org.springframework:spring-core 5.3.39 6.2.19
org.hibernate:hibernate-core 5.6.15.Final 6.0.0.Final
org.apache.jackrabbit:jackrabbit-jcr-commons 2.20.17 2.22.2
org.apache.tika:tika-core 2.9.4 3.2.2
org.apache.activemq:activemq-broker 5.16.8 5.19.7
org.apache.logging.log4j:log4j-core 2.25.3 2.25.4
com.fasterxml.jackson.core:jackson-core 2.21.1 2.21.4
org.jsoup:jsoup 1.22.1 1.23.1
org.apache.cxf:cxf-core 3.5.11 4.1.7
org.bouncycastle:bcpg-jdk18on 1.83 1.84
org.springframework.security:spring-security-core 5.8.16 6.0.0
org.apache.tomcat:tomcat-catalina 9.0.117 9.0.118

Bumps the maven group with 10 updates in the /projects/sitemanage directory:

Package From To
org.springframework:spring-core 5.3.39 6.2.19
org.hibernate:hibernate-core 5.6.15.Final 6.0.0.Final
org.apache.jackrabbit:jackrabbit-jcr-commons 2.20.17 2.22.2
org.apache.tika:tika-core 2.9.4 3.2.2
org.apache.activemq:activemq-broker 5.16.8 5.19.7
org.apache.logging.log4j:log4j-core 2.25.3 2.25.4
com.fasterxml.jackson.core:jackson-core 2.21.1 2.21.4
org.jsoup:jsoup 1.22.1 1.23.1
org.apache.cxf:cxf-core 3.5.11 4.1.7
org.bouncycastle:bcpg-jdk18on 1.83 1.84

Bumps the maven group with 10 updates in the /system directory:

Package From To
org.springframework:spring-core 5.3.39 6.2.19
org.hibernate:hibernate-core 5.6.15.Final 6.0.0.Final
org.apache.jackrabbit:jackrabbit-jcr-commons 2.20.17 2.22.2
org.apache.tika:tika-core 2.9.4 3.2.2
org.apache.activemq:activemq-broker 5.16.8 5.19.7
org.apache.logging.log4j:log4j-core 2.25.3 2.25.4
com.fasterxml.jackson.core:jackson-core 2.21.1 2.21.4
org.jsoup:jsoup 1.22.1 1.23.1
org.apache.cxf:cxf-core 3.5.11 4.1.7
org.bouncycastle:bcpg-jdk18on 1.83 1.84

Updates org.springframework:spring-core from 5.3.39 to 6.2.19

Release notes

Sourced from org.springframework:spring-core's releases.

v6.2.19

⚠️ Security Fixes

This maintenance release fixes a high number of CVEs. You can learn more about this in the "Spring and Security In The Times Of AI" blog post. Here is the full list of 16 CVEs:

  • CVE-2026-41838 "Spring Framework Predictable Session ID in WebSocket Module"
  • CVE-2026-41839 "Spring Framework Escalation via Session Fixation in WebFlux"
  • CVE-2026-41840 "Spring Framework Denial of Service via Multipart Requests in WebFlux"
  • CVE-2026-41841 "Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux"
  • CVE-2026-41842 "Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux"
  • CVE-2026-41843 "Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux"
  • CVE-2026-41844 "Spring Framework Open Redirect in Spring MVC and WebFlux"
  • CVE-2026-41845 "Spring Framework Cross-site Scripting via JavaScriptUtils"
  • CVE-2026-41846 "Spring Framework Cross-site Scripting via JSP Form Tags"
  • CVE-2026-41848 "Spring Framework Denial of Service via AntPathMatcher"
  • CVE-2026-41850 "Spring Framework Algorithmic Denial of Service via SpEL Expressions"
  • CVE-2026-41851 "Spring Framework Denial of Service via Unbounded Cache in SpEL"
  • CVE-2026-41852 "Spring Framework Arbitrary Method Invocation in SpEL Expressions"
  • CVE-2026-41853 "Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux"
  • CVE-2026-41854 "Spring Framework Server-Side Request Forgery via UriComponentsBuilder"
  • CVE-2026-41855 "Spring Framework Unsafe Deserialization via Jackson JMS Converters"

⭐ New Features

  • Avoid too many character access attempts in AntPathMatcher #36886
  • Track operations during SpEL expression evaluation #36887
  • Ensure getters have non-void return types in SpEL #36888
  • Expose ClassLoader from DefaultDeserializer #36839
  • Refine default view name resolution #36794
  • Refine Jackson JMS converters #36792
  • Improve ABNF rule checks in RfcUriParser #36788
  • Detect custom deserialized NullValue instances in AbstractValueAdaptingCache #36728
  • Warn against unsafe static resource locations in MVC and WebFlux #36693
  • Consistent compatibility with Woodstox as an alternative to Xerces #36683

🐞 Bug Fixes

  • Data is lost for joined DataBuffer in DataBufferUtils #36874
  • CronExpression skips days on midnight DST gap #36873
  • Concurrency issue against shared cookie field in CookieLocaleResolver#setLocaleContext #36870
  • Server Sent Event does not support multi-line comments #36867
  • Regression in 6.2.0+: ConfigurationClassParser incorrectly removes component-scanned bean when the same class is also registered under a different name via XML #36849
  • Bean Background Bootstrap and Lazy Init #36847
  • Fix JSP tag processing #36798
  • Fix script processing capabilities #36796
  • Parsing failure for MIME type with quoted parameter values #36734
  • Circular dependency between supplier-created beans is silently ignored on startup #36732
  • Non-deterministic "Body token not expected" in org.springframework.http.codec.multipart.PartGenerator #36722
  • Regression on value class parameter handling #36720
  • Cache collisions in CachingResourceResolver #36718

... (truncated)

Commits
  • 6214eae Release v6.2.19
  • 76a36df Track operations during SpEL expression evaluation
  • 3d47da9 Ensure getters have non-void return types in SpEL
  • 519d733 Improve additional error messages in SpEL
  • ec89834 Further improve pattern caching in SpEL
  • b294371 Avoid too many character access attempts in AntPathMatcher
  • 1829b42 Ensure consistent JSP tag attribute processing
  • 86d9979 Refine JavaScriptUtils#javaScriptEscape
  • 3aaec98 Prevent special prefixes in default view name resolution
  • ee4e790 Add trusted packages to MappingJackson2MessageConverter
  • Additional commits viewable in compare view

Updates org.springframework:spring-expression from 5.3.39 to 6.2.19

Release notes

Sourced from org.springframework:spring-expression's releases.

v6.2.19

⚠️ Security Fixes

This maintenance release fixes a high number of CVEs. You can learn more about this in the "Spring and Security In The Times Of AI" blog post. Here is the full list of 16 CVEs:

  • CVE-2026-41838 "Spring Framework Predictable Session ID in WebSocket Module"
  • CVE-2026-41839 "Spring Framework Escalation via Session Fixation in WebFlux"
  • CVE-2026-41840 "Spring Framework Denial of Service via Multipart Requests in WebFlux"
  • CVE-2026-41841 "Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux"
  • CVE-2026-41842 "Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux"
  • CVE-2026-41843 "Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux"
  • CVE-2026-41844 "Spring Framework Open Redirect in Spring MVC and WebFlux"
  • CVE-2026-41845 "Spring Framework Cross-site Scripting via JavaScriptUtils"
  • CVE-2026-41846 "Spring Framework Cross-site Scripting via JSP Form Tags"
  • CVE-2026-41848 "Spring Framework Denial of Service via AntPathMatcher"
  • CVE-2026-41850 "Spring Framework Algorithmic Denial of Service via SpEL Expressions"
  • CVE-2026-41851 "Spring Framework Denial of Service via Unbounded Cache in SpEL"
  • CVE-2026-41852 "Spring Framework Arbitrary Method Invocation in SpEL Expressions"
  • CVE-2026-41853 "Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux"
  • CVE-2026-41854 "Spring Framework Server-Side Request Forgery via UriComponentsBuilder"
  • CVE-2026-41855 "Spring Framework Unsafe Deserialization via Jackson JMS Converters"

⭐ New Features

  • Avoid too many character access attempts in AntPathMatcher #36886
  • Track operations during SpEL expression evaluation #36887
  • Ensure getters have non-void return types in SpEL #36888
  • Expose ClassLoader from DefaultDeserializer #36839
  • Refine default view name resolution #36794
  • Refine Jackson JMS converters #36792
  • Improve ABNF rule checks in RfcUriParser #36788
  • Detect custom deserialized NullValue instances in AbstractValueAdaptingCache #36728
  • Warn against unsafe static resource locations in MVC and WebFlux #36693
  • Consistent compatibility with Woodstox as an alternative to Xerces #36683

🐞 Bug Fixes

  • Data is lost for joined DataBuffer in DataBufferUtils #36874
  • CronExpression skips days on midnight DST gap #36873
  • Concurrency issue against shared cookie field in CookieLocaleResolver#setLocaleContext #36870
  • Server Sent Event does not support multi-line comments #36867
  • Regression in 6.2.0+: ConfigurationClassParser incorrectly removes component-scanned bean when the same class is also registered under a different name via XML #36849
  • Bean Background Bootstrap and Lazy Init #36847
  • Fix JSP tag processing #36798
  • Fix script processing capabilities #36796
  • Parsing failure for MIME type with quoted parameter values #36734
  • Circular dependency between supplier-created beans is silently ignored on startup #36732
  • Non-deterministic "Body token not expected" in org.springframework.http.codec.multipart.PartGenerator #36722
  • Regression on value class parameter handling #36720
  • Cache collisions in CachingResourceResolver #36718

... (truncated)

Commits
  • 6214eae Release v6.2.19
  • 76a36df Track operations during SpEL expression evaluation
  • 3d47da9 Ensure getters have non-void return types in SpEL
  • 519d733 Improve additional error messages in SpEL
  • ec89834 Further improve pattern caching in SpEL
  • b294371 Avoid too many character access attempts in AntPathMatcher
  • 1829b42 Ensure consistent JSP tag attribute processing
  • 86d9979 Refine JavaScriptUtils#javaScriptEscape
  • 3aaec98 Prevent special prefixes in default view name resolution
  • ee4e790 Add trusted packages to MappingJackson2MessageConverter
  • Additional commits viewable in compare view

Updates org.springframework:spring-webmvc from 5.3.39 to 6.2.19

Release notes

Sourced from org.springframework:spring-webmvc's releases.

v6.2.19

⚠️ Security Fixes

This maintenance release fixes a high number of CVEs. You can learn more about this in the "Spring and Security In The Times Of AI" blog post. Here is the full list of 16 CVEs:

  • CVE-2026-41838 "Spring Framework Predictable Session ID in WebSocket Module"
  • CVE-2026-41839 "Spring Framework Escalation via Session Fixation in WebFlux"
  • CVE-2026-41840 "Spring Framework Denial of Service via Multipart Requests in WebFlux"
  • CVE-2026-41841 "Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux"
  • CVE-2026-41842 "Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux"
  • CVE-2026-41843 "Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux"
  • CVE-2026-41844 "Spring Framework Open Redirect in Spring MVC and WebFlux"
  • CVE-2026-41845 "Spring Framework Cross-site Scripting via JavaScriptUtils"
  • CVE-2026-41846 "Spring Framework Cross-site Scripting via JSP Form Tags"
  • CVE-2026-41848 "Spring Framework Denial of Service via AntPathMatcher"
  • CVE-2026-41850 "Spring Framework Algorithmic Denial of Service via SpEL Expressions"
  • CVE-2026-41851 "Spring Framework Denial of Service via Unbounded Cache in SpEL"
  • CVE-2026-41852 "Spring Framework Arbitrary Method Invocation in SpEL Expressions"
  • CVE-2026-41853 "Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux"
  • CVE-2026-41854 "Spring Framework Server-Side Request Forgery via UriComponentsBuilder"
  • CVE-2026-41855 "Spring Framework Unsafe Deserialization via Jackson JMS Converters"

⭐ New Features

  • Avoid too many character access attempts in AntPathMatcher #36886
  • Track operations during SpEL expression evaluation #36887
  • Ensure getters have non-void return types in SpEL #36888
  • Expose ClassLoader from DefaultDeserializer #36839
  • Refine default view name resolution #36794
  • Refine Jackson JMS converters #36792
  • Improve ABNF rule checks in RfcUriParser #36788
  • Detect custom deserialized NullValue instances in AbstractValueAdaptingCache #36728
  • Warn against unsafe static resource locations in MVC and WebFlux #36693
  • Consistent compatibility with Woodstox as an alternative to Xerces #36683

🐞 Bug Fixes

  • Data is lost for joined DataBuffer in DataBufferUtils #36874
  • CronExpression skips days on midnight DST gap #36873
  • Concurrency issue against shared cookie field in CookieLocaleResolver#setLocaleContext #36870
  • Server Sent Event does not support multi-line comments #36867
  • Regression in 6.2.0+: ConfigurationClassParser incorrectly removes component-scanned bean when the same class is also registered under a different name via XML #36849
  • Bean Background Bootstrap and Lazy Init #36847
  • Fix JSP tag processing #36798
  • Fix script processing capabilities #36796
  • Parsing failure for MIME type with quoted parameter values #36734
  • Circular dependency between supplier-created beans is silently ignored on startup #36732
  • Non-deterministic "Body token not expected" in org.springframework.http.codec.multipart.PartGenerator #36722
  • Regression on value class parameter handling #36720
  • Cache collisions in CachingResourceResolver #36718

... (truncated)

Commits
  • 6214eae Release v6.2.19
  • 76a36df Track operations during SpEL expression evaluation
  • 3d47da9 Ensure getters have non-void return types in SpEL
  • 519d733 Improve additional error messages in SpEL
  • ec89834 Further improve pattern caching in SpEL
  • b294371 Avoid too many character access attempts in AntPathMatcher
  • 1829b42 Ensure consistent JSP tag attribute processing
  • 86d9979 Refine JavaScriptUtils#javaScriptEscape
  • 3aaec98 Prevent special prefixes in default view name resolution
  • ee4e790 Add trusted packages to MappingJackson2MessageConverter
  • Additional commits viewable in compare view

Updates org.hibernate:hibernate-core from 5.6.15.Final to 6.0.0.Final

Changelog

Sourced from org.hibernate:hibernate-core's changelog.

Changes in 6.0.0.Final (March 31, 2022)

https://hibernate.atlassian.net/projects/HHH/versions/32049

** Bug * [HHH-15131] - JPA Compliance issue with Envers * [HHH-15118] - PooledOptimizer generates duplicate ids when several JVMs initialize optimizer and sequence value is the initial value * [HHH-15117] - ConstraintViolationException is thrown using same @​SecondaryTable on two entities * [HHH-15115] - Deleting an entity with Joined inheritance and default schema set is throwing and error * [HHH-15113] - Exception setting ParameterExpressions on Update Queries * [HHH-15111] - MappingException is thrown for @​JoinColumn with referencedColumnName on a @​SecondaryTable * [HHH-15105] - Getting the CacheRegionStatistics before executing a query leads to a NPE later on * [HHH-15098] - suboptimal/incorrect behavior when updating managed oneToMany collection on entity with naturalId * [HHH-15091] - EntityManager.persist does not verify the existence of the one side of a many-to-one relationship, introduced 5.4.17 * [HHH-14487] - PropertyAccessStrategyMapImpl imports wrong class

** Improvement * [HHH-15144] - Add IncubationLogger * [HHH-15143] - Add an "implicit naming strategy" for database structures (sequence and tables) for identifier generators * [HHH-15138] - Remove support for Eviction Listeners in BoundedConcurrentHashMap * [HHH-15078] - Support for Tuple and SelectionQuery * [HHH-15055] - Document SelectionQuery and MutationQuery * [HHH-14672] - Allow specifying CHAR-based storage for UUID mappings * [HHH-14510] - Remove deprecated id-gen related contracts and classes * [HHH-13135] - Add support for KEY/NO KEY locking in PostgreSQL

** New Feature * [HHH-14739] - Implement ILike support in 6

** Task * [HHH-15139] - Improvements for QueryInterpretationCache * [HHH-15133] - Use specified result-type to better infer "shape" of query results with implicit selections * [HHH-15132] - Improvements for NavigablePath * [HHH-15119] - Upgrade to ByteBuddy 1.12.8 * [HHH-15107] - Update build to make tests pass against JDK19 * [HHH-14884] - More improvements to Domain Model chapter of the User Guide * [HHH-14872] - Re-enable hibernate-gradle-plugin

Changes in 6.0.0.CR2 (March 09, 2022)

https://hibernate.atlassian.net/projects/HHH/versions/32033

** Bug * [HHH-15084] - JpaCompliantLifecycleStrategy uses deprecated BeanManager method that's gone in CDI 4.0 * [HHH-15082] - JDBC Statement leaks after exceptions other than SQLException during insert/update/... * [HHH-15073] - Criteria query built from JPA metamodel throws PersistenceException: Specified result type [long] did not match Query selection type [java.lang.Long] * [HHH-15071] - "this.anticipatedType" is null

... (truncated)

Commits
  • 2560cc6 Post-steps for release : 6.0.0.Final
  • 53889db Pre-steps for release : 6.0.0.Final
  • 6180e94 - Drop building of bundles for SourceForge
  • fa7cb3f Fix issues with respecting padding and limit for in list rendering
  • ad828a0 release announcement, doc artifacts
  • 8d20c03 Address test failures in Gradle plugin module
  • 3358157 HHH-15078 - Support for Tuple and SelectionQuery
  • aa0c57a HHH-15078 - Support for Tuple and SelectionQuery
  • 88938ac Address test failures in Gradle plugin module
  • 5b0c49e HHH-15133 - Use specified result-type to better infer "shape" of query result...
  • Additional commits viewable in compare view

Updates org.apache.jackrabbit:jackrabbit-jcr-commons from 2.20.17 to 2.22.2

Changelog

Sourced from org.apache.jackrabbit:jackrabbit-jcr-commons's changelog.

Changes in Jackrabbit 2.22.2

Bug

[JCR-5121] - Java 23: getSubject is supported only if a security manager is allowed

Improvement

[JCR-5146] - Add missing mixin values (defined in JCR 2.0 spec) to JcrConstants
[JCR-5150] - Add missing constant for jcr:title
[JCR-5152] - Add method isValidJcrLocalName(String) to o.a.j.util.Text
[JCR-5161] - NamespaceHelper - get NamespaceRegistry only once

Task

[JCR-5048] - Jackrabbit should build and test with Java 24
[JCR-5089] - avoid use of deprecated junit.framework.Assert
[JCR-5119] - webapp: bump htmlunit to 4.7.0
[JCR-5120] - webapp: update tomcat dependency to 9.0.97
[JCR-5130] - Update oak-jackrabbit-api.version.implemented in trunk to Oak 1.76.0
[JCR-5132] - webapp: update tomcat dependency to 9.0.104
[JCR-5134] - Update oak-jackrabbit-api.version.used to Oak 1.22.22
[JCR-5135] - Make JNDI support opt-in
[JCR-5143] - Update Mockito dependency to 5.17.0
[JCR-5144] - Update to jacoco version 0.8.13
[JCR-5145] - Upgrade Commons VFS to 2.10.0
[JCR-5147] - remove jackrabbit 1.x compatibility and performance tests
[JCR-5158] - Update oak-jackrabbit-api.version.implemented in trunk to Oak 1.82.0
[JCR-5159] - Create coverage for NamespaceHelper
[JCR-5177] - jackrabbit-jcr2spi: update to commons-collections4 4.5.0

For more detailed information about all the changes in this and other Jackrabbit releases, please see the Jackrabbit issue tracker at

https://issues.apache.org/jira/browse/JCR

Release Contents

This release consists of a single source archive packaged as a zip file. The archive can be unpacked with the jar tool from your JDK installation. See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a PGP signature that you can use to verify the authenticity of your download. The public key used for the PGP signature can be found at https://www.apache.org/dist/jackrabbit/KEYS.

... (truncated)

Commits
  • 2b5babf [maven-release-plugin] prepare release jackrabbit-2.22.2
  • 0d7c2e5 JCR-5180: Release Jackrabbit 2.22.2 - Candidate Release Notes (#277)
  • b487b6f JCR-5158: Update oak-jackrabbit-api.version.implemented in trunk to Oak 1.82....
  • 52d8411 JCR-5161: NamespaceHelper - get NamespaceRegistry only once (#259)
  • 6b6171e JCR-5150 Add constant for jcr:title
  • 02b09fd JCR-5159: Create coverage for NamespaceHelper (#256)
  • 0b81850 JCR-5152 Add method to check if a (local) name is valid according to JCR
  • 2e64ea5 JCR-5137: Update JCR commons to implement current jackrabbit-api (#231)
  • 9ba0518 JCR-5089: avoid use of deprecated junit.framework.Assert (#208)
  • 019f6f9 JCR-5177: jackrabbit-jcr2spi: update to commons-collections4 4.5.0 (#270)
  • Additional commits viewable in compare view

Updates org.apache.tika:tika-core from 2.9.4 to 3.2.2

Changelog

Sourced from org.apache.tika:tika-core's changelog.

Release 4.0.0 - ???

NEW FEATURES

  • Content-based detection of ASN.1/DER crypto containers at parse time. An opt-in Pkcs7Detector surfaces the subtype at detect() time, but must be enabled via configuration (TIKA-1997).

OTHER CHANGES

  • MagicDetector now compiles its regular expression once, in the constructor, instead of recompiling it on every match (TIKA-4796).

Release 4.0.0-beta-1 - 6/29/2026

BREAKING CHANGES

  • The default content handler is now Markdown. tika-app, tika-server (the /tika and /rmeta endpoints), and the async/pipes CLI now emit Markdown content by default instead of XHTML/XML (plain text for the async CLI). Request the previous format explicitly, e.g. tika-app -x/--xml, the server /tika/xml and /rmeta/xml paths (or the X-Tika-Handler header), and the async CLI --handler x (TIKA-4663).

NEW FEATURES

  • tika-app and tika-server can load extra jars (additional EncodingDetectors, Parsers, etc.) from the directory named by the -Dtika.extras.dir system property, without repackaging the application. Off by default; the directory is a trusted code location whose contents run with full process privileges. The extra jars are also forwarded onto forked pipes/server worker processes, so they are available where parsing actually happens (TIKA-4755).

  • More granular, default-deny capability flags for tika-server and tika-grpc. tika-server's enableUnsecureFeatures is split into allowPipes (gates the /pipes and /async endpoints) and allowPerRequestConfig (gates the /config endpoints and the multipart config part); the /status endpoint is no longer gated and is enabled simply by listing it under endpoints. tika-grpc gains the same allowPerRequestConfig flag plus allowComponentModifications (gates runtime Save/Delete of fetchers and pipes iterators). All flags default to false, so an out-of-the-box tika-grpc server no longer accepts per-request configuration or runtime store mutations (TIKA-4764).

  • Unified XMP extraction across containers; adds HEIF/HEIC and WebP XMP, including Samsung/Google Motion Photo (TIKA-4775).

OTHER CHANGES

  • Release artifacts are now channel-specific. Maven Central gets slim

... (truncated)

Commits
  • c5c9d00 [maven-release-plugin] prepare release 3.2.2-rc1
  • 5d87ef3 update CHANGES.txt for 3.2.2 rc1
  • a608cc2 further improvements
  • 948c753 TIKA-4455: update microsoft-graph, aws, nimbus
  • 0f78344 TIKA-4455: update microsoft-graph
  • 94acef2 Improve configuration of xmlinputfactory (#2294)
  • 0c89f4b Simplify path naming
  • 0b889d1 TIKA-4455: update commons-cli
  • d20be6c TIKA-4455: replace deprecated
  • 8b580d8 TIKA-4455: remove json-smart exclusion, no longer needed
  • Additional commits viewable in compare view

Updates org.apache.activemq:activemq-broker from 5.16.8 to 5.19.7

Release notes

Sourced from org.apache.activemq:activemq-broker's releases.

Apache ActiveMQ 5.19.7

What's Changed

Full Changelog: apache/activemq@activemq-5.19.6...activemq-5.19.7

Apache ActiveMQ 5.19.6

What's Changed

Full Changelog: apache/activemq@activemq-5.19.5...activemq-5.19.6

Apache ActiveMQ 5.19.5

What's Changed

Full Changelog: apache/activemq@activemq-5.19.4...activemq-5.19.5

... (truncated)

Commits
  • fa56d21 [maven-release-plugin] prepare release activemq-5.19.7
  • 038cb1e Ensure connection info is processed before durable sync (#2049)
  • c3272de Backport network flaky test improvements (#2046)
  • 66efdf1 [5.19.x] Harden web console and Jolokia access by default (#2025) (#2038)
  • 8cd761a Harden default broker and web console configuration (5.19.x backport) (#2036)
  • 647d318 Bump dependencies to address known CVEs (#2031)
  • 4e49fbd Remove "java.lang" package as a default allowed serializable package (#2026) ...
  • 98d531c #2005 5.19.x - Fix authorization check on removeDestination (#2008)
  • d82f61f Disable the message servlet by default (#2000) (#2015)
  • c034ea8 Handle validation for Composite URIs without parens (#2004) (#2013)
  • Additional commits viewable in compare view

Updates org.apache.activemq:activemq-client from 5.16.8 to 5.19.7

Release notes

Sourced from org.apache.activemq:activemq-client's releases.

Apache ActiveMQ 5.19.7

What's Changed

Full Changelog: apache/activemq@activemq-5.19.6...activemq-5.19.7

Apache ActiveMQ 5.19.6

What's Changed

@dependabot
build(deps): bump the maven group across 3 directories with 20 updates
6b343d2 
Bumps the maven group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [org.springframework:spring-core](https://github.com/spring-projects/spring-framework) | `5.3.39` | `6.2.19` |
| [org.hibernate:hibernate-core](https://github.com/hibernate/hibernate-orm) | `5.6.15.Final` | `6.0.0.Final` |
| [org.apache.jackrabbit:jackrabbit-jcr-commons](https://github.com/apache/jackrabbit) | `2.20.17` | `2.22.2` |
| [org.apache.tika:tika-core](https://github.com/apache/tika) | `2.9.4` | `3.2.2` |
| [org.apache.activemq:activemq-broker](https://github.com/apache/activemq) | `5.16.8` | `5.19.7` |
| org.apache.logging.log4j:log4j-core | `2.25.3` | `2.25.4` |
| [com.fasterxml.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core) | `2.21.1` | `2.21.4` |
| [org.jsoup:jsoup](https://github.com/jhy/jsoup) | `1.22.1` | `1.23.1` |
| org.apache.cxf:cxf-core | `3.5.11` | `4.1.7` |
| [org.bouncycastle:bcpg-jdk18on](https://github.com/bcgit/bc-java) | `1.83` | `1.84` |
| [org.springframework.security:spring-security-core](https://github.com/spring-projects/spring-security) | `5.8.16` | `6.0.0` |
| org.apache.tomcat:tomcat-catalina | `9.0.117` | `9.0.118` |

Bumps the maven group with 10 updates in the /projects/sitemanage directory:

| Package | From | To |
| --- | --- | --- |
| [org.springframework:spring-core](https://github.com/spring-projects/spring-framework) | `5.3.39` | `6.2.19` |
| [org.hibernate:hibernate-core](https://github.com/hibernate/hibernate-orm) | `5.6.15.Final` | `6.0.0.Final` |
| [org.apache.jackrabbit:jackrabbit-jcr-commons](https://github.com/apache/jackrabbit) | `2.20.17` | `2.22.2` |
| [org.apache.tika:tika-core](https://github.com/apache/tika) | `2.9.4` | `3.2.2` |
| [org.apache.activemq:activemq-broker](https://github.com/apache/activemq) | `5.16.8` | `5.19.7` |
| org.apache.logging.log4j:log4j-core | `2.25.3` | `2.25.4` |
| [com.fasterxml.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core) | `2.21.1` | `2.21.4` |
| [org.jsoup:jsoup](https://github.com/jhy/jsoup) | `1.22.1` | `1.23.1` |
| org.apache.cxf:cxf-core | `3.5.11` | `4.1.7` |
| [org.bouncycastle:bcpg-jdk18on](https://github.com/bcgit/bc-java) | `1.83` | `1.84` |

Bumps the maven group with 10 updates in the /system directory:

| Package | From | To |
| --- | --- | --- |
| [org.springframework:spring-core](https://github.com/spring-projects/spring-framework) | `5.3.39` | `6.2.19` |
| [org.hibernate:hibernate-core](https://github.com/hibernate/hibernate-orm) | `5.6.15.Final` | `6.0.0.Final` |
| [org.apache.jackrabbit:jackrabbit-jcr-commons](https://github.com/apache/jackrabbit) | `2.20.17` | `2.22.2` |
| [org.apache.tika:tika-core](https://github.com/apache/tika) | `2.9.4` | `3.2.2` |
| [org.apache.activemq:activemq-broker](https://github.com/apache/activemq) | `5.16.8` | `5.19.7` |
| org.apache.logging.log4j:log4j-core | `2.25.3` | `2.25.4` |
| [com.fasterxml.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core) | `2.21.1` | `2.21.4` |
| [org.jsoup:jsoup](https://github.com/jhy/jsoup) | `1.22.1` | `1.23.1` |
| org.apache.cxf:cxf-core | `3.5.11` | `4.1.7` |
| [org.bouncycastle:bcpg-jdk18on](https://github.com/bcgit/bc-java) | `1.83` | `1.84` |



Updates `org.springframework:spring-core` from 5.3.39 to 6.2.19
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v5.3.39...v6.2.19)

Updates `org.springframework:spring-expression` from 5.3.39 to 6.2.19
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v5.3.39...v6.2.19)

Updates `org.springframework:spring-webmvc` from 5.3.39 to 6.2.19
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v5.3.39...v6.2.19)

Updates `org.hibernate:hibernate-core` from 5.6.15.Final to 6.0.0.Final
- [Release notes](https://github.com/hibernate/hibernate-orm/releases)
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/6.0.0/changelog.txt)
- [Commits](hibernate/hibernate-orm@5.6.15...6.0.0)

Updates `org.apache.jackrabbit:jackrabbit-jcr-commons` from 2.20.17 to 2.22.2
- [Changelog](https://github.com/apache/jackrabbit/blob/jackrabbit-2.22.2/RELEASE-NOTES.txt)
- [Commits](apache/jackrabbit@jackrabbit-2.20.17...jackrabbit-2.22.2)

Updates `org.apache.tika:tika-core` from 2.9.4 to 3.2.2
- [Changelog](https://github.com/apache/tika/blob/main/CHANGES.txt)
- [Commits](apache/tika@2.9.4...3.2.2)

Updates `org.apache.activemq:activemq-broker` from 5.16.8 to 5.19.7
- [Release notes](https://github.com/apache/activemq/releases)
- [Commits](apache/activemq@activemq-5.16.8...activemq-5.19.7)

Updates `org.apache.activemq:activemq-client` from 5.16.8 to 5.19.7
- [Release notes](https://github.com/apache/activemq/releases)
- [Commits](apache/activemq@activemq-5.16.8...activemq-5.19.7)

Updates `org.apache.logging.log4j:log4j-core` from 2.25.3 to 2.25.4

Updates `org.apache.logging.log4j:log4j-1.2-api` from 2.25.3 to 2.25.4

Updates `com.fasterxml.jackson.core:jackson-core` from 2.21.1 to 2.21.4
- [Commits](FasterXML/jackson-core@jackson-core-2.21.1...jackson-core-2.21.4)

Updates `com.fasterxml.jackson.core:jackson-databind` from 2.21.1 to 2.21.4
- [Commits](https://github.com/FasterXML/jackson/commits)

Updates `org.jsoup:jsoup` from 1.22.1 to 1.23.1
- [Release notes](https://github.com/jhy/jsoup/releases)
- [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES.md)
- [Commits](jhy/jsoup@jsoup-1.22.1...jsoup-1.23.1)

Updates `org.apache.cxf:cxf-core` from 3.5.11 to 4.1.7

Updates `org.bouncycastle:bcpg-jdk18on` from 1.83 to 1.84
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcpkix-jdk18on` from 1.83 to 1.84
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcprov-jdk18on` from 1.83 to 1.84
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.springframework.security:spring-security-core` from 5.8.16 to 6.0.0
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@5.8.16...6.0.0)

Updates `org.springframework.security:spring-security-web` from 5.8.16 to 6.0.0
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@5.8.16...6.0.0)

Updates `org.apache.tomcat:tomcat-catalina` from 9.0.117 to 9.0.118

Updates `org.springframework:spring-core` from 5.3.39 to 6.2.19
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v5.3.39...v6.2.19)

Updates `org.springframework:spring-expression` from 5.3.39 to 6.2.19
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v5.3.39...v6.2.19)

Updates `org.springframework:spring-webmvc` from 5.3.39 to 6.2.19
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v5.3.39...v6.2.19)

Updates `org.hibernate:hibernate-core` from 5.6.15.Final to 6.0.0.Final
- [Release notes](https://github.com/hibernate/hibernate-orm/releases)
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/6.0.0/changelog.txt)
- [Commits](hibernate/hibernate-orm@5.6.15...6.0.0)

Updates `org.apache.jackrabbit:jackrabbit-jcr-commons` from 2.20.17 to 2.22.2
- [Changelog](https://github.com/apache/jackrabbit/blob/jackrabbit-2.22.2/RELEASE-NOTES.txt)
- [Commits](apache/jackrabbit@jackrabbit-2.20.17...jackrabbit-2.22.2)

Updates `org.apache.tika:tika-core` from 2.9.4 to 3.2.2
- [Changelog](https://github.com/apache/tika/blob/main/CHANGES.txt)
- [Commits](apache/tika@2.9.4...3.2.2)

Updates `org.apache.activemq:activemq-broker` from 5.16.8 to 5.19.7
- [Release notes](https://github.com/apache/activemq/releases)
- [Commits](apache/activemq@activemq-5.16.8...activemq-5.19.7)

Updates `org.apache.activemq:activemq-client` from 5.16.8 to 5.19.7
- [Release notes](https://github.com/apache/activemq/releases)
- [Commits](apache/activemq@activemq-5.16.8...activemq-5.19.7)

Updates `org.apache.logging.log4j:log4j-core` from 2.25.3 to 2.25.4

Updates `org.apache.logging.log4j:log4j-1.2-api` from 2.25.3 to 2.25.4

Updates `com.fasterxml.jackson.core:jackson-core` from 2.21.1 to 2.21.4
- [Commits](FasterXML/jackson-core@jackson-core-2.21.1...jackson-core-2.21.4)

Updates `com.fasterxml.jackson.core:jackson-databind` from 2.21.1 to 2.21.4
- [Commits](https://github.com/FasterXML/jackson/commits)

Updates `org.jsoup:jsoup` from 1.22.1 to 1.23.1
- [Release notes](https://github.com/jhy/jsoup/releases)
- [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES.md)
- [Commits](jhy/jsoup@jsoup-1.22.1...jsoup-1.23.1)

Updates `org.apache.cxf:cxf-core` from 3.5.11 to 4.1.7

Updates `org.bouncycastle:bcpg-jdk18on` from 1.83 to 1.84
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcpkix-jdk18on` from 1.83 to 1.84
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcprov-jdk18on` from 1.83 to 1.84
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.springframework:spring-core` from 5.3.39 to 6.2.19
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v5.3.39...v6.2.19)

Updates `org.springframework:spring-expression` from 5.3.39 to 6.2.19
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v5.3.39...v6.2.19)

Updates `org.springframework:spring-webmvc` from 5.3.39 to 6.2.19
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v5.3.39...v6.2.19)

Updates `org.hibernate:hibernate-core` from 5.6.15.Final to 6.0.0.Final
- [Release notes](https://github.com/hibernate/hibernate-orm/releases)
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/6.0.0/changelog.txt)
- [Commits](hibernate/hibernate-orm@5.6.15...6.0.0)

Updates `org.apache.jackrabbit:jackrabbit-jcr-commons` from 2.20.17 to 2.22.2
- [Changelog](https://github.com/apache/jackrabbit/blob/jackrabbit-2.22.2/RELEASE-NOTES.txt)
- [Commits](apache/jackrabbit@jackrabbit-2.20.17...jackrabbit-2.22.2)

Updates `org.apache.tika:tika-core` from 2.9.4 to 3.2.2
- [Changelog](https://github.com/apache/tika/blob/main/CHANGES.txt)
- [Commits](apache/tika@2.9.4...3.2.2)

Updates `org.apache.activemq:activemq-broker` from 5.16.8 to 5.19.7
- [Release notes](https://github.com/apache/activemq/releases)
- [Commits](apache/activemq@activemq-5.16.8...activemq-5.19.7)

Updates `org.apache.activemq:activemq-client` from 5.16.8 to 5.19.7
- [Release notes](https://github.com/apache/activemq/releases)
- [Commits](apache/activemq@activemq-5.16.8...activemq-5.19.7)

Updates `org.apache.logging.log4j:log4j-core` from 2.25.3 to 2.25.4

Updates `org.apache.logging.log4j:log4j-1.2-api` from 2.25.3 to 2.25.4

Updates `com.fasterxml.jackson.core:jackson-core` from 2.21.1 to 2.21.4
- [Commits](FasterXML/jackson-core@jackson-core-2.21.1...jackson-core-2.21.4)

Updates `com.fasterxml.jackson.core:jackson-databind` from 2.21.1 to 2.21.4
- [Commits](https://github.com/FasterXML/jackson/commits)

Updates `org.jsoup:jsoup` from 1.22.1 to 1.23.1
- [Release notes](https://github.com/jhy/jsoup/releases)
- [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES.md)
- [Commits](jhy/jsoup@jsoup-1.22.1...jsoup-1.23.1)

Updates `org.apache.cxf:cxf-core` from 3.5.11 to 4.1.7

Updates `org.bouncycastle:bcpg-jdk18on` from 1.83 to 1.84
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcpkix-jdk18on` from 1.83 to 1.84
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcprov-jdk18on` from 1.83 to 1.84
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

---
updated-dependencies:
- dependency-name: org.springframework:spring-core
  dependency-version: 6.2.19
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework:spring-expression
  dependency-version: 6.2.19
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework:spring-webmvc
  dependency-version: 6.2.19
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.hibernate:hibernate-core
  dependency-version: 6.0.0.Final
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.jackrabbit:jackrabbit-jcr-commons
  dependency-version: 2.22.2
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.tika:tika-core
  dependency-version: 3.2.2
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.activemq:activemq-broker
  dependency-version: 5.19.7
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.activemq:activemq-client
  dependency-version: 5.19.7
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.logging.log4j:log4j-core
  dependency-version: 2.25.4
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.logging.log4j:log4j-1.2-api
  dependency-version: 2.25.4
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: com.fasterxml.jackson.core:jackson-core
  dependency-version: 2.21.4
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.21.4
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.jsoup:jsoup
  dependency-version: 1.23.1
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.cxf:cxf-core
  dependency-version: 4.1.7
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.bouncycastle:bcpg-jdk18on
  dependency-version: '1.84'
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.bouncycastle:bcpkix-jdk18on
  dependency-version: '1.84'
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.bouncycastle:bcprov-jdk18on
  dependency-version: '1.84'
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework.security:spring-security-core
  dependency-version: 6.0.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework.security:spring-security-web
  dependency-version: 6.0.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.tomcat:tomcat-catalina
  dependency-version: 9.0.118
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework:spring-core
  dependency-version: 6.2.19
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework:spring-expression
  dependency-version: 6.2.19
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework:spring-webmvc
  dependency-version: 6.2.19
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.hibernate:hibernate-core
  dependency-version: 6.0.0.Final
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.jackrabbit:jackrabbit-jcr-commons
  dependency-version: 2.22.2
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.tika:tika-core
  dependency-version: 3.2.2
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.activemq:activemq-broker
  dependency-version: 5.19.7
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.activemq:activemq-client
  dependency-version: 5.19.7
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.logging.log4j:log4j-core
  dependency-version: 2.25.4
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.logging.log4j:log4j-1.2-api
  dependency-version: 2.25.4
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: com.fasterxml.jackson.core:jackson-core
  dependency-version: 2.21.4
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.21.4
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.jsoup:jsoup
  dependency-version: 1.23.1
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.cxf:cxf-core
  dependency-version: 4.1.7
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.bouncycastle:bcpg-jdk18on
  dependency-version: '1.84'
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.bouncycastle:bcpkix-jdk18on
  dependency-version: '1.84'
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.bouncycastle:bcprov-jdk18on
  dependency-version: '1.84'
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework:spring-core
  dependency-version: 6.2.19
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework:spring-expression
  dependency-version: 6.2.19
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework:spring-webmvc
  dependency-version: 6.2.19
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.hibernate:hibernate-core
  dependency-version: 6.0.0.Final
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.jackrabbit:jackrabbit-jcr-commons
  dependency-version: 2.22.2
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.tika:tika-core
  dependency-version: 3.2.2
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.activemq:activemq-broker
  dependency-version: 5.19.7
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.activemq:activemq-client
  dependency-version: 5.19.7
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.logging.log4j:log4j-core
  dependency-version: 2.25.4
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.logging.log4j:log4j-1.2-api
  dependency-version: 2.25.4
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: com.fasterxml.jackson.core:jackson-core
  dependency-version: 2.21.4
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.21.4
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.jsoup:jsoup
  dependency-version: 1.23.1
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.cxf:cxf-core
  dependency-version: 4.1.7
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.bouncycastle:bcpg-jdk18on
  dependency-version: '1.84'
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.bouncycastle:bcpkix-jdk18on
  dependency-version: '1.84'
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.bouncycastle:bcprov-jdk18on
  dependency-version: '1.84'
  dependency-type: direct:production
  dependency-group: maven
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Aug 12, 2026
This was referenced Aug 12, 2026
Closed
Merged
@natechadwick-intsof

natechadwick-intsof commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator

Closing: this PR jumps past our Java 8 compatibility caps (e.g. Spring 6, Hibernate 6, CXF 4, ActiveMQ ≥5.17) that .github/dependabot.yml is meant to block.

Tracked in #18; fix in #19 (multi-directory ignore application, invalid version-range cleanup, Java 8–safe groups).

Please do not merge. After #19 lands, re-run Dependabot if needed — only Java 8–compatible updates should open.

@natechadwick-intsof

natechadwick-intsof commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator

Closed as violating Java 8 Dependabot policy (#18 / #19).

@dependabot @github

dependabot Bot commented on behalf of github Aug 12, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/maven/maven-869304db0b branch August 12, 2026 12:55
@natechadwick-intsof natechadwick-intsof mentioned this pull request Aug 26, 2026
Closed
@natechadwick-intsof natechadwick-intsof mentioned this pull request Sep 17, 2026
Merged
natechadwick pushed a commit that referenced this pull request Sep 17, 2026
@natechadwick-intsof
build(deps): refresh web asset deps (lodash 4.18.1, requirejs 2.3.8, …
f0a1b6d 
…jquery-validation 1.22.1, browserstack-runner 0.9.4) (#246)

* build(deps): bump io.netty:netty-* 4.1.136.Final -> 4.1.137.Final (CVE-2026-75595 + CVE-2026-75596)

Dependabot alerts #169 (critical, CVE-2026-75595) and #168 (medium,
CVE-2026-75596) on io.netty:netty-handler are closed by this bump.

CVE-2026-75595 (critical, CVSS 9.1): SNI Routing Bypass via Fragmented
TLS ClientHello. SslClientHelloHandler.decode checks the wrong offset for
the handshake header guard; a fragmented ClientHello whose record header
spans the 5-byte TLS record header + 4-byte handshake boundary silently
falls back to the default SslContext. Per-SNI mTLS gates are bypassed.
Fix in 4.1.137.Final + 4.2.17.Final.

CVE-2026-75596 (medium, CVSS 6.9): Fragmented ClientHello records trigger
quadratic pre-handshake reassembly in default SNI parsing. With 4095
one-byte fragments the handler recopies 8,386,560 bytes from 24,579 bytes
on the wire (341x amplification), exhausting the event-loop CPU before
SslHandler takes over.
Fix in 4.1.137.Final + 4.2.17.Final.

Both CVEs have no Java 1.8 fix line below 4.1.137.Final; 4.1.137.Final
is on the same 4.1.x line we already pin and is compiled for Java 6+
(class major version 50 verified on SslClientHelloHandler.class), so it
is Java 1.8-compatible.

Verification:
  ./mvn-env.sh dependency:tree -pl system
  -> netty-codec, netty-common, netty-handler, netty-resolver, netty-transport,
     netty-transport-classes-epoll, netty-transport-native-epoll,
     netty-transport-native-unix-common all resolved to 4.1.137.Final.
  ./mvn-env.sh test-compile -pl system -am -DskipTests
  -> BUILD SUCCESS.

> Co-Authored by Mavis Mavis-Code using MiniMax-M3 with agent mavis.

* build(deps): refresh web asset dependencies (lodash 4.18.1, requirejs 2.3.8, jquery-validation 1.22.1, browserstack-runner 0.9.4)

Closes Dependabot alerts:
  #21, #17, #20  lodash CVE-2026-4800, CVE-2025-13465, CVE-2026-2950
  #8             requirejs CVE-2024-38999
  #1             jquery-validation CVE-2025-3573
  #3, #2         browserstack-runner CVE-2026-49143, CVE-2026-49144

Changes:
  - cui/package.json + cui/package-lock.json: bump lodash >=4.17.21 -> ^4.18.1 and
    requirejs ^2.3.6 -> ^2.3.8. Regenerated the cui lockfile via 'npm install'.
  - WebUI/war/jslib/profiles/3x/jquery/plugins/jquery-validation/: replaced vendored
    jquery.validate.js + additional-methods.js + localization/ with the 1.22.1
    release (closes CVE-2025-3573 XSS). Old per-language methods_*.js (de, es_CL,
    fi, it, nl, pt) were removed upstream in 1.20+ because the functionality moved
    to additional-methods.js core.
  - WebUI/war/jslib/profiles/3x/package.json: bump jquery-validation 1.19.5 -> 1.22.1
  - cui/components/twitter-bootstrap-3.0.0/package.json: bump browserstack-runner
    ~0.0.12 -> ~0.9.4 (closes CVE-2026-49143 RCE + CVE-2026-49144 file-read).
    The browserstack-runner is only loaded by the vendored upstream Bootstrap
    Gruntfile.js for Travis CI tests on twbs/bootstrap; not used by the cms build.

Verification:
  - npm install in cui/ completes with no peer-dep warnings that break the build.
  - All updated files resolve to the latest patched version.

> Co-Authored by Mavis Mavis-Code using MiniMax-M3 with agent mavis.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@natechadwick-intsof