build(deps): bump the maven-dependencies group across 1 directory with 10 updates by dependabot[bot] · Pull Request #4880 · kubernetes-client/java

dependabot · 2026-08-17T02:03:49Z

Bumps the maven-dependencies group with 10 updates in the / directory:

Package	From	To
software.amazon.awssdk:sts	`2.51.3`	`2.53.0`
software.amazon.awssdk:auth	`2.51.3`	`2.53.0`
software.amazon.awssdk:http-auth-aws	`2.51.3`	`2.53.0`
software.amazon.awssdk:http-auth-spi	`2.51.3`	`2.53.0`
software.amazon.awssdk:http-client-spi	`2.51.3`	`2.53.0`
software.amazon.awssdk:utils	`2.51.3`	`2.53.0`
ch.qos.logback:logback-classic	`1.6.1`	`1.6.2`
ch.qos.logback:logback-core	`1.6.1`	`1.6.2`
org.apache.maven:apache-maven	`3.9.6`	`3.9.16`
org.apache.maven.wrapper:maven-wrapper	`3.2.0`	`3.3.4`

Updates software.amazon.awssdk:sts from 2.51.3 to 2.53.0

Updates software.amazon.awssdk:auth from 2.51.3 to 2.53.0

Updates software.amazon.awssdk:http-auth-aws from 2.51.3 to 2.53.0

Updates software.amazon.awssdk:http-auth-spi from 2.51.3 to 2.53.0

Updates software.amazon.awssdk:http-client-spi from 2.51.3 to 2.53.0

Updates software.amazon.awssdk:utils from 2.51.3 to 2.53.0

Updates software.amazon.awssdk:auth from 2.51.3 to 2.53.0

Updates software.amazon.awssdk:http-auth-aws from 2.51.3 to 2.53.0

Updates software.amazon.awssdk:http-auth-spi from 2.51.3 to 2.53.0

Updates software.amazon.awssdk:http-client-spi from 2.51.3 to 2.53.0

Updates software.amazon.awssdk:utils from 2.51.3 to 2.53.0

Updates ch.qos.logback:logback-classic from 1.6.1 to 1.6.2

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2
Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.
Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:
<property name="logback.skipCallerContradictionAnalysis" value="true"/>
SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits

e3d7833 prepare release 1.6.2
919127d test for skipping contradiction analysis
67dcd40 allow skipping caller contradiction analysis
2619c6d remove unused message string in CallerContradictionWarnAnalyser
22cfade add support for SMTPAppender in caller data contradiction analysis
656fb6d minor javadoc change in SMTPAppenderBase
efb1ce2 cover SocketAppender in caller contradiction analysis
d3a01f8 more tests for caller contradiction analysis
b1a80d6 more complete logic in caller contradiction analysis
0678954 SimpleSocketServer and SLLSimpleSocketServer now accept whitelisted
Additional commits viewable in compare view

Updates ch.qos.logback:logback-core from 1.6.1 to 1.6.2

Release notes

Sourced from ch.qos.logback:logback-core's releases.

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2
Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.
Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:
<property name="logback.skipCallerContradictionAnalysis" value="true"/>
SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits

e3d7833 prepare release 1.6.2
919127d test for skipping contradiction analysis
67dcd40 allow skipping caller contradiction analysis
2619c6d remove unused message string in CallerContradictionWarnAnalyser
22cfade add support for SMTPAppender in caller data contradiction analysis
656fb6d minor javadoc change in SMTPAppenderBase
efb1ce2 cover SocketAppender in caller contradiction analysis
d3a01f8 more tests for caller contradiction analysis
b1a80d6 more complete logic in caller contradiction analysis
0678954 SimpleSocketServer and SLLSimpleSocketServer now accept whitelisted
Additional commits viewable in compare view

Updates ch.qos.logback:logback-core from 1.6.1 to 1.6.2

Release notes

Sourced from ch.qos.logback:logback-core's releases.

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2
Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.
Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:
<property name="logback.skipCallerContradictionAnalysis" value="true"/>
SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits

e3d7833 prepare release 1.6.2
919127d test for skipping contradiction analysis
67dcd40 allow skipping caller contradiction analysis
2619c6d remove unused message string in CallerContradictionWarnAnalyser
22cfade add support for SMTPAppender in caller data contradiction analysis
656fb6d minor javadoc change in SMTPAppenderBase
efb1ce2 cover SocketAppender in caller contradiction analysis
d3a01f8 more tests for caller contradiction analysis
b1a80d6 more complete logic in caller contradiction analysis
0678954 SimpleSocketServer and SLLSimpleSocketServer now accept whitelisted
Additional commits viewable in compare view

Updates org.apache.maven:apache-maven from 3.9.6 to 3.9.16

Updates org.apache.maven.wrapper:maven-wrapper from 3.2.0 to 3.3.4

Release notes

Sourced from org.apache.maven.wrapper:maven-wrapper's releases.

3.3.4

🐛 Bug Fixes

Revert wrapper version removal (#365) @breun

👻 Maintenance

Ensure Path Traversal is fully addressed in MavenWrapperDownloader (#363) @hazendaz

3.3.3

💥 Breaking changes

Remove wrapper lifecycle (#357) @slawekjaranowski

🚀 New features and improvements

Fix Maven wrapper support for snapshot distributions (#335) @gnodet

🐛 Bug Fixes

[MWRAPPER-143] - The wrapperVersion property is not used in only-script mode (#145) @bdemers

fix: Maven wrapper relative distributionUrl does not work (fixes #272) (#107) @danishcake

Fix Windows Junction Link support in mvnw.cmd (#143) @fp024

[MWRAPPER-158] - Remove incorrect license header (#166) @lbruun

[MWRAPPER-161] - Improve script directory detection when using sh mvnw (#329) @ppkarwasz

[MWRAPPER-162] - Removed dead link was getting 404 (#167) @montu376

[MWRAPPER-159] - Fix shellcheck in mvnw (#168) @slawekjaranowski

[MWRAPPER-146] - Bad substitution on Windows if MVNW_REPOURL is set on script-only (#151) @jahk04

[MWRAPPER-147] - mvnw.cmd fails to launch maven if username contains space (#152) @sebthom

[MWRAPPER-150] - Fails to validate checksums on MacOS Sequoia (#155) @jon-signal

[MWRAPPER-111] - Trim whitespace when reading from properties file (#158) @mhalbritter

[MWRAPPER-153] - Fixed only-mvnw.cmd fails when FIPS mode is enabled on Windows hosts (#157) @zbalkan

📝 Documentation updates

Clarify usage of MAVEN_USER_HOME (#359) @slawekjaranowski

site is now /tools/wrapper (#336) @hboutemy

👻 Maintenance

Use invoker version from parent (#356) @slawekjaranowski

Refresh download page (#354) @slawekjaranowski

Update site descriptor to 2.0.0 (#351) @slawekjaranowski

Enable prevent branch protection rules (#348) @slawekjaranowski

Copy edit docs (#344) @elharo

Prefer @Inject (#343) @elharo

Bump shellcheck to 0.10.0 (#333) @slachiewicz

Enable GitHub Issues (#169) @slawekjaranowski

... (truncated)

Commits

524486a [maven-release-plugin] prepare release maven-wrapper-3.3.4
17c1ec9 Revert wrapper version removal (#365)
366207f Ensure Path Traversal is fully addressed in MavenWrapperDownloader
086b1c9 [maven-release-plugin] prepare for next development iteration
e2a0c81 [maven-release-plugin] prepare release maven-wrapper-3.3.3
80952cd Clarify usage of MAVEN_USER_HOME
08e7200 Remove wrapper lifecycle
36886fa Support for snapshot distributions - fix (#352)
d02d845 Use invoker version from parent
af7671b Bump mavenVersion from 3.9.6 to 3.9.11 (#360)
Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
ch.qos.logback:logback-classic	[>= 1.4.a, < 1.5]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…h 10 updates Bumps the maven-dependencies group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | software.amazon.awssdk:sts | `2.51.3` | `2.53.0` | | software.amazon.awssdk:auth | `2.51.3` | `2.53.0` | | software.amazon.awssdk:http-auth-aws | `2.51.3` | `2.53.0` | | software.amazon.awssdk:http-auth-spi | `2.51.3` | `2.53.0` | | software.amazon.awssdk:http-client-spi | `2.51.3` | `2.53.0` | | software.amazon.awssdk:utils | `2.51.3` | `2.53.0` | | [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.6.1` | `1.6.2` | | [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) | `1.6.1` | `1.6.2` | | org.apache.maven:apache-maven | `3.9.6` | `3.9.16` | | [org.apache.maven.wrapper:maven-wrapper](https://github.com/apache/maven-wrapper) | `3.2.0` | `3.3.4` | Updates `software.amazon.awssdk:sts` from 2.51.3 to 2.53.0 Updates `software.amazon.awssdk:auth` from 2.51.3 to 2.53.0 Updates `software.amazon.awssdk:http-auth-aws` from 2.51.3 to 2.53.0 Updates `software.amazon.awssdk:http-auth-spi` from 2.51.3 to 2.53.0 Updates `software.amazon.awssdk:http-client-spi` from 2.51.3 to 2.53.0 Updates `software.amazon.awssdk:utils` from 2.51.3 to 2.53.0 Updates `software.amazon.awssdk:auth` from 2.51.3 to 2.53.0 Updates `software.amazon.awssdk:http-auth-aws` from 2.51.3 to 2.53.0 Updates `software.amazon.awssdk:http-auth-spi` from 2.51.3 to 2.53.0 Updates `software.amazon.awssdk:http-client-spi` from 2.51.3 to 2.53.0 Updates `software.amazon.awssdk:utils` from 2.51.3 to 2.53.0 Updates `ch.qos.logback:logback-classic` from 1.6.1 to 1.6.2 - [Release notes](https://github.com/qos-ch/logback/releases) - [Commits](qos-ch/logback@v_1.6.1...v_1.6.2) Updates `ch.qos.logback:logback-core` from 1.6.1 to 1.6.2 - [Release notes](https://github.com/qos-ch/logback/releases) - [Commits](qos-ch/logback@v_1.6.1...v_1.6.2) Updates `ch.qos.logback:logback-core` from 1.6.1 to 1.6.2 - [Release notes](https://github.com/qos-ch/logback/releases) - [Commits](qos-ch/logback@v_1.6.1...v_1.6.2) Updates `org.apache.maven:apache-maven` from 3.9.6 to 3.9.16 Updates `org.apache.maven.wrapper:maven-wrapper` from 3.2.0 to 3.3.4 - [Release notes](https://github.com/apache/maven-wrapper/releases) - [Commits](apache/maven-wrapper@maven-wrapper-3.2.0...maven-wrapper-3.3.4) --- updated-dependencies: - dependency-name: software.amazon.awssdk:sts dependency-version: 2.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-dependencies - dependency-name: software.amazon.awssdk:auth dependency-version: 2.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-dependencies - dependency-name: software.amazon.awssdk:http-auth-aws dependency-version: 2.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-dependencies - dependency-name: software.amazon.awssdk:http-auth-spi dependency-version: 2.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-dependencies - dependency-name: software.amazon.awssdk:http-client-spi dependency-version: 2.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-dependencies - dependency-name: software.amazon.awssdk:utils dependency-version: 2.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-dependencies - dependency-name: software.amazon.awssdk:auth dependency-version: 2.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-dependencies - dependency-name: software.amazon.awssdk:http-auth-aws dependency-version: 2.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-dependencies - dependency-name: software.amazon.awssdk:http-auth-spi dependency-version: 2.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-dependencies - dependency-name: software.amazon.awssdk:http-client-spi dependency-version: 2.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-dependencies - dependency-name: software.amazon.awssdk:utils dependency-version: 2.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-dependencies - dependency-name: ch.qos.logback:logback-classic dependency-version: 1.6.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: maven-dependencies - dependency-name: ch.qos.logback:logback-core dependency-version: 1.6.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: maven-dependencies - dependency-name: ch.qos.logback:logback-core dependency-version: 1.6.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: maven-dependencies - dependency-name: org.apache.maven:apache-maven dependency-version: 3.9.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven-dependencies - dependency-name: org.apache.maven.wrapper:maven-wrapper dependency-version: 3.3.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

brendandburns · 2026-08-19T16:28:05Z

/lgtm
/approve

kubernetes-prow · 2026-08-19T16:28:14Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: brendandburns, dependabot[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [brendandburns]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 17, 2026

kubernetes-prow Bot requested review from brendandburns and yue9944882 August 17, 2026 02:03

kubernetes-prow Bot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Aug 17, 2026

Sync Bazel dependencies for Dependabot update

7af04b2

kubernetes-prow Bot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Aug 17, 2026

kubernetes-prow Bot assigned brendandburns Aug 19, 2026

kubernetes-prow Bot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 19, 2026

kubernetes-prow Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 19, 2026

kubernetes-prow Bot merged commit 324c0ea into master Aug 19, 2026
14 checks passed

dependabot Bot deleted the dependabot/maven/maven-dependencies-208e27a825 branch August 19, 2026 16:29

Navigation Menu

Uh oh!

build(deps): bump the maven-dependencies group across 1 directory with 10 updates - #4880

build(deps): bump the maven-dependencies group across 1 directory with 10 updates#4880
kubernetes-prow[bot] merged 2 commits into
masterfrom
dependabot/maven/maven-dependencies-208e27a825

dependabot Bot commented on behalf of github Aug 17, 2026 •

edited

Loading

Uh oh!

brendandburns commented Aug 19, 2026

Uh oh!

kubernetes-prow Bot commented Aug 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Logback 1.6.2

2026-08-10 Release of logback version 1.6.2

Logback 1.6.2

2026-08-10 Release of logback version 1.6.2

Logback 1.6.2

2026-08-10 Release of logback version 1.6.2

3.3.4

🐛 Bug Fixes

👻 Maintenance

3.3.3

💥 Breaking changes

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

Uh oh!

brendandburns commented Aug 19, 2026

Uh oh!

kubernetes-prow Bot commented Aug 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Aug 17, 2026 •

edited

Loading