Skip to content

fix(deps): update java dependencies - autoclosed - #1004

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/java
Closed

fix(deps): update java dependencies - autoclosed#1004
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/java

Conversation

@renovate

@renovate renovate Bot commented Aug 21, 2025 •
edited by github-actions Bot
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
org.apache.maven.plugins:maven-enforcer-plugin (source) 3.6.0 -> 3.6.1 age confidence
software.amazon.awssdk:s3 2.32.13 -> 2.32.31 age confidence
org.springdoc:springdoc-openapi-starter-webmvc-ui (source) 2.8.9 -> 2.8.11 age confidence
org.springframework:spring-webmvc 6.2.8 -> 6.2.10 age confidence
org.springframework:spring-web 6.2.8 -> 6.2.10 age confidence
com.nimbusds:nimbus-jose-jwt 10.3.1 -> 10.4.2 age confidence
org.springframework.boot:spring-boot-starter-oauth2-resource-server (source) 3.5.3 -> 3.5.5 age confidence
org.springframework.boot:spring-boot-starter-oauth2-client (source) 3.5.3 -> 3.5.5 age confidence
org.springframework.boot:spring-boot-starter-parent (source) 3.5.3 -> 3.5.5 age confidence

GitHub Vulnerability Alerts

CVE-2025-41242

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.

An application can be vulnerable when all the following are true:

We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.

Release Notes

springdoc/springdoc-openapi (org.springdoc:springdoc-openapi-starter-webmvc-ui)

v2.8.11

Compare Source

Added
  • #​3065 - javadoc and overall performance optimization
Changed
  • Upgrade spring-boot to v3.5.5
Fixed
  • #​3064 -ClassNotFoundException: kotlin.reflect.full.KClasses

v2.8.10

Compare Source

Added
  • #​3046 - Feature Request: Support @​jakarta.annotation.Nonnull.
  • #​3042 - Support externalDocs configure on SpecPropertiesCustomizer
  • #​3057 - Refactor webhook discovery and scanning mechanism
Changed
  • Upgrade spring-boot to v3.5.4
  • Upgrade swagger-ui to v5.27.1
  • Upgrade swagger-core to 2.2.36
Fixed
  • #​3050 - @​RequestPart JSON parameters missing Content-Type in generated curl commands, causing 415 errors.
  • #​2978 - Parameter is no longer optional after upgrade to 2.8.8
  • #​3022 - NullPointerException thrown in SchemaUtils.
  • #​3026 - Fix unexpected merging of media types
  • #​3036 - Fixed "desciption"
  • #​3039 - Fix: Property resolution for extensions within @​OpenAPIDefinition Info object
  • #​3051 - Fixes so that a RequestPart with a Map is added to the RequestBody
  • #​3060 - Use adaptFromForwardedHeaders instead of deprecated fromHttpRequest
spring-projects/spring-framework (org.springframework:spring-webmvc)

v6.2.10

Compare Source

⭐ New Features

  • Optimize NIO path resolution in PathEditor #​35304
  • Make type in ProblemDetail nullable #​35294
  • Refine UriUtils#decode and StringUtils#uriDecode implementation and documentation #​35253
  • Provide configurable useCaches option for URLConnection usage in UrlResource (avoiding jar file leak) #​35218

🐞 Bug Fixes

  • @Scheduled tasks running in SimpleAsyncTaskScheduler are interrupted immediately on context close #​35254
  • ScriptUtils.executeSqlScript() does not support multiple results per statement #​35248
  • Successful Autowiring Dependent on Configuration ordering and Primary Bean flag #​35239
  • Locale parameter in MessageSource#getMessage methods should be nullable #​35230
  • Allow any @Transactional propagation for @TransactionalEventListener with BEFORE_COMMIT phase #​35150
  • Catalog name should be handled with the provided case #​35064
  • Accept support for generated keys column name array on HSQLDB and Derby as well #​34790
  • Handle direct CanncelationException on timeout in JdkClientHttpRequest #​34721

📔 Documentation

  • Add documentation of RequestMapping about SpEL #​35232
  • Document SqlBinaryValue behaviour with PostgreSQL #​34786

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Allan-QLB, @​carsago, @​cw-dimedis, and @​giampa91

v6.2.9

Compare Source

⭐ New Features

  • OncePerRequestFilter cannot be CGLib-proxied #​35198
  • Consistently catch InaccessibleObjectException next to IllegalAccessException #​35190
  • Introduce Date-to-Instant and Instant-to-Date converters #​35175
  • Consistent nullability and exception declarations in AbstractMessagingTemplate hierarchy #​35159
  • Register runtime hints for Instant-to-Timestamp conversion #​35156
  • Improve handling of ResponseEntity<?> in Spring MVC #​35153
  • Support @CacheConfig("myCacheName") declarations for simplified configuration #​35152
  • Declare messageSelector parameters in JmsOperations as @Nullable #​35151
  • Add getter for OverflowStrategy in ConcurrentWebSocketSessionDecorator #​35132
  • Use preset Content-Type for streaming and reactive responses in Spring MVC #​35130
  • Leniently tolerate null @Aspect bean #​35074
  • DataAccessResourceFailureException thrown when transaction times out on PostgreSQL #​35073
  • MethodInvokingFactoryBean fails to invoke publicly exported methods overridden by internal classes when using JPMS #​34028

🐞 Bug Fixes

  • Restore preference for interface (most abstract) method in getPubliclyAccessibleMethodIfPossible #​35189
  • Make targetBeanName field in AbstractBeanFactoryBasedTargetSource protected to avoid exceptions in logging and toString() #​35172
  • Fix inconsistencies in StaticListableBeanFactory #​35119
  • Support StreamingHttpOutputMessage in RestClient #​35102
  • When building DELETE requests, the request body is not used in JdkClientHttpRequest.buildRequest #​35068
  • AOT-generated bean registration file contains "too many constants" when building with many beans #​35044
  • Prevent cache pollution by storing only the factories #​34732
  • WebFlux decodes wildcard content-types as form-data/multipart #​34660
  • AOT-generated CGLib proxies do not contain method overrides #​34642
  • 500 response for ResourceHttpRequestHandler when requested range is not satisfied #​34490

📔 Documentation

  • Document how to register runtime hints for convention-based conversion #​35178
  • Link to @ContextConfiguration Javadoc from reference manual #​35088

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Meijuh, @​RazorNd, @​chenggwang, @​izeye, @​mjd507, @​ngocnhan-tran1996, and @​philwebb

connect2id/nimbus-jose-jwt (com.nimbusds:nimbus-jose-jwt)

v10.4.2

Compare Source

v10.4.1

Compare Source

v10.4

Compare Source

spring-projects/spring-boot (org.springframework.boot:spring-boot-starter-oauth2-resource-server)

v3.5.5

Compare Source

🐞 Bug Fixes

  • Hazelcast health indicator reports the wrong status when Hazelcast has shut down due to an out-of-memory error #​46909
  • Performance critical tracing code has high overhead due to the use of the Stream API #​46844
  • SpringLiquibaseCustomizer is exposed outside its defined visibility scope #​46758
  • Race condition in OutputCapture can result in stale data #​46721
  • Auto-configured WebClient no longer uses context's ReactorResourceFactory #​46673
  • Default value not detected for a field annoted with @Name #​46666
  • Missing metadata when using @Name with a constructor-bound property #​46663
  • Missing property for Spring Authorization Server's PAR endpoint #​46641
  • Property name is incorrect when reporting a mis-configured OAuth 2 Resource Server JWT public key location #​46636
  • Memory not freed on context restart in JpaMetamodel#CACHE with spring.main.lazy-initialization=true #​46634
  • Auto-configured MockMvc ignores @FilterRegistration annotation #​46605
  • Failure to discover default value for a primitive should not lead to document its default value #​46561

📔 Documentation

  • Kotlin samples for configuration metadata are in the wrong package #​46857
  • Observability examples in the reference guide are missing the Kotlin version #​46798
  • Align method descriptions for SslOptions getCiphers and getEnabledProtocols with @returns #​46769
  • Tracing samples in the reference guide are missing the Kotlin version #​46767
  • Improve Virtual Threads section to mention the changes in Java 24 #​46610
  • spring.test.webtestclient.timeout is not documented #​46588
  • spring-boot-test-autoconfigure should use the configuration properties annotation processor like other modules #​46585
  • Adapt deprecation level for management.health.influxdb.enabled #​46580
  • spring.test.mockmvc properties are not documented #​46578

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Kguswo, @​deejay1, @​ganjisriver, @​izeye, @​jetflo, @​ngocnhan-tran1996, @​nicolasgarea, @​nosan, @​prishedko, @​quaff, @​schmidti159, @​scordio, @​shakuzen, @​tommyk-gears, @​zahra7, and @​zakaria-shahen

v3.5.4

Compare Source

🐞 Bug Fixes

  • LambdaSafe.withFilter is not public #​46474
  • Executable JAR application class encounters performance issues when used with Palo Alto Network Cortex XDR agent #​46402
  • Runtime dependencies are missing from aotCompileClasspath and aotTestCompileClasspath when using Kotlin #​46398
  • Additional fields for structured JSON logging incompatible with nested ecs logging in 3.5.x #​46351
  • Change in DefaultErrorAttributes alters the shape of API validation error responses #​46260
  • jdbc.connections.active and jdbc.connections.idle metrics are not available when using Hikari in a native image #​46225
  • developmentOnly and testAndDevelopmentOnly dependencies may prevent implementation dependencies from being included in the uber-jar #​46205
  • Hash calculation for uber archive entries that require unpacking is inefficient #​46203
  • Permissions are applied inconsistently when building uber archives with Gradle #​46194
  • Environment variables using legacy dash format can no longer be bound #​46184
  • EmbeddedWebServerFactoryCustomizerAutoConfiguration fails when undertow-core is on the classpath and undertow-servlet is not #​46180
  • Executable JAR application class encounters performance issues #​46177
  • Executable JAR application class encounters performance issues #​46176
  • Setting spring.reactor.context-propagation has no effect when lazy initialization is enabled #​46174
  • Setting spring.netty.leak-detection has no effect when lazy initialization is enabled #​46170
  • SslInfo does not use its Clock when checking certificate validity #​46011

📔 Documentation

  • Fix description of spring.batch.job.enabled #​46247
  • Fix broken Kotlin examples in reference documentation #​46168
  • Add Logback Access Reactor Netty to community starters #​46060

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Dockerel, @​PiyalAhmed, @​benelog, @​dmitrysulman, @​izeye, @​ngocnhan-tran1996, @​nosan, and @​quaff

Configuration

📅 Schedule: Branch creation - "before 6am every weekday" in timezone America/Vancouver, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Thanks for the PR!

Deployments, as required, will be available below:

Please create PRs in draft mode. Mark as ready to enable:

After merge, new images are deployed in:

@renovate
renovate Bot enabled auto-merge (squash) August 21, 2025 07:46
@renovate
renovate Bot requested review from Abradat and craigyu as code owners August 21, 2025 07:46
@renovate
renovate Bot force-pushed the renovate/java branch 8 times, most recently from 8b55da2 to ffc43c4 Compare August 28, 2025 22:47
@renovate renovate Bot changed the title fix(deps): update java dependencies fix(deps): update java dependencies - autoclosed Sep 3, 2025
@renovate renovate Bot closed this Sep 3, 2025
auto-merge was automatically disabled September 3, 2025 20:48

Pull request was closed

@renovate
renovate Bot deleted the renovate/java branch September 3, 2025 20:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@carolinemwood carolinemwood Awaiting requested review from carolinemwood carolinemwood is a code owner
@paulushcgcj paulushcgcj Awaiting requested review from paulushcgcj
@craigyu craigyu Awaiting requested review from craigyu
@Abradat Abradat Awaiting requested review from Abradat

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants