Skip to content

fix(deps): update java dependencies - #1029

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/java
Oct 27, 2025
Merged

fix(deps): update java dependencies#1029
renovate[bot] merged 1 commit into
mainfrom
renovate/java

Conversation

@renovate

@renovate renovate Bot commented Sep 17, 2025 •
edited by github-actions Bot
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
org.apache.commons:commons-lang3 (source) 3.18.0 -> 3.19.0 age confidence
org.apache.maven.plugins:maven-enforcer-plugin (source) 3.6.0 -> 3.6.2 age confidence
org.jacoco:jacoco-maven-plugin (source) 0.8.13 -> 0.8.14 age confidence
org.apache.maven.plugins:maven-surefire-plugin (source) 3.5.3 -> 3.5.4 age confidence
org.apache.maven.plugins:maven-failsafe-plugin (source) 3.5.3 -> 3.5.4 age confidence
software.amazon.awssdk:s3 2.32.13 -> 2.35.10 age confidence
org.springdoc:springdoc-openapi-starter-webmvc-ui (source) 2.8.9 -> 2.8.13 age confidence
org.projectlombok:lombok (source) 1.18.38 -> 1.18.42 age confidence
org.springframework:spring-webmvc 6.2.8 -> 6.2.10 age confidence
org.springframework:spring-web 6.2.8 -> 6.2.12 age confidence
com.nimbusds:nimbus-jose-jwt 10.3.1 -> 10.5 age confidence
org.springframework.boot:spring-boot-starter-oauth2-resource-server (source) 3.5.3 -> 3.5.6 age confidence
org.springframework.boot:spring-boot-starter-oauth2-client (source) 3.5.3 -> 3.5.6 age confidence
org.springframework.boot:spring-boot-starter-parent (source) 3.5.3 -> 3.5.6 age confidence

GitHub Vulnerability Alerts

CVE-2025-41242

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.

An application can be vulnerable when all the following are true:

We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.

Release Notes

jacoco/jacoco (org.jacoco:jacoco-maven-plugin)

v0.8.14: 0.8.14

Compare Source

New Features

  • JaCoCo now officially supports Java 25 (GitHub #​1950).
  • Experimental support for Java 26 class files (GitHub #​1870).
  • Branches added by the Kotlin compiler for default argument number 33 or higher are filtered out during generation of report (GitHub #​1655).
  • Part of bytecode generated by the Kotlin compiler for elvis operator that follows safe call operator is filtered out during generation of report (GitHub #​1814, #​1954).
  • Part of bytecode generated by the Kotlin compiler for more cases of chained safe call operators is filtered out during generation of report (GitHub #​1956).
  • Part of bytecode generated by the Kotlin compiler for invocations of suspendCoroutineUninterceptedOrReturn intrinsic is filtered out during generation of report (GitHub #​1929).
  • Part of bytecode generated by the Kotlin compiler for suspending lambdas with parameters is filtered out during generation of report (GitHub #​1945).
  • Part of bytecode generated by the Kotlin compiler for suspending functions and lambdas with suspension points that return inline value class is filtered out during generation of report (GitHub #​1871).
  • Part of bytecode generated by the Kotlin Compose compiler plugin for pausable composition is filtered out during generation of report (GitHub #​1911).
  • Methods generated by the Kotlin serialization compiler plugin are filtered out (GitHub #​1885, #​1970, #​1971).

Fixed bugs

  • Fixed handling of implicit else clause of when with String subject in Kotlin (GitHub #​1813, #​1940).
  • Fixed handling of implicit default clause of switch by String in Java when compiled by ECJ (GitHub #​1813, #​1940).
    Fixed handling of exceptions in chains of safe call operators in Kotlin (GitHub #​1819).

Non-functional Changes

  • JaCoCo now depends on ASM 9.9 (GitHub #​1965).
springdoc/springdoc-openapi (org.springdoc:springdoc-openapi-starter-webmvc-ui)

v2.8.13

Compare Source

Added
Changed
  • Upgrade swagger-ui to v5.28.1
Fixed
  • #​3076 - With oneOf the response schema contains an extra type: string

v2.8.12

Compare Source

Changed
  • Upgrade swagger-ui to v5.28.0
Fixed
  • #​3073 - Duplicate key class Parameter when documenting two GET methods with same path and PathVariable.
  • #​3071 - @​io.swagger.v3.oas.annotations.parameters.RequestBody does not work well with @​RequestPart
  • #​3066 - Parameter is now required after upgrading to springdoc-openapi 2.8.10

v2.8.11

Added
  • #​3065 - javadoc and overall performance optimization
Changed
  • Upgrade spring-boot to v3.5.5
Fixed
  • #​3064 -ClassNotFoundException: kotlin.reflect.full.KClasses

v2.8.10

Added
  • #​3046 - Feature Request: Support @​jakarta.annotation.Nonnull.
  • #​3042 - Support externalDocs configure on SpecPropertiesCustomizer
  • #​3057 - Refactor webhook discovery and scanning mechanism
Changed
  • Upgrade spring-boot to v3.5.4
  • Upgrade swagger-ui to v5.27.1
  • Upgrade swagger-core to 2.2.36
Fixed
  • #​3050 - @​RequestPart JSON parameters missing Content-Type in generated curl commands, causing 415 errors.
  • #​2978 - Parameter is no longer optional after upgrade to 2.8.8
  • #​3022 - NullPointerException thrown in SchemaUtils.
  • #​3026 - Fix unexpected merging of media types
  • #​3036 - Fixed "desciption"
  • #​3039 - Fix: Property resolution for extensions within @​OpenAPIDefinition Info object
  • #​3051 - Fixes so that a RequestPart with a Map is added to the RequestBody
  • #​3060 - Use adaptFromForwardedHeaders instead of deprecated fromHttpRequest
projectlombok/lombok (org.projectlombok:lombok)

v1.18.42

v1.18.40

spring-projects/spring-framework (org.springframework:spring-webmvc)

v6.2.10

Compare Source

⭐ New Features
  • Optimize NIO path resolution in PathEditor #​35304
  • Make type in ProblemDetail nullable #​35294
  • Refine UriUtils#decode and StringUtils#uriDecode implementation and documentation #​35253
  • Provide configurable useCaches option for URLConnection usage in UrlResource (avoiding jar file leak) #​35218
🐞 Bug Fixes
  • @Scheduled tasks running in SimpleAsyncTaskScheduler are interrupted immediately on context close #​35254
  • ScriptUtils.executeSqlScript() does not support multiple results per statement #​35248
  • Successful Autowiring Dependent on Configuration ordering and Primary Bean flag #​35239
  • Locale parameter in MessageSource#getMessage methods should be nullable #​35230
  • Allow any @Transactional propagation for @TransactionalEventListener with BEFORE_COMMIT phase #​35150
  • Catalog name should be handled with the provided case #​35064
  • Accept support for generated keys column name array on HSQLDB and Derby as well #​34790
  • Handle direct CanncelationException on timeout in JdkClientHttpRequest #​34721
📔 Documentation
  • Add documentation of RequestMapping about SpEL #​35232
  • Document SqlBinaryValue behaviour with PostgreSQL #​34786
🔨 Dependency Upgrades
❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Allan-QLB, @​carsago, @​cw-dimedis, and @​giampa91

v6.2.9

Compare Source

⭐ New Features
  • OncePerRequestFilter cannot be CGLib-proxied #​35198
  • Consistently catch InaccessibleObjectException next to IllegalAccessException #​35190
  • Introduce Date-to-Instant and Instant-to-Date converters #​35175
  • Consistent nullability and exception declarations in AbstractMessagingTemplate hierarchy #​35159
  • Register runtime hints for Instant-to-Timestamp conversion #​35156
  • Improve handling of ResponseEntity<?> in Spring MVC #​35153
  • Support @CacheConfig("myCacheName") declarations for simplified configuration #​35152
  • Declare messageSelector parameters in JmsOperations as @Nullable #​35151
  • Add getter for OverflowStrategy in ConcurrentWebSocketSessionDecorator #​35132
  • Use preset Content-Type for streaming and reactive responses in Spring MVC #​35130
  • Leniently tolerate null @Aspect bean #​35074
  • DataAccessResourceFailureException thrown when transaction times out on PostgreSQL #​35073
  • MethodInvokingFactoryBean fails to invoke publicly exported methods overridden by internal classes when using JPMS #​34028
🐞 Bug Fixes
  • Restore preference for interface (most abstract) method in getPubliclyAccessibleMethodIfPossible #​35189
  • Make targetBeanName field in AbstractBeanFactoryBasedTargetSource protected to avoid exceptions in logging and toString() #​35172
  • Fix inconsistencies in StaticListableBeanFactory #​35119
  • Support StreamingHttpOutputMessage in RestClient #​35102
  • When building DELETE requests, the request body is not used in JdkClientHttpRequest.buildRequest #​35068
  • AOT-generated bean registration file contains "too many constants" when building with many beans #​35044
  • Prevent cache pollution by storing only the factories #​34732
  • WebFlux decodes wildcard content-types as form-data/multipart #​34660
  • AOT-generated CGLib proxies do not contain method overrides #​34642
  • 500 response for ResourceHttpRequestHandler when requested range is not satisfied #​34490
📔 Documentation
  • Document how to register runtime hints for convention-based conversion #​35178
  • Link to @ContextConfiguration Javadoc from reference manual #​35088
🔨 Dependency Upgrades
❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Meijuh, @​RazorNd, @​chenggwang, @​izeye, @​mjd507, @​ngocnhan-tran1996, and @​philwebb

connect2id/nimbus-jose-jwt (com.nimbusds:nimbus-jose-jwt)

v10.5

Compare Source

v10.4.2

Compare Source

v10.4.1

Compare Source

v10.4

Compare Source

spring-projects/spring-boot (org.springframework.boot:spring-boot-starter-oauth2-resource-server)

v3.5.6

🐞 Bug Fixes
  • Quoted -D arguments break system property resolution on Linux with Spring AOT #​47166
  • Groovy Templates fails with an NPE when rendering an auto new line #​47139
  • available() does not behave correctly when reading stored entries from a NestedJarFile #​47057
  • spring-boot-docker-compose doesn't create service connections when image has registry host but not project #​47019
  • Flyway Ignore Migration Patterns setting can't be set to an empty string #​47013
📔 Documentation
  • Default value of server.tomcat.resource.cache-ttl is not documented #​47253
  • Document Java 25 support #​47245
  • Fix links to Flyway reference documentation #​46988
  • Clarify Javadoc of Customizer interfaces about overriding behavior #​46942
🔨 Dependency Upgrades
❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Chanwon-Seo, @​doljae, @​izeye, and @​quaff

v3.5.5

🐞 Bug Fixes
  • Hazelcast health indicator reports the wrong status when Hazelcast has shut down due to an out-of-memory error #​46909
  • Performance critical tracing code has high overhead due to the use of the Stream API #​46844
  • SpringLiquibaseCustomizer is exposed outside its defined visibility scope #​46758
  • Race condition in OutputCapture can result in stale data #​46721
  • Auto-configured WebClient no longer uses context's ReactorResourceFactory #​46673
  • Default value not detected for a field annoted with @Name #​46666
  • Missing metadata when using @Name with a constructor-bound property #​46663
  • Missing property for Spring Authorization Server's PAR endpoint #​46641
  • Property name is incorrect when reporting a mis-configured OAuth 2 Resource Server JWT public key location #​46636
  • Memory not freed on context restart in JpaMetamodel#CACHE with spring.main.lazy-initialization=true #​46634
  • Auto-configured MockMvc ignores @FilterRegistration annotation #​46605
  • Failure to discover default value for a primitive should not lead to document its default value #​46561
📔 Documentation
  • Kotlin samples for configuration metadata are in the wrong package #​46857
  • Observability examples in the reference guide are missing the Kotlin version #​46798
  • Align method descriptions for SslOptions getCiphers and getEnabledProtocols with @returns #​46769
  • Tracing samples in the reference guide are missing the Kotlin version #​46767
  • Improve Virtual Threads section to mention the changes in Java 24 #​46610
  • spring.test.webtestclient.timeout is not documented #​46588
  • spring-boot-test-autoconfigure should use the configuration properties annotation processor like other modules #​46585
  • Adapt deprecation level for management.health.influxdb.enabled #​46580
  • spring.test.mockmvc properties are not documented #​46578
🔨 Dependency Upgrades
❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Kguswo, @​deejay1, @​ganjisriver, @​izeye, @​jetflo, @​ngocnhan-tran1996, @​nicolasgarea, @​nosan, @​prishedko, @​quaff, @​schmidti159, @​scordio, @​shakuzen, @​tommyk-gears, @​zahra7, and @​zakaria-shahen

v3.5.4

🐞 Bug Fixes
  • LambdaSafe.withFilter is not public #​46474
  • Executable JAR application class encounters performance issues when used with Palo Alto Network Cortex XDR agent #​46402
  • Runtime dependencies are missing from aotCompileClasspath and aotTestCompileClasspath when using Kotlin #​46398
  • Additional fields for structured JSON logging incompatible with nested ecs logging in 3.5.x #​46351
  • Change in DefaultErrorAttributes alters the shape of API validation error responses #​46260
  • jdbc.connections.active and jdbc.connections.idle metrics are not available when using Hikari in a native image #​46225
  • developmentOnly and testAndDevelopmentOnly dependencies may prevent implementation dependencies from being included in the uber-jar #​46205
  • Hash calculation for uber archive entries that require unpacking is inefficient #​46203
  • Permissions are applied inconsistently when building uber archives with Gradle #​46194
  • Environment variables using legacy dash format can no longer be bound #​46184
  • EmbeddedWebServerFactoryCustomizerAutoConfiguration fails when undertow-core is on the classpath and undertow-servlet is not #​46180
  • Executable JAR application class encounters performance issues #​46177
  • Executable JAR application class encounters performance issues #​46176
  • Setting spring.reactor.context-propagation has no effect when lazy initialization is enabled #​46174
  • Setting spring.netty.leak-detection has no effect when lazy initialization is enabled #​46170
  • SslInfo does not use its Clock when checking certificate validity #​46011
📔 Documentation
  • Fix description of spring.batch.job.enabled #​46247
  • Fix broken Kotlin examples in reference documentation #​46168
  • Add Logback Access Reactor Netty to community starters #​46060
🔨 Dependency Upgrades
❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Dockerel, @​PiyalAhmed, @​benelog, @​dmitrysulman, @​izeye, @​ngocnhan-tran1996, @​nosan, and @​quaff

Configuration

📅 Schedule: Branch creation - "before 6am every weekday" in timezone America/Vancouver, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Thanks for the PR!

Deployments, as required, will be available below:

Please create PRs in draft mode. Mark as ready to enable:

After merge, new images are deployed in:

@renovate
renovate Bot enabled auto-merge (squash) September 17, 2025 09:37
@renovate
renovate Bot requested review from Abradat and craigyu as code owners September 17, 2025 09:37
@renovate
renovate Bot force-pushed the renovate/java branch 6 times, most recently from bf4f38e to fa1383f Compare September 24, 2025 01:07
@renovate
renovate Bot force-pushed the renovate/java branch 8 times, most recently from 9680310 to 12b916a Compare October 1, 2025 21:53
@renovate
renovate Bot force-pushed the renovate/java branch 7 times, most recently from cd8cadb to 8173353 Compare October 9, 2025 19:11
@renovate
renovate Bot force-pushed the renovate/java branch 4 times, most recently from 205980d to e738bc9 Compare October 14, 2025 22:46
@renovate
renovate Bot force-pushed the renovate/java branch 5 times, most recently from d398927 to 723e93d Compare October 22, 2025 10:35
@renovate
renovate Bot force-pushed the renovate/java branch 3 times, most recently from c558bac to bc15545 Compare October 24, 2025 04:06
@renovate
renovate Bot merged commit 7872c80 into main Oct 27, 2025
73 of 74 checks passed
@renovate
renovate Bot deleted the renovate/java branch October 27, 2025 16:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@paulushcgcj paulushcgcj paulushcgcj approved these changes
@carolinemwood carolinemwood Awaiting requested review from carolinemwood carolinemwood is a code owner
@craigyu craigyu Awaiting requested review from craigyu
@Abradat Abradat Awaiting requested review from Abradat

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@paulushcgcj