Skip to content

[12.0.x EE9] Bump the dev-dependencies group across 1 directory with 13 updates#15342

Open
dependabot[bot] wants to merge 1 commit into
jetty-12.0.xfrom
dependabot/maven/jetty-ee9/jetty-12.0.x/dev-dependencies-df4c0059ca
Open

[12.0.x EE9] Bump the dev-dependencies group across 1 directory with 13 updates#15342
dependabot[bot] wants to merge 1 commit into
jetty-12.0.xfrom
dependabot/maven/jetty-ee9/jetty-12.0.x/dev-dependencies-df4c0059ca

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 13 updates in the /jetty-ee9 directory:

Package From To
org.glassfish.jersey.containers:jersey-container-servlet 3.0.18 3.1.0
org.glassfish.jersey.inject:jersey-hk2 3.0.18 3.1.0
org.glassfish.jersey.media:jersey-media-json-binding 3.0.18 3.1.0
ch.qos.logback:logback-core 1.5.34 1.5.37
com.github.jnr:jffi 1.3.15 1.4.0
io.grpc:grpc-core 1.82.0 1.82.1
io.grpc:grpc-netty-shaded 1.82.0 1.82.1
org.apache.kerby:kerb-simplekdc 2.1.1 2.1.2
org.eclipse.sisu:org.eclipse.sisu.inject 1.0.0 1.0.1
org.eclipse.sisu:org.eclipse.sisu.plexus 1.0.0 1.0.1
eu.maveniverse.maven.njord:extension3 0.9.8 0.9.9
eu.maveniverse.maven.plugins:njord 0.9.8 0.9.9
org.cyclonedx:cyclonedx-maven-plugin 2.9.1 2.9.2

Updates org.glassfish.jersey.containers:jersey-container-servlet from 3.0.18 to 3.1.0

Updates org.glassfish.jersey.inject:jersey-hk2 from 3.0.18 to 3.1.0

Updates org.glassfish.jersey.media:jersey-media-json-binding from 3.0.18 to 3.1.0

Updates org.glassfish.jersey.inject:jersey-hk2 from 3.0.18 to 3.1.0

Updates org.glassfish.jersey.media:jersey-media-json-binding from 3.0.18 to 3.1.0

Updates ch.qos.logback:logback-core from 1.5.34 to 1.5.37

Release notes

Sourced from ch.qos.logback:logback-core's releases.

Logback 1.5.37

2026-06-26 Release of logback version 1.5.37

• Given the numerous vulnerabilities related to conditional configuration processing based on the evaluation of Java expressions using the Janino library, support for such expressions has been removed. Users are offered the an online migration service or the element introduced in version 1.5.20. See the relevant documentation for more details.

• A bitwise identical binary of this version can be reproduced by building from source code at commit c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag v_1.5.37. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.36

2026-06-25 Release of logback version 1.5.36

• The 'condition' attribute in <if> elements now reject certain references that are associated with ACE attacks. This issue was reported by "yulate" (yulate531@gmail.com.com) and registered as CVE-2026-13006.

• A bitwise identical binary of this version can be reproduced by building from source code at commit 9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag v_1.5.36. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.35

026-06-23 Release of logback version 1.5.35

• The 'condition' attribute in <if> elements now rejects unicode escape sequences (\u and \U). This closes a bypass of the existing prohibition on the new operator in Janino-evaluated conditions. This issue was reported by IcySun (icysun@qq.com) and registered as CVE-2026-13006.

• Added ConfiguratorRank.AUTHENTICATING (rank 100), the highest configurator rank, for certified/authenticating configurators discovered via the ServiceLoader mechanism. ContextInitializer now requires that at most one such configurator exist on the classpath; if more than one is found, initialization aborts with an error.

• ConsoleCharsetPropertyDefiner is no longer shipped. The Java 21 multi-release compilation of logback-core has been disabled, which removes this class from the published artifact. Configurations that referenced ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner will need an alternative approach for console charset detection.

• The logback-examples module is now included in artifacts published to Maven Central.

• JoranConfigurator.makeAnotherInstance() and DefaultJoranConfigurator.performMultiStepConfigurationFileSearch() are now protected, allowing derived configurators to override these methods.

• A bitwise identical binary of this version can be reproduced by building from source code at commit 08bd1598d565d83444f72983935e7da4746783b7 associated with the tag v_1.5.35. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits

Updates com.github.jnr:jffi from 1.3.15 to 1.4.0

Commits
  • 3a2aa58 Bump the major minor for new Maven structure before release
  • 3da7efb Add bare relativePath to always resolve parent
  • 4621e14 Update version for release
  • 2b02140 Merge pull request #195 from headius/jnr-parent
  • ea18e48 Remove snapshot repository inherited from parent
  • f761f8d Update to release version of parent
  • 5c1077e Install prerequisites to compile tests on macOS
  • 2a8b56a Tweaks for toolchain use in jffi
  • 86a1774 Disable fail-fast
  • 45269c3 Update for toolchain and parent defaults
  • Additional commits viewable in compare view

Updates io.grpc:grpc-core from 1.82.0 to 1.82.1

Release notes

Sourced from io.grpc:grpc-core's releases.

v1.82.1

  • protoc-gen-grpc-java: Fix missing osx-x86_64 binary (grpc/grpc-java#12878). This fixes a regression in v1.82.0
Commits
  • 7b5e9ff Bump version to 1.82.1
  • 20768f1 Update README etc to reference 1.82.1
  • 5ab5eba kokoro: Remove extra / in architecture replacement
  • 6726caf buildscripts: add regional td config for psm-interop (v1.82.x backport) (#12864)
  • 022256f Bump version to 1.82.1-SNAPSHOT
  • See full diff in compare view

Updates io.grpc:grpc-netty-shaded from 1.82.0 to 1.82.1

Release notes

Sourced from io.grpc:grpc-netty-shaded's releases.

v1.82.1

  • protoc-gen-grpc-java: Fix missing osx-x86_64 binary (grpc/grpc-java#12878). This fixes a regression in v1.82.0
Commits
  • 7b5e9ff Bump version to 1.82.1
  • 20768f1 Update README etc to reference 1.82.1
  • 5ab5eba kokoro: Remove extra / in architecture replacement
  • 6726caf buildscripts: add regional td config for psm-interop (v1.82.x backport) (#12864)
  • 022256f Bump version to 1.82.1-SNAPSHOT
  • See full diff in compare view

Updates io.grpc:grpc-netty-shaded from 1.82.0 to 1.82.1

Release notes

Sourced from io.grpc:grpc-netty-shaded's releases.

v1.82.1

  • protoc-gen-grpc-java: Fix missing osx-x86_64 binary (grpc/grpc-java#12878). This fixes a regression in v1.82.0
Commits
  • 7b5e9ff Bump version to 1.82.1
  • 20768f1 Update README etc to reference 1.82.1
  • 5ab5eba kokoro: Remove extra / in architecture replacement
  • 6726caf buildscripts: add regional td config for psm-interop (v1.82.x backport) (#12864)
  • 022256f Bump version to 1.82.1-SNAPSHOT
  • See full diff in compare view

Updates org.apache.kerby:kerb-simplekdc from 2.1.1 to 2.1.2

Updates org.eclipse.sisu:org.eclipse.sisu.inject from 1.0.0 to 1.0.1

Release notes

Sourced from org.eclipse.sisu:org.eclipse.sisu.inject's releases.

1.0.1

Slight dependency updates and addition of automatic module names.

What's Changed

New Contributors

Full Changelog: eclipse-sisu/sisu-project@releases/1.0.0...releases/1.0.1

Commits

Updates org.eclipse.sisu:org.eclipse.sisu.plexus from 1.0.0 to 1.0.1

Release notes

Sourced from org.eclipse.sisu:org.eclipse.sisu.plexus's releases.

1.0.1

Slight dependency updates and addition of automatic module names.

What's Changed

New Contributors

Full Changelog: eclipse-sisu/sisu-project@releases/1.0.0...releases/1.0.1

Commits

Updates org.eclipse.sisu:org.eclipse.sisu.plexus from 1.0.0 to 1.0.1

Release notes

Sourced from org.eclipse.sisu:org.eclipse.sisu.plexus's releases.

1.0.1

Slight dependency updates and addition of automatic module names.

What's Changed

New Contributors

Full Changelog: eclipse-sisu/sisu-project@releases/1.0.0...releases/1.0.1

Commits

Updates eu.maveniverse.maven.njord:extension3 from 0.9.8 to 0.9.9

Release notes

Sourced from eu.maveniverse.maven.njord:extension3's releases.

0.9.9

What's Changed

New Contributors

Full Changelog: maveniverse/njord@release-0.9.8...release-0.9.9

Commits
  • e97235e [maven-release-plugin] prepare release release-0.9.9 [skip ci]
  • 7dc7a6a Update parent
  • 96580e6 Improve logging for NjordSessionLifecycleParticipant (#316)
  • a99ff51 README update
  • e357f01 Jreleaser (#314)
  • 03f1bd7 WriteBundleMojo to support file as a target (#313)
  • 3b33b18 [maven-release-plugin] prepare for next development iteration
  • See full diff in compare view

Updates eu.maveniverse.maven.plugins:njord from 0.9.8 to 0.9.9

Release notes

Sourced from eu.maveniverse.maven.plugins:njord's releases.

0.9.9

What's Changed

New Contributors

Full Changelog: maveniverse/njord@release-0.9.8...release-0.9.9

Commits
  • e97235e [maven-release-plugin] prepare release release-0.9.9 [skip ci]
  • 7dc7a6a Update parent
  • 96580e6 Improve logging for NjordSessionLifecycleParticipant (#316)
  • a99ff51 README update
  • e357f01 Jreleaser (#314)
  • 03f1bd7 WriteBundleMojo to support file as a target (#313)
  • 3b33b18 [maven-release-plugin] prepare for next development iteration
  • See full diff in compare view

Updates eu.maveniverse.maven.plugins:njord from 0.9.8 to 0.9.9

Release notes

Sourced from eu.maveniverse.maven.plugins:njord's releases.

0.9.9

What's Changed

New Contributors

Full Changelog: maveniverse/njord@release-0.9.8...release-0.9.9

Commits
  • e97235e [maven-release-plugin] prepare release release-0.9.9 [skip ci]
  • 7dc7a6a Update parent
  • 96580e6 Improve logging for NjordSessionLifecycleParticipant (#316)
  • a99ff51 README update
  • e357f01 Jreleaser (#314)
  • 03f1bd7 WriteBundleMojo to support file as a target (#313)
  • 3b33b18 [maven-release-plugin] prepare for next development iteration
  • See full diff in compare view

Updates org.cyclonedx:cyclonedx-maven-plugin from 2.9.1 to 2.9.2

Release notes

Sourced from org.cyclonedx:cyclonedx-maven-plugin's releases.

2.9.2

🚀 New features and improvements

  • chore: upgrade maven-dependency-analyzer/asm, support Java 25 (#630) @​shihyuho

📦 Dependency updates

🔧 Build

Commits
  • 0fe189d [maven-release-plugin] prepare release cyclonedx-maven-plugin-2.9.2
  • 96c218c update scm urls
  • 0fe08b4 Revert "Bump JamesIves/github-pages-deploy-action from 4.7.3 to 4.8.0"
  • 6779e48 Revert "Bump release-drafter/release-drafter from 6 to 7"
  • 955fead switch to Central Publishing Portal
  • 50dbac7 Bump release-drafter/release-drafter from 6 to 7
  • d50bc58 Bump org.apache.maven.plugins:maven-project-info-reports-plugin
  • 1034644 Bump plugin-tools.version from 3.15.0 to 3.15.2
  • 018ab8e Bump commons-codec:commons-codec from 1.17.1 to 1.22.0
  • e359705 Bump JamesIves/github-pages-deploy-action from 4.7.3 to 4.8.0
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
[12.0.x EE9] Bump the dev-dependencies group across 1 directory with …
fc5e972 
…13 updates

Bumps the dev-dependencies group with 13 updates in the /jetty-ee9 directory:

| Package | From | To |
| --- | --- | --- |
| org.glassfish.jersey.containers:jersey-container-servlet | `3.0.18` | `3.1.0` |
| org.glassfish.jersey.inject:jersey-hk2 | `3.0.18` | `3.1.0` |
| org.glassfish.jersey.media:jersey-media-json-binding | `3.0.18` | `3.1.0` |
| [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) | `1.5.34` | `1.5.37` |
| [com.github.jnr:jffi](https://github.com/jnr/jffi) | `1.3.15` | `1.4.0` |
| [io.grpc:grpc-core](https://github.com/grpc/grpc-java) | `1.82.0` | `1.82.1` |
| [io.grpc:grpc-netty-shaded](https://github.com/grpc/grpc-java) | `1.82.0` | `1.82.1` |
| org.apache.kerby:kerb-simplekdc | `2.1.1` | `2.1.2` |
| [org.eclipse.sisu:org.eclipse.sisu.inject](https://github.com/eclipse-sisu/sisu-project) | `1.0.0` | `1.0.1` |
| [org.eclipse.sisu:org.eclipse.sisu.plexus](https://github.com/eclipse-sisu/sisu-project) | `1.0.0` | `1.0.1` |
| [eu.maveniverse.maven.njord:extension3](https://github.com/maveniverse/njord) | `0.9.8` | `0.9.9` |
| [eu.maveniverse.maven.plugins:njord](https://github.com/maveniverse/njord) | `0.9.8` | `0.9.9` |
| [org.cyclonedx:cyclonedx-maven-plugin](https://github.com/CycloneDX/cyclonedx-maven-plugin) | `2.9.1` | `2.9.2` |



Updates `org.glassfish.jersey.containers:jersey-container-servlet` from 3.0.18 to 3.1.0

Updates `org.glassfish.jersey.inject:jersey-hk2` from 3.0.18 to 3.1.0

Updates `org.glassfish.jersey.media:jersey-media-json-binding` from 3.0.18 to 3.1.0

Updates `org.glassfish.jersey.inject:jersey-hk2` from 3.0.18 to 3.1.0

Updates `org.glassfish.jersey.media:jersey-media-json-binding` from 3.0.18 to 3.1.0

Updates `ch.qos.logback:logback-core` from 1.5.34 to 1.5.37
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.5.34...v_1.5.37)

Updates `com.github.jnr:jffi` from 1.3.15 to 1.4.0
- [Commits](jnr/jffi@jffi-1.3.15...1.4.0)

Updates `io.grpc:grpc-core` from 1.82.0 to 1.82.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.82.0...v1.82.1)

Updates `io.grpc:grpc-netty-shaded` from 1.82.0 to 1.82.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.82.0...v1.82.1)

Updates `io.grpc:grpc-netty-shaded` from 1.82.0 to 1.82.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.82.0...v1.82.1)

Updates `org.apache.kerby:kerb-simplekdc` from 2.1.1 to 2.1.2

Updates `org.eclipse.sisu:org.eclipse.sisu.inject` from 1.0.0 to 1.0.1
- [Release notes](https://github.com/eclipse-sisu/sisu-project/releases)
- [Changelog](https://github.com/eclipse-sisu/sisu-project/blob/main/RELEASE.md)
- [Commits](eclipse-sisu/sisu-project@releases/1.0.0...releases/1.0.1)

Updates `org.eclipse.sisu:org.eclipse.sisu.plexus` from 1.0.0 to 1.0.1
- [Release notes](https://github.com/eclipse-sisu/sisu-project/releases)
- [Changelog](https://github.com/eclipse-sisu/sisu-project/blob/main/RELEASE.md)
- [Commits](eclipse-sisu/sisu-project@releases/1.0.0...releases/1.0.1)

Updates `org.eclipse.sisu:org.eclipse.sisu.plexus` from 1.0.0 to 1.0.1
- [Release notes](https://github.com/eclipse-sisu/sisu-project/releases)
- [Changelog](https://github.com/eclipse-sisu/sisu-project/blob/main/RELEASE.md)
- [Commits](eclipse-sisu/sisu-project@releases/1.0.0...releases/1.0.1)

Updates `eu.maveniverse.maven.njord:extension3` from 0.9.8 to 0.9.9
- [Release notes](https://github.com/maveniverse/njord/releases)
- [Commits](maveniverse/njord@release-0.9.8...release-0.9.9)

Updates `eu.maveniverse.maven.plugins:njord` from 0.9.8 to 0.9.9
- [Release notes](https://github.com/maveniverse/njord/releases)
- [Commits](maveniverse/njord@release-0.9.8...release-0.9.9)

Updates `eu.maveniverse.maven.plugins:njord` from 0.9.8 to 0.9.9
- [Release notes](https://github.com/maveniverse/njord/releases)
- [Commits](maveniverse/njord@release-0.9.8...release-0.9.9)

Updates `org.cyclonedx:cyclonedx-maven-plugin` from 2.9.1 to 2.9.2
- [Release notes](https://github.com/CycloneDX/cyclonedx-maven-plugin/releases)
- [Commits](CycloneDX/cyclonedx-maven-plugin@cyclonedx-maven-plugin-2.9.1...cyclonedx-maven-plugin-2.9.2)

---
updated-dependencies:
- dependency-name: org.glassfish.jersey.containers:jersey-container-servlet
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: org.glassfish.jersey.inject:jersey-hk2
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: org.glassfish.jersey.media:jersey-media-json-binding
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: org.glassfish.jersey.inject:jersey-hk2
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: org.glassfish.jersey.media:jersey-media-json-binding
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.5.37
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: com.github.jnr:jffi
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: io.grpc:grpc-core
  dependency-version: 1.82.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: io.grpc:grpc-netty-shaded
  dependency-version: 1.82.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: io.grpc:grpc-netty-shaded
  dependency-version: 1.82.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: org.apache.kerby:kerb-simplekdc
  dependency-version: 2.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: org.eclipse.sisu:org.eclipse.sisu.inject
  dependency-version: 1.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: org.eclipse.sisu:org.eclipse.sisu.plexus
  dependency-version: 1.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: org.eclipse.sisu:org.eclipse.sisu.plexus
  dependency-version: 1.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: eu.maveniverse.maven.njord:extension3
  dependency-version: 0.9.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: eu.maveniverse.maven.plugins:njord
  dependency-version: 0.9.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: eu.maveniverse.maven.plugins:njord
  dependency-version: 0.9.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: org.cyclonedx:cyclonedx-maven-plugin
  dependency-version: 2.9.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Jun 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants