Update Micronaut dependencies by renovate[bot] · Pull Request #2278 · micronaut-projects/micronaut-security

renovate · 2026-09-11T04:28:28Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
io.micronaut.sql:micronaut-sql-bom (source)	`7.1.0` → `7.1.2`
io.micronaut.data:micronaut-data-bom (source)	`5.1.2` → `5.1.4`
io.micronaut.reactor:micronaut-reactor-bom (source)	`4.1.0` → `4.2.0`
micronaut (source)	`5.1.1` → `5.1.4`
io.micronaut.platform:micronaut-platform (source)	`5.1.1` → `5.1.4`
io.micronaut:micronaut-core-bom (source)	`5.1.12` → `5.2.0`
io.micronaut.build.shared.settings	`8.0.1` → `8.0.2`

Release Notes

micronaut-projects/micronaut-sql (io.micronaut.sql:micronaut-sql-bom)

`v7.1.2`: Micronaut SQL 7.1.2

Full Changelog: micronaut-projects/micronaut-sql@v7.1.1...v7.1.2

`v7.1.1`: Micronaut SQL 7.1.1

Full Changelog: micronaut-projects/micronaut-sql@v7.1.0...v7.1.1

micronaut-projects/micronaut-data (io.micronaut.data:micronaut-data-bom)

`v5.1.4`: Micronaut Data 5.1.4

What's Changed

Dependency updates 🚀

Update Micronaut Data to Micronaut Core 5.1.4 by @sdelamo in #4028

Other Changes 💡

Make DataConversionServiceSpec date assertions time zone independent by @dstepanov in #4019

Full Changelog: micronaut-projects/micronaut-data@v5.1.3...v5.1.4

`v5.1.3`: Micronaut Data 5.1.3

What's Changed

Bug Fixes 🐞

Fix transaction synchronization context propagation (merge from 5.2.x) by @dstepanov in #4009

Full Changelog: micronaut-projects/micronaut-data@v5.1.2...v5.1.3

micronaut-projects/micronaut-reactor (io.micronaut.reactor:micronaut-reactor-bom)

`v4.2.0`: Micronaut Reactor 4.2.0

What's Changed

Other Changes 💡

Update Reactor BOM to 2025.0.7 by @sdelamo in #673

Dependency updates 🚀

Update actions/checkout digest to d23441a by @renovate[bot] in #666
Update Gradle to v9.6.1 by @renovate[bot] in #663
Update actions/cache digest to caa2961 by @renovate[bot] in #658
Update actions/setup-java digest to 03ad4de by @renovate[bot] in #659
Update actions/checkout action to v7 by @renovate[bot] in #665
Update actions/cache action to v6 by @renovate[bot] in #664
Update mikepenz/action-junit-report digest to d9f48fc by @renovate[bot] in #662
Update graalvm/setup-graalvm digest to 0def53c by @renovate[bot] in #660
Update Micronaut dependencies by @renovate[bot] in #661
Update Micronaut dependencies by @renovate[bot] in #672
Update Gradle to v9.7.1 by @renovate[bot] in #671
Update gradle/actions digest to 9c97196 by @renovate[bot] in #670
Update actions/setup-java digest to b6effb0 by @renovate[bot] in #668
Update graalvm/setup-graalvm digest to 5298d94 by @renovate[bot] in #669

Full Changelog: micronaut-projects/micronaut-reactor@v4.1.0...v4.2.0

micronaut-projects/micronaut-platform (micronaut)

`v5.1.4`: Micronaut Platform 5.1.4

Micronaut Core 5.1.14
Micronaut Data 5.1.4

Full Changelog: micronaut-projects/micronaut-platform@v5.1.2...v5.1.4

`v5.1.3`: Micronaut Platform 5.1.3

Full Changelog: micronaut-projects/micronaut-platform@v5.1.2...v5.1.3

`v5.1.2`: Micronaut Platform 5.1.2

Full Changelog: micronaut-projects/micronaut-platform@v5.1.1...v5.1.2

micronaut-projects/micronaut-core (io.micronaut:micronaut-core-bom)

`v5.2.0`: Micronaut Core 5.2.0

What's Changed

New Features 🎉

Add RFC 10008 support (QUERY Method) by @desiderantes in #12780
Derive configuration metadata documentation from Kotlin KDoc by @MariusVolkhart in #12831
feat: add experimental Python support with GraalPy by @graemerocher in #12843
Add Netty activation controls by @n0tl3ss in #12842
feat: add incremental Python and Java compilation by @graemerocher in #12850
Support Python module annotations and JUnit 5 tests by @graemerocher in #12881
Add cross-origin policy header configuration by @sdelamo in #12914
Control the order in which singletons are destroyed by @dstepanov in #12965
Let AbstractConcurrentCustomScope answer for a bean definition by @dstepanov in #12969
Add language-neutral extension points for Scala integration by @graemerocher in #12695
Retain the annotations a composed annotation introduces by @dstepanov in #12968
Add the micronaut-reflection module by @dstepanov in #12977
Compile a wildcard type argument to a WildcardArgument that keeps its bounds by @dstepanov in #13023
Record on a bean introspection the type arguments a type binds in a super type by @dstepanov in #13048
Support default parameters for languages other than Kotlin by @graemerocher in #13041
Honour @Bean(preDestroy) on a bean class by @dstepanov in #13066
Let a runtime bean definition declare its injection points by @dstepanov in #13065
Keep the bounds of a type variable on the argument it compiles to by @dstepanov in #13063
Add isInherited() method to AnnotationElement interface by @dstepanov in #13053

Bug Fixes 🐞

Fix KSP2 crash writing aggregating outputs by @kamilkrzywanski in #12805
Cache successful message lookups in ResourceBundleMessageSource by @el-psy-kongroo-d in #12837
Fix bean introspection for OpenAPI generated $ref properties by @samikshathorat21 in #12823
Diagnose concrete Java inheritance in native Python by @n0tl3ss in #12896
Propagate hasEvaluatedExpressions in DefaultAnnotationMetadata copies by @dstepanov in #12975
Key a parameter's and a field's mutated metadata by the declaring type, not the type it is read through by @dstepanov in #12971
Keep a generated introspection name usable as a file name by @dstepanov in #12967
Resolve a repeatable annotation through its container in the by-name metadata queries by @dstepanov in #12963
Return the resolved values from getAnnotationValuesByName by @dstepanov in #12978
fix: handle discovery health without cache implementation by @graemerocher in #12983
Fix NoSuchMethodError when instantiating a Python bean via a @Creator classmethod by @graemerocher in #13033
Prefer an explicit @Head route over the implicit one derived from @Get by @graemerocher in #13030
Fix the endless destruction of a per-bean-locked scope holding a bean it cannot take out by @dstepanov in #13049
Resolve member-level @AnnotationExpressionContext in Kotlin by @graemerocher in #13035
fix(cookie): parse request Cookie header as name/value pairs by @dstepanov in #13054
Propagate the context of pre-matching filters into the route match by @dstepanov in #13082
Publish a refreshed property catalog atomically by @dstepanov in #13079
Don't instantiate an empty bean for an absent @QueryValue POJO by @dstepanov in #13080
Add the SslHandler for every wss connection by @dstepanov in #13085
Invoke the Kotlin $default method on the type that declares it by @dstepanov in #13084

Improvements ⭐

Fix KSP configuration interface inheritance by @sakshichitnis27 in #12814
fix(http): @QueryValue object binding for @JsonProperty aliases with underscores by @samikshathorat21 in #12803
Handle health status for endpoint base paths by @sakshichitnis27 in #12812
Inherit HTTP/2 settings for service clients by @hutiefang76 in #12800
reject header-injection characters in default cookie encoders by @kali834x in #12753
fix: allow validated @Value constructor params without @Introspected by @arimu1 in #12859
Add shared GraalPy context execution APIs by @graemerocher in #12849
Preserve original Python sources for debugging by @graemerocher in #12874
Fix native Python Throwable subclasses by @n0tl3ss in #12893
Allow disabling ImageSingletons lookups by @graemerocher in #12894
Memoize repeated Resolver calls by @Nillerr in #12897
Fix Python pooled request-body context conversion by @graemerocher in #12942
Fix: Micronaut Python cannot start on a JVM without JVMCI by @dstepanov in #12976
Make a field resolution segment a FieldInjectionPoint with no outer injection point by @dstepanov in #12970
Let a custom scope lock bean creation per bean rather than for the whole scope by @dstepanov in #12973
Destroy a proxy's retained interceptors from destroyBean(Object) by @dstepanov in #12972
Expose the target constructor to constructor interceptors of proxied beans by @dstepanov in #12959
Honour the route's executor for Kotlin suspend functions by @dstepanov in #13032
Expose the beans predicate a context was built with by @dstepanov in #13050
Cut annotation processor CPU by profiling the Java and Python pipelines by @dstepanov in #13060
Add a JDT compiler test suite and fix three javac specific assumptions by @graemerocher in #13070
Reject AOP advice on a sealed type at compile time by @dstepanov in #13067
Let a method element be annotated through the default method annotation metadata by @graemerocher in #13062
Copy all HTTP client configuration fields by @yawkat in #12816
Resolve a type argument bound at an intermediate generic super type by @dstepanov in #13081
Tell a raw type apart from a usage written with a type variable by @dstepanov in #13086
Add extensible response header populators by @sdelamo in #12992

Docs 📖

Update JDK setup requirements by @sdelamo in #12844
docs: document Python threading configuration by @graemerocher in #12984
Document retaining composed annotations by @dstepanov in #12989
docs: fix guide errors and fill in missing language snippets by @graemerocher in #13034
Document immutable configuration with record-like types by @dstepanov in #13057

Dependency updates 🚀

Update bytebuddy to v1.18.11 by @renovate[bot] in #12785
Update dependency ch.qos.logback:logback-classic to v1.5.38 by @renovate[bot] in #12811
Update dependency com.github.javaparser:javaparser-symbol-solver-core to v3.28.2 by @renovate[bot] in #12819
Update dependency com.uber.nullaway:nullaway to v0.13.8 by @renovate[bot] in #12824
Update Micronaut dependencies by @renovate[bot] in #12736
Update dependency com.squareup.okio:okio to v3.18.0 by @renovate[bot] in #11549
Update actions/setup-java digest to 03ad4de by @renovate[bot] in #12754
Update dependency com.blazebit:blaze-persistence-core-impl to v1.6.20 by @renovate[bot] in #12845
Update dependency com.squareup.okio:okio to v3.18.1 by @renovate[bot] in #12852
Update jackson monorepo by @renovate[bot] in #12833
Update graalvm/setup-graalvm digest to 5298d94 by @renovate[bot] in #12872
Update actions/checkout digest to d23441a by @renovate[bot] in #12839
Update netty monorepo to v4.2.17.Final by @renovate[bot] in #12876
Update dependency io.netty:netty-tcnative-boringssl-static to v2.0.81.Final by @renovate[bot] in #12889
Update bytebuddy to v1.18.12 by @renovate[bot] in #12898
Update dependency io.github.classgraph:classgraph to v4.8.192 by @renovate[bot] in #12901
Upgrade GraalPy for Python modules by @graemerocher in #12903
Update dependency jakarta.data:jakarta.data-api to v1.1.0-M3 by @renovate[bot] in #12905
Update graalvm/setup-graalvm digest to 0426e2e by @renovate[bot] in #12979
Update graalvm/setup-graalvm digest to 0426e2e by @renovate[bot] in #12991
upgrade graalpy version to 25.3.4.1 by @graemerocher in #13029
Update dependency com.squareup.okio:okio to v3.18.2 by @renovate[bot] in #13071
Update dependency com.google.testing.compile:compile-testing to v0.23.0 by @renovate[bot] in #12295
Update mikepenz/action-junit-report digest to a9170d5 by @renovate[bot] in #13013
Update graalvm/setup-graalvm digest to 0426e2e by @renovate[bot] in #13012
Update kotlin monorepo to v2.4.10 by @renovate[bot] in #12815

Other Changes 💡

Honor configuration loading strategy during bootstrap by @fatekingsama in #12788
fix: clear resolver caches after catalog rebuild by @graemerocher in #12864
fix(ksp): include Kotlin internal types in bean $EXPOSED_TYPES by @arimu1 in #12857
fix(http-client): preserve PropagatedContext for client filters with micrometer context-propagation by @arimu1 in #12858
fix: improve incremental Python compiler sessions by @graemerocher in #12870
test: cover implicit Python controller validation by @graemerocher in #12878
Fix Python module test nested-function traversal by @graemerocher in #12883
Add unique metadata and names for generated Python module stubs by @graemerocher in #12892
Fix quadratic response body assembly in NettyReadBufferFactory.compose by @graemerocher in #12891
Fix Python bridge casts for response subtypes by @n0tl3ss in #12895
Exclude BC dependencies by @graemerocher in #12904
fix(aop): preserve toString behavior for lazy proxies by @Boulea7 in #12875
Initialize parameterized Python config beans before builder injection by @n0tl3ss in #12907
Invoke @PreDestroy methods on beans with PRE_DESTROY advice by @dstepanov in #12920
Fix an interceptor not matching a bean that leaves a binding member at its default by @dstepanov in #12925
Compare the members of a qualifier built from an annotation instance by @dstepanov in #12928
Allow a primitive type to be named among a bean's exposed types by @dstepanov in #12927
Property cache issue by @msupic in #12926
Leave @Primary out of composite qualifiers by @dstepanov in #12945
Fix @InjectScope destruction for constructor parameters and prototype beans by @dstepanov in #12934
Allow a runtime bean definition's factory to receive the resolution context by @dstepanov in #12937
Honour the argument of RuntimeBeanDefinition.Builder.singleton(boolean) by @dstepanov in #12946
Remove a bean from the scope map when a custom scope destroys it by @dstepanov in #12947
Fire destruction listeners when closing a context-created bean registration by @dstepanov in #12943
Fix client proxy tests for updated Micronaut website by @graemerocher in #12954
fix(ksp): detect @JvmRepeatable when resolving repeatable containers by @dstepanov in #12912
fix(processor): stop generating an imported type's introspection twice by @dstepanov in #12916
Extend @AliasFor to support OverridesAttribute-style member overrides by @dstepanov in #12911
Throw IllegalStateException when resolving beans from a context that is not running by @dstepanov in #12948
Reuse one interceptor instance across a bean's lifecycle by @dstepanov in #12922
Process a class annotated only @ClassImport by @dstepanov in #12952
Resolve a null proxy target through the bean resolution customizer by @dstepanov in #12951
fix(validation): only advise methods that declare @RequiresValidation by @dstepanov in #12919
A bean introspection describes only the constructor it instantiates beans with by @dstepanov in #12909
Two startup optimisations: -5% wall, -12% CPU on cold start by @dstepanov in #12955
Support static methods meta-annotated as @Executable by @dstepanov in #12957
Close a bean registration idempotently by @dstepanov in #12956
Let a custom scope registered at runtime reach beans resolved before it by @dstepanov in #12961
Let a runtime bean definition carry its own disposer by @dstepanov in #12964
Describe the enclosing instance of an inner class constructor by @dstepanov in #12966
Find a bean definition by its compiled class by @dstepanov in #12974
Update introduction.adoc for clarity and accuracy by @graemerocher in #12988
Intercept each @PostConstruct and @PreDestroy callback separately by @dstepanov in #12962
Clear the quality gate of 5.2.x by @dstepanov in #12990
Make the declared only annotation metadata usable by @dstepanov in #12917
Do not assert an exact reply count in the Python websocket specs by @dstepanov in #12996
Read a member held in a collection value by value, as one held in an array by @dstepanov in #12994
Do not discard Fetch Metadata that is only partly recognised by @dstepanov in #12999
Expose the members a bean property is composed of by @dstepanov in #12918
Do not leave the bean context stuck as terminating by @dstepanov in #13009
Fail fast when adding a method definition after inheriting the super ones by @dstepanov in #13000
Do not break a destruction cycle at a bean the cycle requires by @dstepanov in #13005
Destroy singletons created during context shutdown by @dstepanov in #13007
Do not lose a bean created while a per-bean-locked scope shuts down by @dstepanov in #13008
Inherit the active environment in GraalPy contexts by @n0tl3ss in #13011
Enumerate beans by their @Indexed types even when not implemented by @dstepanov in #12960
Do not derive an interceptor binding for a kind that is already declared by @dstepanov in #13001
Register binder constructors for native images by @n0tl3ss in #12986
Three unrelated cleanups in inject, inject-python and inject-kotlin by @dstepanov in #13003
Four fixes from a deep analysis pass: interceptor member binding, PowerPoint media type, unsafe publication, header name validation by @dstepanov in #13004
Reject header values holding a character above U+00FF by @dstepanov in #13002
Invoke the pre-destroy method of a proxied factory-produced bean by @dstepanov in #13015
Register the proxy synthesize() actually creates for DYNAMIC_PROXY annotations by @dstepanov in #13014
Track @Parallel bean startup as part of the context lifecycle by @dstepanov in #13010
Report a mime type table that could not be loaded by @dstepanov in #13006
Keep the singleton creation lock across a failed creation by @dstepanov in #13024
Validate constrained @Value fields and setter placeholders at inject time by @dstepanov in #13021
Answer the enclosing method for the outer injection point of a method argument segment by @dstepanov in #13022
Intercept a lifecycle event once, keeping the callbacks it exposes by @dstepanov in #13019
Normalize Python resource paths on Windows by @ezzarghili in #13028
Close every bean of a per-bean-locked scope before taking any out by @dstepanov in #13025
Rework the Python (GraalPy) support: correctness, lifecycle, asyncio over Netty, compile time by @dstepanov in #13026
Make the Python compile tasks cacheable and relocatable by @dstepanov in #13036
Preserve map key spelling for indexed keys in the RAW property catalog by @dstepanov in #13039
Recompute the closure of an annotation a visitor added to an annotation type by @dstepanov in #13042
Address the Copilot review of the lifecycle interception PR (#13019) by @dstepanov in #13031
Retain the interceptor registrations on every AOP proxy by @dstepanov in #13047
Document the jakarta.annotation.Priority to @Order mapping and its sign by @dstepanov in #13051
Describe the members of a property by the type declaring them by @dstepanov in #13040
test: add regression tests for DefaultBeanContext by @dstepanov in #13056
Make error body buffering for streaming clients configurable by @dstepanov in #13055
fix: match @EachProperty record properties by name by @dstepanov in #13058
A lifecycle event whose bean declares no callback has no target method by @dstepanov in #13061
Decide between bean candidates that are all @Secondary by @dstepanov in #13064
Let construct advice enforce constraints on a container-invoked constructor by @dstepanov in #13068
Fix Python bridge conversions and processor isolation by @n0tl3ss in #13072
Let a runtime bean definition look beans up as it creates and disposes by @dstepanov in #13069
Keep the name a type variable was declared with when its bounds are written by @dstepanov in #13076
Keep reusable GraalPy context alive across app shutdown by @n0tl3ss in #13077
Answer the static analysis on the raw type argument by @dstepanov in #13088
Preserve IPv6 hosts in UriBuilder by @yawkat in #13087
Let a consumer read which super types a bean records type arguments for by @dstepanov in #13091

New Contributors

@sakshichitnis27 made their first contribution in #12814
@kamilkrzywanski made their first contribution in #12805
@desiderantes made their first contribution in #12780
@hutiefang76 made their first contribution in #12800
@el-psy-kongroo-d made their first contribution in #12837
@arimu1 made their first contribution in [#&fix: openid-urls in github-example #820

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Prague)

Branch creation
- "after 10pm"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

sonarqubecloud · 2026-09-11T04:59:46Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Update Micronaut dependencies

1d35ff6

renovate Bot added the type: dependency-upgrade Upgrade a dependency label Sep 11, 2026

dstepanov mentioned this pull request Sep 11, 2026

Update all Micronaut Platform 5.2 projects to Micronaut Core 5.2 micronaut-projects/micronaut-core#13110

Open

43 tasks

dstepanov requested a review from graemerocher September 11, 2026 04:34

graemerocher approved these changes Sep 11, 2026

View reviewed changes

Navigation Menu

Uh oh!

Update Micronaut dependencies - #2278

Update Micronaut dependencies#2278
renovate[bot] wants to merge 1 commit into
5.4.xfrom
renovate/micronaut-dependencies

renovate Bot commented Sep 11, 2026

Uh oh!

sonarqubecloud Bot commented Sep 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Sep 11, 2026

Release Notes

v7.1.2: Micronaut SQL 7.1.2

v7.1.1: Micronaut SQL 7.1.1

v5.1.4: Micronaut Data 5.1.4

What's Changed

Dependency updates 🚀

Other Changes 💡

v5.1.3: Micronaut Data 5.1.3

What's Changed

Bug Fixes 🐞

v4.2.0: Micronaut Reactor 4.2.0

What's Changed

Other Changes 💡

Dependency updates 🚀

v5.1.4: Micronaut Platform 5.1.4

v5.1.3: Micronaut Platform 5.1.3

v5.1.2: Micronaut Platform 5.1.2

v5.2.0: Micronaut Core 5.2.0

What's Changed

New Features 🎉

Bug Fixes 🐞

Improvements ⭐

Docs 📖

Dependency updates 🚀

Other Changes 💡

New Contributors

Configuration

Uh oh!

sonarqubecloud Bot commented Sep 11, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`v7.1.2`: Micronaut SQL 7.1.2

`v7.1.1`: Micronaut SQL 7.1.1

`v5.1.4`: Micronaut Data 5.1.4

`v5.1.3`: Micronaut Data 5.1.3

`v4.2.0`: Micronaut Reactor 4.2.0

`v5.1.4`: Micronaut Platform 5.1.4

`v5.1.3`: Micronaut Platform 5.1.3

`v5.1.2`: Micronaut Platform 5.1.2

`v5.2.0`: Micronaut Core 5.2.0