fix(deps): update all non-major dependencies (minor) - #364
Merged
Conversation
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
May 4, 2026 11:41
c760792 to
d66c9d4
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
May 24, 2026 18:37
5449321 to
88f3ea0
Compare
|
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
May 31, 2026 10:46
88f3ea0 to
16c2802
Compare
|
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
July 5, 2026 15:25
a69b43f to
36d9b5f
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
July 16, 2026 07:28
36d9b5f to
cfed6c7
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
July 17, 2026 02:43
cfed6c7 to
16de96f
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.23.0→1.25.05.5.0.6356→5.7.0.69703.21.0→3.22.06.0.3→6.1.26.0.3→6.1.26.0.3→6.1.21.17→1.18.212.9→12.10Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
jreleaser/jreleaser (org.jreleaser:jreleaser-maven-plugin)
v1.25.0Compare Source
Binaries
https://github.com/jreleaser/jreleaser/wiki/Release-v1.25.0
Changelog
🚀 Features
assemble
1404462Resolve native-image distribution artifacts with multiple archive formats, closes #2106e0c5956Update gradle DSL, closes #210603ece6eResolve jlink distribution artifacts with multiple archive formats, closes #210627d5a50Support multiple archive formats in jlink assembler, closes #2106core
36e4e99Provide secret hints, closes #2141release
d2c2784Expose snapshot enabled status🐛 Fixes
deploy
dc7c2e4Clarify Maven Central polling log wording, closes #2125jdks
2dac6f3Drop unsupported connectTimeOut from download-maven-plugin call, closes #2126packager
69d6677Update Chcolatey GH workflows, closes #2117release
7d4d23aEnsure JRELEASER_PREVIOUS_TAG_NAME is used with snapshot releases, closes #2136signing
65e3fb7PGP no longer requires a publicKey to be set, closes #2143b5b088bskip signing validation errors when --yolo is set, closes #2128validation
c47df63Correct project identifier log message for GitLab deployer🛠 Build
e6c5adcUpdate release announcementsddd5b2cBump flatpack runtime to 25.08📝 Documentation
347c635Add mvanhorn as a contributor for codecb8ab48Add seonwooj0810 as a contributor for code⚙️ Dependencies
951142cUpdate zstd-jni to 1.5.7-116457cb6Update woodstox to 7.2.16d729a0Update syft to 1.46.08ae6a3eUpdate slf4j to 2.0.18390afffUpdate tika to 2.9.47744f7bUpdate jacoco to 0.8.1506cb7ebUpdate jackson to 2.22.0d5b4c90Update cyclonedx to 0.32.05febc13Update cosign to 3.1.12ba4c3eUpdate commons-jexl to 3.6.3eaad81aUpdate classworlds to 2.12.0f34068bUpdate classmate to 1.7.35850a5eUpdate byte-buddy to 1.18.10650fa89Update aws-java-sdk to 2.46.177fd8875Update asm to 9.10.1817d8b4Update jdks-gradle-plugin to 1.24.076e2accReleasing version 1.25.05e48b86Bump for next development cycleContributors
We'd like to thank the following people for their contributions:
v1.24.0Compare Source
Binaries
https://github.com/jreleaser/jreleaser/wiki/Release-v1.24.0
Changelog
🚀 Features
announce
c8033eeSupport zernio as announcer, closes #2098core
4586b4aAdd a flag to activate reproducible artifacts, closes #2115gradle
48a2685Fix access to Task.project at task execution time, closes #1992jdks
bfb88cdFix inconsistent timeout validation, closes #20876dffe57Add download timeout support to jdks-maven-plugin, closes #2083🐛 Fixes
assemble
af9767bPass JVM options to generated launcher by jlink, closes #2090e7b4afbResolve relative launcher symlinks, closes #1994dce1c0fAvoid duplicate resources in Native Image by using -cp option during assemble step, closes #2094deploy
39250faConsider PUBLISHED state when checking deployment transition, closes #2082gradle
2737a31Add property keys related to deprecated Convention APIs, closes #2078packager
401af4bUse snap arch in JAVA_HOME, closes #2027packagers
3736268Update chocolatey templates, closes #2107 #21081b0e37bUse consistent paths in single-jar Dockerfile template0955463Use multi-stage build in Docker templates to avoid duplicate layers, closes #2079sign
e820f56Support PGP subkeys, closes #2086🔄️ Changes
packagers
e5eab0aFix default Docker entrypoints, closes #2112 #2113c775aa9Fine tune multi-stage docker files, closes #2079unscoped
735a8dfMore code audit fixes37fc14bApply suggestions from code audits🛠 Build
7d313fdFix GH workflowsd7488abUpdate release announcements805a0fdFix wiki updatese20ce15Fix workflow issues1d195ceFix update-wiki scripta94a966Fix issues found by CodeQLaf15bcaUpdate GH workflows based on lint auditsf925bedUpdate CodeQL settings1ff8029More GH workflow improvements based on audits4e9bb7dImprove GH workflows based on auditsab785d8Update github workflows in templates161c490Fix workflow linting issues77d1e3cPin versions in GH workflows84aa4b9Fix some linting issues in GH workflows9ef4afeAdd version management to release workflow19eb19aAdd a GH workflow for linting GH workflows2f79751Update readmef978967Fix wiki template337c1d3Update release workflow📝 Documentation
2f0fd0aAdd XiaoPengMei as a contributor for code564ed30Add mhoffrog as a contributor for codede84e9eAdd PrakarshSrivastav as a contributor for code⚙️ Dependencies
55c0de7Update ant to 1.10.17b058360Update aws-java-sdk to 2.42.4193f5b77Update bouncycastle to 1.849fec8eeUpdate byte-buddy to 1.18.83d87d5dUpdate commons-codec to 1.22.022b1263Update commons-io to 2.22.079ca5e3Update commons-net to 3.13.0390619bUpdate cosign to 3.0.6b2d7465Update feign to 13.12fc629beUpdate jsoup to 1.22.2f0f7868Update syft to 1.43.0b52e929Update stax2-api to 4.3.0d70d2c3Update xz to 1.124def722Releasing version 1.24.0f645ecdBump for next development cycleContributors
We'd like to thank the following people for their contributions:
SonarSource/sonar-scanner-maven (org.sonarsource.scanner.maven:sonar-maven-plugin)
v5.7.0.6970Compare Source
Release notes - Sonar Scanner for Maven - 5.7
Feature
SCANMAVEN-317 Support encryption of sonar.token, and other new secure properties
SCANMAVEN-332 support
modular-jarartifact typeSCANMAVEN-341 Rework the support of encrypted properties
Maintenance
SCANMAVEN-370 Prepare next development iteration 5.7.0
SCANMAVEN-372 Configure Renovate for sonar-scanner-maven
SCANMAVEN-373 SubmitReview: Use Vault token
SCANMAVEN-374 Unpin internal GitHub actions
SCANMAVEN-376 Use SonarSource/.../sonar-update-center-release@v1 instead of @master
SCANMAVEN-377 Update dependency org.assertj:assertj-core to v3.27.7 [SECURITY]
v5.6.0.6792Compare Source
Release notes - Sonar Scanner for Maven - 5.6
Maintenance
SCANMAVEN-318 Update Orchestrator and fix e2e matrix
SCANMAVEN-324 Convert e2e tests to invoker
SCANMAVEN-346 Fix CI failure
SCANMAVEN-347 Automate detection of sonar:sonar shorthand failure
SCANMAVEN-348 Bump org.assertj:assertj-core from 3.26.3 to 3.27.7 in /sonar-maven-plugin
SCANMAVEN-349 Remove Maven 4 e2e tests from promotion requirements
SCANMAVEN-356 Add automated release workflow
SCANMAVEN-357 Licence packaging standard - Maven Scanner
SCANMAVEN-358 Create SonarUpdateCenterRelease.yml
SCANMAVEN-361 Add issue-categories in automated release
SCANMAVEN-363 Fix e2e tests with Maven 4
SCANMAVEN-364 Do not run nightly builds on weekends
SCANMAVEN-365 Set up orchestrator cache
SCANMAVEN-366 Update sonar-scanner-java-library to 4.1.0.1619
SCANMAVEN-367 Update sonar-scanner-java-library to 4.1.1.1633
SCANMAVEN-369 Update parent pom to 87.0.0.3057
Feature
SCANMAVEN-281 Irrelevant encrypted properties are not filtered out in multi-module project with "sonar" in the name
junit-team/junit-framework (org.junit.jupiter:junit-jupiter-params)
v6.1.1zeroturnaround/zt-zip (org.zeroturnaround:zt-zip)
v1.18.2Security
:as a drive/stream separator, so an entry name like" ."could resolve to the output directory itself (re-applying the entry's permissions to it, GHSA-v2g6-7r9j-v6px) and a name like".. \evil.txt"could escape the output directory. The allocation-free fast path that clears genuine descendant entry names (avoiding agetCanonicalFile()call) no longer clears such names; they are canonicalized and rejected as malicious when their canonical path cannot be resolved or does not stay inside the output directory. The output-directory check compares canonicaljava.nio.file.Paths so a self-referencing name is recognised even whengetCanonicalFile()renders it with a trailing separator. Reported by Marcono1234.v1.18.1Fixed
ZipUtil.unpackno longer applies a ZIP entry's stored file permissions to the output directory itself when an entry's name resolves to it (for example an entry named/), which could change the output directory's permissions (GHSA-v2g6-7r9j-v6px).v1.18.0Added
packoverloads that write to an existingjava.util.zip.ZipOutputStream.Changed
slf4j-apidependency from 1.6.6 to 2.0.18. zt-zip uses only the SLF4J API; applications that pick this newer API up transitively and still use an SLF4J 1.x binding must move to an SLF4J 2.x-compatible binding.slf4j-apiis now a runtime-scoped dependency (previouslycompilescope), so it is no longer on the consumer compile classpath. Declare a directslf4j-apidependency if your own code references SLF4J.Fixed
Zipsunpack with a transformer no longer hangs when the transformer produces no entry, and a transformer that throws now surfaces its real exception to the caller instead of a misleading "Write end dead" pipe error.Zips.addEntry/addEntriesno longer fail with "Stream closed" when adding a directoryFileSource; a directory is now stored as a proper directory entry (#138).ZipUtil.packno longer fails withFileNotFoundExceptionwhen a directory contains a broken (dangling) symbolic link; such entries are skipped (#122).ZipUtil.packEntries/packEntry(File, File, NameMapper)now skip an entry whoseNameMapperreturnsnull(the same convention as the directorypack) instead of throwingNullPointerExceptionand leaving a partial zip.ZipUtilmethods that take a separate destination —addEntry/addEntries,removeEntry/removeEntries,replaceEntry/replaceEntries,addOrReplaceEntries,transformEntry/transformEntries,repack— now reject a destination equal to the source with anIllegalArgumentExceptioninstead of truncating and destroying the source before reading it; use the in-place variant (without a destination) instead.ByteSource(and thebyte[]ZipUtil.addEntry/replaceEntryoverloads) now acceptnullbytes as the documented directory entry instead of throwingNullPointerException.ByteSourcewithnullbytes and theSTOREDmethod now produces a valid empty entry (size 0, CRC 0) instead of failing with "STORED entry missing size, compressed size, or crc-32".Security
java.nio.file.Pathfor consistent sub-directory containment checks.Zipsfluent API unpack path (Zips.get(...).unpack().destination(...).process()) now applies the same path-traversal guard asZipUtil.unpack, rejecting entries that resolve outside the destination directory; this covers both the plain and transformer branches (#180).Files.createTempDirectory(atomic, owner-only permissions) instead of a predictable, world-readable directory.AsiExtraFieldnow validates the declared symbolic-link length against the bytes actually present before allocating, so a forged length in a crafted archive can no longer trigger a large (up to ~2 GB) memory allocation per entry while unpacking (#181).AsiExtraFieldnow rejects a truncated ASI extra field with aZipExceptioninstead of letting anArrayIndexOutOfBoundsException/NegativeArraySizeExceptionabort unpacking, completing the bounds check added in #181.BackslashUnpackernow validates the resolved path before creating any directories, so a backslash-separated..\entry can no longer create directories outside the output directory (the file write itself was already blocked).ZipUtil.explode,repackandunexplodenow create their working file or directory atomically (File.createTempFile/Files.createTempDirectory) instead of a predictable name next to the target, closing a symlink/TOCTOU race when the target sits in a shared directory; the predictableFileUtils.getTempFileForhelper is deprecated.ZipUtil.unwrapnow throws aZipExceptionfor an entry name whose path prefix resolves outside the name (such as a~- or:-prefixed name) instead of letting an uncheckedStringIndexOutOfBoundsExceptionabort the operation.Configuration
📅 Schedule: (in timezone Europe/Oslo)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.