chore(deps): bump the low-risk group across 1 directory with 20 updates

[dependabot]

Bumps the low-risk group with 20 updates in the / directory:

Package	From	To
ch.qos.logback:logback-core	1.5.32	1.6.3
ch.qos.logback:logback-classic	1.5.32	1.6.3
org.junit.jupiter:junit-jupiter	6.1.0	6.1.3
nl.jqno.equalsverifier:equalsverifier	4.5	4.5.1
com.fasterxml.jackson:jackson-bom	2.21.3	2.22.2
io.projectreactor:reactor-bom	2025.0.5	2025.0.7
org.springframework.boot:spring-boot-dependencies	3.5.14	3.5.16
org.springframework.cloud:spring-cloud-dependencies	2025.1.1	2025.1.3
io.projectreactor.netty:reactor-netty-core	1.3.5	1.3.7
org.pitest:pitest-parent	1.25.1	1.25.9
org.pitest:pitest-maven	1.25.1	1.25.9
com.nimbusds:oauth2-oidc-sdk	11.37.2	11.38.2
io.netty:netty-codec-http	4.2.14.Final	4.2.17.Final
io.netty:netty-codec	4.2.14.Final	4.2.17.Final
io.netty:netty-common	4.2.14.Final	4.2.17.Final
io.netty:netty-handler	4.2.14.Final	4.2.17.Final
com.github.spotbugs:spotbugs	4.9.8	4.10.4
org.jacoco:jacoco-maven-plugin	0.8.14	0.8.15
com.github.spotbugs:spotbugs-maven-plugin	4.9.8.3	4.10.4.0
org.sonatype.central:central-publishing-maven-plugin	0.10.0	0.11.0

Updates ch.qos.logback:logback-core from 1.5.32 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-core's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

• In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

• Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

• The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

• ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

• Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

• The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

-- Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

• Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

• Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

  <property name="logback.skipCallerContradictionAnalysis" value="true"/>

• SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

• Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

• Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

• Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

... (truncated)

Commits

• e8e824d prepare release 1.6.3
• 761821b MDCBasedDiscriminator has a gated warning mechanism
• 53ed122 update copyright year
• c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
• b5aa931 added BatchedSimpleInvocationGate
• 1f22af7 add javadocs to SimpleInvocationGate
• 638ffa7 prevent forward and backward slashes to escape to other directories
• 7d6b9a4 add missing ch.qos.logback.core.property package
• fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
• c73b43f deprecate the withJansi path
• Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.5.32 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

• In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

• Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

• The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

• ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

• Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

• The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

-- Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

• Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

• Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

  <property name="logback.skipCallerContradictionAnalysis" value="true"/>

• SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

• Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

• Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

• Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

... (truncated)

Commits

• e8e824d prepare release 1.6.3
• 761821b MDCBasedDiscriminator has a gated warning mechanism
• 53ed122 update copyright year
• c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
• b5aa931 added BatchedSimpleInvocationGate
• 1f22af7 add javadocs to SimpleInvocationGate
• 638ffa7 prevent forward and backward slashes to escape to other directories
• 7d6b9a4 add missing ch.qos.logback.core.property package
• fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
• c73b43f deprecate the withJansi path
• Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.5.32 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

• In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

• Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

• The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

• ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

• Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

• The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

-- Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

• Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

• Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

  <property name="logback.skipCallerContradictionAnalysis" value="true"/>

• SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

• Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

• Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

• Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

... (truncated)

Commits

• e8e824d prepare release 1.6.3
• 761821b MDCBasedDiscriminator has a gated warning mechanism
• 53ed122 update copyright year
• c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
• b5aa931 added BatchedSimpleInvocationGate
• 1f22af7 add javadocs to SimpleInvocationGate
• 638ffa7 prevent forward and backward slashes to escape to other directories
• 7d6b9a4 add missing ch.qos.logback.core.property package
• fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
• c73b43f deprecate the withJansi path
• Additional commits viewable in compare view

Updates org.junit.jupiter:junit-jupiter from 6.1.0 to 6.1.3

Release notes

Sourced from org.junit.jupiter:junit-jupiter's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.1...r6.1.2

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

Commits

• f59f60d Release 6.1.3
• cd8ec92 Finalize 6.1.3 release notes
• c8729f2 Restore compatibility with GraalVM 25 (#5901)
• ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
• fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
• 62afc02 Delay GraalVM plugin updates for 3 days
• 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
• f6bbfc5 Move GraalVM tests to separate test task (#5903)
• e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
• 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
• Additional commits viewable in compare view

Updates nl.jqno.equalsverifier:equalsverifier from 4.5 to 4.5.1

Release notes

Sourced from nl.jqno.equalsverifier:equalsverifier's releases.

Release equalsverifier-4.5.1

For a list of changes in this version, see CHANGELOG.md.

Changelog

Sourced from nl.jqno.equalsverifier:equalsverifier's changelog.

[4.5.1] - 2026-08-21

Fixed

• Adds prefab values for java.util.LinkedHashSet. (Issue 1231, Issue 1232; thanks kalayciburak!)

Commits

• d890771 Bumps version to 4.5.1
• cec51b8 Updates CHANGELOG for release
• 1e5a37a Merge pull request #1235 from jqno/dependabot/maven/dependencies-1b33e0e210
• 7b46e33 Merge pull request #1234 from jqno/dependabot/github_actions/dependencies-9c0...
• 5706e86 Bump the dependencies group with 2 updates
• 3086b73 Bump dawidd6/action-download-artifact in the dependencies group
• bdf2481 Merge pull request #1233 from jqno/dependabot/maven/dependencies-48481af9b8
• 7c9fabc Bump the dependencies group with 3 updates
• 788d8de Merge pull request #1232 from kalayciburak/fix/linkedhashset-prefab-values
• f48ccdb Fix spotless wrap and shorten changelog
• Additional commits viewable in compare view

Updates com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.2

Commits

• 062d76d [maven-release-plugin] prepare release jackson-bom-2.22.2
• dcf18f7 Prep for 2.22.2 release
• 9688c7b Merge branch '2.21' into 2.22
• 7796a7d Merge branch '2.20' into 2.21
• d3cd7fc Merge branch '2.19' into 2.20
• 7a28068 Merge branch '2.18' into 2.19
• 51eb465 Post-release dep version bump
• 34ff5e8 [maven-release-plugin] prepare for next development iteration
• 0b44a45 [maven-release-plugin] prepare release jackson-bom-2.18.10
• 691ec93 Prep for 2.18.10 release
• Additional commits viewable in compare view

Updates io.projectreactor:reactor-bom from 2025.0.5 to 2025.0.7

Release notes

Sourced from io.projectreactor:reactor-bom's releases.

2025.0.7

2025.0.7 release train is made of:

• reactor-core 3.8.7
• reactor-addons 3.6.1
• reactor-pool 1.2.7
• reactor-netty 1.3.7
• reactor-kotlin-extensions 1.3.2

2025.0.6

2025.0.6 release train is made of:

• reactor-core 3.8.6
• reactor-pool 1.2.6
• reactor-netty 1.3.6
• reactor-kotlin-extensions 1.3.1

These artifacts didn't have any changes:

• reactor-addons 3.6.0

Commits

• fec5676 [release] Prepare and release BOM 2025.0.7
• 66e71db Prepare release/2025.0.7 branch
• f1e6769 Prepare 2025.0.x-internal branch
• 9a4154c Bump github/codeql-action from 4.37.5 to 4.37.6 (#793)
• e913602 Bump github/codeql-action from 4.37.4 to 4.37.5 (#792)
• 442d114 Bump github/codeql-action from 4.37.3 to 4.37.4 (#791)
• 7667828 Bump actions/setup-java from 5.6.0 to 5.7.0 (#790)
• 5ab3397 Bump github/codeql-action from 4 to 4.37.3 (#789)
• 2b6d1da Bump actions/checkout from 7.0.0 to 7.0.1 (#788)
• 92b99f4 Bump actions/setup-java from 5.5.0 to 5.6.0 (#787)
• Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-dependencies from 3.5.14 to 3.5.16

Release notes

Sourced from org.springframework.boot:spring-boot-dependencies's releases.

v3.5.16

🔨 Dependency Upgrades

• Upgrade to Spring AMQP 3.2.12 #50818
• Upgrade to Spring Data Bom 2025.0.13 #50819
• Upgrade to Spring Integration 6.5.10 #50820

v3.5.15

🐞 Bug Fixes

• Artemis auto-configuration uses a predictable default location for the embedded broker's data #50743
• MailSender auto-configuration does not enable hostname verification #50742
• SSL should not be enabled when a SSL bundle is overridden to an empty string #50624
• Layer written outside the output location of '//' exception is thrown when using extract layers in root directory #50501
• Docker Compose support does not restore thread interrupt flag when catching InterruptedException #50451
• RabbitProperties enables SSL even when spring.rabbitmq.ssl.bundle is overridden to an empty string #50429
• GraphQL WebSocket support does not configure allowed origins #50391
• Buildpack module does not validate long-to-int casts #50382
• MappingsEndpoint reports the context's own ID as parentId when a parent exists #50373
• Created StackTracePrinter instances have no access to the Environment #50303
• NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles #50301
• Spring Boot Loader Does Not Support RSA and EC Signed Jars #50292
• ConfigurationPropertiesReportEndpoint exposes AOP proxy internals #50273
• Actuator's '/cloudfoundryapplication' endpoint does not work if restrictive CORS configuration is provided using a bean named corsConfigurationSource #50254
• Meter registries are not removed from the global registry when the context is closed #50235
• ThreadPoolTaskScheduleBuilder unnecessarily loses precision when configuring await termination time #50225
• Apply HTML escaping to timestamp attribute in Whitelabel error page #50205
• NimbusJwtDecoder silently accepts unknown values for spring.security.oauth2.resourceserver.jwt.jws-algorithms #50118
• EndpointRequest links matcher unnecessarily matches HTTP methods other than GET #50095

📔 Documentation

• Fix reference to Gradle documentation for module replacement #50641
• Remove the use of Optional from Data Neo4j repository examples #50600
• Fix typos in documentation #50593
• Document Java 25 requirement for AOT cache #50482
• Clarify dependency requirement for Bean Validation support #50290
• Document SSL reloading with Let's Encrypt #50222
• Polish InvalidConfigurationPropertyValueException constructor javadoc #50212
• Document known testcontainers lifecycle issues #50210
• Document configuring multiple connectors with Jetty #50206
• Fix typo in Spring Security OAuth2 client registration documentation #50193

🔨 Dependency Upgrades

• Upgrade to Caffeine 3.2.4 #50308
• Upgrade to Cassandra Driver 4.19.3 #50670
• Upgrade to Glassfish JAXB 4.0.9 #50671
• Upgrade to Groovy 4.0.32 #50310
• Upgrade to Hibernate 6.6.53.Final #50721

... (truncated)

Commits

• 0566f69 Release v3.5.16
• 93edd16 Next development version (v3.5.16-SNAPSHOT)
• 5bafd0a Upgrade to Spring Integration 6.5.10
• baf3290 Upgrade to Spring AMQP 3.2.12
• 2c5964a Upgrade to Spring Data Bom 2025.0.13
• dbb08aa Upgrade Antora dependencies
• 9b281d5 Upgrade to actions/checkout 7.0.0
• a854058 Upgrade to jfrog/setup-jfrog-cli 5.1.0
• fc236ae Start building against Spring Integration 6.5.10 snapshots
• 5271da7 Start building against Spring Data Bom 2025.0.13 snapshots
• Additional commits viewable in compare view

Updates org.springframework.cloud:spring-cloud-dependencies from 2025.1.1 to 2025.1.3

Release notes

Sourced from org.springframework.cloud:spring-cloud-dependencies's releases.

v2025.1.3

Security

This release train contains fixes for 17 CVEs across 5 modules.

Spring Cloud Commons 5.0.3

• CVE-2026-59284 — Spring Cloud Commons no allow list for writable env actuator endpoint

Spring Cloud Config 5.0.5

• CVE-2026-47836 — Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
• CVE-2026-47837 — Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
• CVE-2026-47894 — Spring Cloud Config Server Native Environment Repository Exposure
• CVE-2026-59315 — Spring Cloud Config Monitor Denial of Service

Spring Cloud Function 5.0.4

• CVE-2026-59291 — Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function
• CVE-2026-59297 — Spring Cloud Function can incorrectly determine if URI is secure
• CVE-2026-59298 — Potential for improper filtering of HTTP headers in Spring Cloud Function
• CVE-2026-59299 — Composition lookup can potentially poison base function in Spring Cloud Function
• CVE-2026-59300 — Potential for logging sensitive data in Spring Cloud Function AWS
• CVE-2026-59301 — Potential for logging sensitive data in Spring Cloud Function Azure

Spring Cloud Gateway 5.0.3

• CVE-2026-47879 — Spring Cloud Gateway SSRF and native file access with gRPC

Spring Cloud Stream 5.0.3

• CVE-2026-59302 — Potential for logging sensitive data in Spring Cloud Stream
• CVE-2026-59303 — Dynamic destination cache size is not properly bound in Spring Cloud Stream
• CVE-2026-59304 — Improper caching of the original content type in Spring Cloud Stream Avro
• CVE-2026-59305 — Partition interceptor may be improperly added while sending message
• CVE-2026-59306 — Potential for deserialization of untrusted types in Spring Cloud Stream

What's Included

• Spring Cloud Build 5.0.3 (issues)
• Spring Cloud Function 5.0.4 (issues)
• Spring Cloud Stream 5.0.3 (issues)
• Spring Cloud Commons 5.0.3 (issues)
• Spring Cloud Bus 5.0.3 (issues)
• Spring Cloud Task 5.0.2 (issues)
• Spring Cloud Config 5.0.5 (issues)
• Spring Cloud Netflix 5.0.2 (issues)
• Spring Cloud Openfeign 5.0.3 (issues)
• Spring Cloud Consul 5.0.3 (issues)
• Spring Cloud Circuitbreaker 5.0.3 (issues)
• Spring Cloud Gateway 5.0.3 (issues)

... (truncated)

Commits

• d52d95a Release 2025.1.3
• 5ba4ec5 Initialize commercial release branch
• 7e855d0 Update versions for 2025.1.3-INTERNAL-SNAPSHOT
• 22ebee1 Add commercial release CI files [skip actions]
• 3c1c981 Merge pull request #534 from spring-cloud/dependabot/npm_and_yarn/docs/main/s...
• b79bd77 Bump @​springio/antora-extensions from 1.14.12 to 1.14.13 in /docs
• 65eb111 Use canonical deploy-docs trigger workflow [skip actions]
• 7501938 Merge pull request #532 from spring-cloud/dependabot/maven/main/com.github.jk...
• e3b2779 Merge pull request #533 from spring-cloud/dependabot/maven/com.github.jknack-...
• 791fbef Bump com.github.jknack:handlebars from 4.5.3 to 4.5.4
• Additional commits viewable in compare view

Updates io.projectreactor.netty:reactor-netty-core from 1.3.5 to 1.3.7

Release notes

Sourced from io.projectreactor.netty:reactor-netty-core's releases.

v1.3.7

Reactor Netty 1.3.7 is part of 2025.0.7 Release Train.

What's Changed

✨ New features and improvements

• Depend on Reactor Core v3.8.7 by @​violetagg in b0395bec56155b3c6ed9c2a4b2b81ccb857bdcf5, see release notes
• Depend on Netty v4.2.17.Final by @​violetagg in #4324
• Add WebSocket client metrics by @​LivingLikeKrillin in #4118
• Expose pending acquire latencies to custom MeterRegistrar by @​ejhnsn in #4250
• Reduce per-request CPU in the HTTP/2 connection pool by @​samueldlightfoot in #4297
• Evaluate the address supplier once in AddressUtils.updatePort by @​samueldlightfoot in #4298
• Require choice between Forwarded and X-Forwarded headers by @​violetagg in #4312
• Reuse per-connection address and byte meters in the Micrometer client metrics path by @​samueldlightfoot in #4318
• Override isH2cUpgrade in Http3Pool to always return false by @​violetagg in #4325
• Drop the redundant address parameter from the HttpClient recordRead/recordWrite/startWrite by @​violetagg in #4327
• HttpClient: Add API for configuring max decompression buffer size by @​violetagg in f4ca645c635c392d602c3cae12a4ca74697ae5fd
• Ensure NonSslRedirectHandler always does a redirect based on HOST header by @​violetagg in 626a6e742d0314c26b2fda5e943382e94afefa31
• WebSocket: Add API for configuring max decompression buffer size by @​violetagg in 6908378d586989ffceaa4c2f50f407d969016dd9

🐞 Bug fixes

• Exclude HTTP/2 connections from the pool during the PING liveness check by @​LivingLikeKrillin in #4255
• Add the liveness check to Http11EvictionPredicate by @​LivingLikeKrillin in #4256
• Skip SNI lookup completion when the channel is already closed by @​violetagg in #4266
• Do not capture caller context into pool maintenance tasks by @​hocaron in #4300
• Fix WebSocket-over-HTTP/2 server metrics gauge accounting on close by @​LivingLikeKrillin in #4302
• Fix NameResolverProvider#equals/hashCode by @​violetagg in 717381b7054376657753eaee27c6d48a19c7fe68
• Refactor TracingMapHandle to handle exceptions correctly by @​violetagg in 68561f4889a881a5e72f45e8f20c814adfa05b5f
• Update proxy handling by @​violetagg in fc98328cf0d4268c22ba17f8cad144e1408ff91f
• Refine header handling during redirects by @​violetagg in 88adf0cb35e648aa695c22d53efc8ff19c69600f
• Add back-pressure on pipelined HTTP requests by @​violetagg in dc07b9259bd1f3fb089b1658e62e9be21356e0b6
• Proxy protocol is not supported for HTTP/3 protocol by @​violetagg in 8d37581255ba2cc3cd2a0c6c5a2ece4af7040115...

  Description has been truncated

[dependabot]

Assignees

The following users could not be added as assignees: RichardSlater. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

[Copilot]

Pull request overview

Updates this Maven parent POM’s managed dependency/plugin versions to newer patch/minor releases, keeping downstream Stacks Java modules aligned on consistent (and generally more secure) library versions.

Changes:

• Bumped several core dependency versions (e.g., Logback, Netty, Jackson BOM, Reactor, Spring Boot/Cloud BOMs).
• Updated testing and quality tooling versions (JUnit Jupiter, JaCoCo, PIT, SpotBugs).
• Updated Sonatype Central publishing plugin version.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.