Skip to content

Bump the dependencies group with 3 updates#5966

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/dependencies-7f7858161f
Open

Bump the dependencies group with 3 updates#5966
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/dependencies-7f7858161f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 3 updates: org.apache.maven.plugins:maven-jar-plugin, org.safere:safere and joda-time:joda-time.

Updates org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1

Release notes

Sourced from org.apache.maven.plugins:maven-jar-plugin's releases.

3.5.1

📝 Documentation updates

  • Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#550) @​potiuk

👻 Maintenance

  • Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#550) @​potiuk
  • Use plugin version properties (3.x) (#535) @​Bukama

📦 Dependency updates

Commits
  • b0cd63d [maven-release-plugin] prepare release maven-jar-plugin-3.5.1
  • 5318a4f Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability
  • 8e0b9bb Bump org.apache.maven.plugins:maven-plugins from 48 to 49 (#547)
  • d5a438b Fix javadoc
  • 774fac9 Bump org.codehaus.plexus:plexus-archiver from 4.11.0 to 4.12.0
  • b71f403 Bump mavenVersion from 3.9.15 to 3.9.16 (#536)
  • 9f2a001 Use plugin version properties (3.x) (#535)
  • 68a978f Bump org.apache.maven.plugins:maven-plugins from 47 to 48 (#534)
  • e105821 Bump commons-io:commons-io from 2.21.0 to 2.22.0 (#529)
  • 953dc1a Bump mavenVersion from 3.9.14 to 3.9.15 (#528)
  • Additional commits viewable in compare view

Updates org.safere:safere from 0.8.0 to 0.9.0

Release notes

Sourced from org.safere:safere's releases.

SafeRE 0.9.0

Highlights

SafeRE 0.9.0 adds direct matching and replacement over borrowed UTF-8 byte-array views, avoiding an input-sized conversion to String for applications that already store text as UTF-8. This release also substantially improves matching, replacement, and splitting performance across the DFA, NFA, BitState, and OnePass engines, while expanding differential and scaling coverage for the optimized paths.

New features

  • Added Utf8Input and Utf8Matcher for matching validated or trusted UTF-8 byte-array views. Match and capture coordinates are reported as relative byte offsets, and Utf8Sink supports byte-native replacement output. Existing compiled Pattern instances can be shared between the String and UTF-8 APIs. See the direct UTF-8 matching guide for API details and semantic boundaries. (#569, #576)

Compatibility and correctness

  • Corrected DFA priority and match-boundary handling for overlapping alternatives, empty-width assertions, ambiguous reverse starts, and boundary-sensitive matches. These fixes allow more patterns to use the DFA path without changing leftmost-first match results. (#505, #506, #532, #539)
  • Prevented an ArrayIndexOutOfBoundsException when complex empty-width loops temporarily expand to duplicate DFA states. (#537)
  • Fixed OnePass eligibility, literal-prefix extraction through nested capture groups, literal prefix fallback behavior, grapheme-search fast rejection, and CRLF-sensitive DFA transition caching. (#487, #541, #555, #558, #572)
  • Added call-by-call UTF-8 crosschecks against SafeRE String matching and java.util.regex, covering captures, matcher state, input windows, byte-coordinate mapping, and replacement output. This also fixed bounded literal search so budget exhaustion falls back safely instead of missing a final candidate. (#575)

Performance

  • Expanded DFA eligibility for safe alternations and greedy nested nullable loops, and removed obsolete start-reliability fallbacks after correcting reverse-DFA semantics. Representative benchmark improvements include 14.7x for a 100 KB safe-alternation replacement workload and approximately 100x for an overlapping-URL search that previously fell back from the DFA. (#495, #506, #529)
  • Added ASCII-specialized DFA loops and streamlined DFA state storage, transition lookup, cache hits, character-class lookup, and inner-loop dispatch. The ASCII fast paths improved the reported representative 1 KB search workloads by 22% to 37%. (#501, #517, #535, #546, #561)
  • Reduced Pike NFA allocation and execution overhead through reusable state storage, pooled NFA instances, generational visited-state tracking, combined code-point decoding, and cached empty-width context. Reported scan-heavy forced-NFA workloads improved by 2.3x to 2.5x, with representative replacement and split workloads improving by 2.2x and 1.6x respectively. (#496, #510)
  • Added optimized replacement paths for DFA-eligible and character-class patterns, including replacements that reference capture groups, while reducing temporary allocations in appendReplacement. Pattern.split and splitWithDelimiters now share an optimized match position scan. (#547, #549, #554, #556)
  • Improved unanchored search acceleration by extracting starting character classes through alternations and case-insensitive literals, scanning for required pattern content, and retaining the DFA path after rejected literal-prefix candidates. The reported alternation-prefix workload improved by 46%. (#492, #541, #577)
  • Reduced allocations and copying in matcher group storage, OnePass captures, replacement builders, BitState capture resolution, and split operations. (#543, #544, #548, #553)

Performance figures above are workload-specific benchmark results reported by the corresponding changes; they are not general throughput guarantees.

Other changes

  • Expanded comparative real-world benchmarks, added stable work-counter scaling tests, and now run saved fuzz regression inputs in CI. (#500, #514, #515, #527)
  • Improved the native RE2 FFM comparison wrapper and its portability across Linux and macOS. (#499, #536, #557)

Contributors

Thank you to the community contributors who helped make this release possible:

  • @​cushon contributed extensive correctness and performance work across the DFA, NFA, BitState, and OnePass engines, as well as replacement, splitting, benchmarking, and native RE2 comparison improvements.
  • @​eamonnmcmanus improved benchmark-script compatibility across Bash versions.

Full changelog: eaftan/safere@v0.8.0...v0.9.0

Commits
  • 6fe6760 Prepare documentation for the 0.9.0 release (#578)
  • 1907a4e Accelerate searches using required pattern content (#577)
  • 399b7a7 Document direct UTF-8 matching API (#576)
  • 4fdf92a Crosscheck UTF-8 matching against String oracles (#575)
  • abbe57f Restore String matching performance after UTF-8 input changes (#572)
  • 7a392a1 Add direct UTF-8 input support (#569)
  • c8f51f3 Add daily repo assist skill (#566)
  • 0431e1e Optimize replacement operations with DFA fast path (#547)
  • 737f66a Avoid unnecessary third DFA pass for start-anchored patterns (#563)
  • 37f5e82 Revert "Generalize charClassPrefixAscii to support non-ASCII character clas...
  • Additional commits viewable in compare view

Updates joda-time:joda-time from 2.14.2 to 2.14.3

Release notes

Sourced from joda-time:joda-time's releases.

Release v2.14.3

See the change notes for more information.

What's Changed

Full Changelog: JodaOrg/joda-time@v2.14.2...v2.14.3

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the dependencies group with 3 updates
f4a2939 
Bumps the dependencies group with 3 updates: [org.apache.maven.plugins:maven-jar-plugin](https://github.com/apache/maven-jar-plugin), [org.safere:safere](https://github.com/eaftan/safere) and [joda-time:joda-time](https://github.com/JodaOrg/joda-time).


Updates `org.apache.maven.plugins:maven-jar-plugin` from 3.5.0 to 3.5.1
- [Release notes](https://github.com/apache/maven-jar-plugin/releases)
- [Commits](apache/maven-jar-plugin@maven-jar-plugin-3.5.0...maven-jar-plugin-3.5.1)

Updates `org.safere:safere` from 0.8.0 to 0.9.0
- [Release notes](https://github.com/eaftan/safere/releases)
- [Commits](eaftan/safere@v0.8.0...v0.9.0)

Updates `joda-time:joda-time` from 2.14.2 to 2.14.3
- [Release notes](https://github.com/JodaOrg/joda-time/releases)
- [Changelog](https://github.com/JodaOrg/joda-time/blob/main/RELEASE-NOTES.txt)
- [Commits](JodaOrg/joda-time@v2.14.2...v2.14.3)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-jar-plugin
  dependency-version: 3.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.safere:safere
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: joda-time:joda-time
  dependency-version: 2.14.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Jul 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cpovirk cpovirk cpovirk approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@cpovirk