Skip to content

Bump the dependencies group across 1 directory with 18 updates - #825

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/master/dependencies-2973edbc04
Closed

Bump the dependencies group across 1 directory with 18 updates#825
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/master/dependencies-2973edbc04

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 18 updates in the / directory:

Package From To
com.fasterxml.jackson.core:jackson-databind 2.22.2 2.22.3
io.avaje:avaje-json-node 3.15 3.16
io.avaje:avaje-inject 12.6 12.7
io.avaje:avaje-inject-generator 12.6 12.7
io.avaje:avaje-inject-maven-plugin 12.6 12.7
io.avaje:avaje-inject-generator 12.6 12.7
io.avaje:avaje-inject-maven-plugin 12.6 12.7
org.hibernate.validator:hibernate-validator 9.1.3.Final 9.1.4.Final
io.avaje:avaje-validator 2.17 2.18
io.avaje:avaje-validator-constraints 2.17 2.18
io.avaje:avaje-validator-generator 2.17 2.18
io.helidon.webserver:helidon-webserver 4.5.4 27.0.0
io.helidon.webserver:helidon-webserver-security 4.5.4 27.0.0
io.helidon.http.media:helidon-http-media-jsonb 4.5.4 27.0.0
io.helidon.webserver:helidon-webserver-security 4.5.4 27.0.0
io.helidon.http.media:helidon-http-media-jsonb 4.5.4 27.0.0
io.avaje:avaje-nima 1.12 1.14
io.avaje:avaje-nima-test 1.12 1.14
io.vertx:vertx-web 5.1.8 5.2.0
org.slf4j:slf4j-jdk-platform-logging 2.0.19 2.0.20
ch.qos.logback:logback-classic 1.6.3 1.6.5
io.avaje:avaje-json-core 3.15 3.16

Updates com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.3

Commits
  • 4385c5f [maven-release-plugin] prepare release jackson-databind-2.22.3
  • ccb4fd0 Prep for 2.22.3 release
  • 2958412 Merge branch '2.21' into 2.22
  • 1215b94 Post-release dep version bump
  • 1f0df62 [maven-release-plugin] prepare for next development iteration
  • 13a9ff4 [maven-release-plugin] prepare release jackson-databind-2.21.7
  • d168f96 Prep for 2.21.7 release
  • eaf5c76 Merge branch '2.21' into 2.22
  • e05ef4c Merge branch '2.20' into 2.21
  • f6d4000 Merge branch '2.19' into 2.20
  • Additional commits viewable in compare view

Updates io.avaje:avaje-json-node from 3.15 to 3.16

Updates io.avaje:avaje-inject from 12.6 to 12.7

Release notes

Sourced from io.avaje:avaje-inject's releases.

12.7

What's Changed

Dependencies

Full Changelog: avaje/avaje-inject@12.6...12.7

Commits
  • 0d45ab0 Update how-to-release.md docs
  • fee50c9 Version 12.7 - gradle plugin
  • 8101799 Version 12.7
  • 4fe8c88 #1075 - Fix child scope external bean failure (#1077)
  • ebe75b9 #1075 - Add non failing tests for nested static components (#1076)
  • 4ba9525 Merge pull request #1074 from avaje/dependabot/maven/master/dependencies-64e7...
  • 82474ba Bump the dependencies group with 2 updates
  • d5f3479 Update shade plugin with @MainClass instead of adding useless jar plugin (#...
  • b2fe325 Merge pull request #1071 from avaje/dependabot/maven/master/dependencies-1e2b...
  • 5ead4a4 Bump the dependencies group with 3 updates
  • Additional commits viewable in compare view

Updates io.avaje:avaje-inject-generator from 12.6 to 12.7

Updates io.avaje:avaje-inject-maven-plugin from 12.6 to 12.7

Updates io.avaje:avaje-inject-generator from 12.6 to 12.7

Updates io.avaje:avaje-inject-maven-plugin from 12.6 to 12.7

Updates org.hibernate.validator:hibernate-validator from 9.1.3.Final to 9.1.4.Final

Release notes

Sourced from org.hibernate.validator:hibernate-validator's releases.

Release 9.1.4.Final

Hibernate Validator 9.1.4.Final released

We are pleased to announce the release of Hibernate Validator 9.1: 9.1.4.Final.

You can find the full list of 9.1.4.Final changes here.

What's new

  • See the website for requirements and compatibilities.
  • See the What's New guide for details about new features and capabilities.

Conclusion

For additional details, see:

Visit the website for details on getting in touch with us.

Changelog

Sourced from org.hibernate.validator:hibernate-validator's changelog.

9.1.4.Final (2026-09-20)

Full changelog

Bug

  • HV-2253 - ClassNotFoundException thrown when an EL implementation and OSGi are not on the class path

Improvement

  • HV-2243 - Bump joda-time to 2.14.3
  • HV-2242 - Update to OpenJFX to 17.0.20

Task

  • HV-2244 - Tune the content of javadoc jars to reduce the size of files published to Maven Central
Commits
  • 5504b0c [Jenkins release job] Preparing release 9.1.4.Final
  • 1306aab [Jenkins release job] changelog.md updated by release build 9.1.4.Final
  • 715cbdb [Jenkins release job] README.md updated by release build 9.1.4.Final
  • 84e8d2e HV-2253 When determining the Jakarta Expression Language implementation, igno...
  • f3002a3 [9.1] Bump org.codehaus.mojo:build-helper-maven-plugin
  • 971d85b [9.1] Bump the build-dependencies group with 3 updates
  • dcb1305 Tune the content of javadoc jars to reduce the size of files published to Mav...
  • d01ed37 [9.1] Bump version.org.apache.groovy from 5.0.7 to 5.0.8
  • 6023258 Bump joda-time to 2.14.3 HV-2243
  • 3db152e Update to OpenJFX to 17.0.20 HV-2242
  • Additional commits viewable in compare view

Updates io.avaje:avaje-validator from 2.17 to 2.18

Release notes

Sourced from io.avaje:avaje-validator's releases.

2.18

What's Changed

Dependencies

Full Changelog: avaje/avaje-validator@2.17...2.18

Commits

Updates io.avaje:avaje-validator-constraints from 2.17 to 2.18

Updates io.avaje:avaje-validator-generator from 2.17 to 2.18

Updates io.helidon.webserver:helidon-webserver from 4.5.4 to 27.0.0

Updates io.helidon.webserver:helidon-webserver-security from 4.5.4 to 27.0.0

Updates io.helidon.http.media:helidon-http-media-jsonb from 4.5.4 to 27.0.0

Updates io.helidon.webserver:helidon-webserver-security from 4.5.4 to 27.0.0

Updates io.helidon.http.media:helidon-http-media-jsonb from 4.5.4 to 27.0.0

Updates io.avaje:avaje-nima from 1.12 to 1.14

Updates io.avaje:avaje-nima-test from 1.12 to 1.14

Updates io.vertx:vertx-web from 5.1.8 to 5.2.0

Commits
  • ff8e680 Releasing 5.2.0
  • 757cc4d Rewrite the stop condition of SockJSWriteTest#testXHRPolling
  • 717d477 fix: JWTAuthHandler should validate scopes eagerly on authenticate() so chain...
  • 9a25256 Fix Http3Test (#2945)
  • de4f419 Update GraphiQL generated files
  • 5341598 support query method in webclient
  • 02d7bea Add RFC 10008 (QUERY Method) support
  • 266b0cf Make sure we only fingerprint non-null bodies
  • 8b23492 Upgrade to GraphiQL 5.4.0 (#2943)
  • dfe983c tweak body checks to allow nonconformant GETs that carry a body (fixes the Js...
  • Additional commits viewable in compare view

Updates org.slf4j:slf4j-jdk-platform-logging from 2.0.19 to 2.0.20

Updates ch.qos.logback:logback-classic from 1.6.3 to 1.6.5

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.5

2026-09-30 Release of logback version 1.6.5

• Fixed a vulnerability CVE-2026-104721 closely related to CVE-2026-19880. The fix in version 1.6.3, which strips forward and backward slashes from MDC values, was insufficient. An MDC value could still contain relative path components such as .., variable references such as /, or characters that are special in file name patterns and email addresses. This latest vulnerability was found and reported by François Martin (GitHub: @​martinfrancois, https://github.com/martinfrancois).

MDCBasedDiscriminator, used by SiftingAppender, now rejects MDC values instead of stripping characters from them. An MDC value is rejected if it is empty, if it is longer than 64 characters, if it contains the sequence .., or if it contains any of the following characters: / \ $ { } [ ] ( ) | ? * + % , @. When an MDC value is rejected, the discriminator returns the value of its DefaultValue property. A warning is emitted for each rejected value. These warnings are rate-limited.

• When compression is enabled, TimeBasedRollingPolicy and SizeAndTimeBasedRollingPolicy now also remove old log files that were never compressed, for example because the application was not running at rollover time. Previously, such files were ignored by maxHistory and accumulated indefinitely. This issue was discussed in discussions/1032. See TimeBasedRollingPolicy.

• SimpleInvocationGate, deprecated in version 1.6.3, is now marked for removal. Use FixedIntervalInvocationGate instead.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit d1b829dcdb9fd98511c64401beb1419a9c9384aa associated with the tag v_1.6.5. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.4

2026-09-24 Release of logback version 1.6.4

• Variable substitution is again applied to the scan attribute of the <configuration> element. The scanning refactoring in version 1.5.27 had dropped substitution, so values such as ${logback.scan.enabled:-true} were no longer resolved. As before version 1.5.27, an unrecognized non-empty value turns scanning on. The same substitution now applies to the scan attribute of <propertiesConfigurator>. This regression was reported in issues/1065 by vaibhavjain2.

• OutputStreamAppender and FileAppender now handle stateful encoders. The Encoder interface has a new default method called isStateful(), which returns false. An encoder that keeps state between calls to encode() can return true. For such encoders, the appender holds its write lock while encoding and while writing, so the output of concurrent appends cannot interleave. Stateless encoders still encode outside the lock, so their performance does not change. Existing encoders need no changes.

• Several race conditions in OutputStreamAppender and FileAppender were fixed. The appender is now marked started and the encoder header is written while the same lock is held, so a concurrent append can no longer write an event before the header. After acquiring the lock, the appender checks again whether it has been stopped, so no event is written after the footer. In prudent mode, FileAppender now encodes and writes each event while holding the lock.

• Fixed a data race on the logger count in LoggerContext. Loggers are created under the lock of their parent logger, so loggers with different parents could be created at the same time and increments of the shared counter could be lost. As a result, LoggerContext.size() could return a value lower than the actual number of loggers. The counter is now an AtomicInteger. This issue was reported in issues/1038 by hcantunc. The fix was contributed in PR #1055 by seonwoo_jung.

• TimeBasedRollingPolicy now supports half-day periods. Date patterns with the AM/PM marker, for example %d{yyyy-MM-dd-a}, used to be detected as daily and rolled over only at midnight. They now roll over at both 00:00 and 12:00. This issue was reported in issues/976 by shakthifuture. The fix was contributed in PR #1051 by seonwoo_jung. See TimeBasedRollingPolicy.

• If org.jline.jansi.AnsiConsole cannot be found on the class path, JansiConsoleAppender now emits warnings that explain how to add org.jline:jansi-core and then writes to the plain console stream. See codes.html#missingJlineJansi.

• The unused ch.qos.logback.classic.util.LogbackMDCAdapterSimple class was removed. LogbackMDCAdapter remains the default MDC adapter.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 07d291ca0d280bc5da934ec9ff5f1da634fd7937 associated with the tag v_1.6.4. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Full Changelog: qos-ch/logback@v_1.6.3...v_1.6.4

Commits
  • d1b829d prepare release 1.6.5
  • 065b9b2 enhance protectin against mischievious MDC values in MDCBasedDiscriminator
  • b69beab complete commit in relation to discussion_1032
  • 7266c0b fix intermittently failing SocketAppenderMessageLossTest rest condition
  • a633bb0 fix intermittently failing SocketAppenderMessageLossTest rest condition
  • 2bc5bcc renamed tbrp and eclosingTBRP, other minor changes
  • 2cd8762 fix typo in AGENTS.md
  • 647846c fix errors when running tests under intellij IDEA
  • 1048917 removed ConsoleCharsetPropertyDefiner.java
  • 39b5002 added 'since' and 'forRemoval' attributes to SimpleInvocationGate @​Deprecatio...
  • Additional commits viewable in compare view

Updates io.avaje:avaje-json-core from 3.15 to 3.16

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the dependencies group across 1 directory with 18 updates
d6e4aec 
Bumps the dependencies group with 18 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) | `2.22.2` | `2.22.3` |
| io.avaje:avaje-json-node | `3.15` | `3.16` |
| [io.avaje:avaje-inject](https://github.com/avaje/avaje-inject) | `12.6` | `12.7` |
| io.avaje:avaje-inject-generator | `12.6` | `12.7` |
| io.avaje:avaje-inject-maven-plugin | `12.6` | `12.7` |
| io.avaje:avaje-inject-generator | `12.6` | `12.7` |
| io.avaje:avaje-inject-maven-plugin | `12.6` | `12.7` |
| [org.hibernate.validator:hibernate-validator](https://github.com/hibernate/hibernate-validator) | `9.1.3.Final` | `9.1.4.Final` |
| [io.avaje:avaje-validator](https://github.com/avaje/avaje-validator) | `2.17` | `2.18` |
| io.avaje:avaje-validator-constraints | `2.17` | `2.18` |
| io.avaje:avaje-validator-generator | `2.17` | `2.18` |
| io.helidon.webserver:helidon-webserver | `4.5.4` | `27.0.0` |
| io.helidon.webserver:helidon-webserver-security | `4.5.4` | `27.0.0` |
| io.helidon.http.media:helidon-http-media-jsonb | `4.5.4` | `27.0.0` |
| io.helidon.webserver:helidon-webserver-security | `4.5.4` | `27.0.0` |
| io.helidon.http.media:helidon-http-media-jsonb | `4.5.4` | `27.0.0` |
| io.avaje:avaje-nima | `1.12` | `1.14` |
| io.avaje:avaje-nima-test | `1.12` | `1.14` |
| [io.vertx:vertx-web](https://github.com/vert-x3/vertx-web) | `5.1.8` | `5.2.0` |
| org.slf4j:slf4j-jdk-platform-logging | `2.0.19` | `2.0.20` |
| [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.6.3` | `1.6.5` |
| io.avaje:avaje-json-core | `3.15` | `3.16` |



Updates `com.fasterxml.jackson.core:jackson-databind` from 2.22.2 to 2.22.3
- [Commits](FasterXML/jackson-databind@jackson-databind-2.22.2...jackson-databind-2.22.3)

Updates `io.avaje:avaje-json-node` from 3.15 to 3.16

Updates `io.avaje:avaje-inject` from 12.6 to 12.7
- [Release notes](https://github.com/avaje/avaje-inject/releases)
- [Commits](avaje/avaje-inject@12.6...12.7)

Updates `io.avaje:avaje-inject-generator` from 12.6 to 12.7

Updates `io.avaje:avaje-inject-maven-plugin` from 12.6 to 12.7

Updates `io.avaje:avaje-inject-generator` from 12.6 to 12.7

Updates `io.avaje:avaje-inject-maven-plugin` from 12.6 to 12.7

Updates `org.hibernate.validator:hibernate-validator` from 9.1.3.Final to 9.1.4.Final
- [Release notes](https://github.com/hibernate/hibernate-validator/releases)
- [Changelog](https://github.com/hibernate/hibernate-validator/blob/9.1.4.Final/changelog.md)
- [Commits](hibernate/hibernate-validator@9.1.3.Final...9.1.4.Final)

Updates `io.avaje:avaje-validator` from 2.17 to 2.18
- [Release notes](https://github.com/avaje/avaje-validator/releases)
- [Commits](avaje/avaje-validator@2.17...2.18)

Updates `io.avaje:avaje-validator-constraints` from 2.17 to 2.18

Updates `io.avaje:avaje-validator-generator` from 2.17 to 2.18

Updates `io.helidon.webserver:helidon-webserver` from 4.5.4 to 27.0.0

Updates `io.helidon.webserver:helidon-webserver-security` from 4.5.4 to 27.0.0

Updates `io.helidon.http.media:helidon-http-media-jsonb` from 4.5.4 to 27.0.0

Updates `io.helidon.webserver:helidon-webserver-security` from 4.5.4 to 27.0.0

Updates `io.helidon.http.media:helidon-http-media-jsonb` from 4.5.4 to 27.0.0

Updates `io.avaje:avaje-nima` from 1.12 to 1.14

Updates `io.avaje:avaje-nima-test` from 1.12 to 1.14

Updates `io.vertx:vertx-web` from 5.1.8 to 5.2.0
- [Commits](vert-x3/vertx-web@5.1.8...5.2.0)

Updates `org.slf4j:slf4j-jdk-platform-logging` from 2.0.19 to 2.0.20

Updates `ch.qos.logback:logback-classic` from 1.6.3 to 1.6.5
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.6.3...v_1.6.5)

Updates `io.avaje:avaje-json-core` from 3.15 to 3.16

---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.22.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.avaje:avaje-json-node
  dependency-version: '3.16'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.avaje:avaje-inject
  dependency-version: '12.7'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.avaje:avaje-inject-generator
  dependency-version: '12.7'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.avaje:avaje-inject-maven-plugin
  dependency-version: '12.7'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.avaje:avaje-inject-generator
  dependency-version: '12.7'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.avaje:avaje-inject-maven-plugin
  dependency-version: '12.7'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: org.hibernate.validator:hibernate-validator
  dependency-version: 9.1.4.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.avaje:avaje-validator
  dependency-version: '2.18'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.avaje:avaje-validator-constraints
  dependency-version: '2.18'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.avaje:avaje-validator-generator
  dependency-version: '2.18'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.helidon.webserver:helidon-webserver
  dependency-version: 27.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: io.helidon.webserver:helidon-webserver-security
  dependency-version: 27.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: io.helidon.http.media:helidon-http-media-jsonb
  dependency-version: 27.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: io.helidon.webserver:helidon-webserver-security
  dependency-version: 27.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: io.helidon.http.media:helidon-http-media-jsonb
  dependency-version: 27.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: io.avaje:avaje-nima
  dependency-version: '1.14'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.avaje:avaje-nima-test
  dependency-version: '1.14'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.vertx:vertx-web
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: org.slf4j:slf4j-jdk-platform-logging
  dependency-version: 2.0.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.avaje:avaje-json-core
  dependency-version: '3.16'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 7, 2026
@github-actions
github-actions Bot enabled auto-merge October 7, 2026 20:07
@dependabot @github

dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 14, 2026
auto-merge was automatically disabled October 14, 2026 20:44

Pull request was closed

@dependabot
dependabot Bot deleted the dependabot/maven/master/dependencies-2973edbc04 branch October 14, 2026 20:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants