Skip to content

Bump the maven-minor-updates group across 2 directories with 14 updates - #423

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/maven-minor-updates-0db22ccbf4
Closed

Bump the maven-minor-updates group across 2 directories with 14 updates#423
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/maven-minor-updates-0db22ccbf4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the maven-minor-updates group with 10 updates in the / directory:

Package From To
org.jspecify:jspecify 1.0.0 1.0.1
com.github.spotbugs:spotbugs-annotations 4.10.3 4.10.4
com.google.guava:guava 33.6.0-jre 33.7.1-jre
joda-time:joda-time 2.14.2 2.14.3
org.yaml:snakeyaml 2.6 2.7
org.springframework.cloud:spring-cloud-dependencies 2025.0.0 2025.1.3
commons-io:commons-io 2.17.0 2.22.0
io.netty:netty-bom 4.1.135.Final 4.2.17.Final
org.apache.maven:apache-maven 3.9.9 3.9.16
org.apache.maven.wrapper:maven-wrapper 3.3.2 3.3.4

Bumps the maven-minor-updates group with 4 updates in the /log4j-samples-graalvm directory: org.junit:junit-bom, ch.qos.logback:logback-classic, net.javacrumbs.json-unit:json-unit-assertj and org.graalvm.buildtools:native-maven-plugin.

Updates org.jspecify:jspecify from 1.0.0 to 1.0.1

Release notes

Sourced from org.jspecify:jspecify's releases.

1.0.1

JSpecify 1.0.1 makes small changes to documentation and build setup but no semantic changes.

Artifacts

Changes since version 1.0.0

  • The JSpecify module-info.class is now present at the root of the jar instead of under a multi-release root. This prevents the jar from containing a file at META-INF/versions/9/OSGI-INF/MANIFEST.MF, which was causing trouble for some users, particularly on Android.
  • The JSpecify module-info.class now contains its version number.
  • We have made various improvements to our Javadoc. While the latest docs are always available at jspecify.dev/docs/api, this release makes our improvements visible in the source files in your IDE.
Commits
  • ce9bec0 Set version to 1.0.1.
  • 7c7f0cf Migrate to com.vanniktech.maven.publish.
  • 2789f67 Bump yaml from 1.10.2 to 1.10.3 in /docs (#853)
  • 1638ca0 Bump svgo from 3.3.2 to 3.3.4 in /docs (#852)
  • 4e80178 Place module-info in the root of the jar. (#809)
  • 5b679e0 Codex found a few more questions the FAQ already answers. (#848)
  • 2019899 Link to the new location of the design FAQ and to specific sections. (#845)
  • f01eac9 batch of javadoc revisions for clarity and completeness (#671)
  • c4eff31 Import the nullness design FAQ as Markdown. (#838)
  • 75fb9cf Bump websocket-driver from 0.7.4 to 0.7.5 in /docs (#835)
  • Additional commits viewable in compare view

Updates com.github.spotbugs:spotbugs-annotations from 4.10.3 to 4.10.4

Release notes

Sourced from com.github.spotbugs:spotbugs-annotations's releases.

4.10.4

SpotBugs 4.10.4

CHANGELOG

Fixed

  • Fix NN_NAKED_NOTIFY false negatives when a field read is stored in a local variable before notify() or notifyAll() (#3884)
  • Fix ASE_ASSERTION_WITH_SIDE_EFFECT and ASE_ASSERTION_WITH_SIDE_EFFECT_METHOD false positives in every method analysed after a method that reads $assertionsDisabled without throwing an AssertionError (#3483)
  • Fix INT_BAD_COMPARISON_WITH_SIGNED_BYTE false positive for meaningful comparisons of a signed byte with 127 (b < 127, b >= 127) (#4201)
  • Fix EI_EXPOSE_REP false negative for public getters in anonymous classes (#4237)
  • Fix missing class report for java.util.Collections$EmptyNavigableSet and java.util.Collections$EmptyNavigableMap when the result of Collections.emptySortedSet(), emptyNavigableSet(), emptySortedMap() or emptyNavigableMap() is stored (#4244)
  • Fix URF_UNREAD_FIELD false negative for unread instance fields declared in enums (#4246)
  • Stop publishing global dependency-management constraints to consumer POMs. (#4223)

CHECKSUM

file checksum (sha256)
spotbugs-4.10.4-javadoc.jar 06bfc9ccdcfb9b594b5053817199b9489dff6312dc35c8864faa9b9357cf5be4
spotbugs-4.10.4-sources.jar d087c11e3b0714e8445b29f2bef9bb4c62b4ee13ad67caf7a4b64d61e82ea400
spotbugs-4.10.4.tgz 72bc0d4edd686e462c0f71f42a049b27bf4da6708797ff7b2b56dd202714b4e5
spotbugs-4.10.4.zip 771c8702beb2b4b6aa20df87ea85f22fda7280c7ce36fce4077b7b3c076d1e14
spotbugs-annotations-4.10.4-javadoc.jar 0fc9d3c529c6ee93aeddf9cfbd4b1438708e37fd53b5157aa47070446fbc7303
spotbugs-annotations-4.10.4-sources.jar 87974d23caffbc8c6e66c567747627267b5ed06573cee966d7af6d236b8d65bd
spotbugs-annotations.jar 28fa4befaddce5d7b79b07c68e7c12fa27c5d9282c4229528717971606661ea3
spotbugs-ant-4.10.4-javadoc.jar eaa1ee0a4e004b7b12e2dfc65290c6324effff6ffc0e7b7ee94c98875997e51c
spotbugs-ant-4.10.4-sources.jar af1c78c8e194c2f82ea3e0517ab38a5eb6ba608c8d0e776c9097605d6b7efca6
spotbugs-ant.jar 9ec240477b7c87270be7dfe3196180cd3763f04c369e5691feeb12e66110a065
spotbugs.jar a88cad2e0ea9bb74b908ce82ae89416c61fa8f8ea5cfcc9368b1baac2da878d2
test-harness-4.10.4-javadoc.jar c1ff7bcd0c4f61f4356ae9734be34567df680175651a3104fdee241e324d6df7
test-harness-4.10.4-sources.jar 805d2d124b0d4ea513ee9262d4ad6027c3471d45defd80fd7d20e23425d17df7
test-harness-4.10.4.jar bd10d1f11a1b93e4ca4db4d27772f611bd3407f9452dbbd2d1ba62584ddc171f
test-harness-core-4.10.4-javadoc.jar ac735a1508609001d122a91e43f6dfb10c4c691cf555d5ba386f216df904ac9b
test-harness-core-4.10.4-sources.jar 043a55d99a517c0d9cf702b0c183b4afd3f03af9eff4a86d59bb37df1b35b532
test-harness-core-4.10.4.jar 1f9a0ee8f150dd71f960ca4f59dcf7912a45d0e9e6aefc4585fd44b975454bc0
test-harness-jupiter-4.10.4-javadoc.jar c9554b4a6509d0d24c6436b6e01171eb8e71fca96df6edf8f80c7b51ab5bda16
test-harness-jupiter-4.10.4-sources.jar 17144f315686bfd01c02fa4ae7c916060c41de8eed58d5b8470416fa08f46ced
test-harness-jupiter-4.10.4.jar a91146da3e993479cfefd2690781cbd102c6360ecc63a96d88995be3bd60fcbb
Changelog

Sourced from com.github.spotbugs:spotbugs-annotations's changelog.

4.10.4 - 2026-08-19

Fixed

  • Fix NN_NAKED_NOTIFY false negatives when a field read is stored in a local variable before notify() or notifyAll() (#3884)
  • Fix ASE_ASSERTION_WITH_SIDE_EFFECT and ASE_ASSERTION_WITH_SIDE_EFFECT_METHOD false positives in every method analysed after a method that reads $assertionsDisabled without throwing an AssertionError (#3483)
  • Fix INT_BAD_COMPARISON_WITH_SIGNED_BYTE false positive for meaningful comparisons of a signed byte with 127 (b < 127, b >= 127) (#4201)
  • Fix EI_EXPOSE_REP false negative for public getters in anonymous classes (#4237)
  • Fix missing class report for java.util.Collections$EmptyNavigableSet and java.util.Collections$EmptyNavigableMap when the result of Collections.emptySortedSet(), emptyNavigableSet(), emptySortedMap() or emptyNavigableMap() is stored (#4244)
  • Fix URF_UNREAD_FIELD false negative for unread instance fields declared in enums (#4246)
  • Stop publishing global dependency-management constraints to consumer POMs. (#4223)
Commits
  • 1a58a48 release v4.10.4
  • 160d4a6 Gradle build cleanup (#4255)
  • 2354168 Fix EI_EXPOSE_REP not reported for anonymous-class getters (#4237)
  • 4895bce Fix naked notify detection after local stores (#4245)
  • 28348e5 Fixes #3955 : Fix URF_UNREAD_FIELD false negative for unread fields i… (#4246)
  • 3ec259e chore(build): Add changelog regarding dependency management constraints remov...
  • 33075ce Remove eclipse table latest as noted version 3.1 that is long retired and dis...
  • 1bf27d8 Update Gradle to v9.7.1 (#4252)
  • ee61d5b Update dependency com.google.guava:guava to v33.7.1-jre (#4250)
  • f352226 Update plugin com.diffplug.spotless to v8.10.0 (#4249)
  • Additional commits viewable in compare view

Updates com.google.guava:guava from 33.6.0-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

Javadoc

JDiff

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
</tr></table>

... (truncated)

Commits

Updates joda-time:joda-time from 2.14.2 to 2.14.3

Release notes

Sourced from joda-time:joda-time's releases.

Release v2.14.3

See the change notes for more information.

What's Changed

Full Changelog: JodaOrg/joda-time@v2.14.2...v2.14.3

Commits

Updates org.yaml:snakeyaml from 2.6 to 2.7

Updates org.springframework.cloud:spring-cloud-dependencies from 2025.0.0 to 2025.1.3

Release notes

Sourced from org.springframework.cloud:spring-cloud-dependencies's releases.

v2025.1.3

Security

This release train contains fixes for 17 CVEs across 5 modules.

Spring Cloud Commons 5.0.3

  • CVE-2026-59284 — Spring Cloud Commons no allow list for writable env actuator endpoint

Spring Cloud Config 5.0.5

  • CVE-2026-47836 — Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
  • CVE-2026-47837 — Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
  • CVE-2026-47894 — Spring Cloud Config Server Native Environment Repository Exposure
  • CVE-2026-59315 — Spring Cloud Config Monitor Denial of Service

Spring Cloud Function 5.0.4

  • CVE-2026-59291 — Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function
  • CVE-2026-59297 — Spring Cloud Function can incorrectly determine if URI is secure
  • CVE-2026-59298 — Potential for improper filtering of HTTP headers in Spring Cloud Function
  • CVE-2026-59299 — Composition lookup can potentially poison base function in Spring Cloud Function
  • CVE-2026-59300 — Potential for logging sensitive data in Spring Cloud Function AWS
  • CVE-2026-59301 — Potential for logging sensitive data in Spring Cloud Function Azure

Spring Cloud Gateway 5.0.3

  • CVE-2026-47879 — Spring Cloud Gateway SSRF and native file access with gRPC

Spring Cloud Stream 5.0.3

  • CVE-2026-59302 — Potential for logging sensitive data in Spring Cloud Stream
  • CVE-2026-59303 — Dynamic destination cache size is not properly bound in Spring Cloud Stream
  • CVE-2026-59304 — Improper caching of the original content type in Spring Cloud Stream Avro
  • CVE-2026-59305 — Partition interceptor may be improperly added while sending message
  • CVE-2026-59306 — Potential for deserialization of untrusted types in Spring Cloud Stream

What's Included

  • Spring Cloud Build 5.0.3 (issues)
  • Spring Cloud Function 5.0.4 (issues)
  • Spring Cloud Stream 5.0.3 (issues)
  • Spring Cloud Commons 5.0.3 (issues)
  • Spring Cloud Bus 5.0.3 (issues)
  • Spring Cloud Task 5.0.2 (issues)
  • Spring Cloud Config 5.0.5 (issues)
  • Spring Cloud Netflix 5.0.2 (issues)
  • Spring Cloud Openfeign 5.0.3 (issues)
  • Spring Cloud Consul 5.0.3 (issues)
  • Spring Cloud Circuitbreaker 5.0.3 (issues)
  • Spring Cloud Gateway 5.0.3 (issues)

... (truncated)

Commits
  • d52d95a Release 2025.1.3
  • 5ba4ec5 Initialize commercial release branch
  • 7e855d0 Update versions for 2025.1.3-INTERNAL-SNAPSHOT
  • 22ebee1 Add commercial release CI files [skip actions]
  • 3c1c981 Merge pull request #534 from spring-cloud/dependabot/npm_and_yarn/docs/main/s...
  • b79bd77 Bump @​springio/antora-extensions from 1.14.12 to 1.14.13 in /docs
  • 65eb111 Use canonical deploy-docs trigger workflow [skip actions]
  • 7501938 Merge pull request #532 from spring-cloud/dependabot/maven/main/com.github.jk...
  • e3b2779 Merge pull request #533 from spring-cloud/dependabot/maven/com.github.jknack-...
  • 791fbef Bump com.github.jknack:handlebars from 4.5.3 to 4.5.4
  • Additional commits viewable in compare view

Updates commons-io:commons-io from 2.17.0 to 2.22.0

Updates io.netty:netty-bom from 4.1.135.Final to 4.2.17.Final

Release notes

Sourced from io.netty:netty-bom's releases.

netty-4.2.17.Final

What's Changed

New Contributors

... (truncated)

Commits
  • e0789d3 [maven-release-plugin] prepare release netty-4.2.17.Final
  • 1b5abc6 Merge changes from forks (#17213)
  • 36fbf57 Update surefire plugin to latest version (#17210)
  • a96226c Add .editorconfig to enforce consistent coding style (#17052)
  • 14a4e6a OpenSSL: Allow to obtain used named group via OpenSslSession (#17058)
  • 26255b1 Weakly reference engines from the OpenSSL engine map (#17199)
  • ae41417 HttpServerCodec: do not consume the method queue for 1xx interim responses ...
  • 41f1db5 Do not write WebSocket handshake response to the tail of the pipeline (#17192)
  • 035d76e Update compress-lzf to 1.2.1 (#17194)
  • 7681aff Fix JdkZlibDecompressor losing the tail of highly compressible streams (#17191)
  • Additional commits viewable in compare view

Updates org.apache.maven:apache-maven from 3.9.9 to 3.9.16

Updates org.apache.maven.wrapper:maven-wrapper from 3.3.2 to 3.3.4

Release notes

Sourced from org.apache.maven.wrapper:maven-wrapper's releases.

3.3.4

🐛 Bug Fixes

👻 Maintenance

  • Ensure Path Traversal is fully addressed in MavenWrapperDownloader (#363) @​hazendaz

3.3.3

💥 Breaking changes

🚀 New features and improvements

  • Fix Maven wrapper support for snapshot distributions (#335) @​gnodet

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

... (truncated)

Commits
  • 524486a [maven-release-plugin] prepare release maven-wrapper-3.3.4
  • 17c1ec9 Revert wrapper version removal (#365)
  • 366207f Ensure Path Traversal is fully addressed in MavenWrapperDownloader
  • 086b1c9 [maven-release-plugin] prepare for next development iteration
  • e2a0c81 [maven-release-plugin] prepare release maven-wrapper-3.3.3
  • 80952cd Clarify usage of MAVEN_USER_HOME
  • 08e7200 Remove wrapper lifecycle
  • 36886fa Support for snapshot distributions - fix (#352)
  • d02d845 Use invoker version from parent
  • af7671b Bump mavenVersion from 3.9.6 to 3.9.11 (#360)
  • Additional commits viewable in compare view

Updates org.junit:junit-bom from 6.1.2 to 6.1.3

Release notes

Sourced from org.junit:junit-bom's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

Commits
  • f59f60d Release 6.1.3
  • cd8ec92 Finalize 6.1.3 release notes
  • c8729f2 Restore compatibility with GraalVM 25 (#5901)
  • ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
  • fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
  • 62afc02 Delay GraalVM plugin updates for 3 days
  • 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
  • f6bbfc5 Move GraalVM tests to separate test task (#5903)
  • e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
  • 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
  • Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.6.0 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

  • In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

  • Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

  • The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

  • ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

  • Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

  • The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

-- Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

  • Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

  • Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

    <property name="logback.skipCallerContradictionAnalysis" value="true"/>

  • SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

  • Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

  • Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

  • Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

... (truncated)

Commits
  • e8e824d prepare release 1.6.3
  • 761821b MDCBasedDiscriminator has a gated warning mechanism
  • 53ed122 update copyright year
  • c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
  • b5aa931 added BatchedSimpleInvocationGate
  • 1f22af7 add javadocs to SimpleInvocationGate
  • 638ffa7 prevent forward and backward slashes to escape to other directories
  • 7d6b9a4 add missing ch.qos.logback.core.property package
  • fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
  • c73b43f deprecate the withJansi path
  • Additional commits viewable in compare view

Updates net.javacrumbs.json-unit:json-unit-assertj from 6.0.1 to 6.2.0

Changelog

Sourced from net.javacrumbs.json-unit:json-unit-assertj's changelog.

6.2.0 (2026-08-13)

  • Support for AssertJ conditions
  • Dependency updates

6.1.0 (2026-08-10)

  • Support for ${json-unit.missing-or-null}
  • Dependency updates
Commits
  • 1edc249 [maven-release-plugin] prepare release json-unit-parent-6.2.0
  • b8466c1 Fix release
  • 6fb3418 [maven-release-plugin] rollback the release of json-unit-parent-6.2.0
  • 793592f [maven-release-plugin] prepare for next development iteration
  • 507fcc4 [maven-release-plugin] prepare release json-unit-parent-6.2.0
  • 276601f Spotless
  • 327f5f3 #1056 Drop notNull condition
  • 43c0d78 #1056 rename conditions
  • 02a8324 #1056 support for conditions
  • e750f46 Drop oss-parent
  • Additional commits viewable in compare view

Updates org.graalvm.buildtools:native-maven-plugin from 1.1.5 to 1.1.11

Release notes

Sourced from org.graalvm.buildtools:native-maven-plugin's releases.

1.1.11

What's Changed

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 7, 2026
@ramanathan1504

ramanathan1504 commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/maven/maven-minor-updates-0db22ccbf4 branch from 46eb0e4 to 9259b9f Compare September 8, 2026 03:15
@ramanathan1504

ramanathan1504 commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/maven/maven-minor-updates-0db22ccbf4 branch from 9259b9f to 2f0c134 Compare September 8, 2026 03:23
@ramanathan1504

ramanathan1504 commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

@dependabot recreate

@dependabot
Bump the maven-minor-updates group across 2 directories with 14 updates
8573f62 
Bumps the maven-minor-updates group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [org.jspecify:jspecify](https://github.com/jspecify/jspecify) | `1.0.0` | `1.0.1` |
| [com.github.spotbugs:spotbugs-annotations](https://github.com/spotbugs/spotbugs) | `4.10.3` | `4.10.4` |
| [com.google.guava:guava](https://github.com/google/guava) | `33.6.0-jre` | `33.7.1-jre` |
| [joda-time:joda-time](https://github.com/JodaOrg/joda-time) | `2.14.2` | `2.14.3` |
| org.yaml:snakeyaml | `2.6` | `2.7` |
| [org.springframework.cloud:spring-cloud-dependencies](https://github.com/spring-cloud/spring-cloud-release) | `2025.0.0` | `2025.1.3` |
| commons-io:commons-io | `2.17.0` | `2.22.0` |
| [io.netty:netty-bom](https://github.com/netty/netty) | `4.1.135.Final` | `4.2.17.Final` |
| org.apache.maven:apache-maven | `3.9.9` | `3.9.16` |
| [org.apache.maven.wrapper:maven-wrapper](https://github.com/apache/maven-wrapper) | `3.3.2` | `3.3.4` |

Bumps the maven-minor-updates group with 4 updates in the /log4j-samples-graalvm directory: [org.junit:junit-bom](https://github.com/junit-team/junit-framework), [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback), [net.javacrumbs.json-unit:json-unit-assertj](https://github.com/lukas-krecan/JsonUnit) and [org.graalvm.buildtools:native-maven-plugin](https://github.com/graalvm/native-build-tools).


Updates `org.jspecify:jspecify` from 1.0.0 to 1.0.1
- [Release notes](https://github.com/jspecify/jspecify/releases)
- [Commits](jspecify/jspecify@v1.0.0...v1.0.1)

Updates `com.github.spotbugs:spotbugs-annotations` from 4.10.3 to 4.10.4
- [Release notes](https://github.com/spotbugs/spotbugs/releases)
- [Changelog](https://github.com/spotbugs/spotbugs/blob/master/CHANGELOG.md)
- [Commits](spotbugs/spotbugs@4.10.3...4.10.4)

Updates `com.google.guava:guava` from 33.6.0-jre to 33.7.1-jre
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

Updates `joda-time:joda-time` from 2.14.2 to 2.14.3
- [Release notes](https://github.com/JodaOrg/joda-time/releases)
- [Changelog](https://github.com/JodaOrg/joda-time/blob/main/RELEASE-NOTES.txt)
- [Commits](JodaOrg/joda-time@v2.14.2...v2.14.3)

Updates `org.yaml:snakeyaml` from 2.6 to 2.7

Updates `org.springframework.cloud:spring-cloud-dependencies` from 2025.0.0 to 2025.1.3
- [Release notes](https://github.com/spring-cloud/spring-cloud-release/releases)
- [Changelog](https://github.com/spring-cloud/spring-cloud-release/blob/main/release-train-settings.xml)
- [Commits](spring-cloud/spring-cloud-release@v2025.0.0...v2025.1.3)

Updates `commons-io:commons-io` from 2.17.0 to 2.22.0

Updates `io.netty:netty-bom` from 4.1.135.Final to 4.2.17.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.135.Final...netty-4.2.17.Final)

Updates `org.apache.maven:apache-maven` from 3.9.9 to 3.9.16

Updates `org.apache.maven.wrapper:maven-wrapper` from 3.3.2 to 3.3.4
- [Release notes](https://github.com/apache/maven-wrapper/releases)
- [Commits](apache/maven-wrapper@maven-wrapper-3.3.2...maven-wrapper-3.3.4)

Updates `org.junit:junit-bom` from 6.1.2 to 6.1.3
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](junit-team/junit-framework@r6.1.2...r6.1.3)

Updates `ch.qos.logback:logback-classic` from 1.6.0 to 1.6.3
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.6.0...v_1.6.3)

Updates `net.javacrumbs.json-unit:json-unit-assertj` from 6.0.1 to 6.2.0
- [Changelog](https://github.com/lukas-krecan/JsonUnit/blob/master/RELEASES.md)
- [Commits](lukas-krecan/JsonUnit@json-unit-parent-6.0.1...json-unit-parent-6.2.0)

Updates `org.graalvm.buildtools:native-maven-plugin` from 1.1.5 to 1.1.11
- [Release notes](https://github.com/graalvm/native-build-tools/releases)
- [Commits](graalvm/native-build-tools@1.1.5...1.1.11)

---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-updates
- dependency-name: com.github.spotbugs:spotbugs-annotations
  dependency-version: 4.10.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-updates
- dependency-name: com.google.guava:guava
  dependency-version: 33.7.1-jre
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-updates
- dependency-name: commons-io:commons-io
  dependency-version: 2.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-updates
- dependency-name: io.netty:netty-bom
  dependency-version: 4.2.17.Final
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-updates
- dependency-name: joda-time:joda-time
  dependency-version: 2.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-updates
- dependency-name: net.javacrumbs.json-unit:json-unit-assertj
  dependency-version: 6.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor-updates
- dependency-name: org.apache.maven.wrapper:maven-wrapper
  dependency-version: 3.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-updates
- dependency-name: org.apache.maven:apache-maven
  dependency-version: 3.9.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-updates
- dependency-name: org.graalvm.buildtools:native-maven-plugin
  dependency-version: 1.1.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-updates
- dependency-name: org.jspecify:jspecify
  dependency-version: 1.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-updates
- dependency-name: org.junit:junit-bom
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-updates
- dependency-name: org.springframework.cloud:spring-cloud-dependencies
  dependency-version: 2025.1.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-updates
- dependency-name: org.yaml:snakeyaml
  dependency-version: '2.7'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-updates
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
dependabot Bot force-pushed the dependabot/maven/maven-minor-updates-0db22ccbf4 branch from 2f0c134 to 8573f62 Compare September 8, 2026 10:13
@ramanathan1504 ramanathan1504 mentioned this pull request Sep 8, 2026
Merged
@dependabot @github

dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer being updated by Dependabot, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 9, 2026
@dependabot
dependabot Bot deleted the dependabot/maven/maven-minor-updates-0db22ccbf4 branch September 9, 2026 07:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ramanathan1504