Skip to content

build(deps): bump the maven-non-major group with 34 updates - #530

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/maven-non-major-c7a0d304d2
Closed

build(deps): bump the maven-non-major group with 34 updates#530
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/maven-non-major-c7a0d304d2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the maven-non-major group with 34 updates:

Package From To
org.projectlombok:lombok 1.18.46 1.18.48
com.google.errorprone:error_prone_annotations 2.42.0 2.50.0
com.google.errorprone:error_prone_core 2.42.0 2.50.0
org.slf4j:slf4j-api 2.0.18 2.0.20
ch.qos.logback:logback-classic 1.6.1 1.6.5
ch.qos.logback:logback-core 1.6.1 1.6.5
org.mockito:mockito-core 5.23.0 5.24.0
org.mockito:mockito-junit-jupiter 5.23.0 5.24.0
com.tngtech.archunit:archunit-junit5 1.4.2 1.5.1
io.netty:netty-bom 4.1.138.Final 4.2.19.Final
at.yawk.lz4:lz4-java 1.11.2 1.12.0
org.apache.commons:commons-lang3 3.20.0 3.21.0
com.google.guava:guava 33.6.0-jre 33.7.2-jre
com.uber.nullaway:nullaway 0.12.7 0.14.2
com.github.spotbugs:spotbugs 4.10.3 4.10.5
org.apache.maven.plugins:maven-compiler-plugin 3.15.0 3.16.0
org.codehaus.mojo:exec-maven-plugin 3.5.0 3.6.4
org.apache.maven.plugins:maven-surefire-plugin 3.5.6 3.6.0
org.apache.maven.plugins:maven-failsafe-plugin 3.5.6 3.6.0
de.thetaphi:forbiddenapis 3.10 3.11
com.github.spotbugs:spotbugs-maven-plugin 4.10.3.0 4.10.5.0
org.pitest:pitest-maven 1.25.8 1.30.0
org.codehaus.mojo:build-helper-maven-plugin 3.6.1 3.6.2
org.codehaus.mojo:versions-maven-plugin 2.21.0 2.23.0
org.apache.maven.plugins:maven-install-plugin 3.1.4 3.2.0
org.apache.maven.plugins:maven-deploy-plugin 3.1.4 3.2.0
org.postgresql:postgresql 42.7.13 42.7.14
org.ow2.asm:asm 9.9.1 9.11
io.vertx:vertx-web-client 4.5.31 4.5.35
io.vertx:vertx-junit5 4.5.31 4.5.35
com.fasterxml.jackson.core:jackson-databind 2.18.10 2.18.11
com.fasterxml.jackson:jackson-bom 2.18.10 2.18.11
org.apache.maven:apache-maven 3.9.0 3.10.0
org.apache.maven.wrapper:maven-wrapper 3.2.0 3.3.4

Updates org.projectlombok:lombok from 1.18.46 to 1.18.48

Changelog

Sourced from org.projectlombok:lombok's changelog.

v1.18.48 (September 1st, 2026)

  • BREAKING CHANGE/BUGFIX: @Builder(builderClassName = "Builder") now generates an error, because the type names collide. #3857 (found after release)
  • PLATFORM: JDK27 support added #4072.
  • BUGFIX: @SneakyThrows usage on JDK26 no longer results in class files that require lombok.jar to be on the runtime classpath (which should not be neccessary). #4040.
  • FEATURE: New config key lombok.checkReturnValueAnnotation (values: none, lombok; default: none) lets lombok generate @lombok.CheckReturnValue on generated methods where the return value should not be ignored, such as @With methods and @Builder.build(). A future lombok release may flip the default to lombok. #4013.
  • PROMOTION: @SuperBuilder has been promoted to the main package. Otherwise, no changes have been made to the annotation. The old experimental annotation will remain for a few versions, at which point it will be marked as a deprecated annotation. Eventually it'll be removed. If you had lombok.config configuration for this annotation, the configuration keys for this feature have been renamed. #2209.
  • OLD-CRUFT: lombok.experimental.Wither and lombok.Delegate are deprecated remnants; these features were moved (to respectively lombok.With and lombok.experimental.Delegate over 5 years ago. They are now removed entirely. If your project is dependent on an older version of lombok which still has those; fret not, lombok still processes these annotations. It just no longer includes them in the jar.
  • FEATURE: CheckerFramework: Lombok now adds @SideEffectFree to constructors it makes if you have enabled checker framework via lombok.config.
  • BUGFIX: CheckerFramework: Lombok would add @SideEffectFree to the build() method of any generated builder, even if it is a builder for invoking a method; in that case, the side-effect-free nature of build() mirrors the side-effect-free nature of the method invocation you've built. Lombok now checks if the method it generated a builder for is side effect free / 'check return type'.
Commits
  • b48657c [version] pre-release version bump v1.18.48
  • d1d0039 Merge branch 'jdk27'
  • 1a23dad [review][refactor] No meaningful changes: Improved comments, javadoc, and cle...
  • 40cdde8 [changelog] JDK27 support
  • 25eae29 Add Danish Nawab to AUTHORS
  • 10ab92b Support JDK27: end positions moved from EndPosTable to JCTree.endpos
  • af01b7a Document the new configuration syntax for listy things
  • 1be3857 There is no more HtAccess
  • 405985d Semantic sections for website
  • 04b7340 [trivial] fixing some outdated tests (tests were broken, not lombok).
  • Additional commits viewable in compare view

Updates com.google.errorprone:error_prone_annotations from 2.42.0 to 2.50.0

Release notes

Sourced from com.google.errorprone:error_prone_annotations's releases.

Error Prone 2.50.0

New checks:

Closed issues: #5553, #5649, #5778

Full changelog: google/error-prone@v2.49.0...v2.50.0

Error Prone 2.49.0

This release includes several changes to Matcher APIs, and removed some deprecated or problematic APIs:

  • Remove deprecated MethodMatchers.withSignature API, which relies on fragile toString behaviour. Alternatives for matching on method signatures with varargs and type parameters were added in google/error-prone@a98a1c5.
  • Removed variableType(Matcher) API. Matchers.variableType(Matcher) uses VariableTree#getType to match variable types, which own't work for lambda parameters with inferred types after JDK-8268850. The recommended replacement is variableType(TypePredicate).
  • Make enclosingPackage return an optional. Module elements are not enclosed by a package, checks using enclosingPackage shouldn't assume an enclosing package exists when processing arbitrary elements.
  • New FieldMatchers API, similar to MethodMatchers (google/error-prone@1dd9c3a).

New checks:

Closed issues: #2283, #3503, #5210, #5289, #5548, #5548, #5554, #5609, #5614, #5656

Full changelog: google/error-prone@v2.48.0...v2.49.0

Error Prone 2.48.0

Changes:

New checks:

Closed issues: #5529, #5537, #5522, #5521

Full changelog: google/error-prone@v2.47.0...v2.48.0

... (truncated)

Commits
  • d802cff Release Error Prone 2.50.0
  • b12b5f2 In StringCharset, move the description from explanation to summary.
  • a7ca02a Update AssertThrowsUtils to emit var thrown = assertThrows(...) instead o...
  • 6b56517 Fix handling of nested tags in UnrecognisedJavadocTag
  • d36e74f Remove translation of the fail() message into assertThrows(). We already ...
  • c3581e9 Fix JavacFileManager compiler crash during speculative recompiles in modular ...
  • da1f32b Remove assignments from assertThrows() lambdas. A large percentage of remai...
  • dee62f7 Update AssertThrowsBlockToExpression to re-write single VariableTrees int...
  • 4939448 Only hoist the last statement into the assertThrows() lambda.
  • 30fd05a refactor: Rename JavaLangClash bug pattern to AvoidCommonTypeNames
  • Additional commits viewable in compare view

Updates com.google.errorprone:error_prone_core from 2.42.0 to 2.50.0

Release notes

Sourced from com.google.errorprone:error_prone_core's releases.

Error Prone 2.50.0

New checks:

Closed issues: #5553, #5649, #5778

Full changelog: google/error-prone@v2.49.0...v2.50.0

Error Prone 2.49.0

This release includes several changes to Matcher APIs, and removed some deprecated or problematic APIs:

  • Remove deprecated MethodMatchers.withSignature API, which relies on fragile toString behaviour. Alternatives for matching on method signatures with varargs and type parameters were added in google/error-prone@a98a1c5.
  • Removed variableType(Matcher) API. Matchers.variableType(Matcher) uses VariableTree#getType to match variable types, which own't work for lambda parameters with inferred types after JDK-8268850. The recommended replacement is variableType(TypePredicate).
  • Make enclosingPackage return an optional. Module elements are not enclosed by a package, checks using enclosingPackage shouldn't assume an enclosing package exists when processing arbitrary elements.
  • New FieldMatchers API, similar to MethodMatchers (google/error-prone@1dd9c3a).

New checks:

Closed issues: #2283, #3503, #5210, #5289, #5548, #5548, #5554, #5609, #5614, #5656

Full changelog: google/error-prone@v2.48.0...v2.49.0

Error Prone 2.48.0

Changes:

New checks:

Closed issues: #5529, #5537, #5522, #5521

Full changelog: google/error-prone@v2.47.0...v2.48.0

... (truncated)

Commits
  • d802cff Release Error Prone 2.50.0
  • b12b5f2 In StringCharset, move the description from explanation to summary.
  • a7ca02a Update AssertThrowsUtils to emit var thrown = assertThrows(...) instead o...
  • 6b56517 Fix handling of nested tags in UnrecognisedJavadocTag
  • d36e74f Remove translation of the fail() message into assertThrows(). We already ...
  • c3581e9 Fix JavacFileManager compiler crash during speculative recompiles in modular ...
  • da1f32b Remove assignments from assertThrows() lambdas. A large percentage of remai...
  • dee62f7 Update AssertThrowsBlockToExpression to re-write single VariableTrees int...
  • 4939448 Only hoist the last statement into the assertThrows() lambda.
  • 30fd05a refactor: Rename JavaLangClash bug pattern to AvoidCommonTypeNames
  • Additional commits viewable in compare view

Updates org.slf4j:slf4j-api from 2.0.18 to 2.0.20

Updates ch.qos.logback:logback-classic from 1.6.1 to 1.6.5

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.5

2026-09-30 Release of logback version 1.6.5

• Fixed a vulnerability CVE-2026-104721 closely related to CVE-2026-19880. The fix in version 1.6.3, which strips forward and backward slashes from MDC values, was insufficient. An MDC value could still contain relative path components such as .., variable references such as /, or characters that are special in file name patterns and email addresses. This latest vulnerability was found and reported by François Martin (GitHub: @​martinfrancois, https://github.com/martinfrancois).

MDCBasedDiscriminator, used by SiftingAppender, now rejects MDC values instead of stripping characters from them. An MDC value is rejected if it is empty, if it is longer than 64 characters, if it contains the sequence .., or if it contains any of the following characters: / \ $ { } [ ] ( ) | ? * + % , @. When an MDC value is rejected, the discriminator returns the value of its DefaultValue property. A warning is emitted for each rejected value. These warnings are rate-limited.

• When compression is enabled, TimeBasedRollingPolicy and SizeAndTimeBasedRollingPolicy now also remove old log files that were never compressed, for example because the application was not running at rollover time. Previously, such files were ignored by maxHistory and accumulated indefinitely. This issue was discussed in discussions/1032. See TimeBasedRollingPolicy.

• SimpleInvocationGate, deprecated in version 1.6.3, is now marked for removal. Use FixedIntervalInvocationGate instead.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit d1b829dcdb9fd98511c64401beb1419a9c9384aa associated with the tag v_1.6.5. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.4

2026-09-24 Release of logback version 1.6.4

• Variable substitution is again applied to the scan attribute of the <configuration> element. The scanning refactoring in version 1.5.27 had dropped substitution, so values such as ${logback.scan.enabled:-true} were no longer resolved. As before version 1.5.27, an unrecognized non-empty value turns scanning on. The same substitution now applies to the scan attribute of <propertiesConfigurator>. This regression was reported in issues/1065 by vaibhavjain2.

• OutputStreamAppender and FileAppender now handle stateful encoders. The Encoder interface has a new default method called isStateful(), which returns false. An encoder that keeps state between calls to encode() can return true. For such encoders, the appender holds its write lock while encoding and while writing, so the output of concurrent appends cannot interleave. Stateless encoders still encode outside the lock, so their performance does not change. Existing encoders need no changes.

• Several race conditions in OutputStreamAppender and FileAppender were fixed. The appender is now marked started and the encoder header is written while the same lock is held, so a concurrent append can no longer write an event before the header. After acquiring the lock, the appender checks again whether it has been stopped, so no event is written after the footer. In prudent mode, FileAppender now encodes and writes each event while holding the lock.

• Fixed a data race on the logger count in LoggerContext. Loggers are created under the lock of their parent logger, so loggers with different parents could be created at the same time and increments of the shared counter could be lost. As a result, LoggerContext.size() could return a value lower than the actual number of loggers. The counter is now an AtomicInteger. This issue was reported in issues/1038 by hcantunc. The fix was contributed in PR #1055 by seonwoo_jung.

• TimeBasedRollingPolicy now supports half-day periods. Date patterns with the AM/PM marker, for example %d{yyyy-MM-dd-a}, used to be detected as daily and rolled over only at midnight. They now roll over at both 00:00 and 12:00. This issue was reported in issues/976 by shakthifuture. The fix was contributed in PR #1051 by seonwoo_jung. See TimeBasedRollingPolicy.

• If org.jline.jansi.AnsiConsole cannot be found on the class path, JansiConsoleAppender now emits warnings that explain how to add org.jline:jansi-core and then writes to the plain console stream. See codes.html#missingJlineJansi.

• The unused ch.qos.logback.classic.util.LogbackMDCAdapterSimple class was removed. LogbackMDCAdapter remains the default MDC adapter.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 07d291ca0d280bc5da934ec9ff5f1da634fd7937 associated with the tag v_1.6.4. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Full Changelog: qos-ch/logback@v_1.6.3...v_1.6.4

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

  • In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

  • Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

  • The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

  • ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

  • Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

  • The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

... (truncated)

Commits
  • d1b829d prepare release 1.6.5
  • 065b9b2 enhance protectin against mischievious MDC values in MDCBasedDiscriminator
  • b69beab complete commit in relation to discussion_1032
  • 7266c0b fix intermittently failing SocketAppenderMessageLossTest rest condition
  • a633bb0 fix intermittently failing SocketAppenderMessageLossTest rest condition
  • 2bc5bcc renamed tbrp and eclosingTBRP, other minor changes
  • 2cd8762 fix typo in AGENTS.md
  • 647846c fix errors when running tests under intellij IDEA
  • 1048917 removed ConsoleCharsetPropertyDefiner.java
  • 39b5002 added 'since' and 'forRemoval' attributes to SimpleInvocationGate @​Deprecatio...
  • Additional commits viewable in compare view

Updates ch.qos.logback:logback-core from 1.6.1 to 1.6.5

Release notes

Sourced from ch.qos.logback:logback-core's releases.

Logback 1.6.5

2026-09-30 Release of logback version 1.6.5

• Fixed a vulnerability CVE-2026-104721 closely related to CVE-2026-19880. The fix in version 1.6.3, which strips forward and backward slashes from MDC values, was insufficient. An MDC value could still contain relative path components such as .., variable references such as /, or characters that are special in file name patterns and email addresses. This latest vulnerability was found and reported by François Martin (GitHub: @​martinfrancois, https://github.com/martinfrancois).

MDCBasedDiscriminator, used by SiftingAppender, now rejects MDC values instead of stripping characters from them. An MDC value is rejected if it is empty, if it is longer than 64 characters, if it contains the sequence .., or if it contains any of the following characters: / \ $ { } [ ] ( ) | ? * + % , @. When an MDC value is rejected, the discriminator returns the value of its DefaultValue property. A warning is emitted for each rejected value. These warnings are rate-limited.

• When compression is enabled, TimeBasedRollingPolicy and SizeAndTimeBasedRollingPolicy now also remove old log files that were never compressed, for example because the application was not running at rollover time. Previously, such files were ignored by maxHistory and accumulated indefinitely. This issue was discussed in discussions/1032. See TimeBasedRollingPolicy.

• SimpleInvocationGate, deprecated in version 1.6.3, is now marked for removal. Use FixedIntervalInvocationGate instead.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit d1b829dcdb9fd98511c64401beb1419a9c9384aa associated with the tag v_1.6.5. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.4

2026-09-24 Release of logback version 1.6.4

• Variable substitution is again applied to the scan attribute of the <configuration> element. The scanning refactoring in version 1.5.27 had dropped substitution, so values such as ${logback.scan.enabled:-true} were no longer resolved. As before version 1.5.27, an unrecognized non-empty value turns scanning on. The same substitution now applies to the scan attribute of <propertiesConfigurator>. This regression was reported in issues/1065 by vaibhavjain2.

• OutputStreamAppender and FileAppender now handle stateful encoders. The Encoder interface has a new default method called isStateful(), which returns false. An encoder that keeps state between calls to encode() can return true. For such encoders, the appender holds its write lock while encoding and while writing, so the output of concurrent appends cannot interleave. Stateless encoders still encode outside the lock, so their performance does not change. Existing encoders need no changes.

• Several race conditions in OutputStreamAppender and FileAppender were fixed. The appender is now marked started and the encoder header is written while the same lock is held, so a concurrent append can no longer write an event before the header. After acquiring the lock, the appender checks again whether it has been stopped, so no event is written after the footer. In prudent mode, FileAppender now encodes and writes each event while holding the lock.

• Fixed a data race on the logger count in LoggerContext. Loggers are created under the lock of their parent logger, so loggers with different parents could be created at the same time and increments of the shared counter could be lost. As a result, LoggerContext.size() could return a value lower than the actual number of loggers. The counter is now an AtomicInteger. This issue was reported in issues/1038 by hcantunc. The fix was contributed in PR #1055 by seonwoo_jung.

• TimeBasedRollingPolicy now supports half-day periods. Date patterns with the AM/PM marker, for example %d{yyyy-MM-dd-a}, used to be detected as daily and rolled over only at midnight. They now roll over at both 00:00 and 12:00. This issue was reported in issues/976 by shakthifuture. The fix was contributed in PR #1051 by seonwoo_jung. See TimeBasedRollingPolicy.

• If org.jline.jansi.AnsiConsole cannot be found on the class path, JansiConsoleAppender now emits warnings that explain how to add org.jline:jansi-core and then writes to the plain console stream. See codes.html#missingJlineJansi.

• The unused ch.qos.logback.classic.util.LogbackMDCAdapterSimple class was removed. LogbackMDCAdapter remains the default MDC adapter.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 07d291ca0d280bc5da934ec9ff5f1da634fd7937 associated with the tag v_1.6.4. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Full Changelog: qos-ch/logback@v_1.6.3...v_1.6.4

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

  • In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

  • Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

  • The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

  • ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

  • Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

  • The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

... (truncated)

Commits
  • d1b829d prepare release 1.6.5
  • 065b9b2 enhance protectin against mischievious MDC values in MDCBasedDiscriminator
  • b69beab complete commit in relation to discussion_1032
  • 7266c0b fix intermittently failing SocketAppenderMessageLossTest rest condition
  • a633bb0 fix intermittently failing SocketAppenderMessageLossTest rest condition
  • 2bc5bcc renamed tbrp and eclosingTBRP, other minor changes
  • 2cd8762 fix typo in AGENTS.md
  • 647846c fix errors when running tests under intellij IDEA
  • 1048917 removed ConsoleCharsetPropertyDefiner.java
  • 39b5002 added 'since' and 'forRemoval' attributes to SimpleInvocationGate @​Deprecatio...
  • Additional commits viewable in compare view

Updates org.mockito:mockito-core from 5.23.0 to 5.24.0

Release notes

Sourced from org.mockito:mockito-core's releases.

v5.24.0

Changelog generated by Shipkit Changelog Gradle Plugin

5.24.0

Commits
  • 5a2f0f8 Fix Mockito docs for -javaagent flag with Gradle (#3866)
  • 9c5f36f Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 (#3862)
  • e7fd06d Preserve method parameters when clearing inline mocks (#3847)
  • 5a676bc Bump gradle/actions from 6.2.0 to 6.3.0 (#3852)
  • 508f8e7 Bump gradle/actions from 5 to 6.2.0 (#3851)
  • ee8a330 Print object fields via reflection when toString() is not implemented (#3844)
  • 39b1aba Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 (#3845)
  • d8638e1 Migrate extensions-tests to JUnit Jupiter (#3840)
  • 0aab922 Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 (#3839)
  • f3cf74c docs(when-verify): fixes to explanations about redundancy (#3838)
  • Additional commits viewable in compare view

Updates org.mockito:mockito-junit-jupiter from 5.23.0 to 5.24.0

Release notes

Sourced from org.mockito:mockito-junit-jupiter's releases.

v5.24.0

Changelog generated by Shipkit Changelog Gradle Plugin

5.24.0

@dependabot
build(deps): bump the maven-non-major group with 34 updates
7308ec2 
Bumps the maven-non-major group with 34 updates:

| Package | From | To |
| --- | --- | --- |
| [org.projectlombok:lombok](https://github.com/projectlombok/lombok) | `1.18.46` | `1.18.48` |
| [com.google.errorprone:error_prone_annotations](https://github.com/google/error-prone) | `2.42.0` | `2.50.0` |
| [com.google.errorprone:error_prone_core](https://github.com/google/error-prone) | `2.42.0` | `2.50.0` |
| org.slf4j:slf4j-api | `2.0.18` | `2.0.20` |
| [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.6.1` | `1.6.5` |
| [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) | `1.6.1` | `1.6.5` |
| [org.mockito:mockito-core](https://github.com/mockito/mockito) | `5.23.0` | `5.24.0` |
| [org.mockito:mockito-junit-jupiter](https://github.com/mockito/mockito) | `5.23.0` | `5.24.0` |
| [com.tngtech.archunit:archunit-junit5](https://github.com/TNG/ArchUnit) | `1.4.2` | `1.5.1` |
| [io.netty:netty-bom](https://github.com/netty/netty) | `4.1.138.Final` | `4.2.19.Final` |
| [at.yawk.lz4:lz4-java](https://github.com/yawkat/lz4-java) | `1.11.2` | `1.12.0` |
| org.apache.commons:commons-lang3 | `3.20.0` | `3.21.0` |
| [com.google.guava:guava](https://github.com/google/guava) | `33.6.0-jre` | `33.7.2-jre` |
| [com.uber.nullaway:nullaway](https://github.com/uber/NullAway) | `0.12.7` | `0.14.2` |
| [com.github.spotbugs:spotbugs](https://github.com/spotbugs/spotbugs) | `4.10.3` | `4.10.5` |
| [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) | `3.15.0` | `3.16.0` |
| [org.codehaus.mojo:exec-maven-plugin](https://github.com/mojohaus/exec-maven-plugin) | `3.5.0` | `3.6.4` |
| [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.5.6` | `3.6.0` |
| [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire) | `3.5.6` | `3.6.0` |
| [de.thetaphi:forbiddenapis](https://github.com/policeman-tools/forbidden-apis) | `3.10` | `3.11` |
| [com.github.spotbugs:spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) | `4.10.3.0` | `4.10.5.0` |
| [org.pitest:pitest-maven](https://github.com/hcoles/pitest) | `1.25.8` | `1.30.0` |
| [org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin) | `3.6.1` | `3.6.2` |
| [org.codehaus.mojo:versions-maven-plugin](https://github.com/mojohaus/versions) | `2.21.0` | `2.23.0` |
| [org.apache.maven.plugins:maven-install-plugin](https://github.com/apache/maven-install-plugin) | `3.1.4` | `3.2.0` |
| [org.apache.maven.plugins:maven-deploy-plugin](https://github.com/apache/maven-deploy-plugin) | `3.1.4` | `3.2.0` |
| [org.postgresql:postgresql](https://github.com/pgjdbc/pgjdbc) | `42.7.13` | `42.7.14` |
| org.ow2.asm:asm | `9.9.1` | `9.11` |
| [io.vertx:vertx-web-client](https://github.com/vert-x3/vertx-web) | `4.5.31` | `4.5.35` |
| [io.vertx:vertx-junit5](https://github.com/eclipse-vertx/vertx-junit5) | `4.5.31` | `4.5.35` |
| [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) | `2.18.10` | `2.18.11` |
| [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) | `2.18.10` | `2.18.11` |
| org.apache.maven:apache-maven | `3.9.0` | `3.10.0` |
| [org.apache.maven.wrapper:maven-wrapper](https://github.com/apache/maven-wrapper) | `3.2.0` | `3.3.4` |


Updates `org.projectlombok:lombok` from 1.18.46 to 1.18.48
- [Changelog](https://github.com/projectlombok/lombok/blob/master/doc/changelog.markdown)
- [Commits](projectlombok/lombok@v1.18.46...v1.18.48)

Updates `com.google.errorprone:error_prone_annotations` from 2.42.0 to 2.50.0
- [Release notes](https://github.com/google/error-prone/releases)
- [Commits](google/error-prone@v2.42.0...v2.50.0)

Updates `com.google.errorprone:error_prone_core` from 2.42.0 to 2.50.0
- [Release notes](https://github.com/google/error-prone/releases)
- [Commits](google/error-prone@v2.42.0...v2.50.0)

Updates `org.slf4j:slf4j-api` from 2.0.18 to 2.0.20

Updates `ch.qos.logback:logback-classic` from 1.6.1 to 1.6.5
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.6.1...v_1.6.5)

Updates `ch.qos.logback:logback-core` from 1.6.1 to 1.6.5
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.6.1...v_1.6.5)

Updates `org.mockito:mockito-core` from 5.23.0 to 5.24.0
- [Release notes](https://github.com/mockito/mockito/releases)
- [Commits](mockito/mockito@v5.23.0...v5.24.0)

Updates `org.mockito:mockito-junit-jupiter` from 5.23.0 to 5.24.0
- [Release notes](https://github.com/mockito/mockito/releases)
- [Commits](mockito/mockito@v5.23.0...v5.24.0)

Updates `org.mockito:mockito-junit-jupiter` from 5.23.0 to 5.24.0
- [Release notes](https://github.com/mockito/mockito/releases)
- [Commits](mockito/mockito@v5.23.0...v5.24.0)

Updates `com.tngtech.archunit:archunit-junit5` from 1.4.2 to 1.5.1
- [Release notes](https://github.com/TNG/ArchUnit/releases)
- [Commits](TNG/ArchUnit@v1.4.2...v1.5.1)

Updates `io.netty:netty-bom` from 4.1.138.Final to 4.2.19.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.138.Final...netty-4.2.19.Final)

Updates `at.yawk.lz4:lz4-java` from 1.11.2 to 1.12.0
- [Release notes](https://github.com/yawkat/lz4-java/releases)
- [Changelog](https://github.com/yawkat/lz4-java/blob/main/CHANGES.md)
- [Commits](yawkat/lz4-java@v1.11.2...v1.12.0)

Updates `org.apache.commons:commons-lang3` from 3.20.0 to 3.21.0

Updates `com.google.guava:guava` from 33.6.0-jre to 33.7.2-jre
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

Updates `ch.qos.logback:logback-core` from 1.6.1 to 1.6.5
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.6.1...v_1.6.5)

Updates `com.google.errorprone:error_prone_core` from 2.42.0 to 2.50.0
- [Release notes](https://github.com/google/error-prone/releases)
- [Commits](google/error-prone@v2.42.0...v2.50.0)

Updates `com.uber.nullaway:nullaway` from 0.12.7 to 0.14.2
- [Release notes](https://github.com/uber/NullAway/releases)
- [Changelog](https://github.com/uber/NullAway/blob/master/CHANGELOG.md)
- [Commits](uber/NullAway@v0.12.7...v0.14.2)

Updates `com.github.spotbugs:spotbugs` from 4.10.3 to 4.10.5
- [Release notes](https://github.com/spotbugs/spotbugs/releases)
- [Changelog](https://github.com/spotbugs/spotbugs/blob/master/CHANGELOG.md)
- [Commits](spotbugs/spotbugs@4.10.3...4.10.5)

Updates `org.apache.maven.plugins:maven-compiler-plugin` from 3.15.0 to 3.16.0
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.15.0...maven-compiler-plugin-3.16.0)

Updates `org.codehaus.mojo:exec-maven-plugin` from 3.5.0 to 3.6.4
- [Release notes](https://github.com/mojohaus/exec-maven-plugin/releases)
- [Commits](mojohaus/exec-maven-plugin@3.5.0...3.6.4)

Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.5.6 to 3.6.0
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.5.6...surefire-3.6.0)

Updates `org.apache.maven.plugins:maven-failsafe-plugin` from 3.5.6 to 3.6.0
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.5.6...surefire-3.6.0)

Updates `org.apache.maven.plugins:maven-failsafe-plugin` from 3.5.6 to 3.6.0
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.5.6...surefire-3.6.0)

Updates `de.thetaphi:forbiddenapis` from 3.10 to 3.11
- [Commits](policeman-tools/forbidden-apis@3.10...3.11)

Updates `com.github.spotbugs:spotbugs-maven-plugin` from 4.10.3.0 to 4.10.5.0
- [Release notes](https://github.com/spotbugs/spotbugs-maven-plugin/releases)
- [Commits](spotbugs/spotbugs-maven-plugin@spotbugs-maven-plugin-4.10.3.0...spotbugs-maven-plugin-4.10.5.0)

Updates `org.pitest:pitest-maven` from 1.25.8 to 1.30.0
- [Release notes](https://github.com/hcoles/pitest/releases)
- [Commits](hcoles/pitest@1.25.8...1.30.0)

Updates `org.codehaus.mojo:build-helper-maven-plugin` from 3.6.1 to 3.6.2
- [Release notes](https://github.com/mojohaus/build-helper-maven-plugin/releases)
- [Commits](mojohaus/build-helper-maven-plugin@3.6.1...3.6.2)

Updates `org.codehaus.mojo:versions-maven-plugin` from 2.21.0 to 2.23.0
- [Release notes](https://github.com/mojohaus/versions/releases)
- [Changelog](https://github.com/mojohaus/versions/blob/master/ReleaseNotes.md)
- [Commits](mojohaus/versions@2.21.0...2.23.0)

Updates `org.apache.maven.plugins:maven-install-plugin` from 3.1.4 to 3.2.0
- [Release notes](https://github.com/apache/maven-install-plugin/releases)
- [Commits](apache/maven-install-plugin@maven-install-plugin-3.1.4...maven-install-plugin-3.2.0)

Updates `org.apache.maven.plugins:maven-deploy-plugin` from 3.1.4 to 3.2.0
- [Release notes](https://github.com/apache/maven-deploy-plugin/releases)
- [Commits](apache/maven-deploy-plugin@maven-deploy-plugin-3.1.4...maven-deploy-plugin-3.2.0)

Updates `org.postgresql:postgresql` from 42.7.13 to 42.7.14
- [Release notes](https://github.com/pgjdbc/pgjdbc/releases)
- [Changelog](https://github.com/pgjdbc/pgjdbc/blob/master/CHANGELOG.md)
- [Commits](pgjdbc/pgjdbc@REL42.7.13...REL42.7.14)

Updates `org.ow2.asm:asm` from 9.9.1 to 9.11

Updates `io.vertx:vertx-web-client` from 4.5.31 to 4.5.35
- [Commits](vert-x3/vertx-web@4.5.31...4.5.35)

Updates `io.vertx:vertx-junit5` from 4.5.31 to 4.5.35
- [Commits](eclipse-vertx/vertx-junit5@4.5.31...4.5.35)

Updates `io.vertx:vertx-junit5` from 4.5.31 to 4.5.35
- [Commits](eclipse-vertx/vertx-junit5@4.5.31...4.5.35)

Updates `com.fasterxml.jackson.core:jackson-databind` from 2.18.10 to 2.18.11
- [Commits](FasterXML/jackson-databind@jackson-databind-2.18.10...jackson-databind-2.18.11)

Updates `com.fasterxml.jackson:jackson-bom` from 2.18.10 to 2.18.11
- [Commits](FasterXML/jackson-bom@jackson-bom-2.18.10...jackson-bom-2.18.11)

Updates `com.fasterxml.jackson:jackson-bom` from 2.18.10 to 2.18.11
- [Commits](FasterXML/jackson-bom@jackson-bom-2.18.10...jackson-bom-2.18.11)

Updates `org.apache.maven:apache-maven` from 3.9.0 to 3.10.0

Updates `org.apache.maven.wrapper:maven-wrapper` from 3.2.0 to 3.3.4
- [Release notes](https://github.com/apache/maven-wrapper/releases)
- [Commits](apache/maven-wrapper@maven-wrapper-3.2.0...maven-wrapper-3.3.4)

---
updated-dependencies:
- dependency-name: org.projectlombok:lombok
  dependency-version: 1.18.48
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-non-major
- dependency-name: com.google.errorprone:error_prone_annotations
  dependency-version: 2.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: com.google.errorprone:error_prone_core
  dependency-version: 2.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: org.slf4j:slf4j-api
  dependency-version: 2.0.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-non-major
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-non-major
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.6.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-non-major
- dependency-name: org.mockito:mockito-core
  dependency-version: 5.24.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: org.mockito:mockito-junit-jupiter
  dependency-version: 5.24.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: org.mockito:mockito-junit-jupiter
  dependency-version: 5.24.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: com.tngtech.archunit:archunit-junit5
  dependency-version: 1.5.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: io.netty:netty-bom
  dependency-version: 4.2.19.Final
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: at.yawk.lz4:lz4-java
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: org.apache.commons:commons-lang3
  dependency-version: 3.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: com.google.guava:guava
  dependency-version: 33.7.2-jre
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.6.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-non-major
- dependency-name: com.google.errorprone:error_prone_core
  dependency-version: 2.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: com.uber.nullaway:nullaway
  dependency-version: 0.14.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: com.github.spotbugs:spotbugs
  dependency-version: 4.10.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-non-major
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-version: 3.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: org.codehaus.mojo:exec-maven-plugin
  dependency-version: 3.6.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: org.apache.maven.plugins:maven-failsafe-plugin
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: org.apache.maven.plugins:maven-failsafe-plugin
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: de.thetaphi:forbiddenapis
  dependency-version: '3.11'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: com.github.spotbugs:spotbugs-maven-plugin
  dependency-version: 4.10.5.0
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-non-major
- dependency-name: org.pitest:pitest-maven
  dependency-version: 1.30.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: org.codehaus.mojo:build-helper-maven-plugin
  dependency-version: 3.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-non-major
- dependency-name: org.codehaus.mojo:versions-maven-plugin
  dependency-version: 2.23.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: org.apache.maven.plugins:maven-install-plugin
  dependency-version: 3.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: org.apache.maven.plugins:maven-deploy-plugin
  dependency-version: 3.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: org.postgresql:postgresql
  dependency-version: 42.7.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-non-major
- dependency-name: org.ow2.asm:asm
  dependency-version: '9.11'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: io.vertx:vertx-web-client
  dependency-version: 4.5.35
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-non-major
- dependency-name: io.vertx:vertx-junit5
  dependency-version: 4.5.35
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-non-major
- dependency-name: io.vertx:vertx-junit5
  dependency-version: 4.5.35
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-non-major
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.18.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-non-major
- dependency-name: com.fasterxml.jackson:jackson-bom
  dependency-version: 2.18.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-non-major
- dependency-name: com.fasterxml.jackson:jackson-bom
  dependency-version: 2.18.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-non-major
- dependency-name: org.apache.maven:apache-maven
  dependency-version: 3.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
- dependency-name: org.apache.maven.wrapper:maven-wrapper
  dependency-version: 3.3.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-non-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
dependabot Bot requested a review from astubbs as a code owner October 15, 2026 18:55
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Oct 15, 2026
@github-actions

github-actions Bot commented Oct 15, 2026

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
maven/org.ow2.asm:asm 9.11 UnknownUnknown
maven/org.postgresql:postgresql 42.7.14 🟢 7.5
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 2Found 2/7 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing⚠️ 0project is not fuzzed
Binary-Artifacts🟢 10no binaries found in the repo
License🟢 10license file detected
Signed-Releases🟢 32 out of the last 5 releases have a total of 2 signed artifacts.
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
CI-Tests🟢 104 out of 4 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 35 contributing companies or organizations
maven/io.vertx:vertx-junit5 4.5.35 UnknownUnknown
maven/io.vertx:vertx-web-client 4.5.35 UnknownUnknown
maven/at.yawk.lz4:lz4-java 1.12.0 🟢 6.9
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Code-Review⚠️ 0Found 0/20 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 2badge detected: InProgress
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
Packaging🟢 10packaging workflow detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
Vulnerabilities🟢 100 existing vulnerabilities detected
CI-Tests🟢 823 out of 27 merged PRs checked by a CI test -- score normalized to 8
Contributors🟢 10project has 9 contributing companies or organizations
maven/ch.qos.logback:logback-classic 1.6.5 🟢 6.9
Details
CheckScoreReason
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing🟢 10project is fuzzed
License🟢 9license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/ch.qos.logback:logback-core 1.6.5 🟢 6.9
Details
CheckScoreReason
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing🟢 10project is fuzzed
License🟢 9license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/com.github.spotbugs:spotbugs 4.10.5 🟢 4.6
Details
CheckScoreReason
Code-Review⚠️ 2Found 6/25 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
Signed-Releases🟢 64 out of the last 5 releases have a total of 4 signed artifacts.
Packaging🟢 10packaging workflow detected
SAST⚠️ 2SAST tool is not run on all commits -- score normalized to 2
Binary-Artifacts⚠️ 0binaries present in source code
maven/com.github.spotbugs:spotbugs-maven-plugin 4.10.5.0 🟢 6.1
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/13 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 10SAST tool is run on all commits
maven/com.google.errorprone:error_prone_annotations 2.50.0 🟢 7.1
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 0/28 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Packaging🟢 10packaging workflow detected
maven/com.google.guava:guava 33.7.2-jre 🟢 8.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 1/27 approved changesets -- score normalized to 0
Dependency-Update-Tool🟢 10update tool detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 2badge detected: InProgress
Binary-Artifacts🟢 9binaries present in source code
Pinned-Dependencies🟢 10all dependencies are pinned
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing🟢 10project is fuzzed
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Signed-Releases⚠️ -1no releases found
CI-Tests🟢 928 out of 29 merged PRs checked by a CI test -- score normalized to 9
Contributors🟢 10project has 11 contributing companies or organizations
maven/com.tngtech.archunit:archunit-junit5 1.5.1 UnknownUnknown
maven/de.thetaphi:forbiddenapis 3.11 UnknownUnknown
maven/io.netty:netty-bom 4.2.19 UnknownUnknown
maven/org.apache.commons:commons-lang3 3.21.0 UnknownUnknown
maven/org.apache.maven.plugins:maven-compiler-plugin 3.16.0 🟢 5.6
Details
CheckScoreReason
Code-Review🟢 5Found 12/24 approved changesets -- score normalized to 5
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.apache.maven.plugins:maven-deploy-plugin 3.2.0 🟢 4.1
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 2Found 4/16 approved changesets -- score normalized to 2
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts⚠️ 0binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.apache.maven.plugins:maven-install-plugin 3.2.0 🟢 4.2
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 3Found 7/18 approved changesets -- score normalized to 3
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts⚠️ 0binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.apache.maven.plugins:maven-surefire-plugin 3.6.0 🟢 5.3
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 3Found 6/20 approved changesets -- score normalized to 3
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.codehaus.mojo:build-helper-maven-plugin 3.6.2 🟢 5.8
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1027 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review⚠️ 0Found 0/22 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST🟢 10SAST tool is run on all commits
maven/org.codehaus.mojo:exec-maven-plugin 3.6.4 UnknownUnknown
maven/org.codehaus.mojo:versions-maven-plugin 2.23.0 UnknownUnknown
maven/org.mockito:mockito-core 5.24.0 🟢 7.1
Details
CheckScoreReason
Code-Review🟢 7Found 14/19 approved changesets -- score normalized to 7
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Maintained🟢 1012 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 9security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Binary-Artifacts🟢 10no binaries found in the repo
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Packaging🟢 10packaging workflow detected
maven/org.mockito:mockito-junit-jupiter 5.24.0 🟢 7.1
Details
CheckScoreReason
Code-Review🟢 7Found 14/19 approved changesets -- score normalized to 7
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Maintained🟢 1012 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 9security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Binary-Artifacts🟢 10no binaries found in the repo
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Packaging🟢 10packaging workflow detected
maven/org.pitest:pitest-maven 1.30.0 🟢 4.8
Details
CheckScoreReason
Code-Review⚠️ 1Found 3/17 approved changesets -- score normalized to 1
Maintained🟢 1030 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 9binaries present in source code
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Packaging🟢 10packaging workflow detected
maven/org.projectlombok:lombok 1.18.48 🟢 3.6
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Code-Review⚠️ 0Found 2/27 approved changesets -- score normalized to 0
Token-Permissions⚠️ -1No tokens found
Dangerous-Workflow⚠️ -1no workflows found
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 7binaries present in source code
License🟢 9license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
maven/org.slf4j:slf4j-api 2.0.20 🟢 5.8
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 0Found 1/30 approved changesets -- score normalized to 0
Maintained🟢 1030 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Security-Policy🟢 10security policy file detected
Binary-Artifacts⚠️ 0binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • parallel-consumer-core/pom.xml
  • parallel-consumer-vertx/pom.xml
  • pom.xml

@github-actions

github-actions Bot commented Oct 15, 2026

Copy link
Copy Markdown

🟠 Throughput — no rate to report

The performance lane ran but produced no usable recordsPerSecond for MultiInstanceHighVolumeTest. Either the test did not run, or ThroughputReport is no longer reached.

Not a pass — both of those look identical to a clean lane otherwise, which is exactly why this is reported rather than skipped.

Updated for 7308ec2 · run 38789609205 · 2026-10-15 18:56 UTC

@github-actions

github-actions Bot commented Oct 15, 2026

Copy link
Copy Markdown

✅ Duplicate Code Report

Two engines run in parallel for cross-validation. Each has its own thresholds tuned to its baseline - the real safety net is the per-engine "max increase vs base" check.

✅ PMD CPD

PR Base Change
Clones 27 27 ➖ 0
Duplicated lines 949 949 ➖ 0
Duplication 0.36% 0.36% ➖ 0
Rule Limit Status
Max duplication 0.5% ✅ Pass (0.36%)
Max increase vs base +0.1% ✅ Pass (+0.00%)

No new clones introduced by this PR.

✅ jscpd (language-agnostic)

PR Base Change
Clones 106 106 ➖ 0
Duplicated lines 1503 1503 ➖ 0
Duplication 0.81% 0.81% ➖ 0
Rule Limit Status
Max duplication 2% ✅ Pass (0.81%)
Max increase vs base +0.1% ✅ Pass (+0.00%)

No new clones introduced by this PR.

Powered by astubbs/duplicate-code-cross-check

@github-actions

github-actions Bot commented Oct 15, 2026

Copy link
Copy Markdown

SpotBugs Report

No SpotBugs XML report found. The compile or analysis step may have failed.

Updated for 7308ec2 · run 38789609205 · 2026-10-15 18:57 UTC

@dependabot @github

dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 19, 2026
@dependabot
dependabot Bot deleted the dependabot/maven/maven-non-major-c7a0d304d2 branch October 19, 2026 18:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@astubbs astubbs Awaiting requested review from astubbs astubbs is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants