build(deps): bump the gradle group across 5 directories with 36 updates

[dependabot]

Bumps the gradle group with 32 updates in the / directory:

Package	From	To
org.springframework.boot:spring-boot-dependencies	4.0.6	4.1.0
org.springframework.vault:spring-vault-core	4.0.2	4.1.0
org.springframework.modulith:spring-modulith-bom	2.0.6	2.1.0
org.springframework.cloud:spring-cloud-starter-vault-config	5.0.1	5.0.2
com.nimbusds:nimbus-jose-jwt	10.9	10.9.1
org.bouncycastle:bcpkix-jdk18on	1.84	1.85
com.google.auth:google-auth-library-oauth2-http	1.47.0	1.50.0
org.apache.tika:tika-core	3.3.1	3.3.2
com.googlecode.libphonenumber:libphonenumber	9.0.31	9.0.36
org.springframework.retry:spring-retry	2.0.12	2.0.13
org.mariadb.jdbc:mariadb-java-client	3.5.8	3.5.10
com.fasterxml.jackson.module:jackson-module-kotlin	2.21.3	2.22.1
org.openapitools:jackson-databind-nullable	0.2.10	0.2.11
org.springdoc:springdoc-openapi-starter-webmvc-ui	3.0.2	3.1.0
org.commonmark:commonmark	0.28.0	0.29.0
io.rest-assured:spring-mock-mvc	6.0.0	6.0.1
io.github.classgraph:classgraph	4.8.184	4.8.186
io.mockk:mockk	1.14.9	1.14.11
com.h2database:h2	2.3.232	2.4.240
org.graalvm.buildtools.native	1.1.1	1.1.7
plugin.jpa	2.3.21	2.4.10
plugin.allopen	2.3.21	2.4.10
plugin.noarg	2.3.21	2.4.10
kapt	2.3.21	2.4.10
org.springframework.security:spring-security-crypto	7.0.5	7.1.0
tools.jackson.module:jackson-module-kotlin	3.1.3	3.2.1
io.rest-assured:rest-assured	6.0.0	6.0.1
com.microsoft.playwright:playwright	1.60.0	1.61.0
org.junit.jupiter:junit-jupiter	6.1.0	6.1.2
org.jetbrains.kotlin:kotlin-gradle-plugin	2.3.21	2.4.10
org.springframework.boot:spring-boot-gradle-plugin	4.0.6	4.1.0
gradle-wrapper	9.5.1	9.6.1

Bumps the gradle group with 3 updates in the /build-logic directory: org.jetbrains.kotlin:kotlin-gradle-plugin, org.springframework.boot:spring-boot-gradle-plugin and org.openapitools:openapi-generator-gradle-plugin.
Bumps the gradle group with 2 updates in the /libs/kotlin-common directory: org.springframework.boot:spring-boot-dependencies and org.springframework.vault:spring-vault-core.
Bumps the gradle group with 22 updates in the /services/api directory:

Package	From	To
org.springframework.modulith:spring-modulith-bom	2.0.6	2.1.0
org.springframework.cloud:spring-cloud-starter-vault-config	5.0.1	5.0.2
com.nimbusds:nimbus-jose-jwt	10.9	10.9.1
org.bouncycastle:bcpkix-jdk18on	1.84	1.85
com.google.auth:google-auth-library-oauth2-http	1.47.0	1.50.0
org.apache.tika:tika-core	3.3.1	3.3.2
com.googlecode.libphonenumber:libphonenumber	9.0.31	9.0.36
org.springframework.retry:spring-retry	2.0.12	2.0.13
org.mariadb.jdbc:mariadb-java-client	3.5.8	3.5.10
com.fasterxml.jackson.module:jackson-module-kotlin	2.21.3	2.22.1
org.openapitools:jackson-databind-nullable	0.2.10	0.2.11
org.springdoc:springdoc-openapi-starter-webmvc-ui	3.0.2	3.1.0
org.commonmark:commonmark	0.28.0	0.29.0
io.rest-assured:spring-mock-mvc	6.0.0	6.0.1
io.github.classgraph:classgraph	4.8.184	4.8.186
io.mockk:mockk	1.14.9	1.14.11
com.h2database:h2	2.3.232	2.4.240
org.graalvm.buildtools.native	1.1.1	1.1.7
plugin.jpa	2.3.21	2.4.10
plugin.allopen	2.3.21	2.4.10
plugin.noarg	2.3.21	2.4.10
kapt	2.3.21	2.4.10

Bumps the gradle group with 6 updates in the /services/system-tests directory:

Package	From	To
org.mariadb.jdbc:mariadb-java-client	3.5.8	3.5.10
org.springframework.security:spring-security-crypto	7.0.5	7.1.0
tools.jackson.module:jackson-module-kotlin	3.1.3	3.2.1
io.rest-assured:rest-assured	6.0.0	6.0.1
com.microsoft.playwright:playwright	1.60.0	1.61.0
org.junit.jupiter:junit-jupiter	6.1.0	6.1.2

Updates org.springframework.boot:spring-boot-dependencies from 4.0.6 to 4.1.0

Release notes

Sourced from org.springframework.boot:spring-boot-dependencies's releases.

v4.1.0

Full release notes for Spring Boot 4.1 are available on the wiki.

⭐ New Features

• Add public constructor to InvalidConfigurationPropertyValueException that accepts a cause #50211
• Reduce memory consumption when repeatedly calling WritableJson.toByteArray #49428

🐞 Bug Fixes

• MailSender auto-configuration does not enable hostname verification #50747
• Artemis auto-configuration uses a predictable default location for the embedded broker's data #50745
• Embedded LDAP SSL should not be enabled when its bundle is empty #50700
• InetAddressFilter.externalAddresses does not exclude special purpose addresses from RFC 6890 #50668
• NullPointerException in reactor-netty SniProvider and unmapped SSL bundle with RSocket #50645
• SSL should not be enabled when a SSL bundle is overridden to an empty string #50635
• Test auto-configuration no longer integrates Spring Security with HtmlUnitDriver #50633
• Configuration property metadata includes incorrect class references #50632
• Docker Compose support does not restore thread interrupt flag when catching InterruptedException #50618
• RabbitProperties enables SSL even when spring.rabbitmq.ssl.bundle is overridden to an empty string #50612
• NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles #50610
• SpringJtaPlatform should have been deprecated since 4.1.0-M3 #50592
• Layer written outside the output location of '//' exception is thrown when using extract layers in root directory #50510
• ConfigurationPropertiesReportEndpoint exposes AOP proxy internals #50417
• Created StackTracePrinter instances have no access to the Environment #50414
• MappingsEndpoint reports the context's own ID as parentId when a parent exists #50412
• Buildpack module does not validate long-to-int casts #50410
• Gradle gRPC support fails if protobuf-java dependency is used instead of protobuf-java-util #50405
• GraphQL WebSocket support does not configure allowed origins #50394
• Spring Boot Loader Does Not Support RSA and EC Signed Jars #50298
• Meter registries are not removed from the global registry when the context is closed #50287
• DataSourceBuilder cannot derive a DataSource from a lazy connection proxy #50271
• Nullable annotations from AbstractErrorController.getErrorAttributes are not aligned with implementation #50266
• Bean definitions can be added with an initializer before setAllowBeanDefinitionOverriding is called #50264
• EndpointRequest links matcher unnecessarily matches HTTP methods other than GET #50261
• Actuator's '/cloudfoundryapplication' endpoint does not work if restrictive CORS configuration is provided using a bean named corsConfigurationSource #50258
• ThreadPoolTaskScheduleBuilder unnecessarily loses precision when configuring await termination time #50234
• NimbusJwtDecoder silently accepts unknown values for spring.security.oauth2.resourceserver.jwt.jws-algorithms #50228
• Missing dependency management for spring-boot-web-server-test #50224
• Spring Batch support for MongoDB modules are not included in dependency management #50223
• Apply HTML escaping to timestamp attribute in Whitelabel error page #50216
• GrpcServerHealthScheduler is not started in servlet environments #50209
• Setting server.servlet.session.cookie.partitioned=true has no effect when using Tomcat #50204

📔 Documentation

• Fix reference to Gradle documentation for module replacement #50647
• Document SSL reloading with Let's Encrypt #50630
• Remove the use of Optional from Data Neo4j repository examples #50622
• Fix typos in documentation #50620

... (truncated)

Commits

• ac2cfe0 Release v4.1.0
• 1a5815c Upgrade to Spring Batch 6.0.4
• a8364ff Merge branch '4.0.x'
• 9755ff2 Upgrade to Spring Batch 6.0.4
• 6a6dedc Upgrade to Spring Integration 7.1.0
• db7b2b9 Merge branch '4.0.x'
• d549d07 Upgrade to Spring Integration 7.0.5
• 4d9e463 Merge branch '3.5.x' into 4.0.x
• b068647 Upgrade to Spring Integration 6.5.9
• 198af99 Merge branch '4.0.x'
• Additional commits viewable in compare view

Updates org.springframework.vault:spring-vault-core from 4.0.2 to 4.1.0

Release notes

Sourced from org.springframework.vault:spring-vault-core's releases.

4.1.0

📗 Links

• Spring Vault 4.1.0 Reference documentation
• Spring Vault 4.1.0 Javadoc

⭐ New Features

• Support Pattern for Matches (Regex) query keywords #1000
• Use set-based lookups for IN and NOT_IN query predicates #999
• Build against Vault 2.0.0 #994
• Add Key/Value version detection to VaultTemplate #974
• Enable secrets without a Lease for rotation #973
• Introduce ManagedSecret API #972
• Add CertificateContainer for managed certificate issuance and rotation #969
• Add VaultClient abstraction #942

🐞 Bug Fixes

• Remove rule from set before adding another one with the same path #998
• Use independent JacksonCompat as class loader source #987
• JacksonCompat class loader from Jackson2 class causing potential Jackson 2 initialization #986
• Use default constructor for JacksonHttpMessageConverters #977
• Jackson Kotlin support broken in 4.0 #976

📔 Documentation

• Document SecretLeaseContainer and CertificateContainer usage #970
• Align secrets engines and auth methods terminology #963
• Documentation grammar #959

🔨 Dependency Upgrades

• Upgrade to Spring Data 2026.0.0 #1002
• Upgrade to Spring Framework 7.0.7 #1001
• Upgrade to Kotlin 2.3.20 #991
• Upgrade to Spring Data 2026.0.0-RC1 #990
• Upgrade to Spring Framework 7.0.7 #988
• Upgrade to Jackson 3.1.0 #983
• Upgrade to Spring Framework 7.0.6 #982
• Upgrade dependencies #979
• Bump org.assertj:assertj-core from 3.27.6 to 3.27.7 #975
• Upgrade to Vault 1.21 #962

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

• @​bradenrayhorn
• @​RouxAntoine
• @​dependabot[bot]

4.1.0-RC1

📗 Links

... (truncated)

Commits

• 83514ce Release Spring Vault 4.1.0.
• 4298eff Upgrade to Spring Data 2025.1.6, Spring Security 7.0.6, Reactor 2025.0.6
• 94e3588 Upgrade to Spring Data 2026.0.0.
• d0d8e61 Upgrade to Spring Framework 7.0.7.
• 89bdb80 Upgrade build dependencies.
• dedce00 Upgrade build dependencies.
• 680015d Support Pattern for Matches (Regex) query keywords.
• f6cdeef Polishing.
• f78d715 Polishing.
• 9a6b97b Use set-based lookups for IN and NOT_IN query predicates.
• Additional commits viewable in compare view

Updates org.springframework.modulith:spring-modulith-bom from 2.0.6 to 2.1.0

Release notes

Sourced from org.springframework.modulith:spring-modulith-bom's releases.

2.1 GA

⭐ New Features

Outbox

• Support for event outbox via Namastack #1517
• Support for externalizing events via JobRunr #1637
• Avoid executing Flyway migrations for modules without any migrations #1684

EPR

• Allow opting out of event publication registry handling for an @TransactionalEventListener #1630
• Enable JDBC event publication schema creation by default #1563
• Make sure that JDBC EPR schema initialization runs after Boot's file-based one #1568

Testing

• Support for application module testing in combination with Boot's slice test support #1573
• Open up PublishedEvents and Scenario to see events from all threads by default #1564

Observability

• Streamline observability infrastructure #1567
• Split up observability support into API and core artifact #1559

Moments

• Allow Moments' events to be (de)serialized by Jackson #1569

💡 Improvements

Core

• Prefer @SpringBootApplication on explicitly declared classes in @ModuleSlicing #1644
• Allow FormattableType to also abbreviate non-module types #1566

Outbox

• Require RabbitMQ publisher confirmation for outbox-based externalization #1727
• Block for externalization in outbox mode #1687
• Improve transaction handling in JobRunr integration #1655

EPR

• Switch to SHA-256 for event hashing in Neo4jEventPublicationRepository #1718
• Simplify default status assignment in JpaEventPublication #1703
• Unify event externalization infrastructure #1642
• Add details about the refined event publication lifecycle to the reference documentation #1593
• Avoid recreation of TransactionalEventListeners in PersistentApplicationEventMulticaster #1632
• Hibernate schema validation fails with JPA event publication registry #1543

JUnit Extension

• Allow skipping all tests if no changes are detected #1438

APT

• SpringModulithProcessor fails on Windows with KAPT - StringIndexOutOfBoundsException due to hardcoded forward slashes #1544

Moments

... (truncated)

Commits

• c75f173 GH-1690 - Release version 2.1.0.
• 2472023 GH-1747 - Downgrade to Structurizr 5.0.3.
• 5179dc4 GH-1690 - Re-enable test cases in standard CI builds.
• a886fdb GH-1744 - Upgrade to Structurizr 6.2.1.
• 15877d8 GH-1740 - Upgrade to Spring Boot 4.1.
• a52641f GH-1699 - Detect more (Gradle) build-related changes to trigger full builds.
• 4d8c20e GH-1739 - Upgrade to jGit 7.7.0.202606012155-r.
• 9b29aaf GH-1737 - Upgrade to Namastack Outbox 1.7.0.
• 3e97b34 GH-1736 - Upgrade to Spring Framework 7.0.8.
• fdeea6c GH-1735 - Upgrade to Micrometer Tracing 1.7.0.
• Additional commits viewable in compare view

Updates org.springframework.cloud:spring-cloud-starter-vault-config from 5.0.1 to 5.0.2

Release notes

Sourced from org.springframework.cloud:spring-cloud-starter-vault-config's releases.

5.0.2

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​dependabot[bot]

What's Changed

• Bump org.springframework.cloud:spring-cloud-dependencies-parent from 4.3.1-SNAPSHOT to 4.3.2-SNAPSHOT by @​dependabot[bot] in spring-cloud/spring-cloud-vault#785
• Bump org.jacoco:jacoco-maven-plugin from 0.8.6 to 0.8.13 by @​dependabot[bot] in spring-cloud/spring-cloud-vault#786
• Bump org.codehaus.mojo:flatten-maven-plugin from 1.7.0 to 1.7.3 by @​dependabot[bot] in spring-cloud/spring-cloud-vault#781
• Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.11.2 to 3.11.3 by @​dependabot[bot] in spring-cloud/spring-cloud-vault#795
• Bump software.amazon.awssdk:auth from 2.17.195 to 2.17.295 by @​dependabot[bot] in spring-cloud/spring-cloud-vault#775
• Bump org.apache.maven.plugins:maven-jar-plugin from 3.2.0 to 3.2.2 by @​dependabot[bot] in spring-cloud/spring-cloud-vault#804
• Bump com.google.cloud:google-cloud-iamcredentials from 1.2.2 to 1.2.5 by @​dependabot[bot] in spring-cloud/spring-cloud-vault#801
• Bump org.springframework.cloud:spring-cloud-dependencies-parent from 4.3.1-SNAPSHOT to 4.3.2-SNAPSHOT by @​dependabot[bot] in spring-cloud/spring-cloud-vault#805
• Bump org.springframework.cloud:spring-cloud-dependencies-parent from 4.3.1-SNAPSHOT to 4.3.2-SNAPSHOT by @​dependabot[bot] in spring-cloud/spring-cloud-vault#810
• Bump org.springframework.cloud:spring-cloud-dependencies-parent from 4.3.1-SNAPSHOT to 4.3.2-SNAPSHOT by @​dependabot[bot] in spring-cloud/spring-cloud-vault#812
• Bump org.jacoco:jacoco-maven-plugin from 0.8.13 to 0.8.14 by @​dependabot[bot] in spring-cloud/spring-cloud-vault#836
• Bump org.springframework.cloud:spring-cloud-dependencies-parent from 5.0.1-SNAPSHOT to 5.0.2-SNAPSHOT by @​dependabot[bot] in spring-cloud/spring-cloud-vault#918
• Bump org.springframework.vault:spring-vault-core from 4.0.0 to 4.0.1 by @​dependabot[bot] in spring-cloud/spring-cloud-vault#921
• Bump actions/upload-artifact from 6 to 7 by @​dependabot[bot] in spring-cloud/spring-cloud-vault#922
• Bump @​antora/collector-extension from 1.0.2 to 1.0.3 in /docs by @​dependabot[bot] in spring-cloud/spring-cloud-vault#923
• Bump @​springio/asciidoctor-extensions from 1.0.0-alpha.17 to 1.0.0-alpha.18 in /docs by @​dependabot[bot] in spring-cloud/spring-cloud-vault#926
• Bump @​springio/antora-extensions from 1.14.7 to 1.14.9 in /docs by @​dependabot[bot] in spring-cloud/spring-cloud-vault#931
• Bump @​springio/antora-extensions from 1.14.9 to 1.14.10 in /docs by @​dependabot[bot] in spring-cloud/spring-cloud-vault#932
• Bump @​springio/antora-extensions from 1.14.10 to 1.14.11 in /docs by @​dependabot[bot] in spring-cloud/spring-cloud-vault#935
• Bump org.springframework.vault:spring-vault-core from 4.0.1 to 4.0.2 by @​dependabot[bot] in spring-cloud/spring-cloud-vault#937
• Bump @​springio/antora-extensions from 1.14.11 to 1.14.12 in /docs by @​dependabot[bot] in spring-cloud/spring-cloud-vault#945

Full Changelog: spring-cloud/spring-cloud-vault@v5.0.1...v5.0.2

Commits

• 5c435fa Update SNAPSHOT to 5.0.2
• 6027f1b Upgrade to Spring Vault 4.0.3
• f98987d Merge pull request #945 from spring-cloud/dependabot/npm_and_yarn/docs/main/s...
• f62fe08 Bump @​springio/antora-extensions from 1.14.11 to 1.14.12 in /docs
• 461a696 Use PR workflow
• bf81531 Bumping versions
• 996f864 Upgrading antora to 3.2.0-alpha.12
• b7e14b8 Merge pull request #937 from spring-cloud/dependabot/maven/main/org.springfra...
• 42c9e8b Bump org.springframework.vault:spring-vault-core from 4.0.1 to 4.0.2
• bf948d0 Merge pull request #935 from spring-cloud/dependabot/npm_and_yarn/docs/main/s...
• Additional commits viewable in compare view

Updates com.nimbusds:nimbus-jose-jwt from 10.9 to 10.9.1

Commits

• 94f4387 [maven-release-plugin] prepare for next development iteration
• 5370446 Back-ports fix for iss #619
• 62d00fc [maven-release-plugin] prepare release 10.9.1
• See full diff in compare view

Updates org.bouncycastle:bcpkix-jdk18on from 1.84 to 1.85

Changelog

Sourced from org.bouncycastle:bcpkix-jdk18on's changelog.

... (truncated)

Commits

• See full diff in compare view

Updates com.google.auth:google-auth-library-oauth2-http from 1.47.0 to 1.50.0

Updates org.apache.tika:tika-core from 3.3.1 to 3.3.2

Changelog

Sourced from org.apache.tika:tika-core's changelog.

Release 3.3.2 - 7/16/2026

• Dependency upgrades (TIKA-4738).

• tika-server now requires enableUnsecureFeatures=true when the /pipes, /async, or /status endpoints are selected; the server refuses to start otherwise (TIKA-4760).

• Port the 4.x SAX-based OOXML parsers to 3.x and make SAX default. The docx/pptx/xlsx/vsdx SAX parsers gain field-code hyperlink extraction, inlined footnotes/endnotes/comments, balanced-XHTML recovery on error, and XMLBeans-free xlsx/xlsb reading. The DOM docx/pptx parsers can still be configured via useSAXDocxExtractor/useSAXPptxExtractor (TIKA-4692, TIKA-4708, TIKA-4790).

Release 3.3.1 - 5/20/2026

• Dependency upgrades (TIKA-4695).

• Use the IANA-registered text/markdown as the primary media type, with text/x-web-markdown and text/x-markdown kept as aliases (TIKA-4724).

• Fix several potential resource/file-handle leaks across the OOXML and ODF parsers, the HTTP fetcher, the gRPC server, and ForkClient (TIKA-4704).

• The resourceName of a nested tarball no longer includes the parent directories of its parent gzip file, and fix a typo in the .gz extension (TIKA-4705).

Release 3.3.0 - 3/18/2026

• Switch to poi-ooxml-full (TIKA-4563).

• Users need to add "allowAbsolutePaths=true" for the FileSystemFetcher to fetch an absolute path (TIKA-4649).

• Add a markdown option for content handlers (TIKA-4563).

• Improve zip parsing (TIKA-4650).

• Add detection of compressed bmp (TIKA-4511).

• Allow per file timeouts in tika-pipes (TIKA-4497).

• Add matroska detector (TIKA-1180).

• Allow multiple values for many Dublin Core keys (TIKA-4466).

• Extract macros by default in tika-app's commandline and gui (TIKA-4472).

• Improve extraction of Javascript from PDFs (TIKA-4465).

... (truncated)

Commits

• b8a6916 [maven-release-plugin] prepare release 3.3.2-rc1
• bf67012 Prep for 3.3.2 rc1, another day...
• a2d8362 Prep for 3.3.2 rc1, bump maven version
• df5130f Prep for 3.3.2 rc1, roll back release version
• d6cc513 Prep for 3.3.2 rc1, javadocs
• 73865f9 [maven-release-plugin] prepare for next development iteration
• c8a2d64 [maven-release-plugin] prepare release 3.3.2-rc1
• 63f4a95 Prep for 3.3.2 rc1
• 3cecc5b TIKA-4790 -- make sax parsing default in 3.x (#2957)
• 883805d backport javadocs aggregate fix from main (#2958)
• Additional commits viewable in compare view

Updates com.googlecode.libphonenumber:libphonenumber from 9.0.31 to 9.0.36

Release notes

Sourced from com.googlecode.libphonenumber:libphonenumber's releases.

v9.0.36

Hi all,

Please find the new JARs on the maven site here.

The new release contains mostly metadata changes.

Thanks to all those who contributed by providing issue reports! See detailed release notes.

Want to be notified of future releases? Join the discussion group!

v9.0.35

Hi all,

Please find the new JARs on the maven site here.

The new release contains mostly metadata changes. Thanks to all those who contributed by providing issue reports! See detailed release notes.

Want to be notified of future releases? Join the discussion group!

v9.0.34

Hi all,

Please find the new JARs on the maven site here.

The new release contains mostly metadata changes. Thanks to all those who contributed by providing issue reports! See detailed release notes.

Want to be notified of future releases? Join the discussion group!

v9.0.33

Hi all,

Please find the new JARs on the maven site here.

The new release contains mostly metadata changes. Thanks to all those who contributed by providing issue reports! See detailed release notes.

Want to be notified of future releases? Join the discussion group!

v9.0.32

Hi all,

Please find the new JARs on the maven site here.

... (truncated)

Changelog

Sourced from com.googlecode.libphonenumber:libphonenumber's changelog.

Jul 30, 2026: v9.0.36 Metadata changes:

• Updated alternate formatting data for country calling code(s): 995
• Updated phone metadata for region code(s): BD, EH, FO, GE, IL, LI, MA, ML, NO, SJ
• Updated short number metadata for region code(s): FO, IT
• Updated carrier data for country calling code(s): 47 (en), 61 (en), 212 (en), 256 (en), 298 (en), 423 (en), 972 (en), 995 (en)

Jul 16, 2026: v9.0.35 Metadata changes:

• Updated alternate formatting data for country calling code(s): 995
• Updated phone metadata for region code(s): AC, CN, FO, GE, IR, KE, SE, UG, ZW
• Updated short number metadata for region code(s): FR
• Updated geocoding data for country calling code(s): 86 (en, zh)
• Updated carrier data for country calling code(s): 61 (en), 86 (en, zh), 93 (en, fa), 247 (en), 250 (en), 254 (en), 256 (en), 263 (en), 298 (en), 420 (en), 976 (en), 995 (en)

Jul 02, 2026: v9.0.34 Metadata changes:

• Updated alternate formatting data for country calling code(s): 34
• Updated phone metadata for region code(s): CM, ES, GY, HN, MZ, SR, TM, TZ, US, UZ
• Updated geocoding data for country calling code(s): 504 (en)
• Updated carrier data for country calling code(s): 46 (en), 255 (en), 258 (en), 352 (en), 381 (en), 592 (en), 597 (en), 886 (en), 998 (en)
• Updated / refreshed time zone meta data.

Jun 17, 2026: v9.0.33 Metadata changes:

• Updated phone metadata for region code(s): BF, KE, MC, MW, NO, SG, SI, UG, VN
• Updated geocoding data for country calling code(s): 47 (en)
• Updated carrier data for country calling code(s): 36 (en), 40 (en), 65 (en), 84 (en), 232 (en), 235 (en), 250 (en), 256 (en), 265 (en), 386 (en), 503 (en), 1868 (en)

Jun 03, 2026: v9.0.32 Metadata changes:

• Updated phone metadata for region code(s): DZ, JP, NO, SJ, SO, UG
• Updated carrier data for country calling code(s): 33 (en), 47 (en), 233 (en), 252 (en), 256 (en)

May 20, 2026: v9.0.31 Metadata changes:

• Updated alternate formatting data for country calling code(s): 84
• Updated phone metadata for region code(s):

... (truncated)

Commits

• eba87f5 [maven-release-plugin] prepare release v9.0.36
• 99ade73 Metadata updates for release 9.0.36 (#4043)
• eee8163 Replace recursive regex with linear scan in isAlphaNumber() to fix StackOverf...
• 2666988 Defensively cap number_of_leading_zeros in getNationalSignificantNumber (#4010)
• f7e3e88 Update README.md (#4041)
• 7c461df Mandlil maven update (#4040)
• 1b411ce Metadata updates for release 9.0.35 (#4038)
• c6220b3 Include <utility> for std::move in metadata_bytes.h (#4018)
• d055755 Update README.md (#4037)
• 0640eda Kkeshava maven update (#4036)
• Additional commits viewable in compare view

Updates org.springframework.retry:spring-retry from 2.0.12 to 2.0.13

Release notes

Sourced from org.springframework.retry:spring-retry's releases.

v2.0.13

⭐ New Features

• Add automatic module metadata #494

🐞 Bug Fixes

• Cache capacity limit prevents updates to existing entries in RetryContextCache #505
• RecoverAnnotationRecoveryHandler chooses wrong @Recover method when JVM returns non-deterministic getDeclaredMethods order #496

🔨 Dependency Upgrades

• Upgrade to Micrometer 1.15.12 #503
• Upgrade to Spring Framework 6.2.19 #502

Commits

• f101212 Release v2.0.13
• 96b5e39 Fix name of attributes in artifacts.spec
• 320e36a Refresh CI configuration
• 6f351ed Implement LRU eviction and separate caches for RetryContextCache
• 6a8b109 Upgrade to Spring Framework 6.2.19
• 979f6dc Upgrade to Micrometer 1.15.12
• ad874b8 Upgrade to AspectJ 1.9.25.1
• f4ebd2e Start building against Micrometer 1.15.12 snapshots
• a75315d Start building against Spring Framework 6.2.19 snapshots
• 722db6d Bump org.assertj:assertj-core from 3.27.3 to 3.27.7
• Additional commits viewable in compare view

Updates org.mariadb.jdbc:mariadb-java-client from 3.5.8 to 3.5.10

Release notes

Sourced from org.mariadb.jdbc:mariadb-java-client's releases.

MariaDB Connector/Java 3.5.10

3.5.10 (Jul 2026)

Full Changelog

Key Enhancements

• CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
• CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
• CONJ-1330 - add infer test to CI

Issues Resolved

• CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
• CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
• CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
• CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
• CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
• CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)
• CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder)
• CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)
• CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)
• CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)
• CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
• CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR)
• CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order

MariaDB Connector/Java 3.5.9

3.5.9 (Jun 2026)

Full Changelog

Key Enhancements

• CONJ-1223 - cache TLS trust/key managers across connections to reduce SSL connection cost
• CONJ-1314 - add SPI for interactive dialog (PAM) authentication callback
• CONJ-1311 - add dedicated option useIpForKillQuery for query cancellation
• CONJ-1310 - Add full native image support and CI coverage

Issues Resolved

• CONJ-1320 - PAM (dialog) authentication must require a secure connection (report by fg0x0)
• CONJ-1319 - Use constant-time comparison when validating the server certificate fingerprint (report by jmestwa-coder)
• CONJ-1318 - enforce allowLocalInfile=false on the server's local-infile request, so a malicious server cannot read a client file despite the option being disabled

... (truncated)

Changelog

Sourced from org.mariadb.jdbc:mariadb-java-client's changelog.

3.5.10 (Jul 2026)

Full Changelog

Key Enhancements

• CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
• CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
• CONJ-1330 - add infer test to CI

Issues Resolved

• CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
• CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
• CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
• CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
• CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
• CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)
• CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder)
• CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)
• CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)
• CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)
• CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
• CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR)
• CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order

3.4.4 (Jul 2026)

Full Changelog

Notable Changes

• CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)

Bugs Fixed

• CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
• CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
• CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
• CONJ-1329 - LOAD DATA LOCAL ...

  Description has been truncated

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.