From e4563e21f64c550b3abef054dfe1211420fd3ea7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 28 Jul 2026 02:35:17 +0000 Subject: [PATCH] Bump the gradle-dependencies group across 1 directory with 10 updates Bumps the gradle-dependencies group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [io.swagger.parser.v3:swagger-parser](https://github.com/swagger-api/swagger-parser) | `2.1.22` | `2.1.45` | | [com.diffplug.spotless:spotless-plugin-gradle](https://github.com/diffplug/spotless) | `8.8.0` | `8.9.0` | | com.diffplug.spotless | `8.8.0` | `8.9.0` | | [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.5.38` | `1.6.0` | | [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) | `1.5.38` | `1.6.0` | | [io.netty:netty-bom](https://github.com/netty/netty) | `4.2.15.Final` | `4.2.16.Final` | | [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) | `2.21.5` | `2.22.1` | | [org.apache.commons:commons-compress](https://github.com/apache/commons-compress) | `1.26.0` | `1.28.0` | | org.apache.commons:commons-lang3 | `3.18.0` | `3.20.0` | | [org.mozilla:rhino](https://github.com/mozilla/rhino) | `1.7.14.1` | `1.9.1` | Updates `io.swagger.parser.v3:swagger-parser` from 2.1.22 to 2.1.45 - [Release notes](https://github.com/swagger-api/swagger-parser/releases) - [Commits](https://github.com/swagger-api/swagger-parser/compare/v2.1.22...v2.1.45) Updates `com.diffplug.spotless:spotless-plugin-gradle` from 8.8.0 to 8.9.0 - [Release notes](https://github.com/diffplug/spotless/releases) - [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md) - [Commits](https://github.com/diffplug/spotless/compare/gradle/8.8.0...gradle/8.9.0) Updates `com.diffplug.spotless` from 8.8.0 to 8.9.0 Updates `ch.qos.logback:logback-classic` from 1.5.38 to 1.6.0 - [Release notes](https://github.com/qos-ch/logback/releases) - [Commits](https://github.com/qos-ch/logback/compare/v_1.5.38...v_1.6.0) Updates `ch.qos.logback:logback-core` from 1.5.38 to 1.6.0 - [Release notes](https://github.com/qos-ch/logback/releases) - [Commits](https://github.com/qos-ch/logback/compare/v_1.5.38...v_1.6.0) Updates `io.netty:netty-bom` from 4.2.15.Final to 4.2.16.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](https://github.com/netty/netty/compare/netty-4.2.15.Final...netty-4.2.16.Final) Updates `com.fasterxml.jackson:jackson-bom` from 2.21.5 to 2.22.1 - [Commits](https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.21.5...jackson-bom-2.22.1) Updates `ch.qos.logback:logback-core` from 1.5.38 to 1.6.0 - [Release notes](https://github.com/qos-ch/logback/releases) - [Commits](https://github.com/qos-ch/logback/compare/v_1.5.38...v_1.6.0) Updates `org.apache.commons:commons-compress` from 1.26.0 to 1.28.0 - [Changelog](https://github.com/apache/commons-compress/blob/master/RELEASE-NOTES.txt) - [Commits](https://github.com/apache/commons-compress/compare/rel/commons-compress-1.26.0...rel/commons-compress-1.28.0) Updates `org.apache.commons:commons-lang3` from 3.18.0 to 3.20.0 Updates `org.mozilla:rhino` from 1.7.14.1 to 1.9.1 - [Release notes](https://github.com/mozilla/rhino/releases) - [Changelog](https://github.com/mozilla/rhino/blob/master/RELEASE-NOTES.md) - [Commits](https://github.com/mozilla/rhino/commits) Updates `com.diffplug.spotless` from 8.8.0 to 8.9.0 --- updated-dependencies: - dependency-name: io.swagger.parser.v3:swagger-parser dependency-version: 2.1.45 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-dependencies - dependency-name: com.diffplug.spotless:spotless-plugin-gradle dependency-version: 8.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-dependencies - dependency-name: com.diffplug.spotless dependency-version: 8.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-dependencies - dependency-name: ch.qos.logback:logback-classic dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-dependencies - dependency-name: ch.qos.logback:logback-core dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-dependencies - dependency-name: io.netty:netty-bom dependency-version: 4.2.16.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-dependencies - dependency-name: com.fasterxml.jackson:jackson-bom dependency-version: 2.22.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-dependencies - dependency-name: ch.qos.logback:logback-core dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-dependencies - dependency-name: org.apache.commons:commons-compress dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-dependencies - dependency-name: org.apache.commons:commons-lang3 dependency-version: 3.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-dependencies - dependency-name: org.mozilla:rhino dependency-version: 1.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-dependencies - dependency-name: com.diffplug.spotless dependency-version: 8.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-dependencies ... Signed-off-by: dependabot[bot] --- gradle/libs.versions.toml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 3d032a6..12d1931 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -13,7 +13,7 @@ java = "21" # Build / quality -spotless = "8.8.0" +spotless = "8.9.0" errorprone-plugin = "5.1.0" errorprone-core = "2.50.0" google-java-format = "1.25.2" @@ -50,13 +50,13 @@ testcontainers = "1.21.4" # OpenAPI parsing — validates the committed velocity-api spec is well-formed OpenAPI 3.1 in a test # (velocity-api OpenApiSpecTest). velocity-only; tracks the current latest 2.1.x. -swagger-parser = "2.1.22" +swagger-parser = "2.1.45" # Test bundle (wired in the test convention plugin). Pinned to pk-auth. junit-jupiter = "6.1.2" assertj = "3.27.7" mockito = "5.23.0" -logback = "1.5.38" +logback = "1.6.0" # Security floors for transitive dependencies (see the "Transitive security floors" block in # velocity.java-conventions). None of these are direct dependencies of ours — they arrive @@ -64,11 +64,11 @@ logback = "1.5.38" # Testcontainers, rhino via swagger-parser). Each value is the first patched release for the # corresponding Dependabot advisory; it is applied as a *floor*, not a pin, so a higher version # on any resolution path still wins. Dependabot keeps these current on its weekly gradle run. -netty = "4.2.15.Final" # netty-handler / netty-resolver-dns advisories (GHSA, high) -jackson2 = "2.21.5" # jackson-databind 2.x case-insensitive @JsonIgnoreProperties bypass -commons-compress = "1.26.0" # Pack200 OOM + corrupted-DUMP infinite-loop DoS -commons-lang3 = "3.18.0" # uncontrolled recursion on long inputs -rhino = "1.7.14.1" # toFixed() high-CPU DoS +netty = "4.2.16.Final" # netty-handler / netty-resolver-dns advisories (GHSA, high) +jackson2 = "2.22.1" # jackson-databind 2.x case-insensitive @JsonIgnoreProperties bypass +commons-compress = "1.28.0" # Pack200 OOM + corrupted-DUMP infinite-loop DoS +commons-lang3 = "3.20.0" # uncontrolled recursion on long inputs +rhino = "1.9.1" # toFixed() high-CPU DoS [libraries] jspecify = { module = "org.jspecify:jspecify", version.ref = "jspecify" }