fix(deps): update all dependencies #29
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/all"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v6→v718.3→18.418.3→18.43.5.5→3.5.63.5.5→3.5.61.14.9→1.14.116.0.3→6.1.22.2.45→2.2.529.1.0.Final→9.1.2.Final42.7.10→42.7.133.20.11→3.21.612.1.0→13.0.04.0.3→4.1.012.1.0→13.0.01.10.2→1.11.02.0.0→2.1.13.1.0→3.2.13.20.11→3.21.63.20.11→3.21.63.20.11→3.21.63.20.11→3.21.642.7.10→42.7.132.0.0→2.1.1Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v7Compare Source
mockk/mockk (io.mockk:mockk-jvm)
v1.14.11Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/mockk/mockk/compare/1.14.9...v1.14.11
swagger-api/swagger-core (io.swagger.core.v3:swagger-core-jakarta)
v2.2.52: Swagger-core 2.2.52 released!Compare Source
v2.2.51: Swagger-core 2.2.51 released!Compare Source
v2.2.50: Swagger-core 2.2.50 released!Compare Source
v2.2.49: Swagger-core 2.2.49 released!Compare Source
v2.2.48: Swagger-core 2.2.48 released!Compare Source
v2.2.47: Swagger-core 2.2.47 released!Compare Source
v2.2.46: Swagger-core 2.2.46 released!Compare Source
hibernate/hibernate-validator (org.hibernate.validator:hibernate-validator)
v9.1.2.FinalCompare Source
Hibernate Validator 9.1.2.Final released
We are pleased to announce the release of Hibernate Validator 9.1: 9.1.2.Final.
You can find the full list of 9.1.2.Final changes here.
What's new
Conclusion
For additional details, see:
Visit the website for details on getting in touch with us.
v9.1.1.FinalCompare Source
Hibernate Validator 9.1.1.Final released
We are pleased to announce the release of Hibernate Validator 9.1: 9.1.1.Final.
You can find the full list of 9.1.1.Final changes here.
What's new
Conclusion
For additional details, see:
Visit the website for details on getting in touch with us.
pgjdbc/pgjdbc (org.postgresql:postgresql)
v42.7.13Added
search_pathchange via GUC_REPORT (PostgreSQL 18+), so cached plans are no longer used against the wrong schema PR #4259reWriteBatchedInsertsnow merges up to 32768 rows into one multi-valuesINSERT(bounded by the 65535 bind-parameter limit on the extended protocol) instead of capping at 128, which speeds up batches of few-column rows. The newreWriteBatchedInsertsSizeconnection property lowers that cap when set; the default of0uses that maximum. PR #4207autosave=ALWAYS. Controlled by the newflushCacheOnDdlconnection property (defaulttrue); set tofalsefor the prior behaviour. PR #4067connectExecutorconnection property to customize theExecutorused to run the worker task that performs the connection attempt whenloginTimeoutis in effect. The value is the fully qualified name of a class implementingjava.util.concurrent.Executor. With a null value, the default, the driver retains the prior behavior of running the connection attempt on a daemon thread named"PostgreSQL JDBC driver connection thread". The executor must run the task on a thread other than the caller's. Running the attempt on a named thread lets applications that monitor driver-created threads identify it. PR #4165classLoaderStrategyconnection property to control which classloaders the driver searches when loading a class named by a connection property, for examplesocketFactory. The defaultdriver-firstnow falls back to the thread context classloader when the driver's classloader cannot resolve the class, which fixes class loading in non-flat class paths such as Quarkus and OSGi. Setdriverto keep the previous driver-classloader-only behaviour, orcontext-firstto prefer the thread context classloader Issue #2112 PR #4167RECORD, andrefcursorPR #4220LargeObjectBlobInputStreamnow skips by seeking instead of reading, and the driver exposes the server version so it can select the 64-bit large-object API where available PR #4204Changed
loginTimeoutis now aFutureTask(ConnectTask) instead of the hand-rolledConnectThread. When the caller hits the timeout, the task is now cancelled withcancel(true), which interrupts the worker thread rather than letting it run to completion. This makes the connection attempt interruptible, sologinTimeoutcan stop a slow connection attempt instead of leaking a thread. As before, a connection that the worker still manages to establish after the caller gives up is closed by the worker so that it does not leak. There are no public API changes and this should only lead to faster background resource cleanup for connections that time out. PR #4120PGXAConnection.ConnectionHandlernow rejectssetAutoCommit(false)andsetSavepoint(...)during an active XA branch, in addition to the long-rejectedsetAutoCommit(true)/commit()/rollback(). ThesetSavepointrejection was already meant to be in place but the guard misspelled the method name assetSavePoint, so savepoints silently went through. Both changes bring the proxy in line with JTA 1.2 §3.4. PR #4114commitPrepared/rollback-of-prepared now returnXAER_RMFAILinstead ofXAER_RMERRwhen the underlying connection is left in a non-idleTransactionState. Transaction managers (Geronimo, Narayana, Atomikos) treatXAER_RMFAILas retryable on a freshXAResource; the prepared transaction is no longer abandoned. PR #4114getPrimaryKeysfrompg_constraint.conkeyPR #4202Fixed
postgresql-<version>.jarand its detached PGP signature, taken from the same signed build that is uploaded to Maven Central, instead of a leftover SNAPSHOT jar Issue #3812 PR #3814Statement#cancelstate machine by dropping the redundantCANCELLEDstate.killTimerTasknow waits for the state to return toIDLEdirectly, which removes a spin-forever case when more than one thread observes the cancel completing PR #1827.BEGINand the following query to share a network flush Issue #3894 PR #4196reWriteBatchedInsertsno longer throwsIllegalArgumentExceptionwhen batching a parameterlessINSERT(for exampleINSERT INTO t VALUES (1, 2)) of 256 rows or more PR #4207CALLin aCallableStatementno longer hides the native call, so OUT parameter registration works for/* comment */ call proc(?, ?)and similar.Parser.modifyJdbcCallnow skips leading whitespace and SQL comments (both--and/* */) before the call, tolerates a trailing comment after a{ ... }escape, and no longer adds a spurious comma when moving an OUT parameter into a call whose arguments are only a comment Issue #2538 PR #4209PreparedStatement.toString()no longer throws for abyteavalue supplied as text viaPGobject. Hex-format values (\x...) are validated and rendered as abytealiteral, and escape-format values are quoted and cast like any other literal Issue #3757 PR #4201contextClassLoaderof sharedForkJoinPool.commonPool()worker threads, which previously left unrelated tasks on those threads running with anullclassloader Issue #4155 PR #4156PgResultSet#getCharacterStreamwrapsStringin aStringReaderPR #4063PGXAConnectionno longer saves and restores the underlying connection's JDBCautoCommitflag. All XA-protocol SQL (BEGIN,PREPARE TRANSACTION,COMMIT,ROLLBACK,COMMIT PREPARED,ROLLBACK PREPARED, therecover()SELECT) is sent throughQUERY_SUPPRESS_BEGIN, so the caller'sautoCommitvalue is invariant across everyXAResourcecall. Fixes the "2nd phase commit must be issued using an idle connection" failure during recovery on managed datasources that pool connections withautoCommit=false(TomEE, WildFly, WebSphere Liberty) PR #4114PGXAConnection.prepare()now mutates XA state only afterPREPARE TRANSACTIONsucceeds. A failedPREPAREpreviously left the driver thinking the branch was already prepared, so the follow-uprollback(xid)triedROLLBACK PREPAREDagainst a non-existent gid and returnedXAER_RMERR. Transaction managers (Narayana) escalated this toHeuristicMixedException. With the fix,rollback(xid)takes the active-branch path and issues a plainROLLBACK, which the server accepts cleanly. Fixes Issue #3153, Issue #3123. PR #4114search_path. When two schemas held a table with the same name and the same primary or unique index name but a different set of key columns, the driver took the union of both schemas' columns, so the result set could be wrongly rejected as not updatable PR #4214. Supersedes PR #3400.LargeObject.close()now flushes a buffered output stream before marking the object closed, so closing a large object without an explicitflush()no longer drops buffered writes. The flush runs while the object is still open (it calls back intoLargeObject.write()), andlo_closealways runs afterward; a failure fromlo_closeno longer masks an earlier flush error, and the transaction is not committed when the flush failed Issue #4247 PR #4248.timestamp,timestamptz, anddatetext with a clearSQLException(SQLState22007) instead of anArrayIndexOutOfBoundsExceptionPR #4278CHAR_OCTET_LENGTHfor non-character columns PR #4231ResultSet.getBigDecimal(int, int)PR #4211java.timevalues in an updatableResultSetupdateRow()/insertRow()PR #3848RETURNINGclause containsvarcharornumerictypes PR #4014estimatedReceiveBufferBytesaccounting after a forcedSyncPR #4014ResultSetfor describe-statement purposes, and restore the pre-describe path for generated-key batches PR #4014search_pathchanges case-insensitively PR #4216.keyextension PR #3946KeyStoreso FIPS JVMs work PR #4193gssResponseTimeoutrather thansslResponseTimeoutfor GSS connections PR #4076SET LOCAL/SET SESSION TRANSACTIONPR #4203AssertionErrorfromBatchResultHandleron a closed connection PR #4187SQL_TSI_FRAC_SECONDwith an explicit, explained error PR #4229Driver.acceptsURLwith a clearNullPointerExceptionPR #4205NumberParser.getFastLonginstead of silently wrapping PR #4163PGInterval.setSecondsPR #4194PgConnectionsetup fails after connect PR #4161LazyCleanerImplcleanup task alive across a transient empty queue PR #4038socksNonProxyHostsis set PR #4045ResourceBundlecache on deregister so the driver can unload PR #4237IOExceptionPR #4190java.lang.managementdependency in themaxResultBufferparser PR #4069v42.7.12Security
Under
channelBinding=require, the driver silently downgraded fromSCRAM-SHA-256-PLUS(with channel binding) to plainSCRAM-SHA-256(without it) when the server presented a certificate whose signature algorithm has notls-server-end-pointchannel-binding hash (e.g.Ed25519, Ed448, or post-quantum algorithms). An attacker who can intercept the TLS connection could exploit this to strip channel-binding protection.The fix enforces channel binding in the driver's own code: it now fails the connection when no binding data can be extracted, and verifies the negotiated mechanism uses channel binding (
-PLUS) whenrequireis set.Only connections that set
channelBinding=requireare affected. The defaultpreferpolicy and releases before 42.7.4 (which introduced channel-binding support) are unaffected.See the Security Advisory for more detail.
The following CVE-2026-54291 has been issued.
v42.7.11Security
pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins.
See the Security Advisory for more detail.
The following CVE-2026-42198 has been issued.
Added
Changed
Fixed
spring-projects/spring-boot (org.springframework.boot:spring-boot-dependencies)
v4.1.0Compare Source
Full release notes for Spring Boot 4.1 are available on the wiki.
⭐ New Features
🐞 Bug Fixes
📔 Documentation
🔨 Dependency Upgrades
❤️ Contributors
Thank you to all the contributors who worked on this release:
@Abdlatif-nabgha, @DragonFSKY, @Kapil-chn7, @Kimgyuilli, @SJvaca30, @SebTardif, @ares333, @codingkiddo, @dlwldnjs1009, @eddumelendez, @henriquejsza, @igormukhin, @johnnypwong, @kwondh5217, @leestana01, @mheath, @mmoayyed, @msridhar, @ngocnhan-tran1996, @nosan, @quaff, @scordio, @vinhhieu21, @vpavic, @won-seoop, and @zxuhan
v4.0.7Compare Source
🐞 Bug Fixes
📔 Documentation
🔨 Dependency Upgrades
❤️ Contributors
Thank you to all the contributors who worked on this release:
@Abdlatif-nabgha, @DragonFSKY, @Kapil-chn7, @Kimgyuilli, @SJvaca30, @SebTardif, @ares333, @codingkiddo, @dlwldnjs1009, @henriquejsza, @igormukhin, @johnnypwong, @kwondh5217, @leestana01, @mheath, @mmoayyed, @msridhar, @ngocnhan-tran1996, @nosan, @quaff, @scordio, @vinhhieu21, @won-seoop, and @zxuhan
v4.0.6Compare Source
🐞 Bug Fixes
@Ssldon't work on@Beanmethods when using@ServiceConnection#50064@EnableEnversRepositoriesrather than configuring the JPA counterpart #50039📔 Documentation
🔨 Dependency Upgrades
❤️ Contributors
Thank you to all the contributors who worked on this release:
@GollapudiSrikanth, @MohammedGhallab, @bachhs, @dlwldnjs1009, @edwardsre, @kodama-kcc, @kwondh5217, @ppapaj, @quaff, @refeccd, @scordio, and @xxxxxxjun
v4.0.5Compare Source
🐞 Bug Fixes
@NestedConfigurationPropertywhen using constructor binding #49738@ConditionalOnWebApplicationto NettyReactiveWebServerAutoConfiguration #49695@GraphQlTestdoes not include@ControllerAdvice#49672📔 Documentation
🔨 Dependency Upgrades
❤️ Contributors
Thank you to all the contributors who worked on this release:
@Joowon-Seo, @deejay1, @dlwldnjs1009, @kwondh5217, @ljrmorgan, and @quaff
v4.0.4Compare Source
⚠️ Attention Required
server.tomcat.max-part-counthas been increased from 10 to 50. This aligns it with Tomcat's own default and the default in Spring Boot 3.x. #49311🐞 Bug Fixes
@AutoConfigureWebTestClientprevents separate configuration of spring.test.webtestclient.timeout from taking effect #49344📔 Documentation
🔨 Dependency Upgrades
❤️ Contributors
Thank you to all the contributors who worked on this release:
@FBibonne, @answndud, @bbbbooo, @chandanv89, @giyeon95, @itsmevichu, @jayychoi, @l2yujw, @ngocnhan-tran1996, @qnnn, @quaff, and @sbrannen
Kotlin/kotlinx.coroutines (org.jetbrains.kotlinx:kotlinx-coroutines-bom)
v1.11.0Compare Source
Various
Breaking changes and deprecations
Promise-related functions from JS and Wasm/JS to the newwebtarget. On Wasm/JS, this is a breaking change. Before the change,Promiseon Wasm/JS could work with arbitrary Kotlin types, but now, onlyJsAnysubtypes are accepted (#4563).CoroutineDispatcheras the coroutine context key; now,ContinuationInterceptorhas to be used instead (#4333).kotlinx-coroutines-testAPIs (#4604).Jobto coroutine builders as deprecated (#4435).Bug fixes and improvements
callsInPlace(EXACTLY_ONCE)contract torunBlockingin code shared between JVM and Native (#4368).callsInPlace(EXACTLY_ONCE)contract tosuspendCancellableCoroutine(#4574).flowOnincorrectly handlingThreadContextElementupdates (#4403).Thread.UncaughtExceptionHandlerinstances causing the internal coroutines machinery to fail (#4516).CoroutineDispatcher.asSchedulerin the RxJava integration not cancelling outstanding work when aWorkergets cancelled, which led to memory leaks in some scenarios (#4615).SharedFlowentering an invalid state when a subscriber and an emitter are cancelled simultaneously (#4583).shareIn/stateIncoroutines getting garbage-collected (#4646). Thanks, @solevic!Small additions
CompletableDeferred.asDeferredfor obtaining a read-onlyDeferredview (#4408).SharedFlow.asFlowfor obtaining aFlowview with hidden hot flow semantics (#4530). Thanks, @g000sha256!StateFlow.collectLatestoverload returningNothingto assist with finding unreachable code (#4454).ReceiveChannel.consumeTofor consuming aReceiveChannelinto aMutableCollection(#4520).StateFlow<T>.onSubscriptionoverload returning aStateFlow<T>, similar toSharedFlow<T>.onSubscriptionreturningSharedFlow<T>(#4275). Thanks, @xit0c!Flowoperators for collecting aFlowto aMap(#1541).Changelog relative to version 1.11.0
No changes, only the version is increased.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.
7d963936dcab0f49ddb0fix(deps): update all dependencies to v2.0.1to fix(deps): update all dependenciesab0f49ddb06ae22e0aaf6ae22e0aafea5c6e0393ea5c6e0393e1d791d38ae1d791d38a82d41a851682d41a851694057647f194057647f1485d2654ef485d2654ef20339a0e3f20339a0e3f4019f7659c4019f7659c96dde218ff96dde218ff478de41ee1478de41ee13f565b33b33f565b33b3cc503fd81fcc503fd81f7988d82bd47988d82bd4d191517b20d191517b204eaf5e8d2a4eaf5e8d2abd0d11943abd0d11943a47b77cc69447b77cc694cf34669f03cf34669f0374fef6d4a174fef6d4a1593903b8d6593903b8d6a2f0dfef28a2f0dfef28b7c136dd80b7c136dd80647cb99f22647cb99f2239efa245c639efa245c693ee4e860b93ee4e860b9b51ec793c9b51ec793cbef2182c85bef2182c8595a2a4162795a2a41627d48677dc37d48677dc37ebf30d1efcebf30d1efc58b59ac7ac58b59ac7aca878571249a87857124954f7fc03cd54f7fc03cdc99bf07acbc99bf07acba5d786b74da5d786b74de3e72aeeefe3e72aeeefd27c762e4bd27c762e4bc57960d587c57960d58781a4c1d363Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️ Warning: custom changes will be lost.