Update Renovatebot Gradle Updates - #1190
Open
protocols-renovate[bot] wants to merge 1 commit into
Open
Conversation
|
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
usmansaleem
force-pushed
the
renovate/renovatebot-gradle-updates
branch
from
June 19, 2026 00:36
baf4cfb to
b260936
Compare
protocols-renovate
Bot
force-pushed
the
renovate/renovatebot-gradle-updates
branch
from
June 28, 2026 04:51
b260936 to
2ec5fe8
Compare
protocols-renovate
Bot
force-pushed
the
renovate/renovatebot-gradle-updates
branch
from
July 14, 2026 04:19
2ec5fe8 to
69445f0
Compare
protocols-renovate
Bot
force-pushed
the
renovate/renovatebot-gradle-updates
branch
from
July 14, 2026 21:34
69445f0 to
295be15
Compare
protocols-renovate
Bot
force-pushed
the
renovate/renovatebot-gradle-updates
branch
from
July 14, 2026 21:34
295be15 to
4203292
Compare
protocols-renovate
Bot
force-pushed
the
renovate/renovatebot-gradle-updates
branch
from
July 28, 2026 04:24
4203292 to
71a238b
Compare
protocols-renovate
Bot
force-pushed
the
renovate/renovatebot-gradle-updates
branch
from
August 14, 2026 04:00
71a238b to
99c90f6
Compare
protocols-renovate
Bot
force-pushed
the
renovate/renovatebot-gradle-updates
branch
from
August 28, 2026 05:58
99c90f6 to
7a912bf
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.16→4.171.3.5→1.3.73.17.0→3.18.12.42.37→2.54.12.42.37→2.54.12.42.37→2.54.12.42.37→2.54.12.42.37→2.54.117.9.0→17.10.02.91.0→2.95.03.52.1→3.54.03.52.1→3.54.03.52.1→3.54.042.7.10→42.7.137.0.2→7.1.01.18.2→1.18.44.10.6→4.11.24.10.6→4.11.25.0.2→5.0.35.0.2→5.0.35.0.2→5.0.31.12→1.13.00.3.15→0.3.1826.4.0→26.8.026.4.0→26.8.026.4.0→26.8.026.4.0→26.8.026.4.0→26.8.026.4.0→26.8.026.4.0→26.8.026.4.0→26.8.026.4.0→26.8.00.8.14→0.8.151.84→1.85.21.84→1.852.7.2→2.8.02.7.2→2.8.02.7.2→2.8.02.7.2→2.8.04.5.26→4.5.324.5.26→4.5.324.5.26→4.5.324.5.26→4.5.324.5.26→4.5.324.5.26→4.5.324.5.26→4.5.321.3.6→1.4.03.2.3→3.2.433.6.0-jre→33.7.1-jre3.1.2→3.1.42.49.0→2.50.02.49.0→2.50.02.49.0→2.50.02.49.0→2.50.00.54.0→0.61.02.21.2→2.22.28.4.0→8.10.02.21.2→2.22.212.2.1→12.2.24.2.12.Final→4.2.17.Final5.14.3→5.14.42.25.4→2.26.1Release Notes
reactor/reactor-netty (io.projectreactor.netty:reactor-netty-http)
v1.3.7Reactor Netty1.3.7is part of2025.0.7Release Train.What's Changed
✨ New features and improvements
Reactor Corev3.8.7by @violetagg inb0395be, see release notesNettyv4.2.17.Finalby @violetagg in #4324WebSocketclient metrics by @LivingLikeKrillin in #4118MeterRegistrarby @ejhnsn in #4250AddressUtils.updatePortby @samueldlightfoot in #4298ForwardedandX-Forwardedheaders by @violetagg in #4312isH2cUpgradeinHttp3Poolto always return false by @violetagg in #4325addressparameter from the HttpClientrecordRead/recordWrite/startWriteby @violetagg in #4327f4ca645NonSslRedirectHandleralways does a redirect based on HOST header by @violetagg in626a6e76908378🐞 Bug fixes
HTTP/2connections from the pool during thePINGliveness check by @LivingLikeKrillin in #4255Http11EvictionPredicateby @LivingLikeKrillin in #4256SNIlookup completion when the channel is already closed by @violetagg in #4266NameResolverProvider#equals/hashCodeby @violetagg in717381bTracingMapHandleto handle exceptions correctly by @violetagg in68561f4fc9832888adf0cdc07b928d37581📖 Documentation
74a5524New Contributors
Full Changelog: reactor/reactor-netty@v1.3.6...v1.3.7
v1.3.6Reactor Netty1.3.6is part of2025.0.6Release Train.What's Changed
DNSresolver channel allocation strategy by @violetagg in #4230✨ New features and improvements
Reactor Corev3.8.6by @violetagg in511a3b6, see release notesNettyv4.2.15.Finalby @violetagg in #4237isSelfDefinedMessageLengthfor keep-alive by @violetagg in #4200HTTP/2websocketCONNECT:protocol/:pathin channel attributes by @violetagg in #42021a4c422🐞 Bug fixes
keep-aliverace when creatingHttpServerOperationsby @koisyu in #4189HTTP/3connection pool drain when server replenishes streams to same level by @violetagg in #4193AdaptiveByteBufAllocatorby @lukas-riedler-dynatrace in #4217DecoderExceptionwith hostname whenSNIAsyncMapping resolves to null by @kwondh5217 in #4212e7ef551📖 Documentation
WebSocketecho server example by @Yelagandula in #4177TCP/UDPmetricsremote.addresstag cardinality by @violetagg in #4201New Contributors
Full Changelog: reactor/reactor-netty@v1.3.5...v1.3.6
lysine-dev/okio (com.squareup.okio:okio)
v3.18.12026-07-28
the new
base64()function, we inadvertently changed the binary signature! Ugh! This is nowfixed and we've automated binary-compatibility checking for Kotlin/Native going forward.
v3.18.02026-07-21
AssetFileSystem.exists()when the underlying storage throws aFileNotFoundException.preopen. The platform behavior recently changed inNodeJS, causing our
WasiFileSystemto be unable to access files!BufferedSource.readUInt(),BufferedSink.writeUInt(), and similar functions forUByte,UShortandULong. Also add support for unsigned and little-endian.BufferedSink.utf8Appendable(). Use this to adapt an Okio sink to anAppendable.Source.limit()returns a wrapped source with a strict limit on how many bytes arereturned.
ByteString.equals(other, constantTime)for subtle defense against timing attacks.jdbi/jdbi (org.jdbi:jdbi3-testing)
v3.54.0@SqlPreflight(Alpha) for SQL Object methods. The annotation runs a literal SQL statement onthe same
Handle, immediately before the method's main statement, binding the method's arguments.This is useful for setting scoped/session variables before a query (e.g. a Postgres trigram
threshold). It is repeatable and may be placed on a method or a SQL Object type. See issue #2979.
v3.53.0Fixes: Jdbi-Freemarker Security Advisory GHSA-mggx-p7jf-jgw4
The Freemarker configuration allows templates to construct arbitrary
Java types, including
freemarker.template.utility.Execute.While exploiting this requires other unsafe practices (letting a user
dictate template input), it seems prudent to disable template class resolution.
Please see GHSA-mggx-p7jf-jgw4 for more details.
Upgrade to testcontainers 2.x
While this required no code changes, the testcontainers project has
renamed a number of their jar files. Jdbi still supports
testcontainers 1.x and now also testcontainers 2.x:
If you are using testcontainers with Jdbi today and can not update to
2.x, make sure that you reference the
org.testcontainers:jdbcandorg.testcontainers:junit-jupiterdependencies. Those used to beavailable as transitive dependency from
jdbi3-testcontainers.If you upgrade to testcontainers 2.x, the
org.testcontainers:testcontainers-jdbcandorg.testcontainers:testcontainers-junit-jupiterdependencies must beavailable.
pgjdbc/pgjdbc (org.postgresql:postgresql)
v42.7.13Added
search_pathchange via GUC_REPORT (PostgreSQL 18+), so cached plans are no longer used against the wrong schema PR #4259reWriteBatchedInsertsnow merges up to 32768 rows into one multi-valuesINSERT(bounded by the 65535 bind-parameter limit on the extended protocol) instead of capping at 128, which speeds up batches of few-column rows. The newreWriteBatchedInsertsSizeconnection property lowers that cap when set; the default of0uses that maximum. PR #4207autosave=ALWAYS. Controlled by the newflushCacheOnDdlconnection property (defaulttrue); set tofalsefor the prior behaviour. PR #4067connectExecutorconnection property to customize theExecutorused to run the worker task that performs the connection attempt whenloginTimeoutis in effect. The value is the fully qualified name of a class implementingjava.util.concurrent.Executor. With a null value, the default, the driver retains the prior behavior of running the connection attempt on a daemon thread named"PostgreSQL JDBC driver connection thread". The executor must run the task on a thread other than the caller's. Running the attempt on a named thread lets applications that monitor driver-created threads identify it. PR #4165classLoaderStrategyconnection property to control which classloaders the driver searches when loading a class named by a connection property, for examplesocketFactory. The defaultdriver-firstnow falls back to the thread context classloader when the driver's classloader cannot resolve the class, which fixes class loading in non-flat class paths such as Quarkus and OSGi. Setdriverto keep the previous driver-classloader-only behaviour, orcontext-firstto prefer the thread context classloader Issue #2112 PR #4167RECORD, andrefcursorPR #4220LargeObjectBlobInputStreamnow skips by seeking instead of reading, and the driver exposes the server version so it can select the 64-bit large-object API where available PR #4204Changed
loginTimeoutis now aFutureTask(ConnectTask) instead of the hand-rolledConnectThread. When the caller hits the timeout, the task is now cancelled withcancel(true), which interrupts the worker thread rather than letting it run to completion. This makes the connection attempt interruptible, sologinTimeoutcan stop a slow connection attempt instead of leaking a thread. As before, a connection that the worker still manages to establish after the caller gives up is closed by the worker so that it does not leak. There are no public API changes and this should only lead to faster background resource cleanup for connections that time out. PR #4120PGXAConnection.ConnectionHandlernow rejectssetAutoCommit(false)andsetSavepoint(...)during an active XA branch, in addition to the long-rejectedsetAutoCommit(true)/commit()/rollback(). ThesetSavepointrejection was already meant to be in place but the guard misspelled the method name assetSavePoint, so savepoints silently went through. Both changes bring the proxy in line with JTA 1.2 §3.4. PR #4114commitPrepared/rollback-of-prepared now returnXAER_RMFAILinstead ofXAER_RMERRwhen the underlying connection is left in a non-idleTransactionState. Transaction managers (Geronimo, Narayana, Atomikos) treatXAER_RMFAILas retryable on a freshXAResource; the prepared transaction is no longer abandoned. PR #4114getPrimaryKeysfrompg_constraint.conkeyPR #4202Fixed
postgresql-<version>.jarand its detached PGP signature, taken from the same signed build that is uploaded to Maven Central, instead of a leftover SNAPSHOT jar Issue #3812 PR #3814Statement#cancelstate machine by dropping the redundantCANCELLEDstate.killTimerTasknow waits for the state to return toIDLEdirectly, which removes a spin-forever case when more than one thread observes the cancel completing PR #1827.BEGINand the following query to share a network flush Issue #3894 PR #4196reWriteBatchedInsertsno longer throwsIllegalArgumentExceptionwhen batching a parameterlessINSERT(for exampleINSERT INTO t VALUES (1, 2)) of 256 rows or more PR #4207CALLin aCallableStatementno longer hides the native call, so OUT parameter registration works for/* comment */ call proc(?, ?)and similar.Parser.modifyJdbcCallnow skips leading whitespace and SQL comments (both--and/* */) before the call, tolerates a trailing comment after a{ ... }escape, and no longer adds a spurious comma when moving an OUT parameter into a call whose arguments are only a comment Issue #2538 PR #4209PreparedStatement.toString()no longer throws for abyteavalue supplied as text viaPGobject. Hex-format values (\x...) are validated and rendered as abytealiteral, and escape-format values are quoted and cast like any other literal Issue #3757 PR #4201contextClassLoaderof sharedForkJoinPool.commonPool()worker threads, which previously left unrelated tasks on those threads running with anullclassloader Issue #4155 PR #4156PgResultSet#getCharacterStreamwrapsStringin aStringReaderPR #4063PGXAConnectionno longer saves and restores the underlying connection's JDBCautoCommitflag. All XA-protocol SQL (BEGIN,PREPARE TRANSACTION,COMMIT,ROLLBACK,COMMIT PREPARED,ROLLBACK PREPARED, therecover()SELECT) is sent throughQUERY_SUPPRESS_BEGIN, so the caller'sautoCommitvalue is invariant across everyXAResourcecall. Fixes the "2nd phase commit must be issued using an idle connection" failure during recovery on managed datasources that pool connections withautoCommit=false(TomEE, WildFly, WebSphere Liberty) PR #4114PGXAConnection.prepare()now mutates XA state only afterPREPARE TRANSACTIONsucceeds. A failedPREPAREpreviously left the driver thinking the branch was already prepared, so the follow-uprollback(xid)triedROLLBACK PREPAREDagainst a non-existent gid and returnedXAER_RMERR. Transaction managers (Narayana) escalated this toHeuristicMixedException. With the fix,rollback(xid)takes the active-branch path and issues a plainROLLBACK, which the server accepts cleanly. Fixes Issue #3153, Issue #3123. PR #4114search_path. When two schemas held a table with the same name and the same primary or unique index name but a different set of key columns, the driver took the union of both schemas' columns, so the result set could be wrongly rejected as not updatable PR #4214. Supersedes PR #3400.LargeObject.close()now flushes a buffered output stream before marking the object closed, so closing a large object without an explicitflush()no longer drops buffered writes. The flush runs while the object is still open (it calls back intoLargeObject.write()), andlo_closealways runs afterward; a failure fromlo_closeno longer masks an earlier flush error, and the transaction is not committed when the flush failed Issue #4247 PR #4248.timestamp,timestamptz, anddatetext with a clearSQLException(SQLState22007) instead of anArrayIndexOutOfBoundsExceptionPR #4278CHAR_OCTET_LENGTHfor non-character columns PR #4231ResultSet.getBigDecimal(int, int)PR #4211java.timevalues in an updatableResultSetupdateRow()/insertRow()PR #3848RETURNINGclause containsvarcharornumerictypes PR #4014estimatedReceiveBufferBytesaccounting after a forcedSyncPR #4014ResultSetfor describe-statement purposes, and restore the pre-describe path for generated-key batches PR #4014search_pathchanges case-insensitively PR #4216.keyextension PR #3946KeyStoreso FIPS JVMs work PR #4193gssResponseTimeoutrather thansslResponseTimeoutfor GSS connections PR #4076SET LOCAL/SET SESSION TRANSACTIONPR #4203AssertionErrorfromBatchResultHandleron a closed connection PR #4187SQL_TSI_FRAC_SECONDwith an explicit, explained error PR #4229Driver.acceptsURLwith a clearNullPointerExceptionPR #4205NumberParser.getFastLonginstead of silently wrapping PR #4163PGInterval.setSecondsPR #4194PgConnectionsetup fails after connect PR #4161LazyCleanerImplcleanup task alive across a transient empty queue PR #4038socksNonProxyHostsis set PR #4045ResourceBundlecache on deregister so the driver can unload PR #4237IOExceptionPR #4190java.lang.managementdependency in themaxResultBufferparser PR #4069v42.7.12Security
Under
channelBinding=require, the driver silently downgraded fromSCRAM-SHA-256-PLUS(with channel binding) to plainSCRAM-SHA-256(without it) when the server presented a certificate whose signature algorithm has notls-server-end-pointchannel-binding hash (e.g.Ed25519, Ed448, or post-quantum algorithms). An attacker who can intercept the TLS connection could exploit this to strip channel-binding protection.The fix enforces channel binding in the driver's own code: it now fails the connection when no binding data can be extracted, and verifies the negotiated mechanism uses channel binding (
-PLUS) whenrequireis set.Only connections that set
channelBinding=requireare affected. The defaultpreferpolicy and releases before 42.7.4 (which introduced channel-binding support) are unaffected.See the Security Advisory for more detail.
The following CVE-2026-54291 has been issued.
v42.7.11Security
pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins.
See the Security Advisory for more detail.
The following CVE-2026-42198 has been issued.
Added
Changed
Fixed
LFDT-web3j/web3j (org.web3j:crypto)
v5.0.3Bug Fixes
Features
BREAKING CHANGES
zeroturnaround/zt-exec (org.zeroturnaround:zt-exec)
v1.13.0Added
LogOutputStream.create(LineConsumer)to build aLogOutputStreamfrom a lambda (#107).LogOutputStream.setOutputCharset(String)to control the charset used to decode the process output (#89).Bundle-SymbolicName,Export-Package) in the published jar (#85).Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.