fix(deps): update maven

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
io.undertow:undertow-servlet (source)	2.3.23.Final → 2.3.24.Final
io.projectreactor.netty:reactor-netty	1.3.3 → 1.3.5
io.projectreactor:reactor-test	3.8.3 → 3.8.5
com.fasterxml.jackson:jackson-bom	2.21.0 → 2.21.2
org.projectlombok:lombok (source)	1.18.42 → 1.18.46
io.projectreactor:reactor-core	3.8.3 → 3.8.5
io.github.hakky54:logcaptor	2.12.5 → 2.12.6
com.fasterxml.jackson.core:jackson-databind (source)	2.20.2 → 2.21.2
org.springframework.boot:spring-boot-autoconfigure (source)	4.0.3 → 4.0.6
org.springframework:spring-context	7.0.5 → 7.0.7
org.springframework.security:spring-security-test (source)	7.0.3 → 7.0.5
org.springframework.security:spring-security-oauth2-client (source)	7.0.3 → 7.0.5
org.springframework.security:spring-security-core (source)	7.0.3 → 7.0.5
org.springframework.boot:spring-boot-starter-web (source)	4.0.3 → 4.0.6
org.springframework:spring-test	7.0.5 → 7.0.7
org.springframework:spring-core	7.0.5 → 7.0.7
org.springframework:spring-webmvc	7.0.5 → 7.0.7
org.springframework:spring-web	7.0.5 → 7.0.7
org.springframework:spring-aop	7.0.5 → 7.0.7
org.springframework:spring-expression	7.0.5 → 7.0.7
org.springframework:spring-tx	7.0.5 → 7.0.7
org.springframework.boot:spring-boot-starter-restclient-test (source)	4.0.3 → 4.0.6
org.springframework.boot:spring-boot-webmvc-test (source)	4.0.3 → 4.0.6
org.springframework.boot:spring-boot-test-autoconfigure (source)	4.0.3 → 4.0.6
org.springframework.boot:spring-boot-resttestclient (source)	4.0.3 → 4.0.6
org.springframework.boot:spring-boot-starter-test (source)	4.0.3 → 4.0.6
org.springframework.boot:spring-boot-test (source)	4.0.3 → 4.0.6
org.springframework.boot:spring-boot-starter-security (source)	4.0.3 → 4.0.6
org.springframework.boot:spring-boot-restclient (source)	4.0.3 → 4.0.6
org.springframework.boot:spring-boot (source)	4.0.3 → 4.0.6
org.jboss.logmanager:jboss-logmanager (source)	3.1.2.Final → 3.2.1.Final
org.apache.logging.log4j:log4j-core (source)	2.25.3 → 2.25.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider

CVE-2026-22746 / GHSA-vxf7-qj7q-83fh

More information

Details

Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to enable, expire, or lock users, then DaoAuthenticationProvider's timing attack defense can be bypassed for users who are disabled, expired, or locked. This issue affects Spring Security: from 5.7.0 through 5.7.22, from 5.8.0 through 5.8.24, from 6.3.0 through 6.3.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-22746
• https://github.com/spring-projects/spring-security
• https://spring.io/security/cve-2026-22746

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured

CVE-2026-22751 / GHSA-x2wq-9x2f-fhj7

More information

Details

Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-22751
• https://github.com/spring-projects/spring-security/commit/163772775036c4146815a5266874278c6f45f047
• https://github.com/spring-projects/spring-security/commit/4187af38b251fc97fdf9949f7869618111e6e261
• https://github.com/spring-projects/spring-security
• https://spring.io/security/cve-2026-22751

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Spring Framework Improper Path Limitation with Script View Templates

CVE-2026-22737 / GHSA-4773-3jfm-qmx3

More information

Details

Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-22737
• https://github.com/spring-projects/spring-framework
• https://spring.io/security/cve-2026-22737

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Spring MVC and WebFlux has Server Sent Event stream corruption

CVE-2026-22735 / GHSA-6hcq-hmm3-jj3c

More information

Details

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

Severity

• CVSS Score: 2.6 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-22735
• https://github.com/spring-projects/spring-framework
• https://spring.io/security/cve-2026-22735

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources

CVE-2026-22745 / GHSA-6p4f-wcwh-5vvm

More information

Details

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.

More precisely, an application can be vulnerable when all the following are true:

• the application is using Spring MVC or Spring WebFlux
• the application is serving static resources from the file system
• the application is running on a Windows platform

When all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-22745
• https://github.com/spring-projects/spring-framework
• https://spring.io/security/cve-2026-22745

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.

CVE-2026-22741 / GHSA-wg35-8jpf-2xv3

More information

Details

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.

More precisely, an application can be vulnerable when all the following are true:

• the application is using Spring MVC or Spring WebFlux
• the application is configuring the  resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with caching enabled
• the application adds support for encoded resources resolution
• the resource cache must be empty when the attacker has access to the application

When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.

Severity

• CVSS Score: 0.0 / 10 (None)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-22741
• https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title
• https://github.com/spring-projects/spring-framework
• https://spring.io/security/cve-2026-22741

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Spring Boot's default security filter chain has no authorization rule with Actuator but without Health

CVE-2026-40976 / GHSA-8v8j-3hxp-93wr

More information

Details

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.

Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.

Severity

• CVSS Score: 9.1 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-40976
• https://github.com/spring-projects/spring-boot
• https://spring.io/security/cve-2026-40976

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Spring Boot accepts predictable temp directory without ownership verification

CVE-2026-40973 / GHSA-wwpq-f5c3-7hvx

More information

Details

A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.

Severity

• CVSS Score: 7.0 / 10 (High)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-40973
• https://github.com/spring-projects/spring-boot
• https://spring.io/security/cve-2026-40973

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

CVE-2026-34480 / GHSA-3pxv-7cmr-fjr4

More information

Details

Apache Log4j Core's XmlLayout, in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification, producing invalid XML output whenever a log message or MDC value contains such characters.

The impact depends on the StAX implementation in use:

• JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
• Alternative StAX implementations (e.g., Woodstox, a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.

Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-34480
• https://github.com/apache/logging-log4j2/pull/4077
• https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb
• https://logging.apache.org/cyclonedx/vdr.xml
• https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout
• https://logging.apache.org/security.html#CVE-2026-34480
• http://www.openwall.com/lists/oss-security/2026/04/10/9
• https://github.com/advisories/GHSA-3pxv-7cmr-fjr4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Apache Log4j Core: log injection in Rfc5424Layout due to silent configuration incompatibility

CVE-2026-34478 / GHSA-445c-vh5m-36rj

More information

Details

Apache Log4j Core's Rfc5424Layout, in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.

Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:

• The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.
• The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.

Users of the SyslogAppender are not affected, as its configuration attributes were not modified.

Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-34478
• https://github.com/apache/logging-log4j2/pull/4074
• https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt
• https://logging.apache.org/cyclonedx/vdr.xml
• https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout
• https://logging.apache.org/security.html#CVE-2026-34478
• http://www.openwall.com/lists/oss-security/2026/04/10/7
• https://github.com/advisories/GHSA-445c-vh5m-36rj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration

CVE-2026-34477 / GHSA-6hg6-v5c8-fphq

More information

Details

The fix for CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName attribute of the <Ssl> element.

Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.

A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:

• An SMTP, Socket, or Syslog appender is in use.
• TLS is configured via a nested element.
• The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.

This issue does not affect users of the HTTP appender, which uses a separate verifyHostname attribute that was not subject to this bug and verifies host names by default.

Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-34477
• https://github.com/apache/logging-log4j2/pull/4075
• https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4
• https://logging.apache.org/cyclonedx/vdr.xml
• https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName
• https://logging.apache.org/security.html#CVE-2026-34477
• https://github.com/advisories/GHSA-6hg6-v5c8-fphq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

CVE-2026-34480 / GHSA-3pxv-7cmr-fjr4

More information

Details

Apache Log4j Core's XmlLayout, in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification, producing invalid XML output whenever a log message or MDC value contains such characters.

The impact depends on the StAX implementation in use:

• JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
• Alternative StAX implementations (e.g., Woodstox, a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.

Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-34480
• https://github.com/apache/logging-log4j2/pull/4077
• https://github.com/apache/logging-log4j2
• https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb
• https://logging.apache.org/cyclonedx/vdr.xml
• https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout
• https://logging.apache.org/security.html#CVE-2026-34480
• http://www.openwall.com/lists/oss-security/2026/04/10/9

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Apache Log4j Core: log injection in Rfc5424Layout due to silent configuration incompatibility

CVE-2026-34478 / GHSA-445c-vh5m-36rj

More information

Details

Apache Log4j Core's Rfc5424Layout, in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.

Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:

• The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.
• The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.

Users of the SyslogAppender are not affected, as its configuration attributes were not modified.

Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-34478
• https://github.com/apache/logging-log4j2/pull/4074
• https://github.com/apache/logging-log4j2
• https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt
• https://logging.apache.org/cyclonedx/vdr.xml
• https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout
• https://logging.apache.org/security.html#CVE-2026-34478
• http://www.openwall.com/lists/oss-security/2026/04/10/7

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration

CVE-2026-34477 / GHSA-6hg6-v5c8-fphq

More information

Details

The fix for CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName attribute of the <Ssl> element.

Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.

A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:

• An SMTP, Socket, or Syslog appender is in use.
• TLS is configured via a nested element.
• The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.

This issue does not affect users of the HTTP appender, which uses a separate verifyHostname attribute that was not subject to this bug and verifies host names by default.

Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-34477
• https://github.com/apache/logging-log4j2/pull/4075
• https://github.com/apache/logging-log4j2
• https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4
• https://logging.apache.org/cyclonedx/vdr.xml
• https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName
• https://logging.apache.org/security.html#CVE-2026-34477

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

undertow-io/undertow (io.undertow:undertow-servlet)

v2.3.24.Final

Compare Source

reactor/reactor-netty (io.projectreactor.netty:reactor-netty)

v1.3.5

Compare Source

Reactor Netty 1.3.5 is part of 2025.0.5 Release Train.

What's Changed

✨ New features and improvements

• Depend on Reactor Core v3.8.5 by @​violetagg in b68daca, see release notes
• Depend on Netty v4.2.12.Final by @​violetagg in #​4167
• Depend on Netty QUIC Codec v0.0.75.Final by @​violetagg in #​4148
• Depend on Brave v6.3.1 by @​dependabot[bot] in #​4159
• Optimise uri construction with baseUrl in HttpClientHandler by @​violetagg in #​4130
• Optimise UriEndpoint#toSocketAddressStringWithoutDefaultPort by @​violetagg in #​4131
• Store resolved SocketAddress in UriEndpoint for absolute URLs by @​violetagg in #​4132
• Lazily compute HttpClientOperations#resourceUrl by @​violetagg in #​4135
• Pre-compute path in UriEndpoint when URI is provided by @​violetagg in #​4136
• Cleanup HTTP/2 WebSocket extension handlers by @​violetagg in #​4152
• Optimise Flux body accumulation for GET/HEAD/DELETE requests by @​violetagg in #​4164
• Fix HTTP/3 connection pool max streams handling by @​violetagg in #​4182

🐞 Bug fixes

• Ensure connection concurrency and acquired counters are updated before delivering the slot by @​violetagg in #​4179
• Fix StackOverflowError in ServerTransport graceful shutdown by @​violetagg in #​4181
• Fix invalidated connection reuse in Http2Pool by @​violetagg in #​4180

New Contributors

• @​Junuu made their first contribution in #​4137

Full Changelog: reactor/reactor-netty@v1.3.4...v1.3.5

v1.3.4

Compare Source

Reactor Netty 1.3.4 is part of 2025.0.4 Release Train.

What's Changed

✨ New features and improvements

• Depend on Reactor Core v3.8.4 by @​chemicL in 53e8319, see release notes
• Avoid DefaultChannelId generation for DisposedChannel by @​violetagg in #​4095
• Push-based maxConcurrentStreams update via SETTINGS frame handler by [@​violetagg](https://redirect.github.com/violet

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.