Skip to content

chore(deps): bump the maven-minor-and-patch group across 1 directory with 12 updates - #16

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/backend/maven-minor-and-patch-d07f835285
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/backend/maven-minor-and-patch-d07f835285

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 19, 2026 •

Copy link
Copy Markdown

Bumps the maven-minor-and-patch group with 12 updates in the /backend directory:

Package From To
com.baomidou:mybatis-plus-spring-boot3-starter 3.5.9 3.5.17
cn.dev33:sa-token-spring-boot3-starter 1.39.0 1.46.0
cn.dev33:sa-token-redis-jackson 1.39.0 1.46.0
cn.dev33:sa-token-redis-jackson 1.39.0 1.46.0
io.github.resilience4j:resilience4j-spring-boot3 2.2.0 2.4.0
org.apache.commons:commons-pool2 2.12.0 2.13.1
cn.hutool:hutool-core 5.8.34 5.8.47
org.bouncycastle:bcprov-jdk18on 1.78.1 1.86
org.bouncycastle:bcpkix-jdk18on 1.78.1 1.86
org.bouncycastle:bcpkix-jdk18on 1.78.1 1.86
org.projectlombok:lombok 1.18.34 1.18.48
org.apache.maven.plugins:maven-compiler-plugin 3.13.0 3.16.0
com.twelvemonkeys.imageio:imageio-webp 3.12.0 3.15.1
nl.martijndwars:web-push 5.1.1 5.1.2

Updates com.baomidou:mybatis-plus-spring-boot3-starter from 3.5.9 to 3.5.17

Release notes

Sourced from com.baomidou:mybatis-plus-spring-boot3-starter's releases.

v3.5.17

  • fix: 修复 issues/6899 多租户插件 @Many 注解查无效问题
  • fix: 修复 issues/6938 HashMap 设置类型转换器异常
  • fix: 修复 issues/7081 解决拦截全表存在 schema 校验问题
  • fix: 修复 issues/6905 关于 saveOrUpdateBatch 导致 ParameterHandler 被重复执行问题
  • fix: 修复 issues/7056 支持 GraalVM Native 二进制编译问题,案例 https://gitee.com/baomidou/mybatis-plus-native-image-demo
  • fix: 修复 issues/7027 支持 JDK 9+ 模块化包重名问题,注意 mybatis-plus-spring 模块下文件包名调整
  • feat: 新增 wrapper 支持 xml 别名配置
  • feat: 新增 mybatis-plus-spring-boot-native-image 模块支持 graalvm 编译能力
  • feat: 新增 Wrapper 支持自动识别 typeHandler 类型处理器
  • feat: 新增 Wrapper 对比 eqOrIsNull 方法
  • feat: 新增 i18n 逻辑删除日期格式及自动更新填充能力
  • feat: 新增 Groovy 支持 LambdaQueryWrapper 执行能力
  • feat: 新增 Kotlin 支持 LambdaQueryWrapper 执行能力
  • feat: 新增 MybatisEnumTypeHandler 枚举类型处理器支持缓存处理机制
  • feat: 新增 ITableFieldMetaInfoCustomizer 代码生成器扩展属性元数据处理能力
  • opt: 优化 Sequence 减少增加上下文切换
  • opt: 优化 LambdaQueryWrapper.sqlSelect 属性修改为 protected
  • opt: 优化 sql 注入性能调整为函数方式拼接减少字符串format使用
  • opt: 优化 Cursor 游标查询一条记录能力
  • opt: 优化 format 部分修改为字符串组合
  • opt: 优化 executeBatch 根据执行影响行数返回确定结果布尔值
  • opt: 优化 TableInfo 扩展允许返回新的自定义实例对象
  • opt: 优化 IJsonTypeHandler 处理逻辑

v3.5.16

  • fix: 修复Jackson3TypeHandler自定义ObjectMapper无效
  • fix: 处理代码生成器PackageConfig指定模块为空时拼接错误
  • fix: 修复配置加密无法在环境变量中使用
  • feat: 升级SpringBoot3至3.5.9
  • feat: 升级JUnit单元测试
  • feat: 升级fastjson至2.0.60
  • feat: 升级jackson至2.20.1
  • feat: 升级gson至2.13.2
  • feat: 升级postgresql至42.7.8
  • feat: 升级h2database至2.4.240
  • feat: 升级mysql-connector-j至9.5.0
  • feat: 升级sqlite-jdbc至3.51.1.0
  • feat: 升级jaybird至5.0.10.java8
  • feat: 升级mybatis-spring4.0.0

v3.5.15

  • fix: 修复Enjoy模板生成xml错误
  • feat: 调整代码生成器元数据构建
  • feat: 优化CrudRepository批量执行前判断非事务中关闭连接
  • feat: 支持SpringBoot4.0.0
  • feat: 支持Jackson3.0

v3.5.14

  • feat: 增加bom对mybatis-plus-spring-boot4-starter与mybatis-plus-spring-boot4-starter-test管理

... (truncated)

Changelog

Sourced from com.baomidou:mybatis-plus-spring-boot3-starter's changelog.

[v3.5.17] 2026.07.07

  • fix: 修复 issues/6899 多租户插件 @Many 注解查无效问题
  • fix: 修复 issues/6938 HashMap 设置类型转换器异常
  • fix: 修复 issues/7081 解决拦截全表存在 schema 校验问题
  • fix: 修复 issues/6905 关于 saveOrUpdateBatch 导致 ParameterHandler 被重复执行问题
  • fix: 修复 issues/7056 支持 GraalVM Native 二进制编译问题,案例 https://gitee.com/baomidou/mybatis-plus-native-image-demo
  • fix: 修复 issues/7027 支持 JDK 9+ 模块化包重名问题,注意 mybatis-plus-spring 模块下文件包名调整
  • feat: 新增 wrapper 支持 xml 别名配置
  • feat: 新增 mybatis-plus-spring-boot-native-image 模块支持 graalvm 编译能力
  • feat: 新增 Wrapper 支持自动识别 typeHandler 类型处理器
  • feat: 新增 Wrapper 对比 eqOrIsNull 方法
  • feat: 新增 i18n 逻辑删除日期格式及自动更新填充能力
  • feat: 新增 Groovy 支持 LambdaQueryWrapper 执行能力
  • feat: 新增 Kotlin 支持 LambdaQueryWrapper 执行能力
  • feat: 新增 MybatisEnumTypeHandler 枚举类型处理器支持缓存处理机制
  • feat: 新增 ITableFieldMetaInfoCustomizer 代码生成器扩展属性元数据处理能力
  • opt: 优化 Sequence 减少增加上下文切换
  • opt: 优化 LambdaQueryWrapper.sqlSelect 属性修改为 protected
  • opt: 优化 sql 注入性能调整为函数方式拼接减少字符串format使用
  • opt: 优化 Cursor 游标查询一条记录能力
  • opt: 优化 format 部分修改为字符串组合
  • opt: 优化 executeBatch 根据执行影响行数返回确定结果布尔值
  • opt: 优化 TableInfo 扩展允许返回新的自定义实例对象
  • opt: 优化 IJsonTypeHandler 处理逻辑

[v3.5.16] 2026.1.11

  • fix: 修复Jackson3TypeHandler自定义ObjectMapper无效
  • fix: 处理代码生成器PackageConfig指定模块为空时拼接错误
  • feat: 升级SpringBoot3至3.5.9
  • feat: 升级JUnit单元测试
  • feat: 升级fastjson至2.0.60
  • feat: 升级jackson至2.20.1
  • feat: 升级gson至2.13.2
  • feat: 升级postgresql至42.7.8
  • feat: 升级h2database至2.4.240
  • feat: 升级mysql-connector-j至9.5.0
  • feat: 升级sqlite-jdbc至3.51.1.0
  • feat: 升级jaybird至5.0.10.java8
  • feat: 升级mybatis-spring4.0.0

[v3.5.15] 2025.11.30

  • fix: 修复Enjoy模板生成xml错误
  • feat: 调整代码生成器元数据构建
  • feat: 优化CrudRepository批量执行前判断非事务中关闭连接
  • feat: 支持SpringBoot4.0.0
  • feat: 支持Jackson3.0

[v3.5.14] 2025.08.29

  • feat: 增加bom对mybatis-plus-spring-boot4-starter与mybatis-plus-spring-boot4-starter-test管理

... (truncated)

Commits
  • db0b3c4 发布 3.5.17 版本脚本修复
  • 28b9d23 Merge pull request #7141 from smf-h/docs-idworker-sequence-config
  • 7fbc364 docs(core): clarify IdWorker sequence configuration
  • 404950b 发布 3.5.17 版本
  • 070d5ea 发布 3.5.17 版本
  • 0bc2e2f Merge pull request #7134 from zhangyongxianggithub/3.0
  • 5461a4a 发布 3.5.17 版本
  • 98cba6b feat(wrapper): 添加eqOrIsNull方法并优化参数别名设置逻辑
  • 96465aa id auto 策略新增描述说明
  • 41d78a2 优化 wrapper 支持 xml 别名配置
  • Additional commits viewable in compare view

Updates cn.dev33:sa-token-spring-boot3-starter from 1.39.0 to 1.46.0

Updates cn.dev33:sa-token-redis-jackson from 1.39.0 to 1.46.0

Updates cn.dev33:sa-token-redis-jackson from 1.39.0 to 1.46.0

Updates io.github.resilience4j:resilience4j-spring-boot3 from 2.2.0 to 2.4.0

Release notes

Sourced from io.github.resilience4j:resilience4j-spring-boot3's releases.

v2.4.0

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from io.github.resilience4j:resilience4j-spring-boot3's changelog.

= Release Notes

== Version 0.1.0

  • Initial version

=== Version 0.1.1

  • Added the functionality to add exceptions with are ignored by the CircuitBreaker

=== Version 0.1.2

  • Added the feature to get Metrics for function executions

=== Version 0.1.3

  • Added a static factory method for the CircuitBreakerConfig builder

=== Version 0.1.4

  • Added the feature to retry a failed function

=== Version 0.1.5

  • Added builders to simplify chaining of decorators

=== Version 0.1.6

  • Renamed project to javaslang-circuitbreaker

=== Version 0.1.7

  • Fixed Issue #2
  • Issue #3 Added a listener mechanism for state transitions

== Version 0.2.0

  • Removed Dropwizard Metrics, because its a too heavy dependency for such a lightweight library.
  • Changed the way exceptions can be handled. You have to provide a Predicate now instead of a list of exceptions to ignore.

== Version 0.3.0

  • The CircuitBreaker is based on a Ring Bit Buffer and a failure rate now.

=== Version 0.3.1

  • Changed the visibility of CircuitBreakerUtils.isCallPermitted to public.

=== Version 0.3.2

  • CircuitBreakerRegistry has a new method which takes a Supplier of a CircuitBreakerConfig so that the CircuitBreakerConfig is only created when needed.

=== Version 0.3.3

  • CircuitBreaker has a new method +getCircuitBreakerConfig+ which allows to retrieve the CircuitBreakerConfig of the CircuitBreaker.
  • Renamed the state HALF_CLOSED to HALF_OPEN to match the pattern description of Martin Fowler.

=== Version 0.3.4

  • Added a Metrics interface to the CircuitBreaker which allows to retrieve current statistics like failureRate and number of buffer calls.

== Version 0.4.0

  • Updated javaslang from 2.0.0-RC4 to 2.0.1

... (truncated)

Commits
  • f1c3be8 Fix signing
  • 88a8293 Enable signing for resilience4j-bom
  • 1ed88c2 Remove sign skip on snapshot version (#2419)
  • ed637ec Enable SNAPSHOT artifact signing from master (#2418)
  • d51bce1 Read env variables from gradle for gpg key (#2417)
  • 89baea7 Fix release workflow: unquoted multi-line GPG key breaks Gradle invocation (#...
  • b888e82 Add GPG key and passphrase to build step
  • e9aedee Revert JDK target back to 17 (#2415)
  • ad4efb8 Remove log spam from tests (#2412)4
  • cd8f8e0 Issue #2189: Use snapshot reads for actuator event endpoints in Spring Boot 3...
  • Additional commits viewable in compare view

Updates org.apache.commons:commons-pool2 from 2.12.0 to 2.13.1

Updates cn.hutool:hutool-core from 5.8.34 to 5.8.47

Release notes

Sourced from cn.hutool:hutool-core's releases.

5.8.47(2026-07-06) 🐣新特性 【core 】 EnumConverter变更规则,当用户自定义方法返回null时,调用默认valueOf(pr#4258@Github) 【core 】 DateUtilparseISO8601增加检查范围(pr#4275@Github) 【core 】 Guard FileMagicNumber AAC/M4A/AMR matchers against short byte arrays(pr#4278@Github) 【crypto 】 Reject empty cipherKey in Vigenere with a clear exception(pr#4279@Github) 【core 】 Return null from CsvRow.get for a negative index(pr#4280@Github) 【crypto 】 Reject too-short salt in BCrypt.hashpw with IllegalArgumentException(pr#4282@Github) 【crypto 】 Validate md5HexTo16 input length to avoid StringIndexOutOfBoundsException(pr#4283@Github) 🐞Bug修复 【core 】 修复HexUtil.format奇数位数输出错误问题(issue#4263@Github) 【core 】 修复CamelCaseLinkedMap顺序错乱问题(issue#IJV845@Gitee) 【core 】 修复AntPathMatchersubstring问题(pr#4276@Github) 【poi 】 修复Excel03SaxReader读取xls时最后一行数据丢失问题(pr#1442@Gitee) 【core 】 修复根据新版外国人永久居留身份证(18位)身份编号获取户籍省份编码的问题(pr#4288@Github) 【core 】 修复Record反序列化时字段null导致报错问题(issue#4269@Github)

v5.8.46

5.8.46(2026-05-25) 🐣新特性 【core 】 AnnotationUtil新增两级缓存架构,提升高频注解解析性能(pr#1434@Gitee) 【core 】 RegexPool.PLATE_NUMBER新增粤AP号段支持(issue#IJNDJR@Gitee) 🐞Bug修复 【db 】 修复Page和PageResult首页调用问题(issue#IH7A18@Gitee) 【ai 】 修复AI SPI classloader找不到实现问题(issue#4241@Github) 【extra 】 修复ExpressionEngine中SpELEngine、MVEL白名单无效问题(issue#4249@Github) 【core 】 修复JNDIUtil远程加载漏洞(issue#4249@Github) 【core 】 修复ValidateObjectInputStream白名单规则问题(issue#4249@Github) 【core 】 修复VersionUtil比对null时结果异常问题(issue#IJNFQZ@Gitee) 【core 】 修复BeanConverter和MapConverter源Bean判断问题(pr#4252@Github)

5.8.44


5.8.44(2026-03-11)

🐣新特性

  • 【core 】 NumberUtil.parseNumber增加支持科学计数法(pr#4211@Github)
  • 【captcha】 AbstractCaptcha增加setStroke方法支持线条粗细(issue#IDJQ15@Gitee)
  • 【core 】 BooleanUtil新增 exactlyOneTrue 方法用于互斥条件校验(issue#IDJQ15@Gitee)
  • 【core 】 DateUtil.normalize方法中正则预编译提升效率(pr#4221@Gitee)
  • 【core 】 AppendableWriter增加checkNotClosed(issue#IDMZ5K@Gitee)
  • 【core 】 FastDateParser改进在JDK25下三字母时区警告(issue#4100@Github)
  • 【core 】 ReflectUtil增加二级缓存(pr#1433@Gitee)

🐞Bug修复

  • 【json 】 修复JSONUtil.wrap忽略错误问题(issue#4210@Github)
  • 【http 】 修复HttpUtil.normalizeParams 在极端输入下抛 StringIndexOutOfBoundsException(pr#4216@Github)
  • 【extra 】 修复MailAccount.setAuth参数与field不一致问题(issue#4217@Github)
  • 【core 】 修复TransMap.computeIfAbsentmappingFunction处理不一致问题(issue#IDM6UR@Gitee)
  • 【core 】 修复MultiResource游标歧义问题(issue#IDNAOY@Gitee)
  • 【core 】 修复BufferUtilcopy歧义问题(issue#IDN097@Gitee)

... (truncated)

Changelog

Sourced from cn.hutool:hutool-core's changelog.

5.8.47(2026-07-06)

🐣新特性

  • 【core 】 EnumConverter变更规则,当用户自定义方法返回null时,调用默认valueOf(pr#4258@Github)
  • 【core 】 DateUtilparseISO8601增加检查范围(pr#4275@Github)
  • 【core 】 Guard FileMagicNumber AAC/M4A/AMR matchers against short byte arrays(pr#4278@Github)
  • 【crypto 】 Reject empty cipherKey in Vigenere with a clear exception(pr#4279@Github)
  • 【core 】 Return null from CsvRow.get for a negative index(pr#4280@Github)
  • 【crypto 】 Reject too-short salt in BCrypt.hashpw with IllegalArgumentException(pr#4282@Github)
  • 【crypto 】 Validate md5HexTo16 input length to avoid StringIndexOutOfBoundsException(pr#4283@Github)

🐞Bug修复

  • 【core 】 修复HexUtil.format奇数位数输出错误问题(issue#4263@Github)
  • 【core 】 修复CamelCaseLinkedMap顺序错乱问题(issue#IJV845@Gitee)
  • 【core 】 修复AntPathMatchersubstring问题(pr#4276@Github)
  • 【poi 】 修复Excel03SaxReader读取xls时最后一行数据丢失问题(pr#1442@Gitee)
  • 【core 】 修复根据新版外国人永久居留身份证(18位)身份编号获取户籍省份编码的问题(pr#4288@Github)
  • 【core 】 修复Record反序列化时字段null导致报错问题(issue#4269@Github)

5.8.46(2026-05-25)

🐣新特性

  • 【core 】 AnnotationUtil新增两级缓存架构,提升高频注解解析性能(pr#1434@Gitee)
  • 【core 】 RegexPool.PLATE_NUMBER新增粤AP号段支持(issue#IJNDJR@Gitee)

🐞Bug修复

  • 【db 】 修复Page和PageResult首页调用问题(issue#IH7A18@Gitee)
  • 【ai 】 修复AI SPI classloader找不到实现问题(issue#4241@Github)
  • 【extra 】 修复ExpressionEngine中SpELEngine、MVEL白名单无效问题(issue#4249@Github)
  • 【core 】 修复JNDIUtil远程加载漏洞(issue#4249@Github)
  • 【core 】 修复ValidateObjectInputStream白名单规则问题(issue#4249@Github)
  • 【core 】 修复VersionUtil比对null时结果异常问题(issue#IJNFQZ@Gitee)
  • 【core 】 修复BeanConverter和MapConverter源Bean判断问题(pr#4252@Github)

5.8.45(2026-05-19)

🐣新特性

  • 此版本发布出现问题,跳过!

🐞Bug修复


5.8.44(2026-03-11)

🐣新特性

  • 【core 】 NumberUtil.parseNumber增加支持科学计数法(pr#4211@Github)
  • 【captcha】 AbstractCaptcha增加setStroke方法支持线条粗细(issue#IDJQ15@Gitee)
  • 【core 】 BooleanUtil新增 exactlyOneTrue 方法用于互斥条件校验(issue#IDJQ15@Gitee)
  • 【core 】 DateUtil.normalize方法中正则预编译提升效率(pr#4221@Gitee)
  • 【core 】 AppendableWriter增加checkNotClosed(issue#IDMZ5K@Gitee)
  • 【core 】 FastDateParser改进在JDK25下三字母时区警告(issue#4100@Github)
  • 【core 】 ReflectUtil增加二级缓存(pr#1433@Gitee)

🐞Bug修复

  • 【json 】 修复JSONUtil.wrap忽略错误问题(issue#4210@Github)

... (truncated)

Commits
  • 8870454 Prepare release
  • 853c29f 🚀release5.8.47
  • eaa0641 fix test
  • 90fae33 fix test
  • c57da4d 修复Record反序列化时字段null导致报错问题(issue#4269@Github)
  • 212c796 修复根据新版外国人永久居留身份证(18位)身份编号获取户籍省份编码的问题(pr#4288@Github)
  • faa08a8 Merge pull request #4288 from YamMangoTea/v5-dev
  • 8290d30 Merge pull request #4284 from vasiliy-mikhailov/fix-condition-unwrapquote-whi...
  • 71e7957 Validate md5HexTo16 input length to avoid StringIndexOutOfBoundsException
  • 6cbc8f8 Merge pull request #4283 from vasiliy-mikhailov/fix-md5hexto16-short-input
  • Additional commits viewable in compare view

Updates org.bouncycastle:bcprov-jdk18on from 1.78.1 to 1.86

Changelog

Sourced from org.bouncycastle:bcprov-jdk18on's changelog.

Bouncy Castle Crypto Package - Release Notes

1.0 Introduction

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. The package is organised so that it contains a light-weight API suitable for use in any environment (including the J2ME) with the additional infrastructure to conform the algorithms to the JCE framework.

2.0 Release History

2.1.1 Version

Release: 1.87
Date: 2026, TBD

2.1.2 Defects Fixed

  • A KeyAgreement asked for its shared secret before doPhase returned data rather than refusing. javax.crypto.KeyAgreement specifies IllegalStateException for that state, but nothing in the provider tracked it, so each SPI handed back whatever its result field held: for Diffie-Hellman that was the private value itself - engineInit seeded result with x, so generateSecret() returned the private exponent padded to the prime's length and generateSecret("AES") an all-zero key taken from that padding - while ECDH returned null and its named-algorithm overload raised NullPointerException. BaseAgreementSpi now records whether a doPhase has completed the agreement since the last init and refuses the request with an IllegalStateException naming the algorithm, so every family in the provider - DH, ECDH and ECMQV, the SM2 exchange, both ECGOST families, XDH, SM9 and NewHope - answers the same way, and the DH SPI no longer holds the private value in that field at all.

  • Mac.getInstance and KeyGenerator.getInstance by the HMAC SHA-512/224 and SHA-512/256 object identifiers (1.2.840.113549.2.12 and .13) failed, although the same algorithms resolved by name and the matching SecretKeyFactory aliases were registered: the SHA512 mappings called addHMACAlgorithm for the two truncated variants without the addHMACAlias that registers their OIDs against Mac and KeyGenerator. Both are now aliased, as every other HMAC in that class already was.

  • A KTSParameterSpec naming an HKDF key-derivation function with a parameters field - a form the provider does not service - was accepted at Cipher init and then failed out of wrap or unwrap with an unchecked IllegalStateException neither method declares. The KTS key-wrapping Ciphers (ML-KEM, Classic McEliece, FrodoKEM, the composite KEM and RSA-KEM) now validate the spec's KDF when they take it, reporting an unserviceable one as the InvalidAlgorithmParameterException engineInit declares, which is what the javax.crypto.KEM services already did through KdfUtil.resolveKemSpec.

  • A DTLS handshake deadlocked when a handshake message ahead of the peer's ChangeCipherSpec (a client's CertificateVerify, say) was lost while the ChangeCipherSpec and Finished behind it arrived: the record layer moved its read epoch on at the ChangeCipherSpec and then discarded every retransmission of the lost message as belonging to the old epoch, whose records are only accepted once the handshake has completed. Each side then waited on the other until a handshake timeout, if one was configured, ended it. Every client-authenticated handshake, and every handshake in which the server issues a NewSessionTicket, was exposed. Until the handshake completes, handshake records from the current epoch are now still accepted after the read epoch has moved on, and each message is checked against the epoch of the record that carried it. The DTLS loopback tests now run their handshakes at 10% datagram loss in each direction, with a client-authenticated handshake at 25%.

  • The lightweight SubjectPublicKeyInfoFactory and PrivateKeyInfoFactory encoded a GOST R 34.10-2012 key on one of the legacy CryptoPro curves under id-GostR3410-2001, although RFC 9215 sec. 4.2 permits those curves for 2012 keys. The digestParamSet now decides: a GOST R 34.11-94 parameter set means 2001 (RFC 4491 sec. 2.3.2), a GOST R 34.11-2012 digest or none means 2012 with 256/512 taken from the curve field size, and any other value is rejected. GOST3410PublicKeyAlgParameters treats digestParamSet as OPTIONAL on both read and write per RFC 9215, and PrivateKeyInfoFactory now passes attributes through for ECGOST3410 keys (bc-csharp github #707).

  • The name-constraint host canonicalisation removed a single RFC 1034 root-label dot, the only empty label a name may legally carry, but nothing refused the ones that are not legal: a dNSName, rfc822Name host or uniformResourceIdentifier host such as "example.com.." kept a phantom empty label after the strip and so matched no constraint at all, escaping an excluded subtree naming the host it appears to carry. A tested name whose host carries an empty label - a second trailing dot, a doubled dot or a leading dot - is now refused outright wherever a constraint of that type is in force, rather than canonicalised into a name it is not: removing the extra dots would decide on the caller's behalf that "example.com.." names example.com, which is not how a consumer resolving or comparing the name reads it, and refusing fails closed in both directions where canonicalising would newly admit such a name under a permitted subtree. The single trailing dot is canonicalised as before, a bare "." remains the root label rather than an empty one, and the guard is scoped to the host, so the doubled dot a quoted local part may legally carry is unaffected. Constraints are untouched - one may still begin with a dot, which is how this implementation spells "subdomains only" (github PR #2436).

2.1.3 Additional Features and Functionality

2.1.4 Additional Notes

  • The sources and javadoc jars of the Ant-built distributions (jdk14, jdk15to18 and jdk13) no longer carry test material. Each module's javadoc target copies the package documentation it needs - org/bouncycastle///*.html - back into the module source directory that has already been compiled from, and zip-src zips that directory afterwards, so every test package's package.html arrived in the sources jar by that route; javadoc-util additionally copied org/bouncycastle/asn1/isismtt//*.java, which put test classes into the bcutil javadoc as generated pages, and javadoc-pg deliberately copied the gpg and bcpg test sources in order to document them. Separately the source copies excluded test material only one directory deep and only for *.java, because Ant reads ** as an any-depth wildcard just where it is a whole path segment, so anything nested further or with another extension - the PEM certificate fixtures under org/bouncycastle/est/test/san corrected in 1.86, and an ICAO master list under org/bouncycastle/asn1/icao/test - went through. The source and javadoc copies of every module now exclude test directories at any depth, and javadoc-pg no longer documents the test packages. org.bouncycastle.util.test is unaffected and still ships in the bcprov binary, sources and javadoc jars, as it does from the Gradle build: it is the SimpleTest framework the light-weight API's own test classes are written against, not test material of the distribution. No binary changes - the classes and resources of every Ant-built jar are identical to those of the 1.86 release - and the Gradle-built jdk18on artifacts never carried any of this.

2.2.1 Version

Release: 1.86
Date: 2026, 11th September.

2.2.2 Defects Fixed

  • The high-level OpenPGP API let a subkey inherit the primary key's Key Flags when its own Subkey Binding signature carried none, so a subkey bound with no flags counted as signing-capable for one check while the cross-certification check RFC 9580 sec. 5.2.1.8 requires of a signing subkey saw none and was skipped - letting a third party's public signing subkey be bound to an attacker's primary key and that party's genuine signatures verify under the attacker's identity. Flags are no longer inherited (CVE-2026-71887).
  • The high-level OpenPGP API used a version 6 key carrying no valid Direct Key signature, falling back to the primary user ID binding as it correctly does for version 4. RFC 9580 sec. 5.2.3.10 requires the opposite, and since a v6 certificate carries its expiration and preferences there, stripping that one packet silently dropped them - the certificate went on offering subkeys of a key set to expire. isBoundBy now requires a valid Direct Key self-signature before any v6 component is treated as bound; version 4 is unaffected.
  • The high-level OpenPGP API ignored the OpenPGPPolicy a caller had configured when verifying signatures on an inline message: OpenPGPMessageInputStream took the policy from the implementation's own default rather than from the processor doing the verification, so a hardened policy had no bearing on acceptance and getSignatures() reported isTestedCorrect() true for a signature that policy rejects. Both the one-pass and prefixed-signature paths now read the configured policy.
  • The high-level OpenPGP API went on offering the subkeys of a certificate whose primary key had expired, the binding check evaluating only a subkey's own Subkey Binding signature - so the certificate contradicted itself, reporting the primary unbound while still handing out its subkeys. The primary key's expiration now applies to the whole certificate, as GnuPG and Sequoia treat it, and a subkey no longer inherits the primary's validity period, which RFC 9580 sec. 5.2.3.13 counts from the creation time of the key the carrying signature is made on.
  • OpenPGPDocumentSignature.isValidAt(Date) reported a data signature as valid past the signature's own Signature Expiration Time (RFC 9580 sec. 5.2.3.18): it checked that the signature was correct and the issuing key bound and signing-capable at that date, but never the signature's own expiration, so it disagreed with isEffectiveAt() on the same object and with its own javadoc. isValid() and isValid(policy), which evaluate at creation time, are unchanged.
  • The lightweight LMSSigner and HSSSigner refused a key wrapped in ParametersWithRandom, which is how BcContentSignerBuilder passes one once setSecureRandom() has been called, so BcHssLmsContentSignerBuilder failed with "Incorrect Key Parameters" and the two signers raised ClassCastException. All three now unwrap it, as the ML-DSA and SLH-DSA signers already did; the random is accepted and ignored, LMS deriving its message randomiser deterministically from the seed and one-time index.
  • LMS signature verification did not apply two checks RFC 8554 sec. 5.4.2 requires before a signature is processed: step 2g, refusing a signature whose LMS typecode is not the public key's - without it a signature claiming a height-25 parameter set drove a 25-level computation against a height-5 key - and step 2i, refusing a leaf number outside the tree. Neither was a forgery, but both are attacker-chosen work the specification says to refuse up front. Both are now checked.
  • The LMS and HSS key parameter classes now apply at construction the checks their decoders apply, so a key built directly cannot be one the decoder would refuse: LMSPrivateKeyParameters accepted an identifier of any length where the decoder reads exactly 16 bytes, and left q, maxQ and the seed length unchecked, while HSSPrivateKeyParameters checked neither its level count nor that it had a component key and chaining signature per level. The decoders now report a bad version or seed length as IOException rather than IllegalStateException.
  • In the LMS JCE layer, LMSKeyGenParameterSpec.fromNames knew all twenty LMS parameter-set names but only four of the sixteen LM-OTS ones, so none of the SP 800-208 n24 or SHAKE sets could be named; all sixteen are now present. initialize(int, SecureRandom) now reports InvalidParameterException as the JCA specifies, and BCLMSPrivateKey.getIndex takes the exhaustion check and the index read under one monitor.
  • KeyPairGenerator.initialize(int, SecureRandom) is documented to raise InvalidParameterException when the key size is not one the generator supports, and thirty of them raised a bare IllegalArgumentException instead. Every generator in BCPQC, and the ML-DSA, ML-KEM, SLH-DSA, Classic McEliece, FrodoKEM, NTRU and composite ones in the BC provider, now raise the documented type - which extends IllegalArgumentException, so existing catches still match. The two RSA generators translate the lightweight refusal through a new SecurityExceptions.invalidParameterException factory.

... (truncated)

Commits

Updates org.bouncycastle:bcpkix-jdk18on from 1.78.1 to 1.86

Changelog

Sourced from org.bouncycastle:bcpkix-jdk18on's changelog.

Bouncy Castle Crypto Package - Release Notes

1.0 Introduction

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. The package is organised so that it contains a light-weight API suitable for use in any environment (including the J2ME) with the additional infrastructure to conform the algorithms to the JCE framework.

2.0 Release History

2.1.1 Version

Release: 1.87
Date: 2026, TBD

2.1.2 Defects Fixed

  • A KeyAgreement asked for its shared secret before doPhase returned data rather than refusing. javax.crypto.KeyAgreement specifies IllegalStateException for that state, but nothing in the provider tracked it, so each SPI handed back whatever its result field held: for Diffie-Hellman that was the private value itself - engineInit seeded result with x, so generateSecret() returned the private exponent padded to the prime's length and generateSecret("AES") an all-zero key taken from that padding - while ECDH returned null and its named-algorithm overload raised NullPointerException. BaseAgreementSpi now records whether a doPhase has completed the agreement since the last init and refuses the request with an IllegalStateException naming the algorithm, so every family in the provider - DH, ECDH and ECMQV, the SM2 exchange, both ECGOST families, XDH, SM9 and NewHope - answers the same way, and the DH SPI no longer holds the private value in that field at all.

  • Mac.getInstance and KeyGenerator.getInstance by the HMAC SHA-512/224 and SHA-512/256 object identifiers (1.2.840.113549.2.12 and .13) failed, although the same algorithms resolved by name and the matching SecretKeyFactory aliases were registered: the SHA512 mappings called addHMACAlgorithm for the two truncated variants without the addHMACAlias that registers their OIDs against Mac and KeyGenerator. Both are now aliased, as every other HMAC in that class already was.

  • A KTSParameterSpec naming an HKDF key-derivation function with a parameters field - a form the provider does not service - was accepted at Cipher init and then failed out of wrap or unwrap with an unchecked IllegalStateException neither method declares. The KTS key-wrapping Ciphers (ML-KEM, Classic McEliece, FrodoKEM, the composite KEM and RSA-KEM) now validate the spec's KDF when they take it, reporting an unserviceable one as the InvalidAlgorithmParameterException engineInit declares, which is what the javax.crypto.KEM services already did through KdfUtil.resolveKemSpec.

  • A DTLS handshake deadlocked when a handshake message ahead of the peer's ChangeCipherSpec (a client's CertificateVerify, say) was lost while the ChangeCipherSpec and Finished behind it arrived: the record layer moved its read epoch on at the ChangeCipherSpec and then discarded every retransmission of the lost message as belonging to the old epoch, whose records are only accepted once the handshake has completed. Each side then waited on the other until a handshake timeout, if one was configured, ended it. Every client-authenticated handshake, and every handshake in which the server issues a NewSessionTicket, was exposed. Until the handshake completes, handshake records from the current epoch are now still accepted after the read epoch has moved on, and each message is checked against the epoch of the record that carried it. The DTLS loopback tests now run their handshakes at 10% datagram loss in each direction, with a client-authenticated handshake at 25%.

  • The lightweight SubjectPublicKeyInfoFactory and PrivateKeyInfoFactory encoded a GOST R 34.10-2012 key on one of the legacy CryptoPro curves under id-GostR3410-2001, although RFC 9215 sec. 4.2 permits those curves for 2012 keys. The digestParamSet now decides: a GOST R 34.11-94 parameter set means 2001 (RFC 4491 sec. 2.3.2), a GOST R 34.11-2012 digest or none means 2012 with 256/512 taken from the curve field size, and any other value is rejected. GOST3410PublicKeyAlgParameters treats digestParamSet as OPTIONAL on both read and write per RFC 9215, and PrivateKeyInfoFactory now passes attributes through for ECGOST3410 keys (bc-csharp github #707).

  • The name-constraint host canonicalisation removed a single RFC 1034 root-label dot, the only empty label a name may legally carry, but nothing refused the ones that are not legal: a dNSName, rfc822Name host or uniformResourceIdentifier host such as "example.com.." kept a phantom empty label after the strip and so matched no constraint at all, escaping an excluded subtree naming the host it appears to carry. A tested name whose host carries an empty label - a second trailing dot, a doubled dot or a leading dot - is now refused outright wherever a constraint of that type is in force, rather than canonicalised into a name it is not: removing the extra dots would decide on the caller's behalf that "example.com.." names example.com, which is not how a consumer resolving or comparing the name reads it, and refusing fails closed in both directions where canonicalising would newly admit such a name under a permitted subtree. The single trailing dot is canonicalised as before, a bare "." remains the root label rather than an empty one, and the guard is scoped to the host, so the doubled dot a quoted local part may legally carry is unaffected. Constraints are untouched - one may still begin with a dot, which is how this implementation spells "subdomains only" (github PR #2436).

2.1.3 Additional Features and Functionality

2.1.4 Additional Notes

  • The sources and javadoc jars of the Ant-built distributions (jdk14, jdk15to18 and jdk13) no longer carry test material. Each module's javadoc target copies the package documentation it needs - org/bouncycastle///*.html - back into the module source directory that has already been compiled from, and zip-src zips that directory afterwards, so every test package's package.html arrived in the sources jar by that route; javadoc-util additionally copied org/bouncycastle/asn1/isismtt//*.java, which put test classes into the bcutil javadoc as generated pages, and javadoc-pg deliberately copied the gpg and bcpg test sources in order to document them. Separately the source copies excluded test material only one directory deep and only for *.java, because Ant reads ** as an any-depth wildcard just where it is a whole path segment, so anything nested further or with another extension - the PEM certificate fixtures under org/bouncycastle/est/test/san corrected in 1.86, and an ICAO master list under org/bouncycastle/asn1/icao/test - went through. The source and javadoc copies of every module now exclude test directories at any depth, and javadoc-pg no longer documents the test packages. org.bouncycastle.util.test is unaffected and still ships in the bcprov binary, sources and javadoc jars, as it does from the Gradle build: it is the SimpleTest framework the light-weight API's own test classes are written against, not test material of the distribution. No binary changes - the classes and resources of every Ant-built jar are identical to those of the 1.86 release - and the Gradle-built jdk18on artifacts never carried any of this.

2.2.1 Version

Release: 1.86
Date: 2026, 11th September.

2.2.2 Defects Fixed

  • The high-level OpenPGP API let a subkey inherit the primary key's Key Flags when its own Subkey Binding signature carried none, so a subkey bound with no flags counted as signing-capable for one check while the cross-certification check RFC 9580 sec. 5.2.1.8 requires of a signing subkey saw none and was skipped - letting a third party's public signing subkey be bound to an attacker's primary key and that party's genuine signatures verify under the attacker's identity. Flags are no longer inherited (CVE-2026-71887).
  • The high-level OpenPGP API used a version 6 key carrying no valid Direct Key signature, falling back to the primary user ID binding as it correctly does for version 4. RFC 9580 sec. 5.2.3.10 requires the opposite, and since a v6 certificate carries its expiration and preferences there, stripping that one packet silently dropped them - the certificate went on offering subkeys of a key set to expire. isBoundBy now requires a valid Direct Key self-signature before any v6 component is treated as bound; version 4 is unaffected.
  • The high-level OpenPGP API ignored the OpenPGPPolicy a caller had configured when verifying signatures on an inline message: OpenPGPMessageInputStream took the policy from the implementation's own default rather than from the processor doing the verification, so a hardened policy had no bearing on acceptance and getSignatures() reported isTestedCorrect() true for a signature that policy rejects. Both the one-pass and prefixed-signature paths now read the configured policy.
  • The high-level OpenPGP API went on offering the subkeys of a certificate whose primary key had expired, the binding check evaluating only a subkey's own Subkey Binding signature - so the certificate contradicted itself, reporting the primary unbound while still handing out its subkeys. The primary key's expiration now applies to the whole certificate, as GnuPG and Sequoia treat it, and a subkey no longer inherits the primary's validity period, which RFC 9580 sec. 5.2.3.13 counts from the creation time of the key the carrying signature is made on.
  • OpenPGPDocumentSignature.isValidAt(Date) reported a data signature as valid past the signature's own Signature Expiration Time (RFC 9580 sec. 5.2.3.18): it checked that the signature was correct and the issuing key bound and signing-capable at that date, but never the signature's own expiration, so it disagreed with isEffectiveAt() on the same object and with its own javadoc. isValid() and isValid(policy), which evaluate at creation time, are unchanged.
  • The lightweight LMSSigner and HSSSigner refused a key wrapped in ParametersWithRandom, which is how BcContentSignerBuilder passes one once setSecureRandom() has been called, so BcHssLmsContentSignerBuilder failed with "Incorrect Key Parameters" and the two signers raised ClassCastException. All three now unwrap it, as the ML-DSA and SLH-DSA signers already did; the random is accepted and ignored, LMS deriving its message randomiser deterministically from the seed and one-time index.
  • LMS signature verification did not apply two checks RFC 8554 sec. 5.4.2 requires before a signature is processed: step 2g, refusing a signature whose LMS typecode is not the public key's - without it a signature claiming a height-25 parameter set drove a 25-level computation against a height-5 key - and step 2i, refusing a leaf number outside the tree. Neither was a forgery, but both are attacker-chosen work the specification says to refuse up front. Both are now checked.
  • The LMS and HSS key parameter classes now apply at construction the checks their decoders apply, so a key built directly cannot be one the decoder would refuse: LMSPrivateKeyParameters accepted an identifier of any length where the decoder reads exactly 16 bytes, and left q, maxQ and the seed length unchecked, while HSSPrivateKeyParameters checked neither its level count nor that it had a component key and chaining signature per level. The decoders now report a bad version or seed length as IOException rather than IllegalStateException.
  • In the LMS JCE layer, LMSKeyGenParameterSpec.fromNames knew all twenty LMS parameter-set names but only four of the sixteen LM-OTS ones, so none of the SP 800-208 n24 or SHAKE sets could be named; all sixteen are now present. initialize(int, SecureRandom) now reports InvalidParameterException as the JCA specifies, and BCLMSPrivateKey.getIndex takes the exhaustion check and the index read under one monitor.
  • KeyPairGenerator.initialize(int, SecureRandom) is documented to raise InvalidParameterException when the key size is not one the generator supports, and thirty of them raised a bare IllegalArgumentException instead. Every generator in BCPQC, and the ML-DSA, ML-KEM, SLH-DSA, Classic McEliece, FrodoKEM, NTRU and composite ones in the BC provider, now raise the documented type - which extends IllegalArgumentException, so existing catches still match. The two RSA generators translate the lightweight refusal through a new SecurityExceptions.invalidParameterException factory.

... (truncated)

Commits

Updates org.bouncycastle:bcpkix-jdk18on from 1.78.1 to 1.86

Changelog

Sourced from org.bouncycastle:bcpkix-jdk18on's changelog.

Bouncy Castle Crypto Package - Release Notes

1.0 Introduction

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. The package is organised so that it contains a light-weight API suitable for use in any environment (including the J2ME) with the additional infrastructure to conform the algorithms to the JCE framework.

2.0 Release History

2.1.1 Version

Release: 1.87
Date: 2026, TBD

2.1.2 Defects Fixed

  • A KeyAgreement asked for its shared secret before doPhase returned data rather than refusing. javax.crypto.KeyAgreement specifies IllegalStateException for that state, but nothing in the provider tracked it, so each SPI handed back whatever its result field held: for Diffie-Hellman that was the private value itself - engineInit seeded result with x, so generateSecret() returned the private exponent padded to the prime's length and generateSecret("AES") an all-zero key taken from that padding - while ECDH returned null and its named-algorithm overload raised NullPointerException. BaseAgreementSpi now records whether a doPhase has completed the agreement since the last init and refuses the request with an IllegalStateException naming the algor...

    Description has been truncated

…with 12 updates

Bumps the maven-minor-and-patch group with 12 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [com.baomidou:mybatis-plus-spring-boot3-starter](https://github.com/baomidou/mybatis-plus) | `3.5.9` | `3.5.17` |
| cn.dev33:sa-token-spring-boot3-starter | `1.39.0` | `1.46.0` |
| cn.dev33:sa-token-redis-jackson | `1.39.0` | `1.46.0` |
| cn.dev33:sa-token-redis-jackson | `1.39.0` | `1.46.0` |
| [io.github.resilience4j:resilience4j-spring-boot3](https://github.com/resilience4j/resilience4j) | `2.2.0` | `2.4.0` |
| org.apache.commons:commons-pool2 | `2.12.0` | `2.13.1` |
| [cn.hutool:hutool-core](https://github.com/chinabugotech/hutool) | `5.8.34` | `5.8.47` |
| [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java) | `1.78.1` | `1.86` |
| [org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java) | `1.78.1` | `1.86` |
| [org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java) | `1.78.1` | `1.86` |
| [org.projectlombok:lombok](https://github.com/projectlombok/lombok) | `1.18.34` | `1.18.48` |
| [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) | `3.13.0` | `3.16.0` |
| com.twelvemonkeys.imageio:imageio-webp | `3.12.0` | `3.15.1` |
| [nl.martijndwars:web-push](https://github.com/web-push-libs/webpush-java) | `5.1.1` | `5.1.2` |



Updates `com.baomidou:mybatis-plus-spring-boot3-starter` from 3.5.9 to 3.5.17
- [Release notes](https://github.com/baomidou/mybatis-plus/releases)
- [Changelog](https://github.com/baomidou/mybatis-plus/blob/3.0/CHANGELOG.md)
- [Commits](baomidou/mybatis-plus@v3.5.9...v3.5.17)

Updates `cn.dev33:sa-token-spring-boot3-starter` from 1.39.0 to 1.46.0

Updates `cn.dev33:sa-token-redis-jackson` from 1.39.0 to 1.46.0

Updates `cn.dev33:sa-token-redis-jackson` from 1.39.0 to 1.46.0

Updates `io.github.resilience4j:resilience4j-spring-boot3` from 2.2.0 to 2.4.0
- [Release notes](https://github.com/resilience4j/resilience4j/releases)
- [Changelog](https://github.com/resilience4j/resilience4j/blob/master/RELEASENOTES.adoc)
- [Commits](resilience4j/resilience4j@v2.2.0...v2.4.0)

Updates `org.apache.commons:commons-pool2` from 2.12.0 to 2.13.1

Updates `cn.hutool:hutool-core` from 5.8.34 to 5.8.47
- [Release notes](https://github.com/chinabugotech/hutool/releases)
- [Changelog](https://github.com/chinabugotech/hutool/blob/v5-master/CHANGELOG.md)
- [Commits](chinabugotech/hutool@5.8.34...5.8.47)

Updates `org.bouncycastle:bcprov-jdk18on` from 1.78.1 to 1.86
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcpkix-jdk18on` from 1.78.1 to 1.86
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcpkix-jdk18on` from 1.78.1 to 1.86
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.projectlombok:lombok` from 1.18.34 to 1.18.48
- [Changelog](https://github.com/projectlombok/lombok/blob/master/doc/changelog.markdown)
- [Commits](projectlombok/lombok@v1.18.34...v1.18.48)

Updates `org.apache.maven.plugins:maven-compiler-plugin` from 3.13.0 to 3.16.0
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.13.0...maven-compiler-plugin-3.16.0)

Updates `com.twelvemonkeys.imageio:imageio-webp` from 3.12.0 to 3.15.1

Updates `nl.martijndwars:web-push` from 5.1.1 to 5.1.2
- [Changelog](https://github.com/web-push-libs/webpush-java/blob/master/CHANGELOG.md)
- [Commits](web-push-libs/webpush-java@5.1.1...5.1.2)

---
updated-dependencies:
- dependency-name: com.baomidou:mybatis-plus-spring-boot3-starter
  dependency-version: 3.5.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: cn.dev33:sa-token-spring-boot3-starter
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: cn.dev33:sa-token-redis-jackson
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: cn.dev33:sa-token-redis-jackson
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: io.github.resilience4j:resilience4j-spring-boot3
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.commons:commons-pool2
  dependency-version: 2.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: cn.hutool:hutool-core
  dependency-version: 5.8.47
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.bouncycastle:bcprov-jdk18on
  dependency-version: '1.86'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.bouncycastle:bcpkix-jdk18on
  dependency-version: '1.86'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.bouncycastle:bcpkix-jdk18on
  dependency-version: '1.86'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: org.projectlombok:lombok
  dependency-version: 1.18.48
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-version: 3.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: com.twelvemonkeys.imageio:imageio-webp
  dependency-version: 3.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor-and-patch
- dependency-name: nl.martijndwars:web-push
  dependency-version: 5.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Sep 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants