Bump the minor-patch group across 1 directory with 22 updates by dependabot[bot] · Pull Request #913 · cap-java/cds-feature-attachments

dependabot · 2026-11-03T15:55:13Z

Bumps the minor-patch group with 22 updates in the / directory:

Package	From	To
com.sap.cds:cds-services-bom	`5.1.1`	`5.2.0`
com.sap.cds:cds-maven-plugin	`5.1.1`	`5.2.0`
io.netty:netty-bom	`4.2.17.Final`	`4.2.19.Final`
com.sap.cloud.sdk:sdk-bom	`5.34.0`	`5.35.0`
org.mockito:mockito-bom	`5.23.0`	`5.24.0`
org.sonatype.central:central-publishing-maven-plugin	`0.11.0`	`0.12.0`
org.apache.maven.plugins:maven-deploy-plugin	`3.1.4`	`3.2.0`
org.apache.maven.plugins:maven-surefire-plugin	`3.6.0`	`3.6.1`
org.apache.maven.plugins:maven-failsafe-plugin	`3.6.0`	`3.6.1`
org.apache.maven.plugins:maven-enforcer-plugin	`3.6.3`	`3.7.0`
org.jacoco:jacoco-maven-plugin	`0.8.15`	`0.8.16`
com.github.spotbugs:spotbugs-maven-plugin	`4.10.4.1`	`4.10.5.0`
com.sap.cds:cds-maven-plugin	`5.1.1`	`5.2.0`
com.diffplug.spotless:spotless-maven-plugin	`3.10.2`	`3.10.4`
com.github.spotbugs:spotbugs-annotations	`4.10.4`	`4.10.5`
ch.qos.logback:logback-classic	`1.6.3`	`1.6.6`
software.amazon.awssdk:s3	`2.54.13`	`2.57.4`
software.amazon.awssdk.crt:aws-crt	`0.48.4`	`0.49.0`
com.azure:azure-storage-blob	`12.35.1`	`12.36.0`
com.google.cloud:google-cloud-storage	`2.73.0`	`2.75.0`
org.springframework.boot:spring-boot-dependencies	`4.1.1`	`4.1.2`
org.wiremock.integrations:wiremock-spring-boot	`4.2.3`	`4.4.3`
org.codehaus.mojo:exec-maven-plugin	`3.6.3`	`3.6.4`

Updates com.sap.cds:cds-services-bom from 5.1.1 to 5.2.0

Updates com.sap.cds:cds-maven-plugin from 5.1.1 to 5.2.0

Updates io.netty:netty-bom from 4.2.17.Final to 4.2.19.Final

Release notes

Sourced from io.netty:netty-bom's releases.

netty-4.2.19.Final

Security

Note that Netty 4.1 will be End-of-Life on July 1st, 2027.

We strongly recommend upgrading to this version to get the following security fixes:

CVE-2026-XXXXX : parser desync in io.netty:netty-codec-haproxy

CVE-2026-XXXXX : improper CRLF neutralization (request/response smuggling) in io.netty:netty-codec-http

CVE-2026-XXXXX : origin validation error in io.netty:netty-codec-http

CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http2

CVE-2026-XXXXX : request/response smuggling in io.netty:netty-codec-http

CVE-2026-XXXXX : time-of-check/time-of-use error in io.netty:netty-handler-ssl-ocsp

CVE-2026-XXXXX : SNI routing bypass in io.netty:netty-handler

CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-xml

CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-base

CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http

CVE-2026-XXXXX : input misinterpretation in io.netty:netty-codec-socks

CVE-2026-XXXXX : improper access control in io.netty:netty-handler

CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-dns

CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http3

CVE-2026-XXXXX : use-after-free in io.netty:netty-transport-classes-io_uring

CVE-2026-XXXXX : memory leak in io.netty:netty-transport-native-io_uring

Note that due to overwhelming strain on the CVE infrastructure, we have not gotten a single CVE number assigned to these reports in time for our release. The advisories will be published without.

Specific changes worth calling out:

Validation in FileUpload.setContentType. Previously, the FileUpload.setContentType methods did not validate their inputs. They now throw an IllegaalArgumentException if the given string is not formatted as a plausible MIME content type.

What's Changed

perf: Use LinkedHashSet to deduplicate search domains by @JunggiKim in netty/netty#17400

Handle non-positive skip lengths in ByteBufInputStream by @cuishuang in netty/netty#17388

Avoid double promise allocation in SslHandler.wrap() by @doom369 in netty/netty#17382

Socket: Add half-closure tests to SocketHalfClosedTest by @rajan-github in netty/netty#17394

HttpUtil.getCharset() must accept whitespace before the next Content-Type parameter by @hunseonglee in netty/netty#17386

codec-dns: Add SMIMEA, CDS, CDNSKEY, OPENPGPKEY, CSYNC, ZONEMD records by @hyperxpro in netty/netty#17373

transport: Avoid io_uring completion callback allocation by @massiccio in netty/netty#17457

QUIC: Ensure writable events reflect stream capacity by @yawkat in netty/netty#17431

OcspServerCertificateValidatorTest: Fix possible leak in test by @normanmaurer in netty/netty#17469

Use github to download cmake and also remove tar file after unpacking by @normanmaurer in netty/netty#17482

build: Upgrade GitHub Actions to fix Node.js 20 deprecation warnings by @normanmaurer in netty/netty#17484

HttpUtil.getMimeType() must not include whitespace before the next Content-Type parameter by @ohchanKyu in netty/netty#17456

Fix buffer leak when recvmmsg returns single UDP_GRO batch by @octa-one in netty/netty#17493

Guard ChunkedWriteHandler.doFlush() against re-entrant invocation from user code by @fudianchn in netty/netty#17438

Add regression test for close() cascade reentering flush() by @normanmaurer in netty/netty#17497

Fix UDP_GRO segment size is lost when reading with recvmmsg by @octa-one in netty/netty#17492

... (truncated)

Commits

64cc10f [maven-release-plugin] prepare release netty-4.2.19.Final
e863e69 Fix io_uring domain socket fd leak on multi-fd SCM_RIGHTS messages
d82c6c3 Fix IP allow-list bypass from ruleType-blind dedup in IpSubnetFilter
bccc62a Bound domain-name decode buffer to avoid quadratic allocation
6b02cd3 Fix wrong nextBid computation in IoUringBufferRing for RECVSEND_BUNDLE
ef3a3e1 Fix sign-extension bug in SocksInitRequestDecoder NMETHODS field
4cacdf0 Fix quadratic CPU usage in XmlFrameDecoder when an element is never balanced
20f3aae Fail closed on zero-length handshake records in SslClientHelloHandler
c3f7088 Netty OcspServerCertificateValidator still delivers buffered data from a revo...
4029f07 Correctly handle multiple Content-Length
Additional commits viewable in compare view

Updates com.sap.cloud.sdk:sdk-bom from 5.34.0 to 5.35.0

Release notes

Sourced from com.sap.cloud.sdk:sdk-bom's releases.

Release 5.35.0

What's Changed

Add disclaimer in the ReadMe for WIP status by @jjtang1985 in SAP/cloud-sdk-java#17

Big Pipeline Update by @MatKuhr in SAP/cloud-sdk-java#18

Improve sanity check pipeline by @MatKuhr in SAP/cloud-sdk-java#23

Add CodeQL security scan by @KevinHudemann in SAP/cloud-sdk-java#24

Update Blackduck Action by @KevinHudemann in SAP/cloud-sdk-java#25

Add step for snapshot deployments by @KevinHudemann in SAP/cloud-sdk-java#26

Read Blackduck excludes from modules-inventory.json by @KevinHudemann in SAP/cloud-sdk-java#27

Test archetypes by @daniel-kurzynski in SAP/cloud-sdk-java#28

Enforce threshold for JaCoCo and improve config by @KevinHudemann in SAP/cloud-sdk-java#29

Notify via slack in case CI workflow on main fails by @daniel-kurzynski in SAP/cloud-sdk-java#31

Add checkstyle by @daniel-kurzynski in SAP/cloud-sdk-java#30

Add checkstyle rule for TODO and FIXME comments by @KevinHudemann in SAP/cloud-sdk-java#40

Remove OpenAPI CLI module by @cschubertcs in SAP/cloud-sdk-java#42

Update Fosstars workflow and trigger scan on every push by @KevinHudemann in SAP/cloud-sdk-java#41

Improve release workflow by @KevinHudemann in SAP/cloud-sdk-java#39

Chore: Adjust Release Audience of scp-cf-spring-jakarta by @Johannes-Schneider in SAP/cloud-sdk-java#45

Add create module inventory script by @KevinHudemann in SAP/cloud-sdk-java#57

Improve perform release by @KevinHudemann in SAP/cloud-sdk-java#53

Fix reading the version from build in deploy-snapshots step by @KevinHudemann in SAP/cloud-sdk-java#59

JavaDoc as HTML and JARs by @KevinHudemann in SAP/cloud-sdk-java#58

Create support issue template by @CharlesDuboisSAP in SAP/cloud-sdk-java#68

Release to Maven Central by @stippi2 in SAP/cloud-sdk-java#78

Fix scheduled sanity pipeline by @daniel-kurzynski in SAP/cloud-sdk-java#82

Fix build pipeline after merging deployment to Maven Central by @stippi2 in SAP/cloud-sdk-java#80

Migrate all main/v5 code to OSS repo by @stippi2 in SAP/cloud-sdk-java#83

322 - remove CURRENT_TENANT_THEN_PROVIDER by @rnewbigging in SAP/cloud-sdk-java#86

Enable ServiceBinding based OnPremise Proxy resolution by @newtork in SAP/cloud-sdk-java#87

Force Java 17 for CodeQL, same as in normal CI workflow by @stippi2 in SAP/cloud-sdk-java#88

HttpClient5 to own module by @rnewbigging in SAP/cloud-sdk-java#90

Remove Frameworks parent module by @rnewbigging in SAP/cloud-sdk-java#92

Deploy snapshots to Maven central by @KevinHudemann in SAP/cloud-sdk-java#94

Fix: Add providerTenantId to MegacliteServiceBinding by @CharlesDuboisSAP in SAP/cloud-sdk-java#98

fix: Update Javadoc Overview Page by @CharlesDuboisSAP in SAP/cloud-sdk-java#100

Update XSUAA Security Library to 2.14.2 by @newtork in SAP/cloud-sdk-java#97

Change ScpCf modules behaviour with DwC bindings by @CharlesDuboisSAP in SAP/cloud-sdk-java#104

Fix DwC-test-app: Made ScpCfDestinationRetrievalStrategy.ofIdentifier() public by @CharlesDuboisSAP in SAP/cloud-sdk-java#105

Used ProxyHandler in MegacliteDestination connectivity test by @CharlesDuboisSAP in SAP/cloud-sdk-java#107

[OpenAPI] Ignore getCustomFieldNames() method from default Jackson serialization by @newtork in SAP/cloud-sdk-java#102

Fix: Silently Ignore Resilience for multiple ResilienceDecorationStrategies - Alternative by @Johannes-Schneider in SAP/cloud-sdk-java#115

Migrate OData header deduplication by @cschubertcs in SAP/cloud-sdk-java#114

Refactor: Remove CloudPlatform classes by @Johannes-Schneider in SAP/cloud-sdk-java#111

feat: Add error handling for incorrect destination configuration in HttpClientWrapper by @CharlesDuboisSAP in SAP/cloud-sdk-java#112

feat: Add new Pull Request template for SAP Cloud SDK Java repository by @CharlesDuboisSAP in SAP/cloud-sdk-java#116

Minor syntax change in OAuth2ServiceBindingDestinationLoader by @newtork in SAP/cloud-sdk-java#96

feature: Introduce OAuth2 caching by @cschubertcs in SAP/cloud-sdk-java#106

Use all runner cores for mvn executions by @stippi2 in SAP/cloud-sdk-java#85

feat: Update PR template to automatically close associated issue by @CharlesDuboisSAP in SAP/cloud-sdk-java#118

Multitenancy Refactor by @rnewbigging in SAP/cloud-sdk-java#101

... (truncated)

Commits

dc8d1cd Update to version 5.35.0
9ea1e6a chore: [DevOps] bump the github-actions group with 2 updates (#1295)
de45ef9 revert: migrate odata v2/v4 to Apache HttpClient 5 and scope CSRF token inter...
44fe831 chore: [DevOps] bump the test group with 4 updates (#1288)
0efc39a chore: [DevOps] bump the production-minor-patch group with 14 updates (#1287)
9a4692a fix: KeyStoreReader fails to decrypt PBES2/PBKDF2-encrypted destinati… (#1282)
d139237 fix: scope CSRF token interceptor to OData clients only (#1281)
03fbc68 chore: [DevOps] bump the production-minor-patch group with 3 updates (#1283)
f105d85 chore: [DevOps] bump the test group with 2 updates (#1285)
8fa1e54 chore: [DevOps] bump the plugins group with 2 updates (#1284)
Additional commits viewable in compare view

Updates org.mockito:mockito-bom from 5.23.0 to 5.24.0

Release notes

Sourced from org.mockito:mockito-bom's releases.

v5.24.0

Changelog generated by Shipkit Changelog Gradle Plugin

5.24.0

2026-09-23 - 27 commit(s) by Andrei Solntsev, DragonFSKY, Hünkar Can Tunç, Joshua Selbo, M. Minot, Markus Gaisbauer, Mirko Alicastro, Vinod Kumar M ( codingkiddo ), dependabot[bot]

Fix Mockito docs for -javaagent flag with Gradle [(#3866)](mockito/mockito#3866)

Kotlin example for adding Mockito as an agent is incorrect [(#3864)](mockito/mockito#3864)

Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 [(#3862)](mockito/mockito#3862)

Bump gradle/actions from 6.2.0 to 6.3.0 [(#3852)](mockito/mockito#3852)

Bump gradle/actions from 5 to 6.2.0 [(#3851)](mockito/mockito#3851)

Preserve method parameters when clearing inline mocks [(#3847)](mockito/mockito#3847)

Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 [(#3845)](mockito/mockito#3845)

Print object fields via reflection when toString() is not implemented [(#3844)](mockito/mockito#3844)

Migrate extensions-tests to JUnit Jupiter [(#3840)](mockito/mockito#3840)

Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 [(#3839)](mockito/mockito#3839)

docs(when-verify): fixes to explanations about redundancy [(#3838)](mockito/mockito#3838)

Confusing inconsistency in example method calls in “stubbing and verifying is redundant” note of “when” and “verify” Javadoc [(#3837)](mockito/mockito#3837)

Bump actions/checkout from 6 to 7 [(#3836)](mockito/mockito#3836)

Fixes #2740 : Add mockMaker option to @Spy annotation [(#3835)](mockito/mockito#3835)

Bump graalvm/setup-graalvm from 1.5.5 to 1.5.6 [(#3834)](mockito/mockito#3834)

Bump graalvm/setup-graalvm from 1.5.4 to 1.5.5 [(#3833)](mockito/mockito#3833)

Bump codecov/codecov-action from 6 to 7 [(#3831)](mockito/mockito#3831)

Bump graalvm/setup-graalvm from 1.4.5 to 1.5.4 [(#3830)](mockito/mockito#3830)

Fix clearInlineMocks not de-registering singleton mocks [(#3829)](mockito/mockito#3829)

Fix NotAMockException when using mockSingleton with MockitoJUnit [(#3827)](mockito/mockito#3827)

NotAMockException when using mockSingleton with MockitoSession or MockitoJUnit [(#3826)](mockito/mockito#3826)

Improve Gradle agent docs for configuration cache [(#3823)](mockito/mockito#3823)

Gradle documentation for setting up instrumentation with Gradle configuration cache [(#3822)](mockito/mockito#3822)

Fixes #3818 : Fix data race in InvocationContainerImpl.invocationForStubbing [(#3819)](mockito/mockito#3819)

Data race on invocationForPotentialStubbing [(#3818)](mockito/mockito#3818)

Fixes #3814 : implement package-level clinit suppression [(#3815)](mockito/mockito#3815)

Package-level clinit suppression [(#3814)](mockito/mockito#3814)

Upgrade Android Gradle Plugin to 8.13.2 [(#3812)](mockito/mockito#3812)

Replaces raw generic types with type parameters [(#3806)](mockito/mockito#3806)

Fixes #2398 : Implement global suppress static initialization leveraging java agent [(#3801)](mockito/mockito#3801)

Bump codecov/codecov-action from 5 to 6 [(#3800)](mockito/mockito#3800)

Fix non-deterministic AssertionError when using MockMakers.SUBCLASS (#3406, #2823) [(#3795)](mockito/mockito#3795)

Fixes #3536 : Implement SpyStatic API [(#3794)](mockito/mockito#3794)

The class's MethodParameters are removed after clearAllCaches is invoked [(#3763)](mockito/mockito#3763)

[FeatureRequest / Idea] Create Mockito.spyStatic [(#3536)](mockito/mockito#3536)

Add option to specify mockmaker for @Spy [(#2740)](mockito/mockito#2740)

How can I suppress static initializer? [(#2398)](mockito/mockito#2398)

Commits

5a2f0f8 Fix Mockito docs for -javaagent flag with Gradle (#3866)
9c5f36f Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 (#3862)
e7fd06d Preserve method parameters when clearing inline mocks (#3847)
5a676bc Bump gradle/actions from 6.2.0 to 6.3.0 (#3852)
508f8e7 Bump gradle/actions from 5 to 6.2.0 (#3851)
ee8a330 Print object fields via reflection when toString() is not implemented (#3844)
39b1aba Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 (#3845)
d8638e1 Migrate extensions-tests to JUnit Jupiter (#3840)
0aab922 Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 (#3839)
f3cf74c docs(when-verify): fixes to explanations about redundancy (#3838)
Additional commits viewable in compare view

Updates org.sonatype.central:central-publishing-maven-plugin from 0.11.0 to 0.12.0

Release notes

Sourced from org.sonatype.central:central-publishing-maven-plugin's releases.

release-0.12.0

What's Changed

feat: add skipUpload property to build the bundle without uploading it by @madpah in sonatype-nexus-community/central-publishing-maven-plugin#6

fix: remove local repository files from the bundle on Maven 3.10 by @madpah in sonatype-nexus-community/central-publishing-maven-plugin#3

Full Changelog: sonatype-nexus-community/central-publishing-maven-plugin@release-0.11.1...release-0.12.0

0.11.1

This is the same source as for release 0.11.0, but now open-sourced under Apache-2.0 license.

Full Changelog: https://github.com/sonatype-nexus-community/central-publishing-maven-plugin/commits/release-0.11.1

Commits

See full diff in compare view

Updates org.apache.maven.plugins:maven-deploy-plugin from 3.1.4 to 3.2.0

Release notes

Sourced from org.apache.maven.plugins:maven-deploy-plugin's releases.

3.2.0

🚀 New features and improvements

Cache projectsWithDeployExecution to fix O(N²) reactor scan (#697) @slawekjaranowski

🐛 Bug Fixes

Backport security audit fixes to 3.x (f004-f008, f010, f012) (#701) @gnodet

📝 Documentation updates

Clarify deploy without editing this projects POM (#694) @slawekjaranowski

Restore the plain form of the ASF licence header (#688) @slachiewicz

Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#674) @potiuk

👻 Maintenance

Simplify remote repository creation (#696) @slawekjaranowski

Restore the plain form of the ASF licence header (#688) @slachiewicz

enable build with Maven 4 (#655) @hboutemy

Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#674) @potiuk

Migration to JUnit 5 - avoid using AbstractMojoTestCase (#643) @slawekjaranowski

Migration to JUnit 5 - avoid using AbstractMojoTestCase in DeployFileMojoTest (#629) @slawekjaranowski

Bump m-invoker-p to 3.9.1 (#627) @slachiewicz

Feature/apt to md 3.x (#620) @kwin

🔧 Build

update deployAtEnd ITs to match latest 4 behaviour (#667) @hboutemy

📦 Dependency updates

Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml from 4 to 5 (#681) @dependabot[bot]

Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml from 4 to 5 (#679) @dependabot[bot]

Bump apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml from 4 to 5 (#680) @dependabot[bot]

Bump org.apache.maven.plugins:maven-plugins from 48 to 49 (#671) @dependabot[bot]

Bump mavenVersion from 3.9.15 to 3.9.16 (#665) @dependabot[bot]

Bump org.apache.maven.plugins:maven-plugins from 47 to 48 (#662) @dependabot[bot]

Bump mavenVersion from 3.9.14 to 3.9.15 (#657) @dependabot[bot]

Bump mavenVersion from 3.9.13 to 3.9.14 (#654) @dependabot[bot]

Bump mavenVersion from 3.9.12 to 3.9.13 (#648) @dependabot[bot]

Bump resolverVersion from 1.9.26 to 1.9.27 (#646) @dependabot[bot]

Bump resolverVersion from 1.9.25 to 1.9.26 (#642) @dependabot[bot]

Bump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.5.0 to 3.5.1 (#640) @dependabot[bot]

Bump org.apache.maven.plugins:maven-plugins from 46 to 47 (#639) @dependabot[bot]

Bump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.4.0 to 3.5.0 (#637) @dependabot[bot]

Bump org.apache.maven.plugins:maven-plugins from 45 to 46 (#636) @dependabot[bot]

Bump mavenVersion from 3.9.11 to 3.9.12 (#634) @dependabot[bot]

Bump resolverVersion from 1.9.24 to 1.9.25 (#631) @dependabot[bot]

... (truncated)

Commits

7aab9fb [maven-release-plugin] prepare release maven-deploy-plugin-3.2.0
1f3eef5 Backport security audit fixes to 3.x (f004-f008, f010, f012)
307f328 Simplify remote repository creation
7b1bbc4 Cache projectsWithDeployExecution to fix O(N²) reactor scan
a9177c6 Clarify deploy without editing this projects POM
7c40513 Restore the plain form of the ASF licence header
5969234 Update Release Drafter configuration to use custom tag template and remove un...
df7b3fa Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml
b4e8aed work around Maven 4 CLI lack of interpolation
d634bb4 enable build with Maven 4
Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-surefire-plugin from 3.6.0 to 3.6.1

Release notes

Sourced from org.apache.maven.plugins:maven-surefire-plugin's releases.

3.6.1

🚀 New features and improvements

Group module path heuristics in a single class ModulePathJpmsArguments (#3541) @olamy

Fix out of memory errors with big JUnit 4 suites (#3511) (#3515) @olamy

[SUREFIRE-3459] - Allow opting out of StackWalker stack capture (#3493) @goutamadwant

🐛 Bug Fixes

Fix IllegalAccessError when the main module requires JUnit (#3532) (#3538) @olamy

Fix groups and excludedGroups being ignored when TestNG is on the classpath (#3534) @olamy

Don't let runOrder replace JUnit orderers set elsewhere (#3529) (#3530) @olamy

Fix groups and excludedGroups for Spock and Jupiter tests when JUnit 4 is on the classpath (#3468) (#3503) (#3517) @olamy

Issue #3462 TestNG extension onStart/onFinish called too many times (#3470) @olamy

Fix forked JVM hanging forever when the exit timeout fires (#3500), Possible NPE if a thread ends while building the thread dump (#3506) @olamy

Stop rewriting the class report for every nested suite (#3511) (#3514) @olamy

Fix IllegalAccessError in the forked JVM on Java 8 and 11 (#3511) (#3513) @olamy

[SUREFIRE-3460] - Don't NPE when StackWalkerStrategy inits with a null TCCL (#3464) @kalayciburak

[SUREFIRE-3465] - Match includes/excludes the way the scanner does (#3466) @orion0616

[Issue-3456] Apply systemPropertyVariables before the fork initializes networking (#3467) @joseluisll

Fix inverted filter predicate in ForkStarter#readTestClassNames (#3453) @slachiewicz

📝 Documentation updates

Clean up deprecated parameters and fix TestNG parallel modes (#3452) (#3519) @olamy

Merge the two timeout extension pages into one. The guide and the example page covered the same things twice. (#3520) @olamy

Drop the Source Xref menu items (#3479) @slachiewicz

👻 Maintenance

Use push for PR Automation (#3536) @slawekjaranowski

Use workflow_run for PR check (#3531) @slawekjaranowski

Add project metadata for ATR (#3522) @slawekjaranowski

Add PR check workflow (#3507) @slawekjaranowski

Fix ForkCountIT failing on Windows with Maven 3.10.0 (#3509) @olamy

Fix ITs for Maven 3.10.0 (#3508) @slawekjaranowski

Migrate surefire-its fixture from maven-verifier to maven-executor (#3484) @slachiewicz

Port the IT scripts from BeanShell to Groovy (#3480) @slachiewicz

Drop the Source Xref menu items (#3479) @slachiewicz

Implement getOutputPath() and deprecate getOutputName() (#3469) @slachiewicz

🔧 Build

Drop the Maven 3.9.0 CI job (#3525) @slachiewicz

Fix ForkCountIT failing on Windows with Maven 3.10.0 (#3509) @olamy

fix test due to uneven Maven API migration, Maven 4 build (#3502) @sebtiem

Keep Dependabot off JUnit 6 (#3497) @slachiewicz

Verify the plugin on Maven 3.9.0 (#3478) @slachiewicz

... (truncated)

Commits

5bf0dcf [maven-release-plugin] prepare release surefire-3.6.1
7f73580 Bump doxiaVersion from 2.1.0 to 2.2.0 (#3542)
ab7ce2f Bump org.testng:testng (#3539)
ff3b768 Group module path heuristics in ModulePathJpmsArguments (#3541)
a343e4d Fix IllegalAccessError when the main module requires JUnit (#3532) (#3538)
907a2e2 Fix groups and excludedGroups being ignored when TestNG is on the classpath (...
cc69b3c Use push for PR Automation
b119019 Install the JUnit Platform provider for the ITs (#3535)
2cdec2e Don't let runOrder replace JUnit orderers set elsewhere (#3529) (#3530)
1e4f6b9 Use workflow_run for PR check (#3531)
Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-failsafe-plugin from 3.6.0 to 3.6.1

Release notes

Sourced from org.apache.maven.plugins:maven-failsafe-plugin's releases.

3.6.1

🚀 New features and improvements

Group module path heuristics in a single class ModulePathJpmsArguments (#3541) @olamy

Fix out of memory errors with big JUnit 4 suites (#3511) (#3515) @olamy

[SUREFIRE-3459] - Allow opting out of StackWalker stack capture (#3493) @goutamadwant

🐛 Bug Fixes

Fix IllegalAccessError when the main module requires JUnit (#3532) (#3538) @olamy

Fix groups and excludedGroups being ignored when TestNG is on the classpath (#3534) @olamy

Don't let runOrder replace JUnit orderers set elsewhere (#3529) (#3530) @olamy

Fix groups and excludedGroups for Spock and Jupiter tests when JUnit 4 is on the classpath (#3468) (#3503) (#3517) @olamy

Issue #3462 TestNG extension onStart/onFinish called too many times (#3470) @olamy

Fix forked JVM hanging forever when the exit timeout fires (#3500), Possible NPE if a thread ends while building the thread dump (#3506) @olamy

Stop rewriting the class report for every nested suite (#3511) (

Bumps the minor-patch group with 22 updates in the / directory: | Package | From | To | | --- | --- | --- | | com.sap.cds:cds-services-bom | `5.1.1` | `5.2.0` | | com.sap.cds:cds-maven-plugin | `5.1.1` | `5.2.0` | | [io.netty:netty-bom](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.19.Final` | | [com.sap.cloud.sdk:sdk-bom](https://github.com/SAP/cloud-sdk-java) | `5.34.0` | `5.35.0` | | [org.mockito:mockito-bom](https://github.com/mockito/mockito) | `5.23.0` | `5.24.0` | | [org.sonatype.central:central-publishing-maven-plugin](https://github.com/sonatype-nexus-community/central-publishing-maven-plugin) | `0.11.0` | `0.12.0` | | [org.apache.maven.plugins:maven-deploy-plugin](https://github.com/apache/maven-deploy-plugin) | `3.1.4` | `3.2.0` | | [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.6.0` | `3.6.1` | | [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire) | `3.6.0` | `3.6.1` | | [org.apache.maven.plugins:maven-enforcer-plugin](https://github.com/apache/maven-enforcer) | `3.6.3` | `3.7.0` | | [org.jacoco:jacoco-maven-plugin](https://github.com/jacoco/jacoco) | `0.8.15` | `0.8.16` | | [com.github.spotbugs:spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) | `4.10.4.1` | `4.10.5.0` | | com.sap.cds:cds-maven-plugin | `5.1.1` | `5.2.0` | | [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) | `3.10.2` | `3.10.4` | | [com.github.spotbugs:spotbugs-annotations](https://github.com/spotbugs/spotbugs) | `4.10.4` | `4.10.5` | | [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.6.3` | `1.6.6` | | software.amazon.awssdk:s3 | `2.54.13` | `2.57.4` | | [software.amazon.awssdk.crt:aws-crt](https://github.com/awslabs/aws-crt-java) | `0.48.4` | `0.49.0` | | [com.azure:azure-storage-blob](https://github.com/Azure/azure-sdk-for-java) | `12.35.1` | `12.36.0` | | [com.google.cloud:google-cloud-storage](https://github.com/googleapis/google-cloud-java) | `2.73.0` | `2.75.0` | | [org.springframework.boot:spring-boot-dependencies](https://github.com/spring-projects/spring-boot) | `4.1.1` | `4.1.2` | | [org.wiremock.integrations:wiremock-spring-boot](https://github.com/wiremock/wiremock-spring-boot) | `4.2.3` | `4.4.3` | | [org.codehaus.mojo:exec-maven-plugin](https://github.com/mojohaus/exec-maven-plugin) | `3.6.3` | `3.6.4` | Updates `com.sap.cds:cds-services-bom` from 5.1.1 to 5.2.0 Updates `com.sap.cds:cds-maven-plugin` from 5.1.1 to 5.2.0 Updates `io.netty:netty-bom` from 4.2.17.Final to 4.2.19.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.19.Final) Updates `com.sap.cloud.sdk:sdk-bom` from 5.34.0 to 5.35.0 - [Release notes](https://github.com/SAP/cloud-sdk-java/releases) - [Changelog](https://github.com/SAP/cloud-sdk-java/blob/main/release_notes.md) - [Commits](SAP/cloud-sdk-java@rel/5.34.0...rel/5.35.0) Updates `org.mockito:mockito-bom` from 5.23.0 to 5.24.0 - [Release notes](https://github.com/mockito/mockito/releases) - [Commits](mockito/mockito@v5.23.0...v5.24.0) Updates `org.sonatype.central:central-publishing-maven-plugin` from 0.11.0 to 0.12.0 - [Release notes](https://github.com/sonatype-nexus-community/central-publishing-maven-plugin/releases) - [Commits](https://github.com/sonatype-nexus-community/central-publishing-maven-plugin/commits/release-0.12.0) Updates `org.apache.maven.plugins:maven-deploy-plugin` from 3.1.4 to 3.2.0 - [Release notes](https://github.com/apache/maven-deploy-plugin/releases) - [Commits](apache/maven-deploy-plugin@maven-deploy-plugin-3.1.4...maven-deploy-plugin-3.2.0) Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.6.0 to 3.6.1 - [Release notes](https://github.com/apache/maven-surefire/releases) - [Commits](apache/maven-surefire@surefire-3.6.0...surefire-3.6.1) Updates `org.apache.maven.plugins:maven-failsafe-plugin` from 3.6.0 to 3.6.1 - [Release notes](https://github.com/apache/maven-surefire/releases) - [Commits](apache/maven-surefire@surefire-3.6.0...surefire-3.6.1) Updates `org.apache.maven.plugins:maven-enforcer-plugin` from 3.6.3 to 3.7.0 - [Release notes](https://github.com/apache/maven-enforcer/releases) - [Commits](apache/maven-enforcer@enforcer-3.6.3...enforcer-3.7.0) Updates `org.jacoco:jacoco-maven-plugin` from 0.8.15 to 0.8.16 - [Release notes](https://github.com/jacoco/jacoco/releases) - [Commits](jacoco/jacoco@v0.8.15...v0.8.16) Updates `com.github.spotbugs:spotbugs-maven-plugin` from 4.10.4.1 to 4.10.5.0 - [Release notes](https://github.com/spotbugs/spotbugs-maven-plugin/releases) - [Commits](spotbugs/spotbugs-maven-plugin@spotbugs-maven-plugin-4.10.4.1...spotbugs-maven-plugin-4.10.5.0) Updates `com.sap.cds:cds-maven-plugin` from 5.1.1 to 5.2.0 Updates `com.diffplug.spotless:spotless-maven-plugin` from 3.10.2 to 3.10.4 - [Release notes](https://github.com/diffplug/spotless/releases) - [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md) - [Commits](diffplug/spotless@maven/3.10.2...maven/3.10.4) Updates `com.github.spotbugs:spotbugs-annotations` from 4.10.4 to 4.10.5 - [Release notes](https://github.com/spotbugs/spotbugs/releases) - [Changelog](https://github.com/spotbugs/spotbugs/blob/master/CHANGELOG.md) - [Commits](spotbugs/spotbugs@4.10.4...4.10.5) Updates `ch.qos.logback:logback-classic` from 1.6.3 to 1.6.6 - [Release notes](https://github.com/qos-ch/logback/releases) - [Commits](qos-ch/logback@v_1.6.3...v_1.6.6) Updates `software.amazon.awssdk:s3` from 2.54.13 to 2.57.4 Updates `software.amazon.awssdk.crt:aws-crt` from 0.48.4 to 0.49.0 - [Release notes](https://github.com/awslabs/aws-crt-java/releases) - [Commits](awslabs/aws-crt-java@v0.48.4...v0.49.0) Updates `com.azure:azure-storage-blob` from 12.35.1 to 12.36.0 - [Release notes](https://github.com/Azure/azure-sdk-for-java/releases) - [Commits](Azure/azure-sdk-for-java@com.azure+azure-storage-blob_12.35.1...com.azure+azure-storage-blob_12.36.0) Updates `com.google.cloud:google-cloud-storage` from 2.73.0 to 2.75.0 - [Release notes](https://github.com/googleapis/google-cloud-java/releases) - [Changelog](https://github.com/googleapis/google-cloud-java/blob/main/java-document-ai/CHANGELOG.md) - [Commits](https://github.com/googleapis/google-cloud-java/commits/gapic-generator-java/v2.75.0) Updates `org.springframework.boot:spring-boot-dependencies` from 4.1.1 to 4.1.2 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](spring-projects/spring-boot@v4.1.1...v4.1.2) Updates `org.wiremock.integrations:wiremock-spring-boot` from 4.2.3 to 4.4.3 - [Release notes](https://github.com/wiremock/wiremock-spring-boot/releases) - [Commits](wiremock/wiremock-spring-boot@4.2.3...4.4.3) Updates `org.codehaus.mojo:exec-maven-plugin` from 3.6.3 to 3.6.4 - [Release notes](https://github.com/mojohaus/exec-maven-plugin/releases) - [Commits](mojohaus/exec-maven-plugin@3.6.3...3.6.4) --- updated-dependencies: - dependency-name: com.sap.cds:cds-services-bom dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: com.sap.cds:cds-maven-plugin dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: io.netty:netty-bom dependency-version: 4.2.19.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: com.sap.cloud.sdk:sdk-bom dependency-version: 5.35.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: org.mockito:mockito-bom dependency-version: 5.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: org.sonatype.central:central-publishing-maven-plugin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: org.apache.maven.plugins:maven-deploy-plugin dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: org.apache.maven.plugins:maven-surefire-plugin dependency-version: 3.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: org.apache.maven.plugins:maven-failsafe-plugin dependency-version: 3.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: org.apache.maven.plugins:maven-enforcer-plugin dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: org.jacoco:jacoco-maven-plugin dependency-version: 0.8.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: com.github.spotbugs:spotbugs-maven-plugin dependency-version: 4.10.5.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: com.sap.cds:cds-maven-plugin dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: com.diffplug.spotless:spotless-maven-plugin dependency-version: 3.10.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: com.github.spotbugs:spotbugs-annotations dependency-version: 4.10.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: ch.qos.logback:logback-classic dependency-version: 1.6.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: software.amazon.awssdk:s3 dependency-version: 2.57.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: software.amazon.awssdk.crt:aws-crt dependency-version: 0.49.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: com.azure:azure-storage-blob dependency-version: 12.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: com.google.cloud:google-cloud-storage dependency-version: 2.75.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: org.springframework.boot:spring-boot-dependencies dependency-version: 4.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: org.wiremock.integrations:wiremock-spring-boot dependency-version: 4.4.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: org.codehaus.mojo:exec-maven-plugin dependency-version: 3.6.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Nov 3, 2026

dependabot Bot requested a review from a team as a code owner November 3, 2026 15:55

Navigation Menu

Repository navigation

Bump the minor-patch group across 1 directory with 22 updates - #913

Bump the minor-patch group across 1 directory with 22 updates#913
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/minor-patch-0083835058

dependabot Bot commented on behalf of github Nov 3, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 3, 2026

netty-4.2.19.Final

Security

What's Changed

Release 5.35.0

What's Changed

v5.24.0

5.24.0

release-0.12.0

What's Changed

0.11.1

3.2.0

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

🔧 Build

📦 Dependency updates

3.6.1

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

🔧 Build

3.6.1

🚀 New features and improvements

🐛 Bug Fixes

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants