Skip to content

Bump the maven group across 2 directories with 18 updates - #3

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/maven-da47d101e0
Open

Bump the maven group across 2 directories with 18 updates#3
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/maven-da47d101e0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 2, 2026

Copy link
Copy Markdown

Bumps the maven group with 16 updates in the / directory:

Package From To
com.google.guava:guava 31.1-jre 32.0.0-jre
com.rabbitmq:amqp-client 5.17.0 5.18.0
com.thoughtworks.xstream:xstream 1.4.20 1.4.21
commons-fileupload:commons-fileupload 1.4 1.6.0
commons-io:commons-io 2.8.0 2.14.0
commons-net:commons-net 3.7.2 3.9.0
org.apache.logging.log4j:log4j-core 2.19.0 2.25.3
com.mysql:mysql-connector-j 8.0.33 8.2.0
org.apache.commons:commons-lang3 3.11 3.18.0
org.apache.kafka:kafka-clients 2.7.0 3.9.1
org.apache.tomcat.embed:tomcat-embed-core 10.0.22 10.1.49
org.eclipse.jetty:jetty-server 9.4.51.v20230217 9.4.56.v20240826
org.owasp.esapi:esapi 2.1.0.1 2.6.0.0
org.springframework:spring-context 5.3.26 6.1.20
org.testng:testng 7.1.0 7.5.1
io.minio:minio 8.5.2 8.6.0

Bumps the maven group with 16 updates in the /plugins directory:

Package From To
com.google.guava:guava 31.1-jre 32.0.0-jre
com.rabbitmq:amqp-client 5.17.0 5.18.0
com.thoughtworks.xstream:xstream 1.4.20 1.4.21
commons-fileupload:commons-fileupload 1.4 1.6.0
commons-io:commons-io 2.8.0 2.14.0
commons-net:commons-net 3.7.2 3.9.0
org.apache.logging.log4j:log4j-core 2.19.0 2.25.3
com.mysql:mysql-connector-j 8.0.33 8.2.0
org.apache.commons:commons-lang3 3.11 3.18.0
org.apache.kafka:kafka-clients 2.7.0 3.9.1
org.apache.tomcat.embed:tomcat-embed-core 10.0.22 10.1.49
org.eclipse.jetty:jetty-server 9.4.51.v20230217 9.4.56.v20240826
org.owasp.esapi:esapi 2.1.0.1 2.6.0.0
org.springframework:spring-context 5.3.26 6.1.20
org.testng:testng 7.1.0 7.5.1
io.minio:minio 8.5.2 8.6.0

Updates com.google.guava:guava from 31.1-jre to 32.0.0-jre

Release notes

Sourced from com.google.guava:guava's releases.

32.0.0

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>32.0.0-jre</version>
  <!-- or, for Android: -->
  <version>32.0.0-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

Javadoc

JDiff

Changelog

Security fixes

While CVE-2020-8908 was officially closed when we deprecated Files.createTempDir in Guava 30.0, we've heard from users that even recent versions of Guava have been listed as vulnerable in other databases of security vulnerabilities. In response, we've reimplemented the method (and the very rarely used FileBackedOutputStream class, which had a similar issue) to eliminate the insecure behavior entirely. This change could technically affect users in a number of different ways (discussed under "Incompatible changes" below), but in practice, the only problem users are likely to encounter is with Windows. If you are using those APIs under Windows, you should skip 32.0.0 and go straight to 32.0.1 which fixes the problem. (Unfortunately, we didn't think of the Windows problem until after the release. And while we warn that common.io in particular may not work under Windows, we didn't intend to regress support.) Sorry for the trouble.

Incompatible changes

Although this release bumps Guava's major version number, it makes no binary-incompatible changes to the guava artifact.

One change could cause issues for Widows users, and a few other changes could cause issues for users in more usual situations:

  • The new implementations of Files.createTempDir and FileBackedOutputStream throw an exception under Windows. This is fixed in 32.0.1. Sorry for the trouble.
  • guava-gwt now requires GWT 2.10.0.
  • This release makes a binary-incompatible change to a @Beta API in the separate artifact guava-testlib. Specifically, we changed the return type of TestingExecutors.sameThreadScheduledExecutor to ListeningScheduledExecutorService. The old return type was a package-private class, which caused the Kotlin compiler to produce warnings. (dafaa3e435)

... (truncated)

Commits

Updates com.rabbitmq:amqp-client from 5.17.0 to 5.18.0

Release notes

Sourced from com.rabbitmq:amqp-client's releases.

v5.18.0

Changes between 5.17.0 and 5.18.0

This is a minor release with usability improvements and dependency upgrades. It is compatible with 5.17.x. All users of the 5.x.x series are encouraged to upgrade.

Inbound message size is now enforced, with default limit being 64 MiB.

Thanks to @​JHahnHRO and Sérgio Faria (@​sergio91pt) for their contribution.

Add ability to specify maximum message size

GitHub issue: #1062

Do not confirmSelect more than once per channel

GitHub PR: #1057

Make RpcClient (Auto)Closeable

GitHub issue: #1032

Bump dependencies

GitHub issue: #999

Dependency

Maven

<dependency>
  <groupId>com.rabbitmq</groupId>
  <artifactId>amqp-client</artifactId>
  <version>5.18.0</version>
</dependency>

Gradle

compile 'com.rabbitmq:amqp-client:5.18.0'

v5.17.1

Changes between 5.17.0 and 5.17.1

This is a minor release with a usability improvement. It is compatible with 5.17.0.

Inbound message size is now enforced, with the default limit being 64 MiB.

... (truncated)

Commits
  • dcc284e [maven-release-plugin] prepare release v5.18.0
  • 75d1d1e Set release version to 5.18.0
  • dc7952e Merge pull request #1064 from rabbitmq/dependabot/maven/5.x.x-stable/org.mock...
  • e2fa38f Bump mockito-core from 5.3.1 to 5.4.0
  • 04f1801 Tweak error message
  • 714aae6 Add max inbound message size to ConnectionFactory
  • 83cf551 Fix flaky test
  • 0dc9ea2 Do not confirmSelect more than once per channel
  • 129dc6a Merge pull request #1060 from rabbitmq/dependabot/maven/5.x.x-stable/io.micro...
  • 671efdc Bump micrometer-core from 1.11.0 to 1.11.1
  • Additional commits viewable in compare view

Updates com.thoughtworks.xstream:xstream from 1.4.20 to 1.4.21

Commits

Updates commons-fileupload:commons-fileupload from 1.4 to 1.6.0

Updates commons-io:commons-io from 2.8.0 to 2.14.0

Updates commons-net:commons-net from 3.7.2 to 3.9.0

Updates org.apache.logging.log4j:log4j-core from 2.19.0 to 2.25.3

Updates com.mysql:mysql-connector-j from 8.0.33 to 8.2.0

Changelog

Sourced from com.mysql:mysql-connector-j's changelog.

Changelog

https://dev.mysql.com/doc/relnotes/connector-j/en/

Version 9.6.0

  • Fix for Bug#118002 (Bug#37843004), The setFetchSize() method in the Statement class may have a potential bug.

  • Fix for Bug#113130 (Bug#36043125), getGeneratedKeys() returns a zero resultset with non-key-generating statements.

  • Fix for Bug#113336 (Bug#36080226), Inconsistent getUpdateCount() Behavior with allowMultiQueries.

  • Fix for Bug#118234 (Bug#37975837), A potential bugs in Mysql Connector/J.

  • Fix for Bug#113413 (Bug#36107426), Connection.changeUser cannot be done after DriverManager.loginTimeout elapses. Thanks to Kazuhisa Kawashima for his contribution.

  • Fix for Bug#119271 (Bug#38599496), Connector/J fails to accept legacy value zeroDateTimeBehavior=convertToNull on multi-host URLs (failover).

  • Fix for Bug#119245 (Bug#38599240), Select into fix breaks queries with 'into' in them.

Version 9.5.0

  • Fix for Bug#72036 (Bug#18403804), XA isSameRM() shouldn't take database into account.

  • Fix for Bug#62693 (Bug#16722068), XAConnection savepoint capability.

  • Fix for Bug#81128 (Bug#23146631), Master host list overwritten by slave list when loadBalanceConnectionGroup used.

  • Fix for Bug#19887224, RUNNING THE TEST SUITE WITH SOCKSPROXY* PROPERTIES HANGS IN TEST TESTBUG56429.

  • Fix for Bug#98699 (Bug#30932850), Allow empty keyStore file for keyStoreTypes that do not require files. Thanks to Kolbe Kegel for his contribution.

  • Fix for Bug#118938 (Bug#38396227), DatabaseMetaDataInformationSchema#getSchemas has a bug.

  • Fix for Bug#99292 (Bug#31195955), Contribution: Support Windows time zone 'Coordinated Universal Time'. Thanks to Frédéric Barrière for his contribution.

  • Fix for Bug#107094 (Bug#34104230), NullPointerException when calling equals with null on MultiHostConnectionProxy.

  • Fix for Bug#107543 (Bug#34464351), Cannot execute a SELECT statement that writes to an OUTFILE.

  • Fix for Bug#17881458, BEHAVIOR OF SETBINARYSTREAM() METHOD IS DIFFERENT WHEN USESERVERPREPSTMTS=TRUE.

  • Fix for Bug#45554 (Bug#11754018), Connector/J does not encode binary data if useServerPrepStatements=false.

  • Fix for Bug#114974 (Bug#36614381), the SQL in batch will not clear after statement close. Thanks to Chengyi Dong for his contribution.

  • Fix for Bug#118688 (Bug#38222681), com.mysql.cj.protocol.a.StringValueEncoder#getString does not handle string escaping.

... (truncated)

Commits
  • 06a1f72 Fix for Bug#35811592, Missing implementation for Connection.releaseSavepoint().
  • 9df3820 Update for GPL license book.
  • ff822cf Fix for tests failing due to expecting unsupported TLS versions.
  • 429db00 Fix for test SecureSessionTest.testXdevapiTlsVersionsAndCiphersuites() failur...
  • d52033a Fix for tests failing due to using unsupported cipher suites in MySQL 5.7.
  • e18e626 Fix for tests failing due to using deprecated cipher suites.
  • 4f70ec3 Fix for Bug#91351 (Bug#28225464), MysqlConnectionPoolDataSource - autocommit ...
  • 71e4c6b Fix for property description 'ConnectionProperties.treatMysqlDatetimeAsTimest...
  • bae6356 Fix for property description 'ConnectionProperties.authenticationPlugins'.
  • 5701086 GPL license book update.
  • Additional commits viewable in compare view

Updates org.apache.commons:commons-lang3 from 3.11 to 3.18.0

Updates org.apache.kafka:kafka-clients from 2.7.0 to 3.9.1

Updates org.apache.tomcat.embed:tomcat-embed-core from 10.0.22 to 10.1.49

Updates org.eclipse.jetty:jetty-server from 9.4.51.v20230217 to 9.4.56.v20240826

Updates org.eclipse.jetty:jetty-servlets from 9.4.51.v20230217 to 9.4.56.v20240826

Updates org.owasp.esapi:esapi from 2.1.0.1 to 2.6.0.0

Release notes

Sourced from org.owasp.esapi:esapi's releases.

2.6.0.0

Full Release Notes

Release notes for ESAPI release 2.6.0.0 are located at:

What's Changed

Full Changelog: ESAPI/esapi-java-legacy@esapi-2.5.5.0...esapi-2.6.0.0

Configuration Jar

Note the associated file "esapi-2.6.0.0-configuration.jar" contains the default ESAPI configuration files under 'configuration/' (ESAPI.properties, validation.properties, etc.) and the file "esapi-2.6.0.0-configuration.jar.asc" is a GPG signature of that jar file made by Kevin W. Wall.

2.5.5.0

Full Release Notes

Release notes for ESAPI release 2.5.5.0 are located at:

What's Changed

New Contributors

Full Changelog: ESAPI/esapi-java-legacy@esapi-2.5.4.0...esapi-2.5.5.0

Configuration Jar

Note the associated file "esapi-2.5.5.0-configuration.jar" contains the default ESAPI configuration files under 'configuration/' (ESAPI.properties, validation.properties, etc.) and the file "esapi-2.5.5.0-configuration.jar.asc" is a GPG signature of that jar file made by Kevin W. Wall.

2.5.4.0

Full release notes

Full release notes for ESAPI release 2.5.4.0 are located at:

It contains important details, which you need to read as you MUST remove (or rename) 'esapi-java-logging.properties' if you are using ESAPI's default logging, which is JUL. Otherwise ESAPI will throw a ConfigurationException (which may appear as a java.lang.ExceptionInInitializerError or as a java.lang.NoClassDefFoundError, depending on circumstances). Please refer to the "Configuring the JavaLogFactory" wiki page for additional details.

YOU HAVE BEEN WARNED!!!

... (truncated)

Commits
  • dcde6c2 A few minor documentation fixes.
  • 5a10f77 Revert "Minor change to release steps document."
  • 8b9f8f1 Minor change to release steps document.
  • 4698c43 Bump release to new official release number.
  • f185e5b Preparation for ESAPI release 2.6.0.0 (#860)
  • 0b0f86c Update SECURITY.md
  • 4879a08 Modifying pom.xml for next planned release.
  • 3f2ff05 Fix release date.
  • 19b739a Merge pull request #856 from kwwall/release-prep-2.5.5.0
  • a160de0 Update section on commit / PR history.
  • Additional commits viewable in compare view

Updates org.springframework:spring-context from 5.3.26 to 6.1.20

Release notes

Sourced from org.springframework:spring-context's releases.

v6.1.20

⭐ New Features

  • Add option for case-insensitive match to PatternMatchUtils #34802

🐞 Bug Fixes

  • HttpComponentsClientHttpRequestFactory setConnectionRequestTimeout not working with httpclient 5.3.1 #34854
  • Accidental ClassLoader defineClass enforcement after #34677 #34839

📔 Documentation

  • Clarify CompositePropertySource behavior for EnumerablePropertySource contract #34887

🔨 Dependency Upgrades

  • Upgrade to Reactor 2023.0.18 #34899

v6.1.19

⭐ New Features

  • Suggest compilation with -parameters when AspectJAdviceParameterNameDiscoverer fails against ambiguity #34618

🐞 Bug Fixes

  • PropertyBatchUpdateException: causes of nested PropertyAccessExceptions not shown in output #34698
  • Change in Jar usecache behavior with Spring 6.1.x causing java.lang.IllegalStateException: zip file closed #34694
  • Startup performance regression due to CGLIB class load attempts in Spring 6.1.x #34693
  • IllegalAccessError for package-private member of AzureStorageConfiguration on WebSphere #34690
  • @Configuration classes can no longer be abstract without @Bean methods #34689
  • Generated-code for LinkedHashMap is missing static keyword #34661
  • AbstractReactiveTransactionManager throws IllegalStateException when rollback fails after commit attempt #34619

📔 Documentation

  • Add javadoc notes on potential exception suppression in ListableBeanFactory#getBeansOfType #34631
  • Remove remaining references to Forwarded headers in MvcUriComponentsBuilder #34626
  • MvcUriComponentsBuilder javadocs inaccurately reflects usage of forwarded headers #34620

v6.1.18

⭐ New Features

  • Avoid unnecessary CGLIB processing on configuration classes #34487
  • Inconsistent default class loaders in hint classes #34473

🐞 Bug Fixes

  • DefaultManagedTaskExecutor throws java.lang.UnsupportedOperationException: isShutdown when rejecting tasks #34515
  • Endless loop with DataSourceUtils in spring-jdbc #34497
  • MockHttpServletResponse - handle multiple values for Content-Language header #34491

... (truncated)

Commits
  • 1f9c59b Release v6.1.20
  • edfcc6f Make use of PatternMatchUtils ignoreCase option
  • f93132b Add missing @​since tags in PatternMatchUtils
  • 6ab4c84 Upgrade to Reactor 2023.0.18
  • d5fca0d Upgrade to Jetty 12.0.21, Netty 4.1.121, Apache HttpClient 5.4.4, Checkstyle ...
  • cbb9419 Clarify CompositePropertySource behavior for EnumerablePropertySource contract
  • 5b5e2b6 Fix HttpClient 5.3.x request config compatibility
  • a5b0399 Polishing
  • 71f2725 Try loadClass on LinkageError in case of same ClassLoader as well
  • daee9f1 Reinstate the @⁠Inject Technology Compatibility Kit (TCK)
  • Additional commits viewable in compare view

Updates org.springframework:spring-web from 5.3.26 to 6.1.20

Release notes

Sourced from org.springframework:spring-web's releases.

v6.1.20

⭐ New Features

  • Add option for case-insensitive match to PatternMatchUtils #34802

🐞 Bug Fixes

  • HttpComponentsClientHttpRequestFactory setConnectionRequestTimeout not working with httpclient 5.3.1 #34854
  • Accidental ClassLoader defineClass enforcement after #34677 #34839

📔 Documentation

  • Clarify CompositePropertySource behavior for EnumerablePropertySource contract #34887

🔨 Dependency Upgrades

  • Upgrade to Reactor 2023.0.18 #34899

v6.1.19

⭐ New Features

  • Suggest compilation with -parameters when AspectJAdviceParameterNameDiscoverer fails against ambiguity #34618

🐞 Bug Fixes

  • PropertyBatchUpdateException: causes of nested PropertyAccessExceptions not shown in output #34698
  • Change in Jar usecache behavior with Spring 6.1.x causing java.lang.IllegalStateException: zip file closed #34694
  • Startup performance regression due to CGLIB class load attempts in Spring 6.1.x #34693
  • IllegalAccessError for package-private member of AzureStorageConfiguration on WebSphere #34690
  • @Configuration classes can no longer be abstract without @Bean methods #34689
  • Generated-code for LinkedHashMap is missing static keyword #34661
  • AbstractReactiveTransactionManager throws IllegalStateException when rollback fails after commit attempt #34619

📔 Documentation

  • Add javadoc notes on potential exception suppression in ListableBeanFactory#getBeansOfType #34631
  • Remove remaining references to Forwarded headers in MvcUriComponentsBuilder #34626
  • MvcUriComponentsBuilder javadocs inaccurately reflects usage of forwarded headers #34620

v6.1.18

⭐ New Features

  • Avoid unnecessary CGLIB processing on configuration classes #34487
  • Inconsistent default class loaders in hint classes #34473

🐞 Bug Fixes

  • DefaultManagedTaskExecutor throws java.lang.UnsupportedOperationException: isShutdown when rejecting tasks #34515
  • Endless loop with DataSourceUtils in spring-jdbc #34497
  • MockHttpServletResponse - handle multiple values for Content-Language header #34491

... (truncated)

Commits
  • 1f9c59b Release v6.1.20
  • edfcc6f Make use of PatternMatchUtils ignoreCase option
  • f93132b Add missing @​since tags in PatternMatchUtils
  • 6ab4c84 Upgrade to Reactor 2023.0.18
  • d5fca0d Upgrade to Jetty 12.0.21, Netty 4.1.121, Apache HttpClient 5.4.4, Checkstyle ...
  • cbb9419 Clarify CompositePropertySource behavior for EnumerablePropertySource contract
  • 5b5e2b6 Fix HttpClient 5.3.x request config compatibility
  • a5b0399 Polishing
  • 71f2725 Try loadClass on LinkageError in case of same ClassLoader as well
  • daee9f1 Reinstate the @⁠Inject Technology Compatibility Kit (TCK)
  • Additional commits viewable in compare view

Updates org.testng:testng from 7.1.0 to 7.5.1

Release notes

Sourced from org.testng:testng's releases.

TestNG v7.5.1

What's Changed

New Contributors

Full Changelog: testng-team/testng@7.5...7.5.1

Changelog

Sourced from org.testng:testng's changelog.

Current (7.13.0) Fixed: GITHUB-3120: ITestNGListenerFactory is broken and never invoked (Krishnan Mahadevan)

7.12.0 Fixed: GITHUB-3231: TestNG retry is going into infinite loop when the data provider returned object is modified before failure (Bartek Florczak) Update: Updated GitHub Actions test matrix to include JDK 25 and JDK 26 EA (Bartek Florczak) Fixed: GITHUB-3236: DataProvider parameters are not refreshed on retry when cacheDataForTestRetries=false (Bartek Florczak) Fixed: GITHUB-3227: assertEqualsNoOrder false positive when collection has same size and actual Collection is subset of expected collection (Krishnan Mahadevan) Fixed: GITHUB-3177: Method org.testng.xml.XmlSuite#toXml do not save new properties like "share-thread-pool-for-data-providers" (Krishnan Mahadevan) Fixed: GITHUB-3179: ClassCastException when use shouldUseGlobalThreadPool(true) property (Krishnan Mahadevan) Fixed: GITHUB-2765: Test timeouts using existing Executor now propagate the stack trace to the ThreadTimeoutException (Charlie Hayes)

7.11.0 Fixed: GITHUB-3180: TestNG testng-failed.xml 'invocation-numbers' values are not calculated correctly with retry and dataproviders (Krishnan Mahadevan) Fixed: GITHUB-3170: Specifying dataProvider and successPercentage causes test to always pass (Krishnan Mahadevan) Fixed: GITHUB-3028: Execution stalls when using "use-global-thread-pool" (Krishnan Mahadevan) Fixed: GITHUB-3122: Update JCommander to 1.83 (Antoine Dessaigne) Fixed: GITHUB-3135: assertEquals on arrays - Failure message is missing information about the array index when an array element is unexpectedly null or non-null (Albert Choi) Fixed: GITHUB-3140: assertEqualsDeep on Sets - Deep comparison was using the wrong expected value Fixed: GITHUB-3189: Incorrect number of ignored tests displayed in the XML results Fixed: GITHUB-3196: support to execlude somes tests in option of command line

7.10.2 Fixed: GITHUB-3117: ListenerComparator doesn't work (Krishnan Mahadevan)

7.10.1 Fixed: GITHUB-3110: Update from testng 7.9.0 to 7.10.0 break maven build with junit5 (Krishnan Mahadevan)

7.10.0 Fixed: GITHUB-3000: Method predecessors lookup and/or method sorting is broken in certain inheritance and naming setups (Krishnan Mahadevan) Fixed: GITHUB-3095: Super class annotated with ITestNGListenerFactory makes derived test class throw TestNGException on execution (Krishnan Mahadevan) Fixed: GITHUB-3081: Discrepancy with combination of (Shared Thread pool and Method Interceptor) (Krishnan Mahadevan) Fixed: GITHUB-2381: Controlling the inclusion of the listener at runtime (Krishnan Mahadevan) Fixed: GITHUB-3082: IInvokedMethodListener Iinvoked method does not return correct instance during @​BeforeMethod, @​AfterMethod and @​AfterClass (Krishnan Mahadevan) Fixed: GITHUB-3084: Document project's PGP artifact signing keys (Krishnan Mahadevan) Fixed: GITHUB-3079: Associate a unique id with every test class object instantiated by TestNG (Krishnan Mahadevan) Fixed: GITHUB-3040: replace the usages of synchronized with ReentrantLock (Krishnan Mahadevan) Fixed: GITHUB-3041: TestNG 7.x DataProvider works in opposite to TestNG 6.x when retrying tests. (Krishnan Mahadevan) Fixed: GITHUB-3066: How to dynamically adjust the number of TestNG threads after IExecutorFactory is deprecated? (Krishnan Mahadevan) New: GITHUB-2874: Allow users to define ordering for TestNG listeners (Krishnan Mahadevan) Fixed: GITHUB-3033: Moved ant support under own repository https://github.com/testng-team/testng-ant (Julien Herr) Fixed: GITHUB-3064: TestResult lost if failure creating RetryAnalyzer (Krishnan Mahadevan) Fixed: GITHUB-3048: ConcurrentModificationException when injecting values (Krishnan Mahadevan) Fixed: GITHUB-3050: Race condition when creating Guice Modules (Krishnan Mahadevan) Fixed: GITHUB-3059: Support the ability to inject custom listener factory (Krishnan Mahadevan) Fixed: GITHUB-3045: IDataProviderListener - beforeDataProviderExecution and afterDataProviderExecution are called twice in special setup (Krishnan Mahadevan) Fixed: GITHUB-3038: java.lang.IllegalStateException: Results per method should NOT have been empty (Krishnan Mahadevan) Fixed: GITHUB-3022: Remove deprecated JUnit related support in TestNG (Krishnan Mahadevan)

7.9.0

... (truncated)

Commits

Updates io.minio:minio from 8.5.2 to 8.6.0

Release notes

Sourced from io.minio:minio's releases.

Bugfix release 8.6.0

What's Changed

New Contributors

Full Changelog: minio/minio-java@8.5.17...8.6.0

Bugfix Release

What's Changed

Full Changelog: minio/minio-java@8.5.16...8.5.17

Bugfix Release

What's Changed

New Contributors

Full Changelog: minio/minio-java@8.5.15...8.5.16

Bugfix Release

What's Changed

Full Changelog: minio/minio-java@8.5.14...8.5.15

Bugfix Release

What's Changed

... (truncated)

Commits

Updates com.google.guava:guava from 31.1-jre to 32.0.0-jre

Release notes

Sourced from com.google.guava:guava's releases.

32.0.0

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>32.0.0-jre</version>
  <!-- or, for Android: -->
  <version>32.0.0-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

Javadoc

JDiff

Changelog

Security fixes

While CVE-2020-8908 was officially closed when we deprecated Files.createTempDir in Guava 30.0, we've heard from users that even recent versions of Guava have been listed as vulnerable in other databases of security vulnerabilities. In response, we've reimplemented the method (and the very rarely used FileBackedOutputStream class, which had a similar issue) to eliminate the insecure behavior entirely. This change could technically affect users in a number of different ways (discussed under "Incompatible changes" below), but in practice, the only problem users are likely to encounter is with Windows. If you are using those APIs under Windows, you should skip 32.0.0 and go straight to 32.0.1 which fixes the problem. (Unfortunately, we didn't think of the Windows problem until after the release. And while we warn that common.io in particular may not work under Windows, we didn't intend to regress support.) Sorry for the trouble.

Incompatible changes

Although this release bumps Guava's major version number, it makes no binary-incompatible changes to the guava artifact.

One change could cause issues for Widows users, and a few other changes could cause issues for users in more usual situations:

  • The new implementations of Files.createTempDir and FileBackedOutputStream throw an exception under Windows. This is fixed in 32.0.1. Sorry for the trouble.
  • guava-gwt now requires GWT 2.10.0.
  • This release makes a binary-incompatible change to a @Beta API in the separate artifact guava-testlib. Specifically, we changed the return type of TestingExecutors.sameThreadScheduledExecutor to ListeningScheduledExecutorService. The old return type was a package-private class, which caused the Kotlin compiler to produce warnings. (dafaa3e435)

... (truncated)

Commits

Updates com.rabbitmq:amqp-client from 5.17.0 to 5.18.0

Release notes

Sourced from com.rabbitmq:amqp-client's releases.

v5.18.0

Changes between 5.17.0 and 5.18.0

This is a minor release with usability improvements and dependency upgrades. It is compatible with 5.17.x. All users of the 5.x.x series are encouraged to upgrade.

Inbound message size is now enforced, with default limit being 64 MiB.

Thanks to @​JHahnHRO and Sérgio Faria (@​sergio91pt) for their contribution.

Add ability to specify maximum message size

GitHub issue: #1062

Do not confirmSelect more than once per channel

GitHub PR: #1057

Make RpcClient (Auto)Closeable

GitHub issue: #1032

Bump dependencies

GitHub issue: #999

Dependency

Maven

<dependency>
  <groupId>com.rabbitmq</groupId>
  <artifactId>amqp-client</artifactId>
  <version>5.18.0</version>
</dependency>

Gradle

compile 'com.rabbitmq:amqp-client:5.18.0'

v5.17.1

Changes between 5.17.0 and 5.17.1

This is a minor release with a usability improvement. It is compatible with 5.17.0.

Inbound message size is now enforced, with the default limit being 64 MiB.

... (truncated)

Commits
  • dcc284e [maven-release-plugin] prepare release v5.18.0
  • 75d1d1e Set release version to 5.18.0
  • dc7952e Merge pull request #1064 from rabbitmq/dependabot/maven/5.x.x-stable/org.mock...
  • e2fa38f Bump mockito-core from 5.3.1 to 5.4.0
  • 04f1801 Tweak error message
  • 714aae6 Add max inbound message size to ConnectionFactory
  • 83cf551 Fix flaky test
  • 0dc9ea2 Do not confirmSelect more than once per channel
  • 129dc6a Merge pull request #1060 from rabbitmq/dependabot/maven/5.x.x-stable/io.micro...
  • 671efdc Bump micrometer-core from 1.11.0 to 1.11.1
  • Additional commits viewable in compare view

Updates com.thoughtworks.xstream:xstream from 1.4.20 to 1.4.21

Commits

Updates commons-fileupload:commons-fileupload from 1.4 to 1.6.0

Updates commons-io:commons-io from 2.8.0 to 2.14.0

Updates commons-net:commons-net from 3.7.2 to 3.9.0

Updates org.apache.logging.log4j:log4j-core from 2.19.0 to 2.25.3

Updates com.mysql:mysql-connector-j from 8.0.33 to 8.2.0

Changelog

Sourced from com.mysql:mysql-connector-j's changelog.

Changelog

https://dev.mysql.com/doc/relnotes/connector-j/en/

Version 9.6.0

  • Fix for Bug#118002 (Bug#37843004), The setFetchSize() method in the Statement class may have a potential bug.

  • Fix for Bug#113130 (Bug#36043125), getGeneratedKeys() returns a zero resultset with non-key-generating statements.

  • Fix for Bug#113336 (Bug#36080226), Inconsistent getUpdateCount() Behavior with allowMultiQueries.

  • Fix for Bug#118234 (Bug#37975837), A potential bugs in Mysql Connector/J.

  • Fix for Bug#113413 (Bug#36107426), Connection.changeUser cannot be done after DriverManager.loginTimeout elapses. Thanks to Kazuhisa Kawashima for his contribution.

  • Fix for Bug#119271 (Bug#38599496), Connector/J fails to accept legacy value zeroDateTimeBehavior=convertToNull on multi-host URLs (failover).

  • Fix for Bug#119245 (Bug#38599240), Select into fix breaks queries with 'into' in them.

Version 9.5.0

  • Fix for Bug#72036 (Bug#18403804), XA isSameRM() shouldn't take database into account.

  • Fix for Bug#62693 (Bug#16722068), XAConnection savepoint capability.

  • Fix for Bug#81128 (Bug#23146631), Master...

    Description has been truncated

@dependabot
Bump the maven group across 2 directories with 18 updates
3162044 
Bumps the maven group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [com.google.guava:guava](https://github.com/google/guava) | `31.1-jre` | `32.0.0-jre` |
| [com.rabbitmq:amqp-client](https://github.com/rabbitmq/rabbitmq-java-client) | `5.17.0` | `5.18.0` |
| [com.thoughtworks.xstream:xstream](https://github.com/x-stream/xstream) | `1.4.20` | `1.4.21` |
| commons-fileupload:commons-fileupload | `1.4` | `1.6.0` |
| commons-io:commons-io | `2.8.0` | `2.14.0` |
| commons-net:commons-net | `3.7.2` | `3.9.0` |
| org.apache.logging.log4j:log4j-core | `2.19.0` | `2.25.3` |
| [com.mysql:mysql-connector-j](https://github.com/mysql/mysql-connector-j) | `8.0.33` | `8.2.0` |
| org.apache.commons:commons-lang3 | `3.11` | `3.18.0` |
| org.apache.kafka:kafka-clients | `2.7.0` | `3.9.1` |
| org.apache.tomcat.embed:tomcat-embed-core | `10.0.22` | `10.1.49` |
| org.eclipse.jetty:jetty-server | `9.4.51.v20230217` | `9.4.56.v20240826` |
| [org.owasp.esapi:esapi](https://github.com/ESAPI/esapi-java-legacy) | `2.1.0.1` | `2.6.0.0` |
| [org.springframework:spring-context](https://github.com/spring-projects/spring-framework) | `5.3.26` | `6.1.20` |
| [org.testng:testng](https://github.com/cbeust/testng) | `7.1.0` | `7.5.1` |
| [io.minio:minio](https://github.com/minio/minio-java) | `8.5.2` | `8.6.0` |

Bumps the maven group with 16 updates in the /plugins directory:

| Package | From | To |
| --- | --- | --- |
| [com.google.guava:guava](https://github.com/google/guava) | `31.1-jre` | `32.0.0-jre` |
| [com.rabbitmq:amqp-client](https://github.com/rabbitmq/rabbitmq-java-client) | `5.17.0` | `5.18.0` |
| [com.thoughtworks.xstream:xstream](https://github.com/x-stream/xstream) | `1.4.20` | `1.4.21` |
| commons-fileupload:commons-fileupload | `1.4` | `1.6.0` |
| commons-io:commons-io | `2.8.0` | `2.14.0` |
| commons-net:commons-net | `3.7.2` | `3.9.0` |
| org.apache.logging.log4j:log4j-core | `2.19.0` | `2.25.3` |
| [com.mysql:mysql-connector-j](https://github.com/mysql/mysql-connector-j) | `8.0.33` | `8.2.0` |
| org.apache.commons:commons-lang3 | `3.11` | `3.18.0` |
| org.apache.kafka:kafka-clients | `2.7.0` | `3.9.1` |
| org.apache.tomcat.embed:tomcat-embed-core | `10.0.22` | `10.1.49` |
| org.eclipse.jetty:jetty-server | `9.4.51.v20230217` | `9.4.56.v20240826` |
| [org.owasp.esapi:esapi](https://github.com/ESAPI/esapi-java-legacy) | `2.1.0.1` | `2.6.0.0` |
| [org.springframework:spring-context](https://github.com/spring-projects/spring-framework) | `5.3.26` | `6.1.20` |
| [org.testng:testng](https://github.com/cbeust/testng) | `7.1.0` | `7.5.1` |
| [io.minio:minio](https://github.com/minio/minio-java) | `8.5.2` | `8.6.0` |



Updates `com.google.guava:guava` from 31.1-jre to 32.0.0-jre
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

Updates `com.rabbitmq:amqp-client` from 5.17.0 to 5.18.0
- [Release notes](https://github.com/rabbitmq/rabbitmq-java-client/releases)
- [Commits](rabbitmq/rabbitmq-java-client@v5.17.0...v5.18.0)

Updates `com.thoughtworks.xstream:xstream` from 1.4.20 to 1.4.21
- [Release notes](https://github.com/x-stream/xstream/releases)
- [Commits](https://github.com/x-stream/xstream/commits)

Updates `commons-fileupload:commons-fileupload` from 1.4 to 1.6.0

Updates `commons-io:commons-io` from 2.8.0 to 2.14.0

Updates `commons-net:commons-net` from 3.7.2 to 3.9.0

Updates `org.apache.logging.log4j:log4j-core` from 2.19.0 to 2.25.3

Updates `com.mysql:mysql-connector-j` from 8.0.33 to 8.2.0
- [Changelog](https://github.com/mysql/mysql-connector-j/blob/release/9.x/CHANGES)
- [Commits](mysql/mysql-connector-j@8.0.33...8.2.0)

Updates `org.apache.commons:commons-lang3` from 3.11 to 3.18.0

Updates `org.apache.kafka:kafka-clients` from 2.7.0 to 3.9.1

Updates `org.apache.tomcat.embed:tomcat-embed-core` from 10.0.22 to 10.1.49

Updates `org.eclipse.jetty:jetty-server` from 9.4.51.v20230217 to 9.4.56.v20240826

Updates `org.eclipse.jetty:jetty-servlets` from 9.4.51.v20230217 to 9.4.56.v20240826

Updates `org.owasp.esapi:esapi` from 2.1.0.1 to 2.6.0.0
- [Release notes](https://github.com/ESAPI/esapi-java-legacy/releases)
- [Commits](ESAPI/esapi-java-legacy@esapi-2.1.0.1...esapi-2.6.0.0)

Updates `org.springframework:spring-context` from 5.3.26 to 6.1.20
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v5.3.26...v6.1.20)

Updates `org.springframework:spring-web` from 5.3.26 to 6.1.20
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v5.3.26...v6.1.20)

Updates `org.testng:testng` from 7.1.0 to 7.5.1
- [Release notes](https://github.com/cbeust/testng/releases)
- [Changelog](https://github.com/testng-team/testng/blob/master/CHANGES.txt)
- [Commits](https://github.com/cbeust/testng/commits/7.5.1)

Updates `io.minio:minio` from 8.5.2 to 8.6.0
- [Release notes](https://github.com/minio/minio-java/releases)
- [Commits](minio/minio-java@8.5.2...8.6.0)

Updates `com.google.guava:guava` from 31.1-jre to 32.0.0-jre
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

Updates `com.rabbitmq:amqp-client` from 5.17.0 to 5.18.0
- [Release notes](https://github.com/rabbitmq/rabbitmq-java-client/releases)
- [Commits](rabbitmq/rabbitmq-java-client@v5.17.0...v5.18.0)

Updates `com.thoughtworks.xstream:xstream` from 1.4.20 to 1.4.21
- [Release notes](https://github.com/x-stream/xstream/releases)
- [Commits](https://github.com/x-stream/xstream/commits)

Updates `commons-fileupload:commons-fileupload` from 1.4 to 1.6.0

Updates `commons-io:commons-io` from 2.8.0 to 2.14.0

Updates `commons-net:commons-net` from 3.7.2 to 3.9.0

Updates `org.apache.logging.log4j:log4j-core` from 2.19.0 to 2.25.3

Updates `com.mysql:mysql-connector-j` from 8.0.33 to 8.2.0
- [Changelog](https://github.com/mysql/mysql-connector-j/blob/release/9.x/CHANGES)
- [Commits](mysql/mysql-connector-j@8.0.33...8.2.0)

Updates `org.apache.commons:commons-lang3` from 3.11 to 3.18.0

Updates `org.apache.kafka:kafka-clients` from 2.7.0 to 3.9.1

Updates `org.apache.tomcat.embed:tomcat-embed-core` from 10.0.22 to 10.1.49

Updates `org.eclipse.jetty:jetty-server` from 9.4.51.v20230217 to 9.4.56.v20240826

Updates `org.eclipse.jetty:jetty-servlets` from 9.4.51.v20230217 to 9.4.56.v20240826

Updates `org.owasp.esapi:esapi` from 2.1.0.1 to 2.6.0.0
- [Release notes](https://github.com/ESAPI/esapi-java-legacy/releases)
- [Commits](ESAPI/esapi-java-legacy@esapi-2.1.0.1...esapi-2.6.0.0)

Updates `org.springframework:spring-context` from 5.3.26 to 6.1.20
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v5.3.26...v6.1.20)

Updates `org.springframework:spring-web` from 5.3.26 to 6.1.20
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v5.3.26...v6.1.20)

Updates `org.testng:testng` from 7.1.0 to 7.5.1
- [Release notes](https://github.com/cbeust/testng/releases)
- [Changelog](https://github.com/testng-team/testng/blob/master/CHANGES.txt)
- [Commits](https://github.com/cbeust/testng/commits/7.5.1)

Updates `io.minio:minio` from 8.5.2 to 8.6.0
- [Release notes](https://github.com/minio/minio-java/releases)
- [Commits](minio/minio-java@8.5.2...8.6.0)

---
updated-dependencies:
- dependency-name: com.google.guava:guava
  dependency-version: 32.0.0-jre
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: com.rabbitmq:amqp-client
  dependency-version: 5.18.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: com.thoughtworks.xstream:xstream
  dependency-version: 1.4.21
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: commons-fileupload:commons-fileupload
  dependency-version: 1.6.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: commons-io:commons-io
  dependency-version: 2.14.0
  dependency-type: direct:development
  dependency-group: maven
- dependency-name: commons-net:commons-net
  dependency-version: 3.9.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.logging.log4j:log4j-core
  dependency-version: 2.25.3
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: com.mysql:mysql-connector-j
  dependency-version: 8.2.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.commons:commons-lang3
  dependency-version: 3.18.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.kafka:kafka-clients
  dependency-version: 3.9.1
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.tomcat.embed:tomcat-embed-core
  dependency-version: 10.1.49
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.eclipse.jetty:jetty-server
  dependency-version: 9.4.56.v20240826
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.eclipse.jetty:jetty-servlets
  dependency-version: 9.4.56.v20240826
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.owasp.esapi:esapi
  dependency-version: 2.6.0.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework:spring-context
  dependency-version: 6.1.20
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework:spring-web
  dependency-version: 6.1.20
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.testng:testng
  dependency-version: 7.5.1
  dependency-type: direct:development
  dependency-group: maven
- dependency-name: io.minio:minio
  dependency-version: 8.6.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: com.google.guava:guava
  dependency-version: 32.0.0-jre
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: com.rabbitmq:amqp-client
  dependency-version: 5.18.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: com.thoughtworks.xstream:xstream
  dependency-version: 1.4.21
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: commons-fileupload:commons-fileupload
  dependency-version: 1.6.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: commons-io:commons-io
  dependency-version: 2.14.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: commons-net:commons-net
  dependency-version: 3.9.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.logging.log4j:log4j-core
  dependency-version: 2.25.3
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: com.mysql:mysql-connector-j
  dependency-version: 8.2.0
  dependency-type: direct:development
  dependency-group: maven
- dependency-name: org.apache.commons:commons-lang3
  dependency-version: 3.18.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.kafka:kafka-clients
  dependency-version: 3.9.1
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.tomcat.embed:tomcat-embed-core
  dependency-version: 10.1.49
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.eclipse.jetty:jetty-server
  dependency-version: 9.4.56.v20240826
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.eclipse.jetty:jetty-servlets
  dependency-version: 9.4.56.v20240826
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.owasp.esapi:esapi
  dependency-version: 2.6.0.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework:spring-context
  dependency-version: 6.1.20
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework:spring-web
  dependency-version: 6.1.20
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.testng:testng
  dependency-version: 7.5.1
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: io.minio:minio
  dependency-version: 8.6.0
  dependency-type: direct:production
  dependency-group: maven
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Mar 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants