Bump the all group with 5 updates

[dependabot]

Bumps the all group with 5 updates:

Package	From	To
org.http4k:http4k-server-netty	6.57.2.0	6.58.0.0
gradle-wrapper	9.7.0	9.7.1
ch.qos.logback:logback-classic	1.6.2	1.6.3
io.micrometer:micrometer-registry-prometheus	1.17.0	1.17.1
org.mongodb:mongodb-driver-kotlin-coroutine	5.9.2	5.10.0

Updates org.http4k:http4k-server-netty from 6.57.2.0 to 6.58.0.0

Release notes

Sourced from org.http4k:http4k-server-netty's releases.

6.58.0.0

Distribution notice - from 1 October 2026, Maven Central receives http4k releases approximately quarterly. maven.http4k.org continues on the normal 1-2 week cadence. Both channels are supported. Background and current status: DISTRIBUTION.md

Changelog:

• http4k-*: Upgrade versions, including Swagger UI upgrade (path change)
• http4k-serverless-tencent: [Possible break] Removed the dependency on com.tencentcloudapi:scf-java-events, which has been abandoned since its last release in June 2021 and has no replacement artifact. Vendored dependent classes. The module has no third-party runtime dependencies at all.
• http4k-format-fory: [New module!] Support for Apache Fory binary serializationn.
• http4k-connect-amazon-dynamodb-fake: [Fix] REMOVE #a, #b now parses. Targets could previously only be separated by whitespace, so an update removing two attributes failed.
• http4k-connect-amazon-route53-fake - Escape wildcard characters in record name. H/T @​youdie006

Changelog

Sourced from org.http4k:http4k-server-netty's changelog.

v6.58.0.0

• http4k-*: Upgrade versions, including Swagger UI upgrade (path change)
• http4k-serverless-tencent: [Possible break] Removed the dependency on com.tencentcloudapi:scf-java-events, which has been abandoned since its last release in June 2021 and has no replacement artifact. Vendored dependent classes. The module has no third-party runtime dependencies at all.
• http4k-format-fory: [New module!] Support for Apache Fory binary serializationn.
• http4k-connect-amazon-dynamodb-fake: [Fix] REMOVE #a, #b now parses. Targets could previously only be separated by whitespace, so an update removing two attributes failed.
• http4k-connect-amazon-route53-fake - Escape wildcard characters in record name. H/T @​youdie006

Commits

• 219d89d Release 6.58.0.0
• d5d38db Tweak to kafka serialisation
• 7bc4d21 Upgrade various libs
• b978d1d CHANGELOG
• c6632ea FakeRoute53: escape wildcard characters in record names (#1479) (#1604)
• b153565 Accept comma-separated targets in the FakeDynamoDb REMOVE clause (#1606)
• f0854c6 Upgrade versions
• 9540cac update dependabot
• 3442f8f Reformat fory files
• 368582b add license version to license report
• Additional commits viewable in compare view

Updates gradle-wrapper from 9.7.0 to 9.7.1

Release notes

Sourced from gradle-wrapper's releases.

9.7.1

The Gradle team is excited to announce Gradle 9.7.1.

This is a patch release for 9.7.0. We recommend using 9.7.1 instead of 9.7.0.

Here are the highlights of 9.7.0 release:

• Isolated Projects graduates to incubating
• Broader Configuration Cache compatibility
• Resilient Sync helps you fix broken builds
• More source locations in problem reports

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Adam, Aman Gautam, Aman Kumar, Anton Dubrouski, Aurimas, gbhavya07, Josh Friend, nicklauslittle-gov, Pragati, project516, Qin Mi, Ravi, sk-reddy17, Suvrat Acharya, Yongshun Ye.

Upgrade instructions

Switch your build to use Gradle 9.7.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.7.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

Commits

• 92f0512 update fixed issues for 9.7.1 (#38892)
• 820ee75 update fixed issues for 9.7.1
• 82c23f9 Fix annotation parameter ordering problem in KTS (#38878)
• ef11a72 Fix annotation parameter ordering issue
• bb0d8a9 Make relevant tests polyglot (run for multiple DSLs)
• 336e129 Update signing configuration (#38874)
• 4bdf0da Update signing configuration
• cd9b92c List issues resolved in 9.7.1 (#38839)
• 5f4e381 List issues resolved in 9.7.1
• 1e08ab5 Keep type-use annotations in extracted ABI classes (#38810)
• Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.6.2 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

• In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

• Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

• The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

• ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

• Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

• The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

-- Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

Commits

• e8e824d prepare release 1.6.3
• 761821b MDCBasedDiscriminator has a gated warning mechanism
• 53ed122 update copyright year
• c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
• b5aa931 added BatchedSimpleInvocationGate
• 1f22af7 add javadocs to SimpleInvocationGate
• 638ffa7 prevent forward and backward slashes to escape to other directories
• 7d6b9a4 add missing ch.qos.logback.core.property package
• fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
• c73b43f deprecate the withJansi path
• Additional commits viewable in compare view

Updates io.micrometer:micrometer-registry-prometheus from 1.17.0 to 1.17.1

Commits

• See full diff in compare view

Updates org.mongodb:mongodb-driver-kotlin-coroutine from 5.9.2 to 5.10.0

Release notes

Sourced from org.mongodb:mongodb-driver-kotlin-coroutine's releases.

Java Driver 5.10.0 (August 14, 2026)

What's Changed

• Added $scoreFusion hybrid search stage for combining and normalizing the scores of multiple search pipelines (MongoDB 8.2+) #2024 by @​nhachicha
• Added a fluent builder API for the $score aggregation stage, with normalization, weighting, and score details (MongoDB 8.2+) #2023 by @​strogiyotec
• Added $vectorSearch support for nested embeddings and arrays of embeddings via parentFilter and nestedOptions #2026 by @​rozza
• Removed stale @Beta from SearchOptions and VectorSearchOptions in the Java and Scala drivers #2026 by @​rozza
• Encoded Kotlin ByteArray data class fields as BSON Binary, and added an opt-in ByteArray BSON Binary serializer for bson-kotlinx #2019 by @​rozza
• Included the fix for CVE-2026-18710 / JAVA-6266, where ProxySettings.toString() rendered the SOCKS5 proxy username and password into application logs. First shipped in 5.9.2 #2035 by @​strogiyotec
• ByteArray fields in Kotlin data classes are once again encoded as BSON Binary rather than a BSON array of int32, restoring the behavior from before 5.1.3. Decoding accepts both forms, so documents written by 5.1.3–5.9.x still read back correctly, but newly written documents change BSON type. Review any non-driver consumers of those fields before upgrading. See JAVA-6224

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/drivers/java/sync/current/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Full Changelog: mongodb/mongo-java-driver@r5.9.0...r5.10.0

Commits

• 6acf4b6 Version: bump 5.10.0
• 09aa019 Merge commit from fork (#2035)
• d751950 Evergreen CI windows fixes
• 533b2b6 Ensure Kotlin can encode ByteArrays efficiently (#2019)
• 94863fa Support $vectorSearch against nested embeddings and arrays of embeddings (#2026)
• 1b958ae JAVA-5990 Hybrid Search Score Fusion (#2024)
• dd814f8 JAVA-6146 Move detail out of the root AGENTS.md into references
• d87d93a Fluent API for $score (#2023)
• 0956b9f Resolve forwarded type arguments across POJO hierarchy edges (#2014)
• cab37d0 Improve readability of NettyStreamCloseFutureListenerTest
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions