Bump the dev-dependencies group with 3 updates

[dependabot]

Bumps the dev-dependencies group with 3 updates: com.codeheadsystems:hofmann-dropwizard, org.junit.jupiter:junit-jupiter and gradle-wrapper.

Updates com.codeheadsystems:hofmann-dropwizard from 2.0.0 to 2.1.0

Release notes

Sourced from com.codeheadsystems:hofmann-dropwizard's releases.

Release 2.1.0

Hofmann Elimination 2.1.0

Maven Central

Sample dependency for Maven:

<dependency>
  <groupId>com.codeheadsystems</groupId>
  <artifactId>hofmann-rfc</artifactId>
  <version>2.1.0</version>
</dependency>

implementation("com.codeheadsystems:hofmann-rfc:2.1.0")

Modules Published

• com.codeheadsystems:hofmann-rfc:2.1.0
• com.codeheadsystems:hofmann-server:2.1.0
• com.codeheadsystems:hofmann-client:2.1.0
• com.codeheadsystems:hofmann-dropwizard:2.1.0
• com.codeheadsystems:hofmann-springboot:2.1.0

What's Changed

See commits since last release for details.

Note: Artifacts may take up to 2 hours to appear in Maven Central after release.

What's Changed

• Bump the dev-dependencies group with 6 updates by @​dependabot[bot] in codeheadsystems/hofmann-elimination#48
• Bump the dev-dependencies group in /hofmann-typescript with 3 updates by @​dependabot[bot] in codeheadsystems/hofmann-elimination#49
• Bump the dev-dependencies group with 2 updates by @​dependabot[bot] in codeheadsystems/hofmann-elimination#50
• Bump @​types/node from 25.9.1 to 25.9.2 in /hofmann-typescript in the dev-dependencies group by @​dependabot[bot] in codeheadsystems/hofmann-elimination#51
• Bump the dev-dependencies group with 2 updates by @​dependabot[bot] in codeheadsystems/hofmann-elimination#52
• Bump the dev-dependencies group with 5 updates by @​dependabot[bot] in codeheadsystems/hofmann-elimination#53
• Bump @​types/node from 25.9.2 to 25.9.3 in /hofmann-typescript in the dev-dependencies group by @​dependabot[bot] in codeheadsystems/hofmann-elimination#54
• Bump vitest from 4.1.8 to 4.1.9 in /hofmann-typescript in the dev-dependencies group by @​dependabot[bot] in codeheadsystems/hofmann-elimination#55
• Bump zeroize from 1.8.2 to 1.9.0 in /hofmann-rust in the dev-dependencies group by @​dependabot[bot] in codeheadsystems/hofmann-elimination#56
• Bump @​types/node from 25.9.3 to 26.0.0 in /hofmann-typescript in the dev-dependencies group by @​dependabot[bot] in codeheadsystems/hofmann-elimination#57
• Bump gradle-wrapper from 9.5.1 to 9.6.0 in the dev-dependencies group by @​dependabot[bot] in codeheadsystems/hofmann-elimination#58
• Bump com.gradleup.nmcp.settings from 1.5.0 to 1.6.0 in the dev-dependencies group by @​dependabot[bot] in codeheadsystems/hofmann-elimination#59
• Bump the dev-dependencies group in /hofmann-typescript with 2 updates by @​dependabot[bot] in codeheadsystems/hofmann-elimination#60
• Bump @​types/node from 26.0.0 to 26.0.1 in /hofmann-typescript in the dev-dependencies group by @​dependabot[bot] in codeheadsystems/hofmann-elimination#61
• Renormalize gradlew.bat line endings by @​wolpert in codeheadsystems/hofmann-elimination#62
• Fix review issues 1–7: interop, DoS hardening, and test coverage by @​wolpert in codeheadsystems/hofmann-elimination#63
• Harden OPRF rate-limit IP extraction and Spring body-size bound by @​wolpert in codeheadsystems/hofmann-elimination#64

... (truncated)

Changelog

Sourced from com.codeheadsystems:hofmann-dropwizard's changelog.

[2.1.0] - 2026-06-28

Backward-compatible hardening and bug-fix release; no breaking API changes to the Java artifacts. Rust note: the hofmann-rfc crate's Argon2id KSF salt is corrected from 32 to 16 bytes to match the Java and TypeScript implementations and RFC 9807. A Rust 2.0.0 server using Argon2id derived a different randomized_pwd, so credentials registered against a Rust 2.0.0 server with Argon2id must be re-registered after upgrading — and cross-implementation (Java/TypeScript ↔ Rust) OPAQUE interop with Argon2id now works.

Security

OPRF endpoint rate limiting (hofmann-server, hofmann-springboot, hofmann-dropwizard)

• Spoofable X-Forwarded-For rate-limit bypass — the unauthenticated OPRF endpoint keyed its rate limiter on the attacker-controlled left-most X-Forwarded-For value (and the Dropwizard adapter collapsed every client to the literal "unknown" when the header was absent). An attacker could rotate the header per request to mint unlimited buckets, or trigger a single shared-bucket self-DoS. The client IP is now taken from the real socket peer by default; X-Forwarded-For is honoured only when the new opt-in trustForwardedHeaders / hofmann.trust-forwarded-headers is enabled, and in that mode the right-most (proxy-appended) entry is used so an appending proxy cannot be tricked into trusting a spoofed value.
• Unthrottled recoveryVerify — account-recovery challenge verification consumed no rate-limit token yet ran an unconditional 250 ms latency floor on the request thread, enabling online challenge-code brute-forcing and a thread-exhaustion DoS. Every attempt is now throttled by the per-credential recovery rate limiter (default capacity raised 3 → 6 to fit a full legitimate recovery plus retry headroom), and a throttled attempt returns HTTP 429.
• Unbounded request bodies (memory-amplification DoS) — request-body size is now enforced regardless of framing. The Dropwizard adapter bounds the entity stream (its previous Content-Length check was bypassable via chunked transfer encoding), and the Spring Boot adapter gained a BodySizeLimitFilter (it previously had no body-size limit at all) covering both getInputStream() and getReader(). The OPAQUE/OPRF wire DTOs additionally cap each encoded field length.

Fixed

• Rust Argon2id salt length (hofmann-rfc) — corrected from 32 to 16 bytes to match the Java/TypeScript implementations and RFC 9807, fixing cross-implementation OPAQUE interop when Argon2id is enabled (see the release note above).
• InMemorySessionStore memory leak (hofmann-server) — the credential → JTI reverse index is now kept in sync when sessions expire lazily, instead of accumulating stale entries unbounded.
• InMemoryPendingSessionStore startup crash on short TTLs (hofmann-server) — the reaper period is now guarded so a TTL of 1–3 seconds no longer throws IllegalArgumentException at construction.

Changed

• Dependencies — Dropwizard 5.0.1 → 5.0.2, Spring Boot 4.0.6 → 4.1.0, Jackson 2.21.4 → 2.22.0, tools-jackson 3.1.3 → 3.2.0, Gradle wrapper 9.5.1 → 9.6.0; added jakarta.servlet-api (6.1.0, compileOnly) for socket-peer access in the OPRF resource.

... (truncated)

Commits

• d159efa Prepare v2.1.0 release (#65)
• ba32fe9 Harden OPRF rate-limit IP extraction and Spring body-size bound (#64)
• 226a416 Fix review issues 1–7: interop, DoS hardening, and test coverage (#63)
• 8411e1b Renormalize gradlew.bat line endings (#62)
• cd12eaa Bump @​types/node in /hofmann-typescript in the dev-dependencies group (#61)
• 6145c99 Bump the dev-dependencies group in /hofmann-typescript with 2 updates (#60)
• e66f84b Bump com.gradleup.nmcp.settings in the dev-dependencies group (#59)
• d47ea45 Bump gradle-wrapper from 9.5.1 to 9.6.0 in the dev-dependencies group (#58)
• 49054bf Bump @​types/node in /hofmann-typescript in the dev-dependencies group (#57)
• 1eb3c19 Bump zeroize in /hofmann-rust in the dev-dependencies group (#56)
• Additional commits viewable in compare view

Updates org.junit.jupiter:junit-jupiter from 6.1.0 to 6.1.1

Release notes

Sourced from org.junit.jupiter:junit-jupiter's releases.

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

Commits

• 0d85889 Release 6.1.1
• 0363eee Finalize 6.1.1 release notes
• a6d540a Move entry to 6.1.1 release notes
• 69339d5 Only pass timeout when publishing to avoid failure in nmcp plugin
• dec2eb9 Allow excluding engines from memory cleanup mode (#5786)
• a5f4270 Publish sha256/sha512 checksums again but filter out signature ones (#5796)
• 8213012 Update plugin nmcp-settings to v1.6.0 (#5787)
• d1bf847 Generate Javadoc for aggregator modules
• d721de5 Pass --no-fonts to javadoc convention
• d289ec6 Restore original SetSystemProperty values in a ParameterizedTest (#5720)
• Additional commits viewable in compare view

Updates gradle-wrapper from 9.6.0 to 9.6.1

Release notes

Sourced from gradle-wrapper's releases.

9.6.1

The Gradle team is excited to announce Gradle 9.6.1.

Here are the highlights of this release:

• Improved Configuration Cache hit rates
• Additional CLI rendering options
• Important project hierarchy lookup deprecations

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aharnish Solanki, Benedikt Johannes, Devendra Reddy Pennabadi, Dmytro Rodionov, Dreeam, Elías Hernández Rodríguez, Eng Zer Jun, FinlayRJW, Kamal Kansal, Marcono1234, Nelson Osacky, Philip Wedemann, Ravi, Roberto Perez Alcolea, Ryan Schmitt, Sebastian Schuberth, seunghun.ham, sk-reddy17, Suvrat Acharya, Vedant Madane.

Upgrade instructions

Switch your build to use Gradle 9.6.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.6.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

Commits

• 309d128 Update fixed issues in release notes for 9.6.1 (#38328)
• 040a978 Update fixed issues in release notes for 9.6.1
• e0b8325 Restore --non-interactive flag instead of --interactive/--no-interactive (#38...
• 946f3e6 Limit explicit temp file permission setting to intended use case (#38300)
• 65f8224 Restore --non-interactive flag instead of --interactive/--no-interactive
• e346a5e Adjust CLI flag to configure non-interactive console (#38301)
• 9b53be9 Adjust CLI flag to configure non-interactive console
• 0dd3b53 Limit explicit temp file permission setting to intended use case
• 48e5ac2 Add reproducers
• 25598fd Prepare 9.6.1 patch release (#38293)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions