Skip to content

build(deps): Bump the dev-dependencies group with 18 updates#7

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/gradle/dev-dependencies-e383fbd5ea
May 15, 2026
Merged

build(deps): Bump the dev-dependencies group with 18 updates#7
github-actions[bot] merged 1 commit into
mainfrom
dependabot/gradle/dev-dependencies-e383fbd5ea

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 15, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 18 updates:

Package From To
software.amazon.awssdk:dynamodb 2.44.5 2.44.6
software.amazon.awssdk:dynamodb-enhanced 2.44.5 2.44.6
io.dropwizard:dropwizard-core 4.0.14 5.0.1
io.dropwizard:dropwizard-auth 4.0.14 5.0.1
io.dropwizard:dropwizard-jersey 4.0.14 5.0.1
io.dropwizard:dropwizard-testing 4.0.14 5.0.1
io.dropwizard:dropwizard-assets 4.0.14 5.0.1
com.google.dagger:dagger 2.56.2 2.59.2
com.google.dagger:dagger-compiler 2.56.2 2.59.2
org.springframework.boot:spring-boot-autoconfigure 3.5.5 4.0.6
org.springframework.boot:spring-boot-starter 3.5.5 4.0.6
org.springframework.boot:spring-boot-starter-web 3.5.5 4.0.6
org.springframework.boot:spring-boot-starter-security 3.5.5 4.0.6
org.springframework.boot:spring-boot-starter-test 3.5.5 4.0.6
org.springframework.boot:spring-boot-configuration-processor 3.5.5 4.0.6
org.springframework.security:spring-security-test 6.5.3 7.0.5
com.diffplug.spotless:spotless-plugin-gradle 8.4.0 8.5.0
com.diffplug.spotless 8.4.0 8.5.0

Updates software.amazon.awssdk:dynamodb from 2.44.5 to 2.44.6

Updates software.amazon.awssdk:dynamodb-enhanced from 2.44.5 to 2.44.6

Updates software.amazon.awssdk:dynamodb-enhanced from 2.44.5 to 2.44.6

Updates io.dropwizard:dropwizard-core from 4.0.14 to 5.0.1

Updates io.dropwizard:dropwizard-auth from 4.0.14 to 5.0.1

Updates io.dropwizard:dropwizard-jersey from 4.0.14 to 5.0.1

Updates io.dropwizard:dropwizard-testing from 4.0.14 to 5.0.1

Updates io.dropwizard:dropwizard-assets from 4.0.14 to 5.0.1

Updates io.dropwizard:dropwizard-auth from 4.0.14 to 5.0.1

Updates io.dropwizard:dropwizard-jersey from 4.0.14 to 5.0.1

Updates io.dropwizard:dropwizard-testing from 4.0.14 to 5.0.1

Updates io.dropwizard:dropwizard-assets from 4.0.14 to 5.0.1

Updates com.google.dagger:dagger from 2.56.2 to 2.59.2

Release notes

Sourced from com.google.dagger:dagger's releases.

Dagger 2.59.2

Bug fixes:

  • Fixed #5116,#5099: Replaced Hilt's "android-classes" transform with attribute rules (f7e31b857)
  • Fixed #5122: Fixed issue with slow incremental builds introduced by HiltSyncTask in AGP 9 support (1be57655b)

Dagger 2.59.1

Bug fixes:

  • Fixed #5099: Fixes compilation error with jetifierEnabled=true in AGP 9 (8dcce8790)
  • Fixed #5098: Updated minimum required AGP version to 9.0.0 to make it clearer this is a requirement when using the Hilt Gradle plugin. (141e5941a)

Dagger 2.59

Breaking changes:

(If you do not use Hilt or the Hilt Gradle plugin, this change does not affect you.)

This release adds AGP 9 support for the Hilt Gradle plugin. This means that if you use the Hilt Gradle Plugin, AGP 9 is now a requirement along with AGP 9’s own requirements like Gradle 9.1+ (https://developer.android.com/build/releases/agp-9-0-0-release-notes).

Note: AGP 9 also seems to cause issues with enableJetifier=true (see #5099). This will be fixed in a follow-up release.

Bug fixes/features:

  • Fixed #4944, #4979: Support AGP 9 in HiltGradlePlugin (6afd7ea5a0fb84a38f2d23c990ddbd95e728a39d)

Dagger 2.58

Note: AGP 9 support was held back from this release (google/dagger#5061) because it forces users onto AGP 9. It will be available in the next Dagger release (e92e3f392).

Potential breaking changes:

  • Flipped default for dagger.useBindingGraphFix to enabled (d41e8362b). See https://dagger.dev/dev-guide/compiler-options#useBindingGraphFix. Fix: If this change breaks you it’s likely due to providing a binding in an incorrect module, (e.g. the binding requests an Activity but is installed in the SingletonComponent). The fix is to move the @Provides so that it is installed into the correct component (e.g. the ActivityComponent instead of SingletonComponent). You can also set dagger.useBindingGraphFix=disabled but note that this flag is only temporary and will eventually be removed.
  • The use of abstract var in components is now banned in super types. The reason for this change is that an abstract var property creates both a getter and a setter on the component which is almost always unintentional. Fix: If this change breaks you, use either an abstract val foo: Foo if you need a getter or abstract fun inject(foo: Foo) if you need an inject method. Note that abstract var is already banned if it is declared directly on the @Component class/interface, but this change fixes the check so that it’s banned even if it’s inherited from a super type.

Bug fixes/features:

  • Fixes #1116, #1630, Supported Map<K, Lazy<V>> as a multibinding request type. (7f981a4c3)
  • Fixes #3601. No longer adds a deprecation warning for unused dependencies on setters on the component builder. (1cf9dfc96)
  • Fixes #4982:
    • Added validation to prevent using Java keywords in Dagger-generated code (72e21a828)
    • Added error for binding elements names that are Java keywords. (38071c5ae)
    • Java keyword validation is now performed earlier during the superficial validation stage. (7f6f7bda7)

Dagger 2.57.2

Bug fixes

  • Fixed #4847: Fixed an issue with the Hilt Gradle Plugin registered transforms on projects using Gradle 9.0.0 (ea570e7)
  • Fixes #4898: Fixed an issue with backwards compatibility handling for libraries that export Hilt roots. (85c470ca4)
  • Fixes #4937: Fixed the incorrectly declared version of the Kotlin stdlib dependency in the Hilt Gradle Plugin. (deefd9a2d)
  • Updated ASM dependency to 9.8 (365bc499d)

... (truncated)

Commits
  • 118f2e5 2.59.2 release
  • 1be5765 Change HiltSyncTask to extend DefaultTask instead of Sync.
  • f7e31b8 Replace Hilt's "android-classes" transform with attribute rules.
  • 5909005 Automated Code Change
  • 3507b0d Support nullability in Switching Providers
  • 1900560 Internal changes
  • 8c69595 Update Dagger yml and README with new latest version number.
  • 1dbb1dd Internal refactoring
  • 62b5423 Internal changes
  • 8dcce87 Add AggregatedPackagesTransform for "android-classes" artifact type.
  • Additional commits viewable in compare view

Updates com.google.dagger:dagger-compiler from 2.56.2 to 2.59.2

Release notes

Sourced from com.google.dagger:dagger-compiler's releases.

Dagger 2.59.2

Bug fixes:

  • Fixed #5116,#5099: Replaced Hilt's "android-classes" transform with attribute rules (f7e31b857)
  • Fixed #5122: Fixed issue with slow incremental builds introduced by HiltSyncTask in AGP 9 support (1be57655b)

Dagger 2.59.1

Bug fixes:

  • Fixed #5099: Fixes compilation error with jetifierEnabled=true in AGP 9 (8dcce8790)
  • Fixed #5098: Updated minimum required AGP version to 9.0.0 to make it clearer this is a requirement when using the Hilt Gradle plugin. (141e5941a)

Dagger 2.59

Breaking changes:

(If you do not use Hilt or the Hilt Gradle plugin, this change does not affect you.)

This release adds AGP 9 support for the Hilt Gradle plugin. This means that if you use the Hilt Gradle Plugin, AGP 9 is now a requirement along with AGP 9’s own requirements like Gradle 9.1+ (https://developer.android.com/build/releases/agp-9-0-0-release-notes).

Note: AGP 9 also seems to cause issues with enableJetifier=true (see #5099). This will be fixed in a follow-up release.

Bug fixes/features:

  • Fixed #4944, #4979: Support AGP 9 in HiltGradlePlugin (6afd7ea5a0fb84a38f2d23c990ddbd95e728a39d)

Dagger 2.58

Note: AGP 9 support was held back from this release (google/dagger#5061) because it forces users onto AGP 9. It will be available in the next Dagger release (e92e3f392).

Potential breaking changes:

  • Flipped default for dagger.useBindingGraphFix to enabled (d41e8362b). See https://dagger.dev/dev-guide/compiler-options#useBindingGraphFix. Fix: If this change breaks you it’s likely due to providing a binding in an incorrect module, (e.g. the binding requests an Activity but is installed in the SingletonComponent). The fix is to move the @Provides so that it is installed into the correct component (e.g. the ActivityComponent instead of SingletonComponent). You can also set dagger.useBindingGraphFix=disabled but note that this flag is only temporary and will eventually be removed.
  • The use of abstract var in components is now banned in super types. The reason for this change is that an abstract var property creates both a getter and a setter on the component which is almost always unintentional. Fix: If this change breaks you, use either an abstract val foo: Foo if you need a getter or abstract fun inject(foo: Foo) if you need an inject method. Note that abstract var is already banned if it is declared directly on the @Component class/interface, but this change fixes the check so that it’s banned even if it’s inherited from a super type.

Bug fixes/features:

  • Fixes #1116, #1630, Supported Map<K, Lazy<V>> as a multibinding request type. (7f981a4c3)
  • Fixes #3601. No longer adds a deprecation warning for unused dependencies on setters on the component builder. (1cf9dfc96)
  • Fixes #4982:
    • Added validation to prevent using Java keywords in Dagger-generated code (72e21a828)
    • Added error for binding elements names that are Java keywords. (38071c5ae)
    • Java keyword validation is now performed earlier during the superficial validation stage. (7f6f7bda7)

Dagger 2.57.2

Bug fixes

  • Fixed #4847: Fixed an issue with the Hilt Gradle Plugin registered transforms on projects using Gradle 9.0.0 (ea570e7)
  • Fixes #4898: Fixed an issue with backwards compatibility handling for libraries that export Hilt roots. (85c470ca4)
  • Fixes #4937: Fixed the incorrectly declared version of the Kotlin stdlib dependency in the Hilt Gradle Plugin. (deefd9a2d)
  • Updated ASM dependency to 9.8 (365bc499d)

... (truncated)

Commits
  • 118f2e5 2.59.2 release
  • 1be5765 Change HiltSyncTask to extend DefaultTask instead of Sync.
  • f7e31b8 Replace Hilt's "android-classes" transform with attribute rules.
  • 5909005 Automated Code Change
  • 3507b0d Support nullability in Switching Providers
  • 1900560 Internal changes
  • 8c69595 Update Dagger yml and README with new latest version number.
  • 1dbb1dd Internal refactoring
  • 62b5423 Internal changes
  • 8dcce87 Add AggregatedPackagesTransform for "android-classes" artifact type.
  • Additional commits viewable in compare view

Updates com.google.dagger:dagger-compiler from 2.56.2 to 2.59.2

Release notes

Sourced from com.google.dagger:dagger-compiler's releases.

Dagger 2.59.2

Bug fixes:

  • Fixed #5116,#5099: Replaced Hilt's "android-classes" transform with attribute rules (f7e31b857)
  • Fixed #5122: Fixed issue with slow incremental builds introduced by HiltSyncTask in AGP 9 support (1be57655b)

Dagger 2.59.1

Bug fixes:

  • Fixed #5099: Fixes compilation error with jetifierEnabled=true in AGP 9 (8dcce8790)
  • Fixed #5098: Updated minimum required AGP version to 9.0.0 to make it clearer this is a requirement when using the Hilt Gradle plugin. (141e5941a)

Dagger 2.59

Breaking changes:

(If you do not use Hilt or the Hilt Gradle plugin, this change does not affect you.)

This release adds AGP 9 support for the Hilt Gradle plugin. This means that if you use the Hilt Gradle Plugin, AGP 9 is now a requirement along with AGP 9’s own requirements like Gradle 9.1+ (https://developer.android.com/build/releases/agp-9-0-0-release-notes).

Note: AGP 9 also seems to cause issues with enableJetifier=true (see #5099). This will be fixed in a follow-up release.

Bug fixes/features:

  • Fixed #4944, #4979: Support AGP 9 in HiltGradlePlugin (6afd7ea5a0fb84a38f2d23c990ddbd95e728a39d)

Dagger 2.58

Note: AGP 9 support was held back from this release (google/dagger#5061) because it forces users onto AGP 9. It will be available in the next Dagger release (e92e3f392).

Potential breaking changes:

  • Flipped default for dagger.useBindingGraphFix to enabled (d41e8362b). See https://dagger.dev/dev-guide/compiler-options#useBindingGraphFix. Fix: If this change breaks you it’s likely due to providing a binding in an incorrect module, (e.g. the binding requests an Activity but is installed in the SingletonComponent). The fix is to move the @Provides so that it is installed into the correct component (e.g. the ActivityComponent instead of SingletonComponent). You can also set dagger.useBindingGraphFix=disabled but note that this flag is only temporary and will eventually be removed.
  • The use of abstract var in components is now banned in super types. The reason for this change is that an abstract var property creates both a getter and a setter on the component which is almost always unintentional. Fix: If this change breaks you, use either an abstract val foo: Foo if you need a getter or abstract fun inject(foo: Foo) if you need an inject method. Note that abstract var is already banned if it is declared directly on the @Component class/interface, but this change fixes the check so that it’s banned even if it’s inherited from a super type.

Bug fixes/features:

  • Fixes #1116, #1630, Supported Map<K, Lazy<V>> as a multibinding request type. (7f981a4c3)
  • Fixes #3601. No longer adds a deprecation warning for unused dependencies on setters on the component builder. (1cf9dfc96)
  • Fixes #4982:
    • Added validation to prevent using Java keywords in Dagger-generated code (72e21a828)
    • Added error for binding elements names that are Java keywords. (38071c5ae)
    • Java keyword validation is now performed earlier during the superficial validation stage. (7f6f7bda7)

Dagger 2.57.2

Bug fixes

  • Fixed #4847: Fixed an issue with the Hilt Gradle Plugin registered transforms on projects using Gradle 9.0.0 (ea570e7)
  • Fixes #4898: Fixed an issue with backwards compatibility handling for libraries that export Hilt roots. (85c470ca4)
  • Fixes #4937: Fixed the incorrectly declared version of the Kotlin stdlib dependency in the Hilt Gradle Plugin. (deefd9a2d)
  • Updated ASM dependency to 9.8 (365bc499d)

... (truncated)

Commits
  • 118f2e5 2.59.2 release
  • 1be5765 Change HiltSyncTask to extend DefaultTask instead of Sync.
  • f7e31b8 Replace Hilt's "android-classes" transform with attribute rules.
  • 5909005 Automated Code Change
  • 3507b0d Support nullability in Switching Providers
  • 1900560 Internal changes
  • 8c69595 Update Dagger yml and README with new latest version number.
  • 1dbb1dd Internal refactoring
  • 62b5423 Internal changes
  • 8dcce87 Add AggregatedPackagesTransform for "android-classes" artifact type.
  • Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-autoconfigure from 3.5.5 to 4.0.6

Release notes

Sourced from org.springframework.boot:spring-boot-autoconfigure's releases.

v4.0.6

🐞 Bug Fixes

  • Default security is misconfigured when spring-boot-actuator-autoconfigure is present and spring-boot-health is not #50188
  • Elasticsearch Rest5Client auto-configuration misconfigures underlying HTTP client #50187
  • ApplicationPidFileWriter does not handle symlinks correctly #50185
  • RandomValuePropertySource is not suitable for secrets #50183
  • Cassandra auto-configuration misconfigures CqlSessionBuilder #50180
  • ApplicationTemp does not handle symlinks correctly #50178
  • Remote DevTools performs comparison incorrectly #50176
  • spring.rabbitmq.ssl.verify-hostname is applied inconsistently #50174
  • Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter #50077
  • Classic starters are missing several modules #50071
  • Module spring-boot-resttestclient is missing from spring-boot-starter-test-classic #50069
  • Annotations like @Ssl don't work on @Bean methods when using @ServiceConnection #50064
  • EnversRevisionRepositoriesRegistrar should reuse @EnableEnversRepositories rather than configuring the JPA counterpart #50039
  • WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links #50017
  • Imports on a containing test class are ignored when a nested class has imports #50012
  • With spring.jackson.use-jackson2-defaults set to true, FAIL_ON_UNKNOWN_PROPERTIES is enabled #49951
  • 500 response from env endpoint when supplied pattern is invalid #49946
  • Reactive MongoDB starter has a transitive dependency on the synchronous MongoDB driver #49945
  • HTTP method is lost when configuring excludes in EndpointRequest #49943
  • Honor HttpMethod for reactive additional endpoint paths #49880
  • Docker Compose support doesn't work with apache/artemis image #49869
  • Docker Compose support doesn't work with apache/activemq image #49866
  • Spring Security's PathPatternRequestMatcher.Builder is not auto-configured when using WebMvcTest and spring-boot-security-test #49854
  • API versioning path strategy should be applied path last as it is not meant to yield #49800

📔 Documentation

  • Update docs to encourage Java fundamentals for beginners that prefer to learn that way #50146
  • HTTP Service Interface Clients still document that API versioning can be configured via properties #50126
  • Link to the observability section of the Lettuce documentation is broken #50097
  • Javadoc for StaticResourceLocation.FAVICON doesn't describe icons location #50085
  • MySamlRelyingPartyConfiguration is missing a Kotlin sample #50024
  • Incorrect default value for management.httpexchanges.recording.include in configuration metadata #50019
  • Link to the Kubernetes documentation when discussing startup probes #50015
  • Typo in JdbcSessionAutoConfiguration Javadoc #49873
  • Clarify that configuration property default values are not available through the Environment #49851
  • Document the need for Liquibase and Flyway starters #49839
  • Kafka documentation refers to deprecated JSON serializer and deserializer classes #49826

🔨 Dependency Upgrades

... (truncated)

Commits
  • 8821ad2 Release v4.0.6
  • 9e4048a Merge branch '3.5.x' into 4.0.x
  • 20bb11c Next development version (v3.5.15-SNAPSHOT)
  • 98daa8e Merge branch '3.5.x' into 4.0.x
  • 9dc5aa2 Polish
  • 874f629 Fix default security with actuator but without health
  • e41b3bf Enable hostname verification for SSL connections to Elasticsearch
  • ef8527b Merge branch '3.5.x' into 4.0.x
  • f533a45 Do not follow symlinks when writing PID file
  • 4a7bd33 Merge branch '3.5.x' into 4.0.x
  • Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-starter from 3.5.5 to 4.0.6

Release notes

Sourced from org.springframework.boot:spring-boot-starter's releases.

v4.0.6

🐞 Bug Fixes

  • Default security is misconfigured when spring-boot-actuator-autoconfigure is present and spring-boot-health is not #50188
  • Elasticsearch Rest5Client auto-configuration misconfigures underlying HTTP client #50187
  • ApplicationPidFileWriter does not handle symlinks correctly #50185
  • RandomValuePropertySource is not suitable for secrets #50183
  • Cassandra auto-configuration misconfigures CqlSessionBuilder #50180
  • ApplicationTemp does not handle symlinks correctly #50178
  • Remote DevTools performs comparison incorrectly #50176
  • spring.rabbitmq.ssl.verify-hostname is applied inconsistently #50174
  • Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter #50077
  • Classic starters are missing several modules #50071
  • Module spring-boot-resttestclient is missing from spring-boot-starter-test-classic #50069
  • Annotations like @Ssl don't work on @Bean methods when using @ServiceConnection #50064
  • EnversRevisionRepositoriesRegistrar should reuse @EnableEnversRepositories rather than configuring the JPA counterpart #50039
  • WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links #50017
  • Imports on a containing test class are ignored when a nested class has imports #50012
  • With spring.jackson.use-jackson2-defaults set to true, FAIL_ON_UNKNOWN_PROPERTIES is enabled #49951
  • 500 response from env endpoint when supplied pattern is invalid #49946
  • Reactive MongoDB starter has a transitive dependency on the synchronous MongoDB driver #49945
  • HTTP method is lost when configuring excludes in EndpointRequest #49943
  • Honor HttpMethod for reactive additional endpoint paths #49880
  • Docker Compose support doesn't work with apache/artemis image #49869
  • Docker Compose support doesn't work with apache/activemq image #49866
  • Spring Security's PathPatternRequestMatcher.Builder is not auto-configured when using WebMvcTest and spring-boot-security-test #49854
  • API versioning path strategy should be applied path last as it is not meant to yield #49800

📔 Documentation

  • Update docs to encourage Java fundamentals for beginners that prefer to learn that way #50146
  • HTTP Service Interface Clients still document that API versioning can be configured via properties #50126
  • Link to the observability section of the Lettuce documentation is broken #50097
  • Javadoc for StaticResourceLocation.FAVICON doesn't describe icons location #50085
  • MySamlRelyingPartyConfiguration is missing a Kotlin sample #50024
  • Incorrect default value for management.httpexchanges.recording.include in configuration metadata #50019
  • Link to the Kubernetes documentation when discussing startup probes #50015
  • Typo in JdbcSessionAutoConfiguration Javadoc #49873
  • Clarify that configuration property default values are not available through the Environment #49851
  • Document the need for Liquibase and Flyway starters #49839
  • Kafka documentation refers to deprecated JSON serializer and deserializer classes #49826

🔨 Dependency Upgrades

... (truncated)

Commits
  • 8821ad2 Release v4.0.6
  • 9e4048a Merge branch '3.5.x' into 4.0.x
  • 20bb11c Next development version (v3.5.15-SNAPSHOT)
  • 98daa8e Merge branch '3.5.x' into 4.0.x
  • 9dc5aa2 Polish
  • 874f629 Fix default security with actuator but without health
  • e41b3bf Enable hostname verification for SSL connections to Elasticsearch
  • ef8527b Merge branch '3.5.x' into 4.0.x
  • f533a45 Do not follow symlinks when writing PID file
  • 4a7bd33 Merge branch '3.5.x' into 4.0.x
  • Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-starter-web from 3.5.5 to 4.0.6

Release notes

Sourced from org.springframework.boot:spring-boot-starter-web's releases.

v4.0.6

🐞 Bug Fixes

  • Default security is misconfigured when spring-boot-actuator-autoconfigure is present and spring-boot-health is not #50188
  • Elasticsearch Rest5Client auto-configuration misconfigures underlying HTTP client #50187
  • ApplicationPidFileWriter does not handle symlinks correctly #50185
  • RandomValuePropertySource is not suitable for secrets #50183
  • Cassandra auto-configuration misconfigures CqlSessionBuilder #50180
  • ApplicationTemp does not handle symlinks correctly #50178
  • Remote DevTools performs comparison incorrectly #50176
  • spring.rabbitmq.ssl.verify-hostname is applied inconsistently #50174
  • Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter #50077
  • Classic starters are missing several modules #50071
  • Module spring-boot-resttestclient is missing from spring-boot-starter-test-classic #50069
  • Annotations like @Ssl don't work on @Bean methods when using @ServiceConnection #50064
  • EnversRevisionRepositoriesRegistrar should reuse @EnableEnversRepositories rather than configuring the JPA counterpart #50039
  • WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links #50017
  • Imports on a containing test class are ignored when a nested class has imports #50012
  • With spring.jackson.use-jackson2-defaults set to true, FAIL_ON_UNKNOWN_PROPERTIES is enabled #49951
  • 500 response from env endpoint when supplied pattern is invalid #49946
  • Reactive MongoDB starter has a transitive dependency on the synchronous MongoDB driver #49945
  • HTTP method is lost when configuring excludes in EndpointRequest #49943
  • Honor HttpMethod for reactive additional endpoint paths #49880
  • Docker Compose support doesn't work with apache/artemis image #49869
  • Docker Compose support doesn't work with apache/activemq image #49866
  • Spring Security's PathPatternRequestMatcher.Builder is not auto-configured when using WebMvcTest and spring-boot-security-test #49854
  • API versioning path strategy should be applied path last as it is not meant to yield #49800

📔 Documentation

  • Update docs to encourage Java fundamentals for beginners that prefer to learn that way #50146
  • HTTP Service Interface Clients still document that API versioning can be configured via properties #50126
  • Link to the observability section of the Lettuce documentation is broken #50097
  • Javadoc for StaticResourceLocation.FAVICON doesn't describe icons location #50085
  • MySamlRelyingPartyConfiguration is missing a Kotlin sample #50024
  • Incorrect default value for management.httpexchanges.recording.include in configuration metadata #50019
  • Link to the Kubernetes documentation when discussing startup probes #50015
  • Typo in JdbcSessionAutoConfiguration Javadoc #49873
  • Clarify that configuration property default values are not available through the Environment #49851
  • Document the need for Liquibase and Flyway starters #49839
  • Kafka documentation refers to deprecated JSON serializer and deserializer classes #49826

🔨 Dependency Upgrades

... (truncated)

Commits
  • 8821ad2 Release v4.0.6
  • 9e4048a Merge branch '3.5.x' into 4.0.x
  • 20bb11c Next development version (v3.5.15-SNAPSHOT)
  • 98daa8e Merge branch '3.5.x' into 4.0.x
  • 9dc5aa2 Polish
  • 874f629 Fix default security with actuator but without health
  • e41b3bf Enable hostname verification for SSL connections to Elasticsearch
  • ef8527b Merge branch '3.5.x' into 4.0.x
  • f533a45 Do not follow symlinks when writing PID file
  • 4a7bd33 Merge branch '3.5.x' into 4.0.x
  • Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-starter-security from 3.5.5 to 4.0.6

Release notes

Sourced from org.springframework.boot:spring-boot-starter-security's releases.

v4.0.6

🐞 Bug Fixes

  • Default security is misconfigured when spring-boot-actuator-autoconfigure is present and spring-boot-health is not #50188
  • Elasticsearch Rest5Client auto-configuration misconfigures underlying HTTP client #50187
  • ApplicationPidFileWriter does not handle symlinks correctly #50185
  • RandomValuePropertySource is not suitable for secrets #50183
  • Cassandra auto-configuration misconfigures CqlSessionBuilder #50180
  • ApplicationTemp does not handle symlinks correctly #50178
  • Remote DevTools performs comparison incorrectly #50176
  • spring.rabbitmq.ssl.verify-hostname is applied inconsistently #50174
  • Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter #50077
  • Classic starters are missing several modules #50071
  • Module spring-boot-resttestclient is missing from spring-boot-starter-test-classic #50069
  • Annotations like @Ssl don't work on @Bean methods when using @ServiceConnection #50064
  • EnversRevisionRepositoriesRegistrar should reuse @EnableEnversRepositories rather than configuring the JPA counterpart #50039
  • WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links #50017
  • Imports on a containing test class are ignored when a nested class has imports #50012
  • With spring.jackson.use-jackson2-defaults set to true, FAIL_ON_UNKNOWN_PROPERTIES is enabled #49951
  • 500 response from env endpoint when supplied pattern is invalid #49946
  • Reactive MongoDB starter has a transitive dependency on the synchronous MongoDB driver #49945
  • HTTP method is lost when configuring excludes in EndpointRequest #49943
  • Honor HttpMethod for reactive additional endpoint paths #49880
  • Docker Compose support doesn't work with apache/artemis image #49869
  • Docker Compose support doesn't work with apache/activemq image #49866
  • Spring Security's PathPatternRequestMatcher.Builder is not auto-configured when using WebMvcTest and spring-boot-security-test #49854
  • API versioning path strategy should be applied path last as it is not meant to yield #49800

📔 Documentation

  • Update docs to encourage Java fundamentals for beginners that prefer to learn that way #50146
  • HTTP Service Interface Clients still document that API versioning can be configured via properties #50126
  • Link to the observability section of the Lettuce documentation is broken #50097
  • Javadoc for StaticResourceLocation.FAVICON doesn't describe icons location #50085
  • MySamlRelyingPartyConfiguration is missing a Kotlin sample #50024
  • Incorrect default value for management.httpexchanges.recording.include in configuration metadata #50019
  • Link to the Kubernetes documentation when discussing startup probes #50015
  • Typo in JdbcSessionAutoConfiguration Javadoc #49873
  • Clarify that configuration property default values are not available through the Environment #49851
  • Document the need for Liquibase and Flyway starters #49839
  • Kafka documentation refers to deprecated JSON serializer and deserializer classes #49826

🔨 Dependency Upgrades

... (truncated)

Commits
  • 8821ad2 Release v4.0.6
  • 9e4048a Merge branch '3.5.x' into 4.0.x
  • 20bb11c Next development version (v3.5.15-SNAPSHOT)
  • 98daa8e Merge branch '3.5.x' into 4.0.x
  • 9dc5aa2 Polish
  • 874f629 Fix default security with actuator but without health
  • e41b3bf Enable hostname verification for SSL connections to Elasticsearch
  • ef8527b Merge branch '3.5.x' into 4.0.x
  • f533a45 Do not follow symlinks when writing PID file
  • 4a7bd33 Merge branch '3.5.x' into 4.0.x
  • Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-starter-test from 3.5.5 to 4.0.6

Release notes

Sourced from org.springframework.boot:spring-boot-starter-test's releases.

v4.0.6

🐞 Bug Fixes

  • Default security is misconfigured when spring-boot-actuator-autoconfigure is present and spring-boot-health is not #50188
  • Elasticsearch Rest5Client auto-configuration misconfigures underlying HTTP client #50187
  • ApplicationPidFileWriter does not handle symlinks correctly #50185
  • RandomValuePropertySource is not suitable for secrets #50183
  • Cassandra auto-configuration misconfigures CqlSessionBuilder #50180
  • ApplicationTemp does not handle symlinks correctly #50178
  • Remote DevTools performs comparison incorrectly #50176
  • spring.rabbitmq.ssl.verify-hostname is applied inconsistently #50174
  • Whole number values are ignored when configuring min and max expected values and SLO boundaries for a...

    Description has been truncated

@dependabot
build(deps): Bump the dev-dependencies group with 18 updates
4463b01 
Bumps the dev-dependencies group with 18 updates:

| Package | From | To |
| --- | --- | --- |
| software.amazon.awssdk:dynamodb | `2.44.5` | `2.44.6` |
| software.amazon.awssdk:dynamodb-enhanced | `2.44.5` | `2.44.6` |
| io.dropwizard:dropwizard-core | `4.0.14` | `5.0.1` |
| io.dropwizard:dropwizard-auth | `4.0.14` | `5.0.1` |
| io.dropwizard:dropwizard-jersey | `4.0.14` | `5.0.1` |
| io.dropwizard:dropwizard-testing | `4.0.14` | `5.0.1` |
| io.dropwizard:dropwizard-assets | `4.0.14` | `5.0.1` |
| [com.google.dagger:dagger](https://github.com/google/dagger) | `2.56.2` | `2.59.2` |
| [com.google.dagger:dagger-compiler](https://github.com/google/dagger) | `2.56.2` | `2.59.2` |
| [org.springframework.boot:spring-boot-autoconfigure](https://github.com/spring-projects/spring-boot) | `3.5.5` | `4.0.6` |
| [org.springframework.boot:spring-boot-starter](https://github.com/spring-projects/spring-boot) | `3.5.5` | `4.0.6` |
| [org.springframework.boot:spring-boot-starter-web](https://github.com/spring-projects/spring-boot) | `3.5.5` | `4.0.6` |
| [org.springframework.boot:spring-boot-starter-security](https://github.com/spring-projects/spring-boot) | `3.5.5` | `4.0.6` |
| [org.springframework.boot:spring-boot-starter-test](https://github.com/spring-projects/spring-boot) | `3.5.5` | `4.0.6` |
| [org.springframework.boot:spring-boot-configuration-processor](https://github.com/spring-projects/spring-boot) | `3.5.5` | `4.0.6` |
| [org.springframework.security:spring-security-test](https://github.com/spring-projects/spring-security) | `6.5.3` | `7.0.5` |
| [com.diffplug.spotless:spotless-plugin-gradle](https://github.com/diffplug/spotless) | `8.4.0` | `8.5.0` |
| com.diffplug.spotless | `8.4.0` | `8.5.0` |


Updates `software.amazon.awssdk:dynamodb` from 2.44.5 to 2.44.6

Updates `software.amazon.awssdk:dynamodb-enhanced` from 2.44.5 to 2.44.6

Updates `software.amazon.awssdk:dynamodb-enhanced` from 2.44.5 to 2.44.6

Updates `io.dropwizard:dropwizard-core` from 4.0.14 to 5.0.1

Updates `io.dropwizard:dropwizard-auth` from 4.0.14 to 5.0.1

Updates `io.dropwizard:dropwizard-jersey` from 4.0.14 to 5.0.1

Updates `io.dropwizard:dropwizard-testing` from 4.0.14 to 5.0.1

Updates `io.dropwizard:dropwizard-assets` from 4.0.14 to 5.0.1

Updates `io.dropwizard:dropwizard-auth` from 4.0.14 to 5.0.1

Updates `io.dropwizard:dropwizard-jersey` from 4.0.14 to 5.0.1

Updates `io.dropwizard:dropwizard-testing` from 4.0.14 to 5.0.1

Updates `io.dropwizard:dropwizard-assets` from 4.0.14 to 5.0.1

Updates `com.google.dagger:dagger` from 2.56.2 to 2.59.2
- [Release notes](https://github.com/google/dagger/releases)
- [Changelog](https://github.com/google/dagger/blob/master/CHANGELOG.md)
- [Commits](google/dagger@dagger-2.56.2...dagger-2.59.2)

Updates `com.google.dagger:dagger-compiler` from 2.56.2 to 2.59.2
- [Release notes](https://github.com/google/dagger/releases)
- [Changelog](https://github.com/google/dagger/blob/master/CHANGELOG.md)
- [Commits](google/dagger@dagger-2.56.2...dagger-2.59.2)

Updates `com.google.dagger:dagger-compiler` from 2.56.2 to 2.59.2
- [Release notes](https://github.com/google/dagger/releases)
- [Changelog](https://github.com/google/dagger/blob/master/CHANGELOG.md)
- [Commits](google/dagger@dagger-2.56.2...dagger-2.59.2)

Updates `org.springframework.boot:spring-boot-autoconfigure` from 3.5.5 to 4.0.6
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.5...v4.0.6)

Updates `org.springframework.boot:spring-boot-starter` from 3.5.5 to 4.0.6
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.5...v4.0.6)

Updates `org.springframework.boot:spring-boot-starter-web` from 3.5.5 to 4.0.6
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.5...v4.0.6)

Updates `org.springframework.boot:spring-boot-starter-security` from 3.5.5 to 4.0.6
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.5...v4.0.6)

Updates `org.springframework.boot:spring-boot-starter-test` from 3.5.5 to 4.0.6
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.5...v4.0.6)

Updates `org.springframework.boot:spring-boot-configuration-processor` from 3.5.5 to 4.0.6
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.5...v4.0.6)

Updates `org.springframework.boot:spring-boot-starter` from 3.5.5 to 4.0.6
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.5...v4.0.6)

Updates `org.springframework.boot:spring-boot-starter-web` from 3.5.5 to 4.0.6
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.5...v4.0.6)

Updates `org.springframework.boot:spring-boot-starter-security` from 3.5.5 to 4.0.6
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.5...v4.0.6)

Updates `org.springframework.boot:spring-boot-starter-test` from 3.5.5 to 4.0.6
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.5...v4.0.6)

Updates `org.springframework.boot:spring-boot-configuration-processor` from 3.5.5 to 4.0.6
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.5...v4.0.6)

Updates `org.springframework.security:spring-security-test` from 6.5.3 to 7.0.5
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@6.5.3...7.0.5)

Updates `com.diffplug.spotless:spotless-plugin-gradle` from 8.4.0 to 8.5.0
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](diffplug/spotless@gradle/8.4.0...gradle/8.5.0)

Updates `com.diffplug.spotless` from 8.4.0 to 8.5.0

Updates `com.diffplug.spotless` from 8.4.0 to 8.5.0

---
updated-dependencies:
- dependency-name: software.amazon.awssdk:dynamodb
  dependency-version: 2.44.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: software.amazon.awssdk:dynamodb-enhanced
  dependency-version: 2.44.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: software.amazon.awssdk:dynamodb-enhanced
  dependency-version: 2.44.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: io.dropwizard:dropwizard-core
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: io.dropwizard:dropwizard-auth
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: io.dropwizard:dropwizard-jersey
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: io.dropwizard:dropwizard-testing
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: io.dropwizard:dropwizard-assets
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: io.dropwizard:dropwizard-auth
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: io.dropwizard:dropwizard-jersey
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: io.dropwizard:dropwizard-testing
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: io.dropwizard:dropwizard-assets
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: com.google.dagger:dagger
  dependency-version: 2.59.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: com.google.dagger:dagger-compiler
  dependency-version: 2.59.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: com.google.dagger:dagger-compiler
  dependency-version: 2.59.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: org.springframework.boot:spring-boot-autoconfigure
  dependency-version: 4.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: org.springframework.boot:spring-boot-starter
  dependency-version: 4.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: org.springframework.boot:spring-boot-starter-web
  dependency-version: 4.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: org.springframework.boot:spring-boot-starter-security
  dependency-version: 4.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: org.springframework.boot:spring-boot-starter-test
  dependency-version: 4.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: org.springframework.boot:spring-boot-configuration-processor
  dependency-version: 4.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: org.springframework.boot:spring-boot-starter
  dependency-version: 4.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: org.springframework.boot:spring-boot-starter-web
  dependency-version: 4.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: org.springframework.boot:spring-boot-starter-security
  dependency-version: 4.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: org.springframework.boot:spring-boot-starter-test
  dependency-version: 4.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: org.springframework.boot:spring-boot-configuration-processor
  dependency-version: 4.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: org.springframework.security:spring-security-test
  dependency-version: 7.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: com.diffplug.spotless:spotless-plugin-gradle
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: com.diffplug.spotless
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: com.diffplug.spotless
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels May 15, 2026
@github-actions
github-actions Bot merged commit d964534 into main May 15, 2026
1 of 2 checks passed
@github-actions
github-actions Bot deleted the dependabot/gradle/dev-dependencies-e383fbd5ea branch May 15, 2026 04:59
wolpert added a commit that referenced this pull request May 15, 2026
@wolpert @claude
build: revert dependabot's spring boot 4, spring security 7, dropwiza…
b6bb69c 
…rd 5 majors

Dependabot's dev-dependencies batch (#7) bumped three frameworks across
major version boundaries, all of which break our adapter modules:

- Spring Boot 3.5.5 → 4.0.6 drops Jackson 2 in favor of Jackson 3
  (`tools.jackson.*`). Our Phase 8 `PkAuthJacksonModule` bridges
  Jackson 2 ↔ pk-auth's Jackson 3 wire types. Spring Boot 4 makes that
  bridge unbuildable: `com.fasterxml.jackson.*` packages no longer
  exist on Spring's classpath.
- Spring Security 6.5.3 → 7.0.5 is tied to Spring Framework 7 /
  Spring Boot 4 and breaks the same way.
- Dropwizard 4.0.14 → 5.0.1 changes the bundle and configuration
  surface that Phase 9's `PkAuthBundle<HasPkAuthConfig>` depends on.

All three are explicitly pinned by the build brief (§6.10 Spring Boot
3.5.x, §6.11 Dropwizard 4.x).

Revert each to the pre-bump version and add semver-major Dependabot
ignore rules so this doesn't recur:
- spring-boot 3.5.5
- spring-security 6.5.3
- dropwizard 4.0.14

Patches/minors from the same Dependabot batch left in place: aws-sdk
2.44.5 → 2.44.6, dagger 2.56.2 → 2.59.2. Spotless's existing >=8 ignore
already covers that one.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
wolpert added a commit that referenced this pull request May 16, 2026
@wolpert @claude
security: fix HIGH-severity findings from review (TODO #2-#11)
8d22d3a 
- ceremony: default UV to REQUIRED so WebAuthn4J enforces flagUV (#2)
- ceremony: refuse the non-strict WebAuthnManager when attestation conveyance
  is not NONE; force operators to wire a strict manager explicitly (#3)
- jwt(spring): fail-fast on HS256 secrets shorter than 32 bytes; remove the
  silent expand() helper that masked weak keys (#4)
- jwt(micronaut): fail-fast on blank or short HS256 secrets; remove the
  zero-pad and random-on-blank fallbacks (#5)
- persistence: make signCount updates atomic against concurrent racing
  assertions so clone detection cannot be silently defeated — JDBI adds
  AND sign_count < :sc, DynamoDB adds a conditional UpdateItem (#6)
- starters: gate LoggingEmailSender / LoggingSmsSender behind dev-mode so
  magic-link tokens and OTP codes don't silently leak to production logs (#7)
- magic-link: replace the unbounded ConcurrentHashMap of consumed JTIs with
  a TTL-bounded Caffeine cache; fix the Javadoc to match reality (#8)
- magic-link: bind verification email to the user via UserLookup#emailFor
  and reject mismatches; admin service maps the new EmailMismatch result to
  a 400 (#9)
- persistence(dynamodb): server-enforce single-use for backup-code consume
  and OTP consume/incrementAttempts via ConditionExpression (#10)
- persistence(dynamodb): server-enforce challenge expiry in takeOnce
  via ConditionExpression on expiresAt instead of post-filtering in Java (#11)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
wolpert added a commit that referenced this pull request May 16, 2026
@wolpert @claude
tier 1: security & correctness hotfixes
23e3e27 
#1 — JdbiOtpRepository.incrementAttempts now unconditional; OtpService.verify uses >=
#2 — BackupCodeRepository.consume returns boolean; impls atomic; race-loser → NoMatch
#3 — OtpRepository.consume returns boolean; JDBI adds consumed=FALSE guard
#4 — PkAuthJwtValidator rejects kid-less tokens when keyset has any kid-bearing key
#5 — new ConsumedJtiStore SPI; in-memory Caffeine default; single-instance WARN
#6 — startAuthentication/startRegistration always emit non-null [] credential lists
#7 — new CeremonyRateLimiter SPI; default Caffeine impl; RateLimited variant; 429
#8 — JDBI/DynamoDB/InMemory repos wrap backend errors as PkAuthPersistenceException
#18 — new DuplicateCredentialException extends PkAuthPersistenceException (sealed)
#28 — OtpRepository.incrementAttempts returns OptionalInt; empty → NoActiveOtp

Blocked: none

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants