Skip to content

build(deps): bump the minor-and-patch group with 14 updates - #3

Closed
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/maven/develop/minor-and-patch-4b0ec7a721
Closed

build(deps): bump the minor-and-patch group with 14 updates#3
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/maven/develop/minor-and-patch-4b0ec7a721

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Feb 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the minor-and-patch group with 14 updates:

Package From To
software.amazon.awssdk:bom 2.21.29 2.41.25
com.azure:azure-storage-blob 12.23.0 12.33.2
com.azure:azure-identity 1.10.4 1.18.2
org.apache.httpcomponents.client5:httpclient5 5.2.1 5.6
io.jsonwebtoken:jjwt-api 0.11.5 0.13.0
io.jsonwebtoken:jjwt-impl 0.11.5 0.13.0
io.jsonwebtoken:jjwt-jackson 0.11.5 0.13.0
com.fasterxml.jackson.core:jackson-databind 2.15.2 2.21.0
com.fasterxml.jackson.core:jackson-core 2.15.2 2.21.0
com.fasterxml.jackson.core:jackson-annotations 2.15.2 2.21.0
io.github.resilience4j:resilience4j-bom 2.1.0 2.3.0
com.github.tomakehurst:wiremock-jre8 2.35.0 2.35.2
org.apache.maven.plugins:maven-surefire-plugin 3.1.2 3.5.4
org.apache.maven.plugins:maven-failsafe-plugin 3.1.2 3.5.4

Updates software.amazon.awssdk:bom from 2.21.29 to 2.41.25

Updates com.azure:azure-storage-blob from 12.23.0 to 12.33.2

Release notes

Sourced from com.azure:azure-storage-blob's releases.

com.azure+azure-storage-blob_12.33.2

12.33.2 (2026-02-05)

Bugs Fixed

  • Fixed a bug where builders were only using a single credential when multiple credentials were added and credentials were silently overwritten for principle-bound user delegation SAS. All credential changes will now be logged at the info level; invalid combinations of credentials will throw an error.

Other Changes

Dependency Updates

  • updated azure-storage-common from 12.32.1 to 12.32.2 in azure-storage-common.
Commits
  • 3c77a8b Storage hotfix feb2026 (#47904)
  • 0a9477c Prepare patch release 20260129 (#47854)
  • 11468a1 Fix empty Dependency Updates section in patch release changelog (#47846)
  • dd5c23d Fix race condition causing test flakiness (#47834)
  • a4d3916 Update Spring Boot and Spring Cloud versions for the Spring compatibility tes...
  • 3bc49f1 Upgrade external dependencies to align with Spring Boot 4.0.2 (#47785)
  • 0b282c6 Sync .github/workflows directory with azure-sdk-tools for PR 13552 (#47840)
  • 74fc2e7 [azure-ai-voicelive] Add live test (#47808)
  • 1b93750 Adding support for the microsoftteamsapp identifier (#47770)
  • 3a95021 Exclude CHANGELOG.md from git restore in patch release preparation (#47821)
  • Additional commits viewable in compare view

Updates com.azure:azure-identity from 1.10.4 to 1.18.2

Commits
  • afe0cd5 broker changelog
  • f6f7b47 Merge branch 'main' into release/identity_1.18.2
  • 52f40ba bumped broker package version
  • 7fcba28 Prepare release 1.18.2 from release branch
  • 3ea0ba6 [SparkConnector]FixClassCastExceptionForPatch (#47748)
  • 44dba7e Prepare Release from release branch- removed beta changes
  • 540cc8c Bump cspell from 9.4.0 to 9.6.0 in /eng/common/spelling (#47753)
  • cbd7021 Spark transactional batch support v2 refactor (#47697)
  • 190f648 [SparkConnector]FixIncorrectInitialOffset (#47742)
  • ac7b375 Add MCP sample with V2026_01_01_PREVIEW support (#47710)
  • Additional commits viewable in compare view

Updates org.apache.httpcomponents.client5:httpclient5 from 5.2.1 to 5.6

Changelog

Sourced from org.apache.httpcomponents.client5:httpclient5's changelog.

Release 5.6 ALPHA1

This is the first ALPHA release in the 5.6 release series. It adds several features such as transport content decompression and content compression for the async transport, support for Unix sockets, experimental support for SCRAM-SHA-256 authentication scheme, and Micrometer/OTel observations & metrics.

Commons Compress, Brotli codec, and ZStd codec are optional dependencies and get wired into the execution pipeline only if present on the classpath.

Notable changes and features included in the 5.6 series:

  • Unix domain socket support.

  • Support for pluggable content codecs via Commons-Compress in the classic transport. (optional).

  • Support for transparent content decompression and content compression with deflate, gzip, zstd (optional), and brotli (optional) codecs in the async transport.

  • Micrometer/OTel observations & metrics (optinal).

  • Off-lock connection disposal by the classic pooling connection manager. Experimental.

  • SCRAM-SHA-256 authentication scheme (RFC 7804). Experimental.

  • Request Priority support (RFC 9218). Experimental.

Compatibility notes:

  • As of this version, HttpClient uses BUILTIN HostnameVerificationPolicy by default, delegating host verification to JSSE security manager. One must explicitly configure the TLS strategy to continue using the hostname verifier shipped with HttpClient.

  • Five-second TCP keep-alive is now enabled by default.

Change Log

  • RequestConfig: Un-deprecate #setProxy. Contributed by Ryan Schmitt

  • Stale connection check support in PoolingAsyncClientConnectionManager. Contributed by Ryan Schmitt

  • ConnectionConfig: #idleTimeout support. Contributed by Ryan Schmitt

... (truncated)

Commits
  • decd193 HttpClient 5.6 release
  • 11ea8e5 Updated release notes for HttpClient 5.6 release
  • 77fa61a Limit the length of content codec list that can be processed automatically
  • 81b7971 Upgraded HttpCore to version 5.4
  • 2c7fe0f Add OFFLOCK pool concurrency policy backed by RouteSegmentedConnPool (#765)
  • 1f4dea7 Fixed Micrometer and OpenTelemetry dependency declaration
  • d2fadd2 Tag TLS handshake timeout tests with slow
  • e52e466 TestTlsHandshakeTimeout: Disable assertions on Java 8
  • 77f52f0 Upgraded HttpClient version to 5.6-alpha2-SNAPSHOT
  • 48e0f25 HttpClient 5.6-alpha1 release
  • Additional commits viewable in compare view

Updates io.jsonwebtoken:jjwt-api from 0.11.5 to 0.13.0

Release notes

Sourced from io.jsonwebtoken:jjwt-api's releases.

0.13.0

This is the last minor JJWT release branch that will support Java 7.

Any necessary emergency bug fixes will be fixed in subsequent 0.13.x patch releases, but all new development, including Java 8 compatible changes, will be in the next minor (0.14.0) release.

All future JJWT major and minor versions ( 0.14.0 and later) will require Java 8 or later.

What's Changed

This release contains a single change:

  • The previously private JacksonDeserializer(ObjectMapper objectMapper, Map<String, Class<?>> claimTypeMap) constructor is now public for those that want register a claims type converter on their own specified ObjectMapper instance. Thank you to @​kesrishubham2510 for PR #972. See Issue 914.

Full Changelog: jwtk/jjwt@0.12.7...0.13.0

0.12.7

This patch release:

  • Adds a new Maven BOM! This is useful for multi-module projects. See Issue 967.

  • Allows the JwtParserBuilder to have empty nested algorithm collections, effectively disabling the parser's associated feature:

    • Emptying the zip() nested collection disables JWT decompression.
    • Emptying the sig() nested collection disables JWS mac/signature verification (i.e. all JWSs will be unsupported/rejected).
    • Emptying either the enc() or key() nested collections disables JWE decryption (i.e. all JWEs will be unsupported/rejected)

    See Issue 996.

  • Fixes bug 961 where JwtParserBuilder nested collection builders were not correctly replacing algorithms with the same id.

  • Ensures a JwkSet's keys collection is no longer entirely secret/redacted by default. This was an overzealous default that was unnecessarily restrictive; the keys collection itself should always be public, and each individual key within should determine which fields should be redacted when printed. See Issue 976.

  • Improves performance slightly by ensuring all jjwt-api utility methods that create *Builder instances (Jwts.builder(), Jwts.parserBuilder(), Jwks.builder(), etc) no longer use reflection.

    Instead,static factories are created via reflection only once during initial jjwt-api classloading, and then *Builders are created via standard instantiation using the new operator thereafter. This also benefits certain environments that may not have ideal ClassLoader implementations (e.g. Tomcat in some cases).

    NOTE: because this changes which classes are loaded via reflection, any environments that must explicitly reference reflective class names (e.g. GraalVM applications) will need to be updated to reflect the new factory class names.

    See Issue 988.

  • Upgrades the Gson dependency to 2.11.0

  • Upgrades the BouncyCastle dependency to 1.78.1

New Contributors

Full Changelog: jwtk/jjwt@0.12.6...0.12.7

0.12.6

This patch release:

  • Ensures that after successful JWS signature verification, an application-configured Base64Url Decoder output is used to construct a Jws instance (instead of JJWT's default decoder). See jwtk/jjwt#947.

... (truncated)

Changelog

Sourced from io.jsonwebtoken:jjwt-api's changelog.

0.13.0

This is the last minor JJWT release branch that will support Java 7. Any necessary emergency bug fixes will be fixed in subsequent 0.13.x patch releases, but all new development, including Java 8 compatible changes, will be in the next minor (0.14.0) release.

All future JJWT major and minor versions ( 0.14.0 and later) will require Java 8 or later.

This 0.13.0 minor release has only one change:

  • The previously private JacksonDeserializer(ObjectMapper objectMapper, Map<String, Class<?>> claimTypeMap) constructor is now public for those that want register a claims type converter on their own specified ObjectMapper instance. See Issue 914.

0.12.7

This patch release:

  • Adds a new Maven BOM, useful for multi-module projects. See Issue 967.

  • Allows the JwtParserBuilder to have empty nested algorithm collections, effectively disabling the parser's associated feature:

    • Emptying the zip() nested collection disables JWT decompression.
    • Emptying the sig() nested collection disables JWS mac/signature verification (i.e. all JWSs will be unsupported/rejected).
    • Emptying either the enc() or key() nested collections disables JWE decryption (i.e. all JWEs will be unsupported/rejected)

    See Issue 996.

  • Fixes bug 961 where JwtParserBuilder nested collection builders were not correctly replacing algorithms with the same id.

  • Ensures a JwkSet's keys collection is no longer entirely secret/redacted by default. This was an overzealous default that was unnecessarily restrictive; the keys collection itself should always be public, and each individual key within should determine which fields should be redacted when printed. See Issue 976.

  • Improves performance slightly by ensuring all jjwt-api utility methods that create *Builder instances (Jwts.builder(), Jwts.parserBuilder(), Jwks.builder(), etc) no longer use reflection.

    Instead,static factories are created via reflection only once during initial jjwt-api classloading, and then *Builders are created via standard instantiation using the new operator thereafter. This also benefits certain environments that may not have ideal ClassLoader implementations (e.g. Tomcat in some cases).

    NOTE: because this changes which classes are loaded via reflection, any environments that must explicitly reference reflective class names (e.g. GraalVM applications) will need to be updated to reflect the new factory class names.

    See Issue 988.

  • Upgrades the Gson dependency to 2.11.0

  • Upgrades the BouncyCastle dependency to 1.78.1

0.12.6

This patch release:

  • Ensures that after successful JWS signature verification, an application-configured Base64Url Decoder output is used to construct a Jws instance (instead of JJWT's default decoder). See Issue 947.
  • Fixes a decompression memory leak in concurrent/multi-threaded environments introduced in 0.12.0 when decompressing JWTs with a zip header of GZIP. See Issue 949.
  • Upgrades BouncyCastle to 1.78 via PR 941.
  • Ensures that a JwkSet's keys list member is no longer considered secret and is not redacted by default. However, each individual JWK element within the keys list may still have redacted private or secret members as expected. See Issue 976.

0.12.5

This patch release:

  • Ensures that builders' NestedCollection changes are applied to the collection immediately as mutation methods are called, no longer

... (truncated)

Commits

Updates io.jsonwebtoken:jjwt-impl from 0.11.5 to 0.13.0

Release notes

Sourced from io.jsonwebtoken:jjwt-impl's releases.

0.13.0

This is the last minor JJWT release branch that will support Java 7.

Any necessary emergency bug fixes will be fixed in subsequent 0.13.x patch releases, but all new development, including Java 8 compatible changes, will be in the next minor (0.14.0) release.

All future JJWT major and minor versions ( 0.14.0 and later) will require Java 8 or later.

What's Changed

This release contains a single change:

  • The previously private JacksonDeserializer(ObjectMapper objectMapper, Map<String, Class<?>> claimTypeMap) constructor is now public for those that want register a claims type converter on their own specified ObjectMapper instance. Thank you to @​kesrishubham2510 for PR #972. See Issue 914.

Full Changelog: jwtk/jjwt@0.12.7...0.13.0

0.12.7

This patch release:

  • Adds a new Maven BOM! This is useful for multi-module projects. See Issue 967.

  • Allows the JwtParserBuilder to have empty nested algorithm collections, effectively disabling the parser's associated feature:

    • Emptying the zip() nested collection disables JWT decompression.
    • Emptying the sig() nested collection disables JWS mac/signature verification (i.e. all JWSs will be unsupported/rejected).
    • Emptying either the enc() or key() nested collections disables JWE decryption (i.e. all JWEs will be unsupported/rejected)

    See Issue 996.

  • Fixes bug 961 where JwtParserBuilder nested collection builders were not correctly replacing algorithms with the same id.

  • Ensures a JwkSet's keys collection is no longer entirely secret/redacted by default. This was an overzealous default that was unnecessarily restrictive; the keys collection itself should always be public, and each individual key within should determine which fields should be redacted when printed. See Issue 976.

  • Improves performance slightly by ensuring all jjwt-api utility methods that create *Builder instances (Jwts.builder(), Jwts.parserBuilder(), Jwks.builder(), etc) no longer use reflection.

    Instead,static factories are created via reflection only once during initial jjwt-api classloading, and then *Builders are created via standard instantiation using the new operator thereafter. This also benefits certain environments that may not have ideal ClassLoader implementations (e.g. Tomcat in some cases).

    NOTE: because this changes which classes are loaded via reflection, any environments that must explicitly reference reflective class names (e.g. GraalVM applications) will need to be updated to reflect the new factory class names.

    See Issue 988.

  • Upgrades the Gson dependency to 2.11.0

  • Upgrades the BouncyCastle dependency to 1.78.1

New Contributors

Full Changelog: jwtk/jjwt@0.12.6...0.12.7

0.12.6

This patch release:

  • Ensures that after successful JWS signature verification, an application-configured Base64Url Decoder output is used to construct a Jws instance (instead of JJWT's default decoder). See jwtk/jjwt#947.

... (truncated)

Changelog

Sourced from io.jsonwebtoken:jjwt-impl's changelog.

0.13.0

This is the last minor JJWT release branch that will support Java 7. Any necessary emergency bug fixes will be fixed in subsequent 0.13.x patch releases, but all new development, including Java 8 compatible changes, will be in the next minor (0.14.0) release.

All future JJWT major and minor versions ( 0.14.0 and later) will require Java 8 or later.

This 0.13.0 minor release has only one change:

  • The previously private JacksonDeserializer(ObjectMapper objectMapper, Map<String, Class<?>> claimTypeMap) constructor is now public for those that want register a claims type converter on their own specified ObjectMapper instance. See Issue 914.

0.12.7

This patch release:

  • Adds a new Maven BOM, useful for multi-module projects. See Issue 967.

  • Allows the JwtParserBuilder to have empty nested algorithm collections, effectively disabling the parser's associated feature:

    • Emptying the zip() nested collection disables JWT decompression.
    • Emptying the sig() nested collection disables JWS mac/signature verification (i.e. all JWSs will be unsupported/rejected).
    • Emptying either the enc() or key() nested collections disables JWE decryption (i.e. all JWEs will be unsupported/rejected)

    See Issue 996.

  • Fixes bug 961 where JwtParserBuilder nested collection builders were not correctly replacing algorithms with the same id.

  • Ensures a JwkSet's keys collection is no longer entirely secret/redacted by default. This was an overzealous default that was unnecessarily restrictive; the keys collection itself should always be public, and each individual key within should determine which fields should be redacted when printed. See Issue 976.

  • Improves performance slightly by ensuring all jjwt-api utility methods that create *Builder instances (Jwts.builder(), Jwts.parserBuilder(), Jwks.builder(), etc) no longer use reflection.

    Instead,static factories are created via reflection only once during initial jjwt-api classloading, and then *Builders are created via standard instantiation using the new operator thereafter. This also benefits certain environments that may not have ideal ClassLoader implementations (e.g. Tomcat in some cases).

    NOTE: because this changes which classes are loaded via reflection, any environments that must explicitly reference reflective class names (e.g. GraalVM applications) will need to be updated to reflect the new factory class names.

    See Issue 988.

  • Upgrades the Gson dependency to 2.11.0

  • Upgrades the BouncyCastle dependency to 1.78.1

0.12.6

This patch release:

  • Ensures that after successful JWS signature verification, an application-configured Base64Url Decoder output is used to construct a Jws instance (instead of JJWT's default decoder). See Issue 947.
  • Fixes a decompression memory leak in concurrent/multi-threaded environments introduced in 0.12.0 when decompressing JWTs with a zip header of GZIP. See Issue 949.
  • Upgrades BouncyCastle to 1.78 via PR 941.
  • Ensures that a JwkSet's keys list member is no longer considered secret and is not redacted by default. However, each individual JWK element within the keys list may still have redacted private or secret members as expected. See Issue 976.

0.12.5

This patch release:

  • Ensures that builders' NestedCollection changes are applied to the collection immediately as mutation methods are called, no longer

... (truncated)

Commits

Updates io.jsonwebtoken:jjwt-jackson from 0.11.5 to 0.13.0

Updates io.jsonwebtoken:jjwt-impl from 0.11.5 to 0.13.0

Release notes

Sourced from io.jsonwebtoken:jjwt-impl's releases.

0.13.0

This is the last minor JJWT release branch that will support Java 7.

Any necessary emergency bug fixes will be fixed in subsequent 0.13.x patch releases, but all new development, including Java 8 compatible changes, will be in the next minor (0.14.0) release.

All future JJWT major and minor versions ( 0.14.0 and later) will require Java 8 or later.

What's Changed

This release contains a single change:

  • The previously private JacksonDeserializer(ObjectMapper objectMapper, Map<String, Class<?>> claimTypeMap) constructor is now public for those that want register a claims type converter on their own specified ObjectMapper instance. Thank you to @​kesrishubham2510 for PR #972. See Issue 914.

Full Changelog: jwtk/jjwt@0.12.7...0.13.0

0.12.7

This patch release:

  • Adds a new Maven BOM! This is useful for multi-module projects. See Issue 967.

  • Allows the JwtParserBuilder to have empty nested algorithm collections, effectively disabling the parser's associated feature:

    • Emptying the zip() nested collection disables JWT decompression.
    • Emptying the sig() nested collection disables JWS mac/signature verification (i.e. all JWSs will be unsupported/rejected).
    • Emptying either the enc() or key() nested collections disables JWE decryption (i.e. all JWEs will be unsupported/rejected)

    See Issue 996.

  • Fixes bug 961 where JwtParserBuilder nested collection builders were not correctly replacing algorithms with the same id.

  • Ensures a JwkSet's keys collection is no longer entirely secret/redacted by default. This was an overzealous default that was unnecessarily restrictive; the keys collection itself should always be public, and each individual key within should determine which fields should be redacted when printed. See Issue 976.

  • Improves performance slightly by ensuring all jjwt-api utility methods that create *Builder instances (Jwts.builder(), Jwts.parserBuilder(), Jwks.builder(), etc) no longer use reflection.

    Instead,static factories are created via reflection only once during initial jjwt-api classloading, and then *Builders are created via standard instantiation using the new operator thereafter. This also benefits certain environments that may not have ideal ClassLoader implementations (e.g. Tomcat in some cases).

    NOTE: because this changes which classes are loaded via reflection, any environments that must explicitly reference reflective class names (e.g. GraalVM applications) will need to be updated to reflect the new factory class names.

    See Issue 988.

  • Upgrades the Gson dependency to 2.11.0

  • Upgrades the BouncyCastle dependency to 1.78.1

New Contributors

Full Changelog: jwtk/jjwt@0.12.6...0.12.7

0.12.6

This patch release:

  • Ensures that after successful JWS signature verification, an application-configured Base64Url Decoder output is used to construct a Jws instance (instead of JJWT's default decoder). See jwtk/jjwt#947.

... (truncated)

Changelog

Sourced from io.jsonwebtoken:jjwt-impl's changelog.

0.13.0

This is the last minor JJWT release branch that will support Java 7. Any necessary emergency bug fixes will be fixed in subsequent 0.13.x patch releases, but all new development, including Java 8 compatible changes, will be in the next minor (0.14.0) release.

All future JJWT major and minor versions ( 0.14.0 and later) will require Java 8 or later.

This 0.13.0 minor release has only one change:

  • The previously private JacksonDeserializer(ObjectMapper objectMapper, Map<String, Class<?>> claimTypeMap) constructor is now public for those that want register a claims type converter on their own specified ObjectMapper instance. See Issue 914.

0.12.7

This patch release:

  • Adds a new Maven BOM, useful for multi-module projects. See Issue 967.

  • Allows the JwtParserBuilder to have empty nested algorithm collections, effectively disabling the parser's associated feature:

    • Emptying the zip() nested collection disables JWT decompression.
    • Emptying the sig() nested collection disables JWS mac/signature verification (i.e. all JWSs will be unsupported/rejected).
    • Emptying either the enc() or key() nested collections disables JWE decryption (i.e. all JWEs will be unsupported/rejected)

    See Issue 996.

  • Fixes bug 961 where JwtParserBuilder nested collection builders were not correctly replacing algorithms with the same id.

  • Ensures a JwkSet's keys collection is no longer entirely secret/redacted by default. This was an overzealous default that was unnecessarily restrictive; the keys collection itself should always be public, and each individual key within should determine which fields should be redacted when printed. See Issue 976.

  • Improves performance slightly by ensuring all jjwt-api utility methods that create *Builder instances (Jwts.builder(), Jwts.parserBuilder(), Jwks.builder(), etc) no longer use reflection.

    Instead,static factories are created via reflection only once during initial jjwt-api classloading, and then *Builders are created via standard instantiation using the new operator thereafter. This also benefits certain environments that may not have ideal ClassLoader implementations (e.g. Tomcat in some cases).

    NOTE: because this changes which classes are loaded via reflection, any environments that must explicitly reference reflective class names (e.g. GraalVM applications) will need to be updated to reflect the new factory class names.

    See Issue 988.

  • Upgrades the Gson dependency to 2.11.0

  • Upgrades the BouncyCastle dependency to 1.78.1

0.12.6

This patch release:

  • Ensures that after successful JWS signature verification, an application-configured Base64Url Decoder output is used to construct a Jws instance (instead of JJWT's default decoder). See Issue 947.
  • Fixes a decompression memory leak in concurrent/multi-threaded environments introduced in 0.12.0 when decompressing JWTs with a zip header of GZIP. See Issue 949.
  • Upgrades BouncyCastle to 1.78 via PR 941.
  • Ensures that a JwkSet's keys list member is no longer considered secret and is not redacted by default. However, each individual JWK element within the keys list may still have redacted private or secret members as expected. See Issue 976.

0.12.5

This patch release:

  • Ensures that builders' NestedCollection changes are applied to the collection immediately as mutation methods are called, no longer

... (truncated)

Commits

Updates io.jsonwebtoken:jjwt-jackson from 0.11.5 to 0.13.0

Updates com.fasterxml.jackson.core:jackson-databind from 2.15.2 to 2.21.0

Commits

Updates com.fasterxml.jackson.core:jackson-core from 2.15.2 to 2.21.0

Commits
  • 80fb536 [maven-release-plugin] prepare release jackson-core-2.21.0
  • 9097789 Prep for 2.21.0 release
  • d678c69 Javadoc fix for StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION (defaults to `...
  • 67912b2 Minor improvement to UTF32Reader.read() bounds-checks
  • ecf5de2 ...
  • dbb1765 Merge branch '2.20' into 2.x
  • 66a9467 Merge branch '2.19' into 2.20
  • b46c0bd Merge branch '2.18' into 2.19
  • fae2542 release notes update
  • 70c99ba Update UTF8DataInputJsonParser.java (#1512)
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-annotations from 2.15.2 to 2.21.0

Updates com.fasterxml.jackson.core:jackson-core from 2.15.2 to 2.21.0

Commits
  • 80fb536 [maven-release-plugin] prepare release jackson-core-2.21.0
  • 9097789 Prep for 2.21.0 release
  • d678c69 Javadoc fix for StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION (defaults to `...
  • 67912b2 Minor improvement to UTF32Reader.read() bounds-checks
  • ecf5de2 ...
  • dbb1765 Merge branch '2.20' into 2.x
  • 66a9467 Merge branch '2.19' into 2.20
  • b46c0bd Merge branch '2.18' into 2.19
  • fae2542 release notes update
  • 70c99ba Update UTF8DataInputJsonParser.java (#1512)
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-annotations from 2.15.2 to 2.21.0

Updates io.github.resilience4j:resilience4j-bom from 2.1.0 to 2.3.0

Release notes

Sourced from io.github.resilience4j:resilience4j-bom's releases.

v2.3.0

Enhancements

  • Issue #2234: Allow passing custom Clock to CircuitBreaker without needing to use internal API.
  • Issue #2131: Added support for RxJava3 in Spring projects.
  • Issue #2029: Include decorateSupplier as a Retry instance method.
  • Issue #2246: Add handling for the case where a non-checked retry consumer is interrupted during sleep.
  • Issue #2245: Refactor Retry#executeSuspendExecute condition to enhance consistency with FlowRetry.
  • Issue #2232: Convert Synchronized to ReentrantLock to avoid virtual-thread pinning issues.
  • Issue #2241: Implement a lock-free sliding window for internal CircuitBreaker metrics.
  • Issue #2239: Add a Clock to CircuitBreakerConfig and utilize it in the state machine.
  • Issue #2200: Ignore unknown exceptions in CircuitBreaker configuration.
  • Issue #2233: Improve exception message for failure rate threshold in CircuitBreaker configuration.
  • Issue #1404: Configure exponential backoff or randomized wait duration if base configuration allows it.
  • Issue #2179: Ensure RateLimiter.executeSuspendFunction respects drainPermissionsOnResult in the configuration.
  • Issue #2152: Ensure the randomize function always returns a number greater than 1.0.
  • Issue #2130: Add support for Feign 12.5+.
  • Issue #2121: Specify required RateLimiter permits in annotations.

Bugs

  • Issue #2243: Fixed potential memory leak in DefaultEventConsumerRegistry.
  • Issue #2209: Resolved issue where CompletionStage does not complete on user-supplied predicate failures.
  • Issue #2190: Fixed StackOverflowError and circular reference in CircuitBreaker configuration handling.
  • Issue #2175: Fixed validation error message for slowCallDurationThreshold.

Release v2.2.0

Enhancements

  • Support Micronaut 4
  • Issue #1962: Added apache commons configuration based registries

Bugs

  • Issue #2052: Support class name using SpEL expression at @​Circuitbreaker name field enhancement
  • Issue #2040: ThreadPoolBulkhead always uses the "default" configuration in micronaut application bug
  • Issue #2037: Removing stale retry configurations from configuration map enhancement
  • Issue #1625: New module that collects overall information enhancement
  • Issue #1565: Do not retry if IntervalFunction returns interval less than 0
  • Issue #1865: Timelimiter always uses the "default" configuration in micronaut application
  • Issue #2038: java.lang.StackOverflowError due to infinite loop in CircuitBreakerStateMachine$OpenState.tryAcquirePermission
Changelog

Sourced from io.github.resilience4j:resilience4j-bom's changelog.

=== Version 2.1.0

==== Enhancements

  • Fallbackmethod supports usage of annotations in Spring
  • Issue #1955: RecordResultPredicate can be configured in Spring Boot config now

==== Bugs

  • Issue #1980: Fixed API regression following removal of io.vavr dependencies in v2.0.0

=== Version 2.2.0

==== Enhancements

  • Support Micronaut 4
  • Issue #1962: Added apache commons configuration based registries

==== Bugs

  • Issue #2052: Support class name using SpEL expression at @​Circuitbreaker name field enhancement
  • Issue #2040: ThreadPoolBulkhead always uses the "default" configuration in micronaut application bug
  • Issue #2037: Removing stale retry configurations from configuration map enhancement
  • Issue #1625: New module that collects overall information enhancement
  • Issue #1565: Do not retry if IntervalFunction returns interval less than 0
  • Issue #1865: Timelimiter always uses the "default" configuration in micronaut application
  • Issue #2038: java.lang.StackOverflowError due to infinite loop in CircuitBreakerStateMachine$OpenState.tryAcquirePermission

=== Version 2.3.0

==== Enhancements

  • Issue #2234: Allow passing custom Clock to CircuitBreaker without needing to use internal API.
  • Issue #2131: Added support for RxJava3 in Spring projects.
  • Issue #2029: Include decorateSupplier as a Retry instance method.
  • Issue #2246: Add handling for the case where a non-checked retry consumer is interrupted during sleep.
  • Issue #2245: Refactor Retry#executeSuspendExecute condition to enhance consistency with FlowRetry.
  • Issue #2232: Convert Synchronized to ReentrantLock to avoid virtual-thread pinning issues.
  • Issue #2241: Implement a lock-free sliding window for internal CircuitBreaker metrics.
  • Issue #2239: Add a Clock to CircuitBreakerConfig and utilize it in the state machin...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Feb 10, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) February 10, 2026 18:30
@dependabot
build(deps): bump the minor-and-patch group with 14 updates
4d517fa 
Bumps the minor-and-patch group with 14 updates:

| Package | From | To |
| --- | --- | --- |
| software.amazon.awssdk:bom | `2.21.29` | `2.41.25` |
| [com.azure:azure-storage-blob](https://github.com/Azure/azure-sdk-for-java) | `12.23.0` | `12.33.2` |
| [com.azure:azure-identity](https://github.com/Azure/azure-sdk-for-java) | `1.10.4` | `1.18.2` |
| [org.apache.httpcomponents.client5:httpclient5](https://github.com/apache/httpcomponents-client) | `5.2.1` | `5.6` |
| [io.jsonwebtoken:jjwt-api](https://github.com/jwtk/jjwt) | `0.11.5` | `0.13.0` |
| [io.jsonwebtoken:jjwt-impl](https://github.com/jwtk/jjwt) | `0.11.5` | `0.13.0` |
| io.jsonwebtoken:jjwt-jackson | `0.11.5` | `0.13.0` |
| [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson) | `2.15.2` | `2.21.0` |
| [com.fasterxml.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core) | `2.15.2` | `2.21.0` |
| com.fasterxml.jackson.core:jackson-annotations | `2.15.2` | `2.21.0` |
| [io.github.resilience4j:resilience4j-bom](https://github.com/resilience4j/resilience4j) | `2.1.0` | `2.3.0` |
| [com.github.tomakehurst:wiremock-jre8](https://github.com/wiremock/wiremock) | `2.35.0` | `2.35.2` |
| [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.1.2` | `3.5.4` |
| [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire) | `3.1.2` | `3.5.4` |


Updates `software.amazon.awssdk:bom` from 2.21.29 to 2.41.25

Updates `com.azure:azure-storage-blob` from 12.23.0 to 12.33.2
- [Release notes](https://github.com/Azure/azure-sdk-for-java/releases)
- [Commits](Azure/azure-sdk-for-java@azure-storage-blob_12.23.0...com.azure+azure-storage-blob_12.33.2)

Updates `com.azure:azure-identity` from 1.10.4 to 1.18.2
- [Release notes](https://github.com/Azure/azure-sdk-for-java/releases)
- [Commits](Azure/azure-sdk-for-java@azure-identity_1.10.4...com.azure+azure-identity_1.18.2)

Updates `org.apache.httpcomponents.client5:httpclient5` from 5.2.1 to 5.6
- [Changelog](https://github.com/apache/httpcomponents-client/blob/master/RELEASE_NOTES.txt)
- [Commits](apache/httpcomponents-client@rel/v5.2.1...rel/v5.6)

Updates `io.jsonwebtoken:jjwt-api` from 0.11.5 to 0.13.0
- [Release notes](https://github.com/jwtk/jjwt/releases)
- [Changelog](https://github.com/jwtk/jjwt/blob/master/CHANGELOG.md)
- [Commits](jwtk/jjwt@0.11.5...0.13.0)

Updates `io.jsonwebtoken:jjwt-impl` from 0.11.5 to 0.13.0
- [Release notes](https://github.com/jwtk/jjwt/releases)
- [Changelog](https://github.com/jwtk/jjwt/blob/master/CHANGELOG.md)
- [Commits](jwtk/jjwt@0.11.5...0.13.0)

Updates `io.jsonwebtoken:jjwt-jackson` from 0.11.5 to 0.13.0

Updates `io.jsonwebtoken:jjwt-impl` from 0.11.5 to 0.13.0
- [Release notes](https://github.com/jwtk/jjwt/releases)
- [Changelog](https://github.com/jwtk/jjwt/blob/master/CHANGELOG.md)
- [Commits](jwtk/jjwt@0.11.5...0.13.0)

Updates `io.jsonwebtoken:jjwt-jackson` from 0.11.5 to 0.13.0

Updates `com.fasterxml.jackson.core:jackson-databind` from 2.15.2 to 2.21.0
- [Commits](https://github.com/FasterXML/jackson/commits)

Updates `com.fasterxml.jackson.core:jackson-core` from 2.15.2 to 2.21.0
- [Commits](FasterXML/jackson-core@jackson-core-2.15.2...jackson-core-2.21.0)

Updates `com.fasterxml.jackson.core:jackson-annotations` from 2.15.2 to 2.21.0

Updates `com.fasterxml.jackson.core:jackson-core` from 2.15.2 to 2.21.0
- [Commits](FasterXML/jackson-core@jackson-core-2.15.2...jackson-core-2.21.0)

Updates `com.fasterxml.jackson.core:jackson-annotations` from 2.15.2 to 2.21.0

Updates `io.github.resilience4j:resilience4j-bom` from 2.1.0 to 2.3.0
- [Release notes](https://github.com/resilience4j/resilience4j/releases)
- [Changelog](https://github.com/resilience4j/resilience4j/blob/master/RELEASENOTES.adoc)
- [Commits](resilience4j/resilience4j@v2.1.0...v2.3.0)

Updates `com.github.tomakehurst:wiremock-jre8` from 2.35.0 to 2.35.2
- [Release notes](https://github.com/wiremock/wiremock/releases)
- [Commits](wiremock/wiremock@2.35.0...2.35.2)

Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.1.2 to 3.5.4
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.1.2...surefire-3.5.4)

Updates `org.apache.maven.plugins:maven-failsafe-plugin` from 3.1.2 to 3.5.4
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.1.2...surefire-3.5.4)

---
updated-dependencies:
- dependency-name: software.amazon.awssdk:bom
  dependency-version: 2.41.25
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: com.azure:azure-storage-blob
  dependency-version: 12.33.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: com.azure:azure-identity
  dependency-version: 1.18.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: org.apache.httpcomponents.client5:httpclient5
  dependency-version: '5.6'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: io.jsonwebtoken:jjwt-api
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: io.jsonwebtoken:jjwt-impl
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: io.jsonwebtoken:jjwt-jackson
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: io.jsonwebtoken:jjwt-impl
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: io.jsonwebtoken:jjwt-jackson
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: com.fasterxml.jackson.core:jackson-core
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: com.fasterxml.jackson.core:jackson-annotations
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: com.fasterxml.jackson.core:jackson-core
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: com.fasterxml.jackson.core:jackson-annotations
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: io.github.resilience4j:resilience4j-bom
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: com.github.tomakehurst:wiremock-jre8
  dependency-version: 2.35.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-version: 3.5.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-failsafe-plugin
  dependency-version: 3.5.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/maven/develop/minor-and-patch-4b0ec7a721 branch from d3e0648 to 4d517fa Compare February 11, 2026 18:17
@ancongui ancongui closed this Feb 11, 2026
auto-merge was automatically disabled February 11, 2026 21:17

Pull request was closed

@dependabot @github

dependabot Bot commented on behalf of github Feb 11, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@ancongui
ancongui deleted the dependabot/maven/develop/minor-and-patch-4b0ec7a721 branch February 11, 2026 21:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ancongui