[12.1.x EE10] Bump the dev-dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the dev-dependencies group with 7 updates in the /jetty-ee10 directory:

Package	From	To
com.fasterxml.jackson:jackson-bom	2.22.2	2.22.3
ch.qos.logback:logback-core	1.6.3	1.6.4
com.google.guava:guava	33.7.1-jre	33.7.2-jre
io.smallrye.common:smallrye-common-annotation	2.20.0	2.21.1
io.smallrye.common:smallrye-common-cpu	2.20.0	2.21.1
org.apache.commons:commons-lang3	3.20.0	3.21.0
org.hibernate.models:hibernate-models	1.3.3	1.3.4

Updates com.fasterxml.jackson:jackson-bom from 2.22.2 to 2.22.3

Commits

• 9b1c380 [maven-release-plugin] prepare release jackson-bom-2.22.3
• f76ca14 Prep for 2.22.3 release
• d6ac108 Merge branch '2.21' into 2.22
• 093a05e Post-release dep version bump
• e7a71a2 [maven-release-plugin] prepare for next development iteration
• 62d4d51 [maven-release-plugin] prepare release jackson-bom-2.21.7
• 6171b54 Prep for 2.21.7 release
• 6702bf3 Merge branch '2.20' into 2.21
• 2feb1f9 Merge branch '2.19' into 2.20
• 1129aa0 Merge branch '2.18' into 2.19
• Additional commits viewable in compare view

Updates ch.qos.logback:logback-core from 1.6.3 to 1.6.4

Release notes

Sourced from ch.qos.logback:logback-core's releases.

Logback 1.6.4

2026-09-24 Release of logback version 1.6.4

• Variable substitution is again applied to the scan attribute of the <configuration> element. The scanning refactoring in version 1.5.27 had dropped substitution, so values such as ${logback.scan.enabled:-true} were no longer resolved. As before version 1.5.27, an unrecognized non-empty value turns scanning on. The same substitution now applies to the scan attribute of <propertiesConfigurator>. This regression was reported in issues/1065 by vaibhavjain2.

• OutputStreamAppender and FileAppender now handle stateful encoders. The Encoder interface has a new default method called isStateful(), which returns false. An encoder that keeps state between calls to encode() can return true. For such encoders, the appender holds its write lock while encoding and while writing, so the output of concurrent appends cannot interleave. Stateless encoders still encode outside the lock, so their performance does not change. Existing encoders need no changes.

• Several race conditions in OutputStreamAppender and FileAppender were fixed. The appender is now marked started and the encoder header is written while the same lock is held, so a concurrent append can no longer write an event before the header. After acquiring the lock, the appender checks again whether it has been stopped, so no event is written after the footer. In prudent mode, FileAppender now encodes and writes each event while holding the lock.

• Fixed a data race on the logger count in LoggerContext. Loggers are created under the lock of their parent logger, so loggers with different parents could be created at the same time and increments of the shared counter could be lost. As a result, LoggerContext.size() could return a value lower than the actual number of loggers. The counter is now an AtomicInteger. This issue was reported in issues/1038 by hcantunc. The fix was contributed in PR #1055 by seonwoo_jung.

• TimeBasedRollingPolicy now supports half-day periods. Date patterns with the AM/PM marker, for example %d{yyyy-MM-dd-a}, used to be detected as daily and rolled over only at midnight. They now roll over at both 00:00 and 12:00. This issue was reported in issues/976 by shakthifuture. The fix was contributed in PR #1051 by seonwoo_jung. See TimeBasedRollingPolicy.

• If org.jline.jansi.AnsiConsole cannot be found on the class path, JansiConsoleAppender now emits warnings that explain how to add org.jline:jansi-core and then writes to the plain console stream. See codes.html#missingJlineJansi.

• The unused ch.qos.logback.classic.util.LogbackMDCAdapterSimple class was removed. LogbackMDCAdapter remains the default MDC adapter.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 07d291ca0d280bc5da934ec9ff5f1da634fd7937 associated with the tag v_1.6.4. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Full Changelog: qos-ch/logback@v_1.6.3...v_1.6.4

Commits

• 07d291c preapre release 1.6.4
• 9627daf revert to Collections.unmodifiableMap instead of
• aa42fb5 disabled RollingCalendarTest#testVaryingNumberOfHalfDailyPeriods to shave off...
• ddc7459 Support HALF_DAY periodicity for AM/PM date patterns
• 42d75d7 disable LoggerContextTest#concurrentGetLoggerKeepsSizeConsistent to shave exe...
• bffd55e add warnings about missing jline.jansi classes
• 8de0b9b Fix data race on LoggerContext.size (#1038)
• 76c73d1 add MinimalUnmodifiableMap and return it in LogbackMDCAdapter#getPropertyMap
• a2c416a Fix formatting of email instruction in README
• 2c89727 mailing lists have been deactivated
• Additional commits viewable in compare view

Updates com.google.guava:guava from 33.7.1-jre to 33.7.2-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.2

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.2-jre</version>
  <!-- or, for Android: -->
  <version>33.7.2-android</version>
</dependency>

Jar files

• 33.7.2-jre.jar
• 33.7.2-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.2-jre
• 33.7.2-android

JDiff

• 33.7.2-jre vs. 33.7.1-jre
• 33.7.2-android vs. 33.7.1-android
• 33.7.2-android vs. 33.7.2-jre

Changelog

• collect: Changed MapMaker, CompactHashMap, and CompactHashSet deserialization to avoid eagerly allocating as much memory as a serialization payload requests. (a0d0c36432)

Commits

• See full diff in compare view

Updates io.smallrye.common:smallrye-common-annotation from 2.20.0 to 2.21.1

Release notes

Sourced from io.smallrye.common:smallrye-common-annotation's releases.

2.21.1

No release notes provided.

2.21.0

• #580 3.0.0

Commits

• a04d030 [maven-release-plugin] prepare release 2.21.1
• 30b7478 Merge pull request #611 from smallrye/release-2.21.1
• 8533f4c Release 2.21.1
• 052a737 Merge pull request #610 from dmlloyd/perm-ordering
• aaa8185 Fix permission bits ordering bug
• 2ba50a0 Merge pull request #609 from dmlloyd/class-path-utils
• 9952a4b Merge pull request #608 from dmlloyd/archive-file
• 310294b Fix nested JAR behavior
• 049232a Fix argument validation issue in archive file resources
• 818722a [maven-release-plugin] prepare for next development iteration
• Additional commits viewable in compare view

Updates io.smallrye.common:smallrye-common-cpu from 2.20.0 to 2.21.1

Release notes

Sourced from io.smallrye.common:smallrye-common-cpu's releases.

2.21.1

No release notes provided.

2.21.0

• #580 3.0.0

Commits

• a04d030 [maven-release-plugin] prepare release 2.21.1
• 30b7478 Merge pull request #611 from smallrye/release-2.21.1
• 8533f4c Release 2.21.1
• 052a737 Merge pull request #610 from dmlloyd/perm-ordering
• aaa8185 Fix permission bits ordering bug
• 2ba50a0 Merge pull request #609 from dmlloyd/class-path-utils
• 9952a4b Merge pull request #608 from dmlloyd/archive-file
• 310294b Fix nested JAR behavior
• 049232a Fix argument validation issue in archive file resources
• 818722a [maven-release-plugin] prepare for next development iteration
• Additional commits viewable in compare view

Updates org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0

Updates org.hibernate.models:hibernate-models from 1.3.3 to 1.3.4

Release notes

Sourced from org.hibernate.models:hibernate-models's releases.

Release 1.3.4

Changelog

• c6d9dde [Jenkins release job] Preparing release 1.3.4 (Jenkins)
• 63551db Return null from determineContainingPackageName() for classes in the default package (Yoann Rodière)
• 09f6d00 Return empty array instead of null from MissingPackageInfoDetails.getRepeatedAnnotationUsages() (Yoann Rodière)
• 89f2faa [Jenkins release job] Preparing next development iteration (Jenkins)
• 2a09091 [Jenkins release job] Preparing release 1.3.3 (Jenkins)
• 79b71fb #306 - Add a new resolveExplicitPackageDetails() method (Steve Ebersole)
• 63e72cb [Jenkins release job] Preparing next development iteration (Jenkins)
• 450ad25 [Jenkins release job] Preparing release 1.3.2 (Jenkins)
• f5d12a0 #301 - Support JPA 4 proposal for distinct class, package and module source categories (Steve Ebersole)
• c957a66 [Jenkins release job] Preparing next development iteration (Jenkins)
• 2badb1d [Jenkins release job] Preparing release 1.3.1 (Jenkins)
• 2c4b0d8 Index package-to-module relationship in JandexModuleDetailsRegistry (Yoann Rodière)
• 055b0d5 Add ClassDetails.getPackage() (Yoann Rodière)
• 1990031 Add ClassDetails.getModule() (Yoann Rodière)
• 025e5b7 #294 - Cache (potentially missing) package details (Steve Ebersole)
• b7c84c0 #294 - Cache (potentially missing) package details (Steve Ebersole)
• 905b0cd [Jenkins release job] Preparing next development iteration (Jenkins)
• 9bf799b [Jenkins release job] Preparing release 1.3.0 (Jenkins)
• 331f38d #186 - Generic array type details resolution leads to partially resolved type (Steve Ebersole)

Contributors

We'd like to thank the following people for their contributions: Jenkins, Steve Ebersole, Yoann Rodière

Visit the website for details on getting in touch with us.

Commits

• c6d9dde [Jenkins release job] Preparing release 1.3.4
• 63551db Return null from determineContainingPackageName() for classes in the default ...
• 09f6d00 Return empty array instead of null from MissingPackageInfoDetails.getRepeated...
• 89f2faa [Jenkins release job] Preparing next development iteration
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions