Skip to content

build(deps): bump ai.djl:bom from 0.36.0 to 0.38.0 - #1444

Closed
dependabot[bot] wants to merge 1 commit into
developmentfrom
dependabot/maven/ai.djl-bom-0.37.0
Closed

build(deps): bump ai.djl:bom from 0.36.0 to 0.38.0#1444
dependabot[bot] wants to merge 1 commit into
developmentfrom
dependabot/maven/ai.djl-bom-0.37.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps ai.djl:bom from 0.36.0 to 0.38.0.

Release notes

Sourced from ai.djl:bom's releases.

DJL v0.38.0 Release

What's Changed

Full Changelog: deepjavalibrary/djl@v0.37.0...v0.38.0

DJL v0.37.0 Release

This is the v0.37.0 release of DJL.

Changes

  • Bundled .java compilation and remote URL loading are now configurable, with tightened defaults (#3875)
  • Bumped log4j to 2.26.0 (#3877)
  • onnxruntime: allow sub-managers after NDManager.cap() (#3870)
  • Docs: fixed a typo (#3874)

Behavior changes

Two loading behaviors changed their defaults in #3875. Both previous behaviors remain available, but from this release each has to be enabled explicitly:

Behavior Default To restore
Compile bundled .java sources at model load off DJL_COMPILE_JAVA=true or -Dai.djl.compile_java=true
Unrestricted remote URL loading off DJL_ALLOW_INSECURE_URL=true or -Dai.djl.allow_insecure_url=true

Utils.openUrl now limits remote fetches to public http(s) destinations, resolves redirects explicitly with a bounded hop count, and allows file: and jar: only where they denote a local read. Loading from local directories, s3://, gs://, public http(s) archives, the djl:// model zoo and Hugging Face is unchanged. See the PR description for the full list and the flags.

Known issues / limitations

  • A model whose translator is available only as a raw .java file under lib/classes/ will not have it compiled by default; an error-level log names the flag. Models shipping a precompiled .class or .jar, or supplying a translator programmatically, are unaffected.
  • Loading a model over http(s) from a host that resolves to a private address now fails by default. Set the flag above if you serve models from an internal mirror.

Contributors

Thank you to the following community members for contributing to this release:

Rohit Kumar Srivastava, Vaibhav Srivastava, dev_Hakaze

Commits
  • 41ff6b2 Remove -SNAPSHOT for release v0.38.0
  • 502671e Increase DJL version to 0.38.0
  • c838756 [ci] Fix native library build pipeline (#3881)
  • ffd4719 [ci] Upgrade actions version (#3880)
  • 46787b3 Increase build version to 0.38.0 (#3879)
  • dee55bf Use 64-bit arithmetic for tensor buffer size calculations (#3876)
  • 1cb7449 [build] Bump log4j to 2.26.0 (#3877)
  • 02b4111 [api] Make bundled Java compilation opt-in and restrict remote URL loading (#...
  • e263d0d [docs] fix typo benifit -> benefit (#3874)
  • 1d6e058 fix(onnxruntime): allow sub-managers after NDManager.cap() (#3870)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Sep 21, 2026
@github-actions

github-actions Bot commented Sep 21, 2026

Copy link
Copy Markdown

Submodule Changes

@dependabot
dependabot Bot force-pushed the dependabot/maven/ai.djl-bom-0.37.0 branch 3 times, most recently from 04e5e74 to 6cae35d Compare September 21, 2026 13:57
c-dilks
c-dilks reviewed Sep 21, 2026
View reviewed changes
Comment thread pom.xml Outdated
<groupId>ai.djl</groupId>
<artifactId>bom</artifactId>
<version>0.36.0</version> <!-- WARNING: if changed, check the `com.google.code.gson:gson` version; see `docs/dependency_conflicts.md` -->
<version>0.37.0</version> <!-- WARNING: if changed, check the `com.google.code.gson:gson` version; see `docs/dependency_conflicts.md` -->

@c-dilks c-dilks Sep 21, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mathieu usually validated this bump; we either need someone else in RG-L to do this, or to lock to 0.36.0.

@dependabot
dependabot Bot force-pushed the dependabot/maven/ai.djl-bom-0.37.0 branch from 6cae35d to 2486040 Compare September 22, 2026 12:32
@dependabot
build(deps): bump ai.djl:bom from 0.36.0 to 0.38.0
90709d0 
Bumps [ai.djl:bom](https://github.com/deepjavalibrary/djl) from 0.36.0 to 0.38.0.
- [Release notes](https://github.com/deepjavalibrary/djl/releases)
- [Commits](deepjavalibrary/djl@v0.36.0...v0.38.0)

---
updated-dependencies:
- dependency-name: ai.djl:bom
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump ai.djl:bom from 0.36.0 to 0.37.0 build(deps): bump ai.djl:bom from 0.36.0 to 0.38.0 Sep 28, 2026
@dependabot
dependabot Bot force-pushed the dependabot/maven/ai.djl-bom-0.37.0 branch from 2486040 to 90709d0 Compare September 28, 2026 03:45
@dependabot @github

dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #1457.

@dependabot dependabot Bot closed this Sep 28, 2026
@dependabot
dependabot Bot deleted the dependabot/maven/ai.djl-bom-0.37.0 branch September 28, 2026 07:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@c-dilks c-dilks c-dilks left review comments
@baltzell baltzell Awaiting requested review from baltzell baltzell is a code owner
@raffaelladevita raffaelladevita Awaiting requested review from raffaelladevita raffaelladevita is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@c-dilks