Skip to content

Bump the java-dependencies group across 1 directory with 11 updates - #3

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/java-dependencies-a1dc0cef9c
Open

Bump the java-dependencies group across 1 directory with 11 updates#3
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/java-dependencies-a1dc0cef9c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the java-dependencies group with 11 updates in the / directory:

Package From To
io.qameta.allure 2.12.0 4.1.0
io.freefair.lombok 8.13 9.5.0
com.diffplug.spotless 8.8.0 8.9.0
com.github.ben-manes.versions 0.54.0 0.60.0
org.gradle.toolchains.foojay-resolver-convention 0.10.0 1.0.0
com.fasterxml.jackson:jackson-bom 2.19.2 2.22.1
com.zaxxer:HikariCP 6.3.0 7.1.0
com.mysql:mysql-connector-j 9.3.0 26.7.0
org.slf4j:slf4j-api 2.0.17 2.0.18
ch.qos.logback:logback-classic 1.5.18 1.6.1
gradle-wrapper 8.14.3 9.7.0

Updates io.qameta.allure from 2.12.0 to 4.1.0

Updates io.freefair.lombok from 8.13 to 9.5.0

Release notes

Sourced from io.freefair.lombok's releases.

9.5.0

What's Changed

New Contributors

Full Changelog: freefair/gradle-plugins@9.4.0...9.5.0

9.4.0

What's Changed

... (truncated)

Commits
  • f24a7d5 Merge pull request #1755 from freefair/dependabot/gradle/examples/main/org.sp...
  • 278081c fix deprecation warnings
  • a1cf246 Merge pull request #1754 from dtrunk90/fix/delombok-sourcepath-for-modules
  • 91dbece Merge branch 'main' of github.com:freefair/gradle-plugins
  • 88570fc fix checkstyle
  • 9ad981d Bump org.springframework.boot:spring-boot-dependencies in /examples (#1756)
  • 7bf9d6e Bump org.graalvm.buildtools.native from 1.0.0 to 1.1.0 in /examples (#1758)
  • f527dd0 fix javadoc link config
  • 27901ff Update to Gradle 9.5.0
  • 8cfe90c Bump org.springframework.boot from 4.0.5 to 4.0.6 in /examples (#1757)
  • Additional commits viewable in compare view

Updates com.diffplug.spotless from 8.8.0 to 8.9.0

Updates com.github.ben-manes.versions from 0.54.0 to 0.60.0

Updates org.gradle.toolchains.foojay-resolver-convention from 0.10.0 to 1.0.0

Updates com.fasterxml.jackson:jackson-bom from 2.19.2 to 2.22.1

Commits
  • b749a0c [maven-release-plugin] prepare release jackson-bom-2.22.1
  • 569073f Prep for 2.22.1 release
  • 87627b1 Merge branch '2.21' into 2.22
  • da540ae Post-release dep version bump
  • 5f0462e [maven-release-plugin] prepare for next development iteration
  • 252ea90 [maven-release-plugin] prepare release jackson-bom-2.21.5
  • 0bbea7f Prep for 2.21.5 release
  • f6c940d Post-release dep version bump
  • 31cfc40 [maven-release-plugin] prepare for next development iteration
  • 112e859 [maven-release-plugin] prepare release jackson-bom-2.22.0
  • Additional commits viewable in compare view

Updates com.zaxxer:HikariCP from 6.3.0 to 7.1.0

Changelog

Sourced from com.zaxxer:HikariCP's changelog.

HikariCP Changes

Changes in 7.1.0

  • merged #2402 avoid virtual-thread yield spin in ConcurrentBag. Thanks to @​ittaigolde for addressing this and deep investigation into the issue.

Changes in 7.0.2

  • decrease thread yield frequency in ConcurrentBag.unreserve()

Changes in 7.0.1

  • merged #2346 fix regression with setSchema behavior

  • decrease thread yield frequency in ConcurrentBag.requite()

Changes in 7.0.0

  • merged #2340 NoSuchMethodException error that is thrown when setting a metric registry, fixes to UtilityElf reflection code to use the correct method signature.

  • fixed #1294 add support for HikariCredentialsProvider class

  • fixed #2265 bail out of the pool filling loop if the thread is interrupted

Changes in 6.3.3

  • backport #2340 NoSuchMethodException error that is thrown when setting a metric registry, fixes to UtilityElf reflection code to use the correct method signature.

Changes in 6.3.2

  • fixed #2342 restore module-info.class to jar file, which was lost in 6.3.1

  • fixed #2256 add support for legacy override of getUsername()/getPassword() of HikariDataSource. See project page for documentation of system property com.zaxxer.hikari.legacy.supportUserPassDataSourceOverride.

  • fixed #2323 right or wrong (wrt driver behavior) return to previous Connection.get/setSchema behavior

  • fixed #2288 upgrade dependencies and fix build warnings

Changes in 6.3.1

  • fixed #2315 source jar contains also binary .class files and missing some .java files

  • fixed #2307 remove improper hardcoded timout, use validationTimeout

  • fixed #2305 keep properties key and values as is rather than forcing stringification. Also fixes #2286 and #2304

... (truncated)

Commits
  • e4c04e8 [maven-release-plugin] prepare release HikariCP-7.1.0
  • b7c5afe upgrade fabric8 docker dependency for tests
  • 315ab1c update testcontainer dependency and postgresql test dependency
  • a400521 fix compiler warnings
  • 37167dc prepare for v7.1.0 release
  • 5e63223 Avoid virtual-thread yield spin in ConcurrentBag (#2402)
  • bba167f Update README.md
  • 62d720b update CHANGES for backport release 6.3.3, fix micrometrics dep version
  • c3a2473 Update README.md
  • 25663ef [maven-release-plugin] prepare for next development iteration
  • Additional commits viewable in compare view

Updates com.mysql:mysql-connector-j from 9.3.0 to 26.7.0

Changelog

Sourced from com.mysql:mysql-connector-j's changelog.

Changelog

https://dev.mysql.com/doc/relnotes/connector-j/en/

Version 26.7.0

  • Fix for Bug#39449361, LOAD DATA LOCAL INFILE accepts ambiguous Windows file URL path forms.

  • Fix for Bug#39328305, X Protocol reader does not validate server-supplied frame length before allocation.

  • Fix for Bug#39327277, Restrict SSL keystore loading to local file inputs.

  • Fix for Bug#39320456, Unexpected behavior with LOAD DATA LOCAL INFILE and connection options.

  • Fix for Bug#120227 (Bug#39204043), LOAD DATA LOCAL INFILE: missing EOF packet on IOException leaves server thread hanging.

  • Fix for Bug#120096 (Bug#39125648), MysqlConnector/Java Connection Url CharacterEncoding bug. Thanks to Rahman Rejepov for his contribution.

Version 9.7.0

  • Fix for Bug#119863 (Bug#38951042), Inaccurate decoding of negative TIME durations in Binary Protocol (Cursor Mode).

  • WL#17215, Implement JDBC 4.3/4.5 Statement/Connection.enquote* methods.

  • Fix for Bug#119245 (Bug#38599240), Select into fix breaks queries with 'into' in them. (reopened)

  • Fix for Bug#119659 (Bug#38916595), BinaryResultsetReader fails to consume EOF packet after column definitions when EOF is not deprecated.

Version 9.6.0

  • Fix for Bug#118002 (Bug#37843004), The setFetchSize() method in the Statement class may have a potential bug.

  • Fix for Bug#113130 (Bug#36043125), getGeneratedKeys() returns a zero resultset with non-key-generating statements.

  • Fix for Bug#113336 (Bug#36080226), Inconsistent getUpdateCount() Behavior with allowMultiQueries.

  • Fix for Bug#118234 (Bug#37975837), A potential bugs in Mysql Connector/J.

  • Fix for Bug#113413 (Bug#36107426), Connection.changeUser cannot be done after DriverManager.loginTimeout elapses. Thanks to Kazuhisa Kawashima for his contribution.

  • Fix for Bug#119271 (Bug#38599496), Connector/J fails to accept legacy value zeroDateTimeBehavior=convertToNull on multi-host URLs (failover).

  • Fix for Bug#119245 (Bug#38599240), Select into fix breaks queries with 'into' in them.

Version 9.5.0

  • Fix for Bug#72036 (Bug#18403804), XA isSameRM() shouldn't take database into account.

  • Fix for Bug#62693 (Bug#16722068), XAConnection savepoint capability.

... (truncated)

Commits
  • 559f62d Update for GPL license book.
  • e2a58f7 Update for .gitignore with exclusion rules for codex files.
  • 373584a Fix for Bug#39449361, LOAD DATA LOCAL INFILE accepts ambiguous Windows file U...
  • 1ed6f37 Fix for Bug#39328305, X Protocol reader does not validate server-supplied fra...
  • 55a2860 Fix for Bug#39327277, Restrict SSL keystore loading to local file inputs.
  • 9ce460a Update for CalVer numbering scheme.
  • 20e1e5d Update for README, README.md and CONTRIBUTING.md files.
  • f40d3be Post-release version bump for CalVer numbering scheme.
  • 61cf1f6 Fix for Bug#39320456, Unexpected behavior with LOAD DATA LOCAL INFILE and con...
  • 2c2d139 Fix for Bug#120227 (Bug#39204043), LOAD DATA LOCAL INFILE: missing EOF packet...
  • Additional commits viewable in compare view

Updates org.slf4j:slf4j-api from 2.0.17 to 2.0.18

Updates ch.qos.logback:logback-classic from 1.5.18 to 1.6.1

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

• On GZ, ZIP, or XZ compression failure, the original (uncompressed) log file is no longer deleted. Compression strategies now delete the source file only after successful compression and emit a warning that the original was left intact.

• ConsoleAppender with now probes JLine's org.jline.jansi.AnsiConsole first and falls back to the legacy FuseSource org.fusesource.jansi.AnsiConsole class. This keeps ANSI coloring working after Jansi moved under the JLine project. The optional org.jline:jansi-core artifact is declared as a dependency alongside the existing FuseSource jansi dependency. A preferredJansiClassName property was added for tests. This issue was reported in issues/1043 by seonwoo_jung who also provided the relevant PR.

• LayoutWrappingEncoder now reports an error at start() when no layout is set and guards encode() against a null layout. Previously, a missing layout (for example after an ignored // branch) allowed the encoder to start and then fail with a NullPointerException on every event, resulting in silent log loss. This issue was reported in issues/1046 by seonwoo_jung who also provided the relevant PR.

• FileCollisionAnalyser now detects file collisions involving nested appenders of SiftingAppender. When the nested file or fileNamePattern does not textually reference the discriminator key (e.g. ${userId}), a warning is issued at configuration time naming the appender, the key, and the shared target. This closes a gap where statically declared file appenders were checked but sifted nested appenders were not. This enhancement was contributed in [PR #1041](qos-ch/logback#1041) by seonwoo_jung.

• More defensive handling in SyslogOutputStream and SyslogAppenderBase: the close() method now ensures that resources are closed, writes and flushes check that the underlying resources are in a valid state and fallback to no-op otherwise.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 57759f433000a133088ef0441038963134437fbd associated with the tag v_1.6.1. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

• See https://logback.qos.ch/news.html#1.6.1 for the original text.

Logback 1.6.0

2026-07-23 Release of logback version 1.6.0

• Removed certain deprecated variables, methods, and classes. For the list of removed members see release_1.6.0.txt.

• In AsyncAppenderBase, the put(ILoggingEvent) method now has the protected modifier to allow access from derived classes. This change was requested by Thomas Skjølberg in pr#1053.

• Bump SLF4J dependency to version 2.0.18.

• See also the overview of the 1.6.x series.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit b07adf36019b51a10f824fdd94009985c587b1d3 associated with the tag v_1.6.0. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.38

2026-07-09 Release of logback version 1.5.38

• In HardenedObjectInputStream, fixed a typo preventing Throwable objects from being white-filtered. This issue was reported in [PR #1045](qos-ch/logback#1045) by t0rchwo0d.

• A bitwise identical binary of this version can be reproduced by building from source code at commit d04984a41fce42977466f45a2f076f0ee5cc4207 associated with the tag v_1.5.38. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.37

2026-06-26 Release of logback version 1.5.37

  1. • Given the numerous vulnerabilities related to conditional configuration processing based on the evaluation of Java expressions using the Janino library, support for such expressions has been removed. Users are offered the an online migration service or the <condition> element introduced in version 1.5.20. See the relevant documentation for more details.

• A bitwise identical binary of this version can be reproduced by building from source code at commit c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag v_1.5.37. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.36

2026-06-25 Release of logback version 1.5.36

• The 'condition' attribute in <if> elements now reject certain references that are associated with ACE attacks. This issue was reported by "yulate" (yulate531@gmail.com.com) and registered as CVE-2026-13006. Please note that version 1.5.37 provides the full fix to this vulnerability.

... (truncated)

Commits
  • 57759f4 prepare release 1.6.1
  • 175f99f fix imports
  • 4b8773e add compressionFailureLeavesOriginalFileIntact test for XZ compression
  • cafaf11 do not delete original file if compression fails
  • ee50125 let the temporary file before compression be target file without the .gz or ....
  • 5626acc minor refactoring
  • d97da4f minor refactoring
  • 159c045 more defensive coding in SyslogOutputStream and in SyslogAppenderBase
  • 9427d6b slight refactoring for clarity
  • 79c4179 slight refactoring
  • Additional commits viewable in compare view

Updates gradle-wrapper from 8.14.3 to 9.7.0

Release notes

Sourced from gradle-wrapper's releases.

9.7.0

The Gradle team is excited to announce Gradle 9.7.0.

Here are the highlights of this release:

  • Isolated Projects graduates to incubating
  • Broader Configuration Cache compatibility
  • More source locations in problem reports

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Adam, Aman Gautam, Aman Kumar, Anton Dubrouski, Aurimas, gbhavya07, Josh Friend, nicklauslittle-gov, Pragati, project516, Qin Mi, Ravi, sk-reddy17, Suvrat Acharya, Yongshun Ye.

Upgrade instructions

Switch your build to use Gradle 9.7.0 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.7.0 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

9.7.0 RC3

The Gradle team is excited to announce Gradle 9.7.0 RC3.

Here are the highlights of this release:

  • Isolated Projects graduates to incubating

... (truncated)

Commits
  • 3defbfc make DistributionIntegrationSpec more permissive for releases (#38766)
  • f176043 make DistributionIntegrationSpec more permissive for releases
  • b0828da Prepare release notes for Gradle 9.7.0GA (#38756)
  • 064b6d6 cleanup
  • dfe7bdc add new training to release notes
  • 7561968 add release notes for 37801
  • 68a1f35 cherrypick 38367 to release
  • a462c95 Rebalance AllVersionsCrossVersion buckets for agents without TestDistribution...
  • 820e2b1 Update Gradle wrapper to version 9.7.0-rc-3 (#38743)
  • 75ea3d7 Update Gradle wrapper to version 9.7.0-rc-3
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Aug 3, 2026
@dependabot
Bump the java-dependencies group across 1 directory with 11 updates
d3f04e8 
Bumps the java-dependencies group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| io.qameta.allure | `2.12.0` | `4.1.0` |
| [io.freefair.lombok](https://github.com/freefair/gradle-plugins) | `8.13` | `9.5.0` |
| com.diffplug.spotless | `8.8.0` | `8.9.0` |
| com.github.ben-manes.versions | `0.54.0` | `0.60.0` |
| org.gradle.toolchains.foojay-resolver-convention | `0.10.0` | `1.0.0` |
| [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) | `2.19.2` | `2.22.1` |
| [com.zaxxer:HikariCP](https://github.com/brettwooldridge/HikariCP) | `6.3.0` | `7.1.0` |
| [com.mysql:mysql-connector-j](https://github.com/mysql/mysql-connector-j) | `9.3.0` | `26.7.0` |
| org.slf4j:slf4j-api | `2.0.17` | `2.0.18` |
| [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.5.18` | `1.6.1` |
| [gradle-wrapper](https://github.com/gradle/gradle) | `8.14.3` | `9.7.0` |



Updates `io.qameta.allure` from 2.12.0 to 4.1.0

Updates `io.freefair.lombok` from 8.13 to 9.5.0
- [Release notes](https://github.com/freefair/gradle-plugins/releases)
- [Commits](freefair/gradle-plugins@8.13...9.5.0)

Updates `com.diffplug.spotless` from 8.8.0 to 8.9.0

Updates `com.github.ben-manes.versions` from 0.54.0 to 0.60.0

Updates `org.gradle.toolchains.foojay-resolver-convention` from 0.10.0 to 1.0.0

Updates `com.fasterxml.jackson:jackson-bom` from 2.19.2 to 2.22.1
- [Commits](FasterXML/jackson-bom@jackson-bom-2.19.2...jackson-bom-2.22.1)

Updates `com.zaxxer:HikariCP` from 6.3.0 to 7.1.0
- [Changelog](https://github.com/brettwooldridge/HikariCP/blob/dev/CHANGES)
- [Commits](brettwooldridge/HikariCP@HikariCP-6.3.0...HikariCP-7.1.0)

Updates `com.mysql:mysql-connector-j` from 9.3.0 to 26.7.0
- [Changelog](https://github.com/mysql/mysql-connector-j/blob/trunk/CHANGES)
- [Commits](mysql/mysql-connector-j@9.3.0...26.7.0)

Updates `org.slf4j:slf4j-api` from 2.0.17 to 2.0.18

Updates `ch.qos.logback:logback-classic` from 1.5.18 to 1.6.1
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.5.18...v_1.6.1)

Updates `gradle-wrapper` from 8.14.3 to 9.7.0
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](gradle/gradle@v8.14.3...v9.7.0)

---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: java-dependencies
- dependency-name: com.diffplug.spotless
  dependency-version: 8.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: java-dependencies
- dependency-name: com.fasterxml.jackson:jackson-bom
  dependency-version: 2.22.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: java-dependencies
- dependency-name: com.github.ben-manes.versions
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: java-dependencies
- dependency-name: com.mysql:mysql-connector-j
  dependency-version: 26.7.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: java-dependencies
- dependency-name: com.zaxxer:HikariCP
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: java-dependencies
- dependency-name: gradle-wrapper
  dependency-version: 9.6.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: java-dependencies
- dependency-name: io.freefair.lombok
  dependency-version: 9.5.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: java-dependencies
- dependency-name: io.qameta.allure
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: java-dependencies
- dependency-name: org.gradle.toolchains.foojay-resolver-convention
  dependency-version: 1.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: java-dependencies
- dependency-name: org.slf4j:slf4j-api
  dependency-version: 2.0.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: java-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/gradle/java-dependencies-a1dc0cef9c branch from f728c7f to d3f04e8 Compare August 10, 2026 02:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants