dependabot[bot] opened a new pull request, #2864: URL: https://github.com/apache/shiro/pull/2864
Bumps the maven-dependencies group with 15 updates: | Package | From | To | | --- | --- | --- | | [org.apache.groovy:groovy-all](https://github.com/apache/groovy) | `5.0.8` | `5.1.0` | | [org.apache.groovy:groovy](https://github.com/apache/groovy) | `5.0.8` | `5.1.0` | | [com.puppycrawl.tools:checkstyle](https://github.com/checkstyle/checkstyle) | `13.9.0` | `13.10.0` | | [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) | `1.6.1` | `1.6.3` | | [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.6.1` | `1.6.3` | | [com.google.guava:guava](https://github.com/google/guava) | `33.6.0-jre` | `33.7.1-jre` | | org.apache.tomcat.embed:tomcat-embed-core | `11.0.24` | `11.0.25` | | org.apache.tomcat.embed:tomcat-embed-el | `11.0.24` | `11.0.25` | | org.apache.tomcat.embed:tomcat-embed-websocket | `11.0.24` | `11.0.25` | | org.apache.tomcat:tomcat-jaspic-api | `11.0.24` | `11.0.25` | | org.apache.tomcat:tomcat-catalina | `11.0.24` | `11.0.25` | | org.apache.tomcat:tomcat-jasper | `11.0.24` | `11.0.25` | | org.apache.tomcat:tomcat-jasper-el | `11.0.24` | `11.0.25` | | [io.openliberty.tools:liberty-maven-plugin](https://github.com/OpenLiberty/ci.maven) | `3.12.1` | `3.12.2` | | org.apache.maven:apache-maven | `3.9.12` | `3.9.16` | Updates `org.apache.groovy:groovy-all` from 5.0.8 to 5.1.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/apache/groovy/commits";>compare view</a></li> </ul> </details> <br /> Updates `org.apache.groovy:groovy` from 5.0.8 to 5.1.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/apache/groovy/commits";>compare view</a></li> </ul> </details> <br /> Updates `com.puppycrawl.tools:checkstyle` from 13.9.0 to 13.10.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/checkstyle/checkstyle/releases";>com.puppycrawl.tools:checkstyle's releases</a>.</em></p> <blockquote> <h2>checkstyle-13.10.0</h2> <p>Checkstyle 13.10.0 - <a href="https://checkstyle.org/releasenotes.html#Release_13.10.0";>https://checkstyle.org/releasenotes.html#Release_13.10.0</a></p> <p>Breaking backward compatibility:</p> <p><a href="https://redirect.github.com/checkstyle/checkstyle/issues/5744";>#5744</a> - JavadocVariable MissingJavadocMethod MissingJavadocType: Expand Javadoc violation messages to include named context.</p> <p>New:</p> <p><a href="https://redirect.github.com/checkstyle/checkstyle/issues/21071";>#21071</a> - WriteTag: new messages when violation is on method. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/19991";>#19991</a> - NonEmptyAtclauseDescription should to validate since tags. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/17841";>#17841</a> - New Check: GoogleMethodName to fix false-negative on method names with underscores. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21079";>#21079</a> - New Check: IllegalBlockTag. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/20987";>#20987</a> - New check: JavadocRegexp. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/18064";>#18064</a> - New check: ArrayBracketWhitespace. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/18420";>#18420</a> - New Check: GoogleMethodNameCheck to enforce Google Java Style Guide method naming.</p> <p>Bug fixes:</p> <p><a href="https://redirect.github.com/checkstyle/checkstyle/issues/20995";>#20995</a> - Add MultilineCommentLeadingAsteriskPresence check to google_checks.xml. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/3469";>#3469</a> - JavadocMethod: check for duplicate parameter block tags. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/20972";>#20972</a> - Javadoc parse error on HTML comment with a line ending in a hyphen. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/19931";>#19931</a> - Documentation Comments Style Guide - Contents of package.html source file. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/18842";>#18842</a> - google_checks.xml incorrectly marks return inlined tag as violation from SummaryJavadoc. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/19925";>#19925</a> - Documentation Comments Style Guide - Custom Tags and Annotations. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/19919";>#19919</a> - Documentation Comments Style Guide - <code>@</code>param. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/19808";>#19808</a> - Add checks for Documentation Comments Style Guide - Notes.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/checkstyle/checkstyle/commit/a9eec044ee8f72cc19260c18c6de294493981228";><code>a9eec04</code></a> [maven-release-plugin] prepare release checkstyle-13.10.0</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/1b9b260b361196d3cb5ab87620d32dd18ae5d6a3";><code>1b9b260</code></a> doc: release notes for 13.10.0</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/dfa2dc855f93465a10daa9439aff84c382ad44a1";><code>dfa2dc8</code></a> Issue <a href="https://redirect.github.com/checkstyle/checkstyle/issues/20514";>#20514</a>: Code changes for enabling toc in website</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/1d9666fba1e135f0784175f7d3a90b38b17c6960";><code>1d9666f</code></a> Issue <a href="https://redirect.github.com/checkstyle/checkstyle/issues/20514";>#20514</a>: Added xml and xml template toc changes</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/b7091072f2bed8a014ab8af839881195f1b175f7";><code>b709107</code></a> Issue <a href="https://redirect.github.com/checkstyle/checkstyle/issues/17841";>#17841</a>: Add GoogleMethodName to google_checks</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/ec377193b849b866ac780901c4cc3078e2b25d39";><code>ec37719</code></a> Issue <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21119";>#21119</a>: Fix duplicate violation behavior in examples: methodname</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/13f477f9213fbec60bc77973d3f07cbbe7c5b8ab";><code>13f477f</code></a> minor: Update expected size in XmlMetaReaderTest</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/2c40ae65a7eb3b4b5e7cfca79dee19445e593ab8";><code>2c40ae6</code></a> Issue <a href="https://redirect.github.com/checkstyle/checkstyle/issues/20995";>#20995</a>: Add MultilineCommentLeadingAsteriskPresence to google_checks</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/913f6cf106eb1f120fc2979b7e110d32cb0cdfd8";><code>913f6cf</code></a> Issue <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21119";>#21119</a>: Fix duplicate violation behavior in examples: typename</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/91a7bf2f3ad609bb447a85467c288e34e270558c";><code>91a7bf2</code></a> Issue <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21079";>#21079</a>: New Check IllegalBlockTag</li> <li>Additional commits viewable in <a href="https://github.com/checkstyle/checkstyle/compare/checkstyle-13.9.0...checkstyle-13.10.0";>compare view</a></li> </ul> </details> <br /> Updates `org.apache.groovy:groovy` from 5.0.8 to 5.1.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/apache/groovy/commits";>compare view</a></li> </ul> </details> <br /> Updates `ch.qos.logback:logback-core` from 1.6.1 to 1.6.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/qos-ch/logback/releases";>ch.qos.logback:logback-core's releases</a>.</em></p> <blockquote> <h2>Logback 1.6.3</h2> <h1>2026-08-14 Release of logback version 1.6.3</h1> <ul> <li> <p>In response <a href="https://www.cve.org/cverecord?id=CVE-2026-19880";>CVE-2026-19880</a>, <code>MDCBasedDiscriminator</code> (used by <code>SiftingAppender</code>) now strips forward and backward slashes (<code>/</code>, <code>\</code>) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).</p> </li> <li> <p>Colour console support is split out into a dedicated <a href="https://logback.qos.ch/manual/appenders.html#JansiConsoleAppender";><code>JansiConsoleAppender</code></a>. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the <a href="https://logback.qos.ch/manual/appenders.html#JansiConsoleAppender";>appenders documentation</a>.</p> </li> <li> <p>The <code>withJansi</code> property on <code>ConsoleAppender</code> is <strong>deprecated</strong>. Existing configurations that still set <code><withJansi>true</withJansi></code> continue to work for compatibility, but new setups should use <code>JansiConsoleAppender</code> instead.</p> </li> <li> <p><code>ConsoleAppender</code> no longer treats the process console as an exclusive resource: stopping it does not close <code>System.out</code> / <code>System.err</code>. <code>JansiConsoleAppender</code> pairs each <code>AnsiConsole.systemInstall()</code> with <code>systemUninstall()</code> on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for <a href="https://redirect.github.com/qos-ch/logback/issues/1063";>issues/1063</a>.</p> </li> <li> <p>Invocation throttling helpers were reworked: <code>SimpleInvocationGate</code> is renamed <code>FixedIntervalInvocationGate</code>, and <code>BatchedFixedIntervalInvocationGate</code> allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.</p> </li> <li> <p>The JPMS <code>module-info</code> for logback-core now exports the <code>ch.qos.logback.core.property</code> package, which had been missing from the module descriptor.</p> </li> <li> <p>A bit-wise identical binary of this version can be reproduced by building from <a href="https://github.com/qos-ch/logback";>source code</a> at commit <code>e8e824dede022a6d7208b36cfa875b0d1b7772f3</code> associated with the tag <code>v_1.6.3</code>. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> </li> </ul> <h2>Logback 1.6.2</h2> <p><a href="https://github.com/user-attachments/assets/9ceaf157-b758-4188-815d-edfe4e1b4edd";>https://github.com/user-attachments/assets/9ceaf157-b758-4188-815d-edfe4e1b4edd</a></p> <h1>2026-08-10 Release of logback version 1.6.2</h1> <ul> <li> <p>Configuration analysis now detects <em>contradictory caller-data inclusion instructions</em>. For example, an <code>AsyncAppender</code>, <code>SocketAppender</code> or <code>SMTPAppender</code> with <code>includeCallerData</code> left at the default <code>false</code> is incompatible with a layout or encoder pattern that uses a caller-data converter such as <code>%C</code>, <code>%M</code>, <code>%L</code>, <code>%F</code>, <code>%l</code> or <code>%caller</code>. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See <a href="https://logback.qos.ch/codes.html#callerContradiction";>codes.html#callerContradiction</a> for details. This issue was reported in <a href="https://redirect.github.com/qos-ch/logback/issues/1059";>issues/1059</a> by <a href="https://github.com/leeychee";>leeychee</a>. The initial analysis was contributed by <a href="https:/ /github.com/seonwooj0810">seonwoo_jung</a>.</p> </li> <li> <p>Caller-contradiction analysis can be turned off by setting the <code>logback.skipCallerContradictionAnalysis</code> variable to <code>true</code>, either as a system property (<code>-Dlogback.skipCallerContradictionAnalysis=true</code>) or as a property in the configuration file:</p> <pre lang="xml"><code><property name="logback.skipCallerContradictionAnalysis" value="true"/> </code></pre> </li> <li> <p><code>SimpleSocketServer</code> and <code>SimpleSSLSocketServer</code> now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with <code>addAllowedClientAddress(String)</code> or <code>setAllowedClientAddresses(Collection)</code> before clients connect. See the documentation on <a href="https://logback.qos.ch/manual/appenders.html#simpleSocketServerClientAccess";>restricting client access</a>.</p> </li> <li> <p>Added <code>ThrowableProxyVOBuilder</code> for assembling a <code>ThrowableProxyVO</code> field by field, with a corresponding <code>ThrowableProxyVO.builder()</code> entry point.</p> </li> <li> <p>Dependency analysis handlers now run their <code>postHandle</code> method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.</p> </li> <li> <p>Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.</p> </li> <li> <p>A bit-wise identical binary of this version can be reproduced by building from <a href="https://github.com/qos-ch/logback";>source code</a> at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag <code>v_1.6.2</code>. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/qos-ch/logback/commit/e8e824dede022a6d7208b36cfa875b0d1b7772f3";><code>e8e824d</code></a> prepare release 1.6.3</li> <li><a href="https://github.com/qos-ch/logback/commit/761821bfaacac3a0ad44fa546cfc814429bf9312";><code>761821b</code></a> MDCBasedDiscriminator has a gated warning mechanism</li> <li><a href="https://github.com/qos-ch/logback/commit/53ed1229008d8b1902f5c234deaa07d742890879";><code>53ed122</code></a> update copyright year</li> <li><a href="https://github.com/qos-ch/logback/commit/c7e2db244671ffa916182b5da8c89579eb54a645";><code>c7e2db2</code></a> rename SimpleInvocationGate as FixedIntervalInvocationGate</li> <li><a href="https://github.com/qos-ch/logback/commit/b5aa931b096a4b0b6a9e140b74fabe7da152cbf0";><code>b5aa931</code></a> added BatchedSimpleInvocationGate</li> <li><a href="https://github.com/qos-ch/logback/commit/1f22af7686aadd25c08b4bd1e6943a906a743ad4";><code>1f22af7</code></a> add javadocs to SimpleInvocationGate</li> <li><a href="https://github.com/qos-ch/logback/commit/638ffa7e7852478b605a91b3e91238ff26f8158c";><code>638ffa7</code></a> prevent forward and backward slashes to escape to other directories</li> <li><a href="https://github.com/qos-ch/logback/commit/7d6b9a4f8c8996834c0a694f6c141705a003d7bb";><code>7d6b9a4</code></a> add missing ch.qos.logback.core.property package</li> <li><a href="https://github.com/qos-ch/logback/commit/fa25930346f35636fb6a077c1f66ebb06edd3b6f";><code>fa25930</code></a> add an extension path in ConsoleAppender for JansiConsoleAppender</li> <li><a href="https://github.com/qos-ch/logback/commit/c73b43f2011f9d4545abc7ea461172276a0a43b3";><code>c73b43f</code></a> deprecate the withJansi path</li> <li>Additional commits viewable in <a href="https://github.com/qos-ch/logback/compare/v_1.6.1...v_1.6.3";>compare view</a></li> </ul> </details> <br /> Updates `ch.qos.logback:logback-classic` from 1.6.1 to 1.6.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/qos-ch/logback/releases";>ch.qos.logback:logback-classic's releases</a>.</em></p> <blockquote> <h2>Logback 1.6.3</h2> <h1>2026-08-14 Release of logback version 1.6.3</h1> <ul> <li> <p>In response <a href="https://www.cve.org/cverecord?id=CVE-2026-19880";>CVE-2026-19880</a>, <code>MDCBasedDiscriminator</code> (used by <code>SiftingAppender</code>) now strips forward and backward slashes (<code>/</code>, <code>\</code>) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).</p> </li> <li> <p>Colour console support is split out into a dedicated <a href="https://logback.qos.ch/manual/appenders.html#JansiConsoleAppender";><code>JansiConsoleAppender</code></a>. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the <a href="https://logback.qos.ch/manual/appenders.html#JansiConsoleAppender";>appenders documentation</a>.</p> </li> <li> <p>The <code>withJansi</code> property on <code>ConsoleAppender</code> is <strong>deprecated</strong>. Existing configurations that still set <code><withJansi>true</withJansi></code> continue to work for compatibility, but new setups should use <code>JansiConsoleAppender</code> instead.</p> </li> <li> <p><code>ConsoleAppender</code> no longer treats the process console as an exclusive resource: stopping it does not close <code>System.out</code> / <code>System.err</code>. <code>JansiConsoleAppender</code> pairs each <code>AnsiConsole.systemInstall()</code> with <code>systemUninstall()</code> on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for <a href="https://redirect.github.com/qos-ch/logback/issues/1063";>issues/1063</a>.</p> </li> <li> <p>Invocation throttling helpers were reworked: <code>SimpleInvocationGate</code> is renamed <code>FixedIntervalInvocationGate</code>, and <code>BatchedFixedIntervalInvocationGate</code> allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.</p> </li> <li> <p>The JPMS <code>module-info</code> for logback-core now exports the <code>ch.qos.logback.core.property</code> package, which had been missing from the module descriptor.</p> </li> <li> <p>A bit-wise identical binary of this version can be reproduced by building from <a href="https://github.com/qos-ch/logback";>source code</a> at commit <code>e8e824dede022a6d7208b36cfa875b0d1b7772f3</code> associated with the tag <code>v_1.6.3</code>. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> </li> </ul> <h2>Logback 1.6.2</h2> <p><a href="https://github.com/user-attachments/assets/9ceaf157-b758-4188-815d-edfe4e1b4edd";>https://github.com/user-attachments/assets/9ceaf157-b758-4188-815d-edfe4e1b4edd</a></p> <h1>2026-08-10 Release of logback version 1.6.2</h1> <ul> <li> <p>Configuration analysis now detects <em>contradictory caller-data inclusion instructions</em>. For example, an <code>AsyncAppender</code>, <code>SocketAppender</code> or <code>SMTPAppender</code> with <code>includeCallerData</code> left at the default <code>false</code> is incompatible with a layout or encoder pattern that uses a caller-data converter such as <code>%C</code>, <code>%M</code>, <code>%L</code>, <code>%F</code>, <code>%l</code> or <code>%caller</code>. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See <a href="https://logback.qos.ch/codes.html#callerContradiction";>codes.html#callerContradiction</a> for details. This issue was reported in <a href="https://redirect.github.com/qos-ch/logback/issues/1059";>issues/1059</a> by <a href="https://github.com/leeychee";>leeychee</a>. The initial analysis was contributed by <a href="https:/ /github.com/seonwooj0810">seonwoo_jung</a>.</p> </li> <li> <p>Caller-contradiction analysis can be turned off by setting the <code>logback.skipCallerContradictionAnalysis</code> variable to <code>true</code>, either as a system property (<code>-Dlogback.skipCallerContradictionAnalysis=true</code>) or as a property in the configuration file:</p> <pre lang="xml"><code><property name="logback.skipCallerContradictionAnalysis" value="true"/> </code></pre> </li> <li> <p><code>SimpleSocketServer</code> and <code>SimpleSSLSocketServer</code> now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with <code>addAllowedClientAddress(String)</code> or <code>setAllowedClientAddresses(Collection)</code> before clients connect. See the documentation on <a href="https://logback.qos.ch/manual/appenders.html#simpleSocketServerClientAccess";>restricting client access</a>.</p> </li> <li> <p>Added <code>ThrowableProxyVOBuilder</code> for assembling a <code>ThrowableProxyVO</code> field by field, with a corresponding <code>ThrowableProxyVO.builder()</code> entry point.</p> </li> <li> <p>Dependency analysis handlers now run their <code>postHandle</code> method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.</p> </li> <li> <p>Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.</p> </li> <li> <p>A bit-wise identical binary of this version can be reproduced by building from <a href="https://github.com/qos-ch/logback";>source code</a> at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag <code>v_1.6.2</code>. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/qos-ch/logback/commit/e8e824dede022a6d7208b36cfa875b0d1b7772f3";><code>e8e824d</code></a> prepare release 1.6.3</li> <li><a href="https://github.com/qos-ch/logback/commit/761821bfaacac3a0ad44fa546cfc814429bf9312";><code>761821b</code></a> MDCBasedDiscriminator has a gated warning mechanism</li> <li><a href="https://github.com/qos-ch/logback/commit/53ed1229008d8b1902f5c234deaa07d742890879";><code>53ed122</code></a> update copyright year</li> <li><a href="https://github.com/qos-ch/logback/commit/c7e2db244671ffa916182b5da8c89579eb54a645";><code>c7e2db2</code></a> rename SimpleInvocationGate as FixedIntervalInvocationGate</li> <li><a href="https://github.com/qos-ch/logback/commit/b5aa931b096a4b0b6a9e140b74fabe7da152cbf0";><code>b5aa931</code></a> added BatchedSimpleInvocationGate</li> <li><a href="https://github.com/qos-ch/logback/commit/1f22af7686aadd25c08b4bd1e6943a906a743ad4";><code>1f22af7</code></a> add javadocs to SimpleInvocationGate</li> <li><a href="https://github.com/qos-ch/logback/commit/638ffa7e7852478b605a91b3e91238ff26f8158c";><code>638ffa7</code></a> prevent forward and backward slashes to escape to other directories</li> <li><a href="https://github.com/qos-ch/logback/commit/7d6b9a4f8c8996834c0a694f6c141705a003d7bb";><code>7d6b9a4</code></a> add missing ch.qos.logback.core.property package</li> <li><a href="https://github.com/qos-ch/logback/commit/fa25930346f35636fb6a077c1f66ebb06edd3b6f";><code>fa25930</code></a> add an extension path in ConsoleAppender for JansiConsoleAppender</li> <li><a href="https://github.com/qos-ch/logback/commit/c73b43f2011f9d4545abc7ea461172276a0a43b3";><code>c73b43f</code></a> deprecate the withJansi path</li> <li>Additional commits viewable in <a href="https://github.com/qos-ch/logback/compare/v_1.6.1...v_1.6.3";>compare view</a></li> </ul> </details> <br /> Updates `com.google.guava:guava` from 33.6.0-jre to 33.7.1-jre <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/guava/releases";>com.google.guava:guava's releases</a>.</em></p> <blockquote> <h2>33.7.1</h2> <h3>Maven</h3> <pre lang="xml"><code><dependency> <groupId>com.google.guava</groupId> <artifactId>guava</artifactId> <version>33.7.1-jre</version> <!-- or, for Android: --> <version>33.7.1-android</version> </dependency> </code></pre> <h3>Jar files</h3> <ul> <li><a href="https://repo1.maven.org/maven2/com/google/guava/guava/33.7.1-jre/guava-33.7.1-jre.jar";>33.7.1-jre.jar</a></li> <li><a href="https://repo1.maven.org/maven2/com/google/guava/guava/33.7.1-android/guava-33.7.1-android.jar";>33.7.1-android.jar</a></li> </ul> <p>Guava requires <a href="https://github.com/google/guava/wiki/UseGuavaInYourBuild#what-about-guavas-own-dependencies";>one runtime dependency</a>, which you can download here:</p> <ul> <li><a href="https://repo1.maven.org/maven2/com/google/guava/failureaccess/1.0.3/failureaccess-1.0.3.jar";>failureaccess-1.0.3.jar</a></li> </ul> <h3>Javadoc</h3> <ul> <li><a href="https://guava.dev/releases/33.7.1-jre/api/docs/";>33.7.1-jre</a></li> <li><a href="https://guava.dev/releases/33.7.1-android/api/docs/";>33.7.1-android</a></li> </ul> <h3>JDiff</h3> <ul> <li><a href="https://guava.dev/releases/33.7.1-jre/api/diffs/";>33.7.1-jre vs. 33.7.0-jre</a></li> <li><a href="https://guava.dev/releases/33.7.1-android/api/diffs/";>33.7.1-android vs. 33.7.0-android</a></li> <li><a href="https://guava.dev/releases/33.7.1-android/api/androiddiffs/";>33.7.1-android vs. 33.7.1-jre</a></li> </ul> <h3>Changelog</h3> <p>Guava 33.7.1 removes the <code>Multi-Release</code> line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to <code>guava-jre</code> in version 33.7.0. Sorry for the trouble.</p> <h2>33.7.0</h2> <h3>Newly introduced problem for Java 9 and Java 10 only</h3> <p>Guava 33.7.0 includes a <code>Multi-Release</code> line in its jar manifest, even though it is no longer a multi-release jar. This causes <a href="https://redirect.github.com/google/guava/issues/8614";>some problems with tools from Java 9 and Java 10</a>. The issue is fixed in <a href="https://github.com/google/guava/releases/tag/v33.7.1";>version 33.7.1</a>. Sorry for the trouble.</p> <h3>Maven</h3> <pre lang="xml"><code><dependency> <groupId>com.google.guava</groupId> <artifactId>guava</artifactId> <version>33.7.0-jre</version> <!-- or, for Android: --> </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/google/guava/commits";>compare view</a></li> </ul> </details> <br /> Updates `org.apache.tomcat.embed:tomcat-embed-core` from 11.0.24 to 11.0.25 Updates `org.apache.tomcat.embed:tomcat-embed-el` from 11.0.24 to 11.0.25 Updates `org.apache.tomcat.embed:tomcat-embed-websocket` from 11.0.24 to 11.0.25 Updates `org.apache.tomcat:tomcat-jaspic-api` from 11.0.24 to 11.0.25 Updates `org.apache.tomcat:tomcat-catalina` from 11.0.24 to 11.0.25 Updates `org.apache.tomcat:tomcat-jasper` from 11.0.24 to 11.0.25 Updates `org.apache.tomcat:tomcat-jasper-el` from 11.0.24 to 11.0.25 Updates `org.apache.tomcat.embed:tomcat-embed-el` from 11.0.24 to 11.0.25 Updates `org.apache.tomcat.embed:tomcat-embed-websocket` from 11.0.24 to 11.0.25 Updates `org.apache.tomcat:tomcat-jaspic-api` from 11.0.24 to 11.0.25 Updates `org.apache.tomcat:tomcat-catalina` from 11.0.24 to 11.0.25 Updates `io.openliberty.tools:liberty-maven-plugin` from 3.12.1 to 3.12.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/OpenLiberty/ci.maven/releases";>io.openliberty.tools:liberty-maven-plugin's releases</a>.</em></p> <blockquote> <h2>Liberty Maven Plug-in 3.12.2</h2> <p>Version 3.12.2 of the Liberty Maven Plugin is a minor release with a bug fix</p> <h2>What's Changed</h2> <ul> <li>When <code><mergeServerEnv>true</mergeServerEnv> </code>was enabled, all backslashes () in server.env values were silently converted to forward slashes, breaking Windows paths like LIBERTY_INSTALL_DIR and JAVA_HOME. Values are now written verbatim by default.</li> <li>A new <a href="https://github.com/OpenLiberty/ci.maven/blob/3.x/docs/common-server-parameters.md";>convertServerEnvPathSeparator</a> parameter (default false) restores the old conversion for users who relied on it. Only applies when mergeServerEnv is true.</li> </ul> <p>See the <a href="https://github.com/OpenLiberty/ci.maven/compare/liberty-maven-3.12.1...liberty-maven-3.12.2";>commit log</a> for the full set of the changes since the previous release.</p> <p>The Liberty Maven Plugin 3.12.2 release is available on the <a href="https://central.sonatype.com/artifact/io.openliberty.tools/liberty-maven-plugin/3.12.2";>Maven Central</a> repository.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/OpenLiberty/ci.maven/commit/3fb7a767e991f5326778e8ffcecf5a810c96adb6";><code>3fb7a76</code></a> [maven-release-plugin] prepare release liberty-maven-3.12.2</li> <li><a href="https://github.com/OpenLiberty/ci.maven/commit/211eceefc9acca4af5cb873e1ca360d9546ef0a5";><code>211ecee</code></a> Merge pull request <a href="https://redirect.github.com/OpenLiberty/ci.maven/issues/2079";>#2079</a> from venmanyarun/fix/merge-server-env-windows-path-c...</li> <li><a href="https://github.com/OpenLiberty/ci.maven/commit/a42d8f3066f99a03e0d376fd2b75446ad7b351d5";><code>a42d8f3</code></a> Add boolean flag convertServerEnvPathSeparator (default false) to</li> <li><a href="https://github.com/OpenLiberty/ci.maven/commit/1cce29f30fef1eef44e4b185de56dc4073980e47";><code>1cce29f</code></a> updated tests</li> <li><a href="https://github.com/OpenLiberty/ci.maven/commit/5699009c81041c7097721ebe290d11ec79de1d1a";><code>5699009</code></a> removing replace backslash altogether</li> <li><a href="https://github.com/OpenLiberty/ci.maven/commit/cb3fb75d11102c59b233a21e3c40e13fca96aec1";><code>cb3fb75</code></a> adding overlapping scenario</li> <li><a href="https://github.com/OpenLiberty/ci.maven/commit/3ad2854b9b6e199c475dd1ff57a39db5c15189d3";><code>3ad2854</code></a> added logic to preserve property order since expansion variable needs that</li> <li><a href="https://github.com/OpenLiberty/ci.maven/commit/a7bb53a2795968fc85866490c89e8a9037b7e058";><code>a7bb53a</code></a> Extends merge-server-env-it to verify that writeServerEnvProperties()</li> <li><a href="https://github.com/OpenLiberty/ci.maven/commit/95870e89000a0ce700cb92867ebcd5a5237c821d";><code>95870e8</code></a> fix: preserve backslashes in server.env values when mergeServerEnv=true</li> <li><a href="https://github.com/OpenLiberty/ci.maven/commit/5f66c0adfb6c531ff0854ecc30b75e028d83f484";><code>5f66c0a</code></a> [maven-release-plugin] prepare for next development iteration</li> <li>See full diff in <a href="https://github.com/OpenLiberty/ci.maven/compare/liberty-maven-3.12.1...liberty-maven-3.12.2";>compare view</a></li> </ul> </details> <br /> Updates `org.apache.tomcat:tomcat-jasper` from 11.0.24 to 11.0.25 Updates `org.apache.tomcat:tomcat-jasper-el` from 11.0.24 to 11.0.25 Updates `org.apache.maven:apache-maven` from 3.9.12 to 3.9.16 Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
