dependabot[bot] opened a new pull request, #2878: URL: https://github.com/apache/shiro/pull/2878
Bumps the maven-dependencies group with 28 updates: | Package | From | To | | --- | --- | --- | | [org.easymock:easymock](https://github.com/easymock/easymock) | `5.6.0` | `5.7.0` | | [net.bytebuddy:byte-buddy](https://github.com/raphw/byte-buddy) | `1.18.11` | `1.18.12` | | [net.bytebuddy:byte-buddy-agent](https://github.com/raphw/byte-buddy) | `1.18.11` | `1.18.12` | | [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) | `1.6.1` | `1.6.3` | | [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.6.1` | `1.6.3` | | [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java) | `1.85` | `1.85.2` | | [com.mycila:license-maven-plugin](https://github.com/mathieucarbou/license-maven-plugin) | `5.1.1` | `5.1.2` | | [org.owasp:dependency-check-maven](https://github.com/dependency-check/DependencyCheck) | `12.2.2` | `13.0.0` | | org.apache.tomcat.embed:tomcat-embed-core | `9.0.120` | `9.0.121` | | org.apache.tomcat.embed:tomcat-embed-el | `9.0.120` | `9.0.121` | | org.apache.tomcat.embed:tomcat-embed-websocket | `9.0.120` | `9.0.121` | | org.apache.tomcat:tomcat-jaspic-api | `9.0.120` | `9.0.121` | | org.apache.tomcat:tomcat-catalina | `9.0.120` | `9.0.121` | | org.apache.cxf:cxf-rt-frontend-jaxrs | `3.6.11` | `3.6.12` | | [org.omnifaces:omnifaces](https://github.com/omnifaces/omnifaces) | `3.14.23` | `3.14.24` | | [org.jsoup:jsoup](https://github.com/jhy/jsoup) | `1.22.2` | `1.23.2` | | org.apache.cxf:cxf-bom | `3.6.11` | `3.6.12` | | org.apache.cxf:cxf-rt-rs-client | `3.6.11` | `3.6.12` | | [io.openliberty.tools:liberty-maven-plugin](https://github.com/OpenLiberty/ci.maven) | `3.12.1` | `3.12.3` | | [org.javassist:javassist](https://github.com/jboss-javassist/javassist) | `3.32.0-GA` | `3.33.0-GA` | | org.apache.tomcat.embed:tomcat-embed-core | `10.1.57` | `10.1.59` | | org.apache.tomcat.embed:tomcat-embed-el | `10.1.57` | `10.1.59` | | org.apache.tomcat.embed:tomcat-embed-websocket | `10.1.57` | `10.1.59` | | org.apache.tomcat:tomcat-jaspic-api | `10.1.57` | `10.1.59` | | org.apache.tomcat:tomcat-catalina | `10.1.57` | `10.1.59` | | org.apache.tomcat:tomcat-jasper | `10.1.57` | `10.1.59` | | org.apache.tomcat:tomcat-jasper-el | `10.1.57` | `10.1.59` | | org.apache.maven:apache-maven | `3.9.12` | `3.9.16` | Updates `org.easymock:easymock` from 5.6.0 to 5.7.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/easymock/easymock/releases";>org.easymock:easymock's releases</a>.</em></p> <blockquote> <h2>5.7.0</h2> <p>Add Java 26 support where bytebuddy isn't using unsafe anymore.</p> <h2>Change log</h2> <ul> <li>Add mock() methods without parameters using varargs reification (<a href="https://redirect.github.com/easymock/easymock/issues/933";>#933</a>)</li> <li>Mock creation fails with JDK 26 and ByteBuddy 1.18.10 (<a href="https://redirect.github.com/easymock/easymock/issues/908";>#908</a>)git log --oneline</li> <li>Use new Maven central plugin</li> <li>Use a github_token instead</li> <li>Add the missing REST calls to fully automated the release</li> <li>Move to .mvn style version</li> <li>Use assertThrows all over the place</li> <li>Optimize imports and finish updating to JUnit 5</li> <li>Update eclipse configuration</li> <li>Move all to UTF-8 like it should already be</li> <li>Use https for xsd</li> <li>Update objenesis to 3.6</li> <li>Update copyrights to 2026</li> <li>Remove Hamcrest usage</li> <li>Add Maven cache</li> <li>Bump actions/checkout from 7.0.0 to 7.0.1 (<a href="https://redirect.github.com/easymock/easymock/pull/917";>#917</a>)</li> <li>Bump actions/github-script from 8 to 9 (<a href="https://redirect.github.com/easymock/easymock/pull/887";>#887</a>)</li> <li>Bump actions/setup-java from 5.6.0 to 5.7.0 (<a href="https://redirect.github.com/easymock/easymock/pull/918";>#918</a>)</li> <li>Bump activesupport from 8.1.2 to 8.1.2.1 in /website (<a href="https://redirect.github.com/easymock/easymock/pull/882";>#882</a>)</li> <li>Bump addressable from 2.8.8 to 2.9.0 in /website (<a href="https://redirect.github.com/easymock/easymock/pull/886";>#886</a>)</li> <li>Bump ch.qos.logback:logback-classic from 1.3.14 to 1.6.3 (<a href="https://redirect.github.com/easymock/easymock/pull/930";>#930</a>)</li> <li>Bump com.github.spotbugs:spotbugs from 4.8.6 to 4.10.3 (<a href="https://redirect.github.com/easymock/easymock/pull/921";>#921</a>)</li> <li>Bump com.github.spotbugs:spotbugs-maven-plugin from 4.8.6.6 to 4.10.3.0 (<a href="https://redirect.github.com/easymock/easymock/pull/922";>#922</a>)</li> <li>Bump com.mycila:license-maven-plugin from 4.6 to 5.1.1 (<a href="https://redirect.github.com/easymock/easymock/pull/919";>#919</a>)</li> <li>Bump com.puppycrawl.tools:checkstyle from 13.9.0 to 13.11.0 (<a href="https://redirect.github.com/easymock/easymock/pull/931";>#931</a>)</li> <li>Bump concurrent-ruby from 1.3.6 to 1.3.7 in /website (<a href="https://redirect.github.com/easymock/easymock/pull/913";>#913</a>)</li> <li>Bump faraday from 2.14.2 to 2.14.3 in /website (<a href="https://redirect.github.com/easymock/easymock/pull/912";>#912</a>)</li> <li>Bump json from 2.20.0 to 2.21.2 in /website (<a href="https://redirect.github.com/easymock/easymock/pull/924";>#924</a>)</li> <li>Bump junit.jupiter.version from 5.14.1 to 6.1.3 (<a href="https://redirect.github.com/easymock/easymock/pull/926";>#926</a>)</li> <li>Bump net.bytebuddy:byte-buddy from 1.18.8 to 1.18.12 (<a href="https://redirect.github.com/easymock/easymock/pull/932";>#932</a>)</li> <li>Bump nokogiri from 1.19.3 to 1.19.4 in /website (<a href="https://redirect.github.com/easymock/easymock/pull/911";>#911</a>)</li> <li>Bump org.apache.felix:maven-bundle-plugin from 5.1.9 to 6.1.0 (<a href="https://redirect.github.com/easymock/easymock/pull/929";>#929</a>)</li> <li>Bump org.apache.maven.plugins:maven-assembly-plugin from 3.7.1 to 3.8.0 (<a href="https://redirect.github.com/easymock/easymock/pull/832";>#832</a>)</li> <li>Bump org.apache.maven.plugins:maven-compiler-plugin from 3.14.1 to 3.15.0 (<a href="https://redirect.github.com/easymock/easymock/pull/863";>#863</a>)</li> <li>Bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 (<a href="https://redirect.github.com/easymock/easymock/pull/899";>#899</a>)</li> <li>Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.2 to 3.6.3 (<a href="https://redirect.github.com/easymock/easymock/pull/894";>#894</a>)</li> <li>Bump org.apache.maven.plugins:maven-jar-plugin from 3.4.2 to 3.5.0 (<a href="https://redirect.github.com/easymock/easymock/pull/833";>#833</a>)</li> <li>Bump org.apache.maven.plugins:maven-resources-plugin from 3.4.0 to 3.5.0 (<a href="https://redirect.github.com/easymock/easymock/pull/879";>#879</a>)</li> <li>Bump org.apache.maven.plugins:maven-shade-plugin from 3.6.1 to 3.6.2 (<a href="https://redirect.github.com/easymock/easymock/pull/880";>#880</a>)</li> <li>Bump org.apache.maven.plugins:maven-source-plugin from 3.3.1 to 3.4.0 (<a href="https://redirect.github.com/easymock/easymock/pull/837";>#837</a>)</li> <li>Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 (<a href="https://redirect.github.com/easymock/easymock/pull/900";>#900</a>)</li> <li>Bump org.apache.maven.plugins:maven-toolchains-plugin from 3.2.0 to 3.3.0 (<a href="https://redirect.github.com/easymock/easymock/pull/928";>#928</a>)</li> <li>Bump org.apache.maven.surefire:surefire-testng from 3.5.5 to 3.5.6 (<a href="https://redirect.github.com/easymock/easymock/pull/897";>#897</a>)</li> <li>Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26 to 1.27 (<a href="https://redirect.github.com/easymock/easymock/pull/852";>#852</a>)</li> <li>Bump org.codehaus.mojo:exec-maven-plugin from 3.6.2 to 3.6.3 (<a href="https://redirect.github.com/easymock/easymock/pull/844";>#844</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/easymock/easymock/blob/master/ReleaseNotes.md";>org.easymock:easymock's changelog</a>.</em></p> <blockquote> <p>Add Java 26 support where bytebuddy isn't using unsafe anymore.</p> <h2>Change log</h2> <ul> <li>Add mock() methods without parameters using varargs reification (<a href="https://redirect.github.com/easymock/easymock/issues/933";>#933</a>)</li> <li>Mock creation fails with JDK 26 and ByteBuddy 1.18.10 (<a href="https://redirect.github.com/easymock/easymock/issues/908";>#908</a>)git log --oneline</li> <li>Use new Maven central plugin</li> <li>Use a github_token instead</li> <li>Add the missing REST calls to fully automated the release</li> <li>Move to .mvn style version</li> <li>Use assertThrows all over the place</li> <li>Optimize imports and finish updating to JUnit 5</li> <li>Update eclipse configuration</li> <li>Move all to UTF-8 like it should already be</li> <li>Use https for xsd</li> <li>Update objenesis to 3.6</li> <li>Update copyrights to 2026</li> <li>Remove Hamcrest usage</li> <li>Add Maven cache</li> <li>Bump actions/checkout from 7.0.0 to 7.0.1 (<a href="https://redirect.github.com/easymock/easymock/pull/917";>#917</a>)</li> <li>Bump actions/github-script from 8 to 9 (<a href="https://redirect.github.com/easymock/easymock/pull/887";>#887</a>)</li> <li>Bump actions/setup-java from 5.6.0 to 5.7.0 (<a href="https://redirect.github.com/easymock/easymock/pull/918";>#918</a>)</li> <li>Bump activesupport from 8.1.2 to 8.1.2.1 in /website (<a href="https://redirect.github.com/easymock/easymock/pull/882";>#882</a>)</li> <li>Bump addressable from 2.8.8 to 2.9.0 in /website (<a href="https://redirect.github.com/easymock/easymock/pull/886";>#886</a>)</li> <li>Bump ch.qos.logback:logback-classic from 1.3.14 to 1.6.3 (<a href="https://redirect.github.com/easymock/easymock/pull/930";>#930</a>)</li> <li>Bump com.github.spotbugs:spotbugs from 4.8.6 to 4.10.3 (<a href="https://redirect.github.com/easymock/easymock/pull/921";>#921</a>)</li> <li>Bump com.github.spotbugs:spotbugs-maven-plugin from 4.8.6.6 to 4.10.3.0 (<a href="https://redirect.github.com/easymock/easymock/pull/922";>#922</a>)</li> <li>Bump com.mycila:license-maven-plugin from 4.6 to 5.1.1 (<a href="https://redirect.github.com/easymock/easymock/pull/919";>#919</a>)</li> <li>Bump com.puppycrawl.tools:checkstyle from 13.9.0 to 13.11.0 (<a href="https://redirect.github.com/easymock/easymock/pull/931";>#931</a>)</li> <li>Bump concurrent-ruby from 1.3.6 to 1.3.7 in /website (<a href="https://redirect.github.com/easymock/easymock/pull/913";>#913</a>)</li> <li>Bump faraday from 2.14.2 to 2.14.3 in /website (<a href="https://redirect.github.com/easymock/easymock/pull/912";>#912</a>)</li> <li>Bump json from 2.20.0 to 2.21.2 in /website (<a href="https://redirect.github.com/easymock/easymock/pull/924";>#924</a>)</li> <li>Bump junit.jupiter.version from 5.14.1 to 6.1.3 (<a href="https://redirect.github.com/easymock/easymock/pull/926";>#926</a>)</li> <li>Bump net.bytebuddy:byte-buddy from 1.18.8 to 1.18.12 (<a href="https://redirect.github.com/easymock/easymock/pull/932";>#932</a>)</li> <li>Bump nokogiri from 1.19.3 to 1.19.4 in /website (<a href="https://redirect.github.com/easymock/easymock/pull/911";>#911</a>)</li> <li>Bump org.apache.felix:maven-bundle-plugin from 5.1.9 to 6.1.0 (<a href="https://redirect.github.com/easymock/easymock/pull/929";>#929</a>)</li> <li>Bump org.apache.maven.plugins:maven-assembly-plugin from 3.7.1 to 3.8.0 (<a href="https://redirect.github.com/easymock/easymock/pull/832";>#832</a>)</li> <li>Bump org.apache.maven.plugins:maven-compiler-plugin from 3.14.1 to 3.15.0 (<a href="https://redirect.github.com/easymock/easymock/pull/863";>#863</a>)</li> <li>Bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 (<a href="https://redirect.github.com/easymock/easymock/pull/899";>#899</a>)</li> <li>Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.2 to 3.6.3 (<a href="https://redirect.github.com/easymock/easymock/pull/894";>#894</a>)</li> <li>Bump org.apache.maven.plugins:maven-jar-plugin from 3.4.2 to 3.5.0 (<a href="https://redirect.github.com/easymock/easymock/pull/833";>#833</a>)</li> <li>Bump org.apache.maven.plugins:maven-resources-plugin from 3.4.0 to 3.5.0 (<a href="https://redirect.github.com/easymock/easymock/pull/879";>#879</a>)</li> <li>Bump org.apache.maven.plugins:maven-shade-plugin from 3.6.1 to 3.6.2 (<a href="https://redirect.github.com/easymock/easymock/pull/880";>#880</a>)</li> <li>Bump org.apache.maven.plugins:maven-source-plugin from 3.3.1 to 3.4.0 (<a href="https://redirect.github.com/easymock/easymock/pull/837";>#837</a>)</li> <li>Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 (<a href="https://redirect.github.com/easymock/easymock/pull/900";>#900</a>)</li> <li>Bump org.apache.maven.plugins:maven-toolchains-plugin from 3.2.0 to 3.3.0 (<a href="https://redirect.github.com/easymock/easymock/pull/928";>#928</a>)</li> <li>Bump org.apache.maven.surefire:surefire-testng from 3.5.5 to 3.5.6 (<a href="https://redirect.github.com/easymock/easymock/pull/897";>#897</a>)</li> <li>Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26 to 1.27 (<a href="https://redirect.github.com/easymock/easymock/pull/852";>#852</a>)</li> <li>Bump org.codehaus.mojo:exec-maven-plugin from 3.6.2 to 3.6.3 (<a href="https://redirect.github.com/easymock/easymock/pull/844";>#844</a>)</li> <li>Bump org.codehaus.mojo:jdepend-maven-plugin from 2.1 to 2.2.0 (<a href="https://redirect.github.com/easymock/easymock/pull/855";>#855</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/easymock/easymock/commit/a8422b97046b58a1671ebd4493729db070281645";><code>a8422b9</code></a> Move to version 5.7.0</li> <li><a href="https://github.com/easymock/easymock/commit/c0ffdcc99d2b29cd127a1e553aaac1e0e3804066";><code>c0ffdcc</code></a> Flatten for oss</li> <li><a href="https://github.com/easymock/easymock/commit/dc07999c696465eee8b5f04315f3a9adcfeadb17";><code>dc07999</code></a> Add missing headers</li> <li><a href="https://github.com/easymock/easymock/commit/6047a3c60be00801eeb3887d45c6b286eaf4f10b";><code>6047a3c</code></a> Class can be static</li> <li><a href="https://github.com/easymock/easymock/commit/e208b61da22d603562342a80945bbf6a361d6c15";><code>e208b61</code></a> Upgrade samples to JUnit 5 and reified calls</li> <li><a href="https://github.com/easymock/easymock/commit/f833ee7fbf2e4f4ea6a889c5bc66bfdfee8001f7";><code>f833ee7</code></a> Add reified methods (close <a href="https://redirect.github.com/easymock/easymock/issues/933";>#933</a>)</li> <li><a href="https://github.com/easymock/easymock/commit/ffaa64ba5001d6a2b02db5d82cb06398f75d6bb4";><code>ffaa64b</code></a> Add flatten-maven-plugin</li> <li><a href="https://github.com/easymock/easymock/commit/02e038e95c77116bcb7136dec58133a1a5cf363a";><code>02e038e</code></a> Bump com.puppycrawl.tools:checkstyle from 13.10.0 to 13.11.0</li> <li><a href="https://github.com/easymock/easymock/commit/dd4dcf8fc8acb6a1b5e5cc0c8652020ecc28da00";><code>dd4dcf8</code></a> Bump net.bytebuddy:byte-buddy from 1.18.11 to 1.18.12</li> <li><a href="https://github.com/easymock/easymock/commit/4d66c46c87de489f58a23562be1eb2ad5cae0702";><code>4d66c46</code></a> CI has been github actions for years now</li> <li>Additional commits viewable in <a href="https://github.com/easymock/easymock/compare/easymock-5.6.0...easymock-5.7.0";>compare view</a></li> </ul> </details> <br /> Updates `net.bytebuddy:byte-buddy` from 1.18.11 to 1.18.12 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/releases";>net.bytebuddy:byte-buddy's releases</a>.</em></p> <blockquote> <h2>Byte Buddy 1.18.12</h2> <ul> <li>Automatically support Kotlin in Gradle plugin.</li> <li>Add support for native attach on Windows for ARM64.</li> <li>Correct JNA injector which accidentally created on based on Unsafe.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/blob/master/release-notes.md";>net.bytebuddy:byte-buddy's changelog</a>.</em></p> <blockquote> <h3>17. July 2026: version 1.18.12</h3> <ul> <li>Automatically support Kotlin in Gradle plugin.</li> <li>Correct JNA injector which accidentally created on based on Unsafe.</li> <li>Support dynamic attach on Windows ARM64 by shipping a native <code>attach_hotspot_windows</code> library for <code>win32-aarch64</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/raphw/byte-buddy/commit/706d4a4fe833e3685ca292318c179afcbd76b54b";><code>706d4a4</code></a> [publish] Releasing Byte Buddy 1.18.12</li> <li><a href="https://github.com/raphw/byte-buddy/commit/b567461809f62cf7bbc3d995c50e38bda7fdcc03";><code>b567461</code></a> [release] Release new version</li> <li><a href="https://github.com/raphw/byte-buddy/commit/bcb5d26b0e89a43343961ad4313888665fa98278";><code>bcb5d26</code></a> Avoid compilation issue on older JVMs.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/e42d7267e40caf3129f956bc92543ee49d858fac";><code>e42d726</code></a> Remove unused import.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/942efc47115a3aed2abe7396a38b373123cb2714";><code>942efc4</code></a> [release] Release new version</li> <li><a href="https://github.com/raphw/byte-buddy/commit/7cff8e9f2cf0a3008bc39d31b0c79bcd24bf4c16";><code>7cff8e9</code></a> [release] Release new version</li> <li><a href="https://github.com/raphw/byte-buddy/commit/6d6cd85d8eb4e06dc05f95edd9d4fb7a7dc6b4dd";><code>6d6cd85</code></a> feat(gradle/plugin): native kotlin support (<a href="https://redirect.github.com/raphw/byte-buddy/issues/1925";>#1925</a>)</li> <li><a href="https://github.com/raphw/byte-buddy/commit/fe2f8d0f5542a6a5671fe2a97a4be080aaeade16";><code>fe2f8d0</code></a> Add reproducible builds badge to readme.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/440fa0a8c9fbf13adee3be1d9166612daee849d1";><code>440fa0a</code></a> Add native attach library for Windows ARM64 to support dynamic attach.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/373c52f007f01fc753ff78ff11ebcfba8cc208b6";><code>373c52f</code></a> Update internal Byte Buddy and release notes.</li> <li>Additional commits viewable in <a href="https://github.com/raphw/byte-buddy/compare/byte-buddy-1.18.11...byte-buddy-1.18.12";>compare view</a></li> </ul> </details> <br /> Updates `net.bytebuddy:byte-buddy-agent` from 1.18.11 to 1.18.12 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/releases";>net.bytebuddy:byte-buddy-agent's releases</a>.</em></p> <blockquote> <h2>Byte Buddy 1.18.12</h2> <ul> <li>Automatically support Kotlin in Gradle plugin.</li> <li>Add support for native attach on Windows for ARM64.</li> <li>Correct JNA injector which accidentally created on based on Unsafe.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/blob/master/release-notes.md";>net.bytebuddy:byte-buddy-agent's changelog</a>.</em></p> <blockquote> <h3>17. July 2026: version 1.18.12</h3> <ul> <li>Automatically support Kotlin in Gradle plugin.</li> <li>Correct JNA injector which accidentally created on based on Unsafe.</li> <li>Support dynamic attach on Windows ARM64 by shipping a native <code>attach_hotspot_windows</code> library for <code>win32-aarch64</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/raphw/byte-buddy/commit/706d4a4fe833e3685ca292318c179afcbd76b54b";><code>706d4a4</code></a> [publish] Releasing Byte Buddy 1.18.12</li> <li><a href="https://github.com/raphw/byte-buddy/commit/b567461809f62cf7bbc3d995c50e38bda7fdcc03";><code>b567461</code></a> [release] Release new version</li> <li><a href="https://github.com/raphw/byte-buddy/commit/bcb5d26b0e89a43343961ad4313888665fa98278";><code>bcb5d26</code></a> Avoid compilation issue on older JVMs.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/e42d7267e40caf3129f956bc92543ee49d858fac";><code>e42d726</code></a> Remove unused import.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/942efc47115a3aed2abe7396a38b373123cb2714";><code>942efc4</code></a> [release] Release new version</li> <li><a href="https://github.com/raphw/byte-buddy/commit/7cff8e9f2cf0a3008bc39d31b0c79bcd24bf4c16";><code>7cff8e9</code></a> [release] Release new version</li> <li><a href="https://github.com/raphw/byte-buddy/commit/6d6cd85d8eb4e06dc05f95edd9d4fb7a7dc6b4dd";><code>6d6cd85</code></a> feat(gradle/plugin): native kotlin support (<a href="https://redirect.github.com/raphw/byte-buddy/issues/1925";>#1925</a>)</li> <li><a href="https://github.com/raphw/byte-buddy/commit/fe2f8d0f5542a6a5671fe2a97a4be080aaeade16";><code>fe2f8d0</code></a> Add reproducible builds badge to readme.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/440fa0a8c9fbf13adee3be1d9166612daee849d1";><code>440fa0a</code></a> Add native attach library for Windows ARM64 to support dynamic attach.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/373c52f007f01fc753ff78ff11ebcfba8cc208b6";><code>373c52f</code></a> Update internal Byte Buddy and release notes.</li> <li>Additional commits viewable in <a href="https://github.com/raphw/byte-buddy/compare/byte-buddy-1.18.11...byte-buddy-1.18.12";>compare view</a></li> </ul> </details> <br /> Updates `net.bytebuddy:byte-buddy-agent` from 1.18.11 to 1.18.12 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/releases";>net.bytebuddy:byte-buddy-agent's releases</a>.</em></p> <blockquote> <h2>Byte Buddy 1.18.12</h2> <ul> <li>Automatically support Kotlin in Gradle plugin.</li> <li>Add support for native attach on Windows for ARM64.</li> <li>Correct JNA injector which accidentally created on based on Unsafe.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/blob/master/release-notes.md";>net.bytebuddy:byte-buddy-agent's changelog</a>.</em></p> <blockquote> <h3>17. July 2026: version 1.18.12</h3> <ul> <li>Automatically support Kotlin in Gradle plugin.</li> <li>Correct JNA injector which accidentally created on based on Unsafe.</li> <li>Support dynamic attach on Windows ARM64 by shipping a native <code>attach_hotspot_windows</code> library for <code>win32-aarch64</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/raphw/byte-buddy/commit/706d4a4fe833e3685ca292318c179afcbd76b54b";><code>706d4a4</code></a> [publish] Releasing Byte Buddy 1.18.12</li> <li><a href="https://github.com/raphw/byte-buddy/commit/b567461809f62cf7bbc3d995c50e38bda7fdcc03";><code>b567461</code></a> [release] Release new version</li> <li><a href="https://github.com/raphw/byte-buddy/commit/bcb5d26b0e89a43343961ad4313888665fa98278";><code>bcb5d26</code></a> Avoid compilation issue on older JVMs.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/e42d7267e40caf3129f956bc92543ee49d858fac";><code>e42d726</code></a> Remove unused import.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/942efc47115a3aed2abe7396a38b373123cb2714";><code>942efc4</code></a> [release] Release new version</li> <li><a href="https://github.com/raphw/byte-buddy/commit/7cff8e9f2cf0a3008bc39d31b0c79bcd24bf4c16";><code>7cff8e9</code></a> [release] Release new version</li> <li><a href="https://github.com/raphw/byte-buddy/commit/6d6cd85d8eb4e06dc05f95edd9d4fb7a7dc6b4dd";><code>6d6cd85</code></a> feat(gradle/plugin): native kotlin support (<a href="https://redirect.github.com/raphw/byte-buddy/issues/1925";>#1925</a>)</li> <li><a href="https://github.com/raphw/byte-buddy/commit/fe2f8d0f5542a6a5671fe2a97a4be080aaeade16";><code>fe2f8d0</code></a> Add reproducible builds badge to readme.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/440fa0a8c9fbf13adee3be1d9166612daee849d1";><code>440fa0a</code></a> Add native attach library for Windows ARM64 to support dynamic attach.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/373c52f007f01fc753ff78ff11ebcfba8cc208b6";><code>373c52f</code></a> Update internal Byte Buddy and release notes.</li> <li>Additional commits viewable in <a href="https://github.com/raphw/byte-buddy/compare/byte-buddy-1.18.11...byte-buddy-1.18.12";>compare view</a></li> </ul> </details> <br /> Updates `ch.qos.logback:logback-core` from 1.6.1 to 1.6.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/qos-ch/logback/releases";>ch.qos.logback:logback-core's releases</a>.</em></p> <blockquote> <h2>Logback 1.6.3</h2> <h1>2026-08-14 Release of logback version 1.6.3</h1> <ul> <li> <p>In response <a href="https://www.cve.org/cverecord?id=CVE-2026-19880";>CVE-2026-19880</a>, <code>MDCBasedDiscriminator</code> (used by <code>SiftingAppender</code>) now strips forward and backward slashes (<code>/</code>, <code>\</code>) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).</p> </li> <li> <p>Colour console support is split out into a dedicated <a href="https://logback.qos.ch/manual/appenders.html#JansiConsoleAppender";><code>JansiConsoleAppender</code></a>. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the <a href="https://logback.qos.ch/manual/appenders.html#JansiConsoleAppender";>appenders documentation</a>.</p> </li> <li> <p>The <code>withJansi</code> property on <code>ConsoleAppender</code> is <strong>deprecated</strong>. Existing configurations that still set <code><withJansi>true</withJansi></code> continue to work for compatibility, but new setups should use <code>JansiConsoleAppender</code> instead.</p> </li> <li> <p><code>ConsoleAppender</code> no longer treats the process console as an exclusive resource: stopping it does not close <code>System.out</code> / <code>System.err</code>. <code>JansiConsoleAppender</code> pairs each <code>AnsiConsole.systemInstall()</code> with <code>systemUninstall()</code> on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for <a href="https://redirect.github.com/qos-ch/logback/issues/1063";>issues/1063</a>.</p> </li> <li> <p>Invocation throttling helpers were reworked: <code>SimpleInvocationGate</code> is renamed <code>FixedIntervalInvocationGate</code>, and <code>BatchedFixedIntervalInvocationGate</code> allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.</p> </li> <li> <p>The JPMS <code>module-info</code> for logback-core now exports the <code>ch.qos.logback.core.property</code> package, which had been missing from the module descriptor.</p> </li> <li> <p>A bit-wise identical binary of this version can be reproduced by building from <a href="https://github.com/qos-ch/logback";>source code</a> at commit <code>e8e824dede022a6d7208b36cfa875b0d1b7772f3</code> associated with the tag <code>v_1.6.3</code>. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> </li> </ul> <p>-- Sponsoring SLF4J/logback/reload4j at <a href="https://github.com/sponsors/qos-ch";>https://github.com/sponsors/qos-ch</a></p> <h2>Logback 1.6.2</h2> <p><a href="https://github.com/user-attachments/assets/9ceaf157-b758-4188-815d-edfe4e1b4edd";>https://github.com/user-attachments/assets/9ceaf157-b758-4188-815d-edfe4e1b4edd</a></p> <h1>2026-08-10 Release of logback version 1.6.2</h1> <ul> <li> <p>Configuration analysis now detects <em>contradictory caller-data inclusion instructions</em>. For example, an <code>AsyncAppender</code>, <code>SocketAppender</code> or <code>SMTPAppender</code> with <code>includeCallerData</code> left at the default <code>false</code> is incompatible with a layout or encoder pattern that uses a caller-data converter such as <code>%C</code>, <code>%M</code>, <code>%L</code>, <code>%F</code>, <code>%l</code> or <code>%caller</code>. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See <a href="https://logback.qos.ch/codes.html#callerContradiction";>codes.html#callerContradiction</a> for details. This issue was reported in <a href="https://redirect.github.com/qos-ch/logback/issues/1059";>issues/1059</a> by <a href="https://github.com/leeychee";>leeychee</a>. The initial analysis was contributed by <a href="https:/ /github.com/seonwooj0810">seonwoo_jung</a>.</p> </li> <li> <p>Caller-contradiction analysis can be turned off by setting the <code>logback.skipCallerContradictionAnalysis</code> variable to <code>true</code>, either as a system property (<code>-Dlogback.skipCallerContradictionAnalysis=true</code>) or as a property in the configuration file:</p> <pre lang="xml"><code><property name="logback.skipCallerContradictionAnalysis" value="true"/> </code></pre> </li> <li> <p><code>SimpleSocketServer</code> and <code>SimpleSSLSocketServer</code> now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with <code>addAllowedClientAddress(String)</code> or <code>setAllowedClientAddresses(Collection)</code> before clients connect. See the documentation on <a href="https://logback.qos.ch/manual/appenders.html#simpleSocketServerClientAccess";>restricting client access</a>.</p> </li> <li> <p>Added <code>ThrowableProxyVOBuilder</code> for assembling a <code>ThrowableProxyVO</code> field by field, with a corresponding <code>ThrowableProxyVO.builder()</code> entry point.</p> </li> <li> <p>Dependency analysis handlers now run their <code>postHandle</code> method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.</p> </li> <li> <p>Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.</p> </li> <li> <p>A bit-wise identical binary of this version can be reproduced by building from <a href="https://github.com/qos-ch/logback";>source code</a> at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag <code>v_1.6.2</code>. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/qos-ch/logback/commit/e8e824dede022a6d7208b36cfa875b0d1b7772f3";><code>e8e824d</code></a> prepare release 1.6.3</li> <li><a href="https://github.com/qos-ch/logback/commit/761821bfaacac3a0ad44fa546cfc814429bf9312";><code>761821b</code></a> MDCBasedDiscriminator has a gated warning mechanism</li> <li><a href="https://github.com/qos-ch/logback/commit/53ed1229008d8b1902f5c234deaa07d742890879";><code>53ed122</code></a> update copyright year</li> <li><a href="https://github.com/qos-ch/logback/commit/c7e2db244671ffa916182b5da8c89579eb54a645";><code>c7e2db2</code></a> rename SimpleInvocationGate as FixedIntervalInvocationGate</li> <li><a href="https://github.com/qos-ch/logback/commit/b5aa931b096a4b0b6a9e140b74fabe7da152cbf0";><code>b5aa931</code></a> added BatchedSimpleInvocationGate</li> <li><a href="https://github.com/qos-ch/logback/commit/1f22af7686aadd25c08b4bd1e6943a906a743ad4";><code>1f22af7</code></a> add javadocs to SimpleInvocationGate</li> <li><a href="https://github.com/qos-ch/logback/commit/638ffa7e7852478b605a91b3e91238ff26f8158c";><code>638ffa7</code></a> prevent forward and backward slashes to escape to other directories</li> <li><a href="https://github.com/qos-ch/logback/commit/7d6b9a4f8c8996834c0a694f6c141705a003d7bb";><code>7d6b9a4</code></a> add missing ch.qos.logback.core.property package</li> <li><a href="https://github.com/qos-ch/logback/commit/fa25930346f35636fb6a077c1f66ebb06edd3b6f";><code>fa25930</code></a> add an extension path in ConsoleAppender for JansiConsoleAppender</li> <li><a href="https://github.com/qos-ch/logback/commit/c73b43f2011f9d4545abc7ea461172276a0a43b3";><code>c73b43f</code></a> deprecate the withJansi path</li> <li>Additional commits viewable in <a href="https://github.com/qos-ch/logback/compare/v_1.6.1...v_1.6.3";>compare view</a></li> </ul> </details> <br /> Updates `ch.qos.logback:logback-classic` from 1.6.1 to 1.6.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/qos-ch/logback/releases";>ch.qos.logback:logback-classic's releases</a>.</em></p> <blockquote> <h2>Logback 1.6.3</h2> <h1>2026-08-14 Release of logback version 1.6.3</h1> <ul> <li> <p>In response <a href="https://www.cve.org/cverecord?id=CVE-2026-19880";>CVE-2026-19880</a>, <code>MDCBasedDiscriminator</code> (used by <code>SiftingAppender</code>) now strips forward and backward slashes (<code>/</code>, <code>\</code>) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).</p> </li> <li> <p>Colour console support is split out into a dedicated <a href="https://logback.qos.ch/manual/appenders.html#JansiConsoleAppender";><code>JansiConsoleAppender</code></a>. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the <a href="https://logback.qos.ch/manual/appenders.html#JansiConsoleAppender";>appenders documentation</a>.</p> </li> <li> <p>The <code>withJansi</code> property on <code>ConsoleAppender</code> is <strong>deprecated</strong>. Existing configurations that still set <code><withJansi>true</withJansi></code> continue to work for compatibility, but new setups should use <code>JansiConsoleAppender</code> instead.</p> </li> <li> <p><code>ConsoleAppender</code> no longer treats the process console as an exclusive resource: stopping it does not close <code>System.out</code> / <code>System.err</code>. <code>JansiConsoleAppender</code> pairs each <code>AnsiConsole.systemInstall()</code> with <code>systemUninstall()</code> on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for <a href="https://redirect.github.com/qos-ch/logback/issues/1063";>issues/1063</a>.</p> </li> <li> <p>Invocation throttling helpers were reworked: <code>SimpleInvocationGate</code> is renamed <code>FixedIntervalInvocationGate</code>, and <code>BatchedFixedIntervalInvocationGate</code> allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.</p> </li> <li> <p>The JPMS <code>module-info</code> for logback-core now exports the <code>ch.qos.logback.core.property</code> package, which had been missing from the module descriptor.</p> </li> <li> <p>A bit-wise identical binary of this version can be reproduced by building from <a href="https://github.com/qos-ch/logback";>source code</a> at commit <code>e8e824dede022a6d7208b36cfa875b0d1b7772f3</code> associated with the tag <code>v_1.6.3</code>. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> </li> </ul> <p>-- Sponsoring SLF4J/logback/reload4j at <a href="https://github.com/sponsors/qos-ch";>https://github.com/sponsors/qos-ch</a></p> <h2>Logback 1.6.2</h2> <p><a href="https://github.com/user-attachments/assets/9ceaf157-b758-4188-815d-edfe4e1b4edd";>https://github.com/user-attachments/assets/9ceaf157-b758-4188-815d-edfe4e1b4edd</a></p> <h1>2026-08-10 Release of logback version 1.6.2</h1> <ul> <li> <p>Configuration analysis now detects <em>contradictory caller-data inclusion instructions</em>. For example, an <code>AsyncAppender</code>, <code>SocketAppender</code> or <code>SMTPAppender</code> with <code>includeCallerData</code> left at the default <code>false</code> is incompatible with a layout or encoder pattern that uses a caller-data converter such as <code>%C</code>, <code>%M</code>, <code>%L</code>, <code>%F</code>, <code>%l</code> or <code>%caller</code>. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See <a href="https://logback.qos.ch/codes.html#callerContradiction";>codes.html#callerContradiction</a> for details. This issue was reported in <a href="https://redirect.github.com/qos-ch/logback/issues/1059";>issues/1059</a> by <a href="https://github.com/leeychee";>leeychee</a>. The initial analysis was contributed by <a href="https:/ /github.com/seonwooj0810">seonwoo_jung</a>.</p> </li> <li> <p>Caller-contradiction analysis can be turned off by setting the <code>logback.skipCallerContradictionAnalysis</code> variable to <code>true</code>, either as a system property (<code>-Dlogback.skipCallerContradictionAnalysis=true</code>) or as a property in the configuration file:</p> <pre lang="xml"><code><property name="logback.skipCallerContradictionAnalysis" value="true"/> </code></pre> </li> <li> <p><code>SimpleSocketServer</code> and <code>SimpleSSLSocketServer</code> now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with <code>addAllowedClientAddress(String)</code> or <code>setAllowedClientAddresses(Collection)</code> before clients connect. See the documentation on <a href="https://logback.qos.ch/manual/appenders.html#simpleSocketServerClientAccess";>restricting client access</a>.</p> </li> <li> <p>Added <code>ThrowableProxyVOBuilder</code> for assembling a <code>ThrowableProxyVO</code> field by field, with a corresponding <code>ThrowableProxyVO.builder()</code> entry point.</p> </li> <li> <p>Dependency analysis handlers now run their <code>postHandle</code> method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.</p> </li> <li> <p>Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.</p> </li> <li> <p>A bit-wise identical binary of this version can be reproduced by building from <a href="https://github.com/qos-ch/logback";>source code</a> at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag <code>v_1.6.2</code>. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/qos-ch/logback/commit/e8e824dede022a6d7208b36cfa875b0d1b7772f3";><code>e8e824d</code></a> prepare release 1.6.3</li> <li><a href="https://github.com/qos-ch/logback/commit/761821bfaacac3a0ad44fa546cfc814429bf9312";><code>761821b</code></a> MDCBasedDiscriminator has a gated warning mechanism</li> <li><a href="https://github.com/qos-ch/logback/commit/53ed1229008d8b1902f5c234deaa07d742890879";><code>53ed122</code></a> update copyright year</li> <li><a href="https://github.com/qos-ch/logback/commit/c7e2db244671ffa916182b5da8c89579eb54a645";><code>c7e2db2</code></a> rename SimpleInvocationGate as FixedIntervalInvocationGate</li> <li><a href="https://github.com/qos-ch/logback/commit/b5aa931b096a4b0b6a9e140b74fabe7da152cbf0";><code>b5aa931</code></a> added BatchedSimpleInvocationGate</li> <li><a href="https://github.com/qos-ch/logback/commit/1f22af7686aadd25c08b4bd1e6943a906a743ad4";><code>1f22af7</code></a> add javadocs to SimpleInvocationGate</li> <li><a href="https://github.com/qos-ch/logback/commit/638ffa7e7852478b605a91b3e91238ff26f8158c";><code>638ffa7</code></a> prevent forward and backward slashes to escape to other directories</li> <li><a href="https://github.com/qos-ch/logback/commit/7d6b9a4f8c8996834c0a694f6c141705a003d7bb";><code>7d6b9a4</code></a> add missing ch.qos.logback.core.property package</li> <li><a href="https://github.com/qos-ch/logback/commit/fa25930346f35636fb6a077c1f66ebb06edd3b6f";><code>fa25930</code></a> add an extension path in ConsoleAppender for JansiConsoleAppender</li> <li><a href="https://github.com/qos-ch/logback/commit/c73b43f2011f9d4545abc7ea461172276a0a43b3";><code>c73b43f</code></a> deprecate the withJansi path</li> <li>Additional commits viewable in <a href="https://github.com/qos-ch/logback/compare/v_1.6.1...v_1.6.3";>compare view</a></li> </ul> </details> <br /> Updates `org.bouncycastle:bcprov-jdk18on` from 1.85 to 1.85.2 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md";>org.bouncycastle:bcprov-jdk18on's changelog</a>.</em></p> <blockquote> <h1>Bouncy Castle Crypto Package - Release Notes</h1> <h2>1.0 Introduction</h2> <p>The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. The package is organised so that it contains a light-weight API suitable for use in any environment (including the J2ME) with the additional infrastructure to conform the algorithms to the JCE framework.</p> <h2>2.0 Release History</h2> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h3>2.1.1 Version</h3> <p>Release: 1.86<br /> Date: 2026, TBD</p> <h3>2.1.2 Defects Fixed</h3> <ul> <li>The high-level OpenPGP API (org.bouncycastle.openpgp.api) let a subkey inherit the primary key's Key Flags when its own Subkey Binding signature carried no Key Flags subpacket, which made the two capability decisions taken for one subkey disagree. OpenPGPCertificate.OpenPGPComponentKey.isSigningKey() reads the effective flags, which fell back to the primary key's direct-key or primary user ID self-signature, so a subkey bound with no flags of its own counted as signing-capable; verifyEmbeddedPrimaryKeyBinding reads the binding signature's own flags, found no signing capability there, and so skipped the embedded Primary Key Binding (cross-certification) signature that RFC 9580 sec. 5.2.1.8 and sec. 10.1.3 require of a subkey that can issue signatures. A data signature made by such a subkey was therefore attributed to the certificate and reported valid by OpenPGPSignature.OpenPGPDocumentSignature.isValid() with the cross-certification requirement never applied, where GnuPG refus es the same certificate and message as not cross-certified. An attacker holding a third party's public signing subkey - which is public material - could bind it to their own primary key with a Subkey Binding signature they are able to make, carrying no Key Flags and no embedded Primary Key Binding signature, which they cannot make without the subkey's private key, and have that party's genuine signatures verify as valid under the attacker's own identity: misattribution of a real signature rather than a forgery of a new one, since the signature still has to be one the subkey actually made. Key Flags are a statement about the key the carrying signature refers to (RFC 9580 sec. 5.2.3.29), so a subkey no longer inherits them from the certificate-wide signatures of the primary key: a Subkey Binding signature that omits the subpacket now leaves the subkey with no capabilities rather than the primary's, which makes the flags the cross-certification check consults the same flags every other decision consults. Preferences and the other subpackets a direct-key signature carries are inherited as before, and the primary key itself - whose flags legitimately come from its direct-key or user ID self-signature - is unaffected. The low-level PGPSignature / PGPPublicKeyRing API performs no binding checks by design and is unchanged.</li> <li>Neither the HSS nor the XMSS^MT private key decoder checked its declared index against the traversal state stored beside it, although the two are independent records of the same position in the key and so can be compared. For HSS the records are the top-level index and the component keys' one-time indices q; for XMSS^MT they are the global index and the per-layer BDS states. A stored key whose index had been rolled back while its state stayed advanced - a partial write, a restore from backup, a buggy storage layer - was therefore accepted, and it then signed a second message under a one-time key the key had already used, producing a signature that verified, so nothing anywhere surfaced the reuse. RFC 8554 sec. 1 and RFC 8391 sec. 1.1 both require each one-time key to be used exactly once, and this is the failure those requirements exist to prevent; the single-tree XMSS decoder has tied its BDS state to its index since that state was first validated, and this brings the two mul ti-tree schemes into line. HSS decode now requires the declared index to equal the position the component q values imply - a level above the last contributes (q - 1) leaves of the levels beneath it, since its q has already advanced past the subtree it signed - and XMSS^MT decode now requires each present layer's BDS index to equal the leaf index that layer derives from the global index, allowing the one position where a layer has moved into a new subtree and its state legitimately still carries the previous subtree's final index. A layer with no state yet is unaffected, since those are built lazily at signing time. Related, and the same shape of omission: an XMSS or XMSS^MT private key encoding carries the tree root twice - the key's own root field and the root node of the BDS state stored beside it, which for XMSS^MT is the top layer's - and the two were never compared either. A corrupted root was accepted and then poisoned every signature the key made, because the root is hashed i nto the message digest: the signature did not verify and nothing indicated why. Decode now requires the two copies to agree. The BDS node values themselves are not checkable the way the LMS tree cache above is - a BDS authentication path, stack, retain or keep node does not have its children stored alongside it, so recomputing one means building a subtree, which is the work the state exists to avoid. Both checks are integer comparisons over the levels of the key, too small to measure against the surrounding decode, and both were verified not to reject any legitimate key by walking every index a key can reach: the full key space of the two-level HSS and the h=4/d=2, h=6/d=2, h=6/d=3, h=9/d=3 and h=8/d=4 XMSS^MT parameter sets, plus a three-level HSS key across a subtree boundary and an HSS shard. Since those node values cannot be recomputed, the encoded state now carries a checksum over itself instead, with the owning key's public seed hashed in front of it. Any corruption of the sto red state is refused at decode rather than being loaded and then producing signatures that silently do not verify, and because the public seed is bound in, a state transplanted between two keys of the same parameter set is refused too, even though it is internally consistent and arrives with its own matching root. The public seed is bound rather than the secret seed or the PRF key deliberately: the state's own root and index are inside the encoding and so are already covered, hashing secret material would make the stored checksum a commitment to it for no gain in detection, and the PRF key does not influence the state at all. <strong>This is an error-detecting code and not integrity protection</strong> - anyone able to rewrite the stored key recomputes it, so it establishes that the state is unchanged since it was written, never that it was correct when written, and the allocation bounds on the encoding remain the guard against a crafted one. It costs one SHA-256 over the state, mea sured at 5 to 8 microseconds each way for the h=10 and h=16 parameter sets, and 32 bytes of encoding. The state encoding was added earlier in this same cycle and has not been released, so the checksum is simply part of it rather than a new version: a state written by a 1.86 beta is rejected, which is recovered from by re-exporting the key. The deprecated org.bouncycastle.pqc.crypto.lms copy carries the HSS check as well (github <a href="https://redirect.github.com/bcgit/bc-java/issues/2414";>#2414</a>).</li> <li>The S/MIME example smoke test in the misc module (org.bouncycastle.mail.smime.examples.test.AllTests) drove SendSignedAndEncryptedMail against smtp.gmail.com, and that example finishes with Transport.send() under JavaMail's default settings, which have no connect timeout. Where outbound port 25 is refused the failure was swallowed and the test passed; where it is silently dropped, as on many home networks, the connect blocked and ./gradlew build hung in :misc:test indefinitely with "0 tests completed". The test now delivers to an SMTP stub on a loopback port, with connect / read / write timeouts as a backstop, and asserts the message arrived (github <a href="https://redirect.github.com/bcgit/bc-java/issues/2407";>#2407</a>).</li> <li>Composite ML-KEM encapsulation took the traditional component public key bytes it feeds the KEM combiner from the recipient key's own encoding, while decapsulation recomputes the point from the private key and so always produced an uncompressed one. Section 4 of draft-ietf-lamps-pq-composite-kem requires an EC component to be carried as an uncompressed point, but a component key that encodes itself compressed - a BC EC key whose point format has been set through org.bouncycastle.jce.interfaces.ECPointEncoder, or a key from a provider that preserves a compressed encoding - was passed through as it came. Both sides then combined a different tradPK and derived different shared secrets, with no error reported on either: encapsulation and decapsulation both succeeded and the recipient simply could not decrypt. The EC component is now normalised to an uncompressed point wherever the engine serialises one, which covers the ephemeral key that forms the ciphertext as well. X25519 and X 448 components have a single encoding and were unaffected, as were EC keys left in their default (uncompressed) format, whose shared secrets are unchanged. CompositePublicKey.getEncoded() took its component bytes the same way, so such a key also encoded to a composite key other implementations reject and whose bytes changed across an encode / decode / encode round trip - 1238 bytes rather than 1270 for MLKEM768-ECDH-P256, and for the composite ML-DSA keys sharing that method, 2006 rather than 2038 for MLDSA65-ECDSA-P256. It now normalises the component the same way. This is a write-side change only: a composite key carrying a compressed EC component is still decoded, since the component key factories accept either form, and continues to verify signatures as before - it simply re-encodes in the normalised form. The shared normalisation is org.bouncycastle.jcajce.provider.asymmetric.util.ECUtil.getUncompressedSubjectPublicKeyBytes.</li> <li>Composite ML-KEM encapsulation threw a NullPointerException, wrapped in an IllegalStateException out of KeyGenerator.generateKey(), when the SecureRandom it was given was null - which javax.crypto.KEM.newEncapsulator() documents as a request for the provider's default, and which KeyGenerator.init(spec, null) passes straight through. The three RSA-OAEP composites draw the traditional shared secret from that random directly, so they were the ones affected; the ECDH and X25519 / X448 composites escaped only because their component KeyPairGenerators default a random of their own. CompositeMLKEMEngine now defaults one through CryptoServicesRegistrar.getSecureRandom() on first use, as the composite KEM Cipher's wrap path already did, and as the KEM generators corrected earlier in this cycle now do. Related, the engine now also clears the ML-KEM component's shared secret alongside the traditional one on both the encapsulate and decapsulate paths - the copy handed back by getEncoded() was left in the heap - as section 3.5 of draft-ietf-lamps-pq-composite-kem requires.</li> <li>CompositePublicKey.getAlgorithm() and CompositePrivateKey.getAlgorithm() returned null for all twelve Composite ML-KEM (draft-ietf-lamps-pq-composite-kem) parameter sets. Both classes resolved the name through the composite signature index only, which holds the composite ML-DSA OIDs, so a composite KEM key pair - generated, parsed from a certificate, or read from PKCS#8 - reported no algorithm at all, and the standard JCA idiom of reconstructing a key with KeyFactory.getInstance(key.getAlgorithm()) raised a NullPointerException. The lookup now falls back to the composite KEM index, so the name returned is the one the provider registers the algorithm under (e.g. MLKEM768-X25519-SHA3-256), matching the composite ML-DSA behaviour. The same single-index assumption made the CompositePublicKey(SubjectPublicKeyInfo) and CompositePrivateKey(PrivateKeyInfo) constructors reject a composite KEM key with "unable to create CompositePublicKey from SubjectPublicKeyInfo"; they now d ispatch to the composite KEM key factory for those OIDs. Keys obtained through KeyFactory or through BouncyCastleProvider.getPublicKey / getPrivateKey were unaffected and are unchanged (github <a href="https://redirect.github.com/bcgit/bc-java/issues/2404";>#2404</a>).</li> <li>The org.bouncycastle.jcajce.spec.KEMKDFSpec constructor stored a null otherInfo as given, so getOtherInfo() returned null, and three of the KDF branches KdfUtil.makeKeyBytes dispatches to - KMAC-128, KMAC-256 and SHAKE-256 - read the otherInfo length without a guard and threw NullPointerException out of the KEM operation, where the KDF2, KDF3 and HKDF branches tolerate a null through KDFParameters / HKDFParameters. The Builder of every spec in the package already mapped null to empty, so no provider path reached it, but the constructor is protected on a public class and KdfUtil is documented for callers building their own KEM integration; the deprecated KEMParameterSpec passes a null itself and escaped only because it also pins the KDF to null. The constructor now stores empty for a null, so getOtherInfo() never returns null, and a null and an explicitly empty otherInfo derive the same key.</li> <li>QR-UOV signature verification accepted a signature encoding that was not canonical, so the encoding of a signature was not unique even after the trailing-byte fix of github <a href="https://redirect.github.com/bcgit/bc-java/issues/2403";>#2403</a>. Each F_q element of the signature is stored in ceil(log2 q) bits, one more bit pattern than the field has elements: q itself is representable and is arithmetically congruent to zero, so an element written as q verified exactly as the same element written as zero would, and the bits padding the last element out to the byte boundary were never read at all. Every zero element of a signature therefore carried a second encoding, and for the q = 7 parameter sets roughly one element in seven is zero - a single qruov_5_q7_L10 signature measured 256 spare bits, so on the order of 2^256 distinct byte strings verified for the one message and key. Verification now rejects any element outside [0, q) and any set padding bit; a signature produced b y this or by the reference implementation is unaffected, as the KAT vectors of every parameter set confirm. (github <a href="https://redirect.github.com/bcgit/bc-java/issues/2403";>#2403</a>)</li> <li>SNOVA signature verification ignored four bits inside the signature for any parameter set whose solution is an odd number of GF(16) nibbles - the SNOVA_24_5_5, SNOVA_25_8_3, SNOVA_29_6_5 and SNOVA_66_15_3 families, sixteen of the forty-four parameter sets. The last byte of the encoded solution carries a single nibble and the signer leaves the top four bits zero, but the decoder did not read them, so sixteen distinct byte strings verified for one signature. This is the same non-unique encoding github <a href="https://redirect.github.com/bcgit/bc-java/issues/2403";>#2403</a> closed for bytes following the signature, applied inside it; the verifier now requires those bits to be zero. (github <a href="https://redirect.github.com/bcgit/bc-java/issues/2403";>#2403</a>)</li> <li>SnovaPrivateKeyParameters did not validate the length of the private key encoding handed to it - the only one of the five schemes of github <a href="https://redirect.github.com/bcgit/bc-java/issues/2403";>#2403</a> that did not - and SnovaParameters.getPrivateKeyLength() reported the expanded ("ESK") length even for a parameter set whose private key is the seed pair. A private key encoding reaches this constructor straight from a PKCS#8 blob, so a wrong length went undetected: a seed-form key with extra bytes appended was accepted and signed under a different derived key, and a short expanded-form key sized the signer's decode buffer negatively, throwing NegativeArraySizeException out of generateSignature() rather than being reported at construction. Related, the signing retry loop could not terminate: the vinegar values are derived from a single-byte counter, so only 256 distinct linear systems can be tried, and an expanded-form private key that is not a real central map is singular for all of them - generateSignature() then span forever rather than failing. The length is now checked at construction, getPrivateKeyLength() reports the length that parameter set's private key actually has, and the retry loop gives up after its 256 attempts as MAYO's does.</li> <li>MayoSigner and MayoKeyPairGenerator did not clear several buffers holding secret key material that the MAYO reference implementation explicitly clears. Signing left the secret oil space O, the expanded L = (P1 + P1^t) * O + P2, and the M / VPV / Ox intermediates of the central map in place, having gone to the trouble of clearing eleven other buffers; key generation left the expanded seed, whose tail is the encoded oil space, and the P1 * O + P2 half of P; and the row-echelon step left the packed echelon form of the secret linear system and its pivot rows. Separately, if all 256 attempts at solving for the signature had given a rank-deficient system, signing emitted a signature built from the failed attempt's state instead of reporting the failure the reference returns, and AIMerSigner.generateSignature returned an empty array on failure, which a caller would hand on as though it were a signature. Both now throw.</li> <li>Five PQC signature schemes - MAYO, SNOVA, QR-UOV, SQIsign and AIMer - returned the NIST crypto_sign "sm" signed-message envelope from generateSignature() rather than the signature. That envelope is an artefact of the reference KAT harness, which records the message alongside the signature so a vector file can be self-contained; it is not part of any of the five specifications, and no other BC signer emits it (Falcon's KAT test rebuilds the equivalent envelope in the test, which is where it belongs). Two consequences followed, both reaching the JCA Signature services of every parameter set of the five schemes in BouncyCastlePQCProvider. First, since the message was appended to the signature, verification had to skip whatever followed the signature proper, and it did so by checking only that the buffer was long enough - so any number of trailing bytes could be added to a valid signature, or the appended message replaced with unrelated data, and it still verified. A sig nature encoding was therefore not unique: anyone holding one valid signature could produce unlimited distinct byte strings that all verified for the same message and key, which breaks any use that treats the signature bytes as an identifier, deduplicates on them, or records them as evidence. Second, the envelope propagated into everything built on the operator layer: because ContentSigner hands the signature straight into the structure being signed, every X.509 certificate, CRL, CMS SignedData and TLS CertificateVerify BC produced with one of these algorithms carried a verbatim copy of the signed data inside its own signature field - a self-signed MAYO-1 certificate came to 3567 bytes where the same certificate is now 2020 - which no other implementation can parse as a signature, and which in a detached CMS signature meant the "detached" signature carried the content. generateSignature() now returns the bare signature, and verifySignature() requires exactly the parameter s et's signature length, so appended or truncated data is rejected rather than ignored. <strong>This is a behavioural change for signatures produced by an earlier release</strong> - MAYO and SNOVA from 1.84, QR-UOV, SQIsign and AIMer from 1.85 - which are no longer accepted in the envelope form they were emitted in; the signature bytes themselves are unchanged, so a stored value can be recovered by taking the leading signature-length bytes, or for AIMer, whose envelope was message || signature rather than signature || message, the trailing ones. The KAT tests now rebuild the envelope before comparing against the vector files, which continue to record it. Note that AIMer's verification had already been made length-exact during this cycle (see the entry below relating to github <a href="https://redirect.github.com/bcgit/bc-java/issues/2401";>#2401</a>), so of the five only its envelope remained (github <a href="https://redirect.github.com/bcgit/bc-java/issues/2403";>#2403</a>).</li> <li>The MLS implementation did not bind an X.509 credential to the LeafNode's signature_key. LeafNode.verify() checked a leaf's signature against the signature_key declared in the leaf itself, while the X.509 credential's certificate chain was stored but never parsed or checked, so the certificate's public key was never required to match signature_key (RFC 9420 sec. 5.3). A leaf could therefore carry one party's certificate while being signed by an unrelated key and still be accepted under that party's identity through KeyPackage.verify() and the Group leaf-validation path. LeafNode.verify() now requires the end-entity certificate's subject public key, in the cipher suite's signature encoding, to equal signature_key for an X.509 credential, and rejects the leaf otherwise - including an empty chain or a certificate whose key type does not match the cipher suite; certificate-chain and identity validation to a trust anchor remain the application's responsibility per RFC 9420 sec. 5.3 .1. A public org.bouncycastle.mls.codec.Certificate(byte[]) constructor and a Credential.getCertificates() accessor are added so callers can build and inspect X.509 credentials. Basic credentials are unaffected.</li> <li>The SecureRandom supplied to org.bouncycastle.cms.jcajce.JceCMSContentEncryptorBuilder.setSecureRandom() did not drive the content IV / nonce for any algorithm other than RC2. EnvelopedDataHelper.generateParameters passed the caller's SecureRandom to the AlgorithmParameterGenerator only in the RC2_CBC branch; every other content-encryption algorithm - AES-CBC, AES-GCM, AES-CCM, Camellia, ARIA, SEED and the rest - reached pGen.generateParameters() on an uninitialised generator, so the IV / nonce was drawn from a default SecureRandom and setSecureRandom() was silently ignored (the builder's javadoc states that random is used for IV/nonce generation). The generator is now initialised with the supplied random on the general path as well, so a caller who provides a specific randomness source - for a controlled or FIPS-approved DRBG, say - has it honoured for the content IV / nonce. The session-key generation path was unaffected and already used the supplied random. Because the cont ent IV / nonce now comes from the supplied SecureRandom, the org.bouncycastle.crypto.util JournalingSecureRandom / JournaledAlgorithm reproducible-encryption support records it in the transcript: a resumed session reproduces the IV / nonce by regenerating it from the replayed randomness - build the resuming encryptor from the content-algorithm OID - rather than by reusing the AlgorithmIdentifier captured from the first encryption, which no longer keeps the transcript aligned.</li> <li>The NTRU LPRime, NTRU+ and SMAUG-T KEM generators threw a NullPointerException when constructed with a null SecureRandom, where every other KEM generator - including NTRU LPRime's own SNTRU Prime counterpart in the same package - defaults one through CryptoServicesRegistrar.getSecureRandom(). This is reachable from the lightweight API directly, and from ... _Description has been truncated_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
