dependabot[bot] opened a new pull request, #2906: URL: https://github.com/apache/shiro/pull/2906
Bumps the maven-dependencies group with 9 updates: | Package | From | To | | --- | --- | --- | | [com.puppycrawl.tools:checkstyle](https://github.com/checkstyle/checkstyle) | `14.1.0` | `14.3.0` | | org.apache.commons:commons-lang3 | `3.20.0` | `3.21.0` | | [org.owasp.encoder:encoder](https://github.com/OWASP/owasp-java-encoder) | `1.4.0` | `1.5.0` | | [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) | `1.6.4` | `1.6.5` | | [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.6.4` | `1.6.5` | | [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm) | `7.4.10.Final` | `7.4.11.Final` | | [com.google.guava:guava](https://github.com/google/guava) | `33.7.1-jre` | `33.7.2-jre` | | [org.seleniumhq.selenium:selenium-bom](https://github.com/SeleniumHQ/selenium) | `4.49.0` | `4.50.0` | | org.apache.maven:apache-maven | `3.9.16` | `3.10.0` | Updates `com.puppycrawl.tools:checkstyle` from 14.1.0 to 14.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/checkstyle/checkstyle/releases";>com.puppycrawl.tools:checkstyle's releases</a>.</em></p> <blockquote> <h2>checkstyle-14.3.0</h2> <p>Checkstyle 14.3.0 - <a href="https://checkstyle.org/releasenotes.html#Release_14.3.0";>https://checkstyle.org/releasenotes.html#Release_14.3.0</a></p> <p>New:</p> <p><a href="https://redirect.github.com/checkstyle/checkstyle/issues/14120";>#14120</a> - Make Checkstyle an java module with module-info.java.</p> <h2>checkstyle-14.2.0</h2> <p>Checkstyle 14.2.0 - <a href="https://checkstyle.org/releasenotes.html#Release_14.2.0";>https://checkstyle.org/releasenotes.html#Release_14.2.0</a></p> <p>New:</p> <p><a href="https://redirect.github.com/checkstyle/checkstyle/issues/19513";>#19513</a> - ModifiedOrder: New property modifierOrder. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/17723";>#17723</a> - WhitespaceAfter: new token SINGLE_LINE_COMMENT to catch missing whitespace checks around // comments. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/8312";>#8312</a> - NoWhitespaceAfter: Allow for use of DO_WHILE, LITERAL_CATCH, LITERAL_FOR, LITERAL_IF, and LITERAL_WHILE. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/17172";>#17172</a> - AnnotationLocation new token MODULE_DEF. Google-style: incomplete coverage on annotation rules for modules. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/14986";>#14986</a> - New Check UnnecessaryPermitsClause. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/7541";>#7541</a> - new Check: GoolgeRightCurly. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/19949";>#19949</a> - New check: JavadocSeeTagOrder. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/20639";>#20639</a> - new Check: OpenjdkMethodThrowsAlignment.</p> <p>Bug fixes:</p> <p><a href="https://redirect.github.com/checkstyle/checkstyle/issues/17663";>#17663</a> - Indentation: missing violations for '-<code>></code>' and ',' in return statement continuation. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/20541";>#20541</a> - False Positive: Lambda is incorrectly flaged by OperatorWrap. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21739";>#21739</a> - UnusedLocalVariable: false positive on unnamed variable <code>_</code> inside anonymous class. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21613";>#21613</a> - False negative: UnusedTryResourceShouldBeUnnamed treats same-named identifiers in catch/finally blocks as resource usage. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21695";>#21695</a> - openjdk style: use custon modifierOrder at RedundantModifier. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21689";>#21689</a> - Add GoogleRightCurly to google_checks.xml instead of RightCurly. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/10924";>#10924</a> - All checks that use <code>AbstractCheck#getLine()</code> should check code points instead of characters for spacing. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21139";>#21139</a> - Performance: Avoid duplicate regex match in SuppressFilterElement.isFileMatch. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21528";>#21528</a> - Add checks for Sun Style [4.2 - Wrapping Lines]. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21578";>#21578</a> - False Negative: LambdaParameterName silently passes lambdas in switch rule. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21579";>#21579</a> - False Negative: NeedBraces silently passes lambdas in switch rule. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/5895";>#5895</a> - CLI XML output file: file stops dead when an execption occurs. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/11410";>#11410</a> - False Negative: LeftCurlyCheck. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21583";>#21583</a> - Update Documentation Comments Style Guide: add JavadocSeeTagOrder. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21609";>#21609</a> - NPE in RightCurlyCheck. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/19724";>#19724</a> - google_checks.xml: <code>JavadocMethod</code> <code>accessModifiers</code> should include <code>protected</code> to match <code>MissingJavadocMethod</code> <code>scope</code>. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/20963";>#20963</a> - False negative in LeftCurly for types with option=eol. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21547";>#21547</a> - add OpenjdkMethodThrowsAlignment check in openjdk_checks.xml. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/20636";>#20636</a> - False negatives regarding LeftCurly in openjdk_checks.xml. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/17170";>#17170</a> - Google-style: unfollowed rule on ordering and spacing of module directives. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21454";>#21454</a> - google_checks.xml: false negative 4.3 One statement per line. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21501";>#21501</a> - CommonUtil.getFileExtension includes parent-directory dots in the extension. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21445";>#21445</a> - google_checks.xml: false negative 3.3.1.1 No module imports. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21477";>#21477</a> - Add checks for Sun Style [4.1 - Line Length]. <a href="https://redirect.github.com/checkstyle/checkstyle/issues/21444";>#21444</a> - google_checks.xml: false negative 3.2 Package declaration.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/checkstyle/checkstyle/commit/bc58fc62478af80aa8490ffb6aea212988c5e2a2";><code>bc58fc6</code></a> [maven-release-plugin] prepare release checkstyle-14.3.0</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/5711c7261b8c548b4c762a10310f8ae828683469";><code>5711c72</code></a> doc: release notes for 14.3.0</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/4b8a5b3f12ae067934d8dde6cbc224c735ed891b";><code>4b8a5b3</code></a> minor: Bump version to 14.3.0-SNAPSHOT</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/a93f8f29ded50590fa92e4b8170fe5d3e5459205";><code>a93f8f2</code></a> Issue <a href="https://redirect.github.com/checkstyle/checkstyle/issues/14120";>#14120</a>: add module-info.java to make Checkstyle an explicit Java module</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/9e3482fa93e6f1f7ef8f577238dc86174f75aba3";><code>9e3482f</code></a> [maven-release-plugin] prepare for next development iteration</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/6a200bcb79aeb537e5b1b6578e9ebd7df59e8e96";><code>6a200bc</code></a> [maven-release-plugin] prepare release checkstyle-14.2.0</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/2d2b135b19329f314ec7d54417f6ae12ba79b28d";><code>2d2b135</code></a> doc: release notes for 14.2.0</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/194e7a25b801409001752a4294f3a44735f8b75d";><code>194e7a2</code></a> Issue <a href="https://redirect.github.com/checkstyle/checkstyle/issues/20590";>#20590</a>: Improve Input coverage for compact sources for SuperCloneCheck</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/123f477dd485db3dc0301230de183e33b5f97f99";><code>123f477</code></a> Issue <a href="https://redirect.github.com/checkstyle/checkstyle/issues/17663";>#17663</a>: Indentation: missing violations for '->' and ',' in return stat...</li> <li><a href="https://github.com/checkstyle/checkstyle/commit/4b2f353772912ef3f7c9cc4060ff280adb2c99c5";><code>4b2f353</code></a> Issue <a href="https://redirect.github.com/checkstyle/checkstyle/issues/20541";>#20541</a>: fix OperatorWrap false positive for lambda with block body</li> <li>Additional commits viewable in <a href="https://github.com/checkstyle/checkstyle/compare/checkstyle-14.1.0...checkstyle-14.3.0";>compare view</a></li> </ul> </details> <br /> Updates `org.apache.commons:commons-lang3` from 3.20.0 to 3.21.0 Updates `org.owasp.encoder:encoder` from 1.4.0 to 1.5.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/OWASP/owasp-java-encoder/releases";>org.owasp.encoder:encoder's releases</a>.</em></p> <blockquote> <h1>OWASP Java Encoder 1.5.0</h1> <p>Version 1.5.0 is available from Maven Central. All nine binary/source/Javadoc JARs, four POMs, and their thirteen signatures were downloaded from Central and verified against the retained signed release files. There is no <code>encoder-esapi:1.5.0</code> release.</p> <h2>Security and correctness</h2> <ul> <li>Fixes encoded fragments completing outer HTML or XML parser delimiters across trusted-text boundaries in JavaScript HTML/block, CDATA, and XML-comment contexts. Versions through 1.4.1 are affected. See <a href="https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv";>GHSA-g8p6-7r8f-qrpv</a>.</li> <li>Fixes <code>EncodedWriter</code> close/finalization behavior, exception handling, and overflow-safe array-slice validation.</li> <li>Adds JSON encoding APIs and matching JSP/Jakarta tags and EL functions, plus XML 1.1 bindings.</li> </ul> <h2>Compatibility and migration</h2> <p>Public Java APIs remain binary and source compatible with 1.4.1 for the three supported libraries. Java 8 remains the minimum runtime; packaged consumers passed on Java 8, 11, 17, 21, and 25.</p> <p>The security fixes deliberately change some encoded output:</p> <ul> <li>JavaScript HTML/block modes emit additional hexadecimal escapes while preserving the string value. Review byte snapshots, cache keys, signatures, and output-size budgets.</li> <li>CDATA preserves parsed text but can expand to 13 output characters per input character and can change parser event boundaries.</li> <li>XML-comment hyphens become <code>~</code> under the documented lossy policy.</li> </ul> <p>The optional ESAPI adapter is retired. Version 1.4.1 is its final published release and is unsupported; migrate to direct Java Encoder APIs. Mixing the 1.4.1 adapter with the 1.5 core is not a supported migration.</p> <p>See the <a href="https://github.com/OWASP/owasp-java-encoder/blob/v1.5.0/docs/compatibility-decisions.md#15-parser-boundary-output-migration";>migration notes</a>, <a href="https://github.com/OWASP/owasp-java-encoder/blob/v1.5.0/docs/encoder-esapi-retirement.md";>ESAPI retirement guide</a>, and <a href="https://github.com/OWASP/owasp-java-encoder/blob/v1.5.0/CHANGELOG.md";>changelog</a>.</p> <h2>Maven artifacts</h2> <p>Use group <code>org.owasp.encoder</code> and version <code>1.5.0</code>:</p> <ul> <li><a href="https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder/1.5.0/";>encoder</a></li> <li><a href="https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-jsp/1.5.0/";>encoder-jsp</a></li> <li><a href="https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-jakarta-jsp/1.5.0/";>encoder-jakarta-jsp</a></li> <li><a href="https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-parent/1.5.0/";>encoder-parent</a> (parent POM)</li> </ul> <p>The optional test WAR and retired ESAPI adapter are not published.</p> <h2>Verification</h2> <p>Exact release source: <code>3fbc5da5bcdc49a6e2b4f39d3df7410b7c13d07d</code>. The signed <code>v1.5.0</code> tag identifies this tested commit. PR <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/229";>#229</a>'s squash commit <code>030c137fc14f277afc5fbe303d2ca8a149f8068b</code> has the identical file tree.</p> <p>Release artifacts were built with Eclipse Temurin 17.0.20.1+1 and the committed Maven 3.9.16 wrapper. All 2,287 local reactor tests passed with zero failures, errors, or skips. All thirteen unsigned payload files matched two fresh source-export builds. Post-merge <a href="https://github.com/OWASP/owasp-java-encoder/actions/runs/36471162477";>Java CI</a>, <a href="https://github.com/OWASP/owasp-java-encoder/actions/runs/36471162240";>packaged consumers</a>, and <a href="https://github.com/OWASP/owasp-java-encoder/actions/runs/36471162191";>CodeQL</a> passed, including the browser and Java 8 gates.</p> <p>Project signing fingerprint: <code>1C5F632B86809F2F5DB25092BEA0075F94074A9B</code>.</p> <p>The assets contain the public <code>KEYS</code>, detached signatures, and signed SHA-256/SHA-512 manifests. Follow the <a href="https://github.com/OWASP/owasp-java-encoder/blob/v1.5.0/VERIFYING.md";>verification instructions</a>, using this full expected fingerprint and the 1.5.0 filenames. Authenticate each checksum manifest's signature before checking its entries.</p> <p>Central bundle SHA-256: <code>107b0e4e1f459087d6bbd1e37222c05c7c4630fa55d52bc1e7c99c0077897590</code>.</p> <p>The source-tag documentation preserves the pre-publication notices from the immutable release commit. This release record confirms the subsequently verified Central publication; publication follow-up documentation belongs in a later commit, not a rebuilt release.</p> <h2>v1.4.1 — Security release</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/OWASP/owasp-java-encoder/blob/main/CHANGELOG.md";>org.owasp.encoder:encoder's changelog</a>.</em></p> <blockquote> <h2>1.5.0 — 2026-09-28 UTC</h2> <p>This is a security release for <a href="https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv";>GHSA-g8p6-7r8f-qrpv</a>. Signed artifact availability and independent verification are tracked in the <a href="https://github.com/OWASP/owasp-java-encoder/blob/main/releases/1.5.0.md";>1.5.0 release record</a>.</p> <ul> <li>build: stop Dependabot from recreating already-reviewed incompatible API, servlet-engine and build-tool version proposals. The ignores are limited to routine version updates in the rejected SemVer classes; security updates remain eligible. Mixed historical/current coordinates require manual version review because Dependabot classifies them from their lowest occurrence.</li> <li>removed: retire the optional <code>encoder-esapi</code> adapter. Version 1.4.1 is its final published release and is no longer supported; no <code>encoder-esapi:1.5.0</code> artifact will be published. Consumers must remove the adapter and <a href="https://github.com/OWASP/owasp-java-encoder/blob/main/docs/encoder-esapi-retirement.md";>migrate Java Encoder-backed calls to the direct context APIs</a>. Historical Maven artifacts remain immutable.</li> <li>build: remove advisory-affected dependencies from active Maven plugin realms, including the separately invoked compatibility-fixture downloader; invoke the same japicmp engine without its obsolete reporting wrapper; and submit only actually invoked build plugins to GitHub's dependency graph. Shared inherited tooling is recorded once, and no Dependabot alert is dismissed or suppressed.</li> <li>build/compatibility: update the published JSP provided API to 2.3.3 and the Jakarta test classpath to Servlet 6.1.0 and EL 6.0.1, while retaining independent JSP 2.2.1 and Java 8-compatible Jakarta minimum-consumer fixtures. Japicmp now resolves distinct old/new support classpaths so the 1.4.1 comparison remains complete. Dependabot scans the root Maven reactor once, rather than opening duplicate module proposals, and continues to scan the standalone compatibility-fixture project separately.</li> <li>feat: all four <code>forJavaScript*</code> methods encode dollar sign (<code>$</code>) as <code>\x24</code>, backtick as <code>\x60</code>, and opening brace (<code>{</code>) as <code>\x7b</code> <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/129";>#129</a>. Escaping <code>{</code> prevents input after a trusted <code>$</code> from completing <code>${...}</code>. Encoded output now supports literal text in ordinary (untagged) template literals as well as single- and double-quoted strings. This changes the encoded output while preserving its decoded JavaScript string value. Tagged templates (including <code>String.raw</code>), <code>${...}</code> expression bodies, JSON, and script URLs are unsupported; each method's HTML context restrictions still apply.</li> <li>fix: all four <code>forJavaScript*</code> methods escape unpaired UTF-16 surrogates as <code>\uXXXX</code>, preserving their JavaScript string values through UTF-8 serialization <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/135";>#135</a>, and escape DEL/C1 controls (U+007F to U+009F) as <code>\xNN</code> <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/163";>#163</a>. Valid surrogate pairs and other non-ASCII text remain unescaped except U+2028/U+2029. These are output-fidelity changes; NEL was already ordinary JavaScript string data.</li> <li>fix: the HTML/block JavaScript encoders escape every ASCII character that can contribute to a case-insensitive <code></script</code> end tag or the <code><!--</code> and <code>--></code> script tokens, including the HTML end-tag delimiters, so any nonempty encoded substring cannot complete a delimiter supplied partly by adjacent trusted literal text. <code>forCDATA</code> represents every <code>]</code> and <code>></code> with close/reopen sequences, preserving parsed text while breaking every nonempty encoded substring of <code>]]></code>; its String facade grows with actual output instead of eagerly reserving the 13× maximum. <code>forXmlComment</code> replaces every hyphen with <code>~</code>. These are substantial compatibility-visible output changes; see the <a href="https://github.com/OWASP/owasp-java-encoder/blob/main/docs/compatibility-decisions.md#15-parser-boundary-output-migration";>migration record</a>.</li> <li>fix: <code>EncodedWriter</code> now enforces Writer lifecycle semantics: write, append and flush operations fail after close; repeated close is harmless; the first close finalizes pending input and still attempts the delegate close, preserving simultaneous failures with suppressed exceptions. Array-slice writes now use overflow-safe bounds validation, including <code>Integer.MAX_VALUE</code>-shaped ranges.</li> <li>build: compare all three 1.5.0 artifacts against the immutable 1.4.1 public-API baseline, and verify that every publishable effective POM inherits repository-root SCM connection, developer connection and URL values without module-name suffixes.</li> <li>feat: add <code>Encode.forJson</code> String/Writer methods, the <code>json</code> encoder context, and <code>forJson</code> tags and EL functions in both JSP and Jakarta tag libraries <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/145";>#145</a>. The caller supplies double quotes. Output uses RFC 8259 string escapes and also escapes HTML script delimiters. Java <code>null</code> becomes the text <code>null</code> (the JSON string <code>"null"</code> when quoted); unpaired surrogates use Unicode escapes and may not interoperate with every JSON consumer. Prefer a serializer for complete JSON documents.</li> <li>feat: add <code>forXml11</code>, <code>forXml11Content</code> and <code>forXml11Attribute</code> tags and EL functions to the advanced JSP and Jakarta taglibs, and <code>forXml11</code> to the basic taglibs <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/131";>#131</a>.</li> <li>deprecation: <code>Encoders.URI</code> and both <code>ForUriTag</code> classes are now deprecated like <code>Encode.forUri</code>, whose Javadoc now says what to use instead; the <code>forUri</code> TLD descriptions warn about double encoding, the adapter builds show deprecation call sites, and the README has a <a href="https://github.com/OWASP/owasp-java-encoder/blob/main/README.md#migrating-from-foruri";>forUri migration section</a> <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/130";>#130</a>.</li> <li>fix: the JSP and Jakarta bundles now declare the core version they need (<code>[1.5,2)</code>, because the tags call <code>Encode.forJson</code>) and the JSP API ranges they support, instead of unversioned imports that could wire to an older core and fail when a tag ran. Bundle symbolic names are now declared explicitly and unchanged <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/137";>#137</a>.</li> <li>fix: <code>forHtmlUnquotedAttribute</code> now replaces U+0085 (NEL) with a hyphen like the other C1 control characters, instead of emitting <code>&[#133](https://github.com/OWASP/owasp-java-encoder/issues/133);</code>, which HTML5 parsers decode as U+2026 <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/136";>#136</a>.</li> <li>fix: the XML 1.1 encoders (<code>forXml11</code>, <code>forXml11Content</code>, <code>forXml11Attribute</code>) now encode U+0085 (NEL) as <code>&#x85;</code> and U+2028 (line separator) as <code>&#x2028;</code>, so they are not normalized to a line feed <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/136";>#136</a>.</li> <li>maintenance: clarify output-context contracts and expand XML 1.1 tests, fix clean reactor compilation, and remove the obsolete benchmark profile.</li> </ul> <h3>Build, compatibility and maintenance</h3> <ul> <li>Preserve original-JAR consumers on Java 8/11/17/21/25, explicit/automatic JPMS and Felix R6/R8; add final TLD-surface/Writer contract checks (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/162";>#162</a>, <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/167";>#167</a>).</li> <li>Test packaged javax/Jakarta TLDs through isolated Tomcat/Jasper engines; retain required real-browser and executable-WAR checks with the modernized optional Boot 4.1.1 fixture (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/179";>#179</a>, <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/180";>#180</a>).</li> <li>Pin and guard Actions, add CodeQL/dependency submissions/Dependabot, isolate Maven caches, and preserve required CI/security gates (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/173";>#173</a>, <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/177";>#177</a>).</li> <li>Include Java 9 descriptors in source attachments; normalize source metadata and retain attribution (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/184";>#184</a>).</li> <li>Retire the dormant Maven Site/OSS parent, adopt verified Maven 3.9.16 wrapper and JDK 17 build policy, Checkstyle and measured unit coverage floors; isolate signing/publishing tools, verify local bundles and measure reproducibility (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/185";>#185</a>, <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/187";>#187</a>). This does not change the Java 8 library runtime baseline.</li> <li>Add release verification, historical key evidence, and maintainer custody guidance (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/164";>#164</a>, <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/171";>#171</a>, <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/185";>#185</a>). Historical signing-key authorization records (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/110";>#110</a>) now distinguish retrospective maintainer authentication from historical GitHub/project records; see the <a href="https://github.com/OWASP/owasp-java-encoder/blob/main/releases/historical-key-authentication.md";>key verification record</a>. Central publication and the reported completion of maintainer access/custody work (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/111";>#111</a>) are recorded in the <a href="https://github.com/OWASP/owasp-java-encoder/blob/main/releases/1.4.1-central-publication.md";>publication follow-up</a>.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/3fbc5da5bcdc49a6e2b4f39d3df7410b7c13d07d";><code>3fbc5da</code></a> Prepare OWASP Java Encoder 1.5.0 release</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/df219a5cdb3528221851dc819999bd05d2d88e73";><code>df219a5</code></a> Suppress rejected Dependabot baseline updates (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/228";>#228</a>)</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/a006309a39c528d419fd52ad2011ad90924a424f";><code>a006309</code></a> Consolidate Dependabot API updates (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/217";>#217</a>)</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/f25c77125422dbbd907df7e1e840a088486bb9a2";><code>f25c771</code></a> Harden 1.5.0 context boundaries and release checks (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/210";>#210</a>)</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/07d8e58f6b9fd834089dc86895e01a1be018cbc0";><code>07d8e58</code></a> Complete historical key archive and maintenance closeout (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/209";>#209</a>)</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/1111f7982e492c60abb4897844a02e7b3a44cef7";><code>1111f79</code></a> Record 1.4.1 Central publication and maintainer readiness (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/208";>#208</a>)</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/18582d3c7b2e7cdf87e42ab093a7763524f0fe90";><code>18582d3</code></a> Update bundle plugin and isolate compatibility-sensitive dependency proposals...</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/011734abc029726a115811b53228cdaa789e7232";><code>011734a</code></a> Update artifact actions with verified pins and strict digest checks (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/175";>#175</a>)</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/21705bdfe972f3a4458549fdbefe924b17b97096";><code>21705bd</code></a> Record compatibility commitments and base64url scope decision (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/190";>#190</a>)</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/8c32b2c69337b4883af13e4c9271c7726b0f6666";><code>8c32b2c</code></a> Consolidate consumer docs, release history and community metadata (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/189";>#189</a>)</li> <li>Additional commits viewable in <a href="https://github.com/OWASP/owasp-java-encoder/compare/v1.4.0...v1.5.0";>compare view</a></li> </ul> </details> <br /> Updates `ch.qos.logback:logback-core` from 1.6.4 to 1.6.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/qos-ch/logback/releases";>ch.qos.logback:logback-core's releases</a>.</em></p> <blockquote> <h2>Logback 1.6.5</h2> <p>2026-09-30 Release of logback version 1.6.5</p> <p>• Fixed a vulnerability <a href="https://www.cve.org/CVERecord?id=CVE-2026-104721";>CVE-2026-104721</a> closely related to <a href="https://www.cve.org/cverecord?id=CVE-2026-19880";>CVE-2026-19880</a>. The fix in version 1.6.3, which strips forward and backward slashes from <code>MDC</code> values, was insufficient. An <code>MDC</code> value could still contain relative path components such as .., variable references such as /, or characters that are special in file name patterns and email addresses. This latest vulnerability was found and reported by François Martin (GitHub: <a href="https://github.com/martinfrancois";><code>@martinfrancois</code></a>, <a href="https://github.com/martinfrancois";>https://github.com/martinfrancois</a>).</p> <p><code>MDCBasedDiscriminator</code>, used by <a href="https://logback.qos.ch/manual/appenders-async-sift.html#SiftingAppender";><code>SiftingAppender</code></a>, now rejects <code>MDC</code> values instead of stripping characters from them. An MDC value is rejected if it is empty, if it is longer than 64 characters, if it contains the sequence .., or if it contains any of the following characters: <code>/ \ $ { } [ ] ( ) | ? * + % , @</code>. When an <code>MDC</code> value is rejected, the discriminator returns the value of its <code>DefaultValue</code> property. A warning is emitted for each rejected value. These warnings are rate-limited.</p> <p>• When compression is enabled, <code>TimeBasedRollingPolicy</code> and <code>SizeAndTimeBasedRollingPolicy</code> now also remove old log files that were never compressed, for example because the application was not running at rollover time. Previously, such files were ignored by <code>maxHistory</code> and accumulated indefinitely. This issue was discussed in <a href="https://github.com/qos-ch/logback/discussions/1032";>discussions/1032</a>. See <a href="https://logback.qos.ch/manual/appenders-rolling.html#TimeBasedRollingPolicy";><code>TimeBasedRollingPolicy</code></a>.</p> <p>• <code>SimpleInvocationGate</code>, deprecated in version 1.6.3, is now marked for removal. Use <code>FixedIntervalInvocationGate</code> instead.</p> <p>• A bit-wise identical binary of this version can be reproduced by building from source code at commit d1b829dcdb9fd98511c64401beb1419a9c9384aa associated with the tag v_1.6.5. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/qos-ch/logback/commit/d1b829dcdb9fd98511c64401beb1419a9c9384aa";><code>d1b829d</code></a> prepare release 1.6.5</li> <li><a href="https://github.com/qos-ch/logback/commit/065b9b23d0d39f78bc92fe02f1c206feb281f7ab";><code>065b9b2</code></a> enhance protectin against mischievious MDC values in MDCBasedDiscriminator</li> <li><a href="https://github.com/qos-ch/logback/commit/b69beabb2c48a3e08cb2fdbb0846969be54346cc";><code>b69beab</code></a> complete commit in relation to discussion_1032</li> <li><a href="https://github.com/qos-ch/logback/commit/7266c0b08c4f52aba5aa0983c36622e0cbfccb9a";><code>7266c0b</code></a> fix intermittently failing SocketAppenderMessageLossTest rest condition</li> <li><a href="https://github.com/qos-ch/logback/commit/a633bb0f12600a6260498e1e81d7a123d3af8861";><code>a633bb0</code></a> fix intermittently failing SocketAppenderMessageLossTest rest condition</li> <li><a href="https://github.com/qos-ch/logback/commit/2bc5bccfa5db52428ad439880a35824ac8434819";><code>2bc5bcc</code></a> renamed tbrp and eclosingTBRP, other minor changes</li> <li><a href="https://github.com/qos-ch/logback/commit/2cd876291ce49fb33cbe8a21cdbaeece5c3b4f89";><code>2cd8762</code></a> fix typo in AGENTS.md</li> <li><a href="https://github.com/qos-ch/logback/commit/647846ce230a8865605fe8dd8dc95eac3c1e58ea";><code>647846c</code></a> fix errors when running tests under intellij IDEA</li> <li><a href="https://github.com/qos-ch/logback/commit/1048917953f79e6fa65a9f3f0e77c49f5baff4f0";><code>1048917</code></a> removed ConsoleCharsetPropertyDefiner.java</li> <li><a href="https://github.com/qos-ch/logback/commit/39b50022362fc242fa051d4be6d427aacfdc92cc";><code>39b5002</code></a> added 'since' and 'forRemoval' attributes to SimpleInvocationGate <a href="https://github.com/Deprecatio";><code>@Deprecatio</code></a>...</li> <li>See full diff in <a href="https://github.com/qos-ch/logback/compare/v_1.6.4...v_1.6.5";>compare view</a></li> </ul> </details> <br /> Updates `ch.qos.logback:logback-classic` from 1.6.4 to 1.6.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/qos-ch/logback/releases";>ch.qos.logback:logback-classic's releases</a>.</em></p> <blockquote> <h2>Logback 1.6.5</h2> <p>2026-09-30 Release of logback version 1.6.5</p> <p>• Fixed a vulnerability <a href="https://www.cve.org/CVERecord?id=CVE-2026-104721";>CVE-2026-104721</a> closely related to <a href="https://www.cve.org/cverecord?id=CVE-2026-19880";>CVE-2026-19880</a>. The fix in version 1.6.3, which strips forward and backward slashes from <code>MDC</code> values, was insufficient. An <code>MDC</code> value could still contain relative path components such as .., variable references such as /, or characters that are special in file name patterns and email addresses. This latest vulnerability was found and reported by François Martin (GitHub: <a href="https://github.com/martinfrancois";><code>@martinfrancois</code></a>, <a href="https://github.com/martinfrancois";>https://github.com/martinfrancois</a>).</p> <p><code>MDCBasedDiscriminator</code>, used by <a href="https://logback.qos.ch/manual/appenders-async-sift.html#SiftingAppender";><code>SiftingAppender</code></a>, now rejects <code>MDC</code> values instead of stripping characters from them. An MDC value is rejected if it is empty, if it is longer than 64 characters, if it contains the sequence .., or if it contains any of the following characters: <code>/ \ $ { } [ ] ( ) | ? * + % , @</code>. When an <code>MDC</code> value is rejected, the discriminator returns the value of its <code>DefaultValue</code> property. A warning is emitted for each rejected value. These warnings are rate-limited.</p> <p>• When compression is enabled, <code>TimeBasedRollingPolicy</code> and <code>SizeAndTimeBasedRollingPolicy</code> now also remove old log files that were never compressed, for example because the application was not running at rollover time. Previously, such files were ignored by <code>maxHistory</code> and accumulated indefinitely. This issue was discussed in <a href="https://github.com/qos-ch/logback/discussions/1032";>discussions/1032</a>. See <a href="https://logback.qos.ch/manual/appenders-rolling.html#TimeBasedRollingPolicy";><code>TimeBasedRollingPolicy</code></a>.</p> <p>• <code>SimpleInvocationGate</code>, deprecated in version 1.6.3, is now marked for removal. Use <code>FixedIntervalInvocationGate</code> instead.</p> <p>• A bit-wise identical binary of this version can be reproduced by building from source code at commit d1b829dcdb9fd98511c64401beb1419a9c9384aa associated with the tag v_1.6.5. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/qos-ch/logback/commit/d1b829dcdb9fd98511c64401beb1419a9c9384aa";><code>d1b829d</code></a> prepare release 1.6.5</li> <li><a href="https://github.com/qos-ch/logback/commit/065b9b23d0d39f78bc92fe02f1c206feb281f7ab";><code>065b9b2</code></a> enhance protectin against mischievious MDC values in MDCBasedDiscriminator</li> <li><a href="https://github.com/qos-ch/logback/commit/b69beabb2c48a3e08cb2fdbb0846969be54346cc";><code>b69beab</code></a> complete commit in relation to discussion_1032</li> <li><a href="https://github.com/qos-ch/logback/commit/7266c0b08c4f52aba5aa0983c36622e0cbfccb9a";><code>7266c0b</code></a> fix intermittently failing SocketAppenderMessageLossTest rest condition</li> <li><a href="https://github.com/qos-ch/logback/commit/a633bb0f12600a6260498e1e81d7a123d3af8861";><code>a633bb0</code></a> fix intermittently failing SocketAppenderMessageLossTest rest condition</li> <li><a href="https://github.com/qos-ch/logback/commit/2bc5bccfa5db52428ad439880a35824ac8434819";><code>2bc5bcc</code></a> renamed tbrp and eclosingTBRP, other minor changes</li> <li><a href="https://github.com/qos-ch/logback/commit/2cd876291ce49fb33cbe8a21cdbaeece5c3b4f89";><code>2cd8762</code></a> fix typo in AGENTS.md</li> <li><a href="https://github.com/qos-ch/logback/commit/647846ce230a8865605fe8dd8dc95eac3c1e58ea";><code>647846c</code></a> fix errors when running tests under intellij IDEA</li> <li><a href="https://github.com/qos-ch/logback/commit/1048917953f79e6fa65a9f3f0e77c49f5baff4f0";><code>1048917</code></a> removed ConsoleCharsetPropertyDefiner.java</li> <li><a href="https://github.com/qos-ch/logback/commit/39b50022362fc242fa051d4be6d427aacfdc92cc";><code>39b5002</code></a> added 'since' and 'forRemoval' attributes to SimpleInvocationGate <a href="https://github.com/Deprecatio";><code>@Deprecatio</code></a>...</li> <li>See full diff in <a href="https://github.com/qos-ch/logback/compare/v_1.6.4...v_1.6.5";>compare view</a></li> </ul> </details> <br /> Updates `org.hibernate.orm:hibernate-core` from 7.4.10.Final to 7.4.11.Final <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/hibernate/hibernate-orm/releases";>org.hibernate.orm:hibernate-core's releases</a>.</em></p> <blockquote> <h2>Release 7.4.11</h2> <h1>Hibernate ORM 7.4.11.Final released</h1> <p>Today, we published a new release of Hibernate ORM 7.4: 7.4.11.Final.</p> <p>You can find the full list of 7.4.11.Final changes <a href="https://hibernate.atlassian.net/issues/?jql=project%20%3D%20HHH%20AND%20fixVersion%20%3D%207.4.11";>here</a>.</p> <h2>What's new</h2> <ul> <li>See the <a href="https://hibernate.org/orm/releases/7.4";>website</a> for requirements and compatibilities.</li> <li>See the <a href="https://docs.hibernate.org/orm/7.4/whats-new/whats-new.html";>What's New</a> guide for details about new features and capabilities.</li> <li>See the <a href="https://docs.hibernate.org/orm/7.4/migration-guide/";>Migration Guide</a> for details about migration.</li> </ul> <h2>Conclusion</h2> <p>For additional details, see:</p> <ul> <li>the <a href="https://hibernate.org/orm/releases/7.4/";>release page</a></li> <li>the <a href="https://docs.hibernate.org/orm/7.4/migration-guide/";>Migration Guide</a></li> <li>the <a href="https://docs.hibernate.org/orm/7.4/introduction/html_single/";>Introduction Guide</a></li> <li>the <a href="https://docs.hibernate.org/orm/7.4/userguide/html_single/";>User Guide</a></li> <li>the <a href="https://docs.hibernate.org/orm/7.4/javadocs";>API docs</a></li> </ul> <p>See also the following resources related to supported APIs:</p> <ul> <li>the <a href="https://hibernate.org/community/compatibility-policy/";>compatibility policy</a></li> <li>the <a href="https://docs.hibernate.org/orm/7.4/incubating/incubating.txt";>incubating API report</a> (<code>@Incubating</code>)</li> <li>the <a href="https://docs.hibernate.org/orm/7.4/deprecated/deprecated.txt";>deprecated API report</a> (<code>@Deprecated</code> + <code>@Remove</code>)</li> <li>the <a href="https://docs.hibernate.org/orm/7.4/internals/internal.txt";>internal API report</a> (internal packages, <code>@Internal</code>)</li> </ul> <p>Visit the <a href="https://hibernate.org/community/";>website</a> for details on getting in touch with us.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/hibernate/hibernate-orm/blob/7.4.11/changelog.txt";>org.hibernate.orm:hibernate-core's changelog</a>.</em></p> <blockquote> <h2>Changes in 7.4.11.Final (September 27, 2026)</h2> <p><a href="https://hibernate.atlassian.net/projects/HHH/versions/40453";>https://hibernate.atlassian.net/projects/HHH/versions/40453</a></p> <p>** Bug * HHH-20894 StatelessSession upsert and upsertMultiple concurrency problem * HHH-20876 StatelessSession: Interceptor#onLoad isn't called * HHH-20826 Emit MERGE for on conflict do nothing on H2, Oracle, and SQL Server instead of silently dropping the conflict clause * HHH-17020 Can't use enum as string in join column when field is part of composite primary key</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hibernate/hibernate-orm/commit/a95dd44cf654131e984682687cf1b2ec5d3e34cd";><code>a95dd44</code></a> [Jenkins release job] Preparing release 7.4.11.Final</li> <li><a href="https://github.com/hibernate/hibernate-orm/commit/bb72fdf2984fc514dedaf82ca4fb0a2cecc1ed4d";><code>bb72fdf</code></a> [Jenkins release job] changelog.txt updated by release build 7.4.11.Final</li> <li><a href="https://github.com/hibernate/hibernate-orm/commit/7134c7247665258a49784629a9f96a040fcf333b";><code>7134c72</code></a> Switch maven-plugin intTest logging from logback to log4j2</li> <li><a href="https://github.com/hibernate/hibernate-orm/commit/97efe593c032dc6601639609d8d942171fca2eb5";><code>97efe59</code></a> Fix Maven plugin integration tests not falling back to Maven Central</li> <li><a href="https://github.com/hibernate/hibernate-orm/commit/dd4001e346b1200fceadf68ea4f272c09f8976dc";><code>dd4001e</code></a> Fix Informix nightly failures</li> <li><a href="https://github.com/hibernate/hibernate-orm/commit/58e974a3fb550a5a4e8aa46e9ffd891c2482fad0";><code>58e974a</code></a> HHH-17020 Test and fix issues with enum in id-class not copying type related ...</li> <li><a href="https://github.com/hibernate/hibernate-orm/commit/bc7d0fb21f37f3cb75f7a4baba8b5fe5764a045f";><code>bc7d0fb</code></a> HHH-18910/HHH-17020 Test and fix issues with binding discriminator through pr...</li> <li><a href="https://github.com/hibernate/hibernate-orm/commit/3cdebc023368e55f142a22c2a15d7f60b813179b";><code>3cdebc0</code></a> HHH-20826 Prefer merge for conflict do-nothing to reduce constraint violation...</li> <li><a href="https://github.com/hibernate/hibernate-orm/commit/4555ed02950710810f759a79f45457e7832f09c2";><code>4555ed0</code></a> HHH-20894 Ensure upsert/insert-or-update really is executed and retry batch p...</li> <li><a href="https://github.com/hibernate/hibernate-orm/commit/57c59cfd230e0750fc3ce54ce404e3802d1f9eab";><code>57c59cf</code></a> HHH-20894 Make Sybase behave like a sane SQL database</li> <li>Additional commits viewable in <a href="https://github.com/hibernate/hibernate-orm/compare/7.4.10...7.4.11";>compare view</a></li> </ul> </details> <br /> Updates `com.google.guava:guava` from 33.7.1-jre to 33.7.2-jre <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/guava/releases";>com.google.guava:guava's releases</a>.</em></p> <blockquote> <h2>33.7.2</h2> <h3>Maven</h3> <pre lang="xml"><code><dependency> <groupId>com.google.guava</groupId> <artifactId>guava</artifactId> <version>33.7.2-jre</version> <!-- or, for Android: --> <version>33.7.2-android</version> </dependency> </code></pre> <h3>Jar files</h3> <ul> <li><a href="https://repo1.maven.org/maven2/com/google/guava/guava/33.7.2-jre/guava-33.7.2-jre.jar";>33.7.2-jre.jar</a></li> <li><a href="https://repo1.maven.org/maven2/com/google/guava/guava/33.7.2-android/guava-33.7.2-android.jar";>33.7.2-android.jar</a></li> </ul> <p>Guava requires <a href="https://github.com/google/guava/wiki/UseGuavaInYourBuild#what-about-guavas-own-dependencies";>one runtime dependency</a>, which you can download here:</p> <ul> <li><a href="https://repo1.maven.org/maven2/com/google/guava/failureaccess/1.0.3/failureaccess-1.0.3.jar";>failureaccess-1.0.3.jar</a></li> </ul> <h3>Javadoc</h3> <ul> <li><a href="https://guava.dev/releases/33.7.2-jre/api/docs/";>33.7.2-jre</a></li> <li><a href="https://guava.dev/releases/33.7.2-android/api/docs/";>33.7.2-android</a></li> </ul> <h3>JDiff</h3> <ul> <li><a href="https://guava.dev/releases/33.7.2-jre/api/diffs/";>33.7.2-jre vs. 33.7.1-jre</a></li> <li><a href="https://guava.dev/releases/33.7.2-android/api/diffs/";>33.7.2-android vs. 33.7.1-android</a></li> <li><a href="https://guava.dev/releases/33.7.2-android/api/androiddiffs/";>33.7.2-android vs. 33.7.2-jre</a></li> </ul> <h3>Changelog</h3> <ul> <li><code>collect</code>: Changed <code>MapMaker</code>, <code>CompactHashMap</code>, and <code>CompactHashSet</code> deserialization to <a href="https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94";>avoid eagerly allocating as much memory as a serialization payload requests</a>. (a0d0c36432)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/google/guava/commits";>compare view</a></li> </ul> </details> <br /> Updates `org.seleniumhq.selenium:selenium-bom` from 4.49.0 to 4.50.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/SeleniumHQ/selenium/releases";>org.seleniumhq.selenium:selenium-bom's releases</a>.</em></p> <blockquote> <h2>Selenium 4.50.0</h2> <h2>Detailed Changelogs by Component</h2> <p><!-- raw HTML omitted --> <strong><a href="https://github.com/SeleniumHQ/selenium/blob/trunk/java/CHANGELOG";>Java</a></strong> | <!-- raw HTML omitted --> <strong><a href="https://github.com/SeleniumHQ/selenium/blob/trunk/py/CHANGES";>Python</a></strong> | <!-- raw HTML omitted --> <strong><a href="https://github.com/SeleniumHQ/selenium/blob/trunk/dotnet/CHANGELOG";>DotNet</a></strong> | <!-- raw HTML omitted --> <strong><a href="https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES";>Ruby</a></strong> | <!-- raw HTML omitted --> <strong><a href="https://github.com/SeleniumHQ/selenium/blob/trunk/javascript/selenium-webdriver/CHANGES.md";>JavaScript</a></strong> <!-- raw HTML omitted --></p> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>[dotnet] [bidi] Add image size to capture screenshots by <a href="https://github.com/nvborisenko";><code>@nvborisenko</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18016";>SeleniumHQ/selenium#18016</a></li> <li>[build] only need to run nightly Grid release after production release by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18013";>SeleniumHQ/selenium#18013</a></li> <li>[build] merge the release PR automatically once required checks pass by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18018";>SeleniumHQ/selenium#18018</a></li> <li>[build] move Selenium Manager publishing into sm-snapshot.yml so releases no longer skip it by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18017";>SeleniumHQ/selenium#18017</a></li> <li>[adr] Network async/event API proposal by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/17685";>SeleniumHQ/selenium#17685</a></li> <li>[adr] Behavioral contract for the low-level WebDriver BiDi layer by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/17786";>SeleniumHQ/selenium#17786</a></li> <li>[java] remove deprecated methods from the HttpClient interface by <a href="https://github.com/joerg1985";><code>@joerg1985</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/17993";>SeleniumHQ/selenium#17993</a></li> <li>[rb] cover BiDi key, wheel, release, and setFiles scenarios in the Input spec by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18022";>SeleniumHQ/selenium#18022</a></li> <li>[py] replace the blanket remote BiDi test suite with an opt-in list by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18023";>SeleniumHQ/selenium#18023</a></li> <li>[build] always use the latest Selenium Manager code when needed for tests by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18024";>SeleniumHQ/selenium#18024</a></li> <li>[py] cleanup for ruff b904 raise from by <a href="https://github.com/iampopovich";><code>@iampopovich</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18030";>SeleniumHQ/selenium#18030</a></li> <li>[py]: Apply ClientConfig <code>user_agent</code> and <code>extra_headers</code> per connection by <a href="https://github.com/navin772";><code>@navin772</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/17944";>SeleniumHQ/selenium#17944</a></li> <li>[build] add bazel flag to support cross-compiling all Selenium Manager binaries from Linux or Mac by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18029";>SeleniumHQ/selenium#18029</a></li> <li>[rb] render WebSocket debug log lines lazily by <a href="https://github.com/ikraamg";><code>@ikraamg</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18033";>SeleniumHQ/selenium#18033</a></li> <li>[rb] Implement driver methods for installing and uninstalling web extensions via BiDi by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/17879";>SeleniumHQ/selenium#17879</a></li> <li>[java] Parse each BiDi command response only once by <a href="https://github.com/pujagani";><code>@pujagani</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18011";>SeleniumHQ/selenium#18011</a></li> <li>[py] run the requirements lock check on RBE with a platform-agnostic lock by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18039";>SeleniumHQ/selenium#18039</a></li> <li>[dotnet] [bidi] Support DestinationFolder optional arg in StartScreencast by <a href="https://github.com/nvborisenko";><code>@nvborisenko</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18042";>SeleniumHQ/selenium#18042</a></li> <li>[dotnet] [bidi] Add Emulation.SetTextLayoutModeOverride command by <a href="https://github.com/nvborisenko";><code>@nvborisenko</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18043";>SeleniumHQ/selenium#18043</a></li> <li>[build] use RBE to prepare and build the artifacts for releases by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18041";>SeleniumHQ/selenium#18041</a></li> <li>[py] move complete GitHub Actions test suite to nightly and run only high value smoke tests for PRs by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18040";>SeleniumHQ/selenium#18040</a></li> <li>[py] Type BaseOptions.set_capability parameters by <a href="https://github.com/adamtheturtle";><code>@adamtheturtle</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18027";>SeleniumHQ/selenium#18027</a></li> <li>[java] Use one HttpClient.Factory inside one RemoteWebDriver instance by <a href="https://github.com/joerg1985";><code>@joerg1985</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18038";>SeleniumHQ/selenium#18038</a></li> <li>[build] Ignore exec.log recursively by <a href="https://github.com/nvborisenko";><code>@nvborisenko</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18049";>SeleniumHQ/selenium#18049</a></li> <li>[build] fetch the changelog history since the previous release tag instead of computing a depth by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18044";>SeleniumHQ/selenium#18044</a></li> <li>[build] prefix workflow names by how they run so the Actions sidebar groups them by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18053";>SeleniumHQ/selenium#18053</a></li> <li>[py] run grid specific tests on windows during scheduled tests by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18054";>SeleniumHQ/selenium#18054</a></li> <li>[build] generate webref_cddl.bzl from the BiDi spec's external specifications list by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18055";>SeleniumHQ/selenium#18055</a></li> <li>[build] update BiDi schema generation to include external spec methods missing due to upstream spec omissions by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18057";>SeleniumHQ/selenium#18057</a></li> <li>[py] Type WebElement.get_attribute name by <a href="https://github.com/adamtheturtle";><code>@adamtheturtle</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18028";>SeleniumHQ/selenium#18028</a></li> <li>[build] generate the BiDi schema vendor section from Mozilla's Firefox CDDL by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18060";>SeleniumHQ/selenium#18060</a></li> <li>[dotnet] [build] Include package license/notice files by <a href="https://github.com/nvborisenko";><code>@nvborisenko</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18048";>SeleniumHQ/selenium#18048</a></li> <li>[dotnet][java][js][py][rb] remove deprecated Firefox profile extension and cert methods by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18066";>SeleniumHQ/selenium#18066</a></li> <li>[java] resolve exceptions from the W3C state in ErrorHandler by <a href="https://github.com/yashp676";><code>@yashp676</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18059";>SeleniumHQ/selenium#18059</a></li> <li>[build] Fix the two CDDL repin fallouts breaking every Python target by <a href="https://github.com/AutomatedTester";><code>@AutomatedTester</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18068";>SeleniumHQ/selenium#18068</a></li> <li>[dotnet] [bidi] Eliminate BiDi context on hot path by <a href="https://github.com/nvborisenko";><code>@nvborisenko</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18069";>SeleniumHQ/selenium#18069</a></li> <li>[py] [dotnet] [java] declare Firefox default preferences in each binding by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18070";>SeleniumHQ/selenium#18070</a></li> <li>[build] add support for Mozilla's Commands fragment in the BiDi schema by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18071";>SeleniumHQ/selenium#18071</a></li> <li>[rust] fix flaky tests by <a href="https://github.com/titusfortner";><code>@titusfortner</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/18073";>SeleniumHQ/selenium#18073</a></li> <li>[js] Align BiDi Generator with the low-level contract by <a href="https://github.com/pujagani";><code>@pujagani</code></a> in <a href="https://redirect.github.com/SeleniumHQ/selenium/pull/17973";>SeleniumHQ/selenium#17973</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/SeleniumHQ/selenium/commit/ca2a96694916c818db1c388b7a1c14cf3380c098";><code>ca2a966</code></a> [build] Prepare for release of selenium-4.50.0 (<a href="https://redirect.github.com/SeleniumHQ/selenium/issues/18105";>#18105</a>)</li> <li><a href="https://github.com/SeleniumHQ/selenium/commit/47912e04623da2d3ac764586b0e2306cacb83de1";><code>47912e0</code></a> [build] publish docs with a rebase instead of serializing on a concurrency group</li> <li><a href="https://github.com/SeleniumHQ/selenium/commit/89f967d3aeb7438e0dd8e48584820cdccf824c80";><code>89f967d</code></a> [dotnet] [bidi] Align CapabilityResponse type name with spec (<a href="https://redirect.github.com/SeleniumHQ/selenium/issues/18099";>#18099</a>)</li> <li><a href="https://github.com/SeleniumHQ/selenium/commit/6d070b5e046839f3aa9b44d817d854aa8b7d6e7b";><code>6d070b5</code></a> [dotnet] [bidi] Preserve BiDi additional data in context commands (<a href="https://redirect.github.com/SeleniumHQ/selenium/issues/18097";>#18097</a>)</li> <li><a href="https://github.com/SeleniumHQ/selenium/commit/18c9d4e9accec72199d97e648f6ca5f8ab5f65fa";><code>18c9d4e</code></a> [java] Keep guarded runnables alive when a task throws an Error (<a href="https://redirect.github.com/SeleniumHQ/selenium/issues/18091";>#18091</a>)</li> <li><a href="https://github.com/SeleniumHQ/selenium/commit/97caa3fc8efe059fe4a4fddab8fca341634c26bc";><code>97caa3f</code></a> [java] Restore HttpCommandExecutor client and httpClientFactory fields as dep...</li> <li><a href="https://github.com/SeleniumHQ/selenium/commit/1564f3a4b65924a0b34a649cc8ede2a2a96ae66f";><code>1564f3a</code></a> [build] Automated Browser Version Update (major) (<a href="https://redirect.github.com/SeleniumHQ/selenium/issues/18096";>#18096</a>)</li> <li><a href="https://github.com/SeleniumHQ/selenium/commit/b63635e2d54516abf9ccf31220a1dd4ab932124c";><code>b63635e</code></a> [build] ensure the pin for the released Selenium Manager is the one built in ...</li> <li><a href="https://github.com/SeleniumHQ/selenium/commit/1d433a984f7e16666552b4326fe8a33525a2bc1a";><code>1d433a9</code></a> [build] verify published packages from the release tag instead of trunk HEAD</li> <li><a href="https://github.com/SeleniumHQ/selenium/commit/531ccc71480ee02904a5d01942341bf9245bc0d8";><code>531ccc7</code></a> [build] grant the release Selenium Manager job the permissions its nested job...</li> <li>Additional commits viewable in <a href="https://github.com/SeleniumHQ/selenium/compare/selenium-4.49.0...selenium-4.50.0";>compare view</a></li> </ul> </details> <br /> Updates `org.apache.maven:apache-maven` from 3.9.16 to 3.10.0 Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
