dependabot[bot] opened a new pull request, #2904: URL: https://github.com/apache/shiro/pull/2904
Bumps the maven-dependencies group with 40 updates: | Package | From | To | | --- | --- | --- | | [org.apache:apache](https://github.com/apache/maven-apache-parent) | `39` | `40` | | org.apache.commons:commons-lang3 | `3.20.0` | `3.21.0` | | [org.mockito:mockito-core](https://github.com/mockito/mockito) | `5.23.0` | `5.24.0` | | [org.mockito:mockito-junit-jupiter](https://github.com/mockito/mockito) | `5.23.0` | `5.24.0` | | [net.bytebuddy:byte-buddy](https://github.com/raphw/byte-buddy) | `1.18.12` | `1.18.14` | | [net.bytebuddy:byte-buddy-agent](https://github.com/raphw/byte-buddy) | `1.18.12` | `1.18.14` | | [org.owasp.encoder:encoder](https://github.com/owasp/owasp-java-encoder) | `1.4.0` | `1.4.1` | | org.slf4j:slf4j-api | `2.0.18` | `2.0.20` | | org.slf4j:slf4j-simple | `2.0.18` | `2.0.20` | | org.slf4j:jcl-over-slf4j | `2.0.18` | `2.0.20` | | org.slf4j:slf4j-jdk14 | `2.0.18` | `2.0.20` | | org.slf4j:slf4j-reload4j | `2.0.18` | `2.0.20` | | [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) | `1.6.3` | `1.6.4` | | [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.6.3` | `1.6.4` | | [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java) | `1.85.2` | `1.86` | | [org.codehaus.mojo:versions-maven-plugin](https://github.com/mojohaus/versions) | `2.21.0` | `2.22.0` | | [org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin) | `3.6.1` | `3.6.2` | | [com.github.siom79.japicmp:japicmp-maven-plugin](https://github.com/siom79/japicmp) | `0.26.1` | `0.26.2` | | [org.codehaus.mojo:buildnumber-maven-plugin](https://github.com/mojohaus/buildnumber-maven-plugin) | `3.3.0` | `3.3.1` | | [org.codehaus.mojo:taglist-maven-plugin](https://github.com/mojohaus/taglist-maven-plugin) | `3.2.2` | `3.2.3` | | [org.codehaus.mojo:jdepend-maven-plugin](https://github.com/mojohaus/jdepend-maven-plugin) | `2.2.0` | `2.2.1` | | [org.projectlombok:lombok](https://github.com/projectlombok/lombok) | `1.18.46` | `1.18.48` | | org.apache.tomcat.embed:tomcat-embed-core | `9.0.121` | `9.0.122` | | org.apache.tomcat.embed:tomcat-embed-el | `9.0.121` | `9.0.122` | | org.apache.tomcat.embed:tomcat-embed-websocket | `9.0.121` | `9.0.122` | | org.apache.tomcat:tomcat-jaspic-api | `9.0.121` | `9.0.122` | | org.apache.tomcat:tomcat-catalina | `9.0.121` | `9.0.122` | | [org.codehaus.mojo:xml-maven-plugin](https://github.com/mojohaus/xml-maven-plugin) | `1.2.1` | `1.2.2` | | org.apache.karaf.features:framework | `4.4.11` | `4.4.12` | | [org.omnifaces:omnifaces](https://github.com/omnifaces/omnifaces) | `3.14.24` | `3.14.25` | | org.yaml:snakeyaml | `2.6` | `2.7` | | [org.codehaus.mojo:exec-maven-plugin](https://github.com/mojohaus/exec-maven-plugin) | `3.6.3` | `3.6.4` | | org.apache.tomcat.embed:tomcat-embed-core | `10.1.59` | `10.1.60` | | org.apache.tomcat.embed:tomcat-embed-el | `10.1.59` | `10.1.60` | | org.apache.tomcat.embed:tomcat-embed-websocket | `10.1.59` | `10.1.60` | | org.apache.tomcat:tomcat-jaspic-api | `10.1.59` | `10.1.60` | | org.apache.tomcat:tomcat-catalina | `10.1.59` | `10.1.60` | | org.apache.tomcat:tomcat-jasper | `10.1.59` | `10.1.60` | | org.apache.tomcat:tomcat-jasper-el | `10.1.59` | `10.1.60` | | org.apache.maven:apache-maven | `3.9.16` | `3.10.0` | Updates `org.apache:apache` from 39 to 40 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/maven-apache-parent/releases";>org.apache:apache's releases</a>.</em></p> <blockquote> <h2>40</h2> <!-- raw HTML omitted --> <h2>:boom: Breaking changes</h2> <ul> <li>Replace nicoulaj checksum plugin with maveniverse checksum plugin (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/599";>#599</a>) <a href="https://github.com/slawekjaranowski";><code>@slawekjaranowski</code></a></li> <li><a href="https://redirect.github.com/apache/maven-apache-parent/issues/586";>#586</a>: Use RAT0.18 and remove commons-lang3 configuration for JDK25 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/587";>#587</a>) <a href="https://github.com/ottlinger";><code>@ottlinger</code></a></li> <li>Property <code>version.maven-surefire</code> was removed in <a href="https://redirect.github.com/apache/maven-apache-parent/pull/588";>apache/maven-apache-parent#588</a>, should be replaced by <code>version.maven-surefire-plugin</code>, <code>version.maven-failsafe-plugin</code> or <code>version.maven-surefire-report-plugin</code></li> </ul> <h2>🚀 New features and improvements</h2> <ul> <li>Fix several version property issues (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/588";>#588</a>) <a href="https://github.com/ctubbsii";><code>@ctubbsii</code></a></li> </ul> <h2>📝 Documentation updates</h2> <ul> <li>Update documentation for push-to-atr profile (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/613";>#613</a>) <a href="https://github.com/slawekjaranowski";><code>@slawekjaranowski</code></a></li> <li>Restore the common wording on the download page (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/596";>#596</a>) <a href="https://github.com/slachiewicz";><code>@slachiewicz</code></a></li> </ul> <h2>👻 Maintenance</h2> <ul> <li>Add local maven configuration for ATR project name override (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/614";>#614</a>) <a href="https://github.com/slawekjaranowski";><code>@slawekjaranowski</code></a></li> <li>Remove custom name-template for release-drafter (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/604";>#604</a>) <a href="https://github.com/slawekjaranowski";><code>@slawekjaranowski</code></a></li> <li>Port the site documentation from APT to Markdown (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/595";>#595</a>) <a href="https://github.com/slachiewicz";><code>@slachiewicz</code></a></li> </ul> <h2>📦 Dependency updates</h2> <ul> <li>Bump org.apache.maven.plugins:maven-deploy-plugin from 3.1.4 to 3.2.0 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/612";>#612</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li>Bump org.apache.maven.plugins:maven-install-plugin from 3.1.4 to 3.2.0 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/611";>#611</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li>Bump org.apache.maven.plugins:maven-plugin-tools from 3.15.2 to 3.16.0 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/610";>#610</a>) <a href="https://github.com/slawekjaranowski";><code>@slawekjaranowski</code></a></li> <li>Bump surefire-plugin, failsafe-plugin, surefire-report-plugin from 3.5.6 to 3.6.0 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/605";>#605</a>) <a href="https://github.com/slawekjaranowski";><code>@slawekjaranowski</code></a></li> <li>Bump org.apache.tooling:atr-maven-plugin from 1.0.0-alpha-1 to 1.0.0-beta-1 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/598";>#598</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li>Bump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/600";>#600</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li><a href="https://redirect.github.com/apache/maven-apache-parent/issues/586";>#586</a>: Use RAT0.18 and remove commons-lang3 configuration for JDK25 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/587";>#587</a>) <a href="https://github.com/ottlinger";><code>@ottlinger</code></a></li> <li>Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/594";>#594</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li>Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml from 4 to 5 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/591";>#591</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li>Bump apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml from 4 to 5 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/593";>#593</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li>Bump apache/maven-gh-actions-shared/.github/workflows/stale.yml from 4 to 5 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/592";>#592</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li>Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml from 4 to 5 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/590";>#590</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li>Bump org.apache.maven.plugins:maven-help-plugin from 3.5.1 to 3.5.2 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/589";>#589</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/apache/maven-apache-parent/commits";>compare view</a></li> </ul> </details> <br /> Updates `org.apache.commons:commons-lang3` from 3.20.0 to 3.21.0 Updates `org.mockito:mockito-core` from 5.23.0 to 5.24.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mockito/mockito/releases";>org.mockito:mockito-core's releases</a>.</em></p> <blockquote> <h2>v5.24.0</h2> <p><!-- raw HTML omitted --><!-- raw HTML omitted --><em>Changelog generated by <a href="https://github.com/shipkit/shipkit-changelog";>Shipkit Changelog Gradle Plugin</a></em><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h4>5.24.0</h4> <ul> <li>2026-09-23 - <a href="https://github.com/mockito/mockito/compare/v5.23.0...v5.24.0";>27 commit(s)</a> by Andrei Solntsev, DragonFSKY, Hünkar Can Tunç, Joshua Selbo, M. Minot, Markus Gaisbauer, Mirko Alicastro, Vinod Kumar M ( codingkiddo ), dependabot[bot]</li> <li>Fix Mockito docs for -javaagent flag with Gradle [(<a href="https://redirect.github.com/mockito/mockito/issues/3866";>#3866</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3866";>mockito/mockito#3866</a>)</li> <li>Kotlin example for adding Mockito as an agent is incorrect [(<a href="https://redirect.github.com/mockito/mockito/issues/3864";>#3864</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3864";>mockito/mockito#3864</a>)</li> <li>Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 [(<a href="https://redirect.github.com/mockito/mockito/issues/3862";>#3862</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3862";>mockito/mockito#3862</a>)</li> <li>Bump gradle/actions from 6.2.0 to 6.3.0 [(<a href="https://redirect.github.com/mockito/mockito/issues/3852";>#3852</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3852";>mockito/mockito#3852</a>)</li> <li>Bump gradle/actions from 5 to 6.2.0 [(<a href="https://redirect.github.com/mockito/mockito/issues/3851";>#3851</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3851";>mockito/mockito#3851</a>)</li> <li>Preserve method parameters when clearing inline mocks [(<a href="https://redirect.github.com/mockito/mockito/issues/3847";>#3847</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3847";>mockito/mockito#3847</a>)</li> <li>Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 [(<a href="https://redirect.github.com/mockito/mockito/issues/3845";>#3845</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3845";>mockito/mockito#3845</a>)</li> <li>Print object fields via reflection when <code>toString()</code> is not implemented [(<a href="https://redirect.github.com/mockito/mockito/issues/3844";>#3844</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3844";>mockito/mockito#3844</a>)</li> <li>Migrate extensions-tests to JUnit Jupiter [(<a href="https://redirect.github.com/mockito/mockito/issues/3840";>#3840</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3840";>mockito/mockito#3840</a>)</li> <li>Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 [(<a href="https://redirect.github.com/mockito/mockito/issues/3839";>#3839</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3839";>mockito/mockito#3839</a>)</li> <li>docs(when-verify): fixes to explanations about redundancy [(<a href="https://redirect.github.com/mockito/mockito/issues/3838";>#3838</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3838";>mockito/mockito#3838</a>)</li> <li>Confusing inconsistency in example method calls in “stubbing and verifying is redundant” note of “when” and “verify” Javadoc [(<a href="https://redirect.github.com/mockito/mockito/issues/3837";>#3837</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3837";>mockito/mockito#3837</a>)</li> <li>Bump actions/checkout from 6 to 7 [(<a href="https://redirect.github.com/mockito/mockito/issues/3836";>#3836</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3836";>mockito/mockito#3836</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/2740";>#2740</a> : Add mockMaker option to <code>@Spy</code> annotation [(<a href="https://redirect.github.com/mockito/mockito/issues/3835";>#3835</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3835";>mockito/mockito#3835</a>)</li> <li>Bump graalvm/setup-graalvm from 1.5.5 to 1.5.6 [(<a href="https://redirect.github.com/mockito/mockito/issues/3834";>#3834</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3834";>mockito/mockito#3834</a>)</li> <li>Bump graalvm/setup-graalvm from 1.5.4 to 1.5.5 [(<a href="https://redirect.github.com/mockito/mockito/issues/3833";>#3833</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3833";>mockito/mockito#3833</a>)</li> <li>Bump codecov/codecov-action from 6 to 7 [(<a href="https://redirect.github.com/mockito/mockito/issues/3831";>#3831</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3831";>mockito/mockito#3831</a>)</li> <li>Bump graalvm/setup-graalvm from 1.4.5 to 1.5.4 [(<a href="https://redirect.github.com/mockito/mockito/issues/3830";>#3830</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3830";>mockito/mockito#3830</a>)</li> <li>Fix clearInlineMocks not de-registering singleton mocks [(<a href="https://redirect.github.com/mockito/mockito/issues/3829";>#3829</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3829";>mockito/mockito#3829</a>)</li> <li>Fix NotAMockException when using mockSingleton with MockitoJUnit [(<a href="https://redirect.github.com/mockito/mockito/issues/3827";>#3827</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3827";>mockito/mockito#3827</a>)</li> <li>NotAMockException when using mockSingleton with MockitoSession or MockitoJUnit [(<a href="https://redirect.github.com/mockito/mockito/issues/3826";>#3826</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3826";>mockito/mockito#3826</a>)</li> <li>Improve Gradle agent docs for configuration cache [(<a href="https://redirect.github.com/mockito/mockito/issues/3823";>#3823</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3823";>mockito/mockito#3823</a>)</li> <li>Gradle documentation for setting up instrumentation with Gradle configuration cache [(<a href="https://redirect.github.com/mockito/mockito/issues/3822";>#3822</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3822";>mockito/mockito#3822</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/3818";>#3818</a> : Fix data race in InvocationContainerImpl.invocationForStubbing [(<a href="https://redirect.github.com/mockito/mockito/issues/3819";>#3819</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3819";>mockito/mockito#3819</a>)</li> <li>Data race on invocationForPotentialStubbing [(<a href="https://redirect.github.com/mockito/mockito/issues/3818";>#3818</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3818";>mockito/mockito#3818</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/3814";>#3814</a> : implement package-level clinit suppression [(<a href="https://redirect.github.com/mockito/mockito/issues/3815";>#3815</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3815";>mockito/mockito#3815</a>)</li> <li>Package-level clinit suppression [(<a href="https://redirect.github.com/mockito/mockito/issues/3814";>#3814</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3814";>mockito/mockito#3814</a>)</li> <li>Upgrade Android Gradle Plugin to 8.13.2 [(<a href="https://redirect.github.com/mockito/mockito/issues/3812";>#3812</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3812";>mockito/mockito#3812</a>)</li> <li>Replaces raw generic types with type parameters [(<a href="https://redirect.github.com/mockito/mockito/issues/3806";>#3806</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3806";>mockito/mockito#3806</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/2398";>#2398</a> : Implement global suppress static initialization leveraging java agent [(<a href="https://redirect.github.com/mockito/mockito/issues/3801";>#3801</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3801";>mockito/mockito#3801</a>)</li> <li>Bump codecov/codecov-action from 5 to 6 [(<a href="https://redirect.github.com/mockito/mockito/issues/3800";>#3800</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3800";>mockito/mockito#3800</a>)</li> <li>Fix non-deterministic AssertionError when using MockMakers.SUBCLASS (<a href="https://redirect.github.com/mockito/mockito/issues/3406";>#3406</a>, <a href="https://redirect.github.com/mockito/mockito/issues/2823";>#2823</a>) [(<a href="https://redirect.github.com/mockito/mockito/issues/3795";>#3795</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3795";>mockito/mockito#3795</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/3536";>#3536</a> : Implement SpyStatic API [(<a href="https://redirect.github.com/mockito/mockito/issues/3794";>#3794</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3794";>mockito/mockito#3794</a>)</li> <li>The class's MethodParameters are removed after clearAllCaches is invoked [(<a href="https://redirect.github.com/mockito/mockito/issues/3763";>#3763</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3763";>mockito/mockito#3763</a>)</li> <li>[FeatureRequest / Idea] Create Mockito.spyStatic [(<a href="https://redirect.github.com/mockito/mockito/issues/3536";>#3536</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3536";>mockito/mockito#3536</a>)</li> <li>Add option to specify mockmaker for <code>@Spy</code> [(<a href="https://redirect.github.com/mockito/mockito/issues/2740";>#2740</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/2740";>mockito/mockito#2740</a>)</li> <li>How can I suppress static initializer? [(<a href="https://redirect.github.com/mockito/mockito/issues/2398";>#2398</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/2398";>mockito/mockito#2398</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mockito/mockito/commit/5a2f0f81cdafc9b34ddb4520db7f8866c787dac0";><code>5a2f0f8</code></a> Fix Mockito docs for -javaagent flag with Gradle (<a href="https://redirect.github.com/mockito/mockito/issues/3866";>#3866</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/9c5f36fb9f2ad89fbaab828d33d144cd398a4079";><code>9c5f36f</code></a> Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 (<a href="https://redirect.github.com/mockito/mockito/issues/3862";>#3862</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/e7fd06dda31daf0c71ad1dedc76ffc9f8ecf6973";><code>e7fd06d</code></a> Preserve method parameters when clearing inline mocks (<a href="https://redirect.github.com/mockito/mockito/issues/3847";>#3847</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/5a676bcd9ef9a10db46e1dc34e190eb46faa2687";><code>5a676bc</code></a> Bump gradle/actions from 6.2.0 to 6.3.0 (<a href="https://redirect.github.com/mockito/mockito/issues/3852";>#3852</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/508f8e78f5ac5ed9f23f7b92b01de76752120a67";><code>508f8e7</code></a> Bump gradle/actions from 5 to 6.2.0 (<a href="https://redirect.github.com/mockito/mockito/issues/3851";>#3851</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/ee8a330da0218f32d5964acdeaa3ac39e2c6ce14";><code>ee8a330</code></a> Print object fields via reflection when <code>toString()</code> is not implemented (<a href="https://redirect.github.com/mockito/mockito/issues/3844";>#3844</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/39b1aba6e6cc92d8ad3c812dcc16ed357c9fbc85";><code>39b1aba</code></a> Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 (<a href="https://redirect.github.com/mockito/mockito/issues/3845";>#3845</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/d8638e1a8b67b4acea63c80dc85d62eda4ef57f5";><code>d8638e1</code></a> Migrate extensions-tests to JUnit Jupiter (<a href="https://redirect.github.com/mockito/mockito/issues/3840";>#3840</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/0aab922fa4c8967e50613671f58c707a69606c62";><code>0aab922</code></a> Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 (<a href="https://redirect.github.com/mockito/mockito/issues/3839";>#3839</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/f3cf74c7e1106f7d32299001ca0ecf2c492c468c";><code>f3cf74c</code></a> docs(when-verify): fixes to explanations about redundancy (<a href="https://redirect.github.com/mockito/mockito/issues/3838";>#3838</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mockito/mockito/compare/v5.23.0...v5.24.0";>compare view</a></li> </ul> </details> <br /> Updates `org.mockito:mockito-junit-jupiter` from 5.23.0 to 5.24.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mockito/mockito/releases";>org.mockito:mockito-junit-jupiter's releases</a>.</em></p> <blockquote> <h2>v5.24.0</h2> <p><!-- raw HTML omitted --><!-- raw HTML omitted --><em>Changelog generated by <a href="https://github.com/shipkit/shipkit-changelog";>Shipkit Changelog Gradle Plugin</a></em><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h4>5.24.0</h4> <ul> <li>2026-09-23 - <a href="https://github.com/mockito/mockito/compare/v5.23.0...v5.24.0";>27 commit(s)</a> by Andrei Solntsev, DragonFSKY, Hünkar Can Tunç, Joshua Selbo, M. Minot, Markus Gaisbauer, Mirko Alicastro, Vinod Kumar M ( codingkiddo ), dependabot[bot]</li> <li>Fix Mockito docs for -javaagent flag with Gradle [(<a href="https://redirect.github.com/mockito/mockito/issues/3866";>#3866</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3866";>mockito/mockito#3866</a>)</li> <li>Kotlin example for adding Mockito as an agent is incorrect [(<a href="https://redirect.github.com/mockito/mockito/issues/3864";>#3864</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3864";>mockito/mockito#3864</a>)</li> <li>Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 [(<a href="https://redirect.github.com/mockito/mockito/issues/3862";>#3862</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3862";>mockito/mockito#3862</a>)</li> <li>Bump gradle/actions from 6.2.0 to 6.3.0 [(<a href="https://redirect.github.com/mockito/mockito/issues/3852";>#3852</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3852";>mockito/mockito#3852</a>)</li> <li>Bump gradle/actions from 5 to 6.2.0 [(<a href="https://redirect.github.com/mockito/mockito/issues/3851";>#3851</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3851";>mockito/mockito#3851</a>)</li> <li>Preserve method parameters when clearing inline mocks [(<a href="https://redirect.github.com/mockito/mockito/issues/3847";>#3847</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3847";>mockito/mockito#3847</a>)</li> <li>Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 [(<a href="https://redirect.github.com/mockito/mockito/issues/3845";>#3845</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3845";>mockito/mockito#3845</a>)</li> <li>Print object fields via reflection when <code>toString()</code> is not implemented [(<a href="https://redirect.github.com/mockito/mockito/issues/3844";>#3844</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3844";>mockito/mockito#3844</a>)</li> <li>Migrate extensions-tests to JUnit Jupiter [(<a href="https://redirect.github.com/mockito/mockito/issues/3840";>#3840</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3840";>mockito/mockito#3840</a>)</li> <li>Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 [(<a href="https://redirect.github.com/mockito/mockito/issues/3839";>#3839</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3839";>mockito/mockito#3839</a>)</li> <li>docs(when-verify): fixes to explanations about redundancy [(<a href="https://redirect.github.com/mockito/mockito/issues/3838";>#3838</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3838";>mockito/mockito#3838</a>)</li> <li>Confusing inconsistency in example method calls in “stubbing and verifying is redundant” note of “when” and “verify” Javadoc [(<a href="https://redirect.github.com/mockito/mockito/issues/3837";>#3837</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3837";>mockito/mockito#3837</a>)</li> <li>Bump actions/checkout from 6 to 7 [(<a href="https://redirect.github.com/mockito/mockito/issues/3836";>#3836</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3836";>mockito/mockito#3836</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/2740";>#2740</a> : Add mockMaker option to <code>@Spy</code> annotation [(<a href="https://redirect.github.com/mockito/mockito/issues/3835";>#3835</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3835";>mockito/mockito#3835</a>)</li> <li>Bump graalvm/setup-graalvm from 1.5.5 to 1.5.6 [(<a href="https://redirect.github.com/mockito/mockito/issues/3834";>#3834</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3834";>mockito/mockito#3834</a>)</li> <li>Bump graalvm/setup-graalvm from 1.5.4 to 1.5.5 [(<a href="https://redirect.github.com/mockito/mockito/issues/3833";>#3833</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3833";>mockito/mockito#3833</a>)</li> <li>Bump codecov/codecov-action from 6 to 7 [(<a href="https://redirect.github.com/mockito/mockito/issues/3831";>#3831</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3831";>mockito/mockito#3831</a>)</li> <li>Bump graalvm/setup-graalvm from 1.4.5 to 1.5.4 [(<a href="https://redirect.github.com/mockito/mockito/issues/3830";>#3830</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3830";>mockito/mockito#3830</a>)</li> <li>Fix clearInlineMocks not de-registering singleton mocks [(<a href="https://redirect.github.com/mockito/mockito/issues/3829";>#3829</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3829";>mockito/mockito#3829</a>)</li> <li>Fix NotAMockException when using mockSingleton with MockitoJUnit [(<a href="https://redirect.github.com/mockito/mockito/issues/3827";>#3827</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3827";>mockito/mockito#3827</a>)</li> <li>NotAMockException when using mockSingleton with MockitoSession or MockitoJUnit [(<a href="https://redirect.github.com/mockito/mockito/issues/3826";>#3826</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3826";>mockito/mockito#3826</a>)</li> <li>Improve Gradle agent docs for configuration cache [(<a href="https://redirect.github.com/mockito/mockito/issues/3823";>#3823</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3823";>mockito/mockito#3823</a>)</li> <li>Gradle documentation for setting up instrumentation with Gradle configuration cache [(<a href="https://redirect.github.com/mockito/mockito/issues/3822";>#3822</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3822";>mockito/mockito#3822</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/3818";>#3818</a> : Fix data race in InvocationContainerImpl.invocationForStubbing [(<a href="https://redirect.github.com/mockito/mockito/issues/3819";>#3819</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3819";>mockito/mockito#3819</a>)</li> <li>Data race on invocationForPotentialStubbing [(<a href="https://redirect.github.com/mockito/mockito/issues/3818";>#3818</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3818";>mockito/mockito#3818</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/3814";>#3814</a> : implement package-level clinit suppression [(<a href="https://redirect.github.com/mockito/mockito/issues/3815";>#3815</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3815";>mockito/mockito#3815</a>)</li> <li>Package-level clinit suppression [(<a href="https://redirect.github.com/mockito/mockito/issues/3814";>#3814</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3814";>mockito/mockito#3814</a>)</li> <li>Upgrade Android Gradle Plugin to 8.13.2 [(<a href="https://redirect.github.com/mockito/mockito/issues/3812";>#3812</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3812";>mockito/mockito#3812</a>)</li> <li>Replaces raw generic types with type parameters [(<a href="https://redirect.github.com/mockito/mockito/issues/3806";>#3806</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3806";>mockito/mockito#3806</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/2398";>#2398</a> : Implement global suppress static initialization leveraging java agent [(<a href="https://redirect.github.com/mockito/mockito/issues/3801";>#3801</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3801";>mockito/mockito#3801</a>)</li> <li>Bump codecov/codecov-action from 5 to 6 [(<a href="https://redirect.github.com/mockito/mockito/issues/3800";>#3800</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3800";>mockito/mockito#3800</a>)</li> <li>Fix non-deterministic AssertionError when using MockMakers.SUBCLASS (<a href="https://redirect.github.com/mockito/mockito/issues/3406";>#3406</a>, <a href="https://redirect.github.com/mockito/mockito/issues/2823";>#2823</a>) [(<a href="https://redirect.github.com/mockito/mockito/issues/3795";>#3795</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3795";>mockito/mockito#3795</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/3536";>#3536</a> : Implement SpyStatic API [(<a href="https://redirect.github.com/mockito/mockito/issues/3794";>#3794</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3794";>mockito/mockito#3794</a>)</li> <li>The class's MethodParameters are removed after clearAllCaches is invoked [(<a href="https://redirect.github.com/mockito/mockito/issues/3763";>#3763</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3763";>mockito/mockito#3763</a>)</li> <li>[FeatureRequest / Idea] Create Mockito.spyStatic [(<a href="https://redirect.github.com/mockito/mockito/issues/3536";>#3536</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3536";>mockito/mockito#3536</a>)</li> <li>Add option to specify mockmaker for <code>@Spy</code> [(<a href="https://redirect.github.com/mockito/mockito/issues/2740";>#2740</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/2740";>mockito/mockito#2740</a>)</li> <li>How can I suppress static initializer? [(<a href="https://redirect.github.com/mockito/mockito/issues/2398";>#2398</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/2398";>mockito/mockito#2398</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mockito/mockito/commit/5a2f0f81cdafc9b34ddb4520db7f8866c787dac0";><code>5a2f0f8</code></a> Fix Mockito docs for -javaagent flag with Gradle (<a href="https://redirect.github.com/mockito/mockito/issues/3866";>#3866</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/9c5f36fb9f2ad89fbaab828d33d144cd398a4079";><code>9c5f36f</code></a> Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 (<a href="https://redirect.github.com/mockito/mockito/issues/3862";>#3862</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/e7fd06dda31daf0c71ad1dedc76ffc9f8ecf6973";><code>e7fd06d</code></a> Preserve method parameters when clearing inline mocks (<a href="https://redirect.github.com/mockito/mockito/issues/3847";>#3847</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/5a676bcd9ef9a10db46e1dc34e190eb46faa2687";><code>5a676bc</code></a> Bump gradle/actions from 6.2.0 to 6.3.0 (<a href="https://redirect.github.com/mockito/mockito/issues/3852";>#3852</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/508f8e78f5ac5ed9f23f7b92b01de76752120a67";><code>508f8e7</code></a> Bump gradle/actions from 5 to 6.2.0 (<a href="https://redirect.github.com/mockito/mockito/issues/3851";>#3851</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/ee8a330da0218f32d5964acdeaa3ac39e2c6ce14";><code>ee8a330</code></a> Print object fields via reflection when <code>toString()</code> is not implemented (<a href="https://redirect.github.com/mockito/mockito/issues/3844";>#3844</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/39b1aba6e6cc92d8ad3c812dcc16ed357c9fbc85";><code>39b1aba</code></a> Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 (<a href="https://redirect.github.com/mockito/mockito/issues/3845";>#3845</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/d8638e1a8b67b4acea63c80dc85d62eda4ef57f5";><code>d8638e1</code></a> Migrate extensions-tests to JUnit Jupiter (<a href="https://redirect.github.com/mockito/mockito/issues/3840";>#3840</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/0aab922fa4c8967e50613671f58c707a69606c62";><code>0aab922</code></a> Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 (<a href="https://redirect.github.com/mockito/mockito/issues/3839";>#3839</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/f3cf74c7e1106f7d32299001ca0ecf2c492c468c";><code>f3cf74c</code></a> docs(when-verify): fixes to explanations about redundancy (<a href="https://redirect.github.com/mockito/mockito/issues/3838";>#3838</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mockito/mockito/compare/v5.23.0...v5.24.0";>compare view</a></li> </ul> </details> <br /> Updates `net.bytebuddy:byte-buddy` from 1.18.12 to 1.18.14 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/releases";>net.bytebuddy:byte-buddy's releases</a>.</em></p> <blockquote> <h2>Byte Buddy 1.18.14</h2> <ul> <li>Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.</li> <li>Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.</li> <li>Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.</li> <li>Sign all deployed files using sigstore, in addition to the existing GPG signature.</li> <li>Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.</li> </ul> <h2>Byte Buddy 1.18.13</h2> <ul> <li>Actually include the SBOM within the published artifacts.</li> <li>Avoid propagation of path traversals that are contained in jar files which are copied without transformation.</li> <li>Avoid repeated traversal of previously visited type hierarchies to improve performance.</li> <li>Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.</li> <li>Create Gradle tasks using Gradle's task registration API if available.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/blob/master/release-notes.md";>net.bytebuddy:byte-buddy's changelog</a>.</em></p> <blockquote> <h3>14. September 2026: version 1.18.14</h3> <ul> <li>Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.</li> <li>Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.</li> <li>Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.</li> <li>Sign all deployed files using sigstore, in addition to the existing GPG signature.</li> <li>Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.</li> </ul> <h3>2. September 2026: version 1.18.13</h3> <ul> <li>Actually include the SBOM within the published artifacts.</li> <li>Avoid propagation of path traversals that are contained in jar files which are copied without transformation.</li> <li>Avoid repeated traversal of previously visited type hierarchies to improve performance.</li> <li>Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.</li> <li>Create Gradle tasks using Gradle's task registration API if available.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/raphw/byte-buddy/commit/92846cb0fa3480ed6e0fc41803e8e74f52070c59";><code>92846cb</code></a> [publish] Releasing Byte Buddy 1.18.14</li> <li><a href="https://github.com/raphw/byte-buddy/commit/a8a9f14e225f87477f65251db17f475895d73369";><code>a8a9f14</code></a> [release] Release new version</li> <li><a href="https://github.com/raphw/byte-buddy/commit/b0fe0066a8ea4f9316aa2a06906c87c0f529ddcd";><code>b0fe006</code></a> Skip the signature creation for artifacts that are not deployed.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/c6107833a61e389719b56623fc36e3e476442e11";><code>c610783</code></a> Resolve the signed POM file by the path of the project file.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/caab321964c9da0e0620fc0ff931413629ecf0b3";><code>caab321</code></a> Sign the deployed POM file and allow for a sigstore dry run.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/c68a9c1761bc3fcda4d942ac7cc3a9e58a200e78";><code>c68a9c1</code></a> Supply the agent argument to the attacher process as an environment variable.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/3ac9ded1959f2aa29809f1bf156d736ef602e3fa";><code>3ac9ded</code></a> Avoid symbolic link resolution on recursive deletion and validate Android ent...</li> <li><a href="https://github.com/raphw/byte-buddy/commit/8dbae60638aac34bed01685d9b322d08433c38de";><code>8dbae60</code></a> Sign deployed files using sigstore.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/5d83cd4a0fc954fb0f6bd13e71f60b532a5d7f95";><code>5d83cd4</code></a> Disable semantic versioning check for protected constructor in abstract class...</li> <li><a href="https://github.com/raphw/byte-buddy/commit/172e0f4712366d4c82c53604214f427cd9232e69";><code>172e0f4</code></a> Move to method to apply suppression.</li> <li>Additional commits viewable in <a href="https://github.com/raphw/byte-buddy/compare/byte-buddy-1.18.12...byte-buddy-1.18.14";>compare view</a></li> </ul> </details> <br /> Updates `net.bytebuddy:byte-buddy-agent` from 1.18.12 to 1.18.14 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/releases";>net.bytebuddy:byte-buddy-agent's releases</a>.</em></p> <blockquote> <h2>Byte Buddy 1.18.14</h2> <ul> <li>Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.</li> <li>Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.</li> <li>Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.</li> <li>Sign all deployed files using sigstore, in addition to the existing GPG signature.</li> <li>Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.</li> </ul> <h2>Byte Buddy 1.18.13</h2> <ul> <li>Actually include the SBOM within the published artifacts.</li> <li>Avoid propagation of path traversals that are contained in jar files which are copied without transformation.</li> <li>Avoid repeated traversal of previously visited type hierarchies to improve performance.</li> <li>Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.</li> <li>Create Gradle tasks using Gradle's task registration API if available.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/blob/master/release-notes.md";>net.bytebuddy:byte-buddy-agent's changelog</a>.</em></p> <blockquote> <h3>14. September 2026: version 1.18.14</h3> <ul> <li>Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.</li> <li>Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.</li> <li>Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.</li> <li>Sign all deployed files using sigstore, in addition to the existing GPG signature.</li> <li>Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.</li> </ul> <h3>2. September 2026: version 1.18.13</h3> <ul> <li>Actually include the SBOM within the published artifacts.</li> <li>Avoid propagation of path traversals that are contained in jar files which are copied without transformation.</li> <li>Avoid repeated traversal of previously visited type hierarchies to improve performance.</li> <li>Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.</li> <li>Create Gradle tasks using Gradle's task registration API if available.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/raphw/byte-buddy/commit/92846cb0fa3480ed6e0fc41803e8e74f52070c59";><code>92846cb</code></a> [publish] Releasing Byte Buddy 1.18.14</li> <li><a href="https://github.com/raphw/byte-buddy/commit/a8a9f14e225f87477f65251db17f475895d73369";><code>a8a9f14</code></a> [release] Release new version</li> <li><a href="https://github.com/raphw/byte-buddy/commit/b0fe0066a8ea4f9316aa2a06906c87c0f529ddcd";><code>b0fe006</code></a> Skip the signature creation for artifacts that are not deployed.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/c6107833a61e389719b56623fc36e3e476442e11";><code>c610783</code></a> Resolve the signed POM file by the path of the project file.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/caab321964c9da0e0620fc0ff931413629ecf0b3";><code>caab321</code></a> Sign the deployed POM file and allow for a sigstore dry run.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/c68a9c1761bc3fcda4d942ac7cc3a9e58a200e78";><code>c68a9c1</code></a> Supply the agent argument to the attacher process as an environment variable.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/3ac9ded1959f2aa29809f1bf156d736ef602e3fa";><code>3ac9ded</code></a> Avoid symbolic link resolution on recursive deletion and validate Android ent...</li> <li><a href="https://github.com/raphw/byte-buddy/commit/8dbae60638aac34bed01685d9b322d08433c38de";><code>8dbae60</code></a> Sign deployed files using sigstore.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/5d83cd4a0fc954fb0f6bd13e71f60b532a5d7f95";><code>5d83cd4</code></a> Disable semantic versioning check for protected constructor in abstract class...</li> <li><a href="https://github.com/raphw/byte-buddy/commit/172e0f4712366d4c82c53604214f427cd9232e69";><code>172e0f4</code></a> Move to method to apply suppression.</li> <li>Additional commits viewable in <a href="https://github.com/raphw/byte-buddy/compare/byte-buddy-1.18.12...byte-buddy-1.18.14";>compare view</a></li> </ul> </details> <br /> Updates `net.bytebuddy:byte-buddy-agent` from 1.18.12 to 1.18.14 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/releases";>net.bytebuddy:byte-buddy-agent's releases</a>.</em></p> <blockquote> <h2>Byte Buddy 1.18.14</h2> <ul> <li>Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.</li> <li>Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.</li> <li>Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.</li> <li>Sign all deployed files using sigstore, in addition to the existing GPG signature.</li> <li>Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.</li> </ul> <h2>Byte Buddy 1.18.13</h2> <ul> <li>Actually include the SBOM within the published artifacts.</li> <li>Avoid propagation of path traversals that are contained in jar files which are copied without transformation.</li> <li>Avoid repeated traversal of previously visited type hierarchies to improve performance.</li> <li>Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.</li> <li>Create Gradle tasks using Gradle's task registration API if available.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/blob/master/release-notes.md";>net.bytebuddy:byte-buddy-agent's changelog</a>.</em></p> <blockquote> <h3>14. September 2026: version 1.18.14</h3> <ul> <li>Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.</li> <li>Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.</li> <li>Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.</li> <li>Sign all deployed files using sigstore, in addition to the existing GPG signature.</li> <li>Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.</li> </ul> <h3>2. September 2026: version 1.18.13</h3> <ul> <li>Actually include the SBOM within the published artifacts.</li> <li>Avoid propagation of path traversals that are contained in jar files which are copied without transformation.</li> <li>Avoid repeated traversal of previously visited type hierarchies to improve performance.</li> <li>Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.</li> <li>Create Gradle tasks using Gradle's task registration API if available.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/raphw/byte-buddy/commit/92846cb0fa3480ed6e0fc41803e8e74f52070c59";><code>92846cb</code></a> [publish] Releasing Byte Buddy 1.18.14</li> <li><a href="https://github.com/raphw/byte-buddy/commit/a8a9f14e225f87477f65251db17f475895d73369";><code>a8a9f14</code></a> [release] Release new version</li> <li><a href="https://github.com/raphw/byte-buddy/commit/b0fe0066a8ea4f9316aa2a06906c87c0f529ddcd";><code>b0fe006</code></a> Skip the signature creation for artifacts that are not deployed.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/c6107833a61e389719b56623fc36e3e476442e11";><code>c610783</code></a> Resolve the signed POM file by the path of the project file.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/caab321964c9da0e0620fc0ff931413629ecf0b3";><code>caab321</code></a> Sign the deployed POM file and allow for a sigstore dry run.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/c68a9c1761bc3fcda4d942ac7cc3a9e58a200e78";><code>c68a9c1</code></a> Supply the agent argument to the attacher process as an environment variable.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/3ac9ded1959f2aa29809f1bf156d736ef602e3fa";><code>3ac9ded</code></a> Avoid symbolic link resolution on recursive deletion and validate Android ent...</li> <li><a href="https://github.com/raphw/byte-buddy/commit/8dbae60638aac34bed01685d9b322d08433c38de";><code>8dbae60</code></a> Sign deployed files using sigstore.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/5d83cd4a0fc954fb0f6bd13e71f60b532a5d7f95";><code>5d83cd4</code></a> Disable semantic versioning check for protected constructor in abstract class...</li> <li><a href="https://github.com/raphw/byte-buddy/commit/172e0f4712366d4c82c53604214f427cd9232e69";><code>172e0f4</code></a> Move to method to apply suppression.</li> <li>Additional commits viewable in <a href="https://github.com/raphw/byte-buddy/compare/byte-buddy-1.18.12...byte-buddy-1.18.14";>compare view</a></li> </ul> </details> <br /> Updates `org.owasp.encoder:encoder` from 1.4.0 to 1.4.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/owasp/owasp-java-encoder/releases";>org.owasp.encoder:encoder's releases</a>.</em></p> <blockquote> <h2>v1.4.1 — Security release</h2> <h1>OWASP Java Encoder 1.4.1</h1> <p><strong>Version 1.4.1 is available from Maven Central.</strong> Published on 2026-09-27 UTC (2026-09-26 in America/Los_Angeles) from the original retained signed bundle. All 12 binary/source/Javadoc JARs, five POMs, and their 17 signatures were downloaded from Central and matched the original release byte for byte. Versions through 1.4.0 remain affected.</p> <p>Central artifacts: <a href="https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder/1.4.1/";>encoder</a>, <a href="https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-jsp/1.4.1/";>encoder-jsp</a>, <a href="https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-jakarta-jsp/1.4.1/";>encoder-jakarta-jsp</a>, <a href="https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-esapi/1.4.1/";>encoder-esapi</a>, <a href="https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-parent/1.4.1/";>encoder-parent</a>.</p> <h2>Security fixes</h2> <p>Upgrade all OWASP Java Encoder dependencies to <strong>1.4.1</strong>. Versions through 1.4.0 are affected by the following issues:</p> <ul> <li><strong>GHSA-57jg-769q-93vh:</strong> <code>EncodedWriter</code> could lose encoding context when pending lookahead overflowed its output buffer, allowing CDATA or XML comment delimiters to escape and dropping or duplicating characters. The fix preserves unconsumed input across buffer flushes.</li> <li><strong>GHSA-q6jj-5396-8mq2:</strong> <code>EncodedWriter</code> could loop indefinitely when a write did not supply enough input to resolve pending lookahead. The fix retains pending input for the next write or close instead of spinning.</li> <li><strong>GHSA-p9ff-j89j-9xhx:</strong> long runs of U+2028 or U+2029 could cause the String overloads of <code>Encode.forCssString</code> and <code>Encode.forCssUrl</code> to throw <code>AssertionError</code>. The fix corrects the maximum encoded output size. The JSP/Jakarta CSS EL functions and the ESAPI CSS adapter also benefit from this fix.</li> </ul> <p>The first two issues require direct use of <code>EncodedWriter</code>; the <code>Encode</code> facade, JSP/Jakarta tags, and ESAPI adapter do not call it internally. The CSS size issue affects String-returning APIs; Writer overloads and CSS tags are unaffected.</p> <h2>Compatibility and other changes</h2> <ul> <li>Java 8 remains the minimum runtime. Build and test with JDK 17.</li> <li>Public method signatures, Maven coordinates, explicit JPMS module names, and historical <code>Automatic-Module-Name</code> values are retained.</li> <li>The JSP, Jakarta, and ESAPI module descriptors now expose their public API dependencies transitively (<a href="https://redirect.github.com/owasp/owasp-java-encoder/issues/98";>#98</a>).</li> <li>The ESAPI adapter now uses a fixed ESAPI 2.7.0.0 dependency; tested compatibility is documented in <code>esapi/README.md</code> (<a href="https://redirect.github.com/owasp/owasp-java-encoder/issues/99";>#99</a>).</li> <li>Build tooling, packaged OSGi compatibility tests, project metadata, and Jakarta test dependency alignment have been updated (<a href="https://redirect.github.com/owasp/owasp-java-encoder/issues/90";>#90</a>, <a href="https://redirect.github.com/owasp/owasp-java-encoder/issues/106";>#106</a>).</li> </ul> <h2>Maven artifacts</h2> <p>Use version <code>1.4.1</code> for every artifact you consume:</p> <table> <thead> <tr> <th>Group ID</th> <th>Artifact ID</th> </tr> </thead> <tbody> <tr> <td><code>org.owasp.encoder</code></td> <td><code>encoder</code></td> </tr> <tr> <td><code>org.owasp.encoder</code></td> <td><code>encoder-jsp</code></td> </tr> <tr> <td><code>org.owasp.encoder</code></td> <td><code>encoder-jakarta-jsp</code></td> </tr> <tr> <td><code>org.owasp.encoder</code></td> <td><code>encoder-esapi</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/OWASP/owasp-java-encoder/blob/main/CHANGELOG.md";>org.owasp.encoder:encoder's changelog</a>.</em></p> <blockquote> <h2>1.4.1 — 2026-09-26 UTC</h2> <p><a href="https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.4.1";>Signed GitHub release</a> (<a href="https://github.com/OWASP/owasp-java-encoder/tree/v1.4.1";>tag created 2026-09-25 in America/Los_Angeles</a>). <strong>Available from Maven Central. Upgrade all four Java Encoder artifacts; versions through 1.4.0 are affected.</strong> Central publication was verified on 2026-09-27 UTC (2026-09-26 in America/Los_Angeles); <a href="https://github.com/OWASP/owasp-java-encoder/blob/main/releases/1.4.1-central-publication.md";>all artifacts and signatures match the retained release</a>.</p> <ul> <li>Fix <code>EncodedWriter</code> context corruption during buffer overflow (<a href="https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-57jg-769q-93vh";>GHSA-57jg-769q-93vh</a>).</li> <li>Fix insufficient-lookahead infinite loops in <code>EncodedWriter</code> (<a href="https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-q6jj-5396-8mq2";>GHSA-q6jj-5396-8mq2</a>).</li> <li>Fix CSS String API maximum-output sizing for long U+2028/U+2029 runs (<a href="https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-p9ff-j89j-9xhx";>GHSA-p9ff-j89j-9xhx</a>).</li> <li>Preserve Java 8 runtime, public method signatures, Maven and JPMS identities; make adapter API dependencies transitively readable in module descriptors.</li> <li>Pin the ESAPI adapter's default to 2.7.0.0 rather than a Maven version range.</li> </ul> <p>See the <a href="https://github.com/OWASP/owasp-java-encoder/blob/main/releases/1.4.1.md";>full release record</a> for affected entry points, coordinates, verification and publication status. Later 1.5 changes do not alter these retained artifacts.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/ab76d586bbfa4f138993d5dc3e9c4b3ea0dc7dce";><code>ab76d58</code></a> Use primary OWASP release email and document pending Central access</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/b51c575674dc093eec1824211a568f04ea6b64a7";><code>b51c575</code></a> Prepare 1.4.1 security release with a dedicated project signing key</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/0583c225b3e6a1f2c4c8a3844c34a63d9c5fe3c9";><code>0583c22</code></a> Fix EncodedWriter handling of pending lookahead characters</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/d15c6fee88a1816cfc3c213f564ec2700d7472b1";><code>d15c6fe</code></a> Fix CSSEncoder.maxEncodedLength for U+2028 and U+2029</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/b52a95443ce80dd67147d97a73a92ff4026148a3";><code>b52a954</code></a> Merge pull request <a href="https://redirect.github.com/owasp/owasp-java-encoder/issues/150";>#150</a> from OWASP/docs/security-policy</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/80851e3aaad1c1c26ce195371ad2273d79435ad7";><code>80851e3</code></a> Qualify the SECURITY.md upgrade note with the Java 8 baseline</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/16312e6afc1e7f8097eb555a7e74e97880bc0ed4";><code>16312e6</code></a> Expand the security policy now that private reporting is enabled</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/14fd1c52e05bd486bad0be72fd49b4c9e0111437";><code>14fd1c5</code></a> Merge pull request <a href="https://redirect.github.com/owasp/owasp-java-encoder/issues/106";>#106</a> from OWASP/fix/jakarta-test-encoder-version</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/2a55ccce4bc94d25f0b526e47a33b517484edaf7";><code>2a55ccc</code></a> Merge pull request <a href="https://redirect.github.com/owasp/owasp-java-encoder/issues/98";>#98</a> from OWASP/fix/jpms-adapter-dependencies</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/316290a1de49acdd46eebd697b6993ddefb20119";><code>316290a</code></a> Merge main into fix/jpms-adapter-dependencies</li> <li>Additional commits viewable in <a href="https://github.com/owasp/owasp-java-encoder/compare/v1.4.0...v1.4.1";>compare view</a></li> </ul> </details> <br /> Updates `org.slf4j:slf4j-api` from 2.0.18 to 2.0.20 Updates `org.slf4j:slf4j-simple` from 2.0.18 to 2.0.20 Updates `org.slf4j:jcl-over-slf4j` from 2.0.18 to 2.0.20 Updates `org.slf4j:slf4j-jdk14` from 2.0.18 to 2.0.20 Updates `org.slf4j:slf4j-reload4j` from 2.0.18 to 2.0.20 Updates `org.slf4j:slf4j-simple` from 2.0.18 to 2.0.20 Updates `ch.qos.logback:logback-core` from 1.6.3 to 1.6.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/qos-ch/logback/releases";>ch.qos.logback:logback-core's releases</a>.</em></p> <blockquote> <h2>Logback 1.6.4</h2> <p><strong>2026-09-24 Release of logback version 1.6.4</strong></p> <p>• Variable substitution is again applied to the <code>scan</code> attribute of the <code><configuration></code> element. The scanning refactoring in version 1.5.27 had dropped substitution, so values such as <code>${logback.scan.enabled:-true}</code> were no longer resolved. As before version 1.5.27, an unrecognized non-empty value turns scanning on. The same substitution now applies to the scan attribute of <code><propertiesConfigurator></code>. This regression was reported in <a href="https://redirect.github.com/qos-ch/logback/issues/1065";>issues/1065</a> by <a href="https://github.com/vaibhavjain2";>vaibhavjain2</a>.</p> <p>• <code>OutputStreamAppender</code> and <code>FileAppender</code> now handle stateful encoders. The <code>Encoder</code> interface has a new default method called <code>isStateful()</code>, which returns <code>false</code>. An encoder that keeps state between calls to <code>encode()</code> can return true. For such encoders, the appender holds its write lock while encoding and while writing, so the output of concurrent appends cannot interleave. Stateless encoders still encode outside the lock, so their performance does not change. Existing encoders need no changes.</p> <p>• Several race conditions in <code>OutputStreamAppender</code> and <code>FileAppender</code> were fixed. The appender is now marked started and the encoder header is written while the same lock is held, so a concurrent append can no longer write an event before the header. After acquiring the lock, the appender checks again whether it has been stopped, so no event is written after the footer. In prudent mode, FileAppender now encodes and writes each event while holding the lock.</p> <p>• Fixed a data race on the logger count in LoggerContext. Loggers are created under the lock of their parent logger, so loggers with different parents could be created at the same time and increments of the shared counter could be lost. As a result, <code>LoggerContext.size()</code> could return a value lower than the actual number of loggers. The counter is now an <code>AtomicInteger</code>. This issue was reported in <a href="https://redirect.github.com/qos-ch/logback/issues/1038";>issues/1038</a> by hcantunc. The fix was contributed in PR <a href="https://redirect.github.com/qos-ch/logback/issues/1055";>#1055</a> by <a href="https://github.com/seonwooj0810";>seonwoo_jung</a>.</p> <p>• <code>TimeBasedRollingPolicy</code> now supports half-day periods. Date patterns with the AM/PM marker, for example %d{yyyy-MM-dd-a}, used to be detected as daily and rolled over only at midnight. They now roll over at both 00:00 and 12:00. This issue was reported in issues/976 by shakthifuture. The fix was contributed in PR <a href="https://redirect.github.com/qos-ch/logback/issues/1051";>#1051</a> by <a href="https://github.com/seonwooj0810";>seonwoo_jung</a>. See <code>TimeBasedRollingPolicy</code>.</p> <p>• If <code>org.jline.jansi.AnsiConsole</code> cannot be found on the class path, <code>JansiConsoleAppender</code> now emits warnings that explain how to add org.jline:jansi-core and then writes to the plain console stream. See codes.html#missingJlineJansi.</p> <p>• The unused <code>ch.qos.logback.classic.util.LogbackMDCAdapterSimple</code> class was removed. <code>LogbackMDCAdapter</code> remains the default MDC adapter.</p> <p>• A bit-wise identical binary of this version can be reproduced by building from source code at commit 07d291ca0d280bc5da934ec9ff5f1da634fd7937 associated with the tag v_1.6.4. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/qos-ch/logback/compare/v_1.6.3...v_1.6.4";>https://github.com/qos-ch/logback/compare/v_1.6.3...v_1.6.4</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/qos-ch/logback/commit/07d291ca0d280bc5da934ec9ff5f1da634fd7937";><code>07d291c</code></a> preapre release 1.6.4</li> <li><a href="https://github.com/qos-ch/logback/commit/9627dafd8c21639e653f80c3e1f98bf8b4bb9be5";><code>9627daf</code></a> revert to Collections.unmodifiableMap instead of</li> <li><a href="https://github.com/qos-ch/logback/commit/aa42fb551a52901929433cd7282264a911e5a12e";><code>aa42fb5</code></a> disabled RollingCalendarTest#testVaryingNumberOfHalfDailyPeriods to shave off...</li> <li><a href="https://github.com/qos-ch/logback/commit/ddc7459d0022d4c07b2800490f6e607258d1f567";><code>ddc7459</code></a> Support HALF_DAY periodicity for AM/PM date patterns</li> <li><a href="https://github.com/qos-ch/logback/commit/42d75d76bebc4789edcd06869e8ad6f5b74c8da4";><code>42d75d7</code></a> disable LoggerContextTest#concurrentGetLoggerKeepsSizeConsistent to shave exe...</li> <li><a href="https://github.com/qos-ch/logback/commit/bffd55ed222eda41a67b0f2736476e47fad49f57";><code>bffd55e</code></a> add warnings about missing jline.jansi classes</li> <li><a href="https://github.com/qos-ch/logback/commit/8de0b9b64abc9a4be13df0e7332a0c6827e1d0a7";><code>8de0b9b</code></a> Fix data race on LoggerContext.size (<a href="https://redirect.github.com/qos-ch/logback/issues/1038";>#1038</a>)</li> <li><a href="https://github.com/qos-ch/logback/commit/76c73d1402cef39586527446665e870efe32d2d6";><code>76c73d1</code></a> add MinimalUnmodifiableMap and return it in LogbackMDCAdapter#getPropertyMap</li> <li><a href="https://github.com/qos-ch/logback/commit/a2c416a361a9af8677b79ba3b3c235a6984a2dfd";><code>a2c416a</code></a> Fix formatting of email instruction in README</li> <li><a href="https://github.com/qos-ch/logback/commit/2c89727c6a24a8283d7485165f70199abbf00b16";><code>2c89727</code></a> mailing lists have been deactivated</li> <li>Additional commits viewable in <a href="https://github.com/qos-ch/logback/compare/v_1.6.3...v_1.6.4";>compare view</a></li> </ul> </details> <br /> Updates `ch.qos.logback:logback-classic` from 1.6.3 to 1.6.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/qos-ch/logback/releases";>ch.qos.logback:logback-classic's releases</a>.</em></p> <blockquote> <h2>Logback 1.6.4</h2> <p><strong>2026-09-24 Release of logback version 1.6.4</strong></p> <p>• Variable substitution is again applied to the <code>scan</code> attribute of the <code><configuration></code> element. The scanning refactoring in version 1.5.27 had dropped substitution, so values such as <code... _Description has been truncated_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
