dependabot[bot] opened a new pull request, #2936: URL: https://github.com/apache/shiro/pull/2936
Bumps the maven-dependencies group with 46 updates: | Package | From | To | | --- | --- | --- | | [org.apache:apache](https://github.com/apache/maven-apache-parent) | `39` | `40` | | org.apache.commons:commons-lang3 | `3.20.0` | `3.21.0` | | [org.mockito:mockito-core](https://github.com/mockito/mockito) | `5.23.0` | `5.24.0` | | [org.mockito:mockito-junit-jupiter](https://github.com/mockito/mockito) | `5.23.0` | `5.24.0` | | [net.bytebuddy:byte-buddy](https://github.com/raphw/byte-buddy) | `1.18.12` | `1.18.16` | | [net.bytebuddy:byte-buddy-agent](https://github.com/raphw/byte-buddy) | `1.18.12` | `1.18.16` | | [org.owasp.encoder:encoder](https://github.com/OWASP/owasp-java-encoder) | `1.4.0` | `1.6.0` | | org.slf4j:slf4j-api | `2.0.18` | `2.0.20` | | org.slf4j:slf4j-simple | `2.0.18` | `2.0.20` | | org.slf4j:jcl-over-slf4j | `2.0.18` | `2.0.20` | | org.slf4j:slf4j-jdk14 | `2.0.18` | `2.0.20` | | org.slf4j:slf4j-reload4j | `2.0.18` | `2.0.20` | | [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) | `1.6.3` | `1.6.6` | | [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.6.3` | `1.6.6` | | [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java) | `1.85.2` | `1.86` | | [org.codehaus.mojo:versions-maven-plugin](https://github.com/mojohaus/versions) | `2.21.0` | `2.23.0` | | [org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin) | `3.6.1` | `3.6.2` | | [org.jacoco:jacoco-maven-plugin](https://github.com/jacoco/jacoco) | `0.8.15` | `0.8.16` | | [com.github.siom79.japicmp:japicmp-maven-plugin](https://github.com/siom79/japicmp) | `0.26.1` | `0.26.5` | | [org.codehaus.mojo:buildnumber-maven-plugin](https://github.com/mojohaus/buildnumber-maven-plugin) | `3.3.0` | `3.3.1` | | [org.codehaus.mojo:taglist-maven-plugin](https://github.com/mojohaus/taglist-maven-plugin) | `3.2.2` | `3.2.3` | | [org.codehaus.mojo:jdepend-maven-plugin](https://github.com/mojohaus/jdepend-maven-plugin) | `2.2.0` | `2.2.1` | | [org.projectlombok:lombok](https://github.com/projectlombok/lombok) | `1.18.46` | `1.18.48` | | org.apache.tomcat.embed:tomcat-embed-core | `9.0.121` | `9.0.123` | | org.apache.tomcat.embed:tomcat-embed-el | `9.0.121` | `9.0.123` | | org.apache.tomcat.embed:tomcat-embed-websocket | `9.0.121` | `9.0.123` | | org.apache.tomcat:tomcat-jaspic-api | `9.0.121` | `9.0.123` | | org.apache.tomcat:tomcat-catalina | `9.0.121` | `9.0.123` | | [org.codehaus.mojo:xml-maven-plugin](https://github.com/mojohaus/xml-maven-plugin) | `1.2.1` | `1.2.2` | | org.apache.cxf:cxf-rt-frontend-jaxrs | `3.6.12` | `3.6.13` | | org.apache.karaf.features:framework | `4.4.11` | `4.4.12` | | [org.omnifaces:omnifaces](https://github.com/omnifaces/omnifaces) | `3.14.24` | `3.14.28` | | org.apache.cxf:cxf-bom | `3.6.12` | `3.6.13` | | org.apache.johnzon:johnzon-jsonb | `1.3.0` | `1.3.1` | | org.yaml:snakeyaml | `2.6` | `2.7` | | org.apache.cxf:cxf-rt-rs-client | `3.6.12` | `3.6.13` | | [io.openliberty.tools:liberty-maven-plugin](https://github.com/OpenLiberty/ci.maven) | `3.12.3` | `3.12.4` | | [org.codehaus.mojo:exec-maven-plugin](https://github.com/mojohaus/exec-maven-plugin) | `3.6.3` | `3.6.4` | | org.apache.tomcat.embed:tomcat-embed-core | `10.1.59` | `10.1.61` | | org.apache.tomcat.embed:tomcat-embed-el | `10.1.59` | `10.1.61` | | org.apache.tomcat.embed:tomcat-embed-websocket | `10.1.59` | `10.1.61` | | org.apache.tomcat:tomcat-jaspic-api | `10.1.59` | `10.1.61` | | org.apache.tomcat:tomcat-catalina | `10.1.59` | `10.1.61` | | org.apache.tomcat:tomcat-jasper | `10.1.59` | `10.1.61` | | org.apache.tomcat:tomcat-jasper-el | `10.1.59` | `10.1.61` | | org.apache.maven:apache-maven | `3.9.16` | `3.10.0` | Updates `org.apache:apache` from 39 to 40 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/maven-apache-parent/releases";>org.apache:apache's releases</a>.</em></p> <blockquote> <h2>40</h2> <!-- raw HTML omitted --> <h2>:boom: Breaking changes</h2> <ul> <li>Replace nicoulaj checksum plugin with maveniverse checksum plugin (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/599";>#599</a>) <a href="https://github.com/slawekjaranowski";><code>@slawekjaranowski</code></a></li> <li><a href="https://redirect.github.com/apache/maven-apache-parent/issues/586";>#586</a>: Use RAT0.18 and remove commons-lang3 configuration for JDK25 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/587";>#587</a>) <a href="https://github.com/ottlinger";><code>@ottlinger</code></a></li> <li>Property <code>version.maven-surefire</code> was removed in <a href="https://redirect.github.com/apache/maven-apache-parent/pull/588";>apache/maven-apache-parent#588</a>, should be replaced by <code>version.maven-surefire-plugin</code>, <code>version.maven-failsafe-plugin</code> or <code>version.maven-surefire-report-plugin</code></li> </ul> <h2>🚀 New features and improvements</h2> <ul> <li>Fix several version property issues (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/588";>#588</a>) <a href="https://github.com/ctubbsii";><code>@ctubbsii</code></a></li> </ul> <h2>📝 Documentation updates</h2> <ul> <li>Update documentation for push-to-atr profile (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/613";>#613</a>) <a href="https://github.com/slawekjaranowski";><code>@slawekjaranowski</code></a></li> <li>Restore the common wording on the download page (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/596";>#596</a>) <a href="https://github.com/slachiewicz";><code>@slachiewicz</code></a></li> </ul> <h2>👻 Maintenance</h2> <ul> <li>Add local maven configuration for ATR project name override (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/614";>#614</a>) <a href="https://github.com/slawekjaranowski";><code>@slawekjaranowski</code></a></li> <li>Remove custom name-template for release-drafter (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/604";>#604</a>) <a href="https://github.com/slawekjaranowski";><code>@slawekjaranowski</code></a></li> <li>Port the site documentation from APT to Markdown (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/595";>#595</a>) <a href="https://github.com/slachiewicz";><code>@slachiewicz</code></a></li> </ul> <h2>📦 Dependency updates</h2> <ul> <li>Bump org.apache.maven.plugins:maven-deploy-plugin from 3.1.4 to 3.2.0 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/612";>#612</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li>Bump org.apache.maven.plugins:maven-install-plugin from 3.1.4 to 3.2.0 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/611";>#611</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li>Bump org.apache.maven.plugins:maven-plugin-tools from 3.15.2 to 3.16.0 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/610";>#610</a>) <a href="https://github.com/slawekjaranowski";><code>@slawekjaranowski</code></a></li> <li>Bump surefire-plugin, failsafe-plugin, surefire-report-plugin from 3.5.6 to 3.6.0 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/605";>#605</a>) <a href="https://github.com/slawekjaranowski";><code>@slawekjaranowski</code></a></li> <li>Bump org.apache.tooling:atr-maven-plugin from 1.0.0-alpha-1 to 1.0.0-beta-1 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/598";>#598</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li>Bump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/600";>#600</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li><a href="https://redirect.github.com/apache/maven-apache-parent/issues/586";>#586</a>: Use RAT0.18 and remove commons-lang3 configuration for JDK25 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/587";>#587</a>) <a href="https://github.com/ottlinger";><code>@ottlinger</code></a></li> <li>Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/594";>#594</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li>Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml from 4 to 5 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/591";>#591</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li>Bump apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml from 4 to 5 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/593";>#593</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li>Bump apache/maven-gh-actions-shared/.github/workflows/stale.yml from 4 to 5 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/592";>#592</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li>Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml from 4 to 5 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/590";>#590</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> <li>Bump org.apache.maven.plugins:maven-help-plugin from 3.5.1 to 3.5.2 (<a href="https://redirect.github.com/apache/maven-apache-parent/pull/589";>#589</a>) @<a href="https://github.com/apps/dependabot";>dependabot[bot]</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/apache/maven-apache-parent/commits";>compare view</a></li> </ul> </details> <br /> Updates `org.apache.commons:commons-lang3` from 3.20.0 to 3.21.0 Updates `org.mockito:mockito-core` from 5.23.0 to 5.24.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mockito/mockito/releases";>org.mockito:mockito-core's releases</a>.</em></p> <blockquote> <h2>v5.24.0</h2> <p><!-- raw HTML omitted --><!-- raw HTML omitted --><em>Changelog generated by <a href="https://github.com/shipkit/shipkit-changelog";>Shipkit Changelog Gradle Plugin</a></em><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h4>5.24.0</h4> <ul> <li>2026-09-23 - <a href="https://github.com/mockito/mockito/compare/v5.23.0...v5.24.0";>27 commit(s)</a> by Andrei Solntsev, DragonFSKY, Hünkar Can Tunç, Joshua Selbo, M. Minot, Markus Gaisbauer, Mirko Alicastro, Vinod Kumar M ( codingkiddo ), dependabot[bot]</li> <li>Fix Mockito docs for -javaagent flag with Gradle [(<a href="https://redirect.github.com/mockito/mockito/issues/3866";>#3866</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3866";>mockito/mockito#3866</a>)</li> <li>Kotlin example for adding Mockito as an agent is incorrect [(<a href="https://redirect.github.com/mockito/mockito/issues/3864";>#3864</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3864";>mockito/mockito#3864</a>)</li> <li>Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 [(<a href="https://redirect.github.com/mockito/mockito/issues/3862";>#3862</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3862";>mockito/mockito#3862</a>)</li> <li>Bump gradle/actions from 6.2.0 to 6.3.0 [(<a href="https://redirect.github.com/mockito/mockito/issues/3852";>#3852</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3852";>mockito/mockito#3852</a>)</li> <li>Bump gradle/actions from 5 to 6.2.0 [(<a href="https://redirect.github.com/mockito/mockito/issues/3851";>#3851</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3851";>mockito/mockito#3851</a>)</li> <li>Preserve method parameters when clearing inline mocks [(<a href="https://redirect.github.com/mockito/mockito/issues/3847";>#3847</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3847";>mockito/mockito#3847</a>)</li> <li>Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 [(<a href="https://redirect.github.com/mockito/mockito/issues/3845";>#3845</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3845";>mockito/mockito#3845</a>)</li> <li>Print object fields via reflection when <code>toString()</code> is not implemented [(<a href="https://redirect.github.com/mockito/mockito/issues/3844";>#3844</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3844";>mockito/mockito#3844</a>)</li> <li>Migrate extensions-tests to JUnit Jupiter [(<a href="https://redirect.github.com/mockito/mockito/issues/3840";>#3840</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3840";>mockito/mockito#3840</a>)</li> <li>Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 [(<a href="https://redirect.github.com/mockito/mockito/issues/3839";>#3839</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3839";>mockito/mockito#3839</a>)</li> <li>docs(when-verify): fixes to explanations about redundancy [(<a href="https://redirect.github.com/mockito/mockito/issues/3838";>#3838</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3838";>mockito/mockito#3838</a>)</li> <li>Confusing inconsistency in example method calls in “stubbing and verifying is redundant” note of “when” and “verify” Javadoc [(<a href="https://redirect.github.com/mockito/mockito/issues/3837";>#3837</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3837";>mockito/mockito#3837</a>)</li> <li>Bump actions/checkout from 6 to 7 [(<a href="https://redirect.github.com/mockito/mockito/issues/3836";>#3836</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3836";>mockito/mockito#3836</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/2740";>#2740</a> : Add mockMaker option to <code>@Spy</code> annotation [(<a href="https://redirect.github.com/mockito/mockito/issues/3835";>#3835</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3835";>mockito/mockito#3835</a>)</li> <li>Bump graalvm/setup-graalvm from 1.5.5 to 1.5.6 [(<a href="https://redirect.github.com/mockito/mockito/issues/3834";>#3834</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3834";>mockito/mockito#3834</a>)</li> <li>Bump graalvm/setup-graalvm from 1.5.4 to 1.5.5 [(<a href="https://redirect.github.com/mockito/mockito/issues/3833";>#3833</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3833";>mockito/mockito#3833</a>)</li> <li>Bump codecov/codecov-action from 6 to 7 [(<a href="https://redirect.github.com/mockito/mockito/issues/3831";>#3831</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3831";>mockito/mockito#3831</a>)</li> <li>Bump graalvm/setup-graalvm from 1.4.5 to 1.5.4 [(<a href="https://redirect.github.com/mockito/mockito/issues/3830";>#3830</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3830";>mockito/mockito#3830</a>)</li> <li>Fix clearInlineMocks not de-registering singleton mocks [(<a href="https://redirect.github.com/mockito/mockito/issues/3829";>#3829</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3829";>mockito/mockito#3829</a>)</li> <li>Fix NotAMockException when using mockSingleton with MockitoJUnit [(<a href="https://redirect.github.com/mockito/mockito/issues/3827";>#3827</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3827";>mockito/mockito#3827</a>)</li> <li>NotAMockException when using mockSingleton with MockitoSession or MockitoJUnit [(<a href="https://redirect.github.com/mockito/mockito/issues/3826";>#3826</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3826";>mockito/mockito#3826</a>)</li> <li>Improve Gradle agent docs for configuration cache [(<a href="https://redirect.github.com/mockito/mockito/issues/3823";>#3823</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3823";>mockito/mockito#3823</a>)</li> <li>Gradle documentation for setting up instrumentation with Gradle configuration cache [(<a href="https://redirect.github.com/mockito/mockito/issues/3822";>#3822</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3822";>mockito/mockito#3822</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/3818";>#3818</a> : Fix data race in InvocationContainerImpl.invocationForStubbing [(<a href="https://redirect.github.com/mockito/mockito/issues/3819";>#3819</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3819";>mockito/mockito#3819</a>)</li> <li>Data race on invocationForPotentialStubbing [(<a href="https://redirect.github.com/mockito/mockito/issues/3818";>#3818</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3818";>mockito/mockito#3818</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/3814";>#3814</a> : implement package-level clinit suppression [(<a href="https://redirect.github.com/mockito/mockito/issues/3815";>#3815</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3815";>mockito/mockito#3815</a>)</li> <li>Package-level clinit suppression [(<a href="https://redirect.github.com/mockito/mockito/issues/3814";>#3814</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3814";>mockito/mockito#3814</a>)</li> <li>Upgrade Android Gradle Plugin to 8.13.2 [(<a href="https://redirect.github.com/mockito/mockito/issues/3812";>#3812</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3812";>mockito/mockito#3812</a>)</li> <li>Replaces raw generic types with type parameters [(<a href="https://redirect.github.com/mockito/mockito/issues/3806";>#3806</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3806";>mockito/mockito#3806</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/2398";>#2398</a> : Implement global suppress static initialization leveraging java agent [(<a href="https://redirect.github.com/mockito/mockito/issues/3801";>#3801</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3801";>mockito/mockito#3801</a>)</li> <li>Bump codecov/codecov-action from 5 to 6 [(<a href="https://redirect.github.com/mockito/mockito/issues/3800";>#3800</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3800";>mockito/mockito#3800</a>)</li> <li>Fix non-deterministic AssertionError when using MockMakers.SUBCLASS (<a href="https://redirect.github.com/mockito/mockito/issues/3406";>#3406</a>, <a href="https://redirect.github.com/mockito/mockito/issues/2823";>#2823</a>) [(<a href="https://redirect.github.com/mockito/mockito/issues/3795";>#3795</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3795";>mockito/mockito#3795</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/3536";>#3536</a> : Implement SpyStatic API [(<a href="https://redirect.github.com/mockito/mockito/issues/3794";>#3794</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3794";>mockito/mockito#3794</a>)</li> <li>The class's MethodParameters are removed after clearAllCaches is invoked [(<a href="https://redirect.github.com/mockito/mockito/issues/3763";>#3763</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3763";>mockito/mockito#3763</a>)</li> <li>[FeatureRequest / Idea] Create Mockito.spyStatic [(<a href="https://redirect.github.com/mockito/mockito/issues/3536";>#3536</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3536";>mockito/mockito#3536</a>)</li> <li>Add option to specify mockmaker for <code>@Spy</code> [(<a href="https://redirect.github.com/mockito/mockito/issues/2740";>#2740</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/2740";>mockito/mockito#2740</a>)</li> <li>How can I suppress static initializer? [(<a href="https://redirect.github.com/mockito/mockito/issues/2398";>#2398</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/2398";>mockito/mockito#2398</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mockito/mockito/commit/5a2f0f81cdafc9b34ddb4520db7f8866c787dac0";><code>5a2f0f8</code></a> Fix Mockito docs for -javaagent flag with Gradle (<a href="https://redirect.github.com/mockito/mockito/issues/3866";>#3866</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/9c5f36fb9f2ad89fbaab828d33d144cd398a4079";><code>9c5f36f</code></a> Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 (<a href="https://redirect.github.com/mockito/mockito/issues/3862";>#3862</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/e7fd06dda31daf0c71ad1dedc76ffc9f8ecf6973";><code>e7fd06d</code></a> Preserve method parameters when clearing inline mocks (<a href="https://redirect.github.com/mockito/mockito/issues/3847";>#3847</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/5a676bcd9ef9a10db46e1dc34e190eb46faa2687";><code>5a676bc</code></a> Bump gradle/actions from 6.2.0 to 6.3.0 (<a href="https://redirect.github.com/mockito/mockito/issues/3852";>#3852</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/508f8e78f5ac5ed9f23f7b92b01de76752120a67";><code>508f8e7</code></a> Bump gradle/actions from 5 to 6.2.0 (<a href="https://redirect.github.com/mockito/mockito/issues/3851";>#3851</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/ee8a330da0218f32d5964acdeaa3ac39e2c6ce14";><code>ee8a330</code></a> Print object fields via reflection when <code>toString()</code> is not implemented (<a href="https://redirect.github.com/mockito/mockito/issues/3844";>#3844</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/39b1aba6e6cc92d8ad3c812dcc16ed357c9fbc85";><code>39b1aba</code></a> Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 (<a href="https://redirect.github.com/mockito/mockito/issues/3845";>#3845</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/d8638e1a8b67b4acea63c80dc85d62eda4ef57f5";><code>d8638e1</code></a> Migrate extensions-tests to JUnit Jupiter (<a href="https://redirect.github.com/mockito/mockito/issues/3840";>#3840</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/0aab922fa4c8967e50613671f58c707a69606c62";><code>0aab922</code></a> Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 (<a href="https://redirect.github.com/mockito/mockito/issues/3839";>#3839</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/f3cf74c7e1106f7d32299001ca0ecf2c492c468c";><code>f3cf74c</code></a> docs(when-verify): fixes to explanations about redundancy (<a href="https://redirect.github.com/mockito/mockito/issues/3838";>#3838</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mockito/mockito/compare/v5.23.0...v5.24.0";>compare view</a></li> </ul> </details> <br /> Updates `org.mockito:mockito-junit-jupiter` from 5.23.0 to 5.24.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mockito/mockito/releases";>org.mockito:mockito-junit-jupiter's releases</a>.</em></p> <blockquote> <h2>v5.24.0</h2> <p><!-- raw HTML omitted --><!-- raw HTML omitted --><em>Changelog generated by <a href="https://github.com/shipkit/shipkit-changelog";>Shipkit Changelog Gradle Plugin</a></em><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h4>5.24.0</h4> <ul> <li>2026-09-23 - <a href="https://github.com/mockito/mockito/compare/v5.23.0...v5.24.0";>27 commit(s)</a> by Andrei Solntsev, DragonFSKY, Hünkar Can Tunç, Joshua Selbo, M. Minot, Markus Gaisbauer, Mirko Alicastro, Vinod Kumar M ( codingkiddo ), dependabot[bot]</li> <li>Fix Mockito docs for -javaagent flag with Gradle [(<a href="https://redirect.github.com/mockito/mockito/issues/3866";>#3866</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3866";>mockito/mockito#3866</a>)</li> <li>Kotlin example for adding Mockito as an agent is incorrect [(<a href="https://redirect.github.com/mockito/mockito/issues/3864";>#3864</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3864";>mockito/mockito#3864</a>)</li> <li>Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 [(<a href="https://redirect.github.com/mockito/mockito/issues/3862";>#3862</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3862";>mockito/mockito#3862</a>)</li> <li>Bump gradle/actions from 6.2.0 to 6.3.0 [(<a href="https://redirect.github.com/mockito/mockito/issues/3852";>#3852</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3852";>mockito/mockito#3852</a>)</li> <li>Bump gradle/actions from 5 to 6.2.0 [(<a href="https://redirect.github.com/mockito/mockito/issues/3851";>#3851</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3851";>mockito/mockito#3851</a>)</li> <li>Preserve method parameters when clearing inline mocks [(<a href="https://redirect.github.com/mockito/mockito/issues/3847";>#3847</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3847";>mockito/mockito#3847</a>)</li> <li>Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 [(<a href="https://redirect.github.com/mockito/mockito/issues/3845";>#3845</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3845";>mockito/mockito#3845</a>)</li> <li>Print object fields via reflection when <code>toString()</code> is not implemented [(<a href="https://redirect.github.com/mockito/mockito/issues/3844";>#3844</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3844";>mockito/mockito#3844</a>)</li> <li>Migrate extensions-tests to JUnit Jupiter [(<a href="https://redirect.github.com/mockito/mockito/issues/3840";>#3840</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3840";>mockito/mockito#3840</a>)</li> <li>Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 [(<a href="https://redirect.github.com/mockito/mockito/issues/3839";>#3839</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3839";>mockito/mockito#3839</a>)</li> <li>docs(when-verify): fixes to explanations about redundancy [(<a href="https://redirect.github.com/mockito/mockito/issues/3838";>#3838</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3838";>mockito/mockito#3838</a>)</li> <li>Confusing inconsistency in example method calls in “stubbing and verifying is redundant” note of “when” and “verify” Javadoc [(<a href="https://redirect.github.com/mockito/mockito/issues/3837";>#3837</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3837";>mockito/mockito#3837</a>)</li> <li>Bump actions/checkout from 6 to 7 [(<a href="https://redirect.github.com/mockito/mockito/issues/3836";>#3836</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3836";>mockito/mockito#3836</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/2740";>#2740</a> : Add mockMaker option to <code>@Spy</code> annotation [(<a href="https://redirect.github.com/mockito/mockito/issues/3835";>#3835</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3835";>mockito/mockito#3835</a>)</li> <li>Bump graalvm/setup-graalvm from 1.5.5 to 1.5.6 [(<a href="https://redirect.github.com/mockito/mockito/issues/3834";>#3834</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3834";>mockito/mockito#3834</a>)</li> <li>Bump graalvm/setup-graalvm from 1.5.4 to 1.5.5 [(<a href="https://redirect.github.com/mockito/mockito/issues/3833";>#3833</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3833";>mockito/mockito#3833</a>)</li> <li>Bump codecov/codecov-action from 6 to 7 [(<a href="https://redirect.github.com/mockito/mockito/issues/3831";>#3831</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3831";>mockito/mockito#3831</a>)</li> <li>Bump graalvm/setup-graalvm from 1.4.5 to 1.5.4 [(<a href="https://redirect.github.com/mockito/mockito/issues/3830";>#3830</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3830";>mockito/mockito#3830</a>)</li> <li>Fix clearInlineMocks not de-registering singleton mocks [(<a href="https://redirect.github.com/mockito/mockito/issues/3829";>#3829</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3829";>mockito/mockito#3829</a>)</li> <li>Fix NotAMockException when using mockSingleton with MockitoJUnit [(<a href="https://redirect.github.com/mockito/mockito/issues/3827";>#3827</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3827";>mockito/mockito#3827</a>)</li> <li>NotAMockException when using mockSingleton with MockitoSession or MockitoJUnit [(<a href="https://redirect.github.com/mockito/mockito/issues/3826";>#3826</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3826";>mockito/mockito#3826</a>)</li> <li>Improve Gradle agent docs for configuration cache [(<a href="https://redirect.github.com/mockito/mockito/issues/3823";>#3823</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3823";>mockito/mockito#3823</a>)</li> <li>Gradle documentation for setting up instrumentation with Gradle configuration cache [(<a href="https://redirect.github.com/mockito/mockito/issues/3822";>#3822</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3822";>mockito/mockito#3822</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/3818";>#3818</a> : Fix data race in InvocationContainerImpl.invocationForStubbing [(<a href="https://redirect.github.com/mockito/mockito/issues/3819";>#3819</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3819";>mockito/mockito#3819</a>)</li> <li>Data race on invocationForPotentialStubbing [(<a href="https://redirect.github.com/mockito/mockito/issues/3818";>#3818</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3818";>mockito/mockito#3818</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/3814";>#3814</a> : implement package-level clinit suppression [(<a href="https://redirect.github.com/mockito/mockito/issues/3815";>#3815</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3815";>mockito/mockito#3815</a>)</li> <li>Package-level clinit suppression [(<a href="https://redirect.github.com/mockito/mockito/issues/3814";>#3814</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3814";>mockito/mockito#3814</a>)</li> <li>Upgrade Android Gradle Plugin to 8.13.2 [(<a href="https://redirect.github.com/mockito/mockito/issues/3812";>#3812</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3812";>mockito/mockito#3812</a>)</li> <li>Replaces raw generic types with type parameters [(<a href="https://redirect.github.com/mockito/mockito/issues/3806";>#3806</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3806";>mockito/mockito#3806</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/2398";>#2398</a> : Implement global suppress static initialization leveraging java agent [(<a href="https://redirect.github.com/mockito/mockito/issues/3801";>#3801</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3801";>mockito/mockito#3801</a>)</li> <li>Bump codecov/codecov-action from 5 to 6 [(<a href="https://redirect.github.com/mockito/mockito/issues/3800";>#3800</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3800";>mockito/mockito#3800</a>)</li> <li>Fix non-deterministic AssertionError when using MockMakers.SUBCLASS (<a href="https://redirect.github.com/mockito/mockito/issues/3406";>#3406</a>, <a href="https://redirect.github.com/mockito/mockito/issues/2823";>#2823</a>) [(<a href="https://redirect.github.com/mockito/mockito/issues/3795";>#3795</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3795";>mockito/mockito#3795</a>)</li> <li>Fixes <a href="https://redirect.github.com/mockito/mockito/issues/3536";>#3536</a> : Implement SpyStatic API [(<a href="https://redirect.github.com/mockito/mockito/issues/3794";>#3794</a>)](<a href="https://redirect.github.com/mockito/mockito/pull/3794";>mockito/mockito#3794</a>)</li> <li>The class's MethodParameters are removed after clearAllCaches is invoked [(<a href="https://redirect.github.com/mockito/mockito/issues/3763";>#3763</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3763";>mockito/mockito#3763</a>)</li> <li>[FeatureRequest / Idea] Create Mockito.spyStatic [(<a href="https://redirect.github.com/mockito/mockito/issues/3536";>#3536</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/3536";>mockito/mockito#3536</a>)</li> <li>Add option to specify mockmaker for <code>@Spy</code> [(<a href="https://redirect.github.com/mockito/mockito/issues/2740";>#2740</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/2740";>mockito/mockito#2740</a>)</li> <li>How can I suppress static initializer? [(<a href="https://redirect.github.com/mockito/mockito/issues/2398";>#2398</a>)](<a href="https://redirect.github.com/mockito/mockito/issues/2398";>mockito/mockito#2398</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mockito/mockito/commit/5a2f0f81cdafc9b34ddb4520db7f8866c787dac0";><code>5a2f0f8</code></a> Fix Mockito docs for -javaagent flag with Gradle (<a href="https://redirect.github.com/mockito/mockito/issues/3866";>#3866</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/9c5f36fb9f2ad89fbaab828d33d144cd398a4079";><code>9c5f36f</code></a> Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 (<a href="https://redirect.github.com/mockito/mockito/issues/3862";>#3862</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/e7fd06dda31daf0c71ad1dedc76ffc9f8ecf6973";><code>e7fd06d</code></a> Preserve method parameters when clearing inline mocks (<a href="https://redirect.github.com/mockito/mockito/issues/3847";>#3847</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/5a676bcd9ef9a10db46e1dc34e190eb46faa2687";><code>5a676bc</code></a> Bump gradle/actions from 6.2.0 to 6.3.0 (<a href="https://redirect.github.com/mockito/mockito/issues/3852";>#3852</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/508f8e78f5ac5ed9f23f7b92b01de76752120a67";><code>508f8e7</code></a> Bump gradle/actions from 5 to 6.2.0 (<a href="https://redirect.github.com/mockito/mockito/issues/3851";>#3851</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/ee8a330da0218f32d5964acdeaa3ac39e2c6ce14";><code>ee8a330</code></a> Print object fields via reflection when <code>toString()</code> is not implemented (<a href="https://redirect.github.com/mockito/mockito/issues/3844";>#3844</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/39b1aba6e6cc92d8ad3c812dcc16ed357c9fbc85";><code>39b1aba</code></a> Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 (<a href="https://redirect.github.com/mockito/mockito/issues/3845";>#3845</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/d8638e1a8b67b4acea63c80dc85d62eda4ef57f5";><code>d8638e1</code></a> Migrate extensions-tests to JUnit Jupiter (<a href="https://redirect.github.com/mockito/mockito/issues/3840";>#3840</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/0aab922fa4c8967e50613671f58c707a69606c62";><code>0aab922</code></a> Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 (<a href="https://redirect.github.com/mockito/mockito/issues/3839";>#3839</a>)</li> <li><a href="https://github.com/mockito/mockito/commit/f3cf74c7e1106f7d32299001ca0ecf2c492c468c";><code>f3cf74c</code></a> docs(when-verify): fixes to explanations about redundancy (<a href="https://redirect.github.com/mockito/mockito/issues/3838";>#3838</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mockito/mockito/compare/v5.23.0...v5.24.0";>compare view</a></li> </ul> </details> <br /> Updates `net.bytebuddy:byte-buddy` from 1.18.12 to 1.18.16 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/releases";>net.bytebuddy:byte-buddy's releases</a>.</em></p> <blockquote> <h2>Byte Buddy 1.18.16</h2> <ul> <li>Correct detection of a dropped implicit <code>this</code> frame in constructors with <code>long</code> or <code>double</code> parameters when using <code>Advice</code>.</li> <li>Detect a dropped uninitialized <code>this</code> frame in constructors after full frames when using <code>Advice</code> with copied arguments.</li> <li>Update ASM to version 9.11.1 and the ASM to Class File API bridge to version 0.0.14.</li> <li>Use a valid tag for the Gradle plugin portal.</li> </ul> <h2>Byte Buddy 1.18.15</h2> <ul> <li>Update ASM to version 9.11 and add support for Java 28.</li> </ul> <h2>Byte Buddy 1.18.14</h2> <ul> <li>Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.</li> <li>Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.</li> <li>Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.</li> <li>Sign all deployed files using sigstore, in addition to the existing GPG signature.</li> <li>Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.</li> </ul> <h2>Byte Buddy 1.18.13</h2> <ul> <li>Actually include the SBOM within the published artifacts.</li> <li>Avoid propagation of path traversals that are contained in jar files which are copied without transformation.</li> <li>Avoid repeated traversal of previously visited type hierarchies to improve performance.</li> <li>Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.</li> <li>Create Gradle tasks using Gradle's task registration API if available.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/blob/master/release-notes.md";>net.bytebuddy:byte-buddy's changelog</a>.</em></p> <blockquote> <h3>23. October 2026: version 1.18.16</h3> <ul> <li>Correct detection of a dropped implicit <code>this</code> frame in constructors with <code>long</code> or <code>double</code> parameters when using <code>Advice</code>.</li> <li>Detect a dropped uninitialized <code>this</code> frame in constructors after full frames when using <code>Advice</code> with copied arguments.</li> <li>Update ASM to version 9.11.1 and the ASM to Class File API bridge to version 0.0.14.</li> <li>Use a valid tag for the Gradle plugin portal.</li> </ul> <h3>13. October 2026: version 1.18.15</h3> <ul> <li>Update ASM to version 9.11 and add support for Java 28.</li> </ul> <h3>14. September 2026: version 1.18.14</h3> <ul> <li>Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.</li> <li>Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.</li> <li>Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.</li> <li>Sign all deployed files using sigstore, in addition to the existing GPG signature.</li> <li>Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.</li> </ul> <h3>2. September 2026: version 1.18.13</h3> <ul> <li>Actually include the SBOM within the published artifacts.</li> <li>Avoid propagation of path traversals that are contained in jar files which are copied without transformation.</li> <li>Avoid repeated traversal of previously visited type hierarchies to improve performance.</li> <li>Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.</li> <li>Create Gradle tasks using Gradle's task registration API if available.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/raphw/byte-buddy/commit/0229449c940b4e5d7624b4453c711dc187f51527";><code>0229449</code></a> [publish] Releasing Byte Buddy 1.18.16</li> <li><a href="https://github.com/raphw/byte-buddy/commit/29c1a2956a29eaa98121dc3e3c64925c743d8e9d";><code>29c1a29</code></a> [release] Complete failed release from where it failed.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/2f7c4ed41b71c4b6e367363e70320e0fda583e61";><code>2f7c4ed</code></a> Change tag which was rejected.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/6ade5784e54121a3f74f8fb39cde4046d2baa6d3";><code>6ade578</code></a> [release] Release new version</li> <li><a href="https://github.com/raphw/byte-buddy/commit/7d6ad7843ef61e83f549e68ef16e1d825fdf2f03";><code>7d6ad78</code></a> Update checksums</li> <li><a href="https://github.com/raphw/byte-buddy/commit/d7bf69f3b59c5aa58ba440b78831b82918684da5";><code>d7bf69f</code></a> Detect dropped uninitialized 'this' frame in constructors after full frames.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/2901502f795695afe91494e9176c402fb0760760";><code>2901502</code></a> Compare constructor frame divergence in frame entries rather than slots.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/8ade117d85107d243fd169abe677c5146ec17168";><code>8ade117</code></a> Update ASM and bridge.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/4e259420075d9df93d5849ac44da82222d71777a";><code>4e25942</code></a> [publish] Start next development iteration 1.18.16-SNAPSHOT</li> <li><a href="https://github.com/raphw/byte-buddy/commit/f2dffef0ed83b65924b699d27e22975e4b338996";><code>f2dffef</code></a> [publish] Releasing Byte Buddy 1.18.15</li> <li>Additional commits viewable in <a href="https://github.com/raphw/byte-buddy/compare/byte-buddy-1.18.12...byte-buddy-1.18.16";>compare view</a></li> </ul> </details> <br /> Updates `net.bytebuddy:byte-buddy-agent` from 1.18.12 to 1.18.16 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/releases";>net.bytebuddy:byte-buddy-agent's releases</a>.</em></p> <blockquote> <h2>Byte Buddy 1.18.16</h2> <ul> <li>Correct detection of a dropped implicit <code>this</code> frame in constructors with <code>long</code> or <code>double</code> parameters when using <code>Advice</code>.</li> <li>Detect a dropped uninitialized <code>this</code> frame in constructors after full frames when using <code>Advice</code> with copied arguments.</li> <li>Update ASM to version 9.11.1 and the ASM to Class File API bridge to version 0.0.14.</li> <li>Use a valid tag for the Gradle plugin portal.</li> </ul> <h2>Byte Buddy 1.18.15</h2> <ul> <li>Update ASM to version 9.11 and add support for Java 28.</li> </ul> <h2>Byte Buddy 1.18.14</h2> <ul> <li>Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.</li> <li>Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.</li> <li>Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.</li> <li>Sign all deployed files using sigstore, in addition to the existing GPG signature.</li> <li>Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.</li> </ul> <h2>Byte Buddy 1.18.13</h2> <ul> <li>Actually include the SBOM within the published artifacts.</li> <li>Avoid propagation of path traversals that are contained in jar files which are copied without transformation.</li> <li>Avoid repeated traversal of previously visited type hierarchies to improve performance.</li> <li>Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.</li> <li>Create Gradle tasks using Gradle's task registration API if available.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/blob/master/release-notes.md";>net.bytebuddy:byte-buddy-agent's changelog</a>.</em></p> <blockquote> <h3>23. October 2026: version 1.18.16</h3> <ul> <li>Correct detection of a dropped implicit <code>this</code> frame in constructors with <code>long</code> or <code>double</code> parameters when using <code>Advice</code>.</li> <li>Detect a dropped uninitialized <code>this</code> frame in constructors after full frames when using <code>Advice</code> with copied arguments.</li> <li>Update ASM to version 9.11.1 and the ASM to Class File API bridge to version 0.0.14.</li> <li>Use a valid tag for the Gradle plugin portal.</li> </ul> <h3>13. October 2026: version 1.18.15</h3> <ul> <li>Update ASM to version 9.11 and add support for Java 28.</li> </ul> <h3>14. September 2026: version 1.18.14</h3> <ul> <li>Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.</li> <li>Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.</li> <li>Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.</li> <li>Sign all deployed files using sigstore, in addition to the existing GPG signature.</li> <li>Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.</li> </ul> <h3>2. September 2026: version 1.18.13</h3> <ul> <li>Actually include the SBOM within the published artifacts.</li> <li>Avoid propagation of path traversals that are contained in jar files which are copied without transformation.</li> <li>Avoid repeated traversal of previously visited type hierarchies to improve performance.</li> <li>Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.</li> <li>Create Gradle tasks using Gradle's task registration API if available.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/raphw/byte-buddy/commit/0229449c940b4e5d7624b4453c711dc187f51527";><code>0229449</code></a> [publish] Releasing Byte Buddy 1.18.16</li> <li><a href="https://github.com/raphw/byte-buddy/commit/29c1a2956a29eaa98121dc3e3c64925c743d8e9d";><code>29c1a29</code></a> [release] Complete failed release from where it failed.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/2f7c4ed41b71c4b6e367363e70320e0fda583e61";><code>2f7c4ed</code></a> Change tag which was rejected.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/6ade5784e54121a3f74f8fb39cde4046d2baa6d3";><code>6ade578</code></a> [release] Release new version</li> <li><a href="https://github.com/raphw/byte-buddy/commit/7d6ad7843ef61e83f549e68ef16e1d825fdf2f03";><code>7d6ad78</code></a> Update checksums</li> <li><a href="https://github.com/raphw/byte-buddy/commit/d7bf69f3b59c5aa58ba440b78831b82918684da5";><code>d7bf69f</code></a> Detect dropped uninitialized 'this' frame in constructors after full frames.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/2901502f795695afe91494e9176c402fb0760760";><code>2901502</code></a> Compare constructor frame divergence in frame entries rather than slots.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/8ade117d85107d243fd169abe677c5146ec17168";><code>8ade117</code></a> Update ASM and bridge.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/4e259420075d9df93d5849ac44da82222d71777a";><code>4e25942</code></a> [publish] Start next development iteration 1.18.16-SNAPSHOT</li> <li><a href="https://github.com/raphw/byte-buddy/commit/f2dffef0ed83b65924b699d27e22975e4b338996";><code>f2dffef</code></a> [publish] Releasing Byte Buddy 1.18.15</li> <li>Additional commits viewable in <a href="https://github.com/raphw/byte-buddy/compare/byte-buddy-1.18.12...byte-buddy-1.18.16";>compare view</a></li> </ul> </details> <br /> Updates `net.bytebuddy:byte-buddy-agent` from 1.18.12 to 1.18.16 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/releases";>net.bytebuddy:byte-buddy-agent's releases</a>.</em></p> <blockquote> <h2>Byte Buddy 1.18.16</h2> <ul> <li>Correct detection of a dropped implicit <code>this</code> frame in constructors with <code>long</code> or <code>double</code> parameters when using <code>Advice</code>.</li> <li>Detect a dropped uninitialized <code>this</code> frame in constructors after full frames when using <code>Advice</code> with copied arguments.</li> <li>Update ASM to version 9.11.1 and the ASM to Class File API bridge to version 0.0.14.</li> <li>Use a valid tag for the Gradle plugin portal.</li> </ul> <h2>Byte Buddy 1.18.15</h2> <ul> <li>Update ASM to version 9.11 and add support for Java 28.</li> </ul> <h2>Byte Buddy 1.18.14</h2> <ul> <li>Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.</li> <li>Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.</li> <li>Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.</li> <li>Sign all deployed files using sigstore, in addition to the existing GPG signature.</li> <li>Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.</li> </ul> <h2>Byte Buddy 1.18.13</h2> <ul> <li>Actually include the SBOM within the published artifacts.</li> <li>Avoid propagation of path traversals that are contained in jar files which are copied without transformation.</li> <li>Avoid repeated traversal of previously visited type hierarchies to improve performance.</li> <li>Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.</li> <li>Create Gradle tasks using Gradle's task registration API if available.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/raphw/byte-buddy/blob/master/release-notes.md";>net.bytebuddy:byte-buddy-agent's changelog</a>.</em></p> <blockquote> <h3>23. October 2026: version 1.18.16</h3> <ul> <li>Correct detection of a dropped implicit <code>this</code> frame in constructors with <code>long</code> or <code>double</code> parameters when using <code>Advice</code>.</li> <li>Detect a dropped uninitialized <code>this</code> frame in constructors after full frames when using <code>Advice</code> with copied arguments.</li> <li>Update ASM to version 9.11.1 and the ASM to Class File API bridge to version 0.0.14.</li> <li>Use a valid tag for the Gradle plugin portal.</li> </ul> <h3>13. October 2026: version 1.18.15</h3> <ul> <li>Update ASM to version 9.11 and add support for Java 28.</li> </ul> <h3>14. September 2026: version 1.18.14</h3> <ul> <li>Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.</li> <li>Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.</li> <li>Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.</li> <li>Sign all deployed files using sigstore, in addition to the existing GPG signature.</li> <li>Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.</li> </ul> <h3>2. September 2026: version 1.18.13</h3> <ul> <li>Actually include the SBOM within the published artifacts.</li> <li>Avoid propagation of path traversals that are contained in jar files which are copied without transformation.</li> <li>Avoid repeated traversal of previously visited type hierarchies to improve performance.</li> <li>Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.</li> <li>Create Gradle tasks using Gradle's task registration API if available.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/raphw/byte-buddy/commit/0229449c940b4e5d7624b4453c711dc187f51527";><code>0229449</code></a> [publish] Releasing Byte Buddy 1.18.16</li> <li><a href="https://github.com/raphw/byte-buddy/commit/29c1a2956a29eaa98121dc3e3c64925c743d8e9d";><code>29c1a29</code></a> [release] Complete failed release from where it failed.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/2f7c4ed41b71c4b6e367363e70320e0fda583e61";><code>2f7c4ed</code></a> Change tag which was rejected.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/6ade5784e54121a3f74f8fb39cde4046d2baa6d3";><code>6ade578</code></a> [release] Release new version</li> <li><a href="https://github.com/raphw/byte-buddy/commit/7d6ad7843ef61e83f549e68ef16e1d825fdf2f03";><code>7d6ad78</code></a> Update checksums</li> <li><a href="https://github.com/raphw/byte-buddy/commit/d7bf69f3b59c5aa58ba440b78831b82918684da5";><code>d7bf69f</code></a> Detect dropped uninitialized 'this' frame in constructors after full frames.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/2901502f795695afe91494e9176c402fb0760760";><code>2901502</code></a> Compare constructor frame divergence in frame entries rather than slots.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/8ade117d85107d243fd169abe677c5146ec17168";><code>8ade117</code></a> Update ASM and bridge.</li> <li><a href="https://github.com/raphw/byte-buddy/commit/4e259420075d9df93d5849ac44da82222d71777a";><code>4e25942</code></a> [publish] Start next development iteration 1.18.16-SNAPSHOT</li> <li><a href="https://github.com/raphw/byte-buddy/commit/f2dffef0ed83b65924b699d27e22975e4b338996";><code>f2dffef</code></a> [publish] Releasing Byte Buddy 1.18.15</li> <li>Additional commits viewable in <a href="https://github.com/raphw/byte-buddy/compare/byte-buddy-1.18.12...byte-buddy-1.18.16";>compare view</a></li> </ul> </details> <br /> Updates `org.owasp.encoder:encoder` from 1.4.0 to 1.6.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/OWASP/owasp-java-encoder/releases";>org.owasp.encoder:encoder's releases</a>.</em></p> <blockquote> <h2>OWASP Java Encoder 1.6.0</h2> <p>OWASP Java Encoder <strong>1.6.0</strong> reduces unnecessary JavaScript letter escaping while retaining recognized HTML-token protection across trusted fragments. It resolves <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/243";>#243</a> through <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/247";>#247</a>. This is a minor release because emitted bytes and streaming behavior change.</p> <h3>Changes and migration</h3> <ul> <li><code>forJavaScript</code> and <code>forJavaScriptBlock</code> keep interior script-name letters readable. A final C, I, P, R, S, or T in either case still receives an escape. Punctuation and whitespace escapes remain.</li> <li><code>http://google.com</code> now produces <code>http:\/\/google.com</code>; <code>script</code> becomes <code>scrip\x74</code>; <code>i</code> remains <code>\x69</code>. The rule is conservative: <code>cat</code> becomes <code>ca\x74</code>.</li> <li>HTML does not remove whitespace inside tag names. Escaping <code><</code> in a complete value addresses the HTML tag delimiter concern, but a fragment may have its <code><</code> supplied by trusted text. The terminal escape preserves that supported protection.</li> <li>General/block <code>EncodedWriter</code> callers must flush before writing directly to the wrapped writer. Explicit flushes safely emit pending letters/surrogates and can add escapes while preserving the JavaScript UTF-16 value. Low-level callers must retain unread input after UNDERFLOW and supply more input or mark end-of-input.</li> <li>Review snapshots, signatures and cache keys that depend on encoded bytes. Source and attribute-only methods are unchanged.</li> </ul> <p>Public APIs, Java 8 support, runtime dependencies and module/bundle identities are unchanged. No new encoder security fix is introduced. The 1.5.0 protections remain; users of older versions should follow the <a href="https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv";>security advisory</a>. See the <a href="https://github.com/OWASP/owasp-java-encoder/blob/v1.6.0/docs/compatibility-decisions.md#javascript-output-refinement-in-160-243";>migration record</a>.</p> <h3>Maven Central</h3> <p>Version <strong>1.6.0</strong> is published under <code>org.owasp.encoder</code>:</p> <ul> <li><a href="https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder/1.6.0/";>encoder</a></li> <li><a href="https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-jsp/1.6.0/";>encoder-jsp</a></li> <li><a href="https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-jakarta-jsp/1.6.0/";>encoder-jakarta-jsp</a></li> <li><a href="https://repo.maven.apache.org/maven2/org/owasp/encoder/encoder-parent/1.6.0/";>encoder-parent</a></li> </ul> <p>Keep core and adapter versions aligned. Do not combine javax and Jakarta adapters. The retired ESAPI adapter and optional test WAR are not included. Javadoc JARs are attached; hosted javadoc.io indexing can lag publication.</p> <h3>Verification</h3> <p>Exact tested source: <code>d9b0fd62497fb9276429a9ea972f4449ab320f2d</code>; signed tag: <code>v1.6.0</code>.</p> <p>All 26 downloaded Central payload/signature files matched the retained originals byte for byte. All 13 payload signatures and both checksum-manifest signatures verify with project fingerprint <strong><code>1C5F632B86809F2F5DB25092BEA0075F94074A9B</code></strong>. Attached bundle SHA-256: <strong><code>8d860714634ae3b53f19bb3ea326f639b74df96c0e82bc956d53f237b5804c16</code></strong>.</p> <p>The clean unsigned and signed builds, Docker/browser/WAR gate, packaged Java 17 consumers and repository checks passed. All thirteen unsigned payloads match two independent clean builds using Temurin 17.0.20.1+1 and Maven 3.10.0. Required CI passed, including Java 8/11/17/21/25 consumers, Java 8 tests and Java/Actions/Python CodeQL. Model-assisted review followed MODELS.md; no Daybreak review was completed before release. The documented maintainer review bypass was authorized; required CI/security checks were not bypassed.</p> <p><strong>Correction — 2026-10-18:</strong> The original review record described Daybreak access as unavailable, but the explicit picker-route probe had not been attempted. A subsequent probe succeeded, as recorded in [PR <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/251";>#251</a>](<a href="https://redirect.github.com/OWASP/owasp-java-encoder/pull/251";>OWASP/owasp-java-encoder#251</a>). This establishes later access, not a pre-release review. The release tag and signed artifacts retain their original bytes.</p> <p>Verify the attached signatures and signed checksum manifests with <code>KEYS</code>, <code>SHA256SUMS</code>, <code>SHA512SUMS</code> and <a href="https://github.com/OWASP/owasp-java-encoder/blob/v1.6.0/VERIFYING.md";>VERIFYING.md</a>. The immutable source retains preparation-stage notices; this release confirms publication without changing those sources or signatures.</p> <p>OWASP Java Encoder 1.5.1 is a documentation and build-maintenance patch. <strong>Encoding behavior, public APIs, runtime dependencies, and Java 8 support are unchanged from 1.5.0.</strong></p> <h3>What changed</h3> <ul> <li>Clarify JavaScript encoding modes, output growth, and where encoded values can safely be inserted.</li> <li>Explain why script-letter escapes remain necessary in the general and block modes; Source mode already leaves the URL in <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/243";>#243</a> unchanged.</li> <li>Distinguish JSON whole-string HTML embedding from JavaScript fragment protection, with clearer surrounding-template requirements.</li> <li>Strengthen parser regression tests and include the build/test maintenance recorded in <a href="https://github.com/OWASP/owasp-java-encoder/blob/v1.5.1/CHANGELOG.md";>CHANGELOG.md</a>.</li> </ul> <p>The documentation changes are in <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/244";>#244</a>. The release preparation is in <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/245";>#245</a>. This patch preserves the security fixes from 1.5.0 and introduces no new encoder security fix. Users upgrading from versions older than 1.5.0 should read the <a href="https://github.com/OWASP/owasp-java-encoder/releases/tag/v1.5.0";>1.5.0 migration notes</a> and <a href="https://github.com/OWASP/owasp-java-encoder/security/advisories/GHSA-g8p6-7r8f-qrpv";>security advisory</a>.</p> <h3>Maven Central</h3> <p>Version <strong>1.5.1</strong> is published under <code>org.owasp.encoder</code>:</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/OWASP/owasp-java-encoder/blob/main/CHANGELOG.md";>org.owasp.encoder:encoder's changelog</a>.</em></p> <blockquote> <h2>1.6.0 — 2026-10-18 UTC</h2> <p>Publication is verified; see the <a href="https://github.com/OWASP/owasp-java-encoder/blob/main/releases/1.6.0.md";>release record</a>.</p> <ul> <li>Reduce unnecessary script-letter escaping in <code>forJavaScript</code> and <code>forJavaScriptBlock</code> (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/243";>#243</a>). Interior letters remain readable; the input's last character is escaped if it is C, I, P, R, S, or T (either case). Existing punctuation escapes and protection against recognized HTML tokens across trusted-text boundaries are preserved. Encoded bytes change, while JavaScript string values do not. Streaming encoders may retain one trailing letter; <code>EncodedWriter.flush()</code> safely emits it as a hex escape and any pending high surrogate as a Unicode escape. Explicit flushes can add safe escapes while preserving UTF-16 values. Direct <code>Encoder.encode</code> callers must retain unread input after underflow and supply more input or mark end-of-input, including for a pending ASCII letter.</li> </ul> <h2>1.5.1 — 2026-10-15 UTC</h2> <p>Documentation and build-maintenance patch; publication is verified in the <a href="https://github.com/OWASP/owasp-java-encoder/blob/main/releases/1.5.1-central-publication.md";>publication record</a>. Encoding behavior and public APIs are unchanged.</p> <ul> <li> <p>Clarify JavaScript encoding modes, output growth, and insertion-boundary requirements for <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/243";>#243</a>; distinguish JSON whole-string HTML embedding from JavaScript fragment protection. Correct internal HTML/XML comments and strengthen parser tests to verify script text, not only absence of a marker. Encoding behavior is unchanged.</p> </li> <li> <p>Verify public API compatibility against immutable 1.5.0 artifacts and their matching support APIs. Minimum-consumer fixtures are unchanged.</p> </li> <li> <p>Discover release tags independently of commit ancestry so squash merges cannot leave the compatibility baseline stale; add isolated Git regressions.</p> </li> <li> <p>Record verified 1.5.0 publication and replace pending-availability notices.</p> </li> <li> <p>Update Jackson core/databind to 3.1.7 in the unpublished Jakarta fixture's Spring Boot Maven plugin realm for GHSA-q4xh-88c3-wmh7, GHSA-wjgm-6hv5-3cvf, GHSA-wv8q-qhhj-9h54 and GHSA-cxp5-3px4-pw24. Published library dependencies and release artifacts are unchanged.</p> </li> <li> <p>Route Jackson plugin-realm pins and Maven wrapper upgrades out of the grouped Dependabot PR for individual review, and keep Jackson on its 3.1 line until the Boot parent moves. Security updates remain eligible.</p> </li> <li> <p>Build with Maven 3.10.0 through the committed wrapper and require it for signed releases. Ordinary builds still accept Maven 3.9.16 or later. Library JARs and module POMs are byte-identical to 3.9.16 builds (<a href="https://github.com/OWASP/owasp-java-encoder/blob/main/releases/maven-3.10.0-validation.md";>validation</a>).</p> </li> <li> <p>Update isolated Tomcat/Jasper test engines to 9.0.123 and 10.1.61 and give each its own Dependabot scan (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/241";>#241</a>, <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/242";>#242</a>). These are test tooling, not dependencies shipped inside the encoder libraries.</p> </li> <li> <p>Update reviewed build tooling and pinned Actions, including japicmp 0.26.3, Commons Lang 3.21.0, and the publisher's HttpClient 5.6.5 (<a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/234";>#234</a>, <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/237";>#237</a>, <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/240";>#240</a>).</p> </li> </ul> <h2>1.5.0 — 2026-09-28 UTC</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/d9b0fd62497fb9276429a9ea972f4449ab320f2d";><code>d9b0fd6</code></a> release: prepare Java Encoder 1.6.0</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/300ef20c1bfff8c3d4c68216d68f3fe742b0a559";><code>300ef20</code></a> Merge pull request <a href="https://redirect.github.com/OWASP/owasp-java-encoder/issues/247";>#247</a> from OWASP/fix/issue-243-script-letter-escaping</li> <li><a href="https://github.com/OWASP/owasp-java-encoder/commit/da8b7a0d298c952aee9064f67dec75e0ab16a32f";><code>da8b7a0</code></a> Merge remote-tracking branch 'origin/main' into fix/i... _Description has been truncated_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
