renovate-bot opened a new pull request, #6571: URL: https://github.com/apache/fineract/pull/6571
> ℹ️ **Note** > > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [apache/kafka](https://redirect.github.com/apache/kafka) | | minor | `4.2.0-rc2` → `4.4.0-rc2` |  |  | | [gradle](https://gradle.org) ([source](https://redirect.github.com/gradle/gradle)) | | minor | `9.7.1` → `9.8.0` |  |  | | [gradle/actions](https://redirect.github.com/gradle/actions) | action | minor | `v6.3.0` → `v6.4.0` |  |  | | localstack/localstack | | minor | `2.1` → `2.3` |  |  | | [mariadb](https://hub.docker.com/_/mariadb) ([source](https://redirect.github.com/MariaDB/mariadb-docker)) | | minor | `12.2` → `12.3` |  |  | | [postgres](https://hub.docker.com/_/postgres) ([source](https://redirect.github.com/docker-library/postgres)) | service | minor | `18.3` → `18.6` |  |  | | [tomcat](https://hub.docker.com/_/tomcat) ([source](https://redirect.github.com/docker-library/tomcat)) | | patch | `10.1.59-jdk25-temurin` → `10.1.60-jdk25-temurin` |  |  | | [at.yawk.lz4:lz4-java](https://redirect.github.com/yawkat/lz4-java) | devDependencies | minor | `1.11.4` → `1.12.0` |  |  | | [io.netty:netty-transport-native-unix-common](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.18.Final` |  |  | | [io.netty:netty-transport-classes-epoll](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.18.Final` |  |  | | [io.netty:netty-transport](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.18.Final` |  |  | | [io.netty:netty-resolver](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.18.Final` |  |  | | [io.netty:netty-handler-proxy](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.18.Final` |  |  | | [io.netty:netty-handler](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.18.Final` |  |  | | [io.netty:netty-codec-socks](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.18.Final` |  |  | | [io.netty:netty-codec-protobuf](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.18.Final` |  |  | | [io.netty:netty-codec-marshalling](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.18.Final` |  |  | | [io.netty:netty-codec-http2](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.18.Final` |  |  | | [io.netty:netty-codec-http](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.18.Final` |  |  | | [io.netty:netty-codec-compression](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.18.Final` |  |  | | [io.netty:netty-codec-base](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.18.Final` |  |  | | [io.netty:netty-codec](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.18.Final` |  |  | | [io.netty:netty-common](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.18.Final` |  |  | | [io.netty:netty-buffer](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.18.Final` |  |  | | [com.nimbusds:nimbus-jose-jwt](https://bitbucket.org/connect2id/nimbus-jose-jwt) | devDependencies | minor | `10.9` → `10.10` |  |  | | [org.apache.commons:commons-lang3](https://commons.apache.org/proper/commons-lang/) ([source](https://gitbox.apache.org/repos/asf/commons-lang.git)) | devDependencies | minor | `3.20.0` → `3.21.0` |  |  | | [io.cucumber:cucumber-spring](https://cucumber.io/) ([source](https://redirect.github.com/cucumber/cucumber-jvm)) | devDependencies | patch | `7.34.3` → `7.34.9` |  |  | | [io.cucumber:cucumber-junit-platform-engine](https://cucumber.io/) ([source](https://redirect.github.com/cucumber/cucumber-jvm)) | devDependencies | patch | `7.34.3` → `7.34.9` |  |  | | [io.cucumber:cucumber-java8](https://cucumber.io/) ([source](https://redirect.github.com/cucumber/cucumber-jvm)) | devDependencies | patch | `7.34.3` → `7.34.9` |  |  | | [io.cucumber:cucumber-java](https://cucumber.io/) ([source](https://redirect.github.com/cucumber/cucumber-jvm)) | devDependencies | patch | `7.34.3` → `7.34.9` |  |  | | [org.apache.sshd:sshd-core](https://www.apache.org/) ([source](https://redirect.github.com/apache/mina-sshd)) | devDependencies | minor | `2.17.1` → `2.20.0` |  |  | | [org.apache.sshd:sshd-common](https://www.apache.org/) ([source](https://redirect.github.com/apache/mina-sshd)) | devDependencies | minor | `2.17.1` → `2.20.0` |  |  | | [org.mariadb.jdbc:mariadb-java-client](https://mariadb.com/kb/en/mariadb/about-mariadb-connector-j/) ([source](https://redirect.github.com/mariadb-corporation/mariadb-connector-j)) | devDependencies | patch | `3.5.8` → `3.5.10` |  |  | | [org.apache.avro:avro](https://avro.apache.org) ([source](https://redirect.github.com/apache/avro)) | devDependencies | patch | `1.12.1` → `1.12.2` |  |  | | [org.hibernate.validator:hibernate-validator](https://hibernate.org/validator) ([source](https://redirect.github.com/hibernate/hibernate-validator)) | devDependencies | patch | `9.1.0.Final` → `9.1.4.Final` |  |  | | [io.swagger.core.v3:swagger-core-jakarta](https://redirect.github.com/swagger-api/swagger-core) | devDependencies | patch | `2.2.49` → `2.2.55` |  |  | | [io.swagger.core.v3:swagger-jaxrs2-jakarta](https://redirect.github.com/swagger-api/swagger-core) | devDependencies | patch | `2.2.49` → `2.2.55` |  |  | | [io.swagger.core.v3:swagger-annotations-jakarta](https://redirect.github.com/swagger-api/swagger-core) | devDependencies | patch | `2.2.49` → `2.2.55` |  |  | | [org.apache.activemq:activemq-client](http://activemq.apache.org) ([source](https://redirect.github.com/apache/activemq)) | devDependencies | minor | `6.2.5` → `6.3.2` |  |  | | [org.springdoc:springdoc-openapi-starter-webmvc-ui](https://springdoc.org/) ([source](https://redirect.github.com/springdoc/springdoc-openapi)) | devDependencies | minor | `3.0.3` → `3.1.1` |  |  | | [org.apache.maven:maven-artifact](https://maven.apache.org/) ([source](https://redirect.github.com/apache/maven)) | devDependencies | minor | `3.9.16` → `3.10.0` |  |  | | [org.eclipse.jgit:org.eclipse.jgit.ssh.apache](https://eclipse.gerrithub.io/admin/repos/eclipse-jgit/jgit) | devDependencies | minor | `7.6.0.202603022253-r` → `7.8.0.202609011348-r` |  |  | | [org.eclipse.jgit:org.eclipse.jgit.gpg.bc](https://eclipse.gerrithub.io/admin/repos/eclipse-jgit/jgit) | devDependencies | minor | `7.6.0.202603022253-r` → `7.8.0.202609011348-r` |  |  | | [org.eclipse.jgit:org.eclipse.jgit](https://eclipse.gerrithub.io/admin/repos/eclipse-jgit/jgit) | devDependencies | minor | `7.6.0.202603022253-r` → `7.8.0.202609011348-r` |  |  | | [org.bouncycastle:bcpg-jdk18on](https://www.bouncycastle.org/download/bouncy-castle-java/) ([source](https://redirect.github.com/bcgit/bc-java)) | devDependencies | minor | `1.84` → `1.86` |  |  | | [org.bouncycastle:bcutil-jdk18on](https://www.bouncycastle.org/download/bouncy-castle-java/) ([source](https://redirect.github.com/bcgit/bc-java)) | devDependencies | minor | `1.84` → `1.86` |  |  | | [org.bouncycastle:bcprov-jdk18on](https://www.bouncycastle.org/download/bouncy-castle-java/) ([source](https://redirect.github.com/bcgit/bc-java)) | devDependencies | minor | `1.84` → `1.86` |  |  | | [org.bouncycastle:bcpkix-jdk18on](https://www.bouncycastle.org/download/bouncy-castle-java/) ([source](https://redirect.github.com/bcgit/bc-java)) | devDependencies | minor | `1.84` → `1.86` |  |  | | [org.projectlombok:lombok](https://projectlombok.org) ([source](https://redirect.github.com/projectlombok/lombok)) | devDependencies | patch | `1.18.46` → `1.18.48` |  |  | | [commons-codec:commons-codec](https://commons.apache.org/proper/commons-codec/) ([source](https://redirect.github.com/apache/commons-codec)) | devDependencies | patch | `1.22.0` → `1.22.1` |  |  | | [org.mock-server:mockserver-junit-jupiter](https://www.mock-server.com) ([source](https://redirect.github.com/mock-server/mockserver-monorepo)) | devDependencies | minor | `5.14.0` → `5.15.0` |  |  | | [com.github.spotbugs:spotbugs-annotations](https://spotbugs.github.io/) ([source](https://redirect.github.com/spotbugs/spotbugs)) | devDependencies | minor | `4.9.8` → `4.10.4` |  |  | | [io.github.classgraph:classgraph](https://redirect.github.com/classgraph/classgraph) | devDependencies | patch | `4.8.184` → `4.8.196` |  |  | | [joda-time:joda-time](https://www.joda.org/joda-time/) ([source](https://redirect.github.com/JodaOrg/joda-time)) | devDependencies | minor | `2.14.2` → `2.15.0` |  |  | | [org.apache.tika:tika-parser-image-module](https://tika.apache.org/) ([source](https://redirect.github.com/apache/tika)) | devDependencies | patch | `3.3.0` → `3.3.2` |  |  | | com.gradleup.shadow | plugin | minor | `9.4.1` → `9.6.1` |  |  | | org.openapi.generator | plugin | minor | `7.22.0` → `7.25.0` |  |  | | [org.apache.tika:tika-parser-microsoft-module](https://tika.apache.org/) ([source](https://redirect.github.com/apache/tika)) | devDependencies | patch | `3.3.0` → `3.3.2` |  |  | | com.github.spotbugs | plugin | patch | `6.5.4` → `6.5.12` |  |  | | com.github.andygoossens.modernizer | plugin | minor | `1.13.0` → `1.15.0` |  |  | | io.swagger.core.v3.swagger-gradle-plugin | plugin | patch | `2.2.49` → `2.2.55` |  |  | | org.springframework.boot | plugin | patch | `4.1.0` → `4.1.1` |  |  | | org.zeroturnaround.gradle.jrebel | plugin | patch | `1.2.2` → `1.2.3` |  |  | | org.nosphere.apache.rat | plugin | minor | `0.8.1` → `0.11.0` |  |  | | [org.apache.tika:tika-parser-miscoffice-module](https://tika.apache.org/) ([source](https://redirect.github.com/apache/tika)) | devDependencies | patch | `3.3.0` → `3.3.2` |  |  | | com.diffplug.spotless | plugin | patch | `8.10.2` → `8.10.3` |  |  | | [org.apache.tika:tika-core](https://tika.apache.org/) ([source](https://redirect.github.com/apache/tika)) | devDependencies | patch | `3.3.0` → `3.3.2` |  |  | | [com.github.librepdf:openpdf](https://redirect.github.com/LibrePDF/OpenPDF) | devDependencies | patch | `3.0.4` → `3.0.5` |  |  | | [software.amazon.msk:aws-msk-iam-auth](https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html) ([source](https://redirect.github.com/aws/aws-msk-iam-auth)) | devDependencies | patch | `2.3.6` → `2.3.9` |  |  | | [org.apache.commons:commons-collections4](https://commons.apache.org/proper/commons-collections/) ([source](https://gitbox.apache.org/repos/asf?p=commons-collections.git)) | devDependencies | minor | `4.5.0` → `4.6.0` |  |  | | [com.google.googlejavaformat:google-java-format](https://redirect.github.com/google/google-java-format) | devDependencies | minor | `1.35.0` → `1.37.0` |  |  | | [com.google.guava:guava](https://redirect.github.com/google/guava) | devDependencies | minor | `33.6.0-jre` → `33.7.2-jre` |  |  | | [ch.qos.logback:logback-classic](http://logback.qos.ch) ([source](https://redirect.github.com/qos-ch/logback), [changelog](https://logback.qos.ch/news.html)) | devDependencies | minor | `1.5.35` → `1.6.5` |  |  | | [ch.qos.logback:logback-core](http://logback.qos.ch) ([source](https://redirect.github.com/qos-ch/logback), [changelog](https://logback.qos.ch/news.html)) | devDependencies | minor | `1.5.35` → `1.6.5` |  |  | | [org.glassfish.jersey:jersey-bom](https://projects.eclipse.org/projects/ee4j) ([source](https://redirect.github.com/eclipse-ee4j/ee4j)) | devDependencies | patch | `4.0.2` → `4.0.3` |  |  | | [software.amazon.awssdk:bom](https://aws.amazon.com/sdkforjava) | devDependencies | minor | `2.44.4` → `2.55.11` |  |  | | [org.mockito:mockito-bom](https://redirect.github.com/mockito/mockito) | devDependencies | minor | `5.23.0` → `5.24.0` |  |  | | [io.cucumber:cucumber-bom](https://cucumber.io/) ([source](https://redirect.github.com/cucumber/cucumber-jvm)) | devDependencies | patch | `7.34.3` → `7.34.9` |  |  | | [org.junit:junit-bom](https://junit.org/) ([source](https://redirect.github.com/junit-team/junit-framework)) | devDependencies | minor | `6.0.3` → `6.1.3` |  |  | | [org.jetbrains.kotlin:kotlin-bom](https://kotlinlang.org/) ([source](https://redirect.github.com/JetBrains/kotlin)) | devDependencies | minor | `2.3.21` → `2.4.20` |  |  | | [io.opentelemetry:opentelemetry-bom](https://redirect.github.com/open-telemetry/opentelemetry-java) | devDependencies | minor | `1.62.0` → `1.66.0` |  |  | | [io.awspring.cloud:spring-cloud-aws-dependencies](https://projects.spring.io/spring-cloud/) ([source](https://redirect.github.com/awspring/spring-cloud-aws)) | devDependencies | minor | `4.0.2` → `4.2.0` |  |  | | [org.springframework.boot:spring-boot-dependencies](https://spring.io/projects/spring-boot) ([source](https://redirect.github.com/spring-projects/spring-boot)) | devDependencies | patch | `4.1.0` → `4.1.1` |  |  | | [io.micrometer:micrometer-bom](https://redirect.github.com/micrometer-metrics/micrometer-commercial) | devDependencies | minor | `1.16.5` → `1.17.1` |  |  | | [org.slf4j:slf4j-bom](http://www.slf4j.org) ([source](https://redirect.github.com/qos-ch/slf4j), [changelog](https://www.slf4j.org/news.html)) | devDependencies | patch | `2.0.17` → `2.0.20` |  |  | | io.qameta.allure | plugin | minor | `4.1.0` → `4.3.0` |  |  | --- ### Release Notes <details> <summary>apache/kafka (apache/kafka)</summary> ### [`v4.3.1`](https://redirect.github.com/apache/kafka/compare/4.3.0...4.3.1) [Compare Source](https://redirect.github.com/apache/kafka/compare/4.3.0...4.3.1) ### [`v4.3.0`](https://redirect.github.com/apache/kafka/compare/4.2.1...4.3.0) [Compare Source](https://redirect.github.com/apache/kafka/compare/4.2.0...4.3.0) </details> <details> <summary>gradle/gradle (gradle)</summary> ### [`v9.8.0`](https://redirect.github.com/gradle/gradle/releases/tag/v9.8.0): 9.8.0 [Compare Source](https://redirect.github.com/gradle/gradle/compare/v9.7.1...v9.8.0) The Gradle team is excited to announce Gradle 9.8.0. Here are the highlights of this release: - Java 27 support - Maven mirror settings reuse - Linked problem locations in build output [Read the Release Notes](https://docs.gradle.org/9.8.0/release-notes.html) We would like to thank the following community members for their contributions to this release of Gradle: [Aman Gautam](https://redirect.github.com/Gautam-aman), [Björn Kautler](https://redirect.github.com/Vampire), [Eng Zer Jun](https://redirect.github.com/Juneezee), [Hashim Khan](https://redirect.github.com/Hashim1999164), [Julian Krannich](https://redirect.github.com/jkrannich), [KBS](https://redirect.github.com/youdie006), [Labh R Jethe](https://redirect.github.com/itsCodeTide), [Mark Dodgson](https://redirect.github.com/doddi), [Maxim](https://redirect.github.com/kroune), [monkey](https://redirect.github.com/Develop-KIM), [nataphon-ktsystems](https://redirect.github.com/nataphon-ktsystems), [Paul King](https://redirect.github.com/paulk-asert), [Qiu Tian](https://redirect.github.com/qiu-tiandev), [rg\_sandesh](https://redirect.github.com/sandeshgorde), [Roberto Perez Alcolea](https://redirect.github.com/rpalcolea), [Sean](https://redirect.github.com/seanxuu), [Zongle Wang](https://redirect.github.com/Goooler). #### Upgrade instructions Switch your build to use Gradle 9.8.0 by updating your wrapper: ``` ./gradlew :wrapper --gradle-version=9.8.0 && ./gradlew :wrapper ``` See the Gradle [9.x upgrade guide](https://docs.gradle.org/9.8.0/userguide/upgrading_version_9.html) to learn about deprecations, breaking changes and other considerations when upgrading. For Java, Groovy, Kotlin and Android compatibility, see the [full compatibility notes](https://docs.gradle.org/9.8.0/userguide/compatibility.html). #### Reporting problems If you find a problem with this release, please file a bug on [GitHub Issues](https://redirect.github.com/gradle/gradle/issues) adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the [forum](https://discuss.gradle.org/c/help-discuss). We hope you will build happiness with Gradle, and we look forward to your feedback via [Twitter](https://twitter.com/gradle) or on [GitHub](https://redirect.github.com/gradle). </details> <details> <summary>gradle/actions (gradle/actions)</summary> ### [`v6.4.0`](https://redirect.github.com/gradle/actions/releases/tag/v6.4.0) [Compare Source](https://redirect.github.com/gradle/actions/compare/v6.3.0...v6.4.0) #### Highlights ##### Gradle version support status in the Job Summary The actions now report the support status of every Gradle version used in a workflow, as job annotations and in the Job Summary ([#​1057](https://redirect.github.com/gradle/actions/issues/1057)). Thanks to [@​ov7a](https://redirect.github.com/ov7a) for the contribution. | version kind | job annotation | version table | below the table | | --------------------------------------------------------------------------------------- | -------------- | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | **End-of-life** — two or more major versions behind the latest release | warning | :warning: | expandable section naming the affected release lines, pointing at the [Gradle Security Subscription](https://gradle.org/security-subscription/) | | **Out of date** — one major behind, or more than two minors behind on the current major | notice | :information\_source: | one-line legend pointing at the [Gradle release lifecycle](https://docs.gradle.org/current/userguide/feature_lifecycle.html#eol_support) docs | | **Current** | none | — | — | Deliberately *not* reported: patch releases (being on `9.7.0` when `9.7.1` exists is not flagged) and pre-releases (release candidates, milestones and snapshots never produce annotations). The latest Gradle release is determined from the wrapper checksum data already bundled with the action, so no network access is required. Note that these annotations are emitted independently of the `add-job-summary` setting: setting `add-job-summary: 'never'` suppresses the Job Summary itself, but the warning and notice annotations remain. ##### Gradle itself is now reported in the dependency graph The `dependency-submission` action now applies **v1.5.0** of the [GitHub Dependency Graph Gradle Plugin](https://redirect.github.com/gradle/github-dependency-graph-gradle-plugin) (up from v1.4.2) ([#​1069](https://redirect.github.com/gradle/actions/issues/1069)). The headline change is that the Gradle Build Tool running the build is now reported as an `org.gradle:gradle-core` dependency, so that **GitHub can surface known vulnerabilities in the version of Gradle used to run your build**. These are the coordinates that GitHub advisories for the Gradle Build Tool are published against. Details worth knowing: - The entry is always reported as a **direct** dependency with **development** scope. - It is **not** affected by the project, configuration or scope filters, so it appears even in graphs that filter aggressively. - Expect dependency graphs to gain this one new entry the first time a build runs after upgrading. ##### A new Gradle signing key, if you use dependency verification > \[!IMPORTANT] > If your build has [dependency verification](https://docs.gradle.org/current/userguide/dependency_verification.html#sec:signature-verification) > enabled, you must add a **second** trusted key before upgrading, or Dependency Graph generation will > fail signature verification. `github-dependency-graph-gradle-plugin` `1.5.0` is signed with a new Gradle signing subkey, and the key previously documented in our setup guide has been revoked upstream: | Artifact | Signing key | | -------------------------------------------------------------------- | --------------------------------------------------------- | | `org.gradle:github-dependency-graph-gradle-plugin` `1.5.0` and later | `E2879931BCA1A42E55F2D64DD9B2DFBD9F3298BA` (new) | | `org.gradle` plugin versions before the rotation | `7B79ADD11F8A779FE90FD3D0893A028475557671` (old, revoked) | | `com.gradle` Develocity Gradle plugin, including `4.5.0` | `7B79ADD11F8A779FE90FD3D0893A028475557671` (old, revoked) | Because the Develocity Gradle plugin is still signed with the old key, you should trust **both** keys rather than swapping one for the other — replacing the old key outright will break Develocity injection. The documented snippet in [docs/setup-gradle.md](https://redirect.github.com/gradle/actions/blob/3f5f9adaf7d9fecd50b5935e54106014257a94e6/docs/setup-gradle.md#dependency-verification) has been updated accordingly ([#​1071](https://redirect.github.com/gradle/actions/issues/1071)): ```xml <trusted-keys> <trusted-key id="7B79ADD11F8A779FE90FD3D0893A028475557671"> <trusting group="com.gradle"/> <trusting group="org.gradle"/> </trusted-key> <trusted-key id="E2879931BCA1A42E55F2D64DD9B2DFBD9F3298BA"> <trusting group="org.gradle"/> </trusted-key> </trusted-keys> ``` ##### `cache-provider: external` for externally managed Gradle User Home Builds that save and restore Gradle User Home by some other mechanism (Develocity Artifact Cache, for example) previously had to set `cache-disabled: true`, which was misleading: caching wasn't disabled, it just wasn't managed by this action, and the Job Summary reported it as "Disabled". `cache-provider: external` skips Gradle User Home restore/save exactly as `cache-disabled` does, but reports a distinct **External** status in the Job Summary explaining that caching is handled by another provider ([#​1059](https://redirect.github.com/gradle/actions/issues/1059)). ```yaml - uses: gradle/actions/setup-gradle@v6 with: cache-provider: 'external' ``` ##### Develocity access keys containing OIDC tokens now work Short-lived-token handling validated the `server=key[;server=key]*` access key format with a regex whose `key` portion was too strict, so an access key holding an OIDC token value was rejected outright. Worse, had it passed the regex, parsing split each entry on `=` and kept only the second field — silently **truncating** any key containing `=` (as JWT padding does) and sending the mangled key to the server. Both problems are fixed ([#​1061](https://redirect.github.com/gradle/actions/issues/1061)). ##### Job Summary attribution Job summaries produced by `setup-gradle` and `dependency-submission` now carry a top-level heading naming the action, so the block stays attributable when another action's summary content lands in the same job ([#​1058](https://redirect.github.com/gradle/actions/issues/1058)). ##### Updated defaults - GitHub Dependency Graph Gradle Plugin: **1.4.2 → 1.5.0** - 5 new known-good wrapper checksums for `wrapper-validation` (368 → 373 entries) #### What's Changed - Bump the github-actions group across 3 directories with 6 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​1039](https://redirect.github.com/gradle/actions/pull/1039) - Bump the npm-dependencies group in /sources with 3 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​1038](https://redirect.github.com/gradle/actions/pull/1038) - Add action heading to Gradle job summary by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1058](https://redirect.github.com/gradle/actions/pull/1058) - Add cache-provider: external to skip Gradle User Home caching by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1059](https://redirect.github.com/gradle/actions/pull/1059) - Relax Develocity access key format validation by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1061](https://redirect.github.com/gradle/actions/pull/1061) - Use the root-qualified `:wrapper` task by [@​cobexer](https://redirect.github.com/cobexer) in [#​1064](https://redirect.github.com/gradle/actions/pull/1064) - Report EOL and maintenance status for Gradle versions by [@​ov7a](https://redirect.github.com/ov7a) in [#​1057](https://redirect.github.com/gradle/actions/pull/1057) - Update dependencies by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1065](https://redirect.github.com/gradle/actions/pull/1065) - Update .tool-versions: node 24.18.0, gradle 9.7.1, java 17 by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1068](https://redirect.github.com/gradle/actions/pull/1068) - Combined automated updates: wrapper checksums, npm dependencies, setup-java by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1070](https://redirect.github.com/gradle/actions/pull/1070) - Bump dependency-graph-gradle-plugin to 1.5.0 by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1069](https://redirect.github.com/gradle/actions/pull/1069) - Document the new Gradle signing key for dependency verification by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1071](https://redirect.github.com/gradle/actions/pull/1071) #### New Contributors - [@​cobexer](https://redirect.github.com/cobexer) made their first contribution in [#​1064](https://redirect.github.com/gradle/actions/pull/1064) - [@​ov7a](https://redirect.github.com/ov7a) made their first contribution in [#​1057](https://redirect.github.com/gradle/actions/pull/1057) **Full Changelog**: <https://github.com/gradle/actions/compare/v6.3.0...v6.4.0> </details> <details> <summary>yawkat/lz4-java (at.yawk.lz4:lz4-java)</summary> ### [`v1.12.0`](https://redirect.github.com/yawkat/lz4-java/releases/tag/v1.12.0): lz4-java v1.12.0 **Note that lz4-java v1.11.4, also released today, contains security fixes.** This minor release contains some additional tightening of input validation that could in theory be breaking but should be fine for most if not all users. I recommend you upgrade to 1.12.0, but 1.11.4 is an option if that breaks. #### What's Changed - Render README tables on the website by [@​yawkat](https://redirect.github.com/yawkat) in [#​150](https://redirect.github.com/yawkat/lz4-java/pull/150) - Throw IOException for invalid or unsupported frame descriptors by [@​yawkat](https://redirect.github.com/yawkat) in [#​133](https://redirect.github.com/yawkat/lz4-java/pull/133) - Replace Codecov with a coverage badge from the documentation site by [@​yawkat](https://redirect.github.com/yawkat) in [#​151](https://redirect.github.com/yawkat/lz4-java/pull/151) - Reject short output in LZ4DecompressorWithLength safe paths by [@​yawkat](https://redirect.github.com/yawkat) in [#​126](https://redirect.github.com/yawkat/lz4-java/pull/126) - Make stream failures sticky in LZ4FrameInputStream and LZ4BlockInputStream by [@​yawkat](https://redirect.github.com/yawkat) in [#​145](https://redirect.github.com/yawkat/lz4-java/pull/145) **Full Changelog**: <https://github.com/yawkat/lz4-java/compare/v1.11.4...v1.12.0> </details> <details> <summary>connect2id/nimbus-jose-jwt (com.nimbusds:nimbus-jose-jwt)</summary> ### [`v10.10`](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/10.10%0D10.9.1) [Compare Source](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/10.10%0D10.9.1) ### [`v10.9.1`](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/10.9.1%0D10.9) [Compare Source](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/10.9.1%0D10.9) </details> <details> <summary>cucumber/cucumber-jvm (io.cucumber:cucumber-spring)</summary> ### [`v7.34.9`](https://redirect.github.com/cucumber/cucumber-jvm/releases/tag/v7.34.9) [Compare Source](https://redirect.github.com/cucumber/cucumber-jvm/compare/v7.34.8...v7.34.9) ##### Fixed - \[Core] Update dependency io.cucumber:messages-ndjson to v0.3.7 - \[Core] Update dependency com.fasterxml.jackson:jackson-bom to v2.22.3 ### [`v7.34.8`](https://redirect.github.com/cucumber/cucumber-jvm/releases/tag/v7.34.8) [Compare Source](https://redirect.github.com/cucumber/cucumber-jvm/compare/v7.34.7...v7.34.8) ##### Fixed - \[TestNG] `AbstractTestNGCucumberTests.scenarios()` throws without setup ([#​3235](https://redirect.github.com/cucumber/cucumber-jvm/pull/3235)) ### [`v7.34.7`](https://redirect.github.com/cucumber/cucumber-jvm/releases/tag/v7.34.7) ##### Fixed - \[Core] Update dependency io.cucumber:messages-ndjson to v0.3.6 - \[Core] Update dependency com.fasterxml.jackson:jackson-bom to v2.22.2 ### [`v7.34.6`](https://redirect.github.com/cucumber/cucumber-jvm/releases/tag/v7.34.6) ##### Fixed - \[JUnit Platform Engine] Do not fail discovery on an empty rerun file with JUnit Platform 6.1.x ([#​3216](https://redirect.github.com/cucumber/cucumber-jvm/pull/3216)) ### [`v7.34.5`](https://redirect.github.com/cucumber/cucumber-jvm/releases/tag/v7.34.5) ##### Fixed - \[Core] Update dependency io.cucumber:messages-ndjson to v0.3.5 - \[Core] Update dependency com.fasterxml.jackson:jackson-bom to v2.22.1 ### [`v7.34.4`](https://redirect.github.com/cucumber/cucumber-jvm/releases/tag/v7.34.4) ##### Fixed - \[Core] Update dependency io.cucumber:messages-ndjson to v0.3.4 - \[Core] Update dependency com.fasterxml.jackson:jackson-bom to v2.22.0 </details> <details> <summary>mariadb-corporation/mariadb-connector-j (org.mariadb.jdbc:mariadb-java-client)</summary> ### [`v3.5.10`](https://redirect.github.com/mariadb-corporation/mariadb-connector-j/blob/HEAD/CHANGELOG.md#3510-Jul-2026) [Compare Source](https://redirect.github.com/mariadb-corporation/mariadb-connector-j/compare/3.5.9...3.5.10) [Full Changelog](https://redirect.github.com/mariadb-corporation/mariadb-connector-j/compare/3.5.9...3.5.10) ##### Key Enhancements - CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit) - CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0) - CONJ-1330 - add infer test to CI ##### Issues Resolved - CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server - CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu) - CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute - CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder) - CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder) - CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder) - CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder) - CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder) - CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0) - CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder) - CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0) - CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR) - CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX\_VALUE, and returns bulk generated keys out of batch order ### [`v3.5.9`](https://redirect.github.com/mariadb-corporation/mariadb-connector-j/blob/HEAD/CHANGELOG.md#359-Jun-2026) [Compare Source](https://redirect.github.com/mariadb-corporation/mariadb-connector-j/compare/3.5.8...3.5.9) [Full Changelog](https://redirect.github.com/mariadb-corporation/mariadb-connector-j/compare/3.5.8...3.5.9) ##### Key Enhancements - CONJ-1223 - cache TLS trust/key managers across connections to reduce SSL connection cost - CONJ-1314 - add SPI for interactive dialog (PAM) authentication callback - CONJ-1311 - add dedicated option `useIpForKillQuery` for query cancellation - CONJ-1310 - Add full native image support and CI coverage ##### Issues Resolved - CONJ-1320 - PAM (dialog) authentication must require a secure connection (report by fg0x0) - CONJ-1319 - Use constant-time comparison when validating the server certificate fingerprint (report by jmestwa-coder) - CONJ-1318 - enforce `allowLocalInfile=false` on the server's local-infile request, so a malicious server cannot read a client file despite the option being disabled - CONJ-1322 - match local infile filename case-sensitively (thanks to jmestwa-coder) - CONJ-1323 - LOAD LOCAL INFILE validation rejects statements preceded by line comments (thanks to sebdomdev) - CONJ-1315 - cap BigDecimal/BigInteger string parsing length to prevent CPU exhaustion if MitM (report by tonghuaroot) - CONJ-1317 - ensure non-UTF8 charset cannot be used for protocol exchanges (report by fg0x0) - CONJ-1304 - CallableStatement parameter metadata read from mysql.proc, with MySQL info\_schema fallback - CONJ-1299 - keep VALUES literals after the last placeholder when rewriting batches - CONJ-1313 - race condition in HaMode#getAvailableHostInOrder can cause NPE - CONJ-1311 - Connection.cancelCurrentQuery fails with SslMode.VERIFY\_FULL when client socket IP is set - CONJ-1264 - handle LocalDateTime as a zoneless wall-clock value - CONJ-1316 - pin Locale.ROOT on locale-sensitive call sites and date/time/Duration text formatting (fixes locale-dependent parsing/formatting, e.g. under tr\_TR) (thanks to jmestwa-coder) - CONJ-1324 - fix SQL parser to correctly handle '--' in expressions and reset lastChar after block comments - CONJ-1323 - LOAD LOCAL INFILE validation rejects statements preceded by line comments (thanks to sebdomdev) - CONJ-1318 - allowLocalInfile=false does not block LOAD DATA LOCAL INFILE against a malicious server (thanks to tharavel) </details> <details> <summary>apache/avro (org.apache.avro:avro)</summary> ### [`v1.12.2`](https://redirect.github.com/apache/avro/compare/release-1.12.1...release-1.12.2) [Compare Source](https://redirect.github.com/apache/avro/compare/release-1.12.1...release-1.12.2) </details> <details> <summary>hibernate/hibernate-validator (org.hi > ❗ **Important** > > ✂ PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apache/fineract). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoiZGV2ZWxvcCIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==--> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
