solrbot opened a new pull request, #5274: URL: https://github.com/apache/solr/pull/5274
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [org.xerial.snappy:snappy-java](https://redirect.github.com/xerial/snappy-java) | dependencies | patch | `1.1.10.8` → `1.1.10.12` | | [org.immutables:value-annotations](https://redirect.github.com/immutables/immutables/tree/value-annotations) ([source](https://redirect.github.com/immutables/immutables)) | dependencies | patch | `2.12.2` → `2.12.3` | | [org.apache.tika:tika-langdetect-tika](https://tika.apache.org/) ([source](https://redirect.github.com/apache/tika)) | dependencies | patch | `3.3.2` → `3.3.3` | | [org.apache.tika:tika-core](https://tika.apache.org/) ([source](https://redirect.github.com/apache/tika)) | dependencies | patch | `3.3.2` → `3.3.3` | | [dev.logchange](https://redirect.github.com/logchange/logchange) | plugin | minor | `1.19.16` → `1.20.0` | | [commons-codec:commons-codec](https://commons.apache.org/proper/commons-codec/) ([source](https://redirect.github.com/apache/commons-codec)) | dependencies | minor | `1.22.1` → `1.23.0` | | [com.github.spotbugs:spotbugs-annotations](https://spotbugs.github.io/) ([source](https://redirect.github.com/spotbugs/spotbugs)) | dependencies | patch | `4.10.4` → `4.10.5` | | [com.github.ben-manes.caffeine:caffeine](https://redirect.github.com/ben-manes/caffeine) | dependencies | patch | `3.3.0` → `3.3.1` | --- ### Release Notes <details> <summary>xerial/snappy-java (org.xerial.snappy:snappy-java)</summary> ### [`v1.1.10.12`](https://redirect.github.com/xerial/snappy-java/releases/tag/v1.1.10.12) <!-- Release notes generated using configuration in .github/release.yml at v1.1.10.12 --> #### What's Changed ##### Other Changes - Hadoop uses a blockHeaderSize of 8 instead of the normal 4 by [@​tomjshore](https://redirect.github.com/tomjshore) in [#​768](https://redirect.github.com/xerial/snappy-java/pull/768) #### New Contributors - [@​tomjshore](https://redirect.github.com/tomjshore) made their first contribution in [#​768](https://redirect.github.com/xerial/snappy-java/pull/768) **Full Changelog**: <https://github.com/xerial/snappy-java/compare/v1.1.10.11...v1.1.10.12> ### [`v1.1.10.11`](https://redirect.github.com/xerial/snappy-java/releases/tag/v1.1.10.11) <!-- Release notes generated using configuration in .github/release.yml at v1.1.10.11 --> #### What's Changed ##### 🐛 Bug Fixes - Fix JAR lookup in integration test and pin hadoop-common to 3.4.x by [@​xerial](https://redirect.github.com/xerial) in [#​764](https://redirect.github.com/xerial/snappy-java/pull/764) ##### 🔗 Dependency Updates - Update sbt, scripted-plugin to 1.12.15 by [@​xerial](https://redirect.github.com/xerial) in [#​753](https://redirect.github.com/xerial/snappy-java/pull/753) - Update scalafmt-core to 3.9.10 by [@​xerial](https://redirect.github.com/xerial) in [#​755](https://redirect.github.com/xerial/snappy-java/pull/755) - Bump the github-actions group with 3 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​758](https://redirect.github.com/xerial/snappy-java/pull/758) - Update sbt, scripted-plugin to 1.13.0 by [@​xerial](https://redirect.github.com/xerial) in [#​762](https://redirect.github.com/xerial/snappy-java/pull/762) - Update scalafmt-core to 3.11.5 by [@​xerial](https://redirect.github.com/xerial) in [#​763](https://redirect.github.com/xerial/snappy-java/pull/763) ##### 🛠 Internal Updates - Update sbt-pgp to 2.3.2 by [@​xerial](https://redirect.github.com/xerial) in [#​750](https://redirect.github.com/xerial/snappy-java/pull/750) - Update hadoop-common to 3.4.3 by [@​xerial](https://redirect.github.com/xerial) in [#​751](https://redirect.github.com/xerial/snappy-java/pull/751) - Update plexus-classworlds to 2.12.1 by [@​xerial](https://redirect.github.com/xerial) in [#​752](https://redirect.github.com/xerial/snappy-java/pull/752) - Update sbt-scalafmt to 2.6.2 by [@​xerial](https://redirect.github.com/xerial) in [#​754](https://redirect.github.com/xerial/snappy-java/pull/754) ##### 📚 Docs - Upgrade to sbt 2.0.10 and Scala 3.9.0 by [@​xerial](https://redirect.github.com/xerial) in [#​759](https://redirect.github.com/xerial/snappy-java/pull/759) ##### Other Changes - Add auto-merge workflow for Scala Steward and Dependabot PRs by [@​xerial](https://redirect.github.com/xerial) in [#​757](https://redirect.github.com/xerial/snappy-java/pull/757) - ([#​765](https://redirect.github.com/xerial/snappy-java/issues/765)) Restore Hadoop ByteBuffer compression compatibility by [@​vjanelle](https://redirect.github.com/vjanelle) in [#​766](https://redirect.github.com/xerial/snappy-java/pull/766) #### New Contributors - [@​vjanelle](https://redirect.github.com/vjanelle) made their first contribution in [#​766](https://redirect.github.com/xerial/snappy-java/pull/766) **Full Changelog**: <https://github.com/xerial/snappy-java/compare/v1.1.10.10...v1.1.10.11> ### [`v1.1.10.10`](https://redirect.github.com/xerial/snappy-java/releases/tag/v1.1.10.10) <!-- Release notes generated using configuration in .github/release.yml at v1.1.10.10 --> #### What's Changed ##### 🐛 Bug Fixes - Fix stream buffer double release, header recursion, and eager chunk allocation by [@​xerial](https://redirect.github.com/xerial) in [#​747](https://redirect.github.com/xerial/snappy-java/pull/747) ##### 📚 Docs - Remove airframe-log and xerial-core test dependencies by [@​xerial](https://redirect.github.com/xerial) in [#​749](https://redirect.github.com/xerial/snappy-java/pull/749) ##### Other Changes - Use the release-drafter v7 autolabeler action for pull requests by [@​xerial](https://redirect.github.com/xerial) in [#​748](https://redirect.github.com/xerial/snappy-java/pull/748) **Full Changelog**: <https://github.com/xerial/snappy-java/compare/v1.1.10.9...v1.1.10.10> ### [`v1.1.10.9`](https://redirect.github.com/xerial/snappy-java/releases/tag/v1.1.10.9) <!-- Release notes generated using configuration in .github/release.yml at v1.1.10.9 --> #### What's Changed ##### 🐛 Bug Fixes - Fix buffer overflows and unbounded allocations from untrusted input (CVE-2026-90559 and others) by [@​xerial](https://redirect.github.com/xerial) in [#​739](https://redirect.github.com/xerial/snappy-java/pull/739) - Fix musl misdetection on glibc systems with musl installed ([#​692](https://redirect.github.com/xerial/snappy-java/issues/692)) by [@​xerial](https://redirect.github.com/xerial) in [#​740](https://redirect.github.com/xerial/snappy-java/pull/740) ##### 🔗 Dependency Updates - Update native libraries by [@​github-actions](https://redirect.github.com/github-actions)\[bot] in [#​543](https://redirect.github.com/xerial/snappy-java/pull/543) - Update sbt, scripted-plugin to 1.11.5 by [@​xerial-bot](https://redirect.github.com/xerial-bot) in [#​687](https://redirect.github.com/xerial/snappy-java/pull/687) - Bump actions/checkout from 4 to 5 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​685](https://redirect.github.com/xerial/snappy-java/pull/685) - Bump actions/setup-java from 4 to 5 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​690](https://redirect.github.com/xerial/snappy-java/pull/690) - Update sbt, scripted-plugin to 1.11.6 by [@​xerial-bot](https://redirect.github.com/xerial-bot) in [#​695](https://redirect.github.com/xerial/snappy-java/pull/695) - Update sbt, scripted-plugin to 1.11.7 by [@​xerial-bot](https://redirect.github.com/xerial-bot) in [#​698](https://redirect.github.com/xerial/snappy-java/pull/698) - Bump actions/checkout from 5 to 6 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​705](https://redirect.github.com/xerial/snappy-java/pull/705) - Bump actions/cache from 4 to 5 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​707](https://redirect.github.com/xerial/snappy-java/pull/707) - Bump peter-evans/create-pull-request from 7 to 8 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​706](https://redirect.github.com/xerial/snappy-java/pull/706) - Update sbt, scripted-plugin to 1.12.0 by [@​xerial-bot](https://redirect.github.com/xerial-bot) in [#​709](https://redirect.github.com/xerial/snappy-java/pull/709) - Update native libraries by [@​github-actions](https://redirect.github.com/github-actions)\[bot] in [#​688](https://redirect.github.com/xerial/snappy-java/pull/688) - Update sbt, scripted-plugin to 1.12.2 by [@​xerial-bot](https://redirect.github.com/xerial-bot) in [#​719](https://redirect.github.com/xerial/snappy-java/pull/719) - Bump dorny/paths-filter from 3 to 4 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​722](https://redirect.github.com/xerial/snappy-java/pull/722) - Bump release-drafter/release-drafter from 6 to 7 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​723](https://redirect.github.com/xerial/snappy-java/pull/723) - Bump jwlawson/actions-setup-cmake from 2.0 to 2.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​724](https://redirect.github.com/xerial/snappy-java/pull/724) ##### 🛠 Internal Updates - Update airframe-log to 2025.1.16 by [@​xerial-bot](https://redirect.github.com/xerial-bot) in [#​686](https://redirect.github.com/xerial/snappy-java/pull/686) - Update airframe-log to 2025.1.19 by [@​xerial-bot](https://redirect.github.com/xerial-bot) in [#​697](https://redirect.github.com/xerial/snappy-java/pull/697) - Update sbt-scalafmt to 2.5.6 by [@​xerial-bot](https://redirect.github.com/xerial-bot) in [#​701](https://redirect.github.com/xerial/snappy-java/pull/701) - Update airframe-log to 2025.1.21 by [@​xerial-bot](https://redirect.github.com/xerial-bot) in [#​700](https://redirect.github.com/xerial/snappy-java/pull/700) - Update hadoop-common to 3.4.2 by [@​xerial-bot](https://redirect.github.com/xerial-bot) in [#​691](https://redirect.github.com/xerial/snappy-java/pull/691) - Update airframe-log to 2025.1.22 by [@​xerial-bot](https://redirect.github.com/xerial-bot) in [#​708](https://redirect.github.com/xerial/snappy-java/pull/708) - Update airframe-log to 2025.1.23 by [@​xerial-bot](https://redirect.github.com/xerial-bot) in [#​710](https://redirect.github.com/xerial/snappy-java/pull/710) - Update airframe-log to 2025.1.27 by [@​xerial-bot](https://redirect.github.com/xerial-bot) in [#​714](https://redirect.github.com/xerial/snappy-java/pull/714) ##### 📚 Docs - Document JDK 24+ native access requirements by [@​xerial](https://redirect.github.com/xerial) in [#​702](https://redirect.github.com/xerial/snappy-java/pull/702) ##### Other Changes - chore: update release CI to use Java 21 by [@​xerial](https://redirect.github.com/xerial) in [#​681](https://redirect.github.com/xerial/snappy-java/pull/681) - Suppress AccessController deprecation warning for Java 17+ by [@​xerial](https://redirect.github.com/xerial) in [#​682](https://redirect.github.com/xerial/snappy-java/pull/682) - Add JDK 25 to CI test matrix by [@​xerial](https://redirect.github.com/xerial) in [#​703](https://redirect.github.com/xerial/snappy-java/pull/703) - Add JAR integration test for JDK compatibility by [@​xerial](https://redirect.github.com/xerial) in [#​704](https://redirect.github.com/xerial/snappy-java/pull/704) - Validate maxCompressedLength overflow and stream array ranges ([#​671](https://redirect.github.com/xerial/snappy-java/issues/671), [#​513](https://redirect.github.com/xerial/snappy-java/issues/513)) by [@​xerial](https://redirect.github.com/xerial) in [#​741](https://redirect.github.com/xerial/snappy-java/pull/741) - Adding automatic module name header ([#​713](https://redirect.github.com/xerial/snappy-java/issues/713)) by [@​gunnarmorling](https://redirect.github.com/gunnarmorling) in [#​718](https://redirect.github.com/xerial/snappy-java/pull/718) - Fail clearly on oversized raw input in SnappyInputStream ([#​278](https://redirect.github.com/xerial/snappy-java/issues/278)) by [@​xerial](https://redirect.github.com/xerial) in [#​743](https://redirect.github.com/xerial/snappy-java/pull/743) - Enable ASLR and DEP for Windows DLLs ([#​288](https://redirect.github.com/xerial/snappy-java/issues/288), [#​661](https://redirect.github.com/xerial/snappy-java/issues/661)) by [@​xerial](https://redirect.github.com/xerial) in [#​742](https://redirect.github.com/xerial/snappy-java/pull/742) - Close the underlying stream even if flush fails on close ([#​216](https://redirect.github.com/xerial/snappy-java/issues/216)) by [@​xerial](https://redirect.github.com/xerial) in [#​744](https://redirect.github.com/xerial/snappy-java/pull/744) - tests: remove Big Endian–specific compressed size assertion (from [#​720](https://redirect.github.com/xerial/snappy-java/issues/720)) by [@​xerial](https://redirect.github.com/xerial) in [#​745](https://redirect.github.com/xerial/snappy-java/pull/745) #### New Contributors - [@​gunnarmorling](https://redirect.github.com/gunnarmorling) made their first contribution in [#​718](https://redirect.github.com/xerial/snappy-java/pull/718) **Full Changelog**: <https://github.com/xerial/snappy-java/compare/v1.1.10.8...v1.1.10.9> </details> <details> <summary>immutables/immutables (org.immutables:value-annotations)</summary> ### [`v2.12.3`](https://redirect.github.com/immutables/immutables/releases/tag/2.12.3) [Compare Source](https://redirect.github.com/immutables/immutables/compare/2.12.2...2.12.3) ### Maintenance release #### What's Changed - Test for [#​1663](https://redirect.github.com/immutables/immutables/issues/1663), derived attribute depending default optional attribute by [@​jbergfi](https://redirect.github.com/jbergfi) in [#​1664](https://redirect.github.com/immutables/immutables/pull/1664) - [#​1668](https://redirect.github.com/immutables/immutables/issues/1668) ECJ: Skip Javadoc section when searching for `extends` keyword by [@​tyner-ibm](https://redirect.github.com/tyner-ibm) in [#​1669](https://redirect.github.com/immutables/immutables/pull/1669) - Fix [#​1665](https://redirect.github.com/immutables/immutables/issues/1665): prevent synthetic nullability from leaking onto mandatory attributes by [@​KingRayuga](https://redirect.github.com/KingRayuga) in [#​1670](https://redirect.github.com/immutables/immutables/pull/1670) - Fix [#​1662](https://redirect.github.com/immutables/immutables/issues/1662): propagate JSpecify NullMarked annotation to record builder stages by [@​KingRayuga](https://redirect.github.com/KingRayuga) in [#​1671](https://redirect.github.com/immutables/immutables/pull/1671) - Name attribute builder helpers after the value type by [@​pbielicki](https://redirect.github.com/pbielicki) in [#​1674](https://redirect.github.com/immutables/immutables/pull/1674) - Fix [#​1678](https://redirect.github.com/immutables/immutables/issues/1678): order absent values instead of dereferencing them by [@​rgatbert](https://redirect.github.com/rgatbert) in [#​1679](https://redirect.github.com/immutables/immutables/pull/1679) - Add optional field to Value.Parameter for trailing parameters only by [@​kiddkaffeine](https://redirect.github.com/kiddkaffeine) in [#​1661](https://redirect.github.com/immutables/immutables/pull/1661) - fix: retain TYPE\_USE annotations on nested/wildcard types ([#​1667](https://redirect.github.com/immutables/immutables/issues/1667)) by [@​arimu1](https://redirect.github.com/arimu1) in [#​1675](https://redirect.github.com/immutables/immutables/pull/1675) - fix: honor Jackson 3 @​JsonSerialize/[@​JsonDeserialize](https://redirect.github.com/JsonDeserialize) meta-annotations ([#​1649](https://redirect.github.com/immutables/immutables/issues/1649)) by [@​nezda](https://redirect.github.com/nezda) in [#​1677](https://redirect.github.com/immutables/immutables/pull/1677) - Fix [#​1647](https://redirect.github.com/immutables/immutables/issues/1647): declare encoded attribute setters on staged BuildFinal by [@​akashchamp](https://redirect.github.com/akashchamp) in [#​1683](https://redirect.github.com/immutables/immutables/pull/1683) #### New Contributors - [@​jbergfi](https://redirect.github.com/jbergfi) made their first contribution in [#​1664](https://redirect.github.com/immutables/immutables/pull/1664) - [@​tyner-ibm](https://redirect.github.com/tyner-ibm) made their first contribution in [#​1669](https://redirect.github.com/immutables/immutables/pull/1669) - [@​KingRayuga](https://redirect.github.com/KingRayuga) made their first contribution in [#​1670](https://redirect.github.com/immutables/immutables/pull/1670) - [@​pbielicki](https://redirect.github.com/pbielicki) made their first contribution in [#​1674](https://redirect.github.com/immutables/immutables/pull/1674) - [@​arimu1](https://redirect.github.com/arimu1) made their first contribution in [#​1675](https://redirect.github.com/immutables/immutables/pull/1675) - [@​nezda](https://redirect.github.com/nezda) made their first contribution in [#​1677](https://redirect.github.com/immutables/immutables/pull/1677) - [@​akashchamp](https://redirect.github.com/akashchamp) made their first contribution in [#​1683](https://redirect.github.com/immutables/immutables/pull/1683) **Full Changelog**: <https://github.com/immutables/immutables/compare/2.12.2...v2.12.3> </details> <details> <summary>apache/tika (org.apache.tika:tika-langdetect-tika)</summary> ### [`v3.3.3`](https://redirect.github.com/apache/tika/compare/3.3.2...3.3.3) [Compare Source](https://redirect.github.com/apache/tika/compare/3.3.2...3.3.3) </details> <details> <summary>logchange/logchange (dev.logchange)</summary> ### [`v1.20.0`](https://redirect.github.com/logchange/logchange/blob/HEAD/CHANGELOG.md#1200---2026-10-04) [Compare Source](https://redirect.github.com/logchange/logchange/compare/1.19.16...1.20.0) ##### Added (1 change) - Added skipIfFileAlreadyExists option to add command, which skips adding entry instead of failing when entry file already exists (f.e. when Renovate updates the same dependency in a few places) ([Peter Zmilczak](https://redirect.github.com/marwin1991) [@​marwin1991](https://redirect.github.com/marwin1991)) ##### Dependency updates (15 changes) - Upgraded actions/checkout from v6.1.0 to v7.0.1 ([logchange-bot]([email protected]) [@​logchange-bot](https://redirect.github.com/logchange-bot)) - Upgraded actions/setup-java from v5.7.0 to v6.0.0 ([logchange-bot]([email protected]) [@​logchange-bot](https://redirect.github.com/logchange-bot)) - Upgraded actions/setup-python from v6.3.0 to v7.0.0 ([logchange-bot]([email protected]) [@​logchange-bot](https://redirect.github.com/logchange-bot)) - Upgraded com.fasterxml.jackson.core:jackson-databind from 2.22.1 to 2.22.2 ([logchange-bot]([email protected]) [@​logchange-bot](https://redirect.github.com/logchange-bot)) - Upgraded com.fasterxml.jackson.core:jackson-databind from 2.22.1 to 2.22.3 ([logchange-bot]([email protected]) [@​logchange-bot](https://redirect.github.com/logchange-bot)) - Upgraded com.fasterxml.jackson.dataformat:jackson-dataformat-yaml from 2.22.1 to 2.22.3 ([logchange-bot]([email protected]) [@​logchange-bot](https://redirect.github.com/logchange-bot)) - Upgraded com.squareup.okhttp3:mockwebserver from 5.4.0 to 5.5.0 ([logchange-bot]([email protected]) [@​logchange-bot](https://redirect.github.com/logchange-bot)) - Upgraded org.apache.groovy:groovy-all from 5.1.0 to 5.1.3 ([logchange-bot]([email protected]) [@​logchange-bot](https://redirect.github.com/logchange-bot)) - Upgraded org.codehaus.plexus:plexus-interactivity-api from 1.5.1 to 1.6.0 ([logchange-bot]([email protected]) [@​logchange-bot](https://redirect.github.com/logchange-bot)) - Upgraded org.graalvm.buildtools:junit-platform-native from 1.1.9 to 1.1.14 ([logchange-bot]([email protected]) [@​logchange-bot](https://redirect.github.com/logchange-bot)) - Upgraded org.graalvm.buildtools:native-maven-plugin from 1.1.9 to 1.1.14 ([logchange-bot]([email protected]) [@​logchange-bot](https://redirect.github.com/logchange-bot)) - Upgraded org.pitest:pitest-maven from 1.25.9 to 1.30.0 ([logchange-bot]([email protected]) [@​logchange-bot](https://redirect.github.com/logchange-bot)) - Upgraded org.projectlombok:lombok from 1.18.46 to 1.18.48 ([logchange-bot]([email protected]) [@​logchange-bot](https://redirect.github.com/logchange-bot)) - Upgraded org.slf4j:slf4j-api from 2.0.18 to 2.0.20 ([logchange-bot]([email protected]) [@​logchange-bot](https://redirect.github.com/logchange-bot)) - Upgraded renovatebot/github-action from v46.2.2 to v46.3.6 ([logchange-bot]([email protected]) [@​logchange-bot](https://redirect.github.com/logchange-bot)) </details> <details> <summary>apache/commons-codec (commons-codec:commons-codec)</summary> ### [`v1.23.0`](https://redirect.github.com/apache/commons-codec/blob/HEAD/RELEASE-NOTES.txt#Apache-Commons-Codec-1230-Release-Notes) The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.23.0. The Apache Commons Codec component contains encoders and decoders for formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities. This is a feature and maintenance release. Java 8 or later is required. </details> <details> <summary>spotbugs/spotbugs (com.github.spotbugs:spotbugs-annotations)</summary> ### [`v4.10.5`](https://redirect.github.com/spotbugs/spotbugs/blob/HEAD/CHANGELOG.md#4105---2026-10-11) [Compare Source](https://redirect.github.com/spotbugs/spotbugs/compare/4.10.4...4.10.5) ##### Added - Add `ReflectiveAccessTracker` to track fields accessed via reflection - such as VarHandle, MethodHandle or AtomicFieldUpdaters ([#​3954](https://redirect.github.com/spotbugs/spotbugs/pull/3954)) to fix issue ([#​2749](https://redirect.github.com/spotbugs/spotbugs/issues/2749)) - Add automatic completion of class names in GUI class filter ([#​749](https://redirect.github.com/spotbugs/spotbugs/issues/749)) ##### Changed - `@SuppressFBWarnings` annotation on a method or a constructor now suppresses warnings reported in their lambdas too ([#​724](https://redirect.github.com/spotbugs/spotbugs/issues/724)) - Replace deprecated calls to 'SignatureParser' to 'GenericSignatureParser' where feasible ([#​4336](https://redirect.github.com/spotbugs/spotbugs/pull/4337)) - Declaring to the interface lists/maps ([#​4381](https://redirect.github.com/spotbugs/spotbugs/pull/4381)) ##### Fixed - Fix `NP_NULL_ON_SOME_PATH` false positive when a field null check that throws uses `field == null` but not `null == field` ([#​4147](https://redirect.github.com/spotbugs/spotbugs/issues/4147)) - Fix `RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT` false negative when the ignored result comes from `Arrays.copyOf`, `Arrays.copyOfRange` or any pure static method or constructor of a class using `assert` ([#​3900](https://redirect.github.com/spotbugs/spotbugs/issues/3900)) - Fix `AA_ASSERTION_OF_ARGUMENTS` false negative when a public method validates a parameter with `assert` and `instanceof` ([#​4305](https://redirect.github.com/spotbugs/spotbugs/issues/4305)) - Fix `PT_ABSOLUTE_PATH_TRAVERSAL` false negative for `new File(parent, child)`, where the attacker controlled segment is the second argument ([#​4340](https://redirect.github.com/spotbugs/spotbugs/pull/4340)) - Fix 'DM\_USELESS\_THREAD' false negative for Thread subclasses that do not override run() ([#​4306](https://redirect.github.com/spotbugs/spotbugs/issues/4306)) - Fix `UL_UNRELEASED_LOCK` false negative when a method acquires a lock and never calls `unlock` ([#​4310](https://redirect.github.com/spotbugs/spotbugs/issues/4310)) - Fix `TLW_TWO_LOCK_WAIT` false negatives when a class waits while holding two monitors but has no matching `notify()` call ([#​4323](https://redirect.github.com/spotbugs/spotbugs/issues/4323)) - Fix `NP_ALWAYS_NULL` false positives when a non-null value is known to satisfy an `instanceof` check ([#​4272](https://redirect.github.com/spotbugs/spotbugs/issues/4272)) - Fix `RANGE_ARRAY_INDEX` false positive when the array access is inside unreachable code caused by an impossible null condition (e.g. `if (x == null && x != null)`) ([#​4275](https://redirect.github.com/spotbugs/spotbugs/issues/4275)) - Fix `NP_NULL_ON_SOME_PATH` false positive when `instanceof` check is always true because the value was created with `new` and its exact type is a subtype of the checked type (e.g. `Base value = new Derived(); if (value instanceof Derived) result = new Object(); result.toString()`) ([#​4273](https://redirect.github.com/spotbugs/spotbugs/issues/4273)) - Fix `NN_NAKED_NOTIFY` false positive when guarded state is updated before the synchronized block that calls `notify`/`notifyAll` ([#​3786](https://redirect.github.com/spotbugs/spotbugs/issues/3786)) - Fix `SA_LOCAL_SELF_ASSIGNMENT` false positive in methods with `++`/`--` inside a switch nested in a try-catch block ([#​3929](https://redirect.github.com/spotbugs/spotbugs/issues/3929)) - Fix `AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE` false negative for non-atomic read-modify-write in inner classes accessing enclosing shared fields ([#​4236](https://redirect.github.com/spotbugs/spotbugs/pull/4236)) - Fix `OS_OPEN_STREAM` false positive when the result of `PrintWriter.append()` is reassigned before closing the writer ([#​4274](https://redirect.github.com/spotbugs/spotbugs/issues/4274)) - Fix `OS_OPEN_STREAM` false positive when a stream is wrapped (e.g. in a `PrintStream`, `BufferedOutputStream` or `PrintWriter`) and the wrapped stream is closed instead of the wrapper ([#​4304](https://redirect.github.com/spotbugs/spotbugs/issues/4304)) - Fix `SING_SINGLETON_GETTER_NOT_SYNCHRONIZED` false negative when lazy init uses a ternary assignment instead of an `if` statement ([#​4154](https://redirect.github.com/spotbugs/spotbugs/issues/4154)) - Fix `UR_UNINIT_READ` false negative for compound assignment to a field (e.g. `m_iType |= e`) ([#​4233](https://redirect.github.com/spotbugs/spotbugs/pull/4233)) - Fix `NP_BOOLEAN_RETURN_NULL` false negative when `null` is returned via a local variable ([#​4234](https://redirect.github.com/spotbugs/spotbugs/pull/4234)) - Fix `MS_EXPOSE_BUF` and `EI_EXPOSE_BUF` false negative when returning `Buffer.array()` ([#​4235](https://redirect.github.com/spotbugs/spotbugs/pull/4235)) - Fix `OBL_UNSATISFIED_OBLIGATION` false negatives for unclosed `CallableStatement`s returned by `Connection.prepareCall` ([#​4148](https://redirect.github.com/spotbugs/spotbugs/issues/4148)) - Fix `LI_LAZY_INIT_STATIC` false negative when field is lazily initialized using a method call ([#​4276](https://redirect.github.com/spotbugs/spotbugs/issues/4276)) - Fix `DMI_RANDOM_USED_ONLY_ONCE` FP when Random is used inside loop but created before ([#​3937](https://redirect.github.com/spotbugs/spotbugs/pull/3937)) - Fix SARIF output writing source-location URI syntax exceptions to stderr when source filenames are unknown ([#​1412](https://redirect.github.com/spotbugs/spotbugs/issues/1412)) - Fix IL\_INFINITE\_LOOP false positives for loops with conditions that are statically known to be true or false ([#​3904](https://redirect.github.com/spotbugs/spotbugs/issues/3904)) - Narrow the definition of singletons ([#​2985](https://redirect.github.com/spotbugs/spotbugs/issues/2985)) - Fix `NP_LOAD_OF_KNOWN_NULL_VALUE` false negative when null check uses `instanceof` ([#​3916](https://redirect.github.com/spotbugs/spotbugs/issues/3916)) - Fix `MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR` false negative when a constructor calls an overridable method that takes arguments, such as a setter (e.g. `setValue(value)`) ([#​4309](https://redirect.github.com/spotbugs/spotbugs/issues/4309)) - Fix CLI launcher scripts intercepting `-conserveSpace` with a JVM system property instead passing it to Java Application as equivalent to `-effort:min` ([#​4268](https://redirect.github.com/spotbugs/spotbugs/pull/4289)) - Fix `USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION` false positive when `clone()` assigns a newly created lock object to the copy ([#​4320](https://redirect.github.com/spotbugs/spotbugs/issues/4320)) - Fix `CT_CONSTRUCTOR_THROW` false positive with sealed classes ([#​4259](https://redirect.github.com/spotbugs/spotbugs/issues/4259)) - Fix `JrtfsCodeBase` resolving JDK classes from the module image of the running JVM instead of the JDK the given `jrt-fs.jar` belongs to, so that `-auxclasspath <other-jdk>/lib/jrt-fs.jar` is honoured ([#​4329](https://redirect.github.com/spotbugs/spotbugs/pull/4329)) - Fix `USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION` false positive when a lock is assigned to a newly allocated object ([#​4331](https://redirect.github.com/spotbugs/spotbugs/issues/4331)) - Do not flag `writeReplace()` and `writeExternal()` as mutators ([#​1719](https://redirect.github.com/spotbugs/spotbugs/pull/1719)) - Prevent XML external entity resolution in user-controlled data ([#​4365](https://redirect.github.com/spotbugs/spotbugs/pull/4365)) - Fix handling of JSpecify type-use annotations in `CheckRelaxingNullnessAnnotation` ([#​4389](https://redirect.github.com/spotbugs/spotbugs/pull/4389)) - Stop reporting missing java.applet at java 26 or higher ([#​4390](https://redirect.github.com/spotbugs/spotbugs/pull/4390)) </details> <details> <summary>ben-manes/caffeine (com.github.ben-manes.caffeine:caffeine)</summary> ### [`v3.3.1`](https://redirect.github.com/ben-manes/caffeine/releases/tag/v3.3.1): 3.3.1 - Added a workaround for `ForkJoinPool` queue corruption caused by resubmitting a reusable `ForkJoinTask` ([#​2021](https://redirect.github.com/ben-manes/caffeine/issues/2021)) - Improved JCache read performance when using access expiration - Fixed various minor issues found using AI audits </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "before 9am on the first day of the month" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://redirect.github.com/solrbot/renovate-github-action) <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzAuMTgiLCJ1cGRhdGVkSW5WZXIiOiI0My4xNzAuMTgiLCJ0YXJnZXRCcmFuY2giOiJicmFuY2hfOXgiLCJsYWJlbHMiOlsiZXhlbXB0LXN0YWxlIl19--> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
