[dependabot]

Bumps the minor-and-patch group with 8 updates in the / directory:

Package	From	To
org.springdoc:springdoc-openapi-starter-webmvc-ui	3.1.1	3.2.0
org.jdbi:jdbi3-sqlobject	3.54.0	3.55.0
com.google.guava:guava	33.7.1-jre	33.7.2-jre
commons-codec:commons-codec	1.22.1	1.23.0
com.google.code.gson:gson	2.14.0	2.15.0
org.springframework.boot:spring-boot-dependencies	4.1.1	4.1.2
org.springframework.boot:spring-boot-maven-plugin	4.1.1	4.1.2
org.springframework.boot:spring-boot-maven-plugin	4.1.1	4.1.2
com.fasterxml.jackson.datatype:jackson-datatype-jsr310	2.22.2	2.22.4

Updates org.springdoc:springdoc-openapi-starter-webmvc-ui from 3.1.1 to 3.2.0

Release notes

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's releases.

springdoc-openapi v3.2.0 released!

Spring Boot 4.1.x line (built on Spring Boot 4.1.2).

⚠️ Changes you may notice

• Default API version (#3354): the default API version is now only listed in the version header or query parameter of the operations that actually serve it (a handler mapped to it, or one without a version). Operations mapped only to other versions no longer show it as an allowed value or as their default. This also fixes the HTTP 500 raised when the version parameter declared @Schema(allowableValues).
• Newly required properties (#3360, #3361): the PagedModel / PageMetadata properties and the amount / currency properties of MonetaryAmount are now marked as required, as they are always serialized. Generated clients will see them as non-nullable.
• Scalar 0.6 (#3359): upgraded to 0.6.83. The first tag is now open by default, and model links changed from #model/name to #models/Name.
• Scalar's standalone integration (#3387): with the Swagger UI or API-only starters, Scalar's own auto-configuration is no longer disabled by springdoc. If you have com.scalar.maven on the classpath and don't want it, set scalar.enabled=false.

New

• Opt-in nullability for Java models (#3382): springdoc.model-converters.java-nullable-property-customizer.enabled=true marks properties annotated with @Nullable (JSpecify, Spring, JSR-305) as nullable, including $ref and oneOf properties, without changing shared components.
• Polymorphic oneOf as reusable components (#3390): springdoc.model-converters.polymorphic-converter.one-of-as-ref=true, with the name suffix set by springdoc.model-converters.polymorphic-converter.one-of-ref-suffix (Variant by default).
• ParameterCustomizer can read type-use annotations, including inside Optional<@MyAnnotation Foo> (#3370).
• MCP tools are registered with a McpStatelessSyncServer, for the Spring AI STATELESS protocol (#3388).

Fixed

• @ResponseStatus on a controller class is applied to its operations (#3352).
• An injected WebSession is no longer documented as a query parameter in WebFlux (#3355).
• The application no longer fails to start with Spring HATEOAS on the classpath but no LinkRelationProvider bean (#3364).
• WebAsyncTask return types are unwrapped (#3368).
• A JSpecify @Nullable on a controller parameter makes its schema nullable (#3377).
• Nullable Kotlin properties described by a oneOf (e.g. sealed classes) are documented as nullable (#3381).
• Gradle builds no longer lift Jackson 2 above the version managed by Spring Boot (#3373).

Security

• The MCP dashboard no longer pre-fills the OAuth2 token endpoint, client id and client secret, and warns when the token endpoint is not HTTPS.

Dependencies

Spring Boot 4.1.2 · swagger-ui 5.34.0 · Scalar 0.6.83 · Spring AI 2.0.1 · Spring Cloud Function 5.0.5 · spring-security-oauth2-authorization-server managed by Spring Boot (7.1.2)

Thanks to all the contributors of this release: @​MaxFreedomPollard, @​kdelay, @​arimu1, @​dpkass, @​anupamchaubey, @​Mattias-Sehlstedt, @​Naresh7175, @​ys0v9, @​sharanggupta, @​itd-sw, @​gwr0-0, @​Tework123, @​awinishere.

Changelog

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's changelog.

[3.2.0] - 2026-10-24

Added

• #3370 – A ParameterCustomizer can read the type-use annotations of a parameter, including the ones declared on the value wrapped in an Optional, such as Optional<@MyAnnotation Foo>
• #3382 – Mark the Java properties annotated with @Nullable (JSpecify, Spring, JSR-305) as nullable in their schema, including $ref and oneOf properties. Opt-in with springdoc.model-converters.java-nullable-property-customizer.enabled=true
• #3390 – Add springdoc.model-converters.polymorphic-converter.one-of-as-ref to emit the polymorphic oneOf unions as reusable component schemas, named after the parent schema with the suffix set by springdoc.model-converters.polymorphic-converter.one-of-ref-suffix (Variant by default)
• #3388 – Register the MCP tools with a McpStatelessSyncServer, for the STATELESS protocol

Changed

• The MCP dashboard no longer pre-fills the OAuth2 token endpoint, client id and client secret. The form shows hints instead, and warns when the token endpoint is not HTTPS
• #3354 – The default API version is only listed in the header or query parameter of the operations that serve it: a handler method mapped to it, or one without a version
• #3360 – The properties of Spring Data PagedModel and its PageMetadata are now marked as required, as they are always serialized
• #3361 – The amount and currency properties of MonetaryAmount are now marked as required
• #3359 – Upgrade Scalar to version 0.6.83. The first tag is now open by default, and the links to models changed from #model/name to #models/Name
• #3383 – Upgrade Spring AI to version 2.0.1. The MCP SDK version is now the one required by Spring AI
• Upgrade spring-boot to version 4.1.2
• Upgrade swagger-ui to version 5.34.0
• Upgrade spring-cloud-function to version 5.0.5
• Use the spring-security-oauth2-authorization-server version managed by Spring Boot (7.1.2) instead of 2.0.0-M2

Fixed

• #3352 – A @ResponseStatus on a controller class is now applied to the responses of its operations
• #3355 – An injected WebSession parameter is no longer documented as a query parameter in WebFlux applications
• #3354 – /v3/api-docs no longer fails when an API version parameter declares @Schema(allowableValues)
• #3364 – The application no longer fails to start when Spring HATEOAS is on the classpath without a LinkRelationProvider bean
• #3368 – A WebAsyncTask return type is now unwrapped, so its response is described by its result type
• #3377 – A JSpecify @Nullable on a controller method parameter now makes its schema nullable
• #3381 – A nullable Kotlin property described by a oneOf schema, such as a sealed class, is now documented as nullable
• #3387 – Scalar's own integration works again with the Swagger UI and API-only starters: only the Springdoc Scalar starters replace it
• #3373 – springdoc no longer lifts Jackson 2 above the version managed by Spring Boot in Gradle builds

Commits

• 6b79ced [maven-release-plugin] prepare release v3.2.0
• 689fc13 Describe the nullable property customizer flags in the configuration metadata
• 7a1b506 Correct the LocalTime format in the changelog entry of gh-3351
• 96245a2 Upgrade Scalar to 0.6.83
• c494456 Build against the GA versions of the optional Spring dependencies
• 2d4595f Restore the changelog entries lost in the unreleased fixed section
• dd807bd Upgrade swagger-ui to version 5.34.0
• e649960 Upgrade spring-boot to 4.1.2
• b170ca8 Use the Jackson 2 managed by Spring Boot
• ae52fe7 Register the MCP tools with a McpStatelessSyncServer
• Additional commits viewable in compare view

Updates org.jdbi:jdbi3-sqlobject from 3.54.0 to 3.55.0

Release notes

Sourced from org.jdbi:jdbi3-sqlobject's releases.

3.55.0

Significant bugfix and small feature request sweep of the backlog:

• Bind and map types that are not public: a package-private bean class with public accessors, a non-public constructor or @JdbiConstructor factory method, or a package-private Immutables value type. mapToBean now also uses a non-public no-arg constructor, e.g. a private one on a public bean. The ReflectionMappers accessible object strategy controls this. Unlike FieldMapper, these mappers apply the strategy in effect when a type is first used and cache the result for the Jdbi instance, so set the strategy on the Jdbi before first use, not on a Handle or statement. A ConstructorMapper for a type that Jdbi can not access now fails on first use, with a message that names the fix, instead of at creation (#1684)
• Fix KotlinMapper ignoring a SQL NULL for a @PropagateNull constructor parameter or property of a non-null primitive type such as Long or Int. The column mapper returned 0 (or false) and the object was mapped instead of null. KotlinMapper now treats the NULL as null like the ConstructorMapper, FieldMapper, and BeanMapper do (#3048)
• Fix a @Nested Optional<T> attribute that held null instead of Optional.empty() when T used the class-level @PropagateNull("column") form and that column was null. A @PropagateNull on the Optional attribute itself no longer turns the parent into null in this case, which matches the attribute-level form (#3049)
• New JoinRowReducer (Beta) reduces the rows of a join query into root objects and links the joined objects to them, for to-one and to-many relations over inner and outer joins. Columns are named relative to the relation prefix, one type is one table, so a table row is one instance no matter through how many relations the query reaches it, and reducers nest for deeper graphs (#1574)
• New RowView.getColumn(String) and RowView.getColumn(int) return a column value as the JDBC driver returns it from ResultSet.getObject, without a column mapper. New RowView.getColumnNames() returns the column labels of the result set, and RowView.getRow(RowMapper) maps the current row with a given mapper (#1574)
• Add BindListStyle to render bindList / @BindList elements as single-column rows, (:a),(:b), for use with the SQL VALUES list constructor. Configure it with SqlStatements#setBindListStyle or @BindList(style = BindListStyle.ROWS) (#1550, Alpha)
• Add LocalTransactionHandler.managed(): Jdbi manages transactions on connections with autocommit disabled instead of joining them, e.g. on a pool that disables autocommit as a precaution. inTransaction commits, retry handlers such as SerializableTransactionRunner engage, and a statement executed outside of a transaction is not committed. (#2663, #1733)
• Add NoOpTransactionHandler for connections whose transactions an external framework manages, e.g. a Spring TransactionAwareDataSourceProxy or an XA data source. It never reads or changes the transaction state of the connection. CMTTransactionHandler now extends it, with unchanged behavior. (#2742, thanks @​bekoenig for the suggestion!)
• Document the transaction contract for connections with autocommit disabled: the handle joins the transaction that the connection owner manages. New "Transactions managed outside Jdbi" section in the User Guide, with tests that pin the contract. (#1039, #2663)
• Document how @PropagateNull resolves its column: on a class, the column name is relative to the mapper prefix (from @Nested or from a mapper made with a prefix), so one class maps under different prefixes. New "Using @PropagateNull" section in the User Guide, with tests for mappers made with a prefix. (#1764)
• Fix JdbiExtension losing its plugins and initializer after afterAll, so a static extension whose test class ran a second time in the same JVM (a Surefire rerun of a failed test, or a @Nested class selected as its own test class) restarted with a bare Jdbi and failed with NoSuchMapperException or NoSuchExtensionException (#3036)
• vavr: update to vavr 1.0.1. The vavr 1.0.0-alpha releases remain unsupported (#2350)
• Fix repeated @RegisterKotlinMapper annotations on one method or type. Kotlin wrapped them in a generated container that Jdbi did not process, so none of the mappers were registered and rows mapped through the

... (truncated)

Changelog

Sourced from org.jdbi:jdbi3-sqlobject's changelog.

3.55.0

• Bind and map types that are not public: a package-private bean class with public accessors, a non-public constructor or @JdbiConstructor factory method, or a package-private Immutables value type. mapToBean now also uses a non-public no-arg constructor, e.g. a private one on a public bean. The ReflectionMappers accessible object strategy controls this. Unlike FieldMapper, these mappers apply the strategy in effect when a type is first used and cache the result for the Jdbi instance, so set the strategy on the Jdbi before first use, not on a Handle or statement. A ConstructorMapper for a type that Jdbi can not access now fails on first use, with a message that names the fix, instead of at creation (#1684)
• Fix KotlinMapper ignoring a SQL NULL for a @PropagateNull constructor parameter or property of a non-null primitive type such as Long or Int. The column mapper returned 0 (or false) and the object was mapped instead of null. KotlinMapper now treats the NULL as null like the ConstructorMapper, FieldMapper, and BeanMapper do (#3048)
• Fix a @Nested Optional<T> attribute that held null instead of Optional.empty() when T used the class-level @PropagateNull("column") form and that column was null. A @PropagateNull on the Optional attribute itself no longer turns the parent into null in this case, which matches the attribute-level form (#3049)
• New JoinRowReducer (Beta) reduces the rows of a join query into root objects and links the joined objects to them, for to-one and to-many relations over inner and outer joins. Columns are named relative to the relation prefix, one type is one table, so a table row is one instance no matter through how many relations the query reaches it, and reducers nest for deeper graphs (#1574)
• New RowView.getColumn(String) and RowView.getColumn(int) return a column value as the JDBC driver returns it from ResultSet.getObject, without a column mapper. New RowView.getColumnNames() returns the column labels of the result set, and RowView.getRow(RowMapper) maps the current row with a given mapper (#1574)
• Add BindListStyle to render bindList / @BindList elements as single-column rows, (:a),(:b), for use with the SQL VALUES list constructor. Configure it with SqlStatements#setBindListStyle or @BindList(style = BindListStyle.ROWS) (#1550, Alpha)
• Add LocalTransactionHandler.managed(): Jdbi manages transactions on connections with autocommit disabled instead of joining them, e.g. on a pool that disables autocommit as a precaution. inTransaction commits, retry handlers such as SerializableTransactionRunner engage, and a statement executed outside of a transaction is not committed. (#2663, #1733)
• Add NoOpTransactionHandler for connections whose transactions an external framework manages, e.g. a Spring TransactionAwareDataSourceProxy or an XA data source. It never reads or changes the transaction state of the connection. CMTTransactionHandler now extends it, with unchanged behavior. (#2742, thanks @​bekoenig for the suggestion!)
• Document the transaction contract for connections with autocommit disabled: the handle joins the transaction that the connection owner manages. New "Transactions managed outside Jdbi" section in the User Guide, with tests that pin the contract. (#1039, #2663)
• Document how @PropagateNull resolves its column: on a class, the column name is relative to the mapper prefix (from @Nested or from a mapper made with a prefix), so one class maps under different prefixes. New "Using @PropagateNull" section in the User Guide, with tests for mappers made with a prefix. (#1764)
• Fix JdbiExtension losing its plugins and initializer after afterAll, so a static extension whose test class ran a second time in the same JVM (a Surefire rerun of a failed test, or a @Nested class selected as its own test class) restarted with a bare Jdbi and failed with NoSuchMapperException or NoSuchExtensionException (#3036)
• vavr: update to vavr 1.0.1. The vavr 1.0.0-alpha releases remain unsupported (#2350)
• Fix repeated @RegisterKotlinMapper annotations on one method or type. Kotlin wrapped them in a generated container that Jdbi did not process, so none of the mappers were registered and rows mapped through the unprefixed KotlinMapperFactory mapper, ignoring the prefix. The annotation now uses

... (truncated)

Commits

• a20642a [maven-release-plugin] prepare release v3.55.0
• a7df034 Release notes 3.55.0
• d43955b Merge remote-tracking branch 'origin/claude-nested-optional-propagate-null'
• 06b6682 Merge pull request #3048 from jdbi/claude-kotlin-propagate-null-primitive
• a3be71c Return Optional.empty() for a nested Optional with class-level @​PropagateNull
• c52bb43 Map a SQL NULL to null for a @​PropagateNull primitive in KotlinMapper
• 6f8de68 Merge pull request #3047 from jdbi/claude-accessible-lookup-1684
• 4570efc Merge pull request #3043 from jdbi/claude-propagate-null-docs-1764
• 793b789 Document how @​PropagateNull resolves its column under a mapper prefix
• 88a246a Apply the accessible object strategy to beans, constructors, and Immutables
• Additional commits viewable in compare view

Updates com.google.guava:guava from 33.7.1-jre to 33.7.2-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.2

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.2-jre</version>
  <!-- or, for Android: -->
  <version>33.7.2-android</version>
</dependency>

Jar files

• 33.7.2-jre.jar
• 33.7.2-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.2-jre
• 33.7.2-android

JDiff

• 33.7.2-jre vs. 33.7.1-jre
• 33.7.2-android vs. 33.7.1-android
• 33.7.2-android vs. 33.7.2-jre

Changelog

• collect: Changed MapMaker, CompactHashMap, and CompactHashSet deserialization to avoid eagerly allocating as much memory as a serialization payload requests (CVE-2026-102554). (a0d0c36432)

Commits

• See full diff in compare view

Updates commons-codec:commons-codec from 1.22.1 to 1.23.0

Changelog

Sourced from commons-codec:commons-codec's changelog.

Apache Commons Codec 1.23.0 Release Notes

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.23.0.

The Apache Commons Codec component contains encoders and decoders for formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

New features

•         Add and use PhoneticEngine.Builder and deprecate old constructors. Thanks to Gary Gregory.
  

•         Add BeiderMorseEncoder.Builder and deprecate old constructor. Thanks to Gary Gregory.
  

•         Add PhoneticEngine.Builder.setMaxInputLength(int). Thanks to Yu Bao, Gary Gregory.
  

•         Add Base45 support. Thanks to Gary Gregory.
  

•         Add URLCodec.decodeUrl(BitSet, byte[]) to decode with a custom safe set. Thanks to Gary Gregory.
  

Fixed Bugs

•         GitIdentifiers orders tree entries by unsigned UTF-8 bytes, as Git does, instead of UTF-16 code units. Thanks to Jeff Lenamon.
  

•         Optimize PhoneticEngine.encode(String, LanguageSet) for speed. Thanks to Yu Bao, Gary Gregory.
  

•         RFC1522Codec.decodeText(String) now throws a DecoderException instead of a StringIndexOutOfBoundsException when a separator is missing. Thanks to Yu Bao, Gary Gregory.
  

•         Optimize Base58.convertFromBase58(byte[], Context) for speed and temporary object allocation. Thanks to Yu Bao, Gary Gregory.
  

•         Allocate a single MessageDigest and use it in Sha2Crypt.sha2Crypt(byte[], String, String, int, String). Thanks to Yu Bao, Gary Gregory.
  

•         Javadoc improvements. Thanks to Gary Gregory.
  

•         Throw IOException instead of IllegalArgumentException in BaseNCodecOutputStream and BaseNCodecOutputStream IO methods. Thanks to Gary Gregory.
  

•         Throw DecoderException instead of IllegalArgumentException in RFC1522Codec.decodeText(String). Thanks to Gary Gregory.
  

•         Fix Blake3 KDF example and clarify finalization semantics. Thanks to Gary Gregory.
  

•         Base32 and Base64 STRICT decoding now require the encoder's canonical alphabet, padding, and line separators, and validate streams through EOF. Use LENIENT to retain permissive decoding. Thanks to Gary Gregory.
  

•         Limit Base58 decoding to 8192 encoded bytes by default, checking cumulative stream input before buffering. Use Base58.Builder.setMaxDecodeLength(int) for larger trusted input. Encoding defaults to a configurable 8192-byte binary input limit through Base58.Builder.setMaxEncodeLength(int). Thanks to Gary Gregory.
  

•         Grow Base58 accumulation buffers geometrically within the configured input limits and validate actual accumulated length. Thanks to Gary Gregory.
  

•         Implement Base58 encoded-length calculation and explicitly reject unsupported line chunking. Thanks to Gary Gregory.
  

•         Close the underlying BaseNCodecOutputStream output even when final conversion or flushing fails, preserving suppressed close exceptions. Thanks to Gary Gregory.
  

•         Reject invalid GitIdentifiers tree entry names and file/directory name conflicts to prevent ambiguous tree serialization and colliding identifiers. Thanks to Gary Gregory.
  

•         Hex decoding now accepts only ASCII hexadecimal characters (0-9, A-F, a-f). Previously accepted non-ASCII Unicode digits and fullwidth letters now cause DecoderException, including when supplied as UTF-8 bytes or ByteBuffers. Thanks to Gary Gregory.
  

•         Restrict Hex decoding to ASCII hexadecimal characters. Thanks to Gary Gregory.
  

•         Validate BinaryCodec input while preserving leading-bit truncation. Thanks to Gary Gregory.
  

•         Reject oversized Beider-Morse input before language guessing. Thanks to Gary Gregory.
  

•         QuotedPrintableCodec decoding now preserves hard CRLF line breaks and, leniently, unpaired CR and LF bytes instead of discarding them. Soft line breaks require the full =CRLF sequence; previously accepted =CR without LF now throws DecoderException. This affects both constructor modes and QCodec, which shares the decoder. Thanks to Gary Gregory.
  

•         Bound Sha2Crypt rounds from caller-supplied salts. Thanks to Gary Gregory.
  

•         Bound Sha2Crypt password length to prevent quadratic CPU DoS. Thanks to Gary Gregory.
  

•         Make the @param names in BaseNCodec match the parameters they document ([#444](https://github.com/apache/commons-codec/issues/444)). Thanks to geonseok, Gary Gregory.
  

• CODEC-345: Restore URLCodec.encodeUrl(BitSet, byte[]) support for custom safe sets containing percent and plus, and document the decoding limitations. Thanks to Ganesh Gautam, Gary Gregory.
• CODEC-245: Reject malformed Sha2Crypt salt syntax (#445). Thanks to Efe, Gary Gregory.

... (truncated)

Commits

• 1147e78 Add github.autolink_jira
• 129a289 Prepare for the release candidate 1.23.0 RC1
• d7bff67 Prepare for the release candidate
• 89d6498 Update GH CI from Java 26 to 27
• 5444a15 [test] Bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0
• 6685826 Bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0 (#446)
• 7221073 Parameterize some unit tests
• cb9c04d Parameterize some unit tests
• 6837802 [CODEC-245] Reject malformed Sha2Crypt salt syntax
• 3e05f66 [CODEC-245] Reject malformed Sha2Crypt salt syntax (#445)
• Additional commits viewable in compare view

Updates com.google.code.gson:gson from 2.14.0 to 2.15.0

Release notes

Sourced from com.google.code.gson:gson's releases.

Gson 2.15.0

What's Changed

These are some of the more important changes

API addition:

• Add JsonReader.getCharacterOffset to track stream position by @​barakhub in google/gson#3102

Behaviour changes and bugfixes:

• Use LinkedHashMap as the default Map. by @​eamonnmcmanus in google/gson#3057
• Make LazilyParsedNumber implement Comparable. by @​eamonnmcmanus in google/gson#3076
• Only deserialize InetAddress from numeric IP addresses. by @​eamonnmcmanus in google/gson#3075
• Correct logic for BOM detection. by @​eamonnmcmanus in google/gson#3137
• fix: Include location info in NumberFormatException from JsonReader by @​daguimu in google/gson#3000
• Fix: peekNumber rejects some numerals like 2^64 + "0" by @​ogolberg in google/gson#3034
• Fix URI type adapter to preserve identity for non-ASCII URIs by @​anishesg in google/gson#3067
• Fix JsonPrimitive.hashCode to honor the equals/hashCode contract (#992) by @​earfman in google/gson#3059
• Reject non-ASCII digits in JsonTreeReader.nextInt/nextLong by @​dong0713 in google/gson#3063
• Include location in NumberFormatException thrown by JsonTreeReader by @​dong0713 in google/gson#3062
• Update JSON path after promoteNameToValue by @​tanvir-ux in google/gson#3098
• fix: reject unpaired surrogates in strict JSON by @​rksharma-owg in google/gson#3116
• Skip accessibility check in BoundField once it is known to have passed by @​nileshpatil6 in google/gson#3086
• Avoid quadratic removeIf in JsonArray list views by @​ishu7w in google/gson#3115
• Use the runtime type for a wildcard element type by @​HuzaifaChaudary in google/gson#3112

New Contributors

• @​daguimu made their first contribution in google/gson#3000
• @​anish-anantharaman made their first contribution in google/gson#3025
• @​adilburaksen made their first contribution in google/gson#3027
• @​ogolberg made their first contribution in google/gson#3034
• @​vasiliy-mikhailov made their first contribution in google/gson#3038
• @​mayokunyusuf made their first contribution in google/gson#3061
• @​arpitagarwal1301 made their first contribution in google/gson#3065
• @​anishesg made their first contribution in google/gson#3067
• @​earfman made their first contribution in google/gson#3059
• @​dong0713 made their first contribution in google/gson#3063
• @​nafisa1602 made their first contribution in google/gson#3049
• @​barakhub made their first contribution in google/gson#3102
• @​tanvir-ux made their first contribution in google/gson#3098
• @​rksharma-owg made their first contribution in google/gson#3116
• @​nileshpatil6 made their first contribution in google/gson#3086
• @​lllincoln made their first contribution in google/gson#3046
• @​Phhofm made their first contribution in google/gson#1532
• @​ishu7w made their first contribution in google/gson#3115
• @​HuzaifaChaudary made their first contribution in google/gson#3112

Full Changelog: google/gson@gson-parent-2.14.0...gson-parent-2.15.0

Commits

• fcd4169 [maven-release-plugin] prepare release gson-parent-2.15.0
• 828cbe0 Update protobuf-maven-plugin dependency. (#3153)
• 66dd98a Disable Spotless plugin before Java 21. (#3152)
• 094f500 Fix typo in comment (#3148)
• 881d2b5 Consistently use "Gson" instead of "GSON" as project name (#3150)
• e2292f9 Address a few static analysis findings. (#3141)
• 67427c4 Bump the github-actions group across 1 directory with 5 updates (#3133)
• 845664b Correct logic for BOM detection. (#3137)
• 216c41b Bump com.fasterxml.jackson.core:jackson-databind (#3136)
• 854c825 Simplify key removal in LegacyProtoTypeAdapterFactoryTest (#3124)
• Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-dependencies from 4.1.1 to 4.1.2

Release notes

Sourced from org.springframework.boot:spring-boot-dependencies's releases.

v4.1.2

⭐ New Features

• Add TWENTY_SEVEN to JavaVersion enum #51426

🐞 Bug Fixes

• OriginTrackedResource does not implement equals correctly #52267
• OriginTrackedPropertiesLoader drops properties whose name starts with # or ! #52265
• JWTs are rejected when issuer-uri is empty and jwk-set-uri is set #52260
• Package manifest attributes are missing for nested jars without directory entries #52258
• Logback ColorConverter unnecessarily parses its options for every log event #52228
• Empty system property in TestPropertyValues is cleared instead of being restored to its empty value #52208
• Graceful shutdown of Tomcat or Jetty may call back with REQUESTS_ACTIVE when stop is called immediately after shutDownGracefully on an idle server #52197
• NettyWebServer stop may hang when called immediately after shutDownGracefully #52196
• gRPC client 'grpc' load balancing fails to bind with a NullPointerException when no child policies are configured #52193
• Prevent gRPC client properties from overriding user customizations #52175
• MongoDB fails to connect when credentials contain a space #52168
• Authentication fails when password configured in spring.elasticsearch.uris contains a colon #52166
• Logging can be lost when a context is paused by the test context framework #52088
• Docker Compose support for MongoDB fails to connect when credentials contain a character that requires URL encoding #52084
• Jersey does not use the endpoint ObjectMapper when Actuator is running on a separate port #51982
• Fractions of a second are handled incorrectly when configuring gRPC service config durations #51957
• Configuration property descriptions may be lost when building incrementally with Gradle #51925
• BasicJsonParser mishandles escaped characters in nested lists and maps #51908
• Zero week value conversion fails with 'intValue cannot be extracted from WEEKS' exception #51894
• App fails to start when using DevTools and manually configuring JDBC or R2DBC without spring-boot-jdbc or spring-boot-r2dbc #51890
• Docker Compose support incorrectly recognizes MARIADB_ALLOW_EMPTY_PASSWORD instead of MARIADB_ALLOW_EMPTY_ROOT_PASSWORD #51888
• Auto-configured Kotlinx Serialization JSON codec customization is not applied #51877
• NullPointerException can be thrown when using uber jars due to a race condition in NestedJarFileResources #51745
• DevTools does not detect a reactive web environment #51730
• spring.http.clients.cookie-handling has no effect when using a reactive client backed by an HttpComponents connector #51724
• Connection fails when rabbitmq Docker Compose service is configured to use SSL #51667
• SBOM-related manifest attributes are missing from Maven-packaged wars #51651
• When server.reactive.session.cookie.same-site is not set, session cookies have no SameSite attribute #51639
• OAuth2 resource server ignores authorities-claim-delimiter when set on its own #51630
• developmentOnly and testAndDevelopmentOnly configurations do not specify any attributes causing potential resolution problems #51623
• In a reactive web application, Cloud Foundry security integration returns a 500 rather than a 503 when the cloud controller URL is unavailable #51614
• Layer temp file is not deleted when layer creation fails #51581
• Docker Compose integration for RabbitMQ skips credential fallbacks when an environment variable has no value #51578
• Some assertion messages name the wrong parameter #51574
• OAuth2ResourceServerProperties.Jwt has a setter that does not match its getter #51562
• jarmode tools commands print stacktrace instead of an error message #51547
• Docker Compose ProcessRunner can hang or leave orphan processes #51538
• NestedByteChannel.read(ByteBuffer) incorrectly returns 0 when buffer could not be filled #51520
• Customizer null checks in HTTP client builders assert the wrong attribute #51513
• SSL host config customizations may be lost during Tomcat initialization #51511
• SQL Server Docker Compose integration may duplicate the JDBC URL's encrypt parameter #51481
• WritableJson.toByteArray() may corrupt supplementary characters #51464
• SSL host config customizations are lost when reloading SSL bundles #51457

... (truncated)

Commits

• 634e6fd Release 4.1.2
• 6b43cf1 Upgrade to Spring WS 5.0.3
• a73dfad Upgrade to Spring Security 7.1.2
• 0485f1e Upgrade to Spring RESTDocs 4.0.2
• de2c11a Upgrade to Spring Pulsar 2.0.8
• 8d0359e Upgrade to Spring LDAP 4.1.2
• f22c6e6 Upgrade to Spring Kafka 4.1.2
• ed55709 Upgrade to Spring Integration 7.1.2
• 2e88a38 Upgrade to Spring HATEOAS 3.1.3
• 0d69ce5 Upgrade to Spring gRPC 1.1.2
• Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-maven-plugin from 4.1.1 to 4.1.2

Release notes

Sourced from org.springframework.boot:spring-boot-maven-plugin's releases.

v4.1.2

⭐ New Features

• Add TWENTY_SEVEN to JavaVersion enum #51426

🐞 Bug Fixes

• OriginTrackedResource does not implement equals correctly #52267
• OriginTrackedPropertiesLoader drops properties whose name starts with # or ! #52265
• JWTs are rejected when issuer-uri is empty and jwk-set-uri is set #52260
• Package manifest attributes are missing for nested jars without directory entries #52258
• Logback ColorConverter unnecessarily parses its options for every log event #52228
• Empty system property in TestPropertyValues is cleared instead of being restored to its empty value #52208
• Graceful shutdown of Tomcat or Jetty may call back with REQUESTS_ACTIVE when stop is called immediately after shutDownGracefully on an idle server #52197
• NettyWebServer stop may hang when called immediately after shutDownGracefully #52196
• gRPC client 'grpc' load balancing fails to bind with a NullPointerException when no child policies are configured #52193
• Prevent gRPC client properties from overriding user customizations #52175
• MongoDB fails to connect when credentials contain a space #52168
• Authentication fails when password configured in spring.elasticsearch.uris contains a colon #52166
• Logging can be lost when a context is paused by the test context framework #52088
• Docker Compose support for MongoDB fails to connect when credentials contain a character that requires URL encoding #52084
• Jersey does not use the endpoint ObjectMapper when Actuator is running on a separate port #51982
• Fractions of a second are handled incorrectly when configuring gRPC service config durations #51957
• Configuration property descriptions may be lost when building incrementally with Gradle #51925
• BasicJ...

  Description has been truncated