fix(deps): update combined - minor and patch

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@actions/github (source)	6.0.0 → 6.0.1
fast-xml-parser	5.8.0 → 5.11.2
jose	6.0.10 → 6.2.12
ruff (source, changelog)	==0.6.9 → ==0.17.0
io.netty:netty-resolver-dns-native-macos (source)	4.1.119.Final → 4.2.19.Final
org.jacoco:jacoco-maven-plugin (source)	0.8.12 → 0.8.15
org.testcontainers:mssqlserver (source)	1.20.6 → 1.21.4
com.azure.spring:spring-cloud-azure-dependencies (source)	5.21.0 → 5.25.0
net.logstash.logback:logstash-logback-encoder	8.0 → 8.1
org.jetbrains.kotlin:kotlin-maven-allopen (source)	2.1.20 → 2.4.21
org.jetbrains.kotlin:kotlin-maven-plugin (source)	2.1.20 → 2.4.21
org.springframework.boot:spring-boot-starter-parent (source)	3.4.4 → 3.5.16

---

Release Notes

actions/toolkit (@​actions/github)

v6.0.1

• Dependency updates #​2043
• Add context.runAttempt #​1588

NaturalIntelligence/fast-xml-parser (fast-xml-parser)

v5.11.2

Compare Source

What's Changed

• fix: decode Uint8Array XML input as UTF-8 by @​emme1t in #​875
• fix: type EntityDecoderOptions.setXmlVersion's version as a number by @​YevheniiKotyrlo in #​880

New Contributors

• @​emme1t made their first contribution in #​875
• @​YevheniiKotyrlo made their first contribution in #​880

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.1...v5.11.2

v5.11.1

Compare Source

What's Changed

• Bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​858
• Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by @​dependabot[bot] in #​856
• Bump actions/setup-node from 6.4.0 to 7.0.0 by @​dependabot[bot] in #​854
• docs: fix two 404 documentation links by @​rajanpanth in #​862

New Contributors

• @​rajanpanth made their first contribution in #​862

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.0...v5.11.1

v5.11.0

Compare Source

What's Changed

• add support for endIndex in node metadata (5.x edition) by @​Wain-PC in #​850
• fix: don't crash on a closing tag with no matching opening tag by @​hdimer in #​861

New Contributors

• @​Wain-PC made their first contribution in #​850
• @​hdimer made their first contribution in #​861

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.1...v5.11.0

v5.10.1

Compare Source

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.0...v5.10.1

v5.10.0

Compare Source

What's Changed

• Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​849
• Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @​dependabot[bot] in #​848

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.3...v5.10.0

v5.9.3

Compare Source

What's Changed

• Harden GitHub Actions workflows by @​martincostello in #​841
• GitHub Actions workflow fixes by @​martincostello in #​844

New Contributors

• @​martincostello made their first contribution in #​841

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.2...v5.9.3

v5.9.2

Compare Source

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.1...v5.9.2

v5.9.1

Compare Source

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.0...v5.9.1

v5.9.0: update strnum, use is-unsafe

Compare Source

• update strnum to 2.3.0
  • you can set hex, binary, enotation, infinity, unicode
• validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

panva/jose (jose)

v6.2.12

Compare Source

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Compare Source

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

v6.2.10

Compare Source

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

v6.2.9

Compare Source

Fixes

• reject a JWE whose generated Key Management Parameters collide (6ed19a6)
• types: undeprecate PBES2 p2c parameter (33bf832)

v6.2.8

Compare Source

Fixes

• enforce a single recipient when decrypting dir and ECDH-ES (505c383)
• reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

• index the JWS and JWE registries without a wrapper (925f3bb)
• name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Compare Source

Fixes

• require own JOSE properties for presence checks (90ab09c)

Refactor

• reduce bundle size (767d7f1)

v6.2.6

Compare Source

Fixes

• types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Compare Source

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #​879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

• correct subpaths and API documentation (2daec38)
• document consumer-supplied type parameters (9e9f66c)
• stop claiming the JWK "use" parameter is used during import (47a07b2)
• update CHANGELOG.md (fc51bf5)

Refactor

• assert key shape and type from the entry (971057e)
• avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
• correct swapped JWE unprotected header type error messages (894c498)
• describe each JWS algorithm once (7375028)
• discriminate a key once (0b59a69)
• fold single-consumer modules into their consumers (c2f0ca3)
• generate and import keys from the entry (da69b68)
• keep JWE out of the JWKS and embedded-JWK paths (241dd48)
• keep JWS and JWE out of each other's bundles (2a98564)
• parse a Protected Header in one place (30f72af)
• resolve the content encryption algorithm once (98b50ab)
• tighten key property checks (fe0dc3b)
• types: add discriminated JOSE error types (f7f764e)
• types: add JOSE identifier unions and JWK narrowing (2a20f49)
• types: improve key and result inference (cb25e77)
• types: trim published declaration comments (544f179)
• unify base64 decode errors (3a91833)
• validate each token once rather than once per layer (bbdae09)
• write each algorithm identifier once (73d83b5)

v6.2.4

Compare Source

Documentation

• update README.md and SECURITY.md to reflect passed EOL dates (2a84032)

Refactor

• normalize JWK export members from runtime quirks (386a3eb)

v6.2.3

Compare Source

Refactor

• cleanly reject invalid PBES2 p2c (0cdb851)

v6.2.2

Compare Source

Fixes

• reject failed decompression with JWEInvalid error (043b181)

v6.2.1

Compare Source

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

v6.2.0

Compare Source

Features

• re-introduce JWE "zip" (Compression Algorithm) Header Parameter support (b13b446)

Documentation

• clarify return of general jws and jwe (56682b4)

v6.1.3

Compare Source

Refactor

• avoid export * as for google closure's compiler sake (6303d98), closes #​832

v6.1.2

Compare Source

Refactor

• fallback to checking instanceof for CryptoKey (901cd90), closes #​765 #​803 #​821 #​827 #​828

v6.1.1

Compare Source

Documentation

• add link to RFC9864 (767edde)
• link to ML-DSA for JOSE (ed4252c)
• remove mention of Edge Runtime from the readme (94fdde7)
• update README.md (25098ef)

Refactor

• eliminate named exports in the source code (f6ae30d)
• expose setKeyManagementParameters also on a GeneralEncrypt Recipient (16e6b23)
• faster path for symmetric key checks (a44c2ec)
• improve en/decoding overheads (daee426)

v6.1.0

Compare Source

Features

• support AKP JWKs in calculateJwkThumbprint and calculateJwkThumbprintUri (cf2092a)
• support for the ML-DSA PQC Algorithm Identifiers (25ddce4)

v6.0.13

Compare Source

Refactor

• more readability in ecdhes.ts (84da9de)
• update asn1.ts helpers (b4f8fb3)

v6.0.12

Compare Source

Documentation

• add known caveats to customFetch (02e1f1e)
• mention the apu/apv parameter names in setKeyManagementParameters (6274d5a)
• update compact setKeyManagementParameters (2f44381)
• use GitHub Flavored Markdown for notes and warnings (f6b4ffc)

Refactor

• createPublicKey is not a constructor (61ded78)
• update asn1.ts helper functions (b2b611c)

v6.0.11

Compare Source

Fixes

• typ checking edge-cases when it contains a slash (/) character (31e4baf)

astral-sh/ruff (ruff)

v0.17.0

Compare Source

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed.
macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows
executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables
verification of the release publisher and binary integrity, supports publisher-based allowlisting,
and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#​28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through
  target-version or
  requires-python. When
  checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15
  instead of 3.14.

• Update the default rule set (#​28786)

  Several of the flake8-datetimez rules
  (DTZ001,
  DTZ005,
  DTZ006,
  DTZ007,
  DTZ011,
  DTZ012, and
  DTZ901) are no longer enabled by default,
  while undefined-local-with-nested-import-star-usage
  (F406), which corresponds to a syntax error, is now enabled by default.

• Update Rust crate quick-junit to 0.8.0 (#​27295)

  JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and
  includes a skipped attribute on the root <testsuites> element.

• [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#​28790)

• Support Unicode dummy variable names (#​28722)

  The default lint.dummy-variable-rgx
  now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

• Update to Unicode 17 (#​21229, #​28784)

  Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

• Always show unsafe and display-only fixes in the CLI (#​27810)

  The default full output format now shows unsafe fixes and suggestions requiring manual review,
  regardless of the unsafe-fixes setting.
  Actually applying unsafe fixes still requires explicit opt-in.

• Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

  The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and
  linux-ppc64le platforms, and now includes shell completions. However, no longer depending on
  Python means that python -m ruff and import ruff will no longer work. Use ruff directly from
  PATH instead. PyPI installations and those from the standalone installer are unaffected.

• Remove support for ruff-lsp (#​28750)

  Support for ruff-lsp, the legacy Python language server deprecated in Ruff
  v0.9.5, has been removed. The Ruff VS Code
  extension now always uses the native language server; ruff.nativeServer is deprecated and
  ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

• lazy-import-mismatch (TID254)
• lazy-import-immediately-resolved
  (TID255)
• os-path-commonprefix (RUF071)

The following behaviors have been stabilized:

• The formatter, unsorted-imports (I001),
  line-too-long (E501), and
  doc-line-too-long (W505) now
  consistently ignore trailing pragma comments when computing line length. This resolved several
  bugs involving interactions between these rules
  (#​27313) but may also cause existing imports to be
  reformatted and was thus classified as a breaking change.

Preview features

• [flake8-bugbear] Report the method name and a more precise range (B005) (#​27050)
• [refurb] Mark fix unsafe and move to suspicious (FURB152) (#​28405)
• [ruff] Allow docstrings in strict mode (RUF067) (#​28679)

Bug fixes

• [flake8-builtins] Expand checks in class scopes (A001) (#​29076)
• [flake8-self] Allow private access on object.__new__(cls) instances (SLF001) (#​29001)
• [flake8-tidy-imports] Skip lazy-import-mismatch in stubs (TID254) (#​29095)
• [flake8-type-checking] Add the notion of runtime-ambiguous references (#​26508)
• [flake8-type-checking] Never flag annotations in function scopes (#​29183)
• [pyflakes] Mark the fix as unsafe when it creates a docstring (F541) (#​28258)
• [pylint] Preserve trailing comments in useless-return fix (PLR1711) (#​29180)
• [ruff] Avoid false positive when pytest.raises is used in a with statement (RUF061) (#​28186)

Rule changes

• [pyupgrade] Suggest typing.TypeForm on Python 3.15 (UP035) (#​29084)

Contributors

• @​DeviousCardi
• @​hugehoo
• @​nekomario28
• @​Daverball
• @​Viicos
• @​DebadityaHait
• @​saberoueslati
• @​baltasarblanco
• @​yxshee
• @​lognd
• @​dor-sr

v0.16.10

Compare Source

Release Notes

Released on 2026-10-01.

Preview features

• Add a migration guide for categories (#​28087)
• [pyupgrade] Add rule for context manager iterator annotations (UP052) (#​29000)

Performance

• Reduce memory used by diagnostics (#​28951)

Server

• Avoid running uv format in untrusted workspaces (#​28873)

Documentation

• Fix links to moved changelog sections and renamed mdtests (#​28941)
• Add Python 3.15 as a supported version (#​28907)
• Add ty as a type checker example (#​28906)

Other changes

• Update Rust toolchain to 1.99 and MSRV to 1.97 (#​29047)

Contributors

• @​ntBre
• @​spaceone
• @​HardMax71
• @​charliermarsh

Install ruff 0.16.10

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.ps1 | iex"

Download ruff 0.16.10

File	Platform	Checksum
ruff-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
ruff-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
ruff-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
ruff-i686-pc-windows-msvc.zip	x86 Windows	checksum
ruff-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
ruff-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
ruff-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
ruff-powerpc64-unknown-linux-gnu.tar.gz	PPC64 Linux	checksum
ruff-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
ruff-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
ruff-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
ruff-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
ruff-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
ruff-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
ruff-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
ruff-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
ruff-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
ruff-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/ruff

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v0.16.9

Compare Source

Release Notes

Released on 2026-09-24.

Preview features

• [ruff] Avoid false positives for overloaded division (RUF069) (#​28309)

Bug fixes

• [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#​28776)
• [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#​28767)

Rule changes

• Update LibCST-based fixes for Python 3.15 (#​28616)
• [flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#​28542)

Documentation

• Fix horizontal overflow on the rules documentation page (#​28699)
• Update rules table with category information (#​28651)
• [flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#​28334)
• [flake8-bugbear] Document type-checker interaction (B010) (#​28509)
• [flake8-comprehensions] Document map/generator exception behavio

[!IMPORTANT]
✂ PR body was truncated to here.