Skip to content

chore(deps): bump the maven-minor group across 1 directory with 28 updates - #669

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/maven-minor-87885c05c3
Closed

chore(deps): bump the maven-minor group across 1 directory with 28 updates#669
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/maven-minor-87885c05c3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the maven-minor group with 28 updates in the / directory:

Package From To
org.junit:junit-bom 6.1.2 6.1.3
org.apache.myfaces.core:myfaces-api 4.1.3 4.1.4
org.apache.myfaces.core:myfaces-impl 4.1.3 4.1.4
org.apache.myfaces.core:myfaces-impl 4.1.3 4.1.4
org.hibernate.validator:hibernate-validator 9.1.3.Final 9.1.4.Final
org.omnifaces:omnifaces 5.4.5 5.5.4
org.primefaces:primefaces 15.0.17 15.0.18
software.xdev:chartjs-java-model 3.0.2 3.1.0
com.twelvemonkeys.servlet:servlet 3.14.0 3.15.2
com.twelvemonkeys.imageio:imageio-bmp 3.14.0 3.15.2
com.twelvemonkeys.imageio:imageio-jpeg 3.14.0 3.15.2
com.twelvemonkeys.imageio:imageio-tiff 3.14.0 3.15.2
com.twelvemonkeys.imageio:imageio-hdr 3.14.0 3.15.2
com.twelvemonkeys.imageio:imageio-webp 3.14.0 3.15.2
com.twelvemonkeys.imageio:imageio-bmp 3.14.0 3.15.2
com.twelvemonkeys.imageio:imageio-jpeg 3.14.0 3.15.2
com.twelvemonkeys.imageio:imageio-tiff 3.14.0 3.15.2
com.twelvemonkeys.imageio:imageio-hdr 3.14.0 3.15.2
com.twelvemonkeys.imageio:imageio-webp 3.14.0 3.15.2
org.flywaydb:flyway-core 13.2.0 13.8.0
org.flywaydb:flyway-mysql 13.2.0 13.8.0
org.flywaydb:flyway-mysql 13.2.0 13.8.0
io.sentry:sentry-log4j2 8.52.0 8.58.0
com.github.ben-manes.caffeine:caffeine 3.2.4 3.3.0
com.google.guava:guava 33.6.0-jre 33.7.1-jre
org.jsoup:jsoup 1.23.1 1.23.2
org.mockito:mockito-core 5.23.0 5.24.0
org.mockito:mockito-junit-jupiter 5.23.0 5.24.0
org.mockito:mockito-junit-jupiter 5.23.0 5.24.0
com.h2database:h2 2.4.240 2.5.250
org.eclipse.jetty.ee11:jetty-ee11-cdi 12.1.12 12.1.13
org.eclipse.jetty.ee11:jetty-ee11-maven-plugin 12.1.12 12.1.13
org.apache.maven.plugins:maven-compiler-plugin 3.15.0 3.16.0
com.github.spotbugs:spotbugs-maven-plugin 4.10.3.0 4.10.4.1
org.apache.maven.plugins:maven-surefire-plugin 3.5.6 3.6.0
org.eclipse.jetty.ee11:jetty-ee11-maven-plugin 12.1.12 12.1.13
org.codehaus.mojo:versions-maven-plugin 2.21.0 2.22.0

Updates org.junit:junit-bom from 6.1.2 to 6.1.3

Release notes

Sourced from org.junit:junit-bom's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

Commits
  • f59f60d Release 6.1.3
  • cd8ec92 Finalize 6.1.3 release notes
  • c8729f2 Restore compatibility with GraalVM 25 (#5901)
  • ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
  • fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
  • 62afc02 Delay GraalVM plugin updates for 3 days
  • 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
  • f6bbfc5 Move GraalVM tests to separate test task (#5903)
  • e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
  • 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
  • Additional commits viewable in compare view

Updates org.apache.myfaces.core:myfaces-api from 4.1.3 to 4.1.4

Updates org.apache.myfaces.core:myfaces-impl from 4.1.3 to 4.1.4

Updates org.apache.myfaces.core:myfaces-impl from 4.1.3 to 4.1.4

Updates org.hibernate.validator:hibernate-validator from 9.1.3.Final to 9.1.4.Final

Release notes

Sourced from org.hibernate.validator:hibernate-validator's releases.

Release 9.1.4.Final

Hibernate Validator 9.1.4.Final released

We are pleased to announce the release of Hibernate Validator 9.1: 9.1.4.Final.

You can find the full list of 9.1.4.Final changes here.

What's new

  • See the website for requirements and compatibilities.
  • See the What's New guide for details about new features and capabilities.

Conclusion

For additional details, see:

Visit the website for details on getting in touch with us.

Changelog

Sourced from org.hibernate.validator:hibernate-validator's changelog.

9.1.4.Final (2026-09-20)

Full changelog

Bug

  • HV-2253 - ClassNotFoundException thrown when an EL implementation and OSGi are not on the class path

Improvement

  • HV-2243 - Bump joda-time to 2.14.3
  • HV-2242 - Update to OpenJFX to 17.0.20

Task

  • HV-2244 - Tune the content of javadoc jars to reduce the size of files published to Maven Central
Commits
  • 5504b0c [Jenkins release job] Preparing release 9.1.4.Final
  • 1306aab [Jenkins release job] changelog.md updated by release build 9.1.4.Final
  • 715cbdb [Jenkins release job] README.md updated by release build 9.1.4.Final
  • 84e8d2e HV-2253 When determining the Jakarta Expression Language implementation, igno...
  • f3002a3 [9.1] Bump org.codehaus.mojo:build-helper-maven-plugin
  • 971d85b [9.1] Bump the build-dependencies group with 3 updates
  • dcb1305 Tune the content of javadoc jars to reduce the size of files published to Mav...
  • d01ed37 [9.1] Bump version.org.apache.groovy from 5.0.7 to 5.0.8
  • 6023258 Bump joda-time to 2.14.3 HV-2243
  • 3db152e Update to OpenJFX to 17.0.20 HV-2242
  • Additional commits viewable in compare view

Updates org.omnifaces:omnifaces from 5.4.5 to 5.5.4

Commits

Updates org.primefaces:primefaces from 15.0.17 to 15.0.18

Release notes

Sourced from org.primefaces:primefaces's releases.

15.0.18

What's Changed

New Contributors

Full Changelog: primefaces/primefaces@v15.0.17...v15.0.18

Commits

Updates software.xdev:chartjs-java-model from 3.0.2 to 3.1.0

Commits

Updates com.twelvemonkeys.servlet:servlet from 3.14.0 to 3.15.2

Release notes

Sourced from com.twelvemonkeys.servlet:servlet's releases.

TwelveMonkeys ImageIO 3.15.2 release notes

This is a bug fix release.

What's Changed

Full Changelog: haraldk/TwelveMonkeys@twelvemonkeys-3.15.1...twelvemonkeys-3.15.2

TwelveMonkeys ImageIO 3.15.1 release notes

This is a bug fix release.

What's Changed

Full Changelog: haraldk/TwelveMonkeys@twelvemonkeys-3.15.0...twelvemonkeys-3.15.1

TwelveMonkeys ImageIO 3.15.0 release notes

This release finally fixes some long-standing WebP decoding issues, along with some TIFF CCITT/fax decoding issues and also adds stricter memory allocation guards to avoid OOME situations. More input validation in DDS, BMP, PCX, PICT and ThumbsDB formats, and some other general improvements.

What's Changed

New Contributors

Full Changelog: haraldk/TwelveMonkeys@twelvemonkeys-3.14.0...twelvemonkeys-3.15.0

Commits
  • 7ac79a7 [maven-release-plugin] prepare release twelvemonkeys-3.15.2
  • 52fecd2 #1346 PSD: Avoid infinite loop and other allocation issues (#1347)
  • f1b9677 #1342: ResampleOp: Added tests to show that both smaller and larger destinati...
  • 4cc825d #1342: ResampleOp: Include indexed type in tests
  • d06aaf6 #1342: ResampleOp: Keep alpha and image type consistent for null-destination
  • 3f75fdb Bump the codeql-action group in /.github/workflows with 4 updates
  • b42b25b Bump actions/setup-java from 6.0.0 to 6.0.1 in /.github/workflows
  • e595f4c [maven-release-plugin] prepare for next development iteration
  • b7e0a98 [maven-release-plugin] prepare release twelvemonkeys-3.15.1
  • 4b21208 Resetting versions
  • Additional commits viewable in compare view

Updates com.twelvemonkeys.imageio:imageio-bmp from 3.14.0 to 3.15.2

Updates com.twelvemonkeys.imageio:imageio-jpeg from 3.14.0 to 3.15.2

Updates com.twelvemonkeys.imageio:imageio-tiff from 3.14.0 to 3.15.2

Updates com.twelvemonkeys.imageio:imageio-hdr from 3.14.0 to 3.15.2

Updates com.twelvemonkeys.imageio:imageio-webp from 3.14.0 to 3.15.2

Updates com.twelvemonkeys.imageio:imageio-bmp from 3.14.0 to 3.15.2

Updates com.twelvemonkeys.imageio:imageio-jpeg from 3.14.0 to 3.15.2

Updates com.twelvemonkeys.imageio:imageio-tiff from 3.14.0 to 3.15.2

Updates com.twelvemonkeys.imageio:imageio-hdr from 3.14.0 to 3.15.2

Updates com.twelvemonkeys.imageio:imageio-webp from 3.14.0 to 3.15.2

Updates org.flywaydb:flyway-core from 13.2.0 to 13.8.0

Updates org.flywaydb:flyway-mysql from 13.2.0 to 13.8.0

Updates org.flywaydb:flyway-mysql from 13.2.0 to 13.8.0

Updates io.sentry:sentry-log4j2 from 8.52.0 to 8.58.0

Release notes

Sourced from io.sentry:sentry-log4j2's releases.

8.58.0

Features

  • Add LocalSentrySpan to sentry-compose so apps can provide a parent ISpan to a composable subtree and have nested SentryTraced spans attach to it ([#6112]getsentry/sentry-java#6112)
  • Add dataCollection, a fine-grained replacement for sendDefaultPii, for controlling data collected automatically by SDK integrations (#5759)

[!WARNING] sendDefaultPii will be removed in the next major SDK version. Migrate to dataCollection before upgrading.

  • Until then, when dataCollection is not configured, the SDK preserves the existing sendDefaultPii behavior.
  • Configuring any dataCollection option makes it the source of truth. sendDefaultPii is then ignored, and omitted dataCollection options use the defaults below.
  • The Logback appender is a compatibility exception. When an encoder is configured, sendDefaultPii=true continues to include the original message template and parameters. To opt in independently of sendDefaultPii, set <includeUnencodedMessage>true</includeUnencodedMessage> on the Sentry appender in logback.xml or logback-spring.xml.
  • Data explicitly supplied through APIs such as Sentry.setUser, scopes, event processors, or beforeSend is not affected.

To opt in to the documented dataCollection defaults without configuring an individual option:

Sentry.init(options -> options.getDataCollection().forceDataCollection());
Option Default Behavior
userInfo true Allows integrations to populate user identity and IP address information automatically.
cookies { mode: DENY_LIST, terms: [] } Collects cookies while filtering sensitive values.
httpHeaders.request { mode: DENY_LIST, terms: [] } Collects request headers while filtering sensitive values.
httpHeaders.response { mode: DENY_LIST, terms: [] } Collects response headers while filtering sensitive values.
httpBodies All supported body types Collects supported incoming and outgoing request and response bodies. An empty set disables body collection.
urlQueryParams { mode: DENY_LIST, terms: [] } Collects URL query parameters while filtering sensitive values.
graphql.document true Collects GraphQL documents.
graphql.variables true Collects GraphQL variables.
databaseQueryData true Allows collection of associated query data, such as bound parameters, write payloads, and results, where supported. Sanitized query statements and structural database metadata remain available.
filePaths true Allows file-system instrumentation to collect file and directory paths. File extensions and byte counts remain available when disabled.

Cookies, HTTP headers, and URL query parameters support three modes:

  • OFF: Do not collect the category.
  • DENY_LIST: Collect values except those matching the built-in sensitive deny-list or additional configured terms.
  • ALLOW_LIST: Only send plaintext values for matching terms. The built-in sensitive deny-list still applies.

Matching is case-insensitive and partial. The built-in sensitive deny-list contains auth, token, secret, password, passwd, pwd, key, jwt, bearer, sso, saml, csrf, xsrf, credentials, session, sid, and identity. Filtered values are replaced with "[Filtered]". Custom deny-list terms extend rather than replace this list.

Configure all HTTP body types, a custom cookie deny-list, a request-header allow-list, and disable URL query parameter and file path collection in an options callback:

Sentry.init(
    options -> {
      options
          .getDataCollection()
          .setHttpBodies(
              EnumSet.of(
</tr></table>

... (truncated)

Changelog

Sourced from io.sentry:sentry-log4j2's changelog.

8.58.0

Features

  • Add LocalSentrySpan to sentry-compose so apps can provide a parent ISpan to a composable subtree and have nested SentryTraced spans attach to it ([#6112]getsentry/sentry-java#6112)
  • Add dataCollection, a fine-grained replacement for sendDefaultPii, for controlling data collected automatically by SDK integrations (#5759)

[!WARNING] sendDefaultPii will be removed in the next major SDK version. Migrate to dataCollection before upgrading.

  • Until then, when dataCollection is not configured, the SDK preserves the existing sendDefaultPii behavior.
  • Configuring any dataCollection option makes it the source of truth. sendDefaultPii is then ignored, and omitted dataCollection options use the defaults below.
  • The Logback appender is a compatibility exception. When an encoder is configured, sendDefaultPii=true continues to include the original message template and parameters. To opt in independently of sendDefaultPii, set <includeUnencodedMessage>true</includeUnencodedMessage> on the Sentry appender in logback.xml or logback-spring.xml.
  • Data explicitly supplied through APIs such as Sentry.setUser, scopes, event processors, or beforeSend is not affected.

To opt in to the documented dataCollection defaults without configuring an individual option:

Sentry.init(options -> options.getDataCollection().forceDataCollection());
Option Default Behavior
userInfo true Allows integrations to populate user identity and IP address information automatically.
cookies { mode: DENY_LIST, terms: [] } Collects cookies while filtering sensitive values.
httpHeaders.request { mode: DENY_LIST, terms: [] } Collects request headers while filtering sensitive values.
httpHeaders.response { mode: DENY_LIST, terms: [] } Collects response headers while filtering sensitive values.
httpBodies All supported body types Collects supported incoming and outgoing request and response bodies. An empty set disables body collection.
urlQueryParams { mode: DENY_LIST, terms: [] } Collects URL query parameters while filtering sensitive values.
graphql.document true Collects GraphQL documents.
graphql.variables true Collects GraphQL variables.
databaseQueryData true Allows collection of associated query data, such as bound parameters, write payloads, and results, where supported. Sanitized query statements and structural database metadata remain available.
filePaths true Allows file-system instrumentation to collect file and directory paths. File extensions and byte counts remain available when disabled.

Cookies, HTTP headers, and URL query parameters support three modes:

  • OFF: Do not collect the category.
  • DENY_LIST: Collect values except those matching the built-in sensitive deny-list or additional configured terms.
  • ALLOW_LIST: Only send plaintext values for matching terms. The built-in sensitive deny-list still applies.

Matching is case-insensitive and partial. The built-in sensitive deny-list contains auth, token, secret, password, passwd, pwd, key, jwt, bearer, sso, saml, csrf, xsrf, credentials, session, sid, and identity. Filtered values are replaced with "[Filtered]". Custom deny-list terms extend rather than replace this list.

Configure all HTTP body types, a custom cookie deny-list, a request-header allow-list, and disable URL query parameter and file path collection in an options callback:

Sentry.init(
    options -> {
      options
          .getDataCollection()
          .setHttpBodies(
</tr></table>

... (truncated)

Commits
  • e319d59 release: 8.58.0
  • a067ff7 docs: Warn about sendDefaultPii removal (#6156)
  • 2028874 feat(core): Data Collection (#5759)
  • 386030d feat(android): Add MemoryLimiter sample (JAVA-687) (#6118)
  • 9fd9105 feat(compose): Introduce LocalSentrySpan (#6112)
  • 8f0dc10 fix(okhttp): keep the wrapped EventListener per Call (#6003)
  • 1511066 chore(deps): bump the github-actions group across 1 directory with 4 updates ...
  • 564f05e fix(core): Disable manifest URL caching when reading versions (JAVA-730) (#6124)
  • b4d1330 Merge remote-tracking branch 'remotes/origin/release/8.57.0'
  • f7b56ef release: 8.57.0
  • Additional commits viewable in compare view

Updates com.github.ben-manes.caffeine:caffeine from 3.2.4 to 3.3.0

Release notes

Sourced from com.github.ben-manes.caffeine:caffeine's releases.

3.3.0

  • Improved read performance by avoiding false sharing in the fast-path check
  • Improved adaptive climber for small caches and shifting workloads
  • Fixed various minor issues found using AI audits
  • Fixed over-aggressive refresh discard (#1970)
Commits
  • af86011 fix jcache audit triage
  • f063e56 Prevent overflow in snapshot durations
  • 5b6fbd9 Saturate the audit stillness counter
  • 48cb408 Read lazy cache views and policies once
  • 4978d18 Normalize JCache processor loader failures
  • c9038d8 Consume JCache iterator removals before listener failures
  • 0b0afd2 polish
  • c0edd00 restore coverage lost to recent fixes
  • 5283c96 make CLOCK-Pro's cold hand a setting
  • d15c205 make the bulk cache loaders serializable
  • Additional commits viewable in compare view

Updates com.google.guava:guava from 33.6.0-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

Javadoc

JDiff

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
</tr></table>

... (truncated)

Commits

Updates org.jsoup:jsoup from 1.23.1 to 1.23.2

Release notes

Sourced from org.jsoup:jsoup's releases.

jsoup 1.23.2

jsoup 1.23.2 is out now. This release focuses largely on bug fixes, specification correctness, and performance improvements.

It brings closer alignment with the HTML, XML, URL, and form submission specifications; improves XML and W3C DOM conversion; and makes HTTP workloads more efficient through streamed request bodies and broader JDK HttpClient reuse.

This version also includes new node insertion methods for Elements, and DOM mutations now reject operations that would create a cycle.

jsoup is a Java library for working with real-world HTML and XML. It provides a very convenient API for extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors.

Download jsoup now.

Improvements

  • Improved consecutive StreamParser.selectFirst() calls during progressive parsing, so later matches are returned with their parsed contents when earlier selections had left them as parser lookahead. E.g., given <title>One</title><p id=hit>Full</p><p>Next</p>, selecting title and then #hit now advances the partial lookahead and returns <p id="hit">Full</p>, rather than returning an empty <p id="hit"></p> before its content is parsed. The updated readiness tracking follows StreamParser's normal emission order across implicit HTML structure and parser recovery. #2551
  • Improved XML parser performance and memory use for documents with many nested namespace declarations by recording namespace changes within each element scope. #2556
  • Improved W3CDom conversion performance for documents with many nested namespace declarations. The W3C converter now uses the same optimized namespace tracking as the XML parser. #2559
  • Improved W3CDom XML conversion to retain processing instructions, comments outside the root element, and CDATA sections, which were previously dropped or converted to text. #2572
  • DOM mutation methods, including child insertion and replacement, now reject operations that would create a cycle, such as making a node its own child or moving an ancestor beneath a descendant. #2552
  • Added Elements#before(Node), after(Node), prepend(Node), and append(Node) to match the existing HTML string methods. #953
  • Large file-backed uploads through Connection.requestBodyStream(InputStream) now stream directly with the JDK HttpClient on Java 11+, rather than being loaded fully into memory first. #2575
  • Extended Java 11+ HTTP client reuse from requests sharing a Jsoup.newSession() to ordinary Jsoup.connect() calls, reducing transport thread and connection setup churn under sustained request loads. Sessions with custom authentication or SSL contexts continue to use their own client. #2584

Changes

  • Aligned the XML parser stack depth and lookups to the configured maximum, which now defaults to 512 for both HTML and XML. Use Parser#setMaxDepth(int) to configure. #2570

Bug Fixes

  • Fixed W3CDom namespace conversion in several cases: #2559
    • Namespace declarations and prefixed attributes now carry the correct namespace URI, so namespace-aware DOM lookups work as expected.
    • Attributes added after parsing, or included through subtree conversion, now use inherited prefix declarations.
    • Namespace declarations now apply regardless of attribute order, and an empty declaration shadows an inherited binding only within its scope.
    • With namespace awareness disabled, inherited and undeclared prefixes now receive the declarations needed for XML serialization.
    • Valid HTML names that are not XML QNames, such as a:b:c, are normalized. Attributes that still cannot be represented are skipped, and unrepresentable elements no longer change the surrounding tree.
  • Fixed W3CDom conversion of programmatically created or renamed elements whose names can be represented in a jsoup HTML DOM but are not valid XML names, such as 1abc. These names are now normalized (e.g. _1abc) instead of causing a NullPointerException. #2560
  • Fixed XML doctype serialization when a system identifier contains a double quote, which could otherwise produce invalid XML. #2571
  • XML serialization now repairs element and attribute names that start with an invalid character, rather than outputting null elements or dropping attributes. For example, an attribute named 1a is written as _1a. Additional leading underscores keep repaired attribute names unique if they conflict with another attribute. #2573
  • Supplementary Unicode characters are now escaped correctly when serializing with non-UTF, non-ASCII output charsets such as ISO-8859-1. Previously, characters could be emitted unescaped when their low 16-bit value was representable by the configured charset, causing replacement or corruption when the output was encoded. #2578
  • Fixed the JDK HttpClient implementation to accept responses missing a Content-Type header, matching the HttpURLConnection implementation. #2549
  • Fixed HTTP response content-type matching to handle media types case-insensitively and recognize structured +xml suffixes, including vendor-specific media types. #2550
  • HTTP request URL normalization now percent-encodes ASCII control characters, DEL, and embedded fragment delimiters, keeping normalized URLs valid for HTTP requests while preserving existing escapes. #2585
  • Corrected multipart form encoding to percent-escape CR and LF in field names and filenames, matching the HTML form submission specification. Multipart file content-types containing CR or LF are now rejected with a ValidationException. #2555
  • Aligned trailing comment placement with the HTML specification: comments after </body> remain children of the html element, while comments after </html> remain children of the document. #2557
  • When using the optional re2j regular expression engine, memory allocation errors caused by complex selector patterns at match time are now normalized to a ValidationException with a Pattern complexity error message.
  • Fixed parsing of malformed SVG and MathML content so that breakout HTML tags are placed according to the HTML specification. #2562
  • Fixed deeply nested malformed HTML parsing that could lose the document body because stack lookups did not align to the configured maximum parser depth. #2569
  • Aligned RCDATA, RAWTEXT, and script-data parsing with the HTML specification: malformed end tags no longer consume following markup, unclosed title/textarea content stays text through EOF, and custom text tags match exact names. #2577
  • Improved URL validation during HTTP/HTTPS URL resolution and cleaning; resolved URLs without a host are now rejected instead of being accepted based only on their scheme prefix, aligning to RFC 9110. Valid relative links and non-HTTP(S) schemes are unchanged. #2579
  • Redirects with malformed single-slash HTTP locations now use standard URL resolution to align with browsers. #2580
  • Template fragment parsing now handles unmatched </template> tags without throwing a ValidationException. #2581
  • Improved source tracking for adopted formatting elements and malformed markup ending at EOF. #2582

... (truncated)

Changelog

Sourced from org.jsoup:jsoup's changelog.

1.23.2 (2026-Aug-26)

Improvements

  • Improved consecutive StreamParser.selectFirst(...) calls during progressive parsing, so later matches are returned with their parsed contents when earlier selections had left them as parser lookahead. E.g., given <title>One</title><p id=hit>Full</p><p>Next</p>, selecting title and then #hit now advances the partial lookahead and returns <p id="hit">Full</p>, rather than returning an empty <p id="hit"></p> before its content is parsed. The updated readiness tracking follows StreamParser's normal emission order across implicit HTML structure and parser recovery. #2551
  • Improved XML parser performance and memory use for documents with many nested namespace declarations by recording namespace changes within each element scope. #2556
  • Improved W3CDom conversion performance for documents with many nested namespace declarations. The W3C converter now uses the same optimized namespace tracking as the XML parser. #2559
  • Improved W3CDom XML conversion to retain processing instructions, comments outside the root element, and CDATA sections, which were previously dropped or converted to text. #2572
  • DOM mutation methods, including child insertion and replacement, now reject operations that would create a cycle, such as making a node its own child or moving an ancestor beneath a descendant. #2552
  • Added Elements#before(Node), after(Node), prepend(Node), and append(Node) to match the existing HTML string methods. #953
  • Large file-backed uploads through Connection.requestBodyStream(InputStream) now stream directly with the JDK HttpClient on Java 11+, rather than being loaded fully into memory first. #2575
  • Extended Java 11+ HTTP client reuse from requests sharing a Jsoup.newSession() to ordinary Jsoup.connect(...) calls, reducing transport thread and connection setup churn under sustained request loads. Sessions with custom authentication or SSL contexts continue to use their own client. #2584

Changes

  • Aligned the XML parser stack depth and lookups to the configured maximum, which now defaults to 512 for both HTML and XML. Use Parser#setMaxDepth(int) to configure. #2570

Bug Fixes

  • Fixed W3CDom namespace conversion in several cases: #2559
    • Namespace declarations and prefixed attributes now carry the correct namespace URI, so namespace-aware DOM lookups work as expected.
    • Attributes added after parsing, or included through subtree conversion, now use inherited prefix declarations.
    • Namespace declarations now apply regardless of attribute order, and an empty declaration shadows an inherited binding only within its scope.
    • With namespace awareness disabled, inherited and undeclared prefixes now receive the declarations needed for XML serialization.
    • Valid HTML names that are not XML QNames, such as a:b:c, are normalized. Attributes that still cannot be represented are skipped, and unrepresentable elements no longer change the surrounding tree.
  • Fixed W3CDom conversion of programmatically created or renamed elements whose names can be represented in a jsoup HTML DOM but are not valid XML names, such as 1abc. These names are now normalized (e.g. _1abc) instead of causing a NullPointerException. #2560
  • Fixed XML doctype serialization when a system identifier contains a double quote, which could otherwise produce invalid XML. #2571
  • XML serialization now repairs element and attribute names that start with an invalid character, rather than outputting null elements or dropping attributes. For example, an attribute named 1a is written as _1a. Additional leading underscores keep repaired attribute names unique if they conflict with anot...

    Description has been truncated

@dependabot
chore(deps): bump the maven-minor group across 1 directory with 28 up…
dc78066 
…dates

Bumps the maven-minor group with 28 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [org.junit:junit-bom](https://github.com/junit-team/junit-framework) | `6.1.2` | `6.1.3` |
| org.apache.myfaces.core:myfaces-api | `4.1.3` | `4.1.4` |
| org.apache.myfaces.core:myfaces-impl | `4.1.3` | `4.1.4` |
| org.apache.myfaces.core:myfaces-impl | `4.1.3` | `4.1.4` |
| [org.hibernate.validator:hibernate-validator](https://github.com/hibernate/hibernate-validator) | `9.1.3.Final` | `9.1.4.Final` |
| [org.omnifaces:omnifaces](https://github.com/omnifaces/omnifaces) | `5.4.5` | `5.5.4` |
| [org.primefaces:primefaces](https://github.com/primefaces/primefaces) | `15.0.17` | `15.0.18` |
| [software.xdev:chartjs-java-model](https://github.com/xdev-software/template-placeholder) | `3.0.2` | `3.1.0` |
| [com.twelvemonkeys.servlet:servlet](https://github.com/haraldk/TwelveMonkeys) | `3.14.0` | `3.15.2` |
| com.twelvemonkeys.imageio:imageio-bmp | `3.14.0` | `3.15.2` |
| com.twelvemonkeys.imageio:imageio-jpeg | `3.14.0` | `3.15.2` |
| com.twelvemonkeys.imageio:imageio-tiff | `3.14.0` | `3.15.2` |
| com.twelvemonkeys.imageio:imageio-hdr | `3.14.0` | `3.15.2` |
| com.twelvemonkeys.imageio:imageio-webp | `3.14.0` | `3.15.2` |
| com.twelvemonkeys.imageio:imageio-bmp | `3.14.0` | `3.15.2` |
| com.twelvemonkeys.imageio:imageio-jpeg | `3.14.0` | `3.15.2` |
| com.twelvemonkeys.imageio:imageio-tiff | `3.14.0` | `3.15.2` |
| com.twelvemonkeys.imageio:imageio-hdr | `3.14.0` | `3.15.2` |
| com.twelvemonkeys.imageio:imageio-webp | `3.14.0` | `3.15.2` |
| org.flywaydb:flyway-core | `13.2.0` | `13.8.0` |
| org.flywaydb:flyway-mysql | `13.2.0` | `13.8.0` |
| org.flywaydb:flyway-mysql | `13.2.0` | `13.8.0` |
| [io.sentry:sentry-log4j2](https://github.com/getsentry/sentry-java) | `8.52.0` | `8.58.0` |
| [com.github.ben-manes.caffeine:caffeine](https://github.com/ben-manes/caffeine) | `3.2.4` | `3.3.0` |
| [com.google.guava:guava](https://github.com/google/guava) | `33.6.0-jre` | `33.7.1-jre` |
| [org.jsoup:jsoup](https://github.com/jhy/jsoup) | `1.23.1` | `1.23.2` |
| [org.mockito:mockito-core](https://github.com/mockito/mockito) | `5.23.0` | `5.24.0` |
| [org.mockito:mockito-junit-jupiter](https://github.com/mockito/mockito) | `5.23.0` | `5.24.0` |
| [org.mockito:mockito-junit-jupiter](https://github.com/mockito/mockito) | `5.23.0` | `5.24.0` |
| [com.h2database:h2](https://github.com/h2database/h2database) | `2.4.240` | `2.5.250` |
| org.eclipse.jetty.ee11:jetty-ee11-cdi | `12.1.12` | `12.1.13` |
| org.eclipse.jetty.ee11:jetty-ee11-maven-plugin | `12.1.12` | `12.1.13` |
| [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) | `3.15.0` | `3.16.0` |
| [com.github.spotbugs:spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) | `4.10.3.0` | `4.10.4.1` |
| [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.5.6` | `3.6.0` |
| org.eclipse.jetty.ee11:jetty-ee11-maven-plugin | `12.1.12` | `12.1.13` |
| [org.codehaus.mojo:versions-maven-plugin](https://github.com/mojohaus/versions) | `2.21.0` | `2.22.0` |



Updates `org.junit:junit-bom` from 6.1.2 to 6.1.3
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](junit-team/junit-framework@r6.1.2...r6.1.3)

Updates `org.apache.myfaces.core:myfaces-api` from 4.1.3 to 4.1.4

Updates `org.apache.myfaces.core:myfaces-impl` from 4.1.3 to 4.1.4

Updates `org.apache.myfaces.core:myfaces-impl` from 4.1.3 to 4.1.4

Updates `org.hibernate.validator:hibernate-validator` from 9.1.3.Final to 9.1.4.Final
- [Release notes](https://github.com/hibernate/hibernate-validator/releases)
- [Changelog](https://github.com/hibernate/hibernate-validator/blob/9.1.4.Final/changelog.md)
- [Commits](hibernate/hibernate-validator@9.1.3.Final...9.1.4.Final)

Updates `org.omnifaces:omnifaces` from 5.4.5 to 5.5.4
- [Commits](omnifaces/omnifaces@5.4.5...5.5.4)

Updates `org.primefaces:primefaces` from 15.0.17 to 15.0.18
- [Release notes](https://github.com/primefaces/primefaces/releases)
- [Commits](primefaces/primefaces@v15.0.17...v15.0.18)

Updates `software.xdev:chartjs-java-model` from 3.0.2 to 3.1.0
- [Commits](https://github.com/xdev-software/template-placeholder/commits)

Updates `com.twelvemonkeys.servlet:servlet` from 3.14.0 to 3.15.2
- [Release notes](https://github.com/haraldk/TwelveMonkeys/releases)
- [Commits](haraldk/TwelveMonkeys@twelvemonkeys-3.14.0...twelvemonkeys-3.15.2)

Updates `com.twelvemonkeys.imageio:imageio-bmp` from 3.14.0 to 3.15.2

Updates `com.twelvemonkeys.imageio:imageio-jpeg` from 3.14.0 to 3.15.2

Updates `com.twelvemonkeys.imageio:imageio-tiff` from 3.14.0 to 3.15.2

Updates `com.twelvemonkeys.imageio:imageio-hdr` from 3.14.0 to 3.15.2

Updates `com.twelvemonkeys.imageio:imageio-webp` from 3.14.0 to 3.15.2

Updates `com.twelvemonkeys.imageio:imageio-bmp` from 3.14.0 to 3.15.2

Updates `com.twelvemonkeys.imageio:imageio-jpeg` from 3.14.0 to 3.15.2

Updates `com.twelvemonkeys.imageio:imageio-tiff` from 3.14.0 to 3.15.2

Updates `com.twelvemonkeys.imageio:imageio-hdr` from 3.14.0 to 3.15.2

Updates `com.twelvemonkeys.imageio:imageio-webp` from 3.14.0 to 3.15.2

Updates `org.flywaydb:flyway-core` from 13.2.0 to 13.8.0

Updates `org.flywaydb:flyway-mysql` from 13.2.0 to 13.8.0

Updates `org.flywaydb:flyway-mysql` from 13.2.0 to 13.8.0

Updates `io.sentry:sentry-log4j2` from 8.52.0 to 8.58.0
- [Release notes](https://github.com/getsentry/sentry-java/releases)
- [Changelog](https://github.com/getsentry/sentry-java/blob/main/CHANGELOG.md)
- [Commits](getsentry/sentry-java@8.52.0...8.58.0)

Updates `com.github.ben-manes.caffeine:caffeine` from 3.2.4 to 3.3.0
- [Release notes](https://github.com/ben-manes/caffeine/releases)
- [Commits](ben-manes/caffeine@v3.2.4...v3.3.0)

Updates `com.google.guava:guava` from 33.6.0-jre to 33.7.1-jre
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

Updates `org.jsoup:jsoup` from 1.23.1 to 1.23.2
- [Release notes](https://github.com/jhy/jsoup/releases)
- [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES.md)
- [Commits](jhy/jsoup@jsoup-1.23.1...jsoup-1.23.2)

Updates `org.mockito:mockito-core` from 5.23.0 to 5.24.0
- [Release notes](https://github.com/mockito/mockito/releases)
- [Commits](mockito/mockito@v5.23.0...v5.24.0)

Updates `org.mockito:mockito-junit-jupiter` from 5.23.0 to 5.24.0
- [Release notes](https://github.com/mockito/mockito/releases)
- [Commits](mockito/mockito@v5.23.0...v5.24.0)

Updates `org.mockito:mockito-junit-jupiter` from 5.23.0 to 5.24.0
- [Release notes](https://github.com/mockito/mockito/releases)
- [Commits](mockito/mockito@v5.23.0...v5.24.0)

Updates `com.h2database:h2` from 2.4.240 to 2.5.250
- [Release notes](https://github.com/h2database/h2database/releases)
- [Commits](h2database/h2database@version-2.4.240...version-2.5.250)

Updates `org.eclipse.jetty.ee11:jetty-ee11-cdi` from 12.1.12 to 12.1.13

Updates `org.eclipse.jetty.ee11:jetty-ee11-maven-plugin` from 12.1.12 to 12.1.13

Updates `org.apache.maven.plugins:maven-compiler-plugin` from 3.15.0 to 3.16.0
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.15.0...maven-compiler-plugin-3.16.0)

Updates `com.github.spotbugs:spotbugs-maven-plugin` from 4.10.3.0 to 4.10.4.1
- [Release notes](https://github.com/spotbugs/spotbugs-maven-plugin/releases)
- [Commits](spotbugs/spotbugs-maven-plugin@spotbugs-maven-plugin-4.10.3.0...spotbugs-maven-plugin-4.10.4.1)

Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.5.6 to 3.6.0
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.5.6...surefire-3.6.0)

Updates `org.eclipse.jetty.ee11:jetty-ee11-maven-plugin` from 12.1.12 to 12.1.13

Updates `org.codehaus.mojo:versions-maven-plugin` from 2.21.0 to 2.22.0
- [Release notes](https://github.com/mojohaus/versions/releases)
- [Changelog](https://github.com/mojohaus/versions/blob/master/ReleaseNotes.md)
- [Commits](mojohaus/versions@2.21.0...2.22.0)

---
updated-dependencies:
- dependency-name: org.junit:junit-bom
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: org.apache.myfaces.core:myfaces-api
  dependency-version: 4.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: org.apache.myfaces.core:myfaces-impl
  dependency-version: 4.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: org.apache.myfaces.core:myfaces-impl
  dependency-version: 4.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: org.hibernate.validator:hibernate-validator
  dependency-version: 9.1.4.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: org.omnifaces:omnifaces
  dependency-version: 5.5.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: org.primefaces:primefaces
  dependency-version: 15.0.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: software.xdev:chartjs-java-model
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.servlet:servlet
  dependency-version: 3.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-bmp
  dependency-version: 3.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-jpeg
  dependency-version: 3.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-tiff
  dependency-version: 3.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-hdr
  dependency-version: 3.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-webp
  dependency-version: 3.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-bmp
  dependency-version: 3.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-jpeg
  dependency-version: 3.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-tiff
  dependency-version: 3.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-hdr
  dependency-version: 3.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-webp
  dependency-version: 3.15.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: org.flywaydb:flyway-core
  dependency-version: 13.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: org.flywaydb:flyway-mysql
  dependency-version: 13.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: org.flywaydb:flyway-mysql
  dependency-version: 13.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: io.sentry:sentry-log4j2
  dependency-version: 8.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.github.ben-manes.caffeine:caffeine
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.google.guava:guava
  dependency-version: 33.7.1-jre
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: org.jsoup:jsoup
  dependency-version: 1.23.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: org.mockito:mockito-core
  dependency-version: 5.24.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: org.mockito:mockito-junit-jupiter
  dependency-version: 5.24.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: org.mockito:mockito-junit-jupiter
  dependency-version: 5.24.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.h2database:h2
  dependency-version: 2.5.250
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: org.eclipse.jetty.ee11:jetty-ee11-cdi
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: org.eclipse.jetty.ee11:jetty-ee11-maven-plugin
  dependency-version: 12.1.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-version: 3.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.github.spotbugs:spotbugs-maven-plugin
  dependency-version: 4.10.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-version: 3.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: org.eclipse.jetty.ee11:jetty-ee11-maven-plugin
  dependency-version: 12.1.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: org.codehaus.mojo:versions-maven-plugin
  dependency-version: 2.22.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 28, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 3, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 3, 2026
@dependabot
dependabot Bot deleted the dependabot/maven/maven-minor-87885c05c3 branch October 3, 2026 12:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants