Skip to content

build(deps): bump the dependencies group with 26 updates - #3998

Merged
jknack merged 1 commit into
mainfrom
dependabot/maven/dependencies-73595e8613
Aug 24, 2026
Merged

build(deps): bump the dependencies group with 26 updates#3998
jknack merged 1 commit into
mainfrom
dependabot/maven/dependencies-73595e8613

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 26 updates:

Package From To
com.fasterxml.jackson:jackson-bom 2.22.1 2.22.2
tools.jackson:jackson-bom 3.2.1 3.2.2
io.modelcontextprotocol.sdk:mcp-bom 2.0.0 2.0.1
ch.qos.logback:logback-classic 1.6.2 1.6.3
io.swagger.core.v3:swagger-annotations 2.2.53 2.2.54
io.swagger.core.v3:swagger-models 2.2.53 2.2.54
io.swagger.parser.v3:swagger-parser 2.1.46 2.1.47
io.ebean:ebean 19.4.0 19.5.0
io.ebean:ebean-querybean 19.4.0 19.5.0
io.ebean:querybean-generator 19.4.0 19.5.0
io.ebean:ebean-test 19.4.0 19.5.0
com.squareup.okhttp3:okhttp-jvm 5.4.0 5.5.0
com.squareup.okhttp3:okhttp-sse 5.4.0 5.5.0
com.squareup.okhttp3:okhttp-tls 5.4.0 5.5.0
com.google.guava:guava 33.6.0-jre 33.7.1-jre
io.lettuce:lettuce-core 7.6.0.RELEASE 7.7.0.RELEASE
org.codehaus.plexus:plexus-utils 4.0.3 4.1.0
de.skuzzle.enforcer:restrict-imports-enforcer-rule 3.0.0 3.0.1
com.diffplug.spotless:spotless-maven-plugin 3.9.0 3.10.0
com.puppycrawl.tools:checkstyle 13.10.0 14.0.0
net.bytebuddy:byte-buddy 1.18.11 1.18.12
dev.langchain4j:langchain4j-bom 1.18.1 1.19.0
io.github.classgraph:classgraph 4.8.192 4.8.193
io.projectreactor:reactor-core 3.8.6 3.8.7
software.amazon.awssdk:bom 2.53.0 2.54.1
io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha 2.30.0-alpha 2.31.0-alpha

Updates com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2

Commits
  • 062d76d [maven-release-plugin] prepare release jackson-bom-2.22.2
  • dcf18f7 Prep for 2.22.2 release
  • 9688c7b Merge branch '2.21' into 2.22
  • 7796a7d Merge branch '2.20' into 2.21
  • d3cd7fc Merge branch '2.19' into 2.20
  • 7a28068 Merge branch '2.18' into 2.19
  • 51eb465 Post-release dep version bump
  • 34ff5e8 [maven-release-plugin] prepare for next development iteration
  • 0b44a45 [maven-release-plugin] prepare release jackson-bom-2.18.10
  • 691ec93 Prep for 2.18.10 release
  • Additional commits viewable in compare view

Updates tools.jackson:jackson-bom from 3.2.1 to 3.2.2

Commits
  • 719429d [maven-release-plugin] prepare release jackson-bom-3.2.2
  • d0b9877 Prep for 3.2.2 release
  • e32f526 Merge branch '3.1' into 3.2
  • 113f6a1 Post-release dep version bump
  • 46176f6 [maven-release-plugin] prepare for next development iteration
  • 8b4a513 [maven-release-plugin] prepare release jackson-bom-3.1.6
  • adeda6f Prep for 3.1.6 release
  • c3a4deb Merge branch '3.1' into 3.2
  • 3c74470 Merge branch '2.x' into 3.1
  • 06416ba Merge pull request #129 from FasterXML/tatu/2.23/woodstox-7.2.2
  • Additional commits viewable in compare view

Updates io.modelcontextprotocol.sdk:mcp-bom from 2.0.0 to 2.0.1

Release notes

Sourced from io.modelcontextprotocol.sdk:mcp-bom's releases.

v2.0.1

What's Changed

Depedency updates

New Contributors

Full Changelog: modelcontextprotocol/java-sdk@v2.0.0...v2.0.1

Changelog

Sourced from io.modelcontextprotocol.sdk:mcp-bom's changelog.

2.0.1 — 2026-08-19

  • Bound STDIO and HTTP client/server reads to a configurable maximum size

Full notes: v2.0.1 release

Commits

Updates ch.qos.logback:logback-classic from 1.6.2 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

  • In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

  • Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

  • The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

  • ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

  • Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

  • The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

-- Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

Commits
  • e8e824d prepare release 1.6.3
  • 761821b MDCBasedDiscriminator has a gated warning mechanism
  • 53ed122 update copyright year
  • c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
  • b5aa931 added BatchedSimpleInvocationGate
  • 1f22af7 add javadocs to SimpleInvocationGate
  • 638ffa7 prevent forward and backward slashes to escape to other directories
  • 7d6b9a4 add missing ch.qos.logback.core.property package
  • fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
  • c73b43f deprecate the withJansi path
  • Additional commits viewable in compare view

Updates io.swagger.core.v3:swagger-annotations from 2.2.53 to 2.2.54

Updates io.swagger.core.v3:swagger-models from 2.2.53 to 2.2.54

Updates io.swagger.core.v3:swagger-models from 2.2.53 to 2.2.54

Updates io.swagger.parser.v3:swagger-parser from 2.1.46 to 2.1.47

Release notes

Sourced from io.swagger.parser.v3:swagger-parser's releases.

Swagger-parser 2.1.47 released!

  • build(deps): bump org.testng:testng from 7.11.0 to 7.12.0 (#2371)
  • build(deps): bump org.slf4j:slf4j-simple from 2.0.9 to 2.0.18 (#2358)
  • build(deps-dev): bump org.apache.maven.plugins:maven-enforcer-plugin from 3.4.1 to 3.6.3 (#2351)
  • Resolve same-named schemas from different files as distinct components (fixes #2333) (#2349)
  • fix: resolve relative refs correctly from spring boot jars (#2080, #2298) (#2320)
Commits
  • 6e50098 prepare release 2.1.47 (#2380)
  • eef1cd2 Resolve same-named schemas from different files as distinct components (fixes...
  • 35ada6a build(deps-dev): bump org.apache.maven.plugins:maven-enforcer-plugin (#2351)
  • 3ee75b3 build(deps): bump org.testng:testng from 7.11.0 to 7.12.0 (#2371)
  • 208ae7a build(deps): bump org.slf4j:slf4j-simple from 2.0.9 to 2.0.18 (#2358)
  • 0827c4a Normalize relative ref paths to avoid duplicating schemas (#2105)
  • 4b6e6b4 fix: support paths from non-default file systems (#2320)
  • 10e5b45 bump snapshot 2.1.47-SNAPSHOT (#2370)
  • See full diff in compare view

Updates io.ebean:ebean from 19.4.0 to 19.5.0

Commits

Updates io.ebean:ebean-querybean from 19.4.0 to 19.5.0

Commits

Updates io.ebean:querybean-generator from 19.4.0 to 19.5.0

Commits

Updates io.ebean:ebean-test from 19.4.0 to 19.5.0

Commits

Updates io.ebean:ebean-querybean from 19.4.0 to 19.5.0

Commits

Updates io.ebean:querybean-generator from 19.4.0 to 19.5.0

Commits

Updates io.ebean:ebean-test from 19.4.0 to 19.5.0

Commits

Updates com.squareup.okhttp3:okhttp-jvm from 5.4.0 to 5.5.0

Changelog

Sourced from com.squareup.okhttp3:okhttp-jvm's changelog.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query&quot;.toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()
  • New: OkHttp artifacts are now signed with our [new signing key]. This project and three sibling projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
  • Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
  • Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
  • Fix: Closing a multipart part's sink no longer closes the entire request body.
  • Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts

... (truncated)

Commits

Updates com.squareup.okhttp3:okhttp-sse from 5.4.0 to 5.5.0

Changelog

Sourced from com.squareup.okhttp3:okhttp-sse's changelog.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query&quot;.toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()
  • New: OkHttp artifacts are now signed with our [new signing key]. This project and three sibling projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
  • Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
  • Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
  • Fix: Closing a multipart part's sink no longer closes the entire request body.
  • Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts

... (truncated)

Commits

Updates com.squareup.okhttp3:okhttp-tls from 5.4.0 to 5.5.0

Changelog

Sourced from com.squareup.okhttp3:okhttp-tls's changelog.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query&quot;.toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()
  • New: OkHttp artifacts are now signed with our [new signing key]. This project and three sibling projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
  • Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
  • Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
  • Fix: Closing a multipart part's sink no longer closes the entire request body.
  • Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts

... (truncated)

Commits

Updates com.squareup.okhttp3:okhttp-sse from 5.4.0 to 5.5.0

Changelog

Sourced from com.squareup.okhttp3:okhttp-sse's changelog.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query&quot;.toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()
  • New: OkHttp artifacts are now signed with our [new signing key]. This project and three sibling projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
  • Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
  • Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
  • Fix: Closing a multipart part's sink no longer closes the entire request body.
  • Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts

... (truncated)

Commits

Updates com.google.guava:guava from 33.6.0-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

Guava requires one runtime dependency, which you can download here:

Javadoc

JDiff

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
</tr></table>

... (truncated)

Commits

Updates io.lettuce:lettuce-core from 7.6.0.RELEASE to 7.7.0.RELEASE

Release notes

Sourced from io.lettuce:lettuce-core's releases.

7.7.0.RELEASE

The Lettuce team is pleased to announce the Lettuce 7.7.0 minor release!

✨ Highlights

Lettuce 7.7.0 introduces support for the new features from Redis OSS 8.10 release, such as:

  • New command: HIMPORT - high-throughput compact hash bulk insertion - user-guide
  • New commands: LMOVEM, BLMOVEM - move multiple elements between lists
  • New command: SUNIONCARD - get the cardinality of the union of multiple sets
  • New command: SDIFFCARD - get the cardinality of the difference between sets
  • XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
  • New command: FT.ALIASLIST - get all aliases for the index
  • Stemmer support for Malay and Tagalog languages

Feature support for Probabilistic data structures in Redis:

Lettuce 7.7.0 supports Redis 2.6+ up to Redis 8.x. In terms of Java runtime, Lettuce requires at least Java 8 and works with Java 24. The driver is tested against Redis 8.10, Redis 8.8, Redis 8.6, Redis 8.4, Redis 8.2, Redis 8.0, Redis 7.4 and Redis 7.2.

Thanks to all contributors who made Lettuce 7.7.0.RELEASE possible.

📗 Links Reference documentation: https://lettuce.io/core/7.7.0.RELEASE

⭐ New Features

🐞 Bug Fixes

... (truncated)

Changelog

Sourced from io.lettuce:lettuce-core's changelog.

Lettuce 7.7.0 RELEASE NOTES

The Lettuce team is pleased to announce the Lettuce 7.7.0 minor release!

✨ Highlights

Lettuce 7.7.0 introduces support for the new features from Redis OSS 8.10 release, such as:

  • New command: HIMPORT - high-throughput compact hash bulk insertion - user-guide
  • New commands: LMOVEM, BLMOVEM - move multiple elements between lists
  • New command: SUNIONCARD - get the cardinality of the union of multiple sets
  • New command: SDIFFCARD - get the cardinality of the difference between sets
  • XREAD, XREADGROUP - new MAXCOUNT and MAXSIZE arguments to cap the cumulative reply entries and size
  • New command: FT.ALIASLIST - get all aliases for the index
  • Stemmer support for Malay and Tagalog languages

Feature support for Probabilistic data structures in Redis:

Lettuce 7.7.0 supports Redis 2.6+ up to Redis 8.x. In terms of Java runtime, Lettuce requires at least Java 8 and works with Java 24. The driver is tested against Redis 8.10, Redis 8.8, Redis 8.6, Redis 8.4, Redis 8.2, Redis 8.0, Redis 7.4 and Redis 7.2.

Thanks to all contributors who made Lettuce 7.7.0.RELEASE possible.

📗 Links Reference documentation: https://lettuce.io/core/7.7.0.RELEASE

⭐ New Features

🐞 Bug Fixes

... (truncated)

Commits
  • 1960d49 Release 7.7.0 (#3893)
  • 219a228 Revert "Deprecate Context utils (#3834)"
  • 781deec Fix/cluster reject commands pending future (#3782)
  • bec7cf5 add Benchmark (jmh) benchmark result for 5a7e25e649035cbc0131909866d10b240370...
  • 5a7e25e add Benchmark (jmh) benchmark result for 4943ae73ac7dd71119baaa301619191539ab...
  • 4943ae7 Revert "Add 'connection.commands(factory)' accessor and deprecate 'reactive()...
  • 8d6af65 Revert "Add connection.commands(factory) accessor and deprecate `reactive()...
  • 6185533 Revert "Fix connection pool support for new accessor (#3788)"
  • dd09a0b Revert "Fix backwards compatibility in connection interface (#3798)"
  • 21f3996 Revert "[reactor-optional] Deprecate reactive in TraceContextProvider (#3827)"
  • Additional commits viewable in compare view

Updates org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0

Release notes

Sourced from org.codehaus.plexus:plexus-utils's releases.

4.1.0

DirectoryScanner no longer excludes .gitignore ...

Description has been truncated

@dependabot
build(deps): bump the dependencies group with 26 updates
7fe91ec 
Bumps the dependencies group with 26 updates:

| Package | From | To |
| --- | --- | --- |
| [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) | `2.22.1` | `2.22.2` |
| [tools.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) | `3.2.1` | `3.2.2` |
| [io.modelcontextprotocol.sdk:mcp-bom](https://github.com/modelcontextprotocol/java-sdk) | `2.0.0` | `2.0.1` |
| [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.6.2` | `1.6.3` |
| io.swagger.core.v3:swagger-annotations | `2.2.53` | `2.2.54` |
| io.swagger.core.v3:swagger-models | `2.2.53` | `2.2.54` |
| [io.swagger.parser.v3:swagger-parser](https://github.com/swagger-api/swagger-parser) | `2.1.46` | `2.1.47` |
| [io.ebean:ebean](https://github.com/ebean-orm/ebean) | `19.4.0` | `19.5.0` |
| [io.ebean:ebean-querybean](https://github.com/ebean-orm/ebean) | `19.4.0` | `19.5.0` |
| [io.ebean:querybean-generator](https://github.com/ebean-orm/ebean) | `19.4.0` | `19.5.0` |
| [io.ebean:ebean-test](https://github.com/ebean-orm/ebean) | `19.4.0` | `19.5.0` |
| [com.squareup.okhttp3:okhttp-jvm](https://github.com/lysine-dev/okhttp) | `5.4.0` | `5.5.0` |
| [com.squareup.okhttp3:okhttp-sse](https://github.com/lysine-dev/okhttp) | `5.4.0` | `5.5.0` |
| [com.squareup.okhttp3:okhttp-tls](https://github.com/lysine-dev/okhttp) | `5.4.0` | `5.5.0` |
| [com.google.guava:guava](https://github.com/google/guava) | `33.6.0-jre` | `33.7.1-jre` |
| [io.lettuce:lettuce-core](https://github.com/redis/lettuce) | `7.6.0.RELEASE` | `7.7.0.RELEASE` |
| [org.codehaus.plexus:plexus-utils](https://github.com/codehaus-plexus/plexus-utils) | `4.0.3` | `4.1.0` |
| [de.skuzzle.enforcer:restrict-imports-enforcer-rule](https://github.com/skuzzle/restrict-imports-enforcer-rule) | `3.0.0` | `3.0.1` |
| [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) | `3.9.0` | `3.10.0` |
| [com.puppycrawl.tools:checkstyle](https://github.com/checkstyle/checkstyle) | `13.10.0` | `14.0.0` |
| [net.bytebuddy:byte-buddy](https://github.com/raphw/byte-buddy) | `1.18.11` | `1.18.12` |
| [dev.langchain4j:langchain4j-bom](https://github.com/langchain4j/langchain4j) | `1.18.1` | `1.19.0` |
| [io.github.classgraph:classgraph](https://github.com/classgraph/classgraph) | `4.8.192` | `4.8.193` |
| [io.projectreactor:reactor-core](https://github.com/reactor/reactor-core) | `3.8.6` | `3.8.7` |
| software.amazon.awssdk:bom | `2.53.0` | `2.54.1` |
| [io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha](https://github.com/open-telemetry/opentelemetry-java-instrumentation) | `2.30.0-alpha` | `2.31.0-alpha` |


Updates `com.fasterxml.jackson:jackson-bom` from 2.22.1 to 2.22.2
- [Commits](FasterXML/jackson-bom@jackson-bom-2.22.1...jackson-bom-2.22.2)

Updates `tools.jackson:jackson-bom` from 3.2.1 to 3.2.2
- [Commits](FasterXML/jackson-bom@jackson-bom-3.2.1...jackson-bom-3.2.2)

Updates `io.modelcontextprotocol.sdk:mcp-bom` from 2.0.0 to 2.0.1
- [Release notes](https://github.com/modelcontextprotocol/java-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/java-sdk/blob/main/CHANGELOG.md)
- [Commits](modelcontextprotocol/java-sdk@v2.0.0...v2.0.1)

Updates `ch.qos.logback:logback-classic` from 1.6.2 to 1.6.3
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.6.2...v_1.6.3)

Updates `io.swagger.core.v3:swagger-annotations` from 2.2.53 to 2.2.54

Updates `io.swagger.core.v3:swagger-models` from 2.2.53 to 2.2.54

Updates `io.swagger.core.v3:swagger-models` from 2.2.53 to 2.2.54

Updates `io.swagger.parser.v3:swagger-parser` from 2.1.46 to 2.1.47
- [Release notes](https://github.com/swagger-api/swagger-parser/releases)
- [Commits](swagger-api/swagger-parser@v2.1.46...v2.1.47)

Updates `io.ebean:ebean` from 19.4.0 to 19.5.0
- [Release notes](https://github.com/ebean-orm/ebean/releases)
- [Commits](https://github.com/ebean-orm/ebean/commits)

Updates `io.ebean:ebean-querybean` from 19.4.0 to 19.5.0
- [Release notes](https://github.com/ebean-orm/ebean/releases)
- [Commits](https://github.com/ebean-orm/ebean/commits)

Updates `io.ebean:querybean-generator` from 19.4.0 to 19.5.0
- [Release notes](https://github.com/ebean-orm/ebean/releases)
- [Commits](https://github.com/ebean-orm/ebean/commits)

Updates `io.ebean:ebean-test` from 19.4.0 to 19.5.0
- [Release notes](https://github.com/ebean-orm/ebean/releases)
- [Commits](https://github.com/ebean-orm/ebean/commits)

Updates `io.ebean:ebean-querybean` from 19.4.0 to 19.5.0
- [Release notes](https://github.com/ebean-orm/ebean/releases)
- [Commits](https://github.com/ebean-orm/ebean/commits)

Updates `io.ebean:querybean-generator` from 19.4.0 to 19.5.0
- [Release notes](https://github.com/ebean-orm/ebean/releases)
- [Commits](https://github.com/ebean-orm/ebean/commits)

Updates `io.ebean:ebean-test` from 19.4.0 to 19.5.0
- [Release notes](https://github.com/ebean-orm/ebean/releases)
- [Commits](https://github.com/ebean-orm/ebean/commits)

Updates `com.squareup.okhttp3:okhttp-jvm` from 5.4.0 to 5.5.0
- [Changelog](https://github.com/lysine-dev/okhttp/blob/main/CHANGELOG.md)
- [Commits](lysine-dev/okhttp@parent-5.4.0...parent-5.5.0)

Updates `com.squareup.okhttp3:okhttp-sse` from 5.4.0 to 5.5.0
- [Changelog](https://github.com/lysine-dev/okhttp/blob/main/CHANGELOG.md)
- [Commits](lysine-dev/okhttp@parent-5.4.0...parent-5.5.0)

Updates `com.squareup.okhttp3:okhttp-tls` from 5.4.0 to 5.5.0
- [Changelog](https://github.com/lysine-dev/okhttp/blob/main/CHANGELOG.md)
- [Commits](lysine-dev/okhttp@parent-5.4.0...parent-5.5.0)

Updates `com.squareup.okhttp3:okhttp-sse` from 5.4.0 to 5.5.0
- [Changelog](https://github.com/lysine-dev/okhttp/blob/main/CHANGELOG.md)
- [Commits](lysine-dev/okhttp@parent-5.4.0...parent-5.5.0)

Updates `com.google.guava:guava` from 33.6.0-jre to 33.7.1-jre
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

Updates `io.lettuce:lettuce-core` from 7.6.0.RELEASE to 7.7.0.RELEASE
- [Release notes](https://github.com/redis/lettuce/releases)
- [Changelog](https://github.com/redis/lettuce/blob/main/RELEASE-NOTES.md)
- [Commits](redis/lettuce@7.6.0.RELEASE...7.7.0.RELEASE)

Updates `org.codehaus.plexus:plexus-utils` from 4.0.3 to 4.1.0
- [Release notes](https://github.com/codehaus-plexus/plexus-utils/releases)
- [Commits](codehaus-plexus/plexus-utils@plexus-utils-4.0.3...plexus-utils-4.1.0)

Updates `de.skuzzle.enforcer:restrict-imports-enforcer-rule` from 3.0.0 to 3.0.1
- [Release notes](https://github.com/skuzzle/restrict-imports-enforcer-rule/releases)
- [Changelog](https://github.com/skuzzle/restrict-imports-enforcer-rule/blob/master/CHANGELOG_LEGACY.md)
- [Commits](https://github.com/skuzzle/restrict-imports-enforcer-rule/commits)

Updates `com.diffplug.spotless:spotless-maven-plugin` from 3.9.0 to 3.10.0
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](diffplug/spotless@maven/3.9.0...maven/3.10.0)

Updates `com.puppycrawl.tools:checkstyle` from 13.10.0 to 14.0.0
- [Release notes](https://github.com/checkstyle/checkstyle/releases)
- [Commits](checkstyle/checkstyle@checkstyle-13.10.0...checkstyle-14.0.0)

Updates `net.bytebuddy:byte-buddy` from 1.18.11 to 1.18.12
- [Release notes](https://github.com/raphw/byte-buddy/releases)
- [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md)
- [Commits](raphw/byte-buddy@byte-buddy-1.18.11...byte-buddy-1.18.12)

Updates `dev.langchain4j:langchain4j-bom` from 1.18.1 to 1.19.0
- [Release notes](https://github.com/langchain4j/langchain4j/releases)
- [Commits](langchain4j/langchain4j@1.18.1...1.19.0)

Updates `io.github.classgraph:classgraph` from 4.8.192 to 4.8.193
- [Release notes](https://github.com/classgraph/classgraph/releases)
- [Commits](classgraph/classgraph@classgraph-4.8.192...classgraph-4.8.193)

Updates `io.projectreactor:reactor-core` from 3.8.6 to 3.8.7
- [Release notes](https://github.com/reactor/reactor-core/releases)
- [Commits](reactor/reactor-core@v3.8.6...v3.8.7)

Updates `software.amazon.awssdk:bom` from 2.53.0 to 2.54.1

Updates `io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha` from 2.30.0-alpha to 2.31.0-alpha
- [Release notes](https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java-instrumentation/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-java-instrumentation/commits)

Updates `com.squareup.okhttp3:okhttp-tls` from 5.4.0 to 5.5.0
- [Changelog](https://github.com/lysine-dev/okhttp/blob/main/CHANGELOG.md)
- [Commits](lysine-dev/okhttp@parent-5.4.0...parent-5.5.0)

---
updated-dependencies:
- dependency-name: com.fasterxml.jackson:jackson-bom
  dependency-version: 2.22.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: tools.jackson:jackson-bom
  dependency-version: 3.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.modelcontextprotocol.sdk:mcp-bom
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.swagger.core.v3:swagger-annotations
  dependency-version: 2.2.54
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.swagger.core.v3:swagger-models
  dependency-version: 2.2.54
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.swagger.core.v3:swagger-models
  dependency-version: 2.2.54
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.swagger.parser.v3:swagger-parser
  dependency-version: 2.1.47
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.ebean:ebean
  dependency-version: 19.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.ebean:ebean-querybean
  dependency-version: 19.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.ebean:querybean-generator
  dependency-version: 19.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.ebean:ebean-test
  dependency-version: 19.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.ebean:ebean-querybean
  dependency-version: 19.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.ebean:querybean-generator
  dependency-version: 19.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.ebean:ebean-test
  dependency-version: 19.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.squareup.okhttp3:okhttp-jvm
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.squareup.okhttp3:okhttp-sse
  dependency-version: 5.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.squareup.okhttp3:okhttp-tls
  dependency-version: 5.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.squareup.okhttp3:okhttp-sse
  dependency-version: 5.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.google.guava:guava
  dependency-version: 33.7.1-jre
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.lettuce:lettuce-core
  dependency-version: 7.7.0.RELEASE
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: org.codehaus.plexus:plexus-utils
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: de.skuzzle.enforcer:restrict-imports-enforcer-rule
  dependency-version: 3.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-version: 3.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.puppycrawl.tools:checkstyle
  dependency-version: 14.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: net.bytebuddy:byte-buddy
  dependency-version: 1.18.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: dev.langchain4j:langchain4j-bom
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.github.classgraph:classgraph
  dependency-version: 4.8.193
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.projectreactor:reactor-core
  dependency-version: 3.8.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: software.amazon.awssdk:bom
  dependency-version: 2.54.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha
  dependency-version: 2.31.0-alpha
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.squareup.okhttp3:okhttp-tls
  dependency-version: 5.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 24, 2026
@jknack jknack added this to the 4.5.5 milestone Aug 24, 2026
@jknack
jknack merged commit 8f81d27 into main Aug 24, 2026
4 checks passed
@dependabot
dependabot Bot deleted the dependabot/maven/dependencies-73595e8613 branch August 24, 2026 14:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

4.5.5

Development

Successfully merging this pull request may close these issues.

1 participant

@jknack