Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 12 updates - #84

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/minor-and-patch-841b1fe830
Closed

chore(deps): bump the minor-and-patch group across 1 directory with 12 updates#84
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/minor-and-patch-841b1fe830

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 12 updates in the / directory:

Package From To
org.projectlombok:lombok 1.18.46 1.18.48
tools.jackson:jackson-bom 3.1.7 3.2.3
org.apache.tomcat.embed:tomcat-embed-core 11.0.25 11.0.27
org.apache.tomcat.embed:tomcat-embed-websocket 11.0.25 11.0.27
org.postgresql:postgresql 42.7.13 42.7.14
gradle-wrapper 9.7.0 9.8.1
com.hierynomus:sshj 0.40.0 0.41.2
com.github.mwiede:jsch 2.28.6 2.28.8
org.eclipse.jgit:org.eclipse.jgit 7.7.1.202607240634-r 7.8.0.202609011348-r
org.bouncycastle:bcpkix-jdk18on 1.85 1.86
org.slf4j:slf4j-api 2.0.18 2.0.20
org.slf4j:slf4j-simple 2.0.18 2.0.20
org.slf4j:slf4j-simple 2.0.18 2.0.20

Updates org.projectlombok:lombok from 1.18.46 to 1.18.48

Changelog

Sourced from org.projectlombok:lombok's changelog.

v1.18.48 (September 1st, 2026)

  • BREAKING CHANGE/BUGFIX: @Builder(builderClassName = "Builder") now generates an error, because the type names collide. #3857 (found after release)
  • PLATFORM: JDK27 support added #4072.
  • BUGFIX: @SneakyThrows usage on JDK26 no longer results in class files that require lombok.jar to be on the runtime classpath (which should not be neccessary). #4040.
  • FEATURE: New config key lombok.checkReturnValueAnnotation (values: none, lombok; default: none) lets lombok generate @lombok.CheckReturnValue on generated methods where the return value should not be ignored, such as @With methods and @Builder.build(). A future lombok release may flip the default to lombok. #4013.
  • PROMOTION: @SuperBuilder has been promoted to the main package. Otherwise, no changes have been made to the annotation. The old experimental annotation will remain for a few versions, at which point it will be marked as a deprecated annotation. Eventually it'll be removed. If you had lombok.config configuration for this annotation, the configuration keys for this feature have been renamed. #2209.
  • OLD-CRUFT: lombok.experimental.Wither and lombok.Delegate are deprecated remnants; these features were moved (to respectively lombok.With and lombok.experimental.Delegate over 5 years ago. They are now removed entirely. If your project is dependent on an older version of lombok which still has those; fret not, lombok still processes these annotations. It just no longer includes them in the jar.
  • FEATURE: CheckerFramework: Lombok now adds @SideEffectFree to constructors it makes if you have enabled checker framework via lombok.config.
  • BUGFIX: CheckerFramework: Lombok would add @SideEffectFree to the build() method of any generated builder, even if it is a builder for invoking a method; in that case, the side-effect-free nature of build() mirrors the side-effect-free nature of the method invocation you've built. Lombok now checks if the method it generated a builder for is side effect free / 'check return type'.
Commits
  • b48657c [version] pre-release version bump v1.18.48
  • d1d0039 Merge branch 'jdk27'
  • 1a23dad [review][refactor] No meaningful changes: Improved comments, javadoc, and cle...
  • 40cdde8 [changelog] JDK27 support
  • 25eae29 Add Danish Nawab to AUTHORS
  • 10ab92b Support JDK27: end positions moved from EndPosTable to JCTree.endpos
  • af01b7a Document the new configuration syntax for listy things
  • 1be3857 There is no more HtAccess
  • 405985d Semantic sections for website
  • 04b7340 [trivial] fixing some outdated tests (tests were broken, not lombok).
  • Additional commits viewable in compare view

Updates tools.jackson:jackson-bom from 3.1.7 to 3.2.3

Commits
  • 169de87 [maven-release-plugin] prepare release jackson-bom-3.2.3
  • c64410b Prep for 3.2.3 release
  • 1f23ca6 Merge branch '3.1' into 3.2
  • 432ca52 Post-release dep version bump
  • e0d3ccf [maven-release-plugin] prepare for next development iteration
  • c63b07a Post-release dep version bump
  • b0a5033 [maven-release-plugin] prepare for next development iteration
  • 719429d [maven-release-plugin] prepare release jackson-bom-3.2.2
  • d0b9877 Prep for 3.2.2 release
  • e32f526 Merge branch '3.1' into 3.2
  • Additional commits viewable in compare view

Updates org.apache.tomcat.embed:tomcat-embed-core from 11.0.25 to 11.0.27

Updates org.apache.tomcat.embed:tomcat-embed-websocket from 11.0.25 to 11.0.27

Updates org.postgresql:postgresql from 42.7.13 to 42.7.14

Release notes

Sourced from org.postgresql:postgresql's releases.

v42.7.14

Security

This release fixes two security vulnerabilities.

requireAuth is silently not enforced when the value excludes every authentication method (GHSA-rhp9-mr79-r74h, CVE-2026-107314)

Severity: Moderate (CVSS 5.9) | Affected versions: 42.7.11 – 42.7.13

If the requireAuth connection property excluded all six authentication methods the driver knows (for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none) or contained no method at all (for example requireAuth=,), the driver applied no restriction and accepted whatever method the server asked for, including cleartext password. An attacker positioned between the application and the server could use this to request cleartext password authentication and receive the database password.

Unset values, positive lists (such as requireAuth=scram-sha-256) and partial exclusions (such as requireAuth=!password,!md5) were not affected, and neither were deployments that do not set requireAuth.

Behavior after upgrading:

  • A value that excludes every method now refuses the connection with SQLState 08004 and the message Authentication method is not allowed by requireAuth (or the channel binding error when channelBinding=require is also set).
  • A value that names no method is rejected as an invalid requireAuth value.

Because affected deployments had this value by mistake, and connections worked normally on affected versions, connections with such a value will fail after upgrading. Replace it with a positive list of the methods your server uses, for example requireAuth=scram-sha-256.

Independently of this fix, use sslmode=verify-full with a trusted CA so that an attacker cannot present a substitute server.

Thanks to @​manus-pi for finding and reporting this issue.

Driver stores bytes of earlier statements when it pads a value shorter than its declared length (GHSA-f64h-wr5q-3qf3, CVE-2026-107315)

Severity: Moderate (CVSS 5.3) | Affected versions: 42.7.4 – 42.7.13

When an application sent a value shorter than the length it declared, the driver padded the missing bytes with data from earlier messages on the same connection instead of zeros, and the server stored them. The stored value could contain SQL text and parameter values of earlier, unrelated statements (up to 8192 bytes, or 16320 with GSS encryption). On pooled connections, those statements could come from other requests. 42.7.3 and earlier padded with zeros.

This is reachable through the following public API when the declared length is larger than the data:

  • PreparedStatement.setObject(int, ByteStreamWriter)
  • CopyIn.writeToCopy(ByteStreamWriter) and CopyIn.writeToCopy(byte[], int, int)
  • PGCopyOutputStream.write(byte[], int, int) (writes over 64 KiB)
  • LargeObject.write(byte[], int, int)
  • java.sql.Blob.setBytes(long, byte[], int, int)

Padding is now always zeros. Applications whose declared length always matches the data were not affected. Values stored by an affected version through such a call may already contain leaked data, so you may want to review affected columns. There is no connection property to disable the old behavior; the workaround on older versions is to make the declared length match the data.

Thanks to @​vlsi for finding and reporting this issue.

Full Changelog: pgjdbc/pgjdbc@REL42.7.13...REL42.7.14

Changelog

Sourced from org.postgresql:postgresql's changelog.

Changelog

Notable changes since version 42.0.0, read the complete History of Changes.

The format is based on Keep a Changelog.

[Unreleased]

Fixed

  • fix: PGStream.skip no longer loops forever when the connection ends while the driver is discarding bytes, and no longer mistakes a stream that skips nothing for one that has ended. InputStream.skip may return zero with more data still coming, which a stream supplied through the socketFactory property is free to do; the driver now reads a byte in that case and treats only -1 as the end [PR #4358](pgjdbc/pgjdbc#4358)
  • fix: LargeObjectManager operations now work inside an active XA transaction. Since 42.7.13 an XA branch keeps the caller's autoCommit=true, and the guard rejected large objects as if the connection were idle. It now checks the server transaction state (getTransactionState()) instead of autoCommit, so a genuine auto-commit connection with no open transaction is still refused [Issue #4309](pgjdbc/pgjdbc#4309) [PR #4310](pgjdbc/pgjdbc#4310)
  • fix: batch update counts are no longer secured as committed inside an XA transaction. BatchResultHandler treated per-statement progress as durable whenever autoCommit=true, but an XA branch keeps autoCommit=true while the transaction is open, so a batch that flushed mid-way and then failed could report rolled-back statements as succeeded. Progress is now secured only when no server transaction is open [Issue #4309](pgjdbc/pgjdbc#4309) [PR #4311](pgjdbc/pgjdbc#4311)

Changed

  • fix: backend message lengths are checked before anything is sized from them. Each length is checked against the message layout and a limit for its type, the lengths inside DataRow and FunctionCallResponse are checked against the message, and the NegotiateProtocolVersion option count is bounded. A hostile or out of sync backend could previously force an allocation of up to two gigabytes with a five byte header [Issue #4015](pgjdbc/pgjdbc#4015)
  • fix: the read buffer is limited to 32 MiB and grows once per request rather than once per socket read. It previously doubled on every read while a large request was outstanding, so a peer that declared a large length and sent it slowly grew the buffer until the doubling past 1 GiB overflowed to a negative size [Issue #4015](pgjdbc/pgjdbc#4015)
  • fix: a zero-length CopyData body is accepted. It is valid on the wire and was previously rejected by an assertion, so it failed only on JVMs started with -ea [Issue #4015](pgjdbc/pgjdbc#4015)
  • fix: GSS packet lengths are bounded. The encrypted transport is limited to a 16380 byte payload and the handshake to a 65532 byte token, matching PQ_GSS_MAX_PACKET_SIZE and PQ_GSS_AUTH_BUFFER_SIZE [Issue #4015](pgjdbc/pgjdbc#4015)
  • fix: a connection whose stream has been refused is no longer reusable. Any refused length or count marks the stream broken, so Connection.isClosed() reports it closed and a pool that tests on borrow discards it. The socket is dropped with SO_LINGER 0 [Issue #4015](pgjdbc/pgjdbc#4015)
  • fix: a protocol violation before authentication is reported as PSQLException with SQLState 08P01 rather than as a plain I/O error, and is no longer retried under sslMode=allow or sslMode=prefer [Issue #4015](pgjdbc/pgjdbc#4015)
  • fix: the counts inside RowDescription, ParameterDescription, CopyInResponse and CopyOutResponse are checked against the declared message length. A RowDescription claiming more fields than its length can hold previously read its field descriptions out of the messages that followed it [Issue #4015](pgjdbc/pgjdbc#4015)
  • fix: the driver checks that each backend message was consumed exactly before reading the next message type, so a reader that stops short of its declared length is refused rather than misreading what follows [Issue #4015](pgjdbc/pgjdbc#4015)
  • fix: the authentication loop, the GSS encryption handshake and the GSS authentication handshake each stop after 64 round trips. A zero-length GSS token is a valid continuation, so a server could previously keep a client exchanging tokens forever before any credentials were exchanged [Issue #4015](pgjdbc/pgjdbc#4015)
  • fix: ErrorResponse before authentication is limited to 30000 bytes rather than 32 MiB, matching libpq's limit for messages outside VALID_LONG_MESSAGE_TYPE, and a C string inside a declared message is no longer scanned past the end of that message. Both were allocations an unauthenticated peer could cause [Issue #4015](pgjdbc/pgjdbc#4015)
  • fix: an ErrorResponse or NoticeResponse longer than 32 MiB is truncated to that size rather than refused. The body past the limit is drained and the shortened message is delivered, so the connection stays usable [Issue #4015](pgjdbc/pgjdbc#4015)
  • fix: the read buffer returns to its initial size once the message that grew it is drained, so a connection no longer retains 32 MiB after one large error [Issue #4015](pgjdbc/pgjdbc#4015)
  • fix: exceeding maxResultBuffer closes the connection. The row is not read past the limit, so the connection cannot continue, and it is now dropped where the limit is exceeded rather than refused as a protocol violation at the next message. The error reported is the limit alone, with SQLState 08S01 as before [Issue #4015](pgjdbc/pgjdbc#4015)

Security

  • fix: a requireAuth value that excludes every authentication method, such as !password,!md5,!gss,!sspi,!scram-sha-256,!none, now refuses every method. A connection with such a value now fails with SQLState 08004. Before, the driver treated the value as if requireAuth were not set, and used any method the server asked for, even a cleartext password. This affects 42.7.11 through 42.7.13 GHSA-rhp9-mr79-r74h
  • fix: a requireAuth value without a method in it, such as , or ,,, now fails with SQLState 22023. Before, the driver treated it as if requireAuth were not set. Commas at the very end of a value are still ignored, as in password,. This affects 42.7.11 through 42.7.13 GHSA-rhp9-mr79-r74h
Commits
  • ebdd9d0 chore: bump version to 42.7.14
  • 0e764c8 test: Add additional PgBufferedOutputStream.writeZeros(...) tests
  • c8998c8 fix: writeZeros() could send stale buffer contents instead of zeros
  • a65ef98 fix: refuse every method when requireAuth excludes them all
  • See full diff in compare view

Updates gradle-wrapper from 9.7.0 to 9.8.1

Release notes

Sourced from gradle-wrapper's releases.

9.8.1

This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.

This release addresses three high rated vulnerabilities:

The following issues were resolved:

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam, Björn Kautler, Eng Zer Jun, Hashim Khan, Julian Krannich, KBS, Labh R Jethe, Mark Dodgson, Maxim, monkey, nataphon-ktsystems, Paul King, Qiu Tian, rg_sandesh, Roberto Perez Alcolea, Sean, Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

... (truncated)

Commits
  • 39daf39 Release notes for Gradle 9.8.1 (#39409)
  • 4fc92e5 Release notes for Gradle 9.8.1
  • bfbd14a Make repository disabling stricter (#39403)
  • 95e0bf9 Check daemon & worker preamble earlier (#39402)
  • 7aa9a5b Improve display for distribution url in wrapper (#39401)
  • 74a7720 Wrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...
  • 651110a Check worker token before any serialization similarly to daemon
  • 8a6b9d9 Harden repository disabling: disable them by default on failure unless there'...
  • f28e514 Check the daemon token before any serialization
  • 86ab273 Replace credentials for distribution url with *** and avoid showing the plain...
  • Additional commits viewable in compare view

Updates com.hierynomus:sshj from 0.40.0 to 0.41.2

Release notes

Sourced from com.hierynomus:sshj's releases.

SSHJ 0.41.2

Changes

📦 Dependency Updates

  • Downgrade Java compiler target version to 8 in build configuration. (#1065) @​dkocher

Full Changelog: hierynomus/sshj@v0.41.1...v0.41.2

SSHJ 0.41.1

Changes

  • No changes

Full Changelog: hierynomus/sshj@v0.41.0...v0.41.1

SSHJ 0.41.0

Changes

🐛 Bug Fixes

✨ New Features

📦 Dependency Updates

🔨 Improvements

... (truncated)

Commits
  • 6fad160 Merge pull request #1065 from iterate-ch/issues/1064-java8
  • dacefc5 Downgrade Java compiler target version to 8 in build configuration.
  • d0ecfd2 >Update sonatype release
  • 243f339 Merge pull request #1062 from hierynomus/feat/rfc-8308
  • f986c90 Fix flaky ConcurrentModificationException in StrictKeyExchangeTest
  • b5aa3fb Strengthen integration test to prove server-sig-algs reordering
  • d1574ab Feat: parse SSH_MSG_EXT_INFO server-sig-algs (RFC 8308)
  • 2bb495a Merge pull request #1061 from hierynomus/fix/ecdsa-keyfactory-algorithm-name
  • 175bf73 Merge branch 'master' into fix/ecdsa-keyfactory-algorithm-name
  • da89216 Merge pull request #1060 from hierynomus/fix/explicit-pubkey
  • Additional commits viewable in compare view

Updates com.github.mwiede:jsch from 2.28.6 to 2.28.8

Release notes

Sourced from com.github.mwiede:jsch's releases.

jsch-2.28.8

What's Changed

  • 2.28.8 changes by @​norrisjeremy in mwiede/jsch#1134
    • #1133: bounds check incoming SSH_FXP_DATA responses.
    • #1133: cap length of incoming HTTP status response lines.
    • #1127: expand on previous SftpATTRS bounds checks to properly close SSH_FX_READDIR handles.
    • #1139: add bounds checks when parsing prompts from SSH_MSG_USERAUTH_INFO_REQUEST messages.
    • #1127 & #1139: expand upon previous bounds checks to account for arithmetic overflow.
  • Support wildcard host certificate principals by @​tc-tlv in mwiede/jsch#1108
  • Expose local SFTP window/packet size setters as public by @​courville in mwiede/jsch#1145

Dependency Updates

New Contributors

Full Changelog: mwiede/jsch@jsch-2.28.7...jsch-2.28.8

jsch-2.28.7

What's Changed

Depenency Updates

... (truncated)

Commits
  • 36c4d26 [maven-release-plugin] prepare release jsch-2.28.8
  • cd4e924 chore: downgrade maven version after publishing problems
  • 53f016a Expose local SFTP window/packet size setters as public (#1145)
  • 898c6c2 Run tests on Java 27.
  • cc7e534 Update to Maven 3.10.0.
  • 660f42d Follow OpenSSH behavior and restrict maximum number of KDF rounds.
  • 9b13e61 Follow OpenSSH behavior and use Huffman coding for zlib compression.
  • 780e57e #1127 & #1139: expand upon previous bounds checks to account for arithmetic o...
  • f94e745 #1139: add bounds checks when parsing prompts from SSH_MSG_USERAUTH_INFO_REQU...
  • d2a3658 #1127: expand on previous SftpATTRS bounds checks to properly close SSH_FX_RE...
  • Additional commits viewable in compare view

Updates org.eclipse.jgit:org.eclipse.jgit from 7.7.1.202607240634-r to 7.8.0.202609011348-r

Commits
  • f386af5 JGit v7.8.0.202609011348-r
  • 1c5afcc Merge branch 'master' into stable-7.8
  • db8cba3 IndexDiffFilter: Don't drop untracked folders unrelated to a tracked change
  • 92c2312 Fix NPE in close() with nothing to fetch
  • 14d0c55 Merge "DfsPackFile: honor to conf to read changedPathFilters"
  • 79f0c50 Merge branch 'master' into stable-7.8
  • a34a12e Merge branch 'stable-7.7'
  • c062a12 Merge branch 'stable-7.6' into stable-7.7
  • 989a5c4 Merge branch 'stable-7.5' into stable-7.6
  • 1fbb306 Merge branch 'stable-7.4' into stable-7.5
  • Additional commits viewable in compare view

Updates org.bouncycastle:bcpkix-jdk18on from 1.85 to 1.86

Changelog

Sourced from org.bouncycastle:bcpkix-jdk18on's changelog.

Bouncy Castle Crypto Package - Release Notes

1.0 Introduction

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. The package is organised so that it contains a light-weight API suitable for use in any environment (including the J2ME) with the additional infrastructure to conform the algorithms to the JCE framework.

2.0 Release History

2.1.1 Version

Release: 1.87
Date: 2026, TBD

2.1.2 Defects Fixed

  • The DANE SMIMEA support in org.bouncycastle.cert.dane had three defects. JndiDANEFetcherFactory, when asked for every entry under a bare domain name, removed the first and last characters of the owner name the JNDI DNS provider reports for each listed record, assuming a quoted name; the provider returns the name unquoted with a trailing root dot, so the first hex digit of the hash label was lost and the lookup that followed could never find the record. It now removes only the root dot. DANEEntryStore kept one entry per owner name, so an address with more than one SMIMEA record (a signing and an encryption certificate, say) only ever showed its last; every entry is now kept. DANEEntrySelectorFactory split an address at its first '@', mis-handling a quoted local-part containing one, and threw StringIndexOutOfBoundsException rather than DANEException for an address with none; it now splits at the last '@', removes enclosing quotes and backslash quoting from the local-part before hashing as RFC 8162 sec. 3 describes, and rejects an address with no '@'. The DANEEntry(String, byte[]) constructor also now rejects, with an IOException, a record whose flags do not describe a full certificate entry rather than parsing whatever follows the flags as a certificate.

  • TimeStampToken accepted a token whose signing-time signed attribute disagreed with the genTime in its TSTInfo. Both are the TSA's statement of when the token was produced, and the disagreement is what distinguishes an RFC 3161 token from a signature a TSA has put over a supplied TSTInfo through another service using the same key, such as a legacy countersignature endpoint, which some TSAs still offer. The constructor now rejects a token whose signing-time, when present, is further from genTime than the token's accuracy plus one minute; the check can be switched off with the org.bouncycastle.tsp.allow_inconsistent_signing_time property. TimeStampTokenGenerator now sets a signing-time attribute from the genTime it is given rather than the clock, so its tokens are consistent whatever genTime is passed.

  • TimeStampToken.validate() accepted a token whose message imprint was calculated with MD5, for which collisions can be computed, and TSPAlgorithms.ALLOWED, the set the request side is typically checked against, included MD5. MD5 has been removed from TSPAlgorithms.ALLOWED, and validate() now rejects a token whose imprint algorithm is not in it (failure code badAlg). The new TSPAlgorithms.LEGACY is ALLOWED plus MD5; validate(SignerInformationVerifier, Set) takes the set of acceptable imprint algorithms, and the org.bouncycastle.tsp.allowed_imprint_algorithms property, a comma separated list of digest names or OIDs, replaces ALLOWED as the default for validate(SignerInformationVerifier). TSPAlgorithms.ALLOWED and LEGACY are now unmodifiable.

  • CRL-based revocation checking (the PKIX CertPathValidator and the pkix X509RevocationChecker) tracked a CRL entry's reasonCode in the same field as its own status markers and did not range-check it, so a CRL entry whose reasonCode was outside the RFC 5280 sec. 5.3.1 set was mishandled: 11 left the certificate unrevoked, other out-of-range values threw an unchecked exception out of validation. The revocation date and the reason code are now kept separately; an undefined reasonCode is processed as unspecified and reported as "(unknown code: N)".

  • OERDefinition.enumItem(label, value) discarded the explicit enumerand value: Builder.enumValue() set it on the builder it had just copied and returned the copy without it, so every item was numbered by its position in the definition instead. The value is now kept, and the items without one are numbered as X.680 sec. 20.3 and 20.6 specify: a root item takes the successive integers from 0, skipping any explicit root number, and an extension item takes the smallest value not defined in the root and greater than every preceding extension item (the old loop restarted its count after an explicit number, so an explicit 0 followed by an unnumbered item was a duplicate). The three ETSI TS 102 941 response-code definitions that use explicit values give "ok" the value 0 at position 0, so their encodings are unchanged.

  • OERInputStream read the two length-prefixed INTEGER forms and BIT STRING with Streams.readFully and did not check its best-effort return, so a stream that ended inside the value decoded the zero-padded buffer as a value rather than failing. Every length-driven read in the decoder now goes through Streams.readLenBytesFully, which fails with EOFException at the real end of input and, for a long length, does not allocate the full array until the stream has delivered a fair part of it - so a hostile length that is within the decoder's allocation cap, or a cap a caller has raised, cannot drive a large allocation from a short input.

  • The OER codec gave a signed INTEGER whose upper bound is exactly the maximum of a fixed-size word the next word up: X.696 sec. 10.4 a)-d) make both bounds inclusive, but the upper-bound comparison was strict, so INTEGER (-128..127) was a two-octet word rather than one, and likewise at the 16-, 32- and 64-bit boundaries. The two signed ranges shipped with the library, NinetyDegreeInt and OneEightyDegreeInt, lie inside the four-octet word and are unaffected.

  • The ETSI TS 102 941 response code wrappers AuthorizationResponseCode, AuthorizationValidationResponseCode and EnrolmentResponseCode checked their range on BigInteger.intValue(), which truncates, so a value past the int range whose low 32 bits were in range was accepted - 2^32 as "ok". The check now rejects a negative value or one over 31 bits before consulting intValue().

  • OERInputStream accepted an empty group of octets as the value zero in four places where X.696 requires at least one: a variable-size INTEGER with a length determinant of 0 (sec. 3.7.11 and 3.7.12 define the number forms as one or more octets), an ENUMERATED long form with 0 subsequent octets (sec. 11.4 says 1 to 127), a length determinant long form with 0 subsequent octets (sec. 8.6.5, likewise) and a sequence-of quantity of 0 octets (sec. 17.2). Each now fails with an IOException; the one-octet encodings of zero decode as before.

  • OEROutputStream could not encode a CHOICE whose chosen alternative has a tag number of 63 or more. X.696 sec. 8.7.2.2 keeps a tag number below 63 in the first octet and sec. 8.7.2.3 continues one of 63 or more in 7-bit groups, most significant first, with bit 8 as the continuation flag; the encoder used the single octet up to and including 63, so 63 went out as the continuation escape with nothing after it, and BitBuilder.write7BitBytes took its groups from bit 31 downward rather than from the low end, so 63 encoded as 83 78, which decodes as 504. Both forms of write7BitBytes now write the fewest 7-bit groups of the value, and the boundary is at 63. No CHOICE in the shipped ITS definitions has that many alternatives.

  • OEROutputStream rejected a required SEQUENCE component as absent whenever it arrived wrapped in an OEROptional, the form the ITS classes' toASN1Primitive methods produce for present values, rather than only when the wrapper is the undefined ABSENT. A defined wrapper at a required position is now unwrapped and written like the bare value.

  • OERInputStream, for an absent optional SEQUENCE component selected through a switch, tested the selected alternative for a default value but then took the default from the switch itself, which has none, so the alternative's default was added as null and the decode failed with NullPointerException. The default now comes from the selected alternative. No definition shipped with the library has a switched component with a default.

  • OERInputStream read a SEQUENCE OF count through BigInteger.intValue(), which keeps only the low 32 bits, so a count of 2^32 + 3 decoded as 3 elements and the rest of the input was left in place for the next field. A count that does not fit in 31 bits is now rejected as out of range, and the fixed sizes taken from a definition go through BigIntegers.intValueExact() rather than silently truncating.

  • OERInputStream rejected a valid SEQUENCE OF as "out of range" on any stream whose available() reported fewer bytes than the element count: available() is an estimate of what can be read without blocking, 0 from the base InputStream and from wrappers such as CipherInputStream, and the decoder had been using it as a bound on the count. The count is now bounded by the decoder's allocation ceiling (maxByteAllocation, 1 MiB by default) instead, and a count within it over a short input fails at the first element that is not there.

  • OERInputStream could not decode a variable-size BIT STRING. X.696 sec. 13.3 encodes one as a length determinant covering an initial octet, which gives the number of unused bits in the final octet, and the octets of the value, which is what OEROutputStream writes; the decoder read the determinant as a bit count, divided it by 8 and never read the initial octet, so it took no data at all for a two-octet value, and a stray third branch keyed on a negative size bound threw NullPointerException for an unbounded schema. The decoder now has the two forms of clause 13: a fixed size reads the whole octets the size occupies and derives the unused bits from it (a 12-bit string is two octets with four unused bits, where it was one octet), and any other size reads the determinant, the initial octet (rejected over 7, or non-zero for an empty value, 13.3.4) and the data, carrying the unused-bit count into the DERBitString. OERDefinition gains bitString() and bitString(lower, upper) alongside bitString(size). The single BIT STRING in the shipped ITS definitions is a fixed 8 bits and decodes as before.

  • OEROutputStream wrote a negative INTEGER value under a type whose lower bound is zero or more through the unsigned encodings, so it went out as a different, positive value: -1 under INTEGER (0..255) as FF, the encoding of 255, and under INTEGER (0..MAX) as 01 FF. A negative value is now rejected with IllegalArgumentException on both unsigned paths.

  • OERInputStream.uint64() read its eight octets as a signed number, so a value with the top bit set came back negative; the other uintN readers were unsigned. It now reads unsigned.

  • The OER codec treated an INTEGER with a positive lower bound as signed. X.696 sec. 10.2 a) gives the unsigned encodings to an integer whose lower bound is zero or positive; OERInputStream and OEROutputStream tested for a lower bound of exactly zero, so INTEGER (1..255) went out as a two-octet signed word rather than one unsigned octet and INTEGER (1..MAX) as a variable-size signed number, where 128 is 00 80 rather than 80. No OER definition shipped with the library puts a positive lower bound on an INTEGER.

  • The OER codec encoded and decoded a negative ENUMERATED value wrongly. X.696 sec. 11.4 reserves the one-octet short form for the values 0 to 127 and puts every other value, negative ones included, in the long form as a two's-complement signed integer; OEROutputStream chose the long form only for values above 127, so a negative value went out in the short form masked to seven bits (-1 as 7F, the encoding of 127), and OERInputStream read a long-form value as unsigned (81 FF, the encoding of -1, as 255). Both now follow sec. 11.4. No OER definition shipped with the library declares a negative enumerand.

  • ASN1Enumerated rejected negative values, although an ENUMERATED is an integer (X.680 sec. 20) and may be negative: the int and BigInteger constructors threw "enumerated must be non-negative", the byte array constructor rejected a leading sign bit, and a parsed ENUMERATED with a negative value failed to decode. The checks are removed, ASN1Enumerated gains isNegative() and longValueExact() alongside the existing intValueExact(), and a zero-length ENUMERATED is now reported as "malformed enumerated", as a zero-length INTEGER is reported as "malformed integer", rather than "ENUMERATED has zero length". ASN1Enumerated.valueOf(int) and valueOf(long) return shared instances for the values 0 to 15, as ASN1Integer.valueOf() does, and a parsed single-byte ENUMERATED in that range is returned as the shared instance.

  • A PBEKey stored in a BCFKS KeyStore was not reported as a key entry: isKeyEntry() returned false for it, so KeyStore.getEntry() returned null rather than a SecretKeyEntry, although getKey() recovered it. The PBE key entry type added for github #2164 was missing from engineIsKeyEntry, and is now included.

  • The CMS content-type decoders SignedData, EnvelopedData, AuthenticatedData, AuthEnvelopedData and EncryptedData read their mandatory fields by index or enumeration with no lower-bound size check, so a ContentInfo whose inner content was an empty or too-short SEQUENCE - malformed but DER-parseable - left the decode as an unchecked NoSuchElementException or ArrayIndexOutOfBoundsException rather than the CMSException the CMSSignedData, CMSEnvelopedData, CMSAuthenticatedData and CMSAuthEnvelopedData constructors declare (the IllegalArgumentException CMSEncryptedData documents). Each now rejects a short sequence with IllegalArgumentException before reading, as the sibling content types CompressedData and DigestedData already did, so the wrappers surface it as their declared exception; the case that claims an OPTIONAL field and then truncates the mandatory ones after it is covered too. The streaming parsers CMSSignedDataParser, CMSEnvelopedDataParser, CMSAuthentic...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Oct 14, 2026
@dependabot
chore(deps): bump the minor-and-patch group across 1 directory with 1…
a21e5cb 
…2 updates

Bumps the minor-and-patch group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [org.projectlombok:lombok](https://github.com/projectlombok/lombok) | `1.18.46` | `1.18.48` |
| [tools.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) | `3.1.7` | `3.2.3` |
| org.apache.tomcat.embed:tomcat-embed-core | `11.0.25` | `11.0.27` |
| org.apache.tomcat.embed:tomcat-embed-websocket | `11.0.25` | `11.0.27` |
| [org.postgresql:postgresql](https://github.com/pgjdbc/pgjdbc) | `42.7.13` | `42.7.14` |
| [gradle-wrapper](https://github.com/gradle/gradle) | `9.7.0` | `9.8.1` |
| [com.hierynomus:sshj](https://github.com/hierynomus/sshj) | `0.40.0` | `0.41.2` |
| [com.github.mwiede:jsch](https://github.com/mwiede/jsch) | `2.28.6` | `2.28.8` |
| [org.eclipse.jgit:org.eclipse.jgit](https://github.com/eclipse-jgit/jgit) | `7.7.1.202607240634-r` | `7.8.0.202609011348-r` |
| [org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java) | `1.85` | `1.86` |
| org.slf4j:slf4j-api | `2.0.18` | `2.0.20` |
| org.slf4j:slf4j-simple | `2.0.18` | `2.0.20` |
| org.slf4j:slf4j-simple | `2.0.18` | `2.0.20` |



Updates `org.projectlombok:lombok` from 1.18.46 to 1.18.48
- [Changelog](https://github.com/projectlombok/lombok/blob/master/doc/changelog.markdown)
- [Commits](projectlombok/lombok@v1.18.46...v1.18.48)

Updates `tools.jackson:jackson-bom` from 3.1.7 to 3.2.3
- [Commits](FasterXML/jackson-bom@jackson-bom-3.1.7...jackson-bom-3.2.3)

Updates `org.apache.tomcat.embed:tomcat-embed-core` from 11.0.25 to 11.0.27

Updates `org.apache.tomcat.embed:tomcat-embed-websocket` from 11.0.25 to 11.0.27

Updates `org.postgresql:postgresql` from 42.7.13 to 42.7.14
- [Release notes](https://github.com/pgjdbc/pgjdbc/releases)
- [Changelog](https://github.com/pgjdbc/pgjdbc/blob/master/CHANGELOG.md)
- [Commits](pgjdbc/pgjdbc@REL42.7.13...REL42.7.14)

Updates `gradle-wrapper` from 9.7.0 to 9.8.1
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](gradle/gradle@v9.7.0...v9.8.1)

Updates `com.hierynomus:sshj` from 0.40.0 to 0.41.2
- [Release notes](https://github.com/hierynomus/sshj/releases)
- [Commits](hierynomus/sshj@v0.40.0...v0.41.2)

Updates `com.github.mwiede:jsch` from 2.28.6 to 2.28.8
- [Release notes](https://github.com/mwiede/jsch/releases)
- [Changelog](https://github.com/mwiede/jsch/blob/master/ChangeLog)
- [Commits](mwiede/jsch@jsch-2.28.6...jsch-2.28.8)

Updates `org.eclipse.jgit:org.eclipse.jgit` from 7.7.1.202607240634-r to 7.8.0.202609011348-r
- [Commits](eclipse-jgit/jgit@v7.7.1.202607240634-r...v7.8.0.202609011348-r)

Updates `org.bouncycastle:bcpkix-jdk18on` from 1.85 to 1.86
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.slf4j:slf4j-api` from 2.0.18 to 2.0.20

Updates `org.slf4j:slf4j-simple` from 2.0.18 to 2.0.20

Updates `org.slf4j:slf4j-simple` from 2.0.18 to 2.0.20

---
updated-dependencies:
- dependency-name: com.github.mwiede:jsch
  dependency-version: 2.28.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: com.hierynomus:sshj
  dependency-version: 0.41.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: gradle-wrapper
  dependency-version: 9.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: org.apache.tomcat.embed:tomcat-embed-core
  dependency-version: 11.0.26
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: org.apache.tomcat.embed:tomcat-embed-websocket
  dependency-version: 11.0.26
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: org.bouncycastle:bcpkix-jdk18on
  dependency-version: '1.86'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: org.eclipse.jgit:org.eclipse.jgit
  dependency-version: 7.8.0.202609011348-r
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: org.postgresql:postgresql
  dependency-version: 42.7.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: org.projectlombok:lombok
  dependency-version: 1.18.48
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: org.slf4j:slf4j-api
  dependency-version: 2.0.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: org.slf4j:slf4j-simple
  dependency-version: 2.0.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: org.slf4j:slf4j-simple
  dependency-version: 2.0.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tools.jackson:jackson-bom
  dependency-version: 3.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/gradle/minor-and-patch-841b1fe830 branch from 4b4c00e to a21e5cb Compare October 20, 2026 22:44
@dependabot @github

dependabot Bot commented on behalf of github Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 27, 2026
@dependabot
dependabot Bot deleted the dependabot/gradle/minor-and-patch-841b1fe830 branch October 27, 2026 22:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants