Skip to content

build(deps): bump the minor-and-patch group across 1 directory with 11 updates - #761

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/minor-and-patch-e0ed4ebffc
Open

build(deps): bump the minor-and-patch group across 1 directory with 11 updates#761
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/minor-and-patch-e0ed4ebffc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 16, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 11 updates in the / directory:

Package From To
io.github.classgraph:classgraph 4.8.194 4.8.195
io.projectreactor.netty:reactor-netty-http 1.2.8 1.3.7
io.swagger.core.v3:swagger-annotations 2.2.54 2.2.55
io.nats:jnats 2.26.2 2.26.3
io.swagger.parser.v3:swagger-parser 2.1.47 2.1.48
org.apache.maven.plugins:maven-compiler-plugin 3.15.0 3.16.0
org.apache.maven.plugins:maven-surefire-plugin 3.5.6 3.6.0
org.apache.maven.plugins:maven-failsafe-plugin 3.5.6 3.6.0
org.apache.maven.plugins:maven-clean-plugin 3.2.0 3.5.0
org.apache.maven.plugins:maven-resources-plugin 3.3.1 3.5.0
org.apache.maven:apache-maven 3.9.12 3.9.16

Updates io.github.classgraph:classgraph from 4.8.194 to 4.8.195

Release notes

Sourced from io.github.classgraph:classgraph's releases.

ClassGraph 4.8.195

ClassGraph 5.0.0 is coming shortly, and requires JDK 17 or newer. 4.8.195 is a bugfix release on the 4.x maintenance branch, and continues the file-by-file audit that produced 4.8.190 through 4.8.194. As before, most of the bugs listed here were found by Claude through careful code analysis, and were fixed on the v5 branch and backported to v4.

The themes this time are a scan that can never finish, temporary files that were left behind or misnamed, classpath entries that were silently dropped, and a set of correctness fixes in the class graph itself.

New API

  • ClassGraph#setWorkerTimeout(long, TimeUnit). Every Future#get() call in the scanner now has a timeout, so a scan that can never finish reports why instead of hanging. The two known causes are the classloading deadlock of #933, and a worker thread blocking on a filesystem or network read of a classpath element — a stalled HTTP server serving a remote jarfile, for instance. The timeout defaults to one minute, so a scan that previously blocked forever now fails with an exception naming the reason. A timeout of zero or less waits indefinitely, which is the previous behavior.

Bug fixes: scans that never return

  • The call stack and the context classloader were read on a worker thread during scanAsync(). The Scanner was constructed inside the task submitted to the ExecutorService, so the call stack that ClassGraph reads to find classloaders, and the thread context classloader it uses, were those of a pool thread rather than of the caller. They are now read on the calling thread, before anything is submitted.

  • The #933 fallback now works on Java 8, and covers a classloader as well as a static initializer. If the calling thread holds a class loading lock, loading a class on a worker thread deadlocks the scan, so the whole scan is run on the calling thread whatever number of threads was requested, and the frame holding the lock is named in the verbose log. Where StackWalker is not available, the classes declaring the stack frames are taken from the call stack that was already read, so a frame can be matched to its class without loading anything — which is what must not be done while a class loading lock is held.

Bug fixes: temporary files

  • A jarfile whose name contains --- was scanned under a truncated name. ClassGraph names the files it extracts ClassGraph--<random>---<name>, and leafName() treated --- anywhere in a path as that separator. A jarfile genuinely named x---y.jar was therefore reported as y.jar, and that truncated name is what accept and reject criteria are matched against. Worse, a --- in a path inside a jarfile falls after the end of the leafname, so the leafname came back empty and the jar matched no criterion at all and was silently skipped. The separator is now only honored in a leafname that starts with ClassGraph--, and only at the first separator after that prefix.

  • A temporary file that was still memory mapped at the end of a scan was left on disk for the life of the JVM. Below JDK 22 a mapping is dropped by freeing its address range, which cannot be done while the caller can still read a buffer of it, so a file held open by such a view stays mapped after the scan closes. Windows refuses to delete a mapped file, and the retry that closing the scan makes after asking for a garbage collection cannot help either, since the buffer the caller holds is strongly reachable. The file is now deleted when the last view of its mapping is released, rather than being left to the deleteOnExit() hook.

  • A slice or an arena that would not close was not reported. An IOException from a slice that would not close was dropped silently, so a file handle or a mapping that outlived a scan left nothing in the log to explain why a jarfile could not afterwards be deleted or overwritten on Windows; an unchecked failure was not caught at all, and abandoned the rest of the teardown — the slices still to be closed, the inflater recycler, and the temporary files. On JDK 22 and later, an arena that fails to close leaves its file mapped, and that too went unrecorded, so no collection was asked for before the temporary files were deleted.

  • Scanning an exploded module leaked an open directory for the life of the JVM. ModuleReader#list() returns a stream that walks the module's directory tree, and closing that stream is what closes the directories the walk opened. It was collected into a list and dropped without being closed.

Bug fixes: classpath elements that were dropped or duplicated

  • A nested classpath element was missed when a sibling sorted between it and its parent. findNestedClasspathElements() sorts the classpath elements and walks forward from each looking for elements nested within it, stopping at the first element that is not nested. Every character below / sorts before it, so for the base path /a/classes the sibling /a/classes-extra falls between it and /a/classes/sub: the walk stopped at the sibling, the outer element no longer masked the nested one, and the nested element's resources were reported twice.

  • A package root or nested jarfile that exists only under a version prefix could not be found. An entry stored under META-INF/versions/N/ in a multi-release jarfile is served without that prefix, and the base copy it masks is gone from the entry list, so a lookup by the stored name matched nothing: naming app.jar!/WEB-INF/classes on the classpath failed with "Path WEB-INF/classes does not exist in jarfile", and the package root of a war or Spring Boot jar whose classes are versioned was dropped.

  • Version prefixes were resolved in a jarfile that is not multi-release. A jarfile is only multi-release if its manifest carries the Multi-Release key; in one that does not, the JVM reads an entry under META-INF/versions/ from the path it is stored under. The prefix was being stripped from every entry as the central directory was read, which is before the manifest has been parsed, so a "versioned" entry masked the base entry of the same path — the scan reported the versioned entry's content under the base entry's path, and did not report the base entry at all.

  • A classpath entry whose path a URI cannot hold was dropped entirely. When stripping a package root suffix from a URI or URL entry, the resolved path — which is percent-decoded — was parsed back as a URI, and the entry was discarded when neither the bare path nor the file: spelling parsed. A path containing a space took that branch, as did any Windows path, since a backslash is illegal in a URI. It now degrades to the path string, as the File branch already did.

  • A URL that was already percent-encoded was encoded a second time. normalizeURLPath left an http:, https: or jrt: URL alone and then passed it to the encoder written for decoded file paths, so %20 became %2520, the colon before a port number became %3a, and a query string ?v=1&t=2 became %3fv%3d1%26t%3d2 — after which URI#getHost returned null and URI#getPort returned -1, matching nothing that ClassGraph actually fetches. Such a URL is now escaped by a rule that leaves an existing escape alone and encodes only what a URI cannot hold. File paths are unchanged.

Bug fixes: classloader order

  • A classloader appeared in the delegation order once per handler that could handle it. More than one ClassLoaderHandler can handle the same classloader — one that a handler recognizes by name may also extend URLClassLoader — and each is asked for the entries it knows how to read, but the classloader itself was added to the order each time.

  • Two classloaders that claim to be equal collapsed into one. findDefaultClassLoaders() collected classloaders in a LinkedHashSet, so the classes of the one that was dropped were never scanned. Separately, ClassLoaderOrder deduplicated by identity, as it must, but then kept the order in a map keyed by classloader: adding the second of two equal classloaders replaced the handlers of the first rather than appending, so one of the two dropped out of the order and its entries were never found, and the one left behind ran the other one's handlers. This is not hypothetical — TomEE makes an instance of CxfContainerClassLoader equal to the TomEEWebappClassLoader it delegates to (#515).

Bug fixes: zipfile and classfile reading

  • An MS-DOS zip timestamp was read in the default locale's calendar system. The year, month and day of an MS-DOS date are Gregorian, but the conversion built a calendar for the default locale, so under th-TH-u-ca-buddhist or ja-JP-u-ca-japanese an entry timestamped September 2020 was reported as September 1477. Only an entry with no extended timestamp extra field is affected, which is what ZipOutputStream writes when ZipEntry#setTime(long) is the only time that was set.

  • A read into a ByteBuffer that carried a limit from a previous read threw IllegalArgumentException. A read leaves the buffer's limit where it stopped, so a later read starting further into the same buffer positioned past that stale limit — not one of the exceptions InputStream.read(byte[], int, int) is allowed to throw for a valid range. Three of the four readers already opened the limit before positioning; ClassfileReader did not, so the same call sequence failed or succeeded depending on where the content was being read from. The file-channel reader reuses one ByteBuffer across array reads, so array reads through it were affected too.

  • A stream of unknown length was read into a 64MB buffer. The buffer was allocated at maxBufferedJarRAMSize even for a stream holding a few bytes, and a stream whose length hint understated it was spilled to a temporary file rather than read into a larger buffer. The buffer now starts at the length hint, or 16kB when there is no usable hint, and doubles as it fills. A related fix: InputStream#read is allowed to return zero from a read of a non-empty buffer, and that was being treated as a full buffer, doubling the buffer on every such read until it reached the maximum or spilled to disk.

... (truncated)

Commits
  • dac837f [maven-release-plugin] prepare release classgraph-4.8.195
  • dc06d6c Assert the deferred temp file delete unconditionally
  • fd2735a Run the deferred temporary file delete test on Windows too
  • 4b90831 Delete a temporary file whose delete had to wait for the file to be unmapped
  • 5688da6 Retry an interrupted SingletonMap creation instead of poisoning the key
  • fdadbe2 Don't resolve version prefixes in a jar that is not multi-release
  • b965f2c Find a nested classpath entry that exists only under a version prefix
  • ad122a1 Never report a rejected resource from getResourcesWithPathIgnoringAccept
  • 30423ed Stop discarding the cause of an exception that is rethrown
  • 63cd5aa Stop percent-encoding a URL that is already percent-encoded
  • Additional commits viewable in compare view

Updates io.projectreactor.netty:reactor-netty-http from 1.2.8 to 1.3.7

Release notes

Sourced from io.projectreactor.netty:reactor-netty-http's releases.

v1.3.7

Reactor Netty 1.3.7 is part of 2025.0.7 Release Train.

What's Changed

✨ New features and improvements

  • Depend on Reactor Core v3.8.7 by @​violetagg in b0395bec56155b3c6ed9c2a4b2b81ccb857bdcf5, see release notes
  • Depend on Netty v4.2.17.Final by @​violetagg in #4324
  • Add WebSocket client metrics by @​LivingLikeKrillin in #4118
  • Expose pending acquire latencies to custom MeterRegistrar by @​ejhnsn in #4250
  • Reduce per-request CPU in the HTTP/2 connection pool by @​samueldlightfoot in #4297
  • Evaluate the address supplier once in AddressUtils.updatePort by @​samueldlightfoot in #4298
  • Require choice between Forwarded and X-Forwarded headers by @​violetagg in #4312
  • Reuse per-connection address and byte meters in the Micrometer client metrics path by @​samueldlightfoot in #4318
  • Override isH2cUpgrade in Http3Pool to always return false by @​violetagg in #4325
  • Drop the redundant address parameter from the HttpClient recordRead/recordWrite/startWrite by @​violetagg in #4327
  • HttpClient: Add API for configuring max decompression buffer size by @​violetagg in f4ca645c635c392d602c3cae12a4ca74697ae5fd
  • Ensure NonSslRedirectHandler always does a redirect based on HOST header by @​violetagg in 626a6e742d0314c26b2fda5e943382e94afefa31
  • WebSocket: Add API for configuring max decompression buffer size by @​violetagg in 6908378d586989ffceaa4c2f50f407d969016dd9

🐞 Bug fixes

  • Exclude HTTP/2 connections from the pool during the PING liveness check by @​LivingLikeKrillin in #4255
  • Add the liveness check to Http11EvictionPredicate by @​LivingLikeKrillin in #4256
  • Skip SNI lookup completion when the channel is already closed by @​violetagg in #4266
  • Do not capture caller context into pool maintenance tasks by @​hocaron in #4300
  • Fix WebSocket-over-HTTP/2 server metrics gauge accounting on close by @​LivingLikeKrillin in #4302
  • Fix NameResolverProvider#equals/hashCode by @​violetagg in 717381b7054376657753eaee27c6d48a19c7fe68
  • Refactor TracingMapHandle to handle exceptions correctly by @​violetagg in 68561f4889a881a5e72f45e8f20c814adfa05b5f
  • Update proxy handling by @​violetagg in fc98328cf0d4268c22ba17f8cad144e1408ff91f
  • Refine header handling during redirects by @​violetagg in 88adf0cb35e648aa695c22d53efc8ff19c69600f
  • Add back-pressure on pipelined HTTP requests by @​violetagg in dc07b9259bd1f3fb089b1658e62e9be21356e0b6
  • Proxy protocol is not supported for HTTP/3 protocol by @​violetagg in 8d37581255ba2cc3cd2a0c6c5a2ece4af7040115

📖 Documentation

  • Update javadoc for http-to-https redirect by @​violetagg in 74a5524c2f589faa28802790643f5b674025cdb6

New Contributors

Full Changelog: reactor/reactor-netty@v1.3.6...v1.3.7

v1.3.6

Reactor Netty 1.3.6 is part of 2025.0.6 Release Train.

What's Changed

... (truncated)

Commits
  • b0395be [release] Prepare and release 1.3.7
  • c6c86c5 Prepare release/1.3.7 branch
  • 8d37581 Proxy protocol is not supported for HTTP/3 protocol
  • 6908378 Add API for configuring max decompression buffer size
  • 626a6e7 Ensure NonSslRedirectHandler always does a redirect based on HOST header
  • f4ca645 Add API for configuring max decompression buffer size
  • dc07b92 Add back-pressure on pipelined HTTP requests
  • 88adf0c Refine header handling during redirects
  • 74a5524 Update javadoc for http-to-https redirect
  • fc98328 Update proxy handling
  • Additional commits viewable in compare view

Updates io.swagger.core.v3:swagger-annotations from 2.2.54 to 2.2.55

Updates io.nats:jnats from 2.26.2 to 2.26.3

Release notes

Sourced from io.nats:jnats's releases.

2.26.3

Core

JetStream

Service

Test

CI/CD

Changelog

Sourced from io.nats:jnats's changelog.

2.26.3

Core

JetStream

Service

Test

CI/CD

Commits
  • 914e69d Merge pull request #1628 from nats-io/fast-ingest-constants
  • ed8d4e3 address review
  • b86eb79 Support ADR 50 Fast Ingest with constants
  • f83ba05 Merge pull request #1624 from nats-io/ack-policy-flow-control
  • 6ff5135 Support ADR 60 Ack Policy Flow Control
  • 7d69e18 Merge pull request #1623 from nats-io/2-15-max-consumers
  • 0280859 Fix test to respect server 2.15 change to max_consumers behavior
  • 1c63577 Merge pull request #1622 from nats-io/bcprov-2-73-12-1
  • e39c08a test connecting to demo must be done over tls
  • bb51217 Update org.bouncycastle:bcprov-lts8on
  • Additional commits viewable in compare view

Updates io.swagger.parser.v3:swagger-parser from 2.1.47 to 2.1.48

Release notes

Sourced from io.swagger.parser.v3:swagger-parser's releases.

Swagger-parser 2.1.48 released!

  • Fix: resolution of external refs inside path items with templated fragments (#2033) (#2394)
  • fix: Fix relative references inside external path items (#1948, #2066) (#2393)
  • chore: update dependency-check-maven to 12.2.2 (#2387)
  • fix: Inlining of references with dot (#2109) (#2384)
  • fix: Fix duplicate schemas from root document back-references (#1961) (#2383)
  • fix: External Refs with same name are ignored (#2055) (#2382)
  • build(deps): bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 (#2379)
  • build(deps-dev): bump org.apache.maven.plugins:maven-compiler-plugin from 3.11.0 to 3.15.0 (#2378)
  • build(deps): bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 (#2377)
  • build(deps): bump swagger-core-version from 2.2.52 to 2.2.53 (#2376)
Commits
  • a982879 prepare release 2.1.48 (#2397)
  • 28b1a73 Fix: resolution of external refs inside path items with templated fragments (...
  • b2a9955 fix: Fix relative references inside external path items (#1948, #2066) (#2393)
  • f23d962 chore: update dependabot to 12.2.2 (#2387)
  • d3398c8 fix: Inlining of references with dot (#2109) (#2384)
  • 0255d18 fix: Fix duplicate schemas from root document back-references (#1961) (#2383)
  • 2242451 build(deps): bump org.apache.maven.plugins:maven-jar-plugin (#2379)
  • 8b683a9 build(deps-dev): bump org.apache.maven.plugins:maven-compiler-plugin (#2378)
  • 9804796 build(deps): bump org.apache.maven.plugins:maven-surefire-plugin (#2377)
  • aea5c1e build(deps): bump swagger-core-version from 2.2.52 to 2.2.53 (#2376)
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0

Release notes

Sourced from org.apache.maven.plugins:maven-compiler-plugin's releases.

3.16.0

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

📦 Dependency updates

Commits
  • e7bba6e [maven-release-plugin] prepare release maven-compiler-plugin-3.16.0
  • c906809 Avoid using deprecated method CompilerConfiguration.setCompilerVersion
  • ad74fee Replace adopt-openj9 by semeru JDK distribution on GH
  • beb0eda Recompile when dependencies change (#1102)
  • a0b689e [MCOMPILER-578] Track outputs across compiler executions (#1091)
  • 2e81228 Fix incremental detection of empty sources, 3.x (#1075)
  • 2132f5b configure ATR project
  • 5992b77 Build fails when annotation processor list is empty (but present) (#1077)
  • acccef7 Bump plexusCompilerVersion from 2.16.2 to 2.17.0
  • 72bc445 Bump org.codehaus.plexus:plexus-java from 1.5.2 to 1.6.0
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0

Release notes

Sourced from org.apache.maven.plugins:maven-surefire-plugin's releases.

3.6.0

Please refer to the main page for what's new https://maven.apache.org/surefire/ And the migration page https://maven.apache.org/surefire/maven-surefire-plugin/whats-new-3-6-0.html

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

... (truncated)

Commits
  • 0ff622b [maven-release-plugin] prepare release surefire-3.6.0
  • bb3932a Let's go for 3.6.0 release
  • 3002a16 Bump mavenVersion from 3.9.14 to 3.9.16
  • 61a531d Bump Maven parent version from 47 to 49 (#3449)
  • e52ead4 [SUREFIRE-523] Link all reported tests to source XRef (#3445)
  • 45102fa [SUREFIRE-3446] Fix direct selection of JUnit Jupiter @​Nested classes (#3447)
  • b2e1f70 Fix #3303: distinguish JUnit 6 ParameterizedClass invocations (#3432)
  • c051938 Discover tests in a fork when a toolchain JDK is used (#3444)
  • db75df8 Bump org.codehaus.plexus:plexus-java from 1.5.2 to 1.6.0 (#3441)
  • 77f2759 Bump org.codehaus.plexus:plexus-interpolation from 1.29 to 1.30.0
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-failsafe-plugin from 3.5.6 to 3.6.0

Release notes

Sourced from org.apache.maven.plugins:maven-failsafe-plugin's releases.

3.6.0

Please refer to the main page for what's new https://maven.apache.org/surefire/ And the migration page https://maven.apache.org/surefire/maven-surefire-plugin/whats-new-3-6-0.html

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

  • Magnify the home, well at least have something rather than nothing :) (#3377) @​olamy
  • Restore the straight quotes the FAQ conversion turned typographic (

@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 1…
0b5ec5d 
…1 updates

Bumps the minor-and-patch group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [io.github.classgraph:classgraph](https://github.com/classgraph/classgraph) | `4.8.194` | `4.8.195` |
| [io.projectreactor.netty:reactor-netty-http](https://github.com/reactor/reactor-netty) | `1.2.8` | `1.3.7` |
| io.swagger.core.v3:swagger-annotations | `2.2.54` | `2.2.55` |
| [io.nats:jnats](https://github.com/nats-io/nats.java) | `2.26.2` | `2.26.3` |
| [io.swagger.parser.v3:swagger-parser](https://github.com/swagger-api/swagger-parser) | `2.1.47` | `2.1.48` |
| [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) | `3.15.0` | `3.16.0` |
| [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.5.6` | `3.6.0` |
| [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire) | `3.5.6` | `3.6.0` |
| [org.apache.maven.plugins:maven-clean-plugin](https://github.com/apache/maven-clean-plugin) | `3.2.0` | `3.5.0` |
| [org.apache.maven.plugins:maven-resources-plugin](https://github.com/apache/maven-resources-plugin) | `3.3.1` | `3.5.0` |
| org.apache.maven:apache-maven | `3.9.12` | `3.9.16` |



Updates `io.github.classgraph:classgraph` from 4.8.194 to 4.8.195
- [Release notes](https://github.com/classgraph/classgraph/releases)
- [Commits](classgraph/classgraph@classgraph-4.8.194...classgraph-4.8.195)

Updates `io.projectreactor.netty:reactor-netty-http` from 1.2.8 to 1.3.7
- [Release notes](https://github.com/reactor/reactor-netty/releases)
- [Commits](reactor/reactor-netty@v1.2.8...v1.3.7)

Updates `io.swagger.core.v3:swagger-annotations` from 2.2.54 to 2.2.55

Updates `io.nats:jnats` from 2.26.2 to 2.26.3
- [Release notes](https://github.com/nats-io/nats.java/releases)
- [Changelog](https://github.com/nats-io/nats.java/blob/main/CHANGELOG.md)
- [Commits](nats-io/nats.java@2.26.2...2.26.3)

Updates `io.swagger.parser.v3:swagger-parser` from 2.1.47 to 2.1.48
- [Release notes](https://github.com/swagger-api/swagger-parser/releases)
- [Commits](swagger-api/swagger-parser@v2.1.47...v2.1.48)

Updates `org.apache.maven.plugins:maven-compiler-plugin` from 3.15.0 to 3.16.0
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.15.0...maven-compiler-plugin-3.16.0)

Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.5.6 to 3.6.0
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.5.6...surefire-3.6.0)

Updates `org.apache.maven.plugins:maven-failsafe-plugin` from 3.5.6 to 3.6.0
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.5.6...surefire-3.6.0)

Updates `org.apache.maven.plugins:maven-clean-plugin` from 3.2.0 to 3.5.0
- [Release notes](https://github.com/apache/maven-clean-plugin/releases)
- [Commits](apache/maven-clean-plugin@maven-clean-plugin-3.2.0...maven-clean-plugin-3.5.0)

Updates `org.apache.maven.plugins:maven-resources-plugin` from 3.3.1 to 3.5.0
- [Release notes](https://github.com/apache/maven-resources-plugin/releases)
- [Commits](apache/maven-resources-plugin@maven-resources-plugin-3.3.1...maven-resources-plugin-3.5.0)

Updates `org.apache.maven:apache-maven` from 3.9.12 to 3.9.16

---
updated-dependencies:
- dependency-name: io.github.classgraph:classgraph
  dependency-version: 4.8.195
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: io.projectreactor.netty:reactor-netty-http
  dependency-version: 1.3.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: io.swagger.core.v3:swagger-annotations
  dependency-version: 2.2.55
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: io.nats:jnats
  dependency-version: 2.26.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: io.swagger.parser.v3:swagger-parser
  dependency-version: 2.1.48
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-version: 3.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-version: 3.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-failsafe-plugin
  dependency-version: 3.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-clean-plugin
  dependency-version: 3.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: org.apache.maven.plugins:maven-resources-plugin
  dependency-version: 3.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: org.apache.maven:apache-maven
  dependency-version: 3.9.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added chore CI/CD, tooling, infrastructure, repo configuration dependencies Pull requests that update a dependency file labels Sep 16, 2026
@coderabbitai

coderabbitai Bot commented Sep 16, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: e3ed9797-9432-4ddb-be44-7f7447a45b30

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Sep 16, 2026

Copy link
Copy Markdown

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
maven/io.github.classgraph:classgraph 4.8.195 🟢 4.5
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 29 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
SAST🟢 10SAST tool detected: CodeQL
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
maven/io.nats:jnats 2.26.3 🟢 6.3
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 9binaries present in source code
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy⚠️ 0security policy file not detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 10SAST tool is run on all commits
Packaging🟢 10packaging workflow detected
maven/io.projectreactor.netty:reactor-netty-http 1.3.7 🟢 7.6
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 1Found 4/25 approved changesets -- score normalized to 1
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits
Packaging🟢 10packaging workflow detected
Binary-Artifacts🟢 9binaries present in source code
maven/io.swagger.core.v3:swagger-annotations 2.2.55 🟢 7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 9binaries present in source code
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy⚠️ 0security policy file not detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging🟢 10packaging workflow detected
SAST🟢 10SAST tool is run on all commits
maven/io.swagger.parser.v3:swagger-parser 2.1.48 🟢 6.3
Details
CheckScoreReason
Code-Review🟢 9Found 10/11 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy⚠️ 0security policy file not detected
Packaging🟢 10packaging workflow detected
SAST🟢 10SAST tool is run on all commits
maven/org.apache.maven.plugins:maven-clean-plugin 3.5.0 UnknownUnknown
maven/org.apache.maven.plugins:maven-compiler-plugin 3.16.0 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 6Found 14/22 approved changesets -- score normalized to 6
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.apache.maven.plugins:maven-failsafe-plugin 3.6.0 🟢 5.6
Details
CheckScoreReason
Code-Review🟢 5Found 14/25 approved changesets -- score normalized to 5
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.apache.maven.plugins:maven-resources-plugin 3.5.0 🟢 5.2
Details
CheckScoreReason
Maintained🟢 1024 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 2Found 3/12 approved changesets -- score normalized to 2
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.apache.maven.plugins:maven-surefire-plugin 3.6.0 🟢 5.6
Details
CheckScoreReason
Code-Review🟢 5Found 14/25 approved changesets -- score normalized to 5
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • pom.xml

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ginccc ginccc Awaiting requested review from ginccc ginccc is a code owner
@rolandpickl rolandpickl Awaiting requested review from rolandpickl rolandpickl is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

chore CI/CD, tooling, infrastructure, repo configuration dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants