FINERACT-2684: Update all non-major dependencies by renovate-bot · Pull Request #6275 · apache/fineract

renovate-bot · 2026-08-17T00:39:01Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
apache/kafka		minor	`4.2.0-rc2` → `4.4.0-rc2`
gradle (source)		minor	`9.7.1` → `9.8.0`
localstack/localstack		minor	`2.1` → `2.3`
mariadb (source)		minor	`12.2` → `12.3`
postgres (source)	service	minor	`18.3` → `18.6`
tomcat (source)		patch	`10.1.59-jdk25-temurin` → `10.1.60-jdk25-temurin`
at.yawk.lz4:lz4-java	devDependencies	minor	`1.11.0` → `1.12.0`
io.netty:netty-transport-native-unix-common (source)	devDependencies	minor	`4.1.135.Final` → `4.2.18.Final`
io.netty:netty-transport-classes-epoll (source)	devDependencies	minor	`4.1.135.Final` → `4.2.18.Final`
io.netty:netty-transport (source)	devDependencies	minor	`4.1.135.Final` → `4.2.18.Final`
io.netty:netty-resolver (source)	devDependencies	minor	`4.1.135.Final` → `4.2.18.Final`
io.netty:netty-handler-proxy (source)	devDependencies	minor	`4.1.135.Final` → `4.2.18.Final`
io.netty:netty-handler (source)	devDependencies	minor	`4.1.135.Final` → `4.2.18.Final`
io.netty:netty-codec-socks (source)	devDependencies	minor	`4.1.135.Final` → `4.2.18.Final`
io.netty:netty-codec-protobuf (source)	devDependencies	minor	`4.1.135.Final` → `4.2.18.Final`
io.netty:netty-codec-marshalling (source)	devDependencies	minor	`4.1.135.Final` → `4.2.18.Final`
io.netty:netty-codec-http2 (source)	devDependencies	minor	`4.1.135.Final` → `4.2.18.Final`
io.netty:netty-codec-http (source)	devDependencies	minor	`4.1.135.Final` → `4.2.18.Final`
io.netty:netty-codec-compression (source)	devDependencies	minor	`4.1.135.Final` → `4.2.18.Final`
io.netty:netty-codec-base (source)	devDependencies	minor	`4.1.135.Final` → `4.2.18.Final`
io.netty:netty-codec (source)	devDependencies	minor	`4.1.135.Final` → `4.2.18.Final`
io.netty:netty-common (source)	devDependencies	minor	`4.1.135.Final` → `4.2.18.Final`
io.netty:netty-buffer (source)	devDependencies	minor	`4.1.135.Final` → `4.2.18.Final`
com.nimbusds:nimbus-jose-jwt	devDependencies	minor	`10.9` → `10.10`
io.cucumber:cucumber-spring (source)	devDependencies	patch	`7.34.3` → `7.34.9`
io.cucumber:cucumber-junit-platform-engine (source)	devDependencies	patch	`7.34.3` → `7.34.9`
io.cucumber:cucumber-java8 (source)	devDependencies	patch	`7.34.3` → `7.34.9`
io.cucumber:cucumber-java (source)	devDependencies	patch	`7.34.3` → `7.34.9`
org.apache.sshd:sshd-core (source)	devDependencies	minor	`2.17.1` → `2.19.0`
org.apache.sshd:sshd-common (source)	devDependencies	minor	`2.17.1` → `2.19.0`
org.postgresql:postgresql (source)	devDependencies	patch	`42.7.11` → `42.7.13`
org.mariadb.jdbc:mariadb-java-client (source)	devDependencies	patch	`3.5.8` → `3.5.10`
org.apache.avro:avro (source)	devDependencies	patch	`1.12.1` → `1.12.2`
org.hibernate.validator:hibernate-validator (source)	devDependencies	patch	`9.1.0.Final` → `9.1.4.Final`
io.swagger.core.v3:swagger-core-jakarta	devDependencies	patch	`2.2.49` → `2.2.55`
io.swagger.core.v3:swagger-jaxrs2-jakarta	devDependencies	patch	`2.2.49` → `2.2.55`
io.swagger.core.v3:swagger-annotations-jakarta	devDependencies	patch	`2.2.49` → `2.2.55`
org.apache.activemq:activemq-client (source)	devDependencies	minor	`6.2.5` → `6.3.2`
org.springdoc:springdoc-openapi-starter-webmvc-ui (source)	devDependencies	minor	`3.0.3` → `3.1.1`
org.eclipse.jgit:org.eclipse.jgit.ssh.apache	devDependencies	minor	`7.6.0.202603022253-r` → `7.8.0.202609011348-r`
org.eclipse.jgit:org.eclipse.jgit.gpg.bc	devDependencies	minor	`7.6.0.202603022253-r` → `7.8.0.202609011348-r`
org.eclipse.jgit:org.eclipse.jgit	devDependencies	minor	`7.6.0.202603022253-r` → `7.8.0.202609011348-r`
org.bouncycastle:bcpg-jdk18on (source)	devDependencies	minor	`1.84` → `1.86`
org.bouncycastle:bcutil-jdk18on (source)	devDependencies	minor	`1.84` → `1.86`
org.bouncycastle:bcprov-jdk18on (source)	devDependencies	minor	`1.84` → `1.86`
org.bouncycastle:bcpkix-jdk18on (source)	devDependencies	minor	`1.84` → `1.86`
org.projectlombok:lombok (source)	devDependencies	patch	`1.18.46` → `1.18.48`
commons-codec:commons-codec (source)	devDependencies	patch	`1.22.0` → `1.22.1`
org.mock-server:mockserver-junit-jupiter (source)	devDependencies	minor	`5.14.0` → `5.15.0`
com.github.spotbugs:spotbugs-annotations (source)	devDependencies	minor	`4.9.8` → `4.10.4`
io.github.classgraph:classgraph	devDependencies	patch	`4.8.184` → `4.8.196`
joda-time:joda-time (source)	devDependencies	patch	`2.14.2` → `2.14.4`
org.apache.httpcomponents.core5:httpcore5-h2 (source)	devDependencies	patch	`5.4` → `5.4.4`
org.apache.httpcomponents.core5:httpcore5 (source)	devDependencies	patch	`5.4` → `5.4.4`
org.apache.tika:tika-parser-image-module (source)	devDependencies	patch	`3.3.0` → `3.3.2`
com.gradleup.shadow	plugin	minor	`9.4.1` → `9.6.1`
org.openapi.generator	plugin	minor	`7.22.0` → `7.25.0`
com.github.spotbugs	plugin	patch	`6.5.4` → `6.5.12`
com.github.andygoossens.modernizer	plugin	minor	`1.13.0` → `1.15.0`
com.google.cloud.tools.jib	plugin	patch	`3.5.3` → `3.5.4`
org.apache.tika:tika-parser-microsoft-module (source)	devDependencies	patch	`3.3.0` → `3.3.2`
io.swagger.core.v3.swagger-gradle-plugin	plugin	patch	`2.2.49` → `2.2.55`
org.springframework.boot	plugin	patch	`4.1.0` → `4.1.1`
org.zeroturnaround.gradle.jrebel	plugin	patch	`1.2.2` → `1.2.3`
org.nosphere.apache.rat	plugin	minor	`0.8.1` → `0.11.0`
com.diffplug.spotless	plugin	patch	`8.10.2` → `8.10.3`
org.apache.tika:tika-parser-miscoffice-module (source)	devDependencies	patch	`3.3.0` → `3.3.2`
org.apache.tika:tika-core (source)	devDependencies	patch	`3.3.0` → `3.3.2`
com.github.librepdf:openpdf	devDependencies	patch	`3.0.4` → `3.0.5`
software.amazon.msk:aws-msk-iam-auth (source)	devDependencies	patch	`2.3.6` → `2.3.9`
org.apache.commons:commons-collections4 (source)	devDependencies	minor	`4.5.0` → `4.6.0`
com.google.googlejavaformat:google-java-format	devDependencies	minor	`1.35.0` → `1.36.1`
com.google.guava:guava	devDependencies	minor	`33.6.0-jre` → `33.7.1-jre`
org.eclipse.persistence:org.eclipse.persistence.jpa (source)	devDependencies	patch	`5.0.1` → `5.0.2`
ch.qos.logback:logback-classic (source, changelog)	devDependencies	minor	`1.5.35` → `1.6.4`
ch.qos.logback:logback-core (source, changelog)	devDependencies	minor	`1.5.35` → `1.6.4`
software.amazon.awssdk:bom	devDependencies	minor	`2.44.4` → `2.55.6`
org.mockito:mockito-bom	devDependencies	minor	`5.23.0` → `5.24.0`
io.cucumber:cucumber-bom (source)	devDependencies	patch	`7.34.3` → `7.34.9`
com.fasterxml.jackson:jackson-bom	devDependencies	patch	`2.22.1` → `2.22.3`
org.junit:junit-bom (source)	devDependencies	minor	`6.0.3` → `6.1.3`
org.jetbrains.kotlin:kotlin-bom (source)	devDependencies	minor	`2.3.21` → `2.4.20`
io.opentelemetry:opentelemetry-bom	devDependencies	minor	`1.62.0` → `1.66.0`
io.awspring.cloud:spring-cloud-aws-dependencies (source)	devDependencies	minor	`4.0.2` → `4.1.1`
org.springframework.boot:spring-boot-dependencies (source)	devDependencies	patch	`4.1.0` → `4.1.1`
io.micrometer:micrometer-bom	devDependencies	minor	`1.16.5` → `1.17.1`
org.slf4j:slf4j-bom (source, changelog)	devDependencies	patch	`2.0.17` → `2.0.20`
io.qameta.allure	plugin	minor	`4.1.0` → `4.3.0`

Release Notes

apache/kafka (apache/kafka)

`v4.3.1`

Compare Source

`v4.3.0`

Compare Source

gradle/gradle (gradle)

`v9.8.0`

Compare Source

yawkat/lz4-java (at.yawk.lz4:lz4-java)

`v1.12.0`: lz4-java v1.12.0

Compare Source

Note that lz4-java v1.11.4, also released today, contains security fixes. This minor release contains some additional tightening of input validation that could in theory be breaking but should be fine for most if not all users. I recommend you upgrade to 1.12.0, but 1.11.4 is an option if that breaks.

What's Changed

Render README tables on the website by @yawkat in #150
Throw IOException for invalid or unsupported frame descriptors by @yawkat in #133
Replace Codecov with a coverage badge from the documentation site by @yawkat in #151
Reject short output in LZ4DecompressorWithLength safe paths by @yawkat in #126
Make stream failures sticky in LZ4FrameInputStream and LZ4BlockInputStream by @yawkat in #145

Full Changelog: yawkat/lz4-java@v1.11.4...v1.12.0

`v1.11.4`: lz4-java v1.11.4

Compare Source

Security release for GHSA-gm45-99xc-r7wv, GHSA-343h-94h5-c4wr and GHSA-mcr4-qmvw-px4g. Also includes general fixes for bugs found by AI.

What's Changed

Update astral-sh/setup-uv action to v10.2.0 by @renovate[bot] in #97
Update dependency com.carrotsearch.randomizedtesting:randomizedtesting-runner to v2.9.2 by @renovate[bot] in #98
Update cloudflare/wrangler-action digest to 953926a by @renovate[bot] in #99
Fix NPE in LZ4FrameInputStream on skippable-only streams by @yawkat in #125
Release source critical array before throwing OOM in LZ4JNI by @yawkat in #124
Fix stale OutOfMemoryError reference in XXHashJNI by @yawkat in #127
Reject truncated block header in LZ4BlockInputStream by @yawkat in #128
Don't restore the Maven cache in the release workflow by @yawkat in #132
Read skippable frame size as unsigned in LZ4FrameInputStream by @yawkat in #131
Only run test workflow on push to main by @yawkat in #136
Document CPU cost of high HC compression levels by @yawkat in #141
Fix int overflow in streaming XXHash update buffering check by @yawkat in #138
docs: declare requires-python >= 3.12 in justfile scripts by @yawkat in #130
Make docs manual-dispatch deploy branch explicit by @yawkat in #137
Switch Maven wrapper to script-only and use strict checksums in CI by @yawkat in #144
Verify SHA-256 of lz4 CLI downloaded in Windows release job by @yawkat in #134
docs: validate version input and tag names before interpolating them by @yawkat in #142
Test safe decompressors with destination offsets and buffer kinds by @yawkat in #146
Document that StreamingXXHash32.asChecksum() returns only 28 bits by @yawkat in #140
Declare explicit GITHUB_TOKEN permissions in workflows by @yawkat in #135
Only publish to Central from v* tags by @yawkat in #139
Test the darwin/aarch64 native library before publishing by @yawkat in #143
Fix negative LZ4BlockInputStream.available() after an empty block by @yawkat in #129
Delete .clinerules by @yawkat in #148
Rework README, add contributing guide, Scorecard and coverage by @yawkat in #147
Fix test compilation on main: remove duplicate testAvailableAfterEmptyBlock by @yawkat in #149

Full Changelog: yawkat/lz4-java@v1.11.3...v1.11.4

`v1.11.3`: lz4-java v1.11.3

Not a security release. This is the second attempt at this release due to a javadoc issue.

What's Changed

Update junit-framework monorepo to v6.1.3 by @renovate[bot] in #80
Update workflows to Java 25 by @yawkat in #82
Update dependency org.apache.maven.plugins:maven-javadoc-plugin to v3.12.0 by @renovate[bot] in #68
Update astral-sh/setup-uv action to v10 by @renovate[bot] in #84
Update dependency org.apache.maven.plugins:maven-compiler-plugin to v3.16.0 by @renovate[bot] in #89
Update dependency org.mvel:mvel2 to v2.5.4.Final by @renovate[bot] in #88
Update astral-sh/setup-uv action to v10.1.0 by @renovate[bot] in #85
Update bnd.maven.plugin.version to v7.4.0 by @renovate[bot] in #86
Update dependency org.codehaus.mojo:build-helper-maven-plugin to v3.6.2 by @renovate[bot] in #92
Make default decompression limit configurable by @yawkat in #93
Restore Javadoc output directory by @yawkat in #95

Full Changelog: yawkat/lz4-java@v1.11.2...v1.11.3

`v1.11.2`: lz4-java v1.11.2

Security release for GHSA-6cx8-rjf8-pr8g and GHSA-4v53-57pg-c464.

What's Changed

Update bnd.maven.plugin.version to v7.3.0 by @renovate[bot] in #59
Update dependency me.qoomon:maven-git-versioning-extension to v9.12.1 by @renovate[bot] in #62
Update dependency com.carrotsearch.randomizedtesting:randomizedtesting-runner to v2.9.1 by @renovate[bot] in #60
Update dependency maven to v3.9.16 by @renovate[bot] in #57
Update dependency com.code-intelligence:jazzer-junit to v0.30.0 by @renovate[bot] in #61
Pin dependencies by @renovate[bot] in #56
Update dependency org.codehaus.mojo:build-helper-maven-plugin to v3.6.1 by @renovate[bot] in #64
Update dependency maven-wrapper to v3.3.4 by @renovate[bot] in #63
Update dependency org.apache.maven.plugins:maven-source-plugin to v3.4.0 by @renovate[bot] in #69
Update actions/checkout action to v7 by @renovate[bot] in #74
Update junit-framework monorepo by @renovate[bot] in #72
Update dependency org.apache.maven.plugins:maven-antrun-plugin to v3.2.0 by @renovate[bot] in #65
Update dependency org.sonatype.central:central-publishing-maven-plugin to v0.11.0 by @renovate[bot] in #71
Update dependency org.apache.maven.plugins:maven-compiler-plugin to v3.15.0 by @renovate[bot] in #66
Update dependency org.apache.maven.plugins:maven-jar-plugin to v3.5.1 by @renovate[bot] in #67
Update dependency org.apache.maven.plugins:maven-surefire-plugin to v3.5.6 by @renovate[bot] in #70
Update dependency org.apache.maven.plugins:maven-gpg-plugin to v3 by @renovate[bot] in #77
Update GitHub Artifact Actions (major) by @renovate[bot] in #78
Update junit-framework monorepo to v6 by @renovate[bot] in #79
Update cloudflare/wrangler-action action to v4 by @renovate[bot] in #76
Update astral-sh/setup-uv action to v9 by @renovate[bot] in #75
Update 8BitJonny/gh-get-current-pr action to v4 by @renovate[bot] in #73

New Contributors

@renovate[bot] made their first contribution in #59

Full Changelog: yawkat/lz4-java@v1.11.1...v1.11.2

`v1.11.1`: lz4-java v1.11.1

Security release for CVE-2026-59949.

What's Changed

Fix docs code block line breaks by @yawkat in #52

Full Changelog: yawkat/lz4-java@v1.11.0...v1.11.1

connect2id/nimbus-jose-jwt (com.nimbusds:nimbus-jose-jwt)

`v10.10`

Compare Source

`v10.9.1`

Compare Source

cucumber/cucumber-jvm (io.cucumber:cucumber-spring)

`v7.34.9`

Fixed

[Core] Update dependency io.cucumber:messages-ndjson to v0.3.7
[Core] Update dependency com.fasterxml.jackson:jackson-bom to v2.22.3

`v7.34.8`

Fixed

[TestNG] AbstractTestNGCucumberTests.scenarios() throws without setup (#3235)

`v7.34.7`

Fixed

[Core] Update dependency io.cucumber:messages-ndjson to v0.3.6
[Core] Update dependency com.fasterxml.jackson:jackson-bom to v2.22.2

`v7.34.6`

Fixed

[JUnit Platform Engine] Do not fail discovery on an empty rerun file with JUnit Platform 6.1.x (#3216)

`v7.34.5`

Fixed

[Core] Update dependency io.cucumber:messages-ndjson to v0.3.5
[Core] Update dependency com.fasterxml.jackson:jackson-bom to v2.22.1

`v7.34.4`

Fixed

[Core] Update dependency io.cucumber:messages-ndjson to v0.3.4
[Core] Update dependency com.fasterxml.jackson:jackson-bom to v2.22.0

pgjdbc/pgjdbc (org.postgresql:postgresql)

`v42.7.13`

Added

feat: invalidate the prepared-statement cache when the server reports a search_path change via GUC_REPORT (PostgreSQL 18+), so cached plans are no longer used against the wrong schema PR #4259
feat: reWriteBatchedInserts now merges up to 32768 rows into one multi-values INSERT (bounded by the 65535 bind-parameter limit on the extended protocol) instead of capping at 128, which speeds up batches of few-column rows. The new reWriteBatchedInsertsSize connection property lowers that cap when set; the default of 0 uses that maximum. PR #4207
feat: invalidate the prepared-statement cache after CREATE/DROP/ALTER so callers no longer trip on "cached plan must not change result type" without opting into autosave=ALWAYS. Controlled by the new flushCacheOnDdl connection property (default true); set to false for the prior behaviour. PR #4067
feat: add connectExecutor connection property to customize the Executor used to run the worker task that performs the connection attempt when loginTimeout is in effect. The value is the fully qualified name of a class implementing java.util.concurrent.Executor. With a null value, the default, the driver retains the prior behavior of running the connection attempt on a daemon thread named "PostgreSQL JDBC driver connection thread". The executor must run the task on a thread other than the caller's. Running the attempt on a named thread lets applications that monitor driver-created threads identify it. PR #4165
feat: add classLoaderStrategy connection property to control which classloaders the driver searches when loading a class named by a connection property, for example socketFactory. The default driver-first now falls back to the thread context classloader when the driver's classloader cannot resolve the class, which fixes class loading in non-flat class paths such as Quarkus and OSGi. Set driver to keep the previous driver-classloader-only behaviour, or context-first to prefer the thread context classloader Issue #2112 PR #4167
feat: add OID constants for geometric arrays, RECORD, and refcursor PR #4220
feat: LargeObject BlobInputStream now skips by seeking instead of reading, and the driver exposes the server version so it can select the 64-bit large-object API where available PR #4204

Changed

refactor: the worker that runs the connection attempt under loginTimeout is now a FutureTask (ConnectTask) instead of the hand-rolled ConnectThread. When the caller hits the timeout, the task is now cancelled with cancel(true), which interrupts the worker thread rather than letting it run to completion. This makes the connec

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

forking-renovate Bot added the renovate https://renovate.whitesourcesoftware.com [FINERACT-962] label Aug 17, 2026

renovate-bot force-pushed the renovate/all-minor-patch branch 13 times, most recently from b3163ab to cfa7cc9 Compare August 24, 2026 09:21

renovate-bot force-pushed the renovate/all-minor-patch branch 12 times, most recently from f234df3 to 5ab6be4 Compare September 1, 2026 02:16

renovate-bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 4819c41 to 9bb73ce Compare September 3, 2026 01:31

renovate-bot force-pushed the renovate/all-minor-patch branch 18 times, most recently from e30e53a to 1a36ada Compare September 15, 2026 12:09

renovate-bot force-pushed the renovate/all-minor-patch branch 11 times, most recently from a5aa920 to ef04341 Compare September 21, 2026 11:56

FINERACT-2684: Update all non-major dependencies

9d60cbe

Navigation Menu

FINERACT-2684: Update all non-major dependencies - #6275

FINERACT-2684: Update all non-major dependencies#6275
renovate-bot wants to merge 1 commit into
apache:developfrom
renovate-bot:renovate/all-minor-patch

renovate-bot commented Aug 17, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate-bot commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.12.0: lz4-java v1.12.0

What's Changed

v1.11.4: lz4-java v1.11.4

What's Changed

v1.11.3: lz4-java v1.11.3

What's Changed

v1.11.2: lz4-java v1.11.2

What's Changed

New Contributors

v1.11.1: lz4-java v1.11.1

What's Changed

Fixed

Fixed

Fixed

Fixed

Fixed

Fixed

Added

Changed

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate-bot commented Aug 17, 2026 •

edited

Loading

`v1.12.0`: lz4-java v1.12.0

`v1.11.4`: lz4-java v1.11.4

`v1.11.3`: lz4-java v1.11.3

`v1.11.2`: lz4-java v1.11.2

`v1.11.1`: lz4-java v1.11.1