FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Bump the maven-dependencies group across 1 directory with 8 updates by dependabot[bot] · Pull Request #4292 · cryptomator/cryptomator · GitHub

/ cryptomator Public

Bump the maven-dependencies group across 1 directory with 8 updates - #4292

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/maven/maven-dependencies-d571b72ff3
ConversationCommits (1)ChecksFiles changed
Open

Bump the maven-dependencies group across 1 directory with 8 updates#4292
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/maven/maven-dependencies-d571b72ff3

Conversation

dependabot Bot commented on behalf of github Aug 18, 2026

Copy link
Copy Markdown
Contributor

Bumps the maven-dependencies group with 8 updates in the / directory:

Package From To
ch.qos.logback:logback-core 1.5.35 1.6.3
ch.qos.logback:logback-classic 1.5.35 1.6.3
com.auth0:java-jwt 4.5.2 4.6.0
com.google.dagger:dagger 2.59.2 2.60.1
com.google.dagger:dagger-compiler 2.59.2 2.60.1
org.junit.jupiter:junit-jupiter 6.1.0 6.1.3
org.apache.maven.plugins:maven-jar-plugin 3.5.0 3.5.1
org.owasp:dependency-check-maven 12.2.2 13.0.0

Updates ch.qos.logback:logback-core from 1.5.35 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-core's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

  • In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

  • Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

  • The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

  • ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

  • Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

  • The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

  • Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

  • Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

    <property name="logback.skipCallerContradictionAnalysis" value="true"/>

  • SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

  • Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

  • Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

  • Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

• On GZ, ZIP, or XZ compression failure, the original (uncompressed) log file is no longer deleted. Compression strategies now delete the source file only after successful compression and emit a warning that the original was left intact.

• ConsoleAppender with now probes JLine's org.jline.jansi.AnsiConsole first and falls back to the legacy FuseSource org.fusesource.jansi.AnsiConsole class. This keeps ANSI coloring working after Jansi moved under the JLine project. The optional org.jline:jansi-core artifact is declared as a dependency alongside the existing FuseSource jansi dependency. A preferredJansiClassName property was added for tests. This issue was reported in issues/1043 by seonwoo_jung who also provided the relevant PR.

... (truncated)

Commits
  • e8e824d prepare release 1.6.3
  • 761821b MDCBasedDiscriminator has a gated warning mechanism
  • 53ed122 update copyright year
  • c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
  • b5aa931 added BatchedSimpleInvocationGate
  • 1f22af7 add javadocs to SimpleInvocationGate
  • 638ffa7 prevent forward and backward slashes to escape to other directories
  • 7d6b9a4 add missing ch.qos.logback.core.property package
  • fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
  • c73b43f deprecate the withJansi path
  • Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.5.35 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

  • In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

  • Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

  • The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

  • ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

  • Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

  • The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

  • Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

  • Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

    <property name="logback.skipCallerContradictionAnalysis" value="true"/>

  • SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

  • Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

  • Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

  • Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

• On GZ, ZIP, or XZ compression failure, the original (uncompressed) log file is no longer deleted. Compression strategies now delete the source file only after successful compression and emit a warning that the original was left intact.

• ConsoleAppender with now probes JLine's org.jline.jansi.AnsiConsole first and falls back to the legacy FuseSource org.fusesource.jansi.AnsiConsole class. This keeps ANSI coloring working after Jansi moved under the JLine project. The optional org.jline:jansi-core artifact is declared as a dependency alongside the existing FuseSource jansi dependency. A preferredJansiClassName property was added for tests. This issue was reported in issues/1043 by seonwoo_jung who also provided the relevant PR.

... (truncated)

Commits
  • e8e824d prepare release 1.6.3
  • 761821b MDCBasedDiscriminator has a gated warning mechanism
  • 53ed122 update copyright year
  • c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
  • b5aa931 added BatchedSimpleInvocationGate
  • 1f22af7 add javadocs to SimpleInvocationGate
  • 638ffa7 prevent forward and backward slashes to escape to other directories
  • 7d6b9a4 add missing ch.qos.logback.core.property package
  • fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
  • c73b43f deprecate the withJansi path
  • Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.5.35 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

  • In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

  • Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

  • The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

  • ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

  • Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

  • The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

  • Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

  • Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

    <property name="logback.skipCallerContradictionAnalysis" value="true"/>

  • SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

  • Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

  • Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

  • Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

• On GZ, ZIP, or XZ compression failure, the original (uncompressed) log file is no longer deleted. Compression strategies now delete the source file only after successful compression and emit a warning that the original was left intact.

• ConsoleAppender with now probes JLine's org.jline.jansi.AnsiConsole first and falls back to the legacy FuseSource org.fusesource.jansi.AnsiConsole class. This keeps ANSI coloring working after Jansi moved under the JLine project. The optional org.jline:jansi-core artifact is declared as a dependency alongside the existing FuseSource jansi dependency. A preferredJansiClassName property was added for tests. This issue was reported in issues/1043 by seonwoo_jung who also provided the relevant PR.

... (truncated)

Commits
  • e8e824d prepare release 1.6.3
  • 761821b MDCBasedDiscriminator has a gated warning mechanism
  • 53ed122 update copyright year
  • c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
  • b5aa931 added BatchedSimpleInvocationGate
  • 1f22af7 add javadocs to SimpleInvocationGate
  • 638ffa7 prevent forward and backward slashes to escape to other directories
  • 7d6b9a4 add missing ch.qos.logback.core.property package
  • fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
  • c73b43f deprecate the withJansi path
  • Additional commits viewable in compare view

Updates com.auth0:java-jwt from 4.5.2 to 4.6.0

Release notes

Sourced from com.auth0:java-jwt's releases.

4.6.0

Added

Changelog

Sourced from com.auth0:java-jwt's changelog.

4.6.0 (2026-07-13)

Full Changelog

Added

Commits

Updates com.google.dagger:dagger from 2.59.2 to 2.60.1

Release notes

Sourced from com.google.dagger:dagger's releases.

Dagger 2.60.1

Bug fixes:

  • Fixes #5203: Fixes regression in Dagger 2.60 where the Hilt compiler options (like fastInit) failed to propagate to the Hilt aggregation compilation tasks. (e181a0d88)
  • Fixes #5204: Fixes @CanIgnoreReturnValue import error by removing the annotation from ActivityRetainedComponentBuilder (3f2dd8fba)

Dagger 2.60

New features:

Potential breaking changes:

  • When using the Hilt Gradle plugin, an error is now reported if a user sets a plugin-controlled flag (previously the plugin just ignored the user’s input). (a119ba68c)
  • Multidex support is removed. minSDK for Hilt is now 23, matching AndroidX (https://issuetracker.google.com/380448311) (1990bd1c4)

Bug fixes:

  • Fixes #1290: Enabled Guava BetaApi checks (5b8b2bdbe)
  • Fixes #5190, #5180, #5177: Updated Kotlin version ton 2.3.21 (7daaec5a9)
  • Fixes #5160: Deferred ViewModelMetadata processing on error types or missing @​AssistedFactory (59827c699)
  • Fixes missing originating element attachments in a few Hilt processors to ensure correct incremental compilation tracking. (2930ca837)
  • Fixes Dagger multibinding duplicate masking across Map components (compile-time validation) Adds strict compile-time detection for duplicate map multibinding keys across component boundaries. This is enabled via the -Adagger.mapMultibindingDuplicateDetectionFix=ENABLED. This option is DISABLED by default to maintain backward compatibility. See Compiler Options for more details. (504397ebe)
Commits
  • f7a89b6 2.60.1 release
  • 7678017 Automated Code Change
  • 974fe29 Automated Code Change
  • 823484c Make Android*InjectionTest$ApplicationReturnsNull public.
  • c26f8d7 Add test for @AssistedFactory compilations without compiler
  • e181a0d Fix Hilt compiler option propagation to Hilt aggregation tasks.
  • 812e2f3 Internal changes
  • 3f2dd8f Delete @CanIgnoreReturnValue from ActivityRetainedComponentBuilder
  • e90e102 Update Dagger version in yml config and REAME.md
  • 7451e37 Add dependenciesRequested to ProducerMonitor
  • Additional commits viewable in compare view

Updates com.google.dagger:dagger-compiler from 2.59.2 to 2.60.1

Release notes

Sourced from com.google.dagger:dagger-compiler's releases.

Dagger 2.60.1

Bug fixes:

  • Fixes #5203: Fixes regression in Dagger 2.60 where the Hilt compiler options (like fastInit) failed to propagate to the Hilt aggregation compilation tasks. (e181a0d88)
  • Fixes #5204: Fixes @CanIgnoreReturnValue import error by removing the annotation from ActivityRetainedComponentBuilder (3f2dd8fba)

Dagger 2.60

New features:

Potential breaking changes:

  • When using the Hilt Gradle plugin, an error is now reported if a user sets a plugin-controlled flag (previously the plugin just ignored the user’s input). (a119ba68c)
  • Multidex support is removed. minSDK for Hilt is now 23, matching AndroidX (https://issuetracker.google.com/380448311) (1990bd1c4)

Bug fixes:

  • Fixes #1290: Enabled Guava BetaApi checks (5b8b2bdbe)
  • Fixes #5190, #5180, #5177: Updated Kotlin version ton 2.3.21 (7daaec5a9)
  • Fixes #5160: Deferred ViewModelMetadata processing on error types or missing @​AssistedFactory (59827c699)
  • Fixes missing originating element attachments in a few Hilt processors to ensure correct incremental compilation tracking. (2930ca837)
  • Fixes Dagger multibinding duplicate masking across Map components (compile-time validation) Adds strict compile-time detection for duplicate map multibinding keys across component boundaries. This is enabled via the -Adagger.mapMultibindingDuplicateDetectionFix=ENABLED. This option is DISABLED by default to maintain backward compatibility. See Compiler Options for more details. (504397ebe)
Commits
  • f7a89b6 2.60.1 release
  • 7678017 Automated Code Change
  • 974fe29 Automated Code Change
  • 823484c Make Android*InjectionTest$ApplicationReturnsNull public.
  • c26f8d7 Add test for @AssistedFactory compilations without compiler
  • e181a0d Fix Hilt compiler option propagation to Hilt aggregation tasks.
  • 812e2f3 Internal changes
  • 3f2dd8f Delete @CanIgnoreReturnValue from ActivityRetainedComponentBuilder
  • e90e102 Update Dagger version in yml config and REAME.md
  • 7451e37 Add dependenciesRequested to ProducerMonitor
  • Additional commits viewable in compare view

Updates org.junit.jupiter:junit-jupiter from 6.1.0 to 6.1.3

Release notes

Sourced from org.junit.jupiter:junit-jupiter's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.1...r6.1.2

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

Commits
  • f59f60d Release 6.1.3
  • cd8ec92 Finalize 6.1.3 release notes
  • c8729f2 Restore compatibility with GraalVM 25 (#5901)
  • ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
  • fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
  • 62afc02 Delay GraalVM plugin updates for 3 days
  • 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
  • f6bbfc5 Move GraalVM tests to separate test task (#5903)
  • e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
  • 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
  • Additional commits viewable in compare view

Updates com.google.dagger:dagger-compiler from 2.59.2 to 2.60.1

Release notes

Sourced from com.google.dagger:dagger-compiler's releases.

Dagger 2.60.1

Bug fixes:

  • Fixes #5203: Fixes regression in Dagger 2.60 where the Hilt compiler options (like fastInit) failed to propagate to the Hilt aggregation compilation tasks. (e181a0d88)
  • Fixes #5204: Fixes @CanIgnoreReturnValue import error by removing the annotation from ActivityRetainedComponentBuilder (3f2dd8fba)

Dagger 2.60

New features:

Potential breaking changes:

  • When using the Hilt Gradle plugin, an error is now reported if a user sets a plugin-controlled flag (previously the plugin just ignored the user’s input). (a119ba68c)
  • Multidex support is removed. minSDK for Hilt is now 23, matching AndroidX (https://issuetracker.google.com/380448311) (1990bd1c4)

Bug fixes:

  • Fixes #1290: Enabled Guava BetaApi checks (5b8b2bdbe)
  • Fixes #5190, #5180, #5177: Updated Kotlin version ton 2.3.21 (7daaec5a9)
  • Fixes #5160: Deferred ViewModelMetadata processing on error types or missing @​AssistedFactory (59827c699)
  • Fixes missing originating element attachments in a few Hilt processors to ensure correct incremental compilation tracking. (2930ca837)
  • Fixes Dagger multibinding duplicate masking across Map components (compile-time validation) Adds strict compile-time detection for duplicate map multibinding keys across component boundaries. This is enabled via the -Adagger.mapMultibindingDuplicateDetectionFix=ENABLED. This option is DISABLED by default to maintain backward compatibility. See Compiler Options for more details. (504397ebe)
Commits
  • f7a89b6 2.60.1 release
  • 7678017 Automated Code Change
  • 974fe29 Automated Code Change
  • 823484c Make Android*InjectionTest$ApplicationReturnsNull public.
  • c26f8d7 Add test for @AssistedFactory compilations without compiler
  • e181a0d Fix Hilt compiler option propagation to Hilt aggregation tasks.
  • 812e2f3 Internal changes
  • 3f2dd8f Delete @CanIgnoreReturnValue from ActivityRetainedComponentBuilder
  • e90e102 Update Dagger version in yml config and REAME.md
  • 7451e37 Add dependenciesRequested to ProducerMonitor
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1

Release notes

Sourced from org.apache.maven.plugins:maven-jar-plugin's releases.

3.5.1

📝 Documentation updates

  • Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#550) @​potiuk

👻 Maintenance

  • Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#550) @​potiuk
  • Use plugin version properties (3.x) (#535) @​Bukama

📦 Dependency updates

Commits
  • b0cd63d [maven-release-plugin] prepare release maven-jar-plugin-3.5.1
  • 5318a4f Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability
  • 8e0b9bb Bump org.apache.maven.plugins:maven-plugins from 48 to 49 (#547)
  • d5a438b Fix javadoc
  • 774fac9 Bump org.codehaus.plexus:plexus-archiver from 4.11.0 to 4.12.0
  • b71f403 Bump mavenVersion from 3.9.15 to 3.9.16 (#536)
  • 9f2a001 Use plugin version properties (3.x) (#535)
  • 68a978f Bump org.apache.maven.plugins:maven-plugins from 47 to 48 (#534)
  • e105821 Bump commons-io:commons-io from 2.21.0 to 2.22.0 (#529)
  • 953dc1a Bump mavenVersion from 3.9.14 to 3.9.15 (#528)
  • Additional commits viewable in compare view

Updates org.owasp:dependency-check-maven from 12.2.2 to 13.0.0

Release notes

Sourced from org.owasp:dependency-check-maven's releases.

Version 13.0.0

What's Changed

Bump the maven-dependencies group across 1 directory with 8 updates
e3065b1 
Bumps the maven-dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) | `1.5.35` | `1.6.3` |
| [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.5.35` | `1.6.3` |
| [com.auth0:java-jwt](https://github.com/auth0/java-jwt) | `4.5.2` | `4.6.0` |
| [com.google.dagger:dagger](https://github.com/google/dagger) | `2.59.2` | `2.60.1` |
| [com.google.dagger:dagger-compiler](https://github.com/google/dagger) | `2.59.2` | `2.60.1` |
| [org.junit.jupiter:junit-jupiter](https://github.com/junit-team/junit-framework) | `6.1.0` | `6.1.3` |
| [org.apache.maven.plugins:maven-jar-plugin](https://github.com/apache/maven-jar-plugin) | `3.5.0` | `3.5.1` |
| [org.owasp:dependency-check-maven](https://github.com/dependency-check/DependencyCheck) | `12.2.2` | `13.0.0` |



Updates `ch.qos.logback:logback-core` from 1.5.35 to 1.6.3
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.5.35...v_1.6.3)

Updates `ch.qos.logback:logback-classic` from 1.5.35 to 1.6.3
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.5.35...v_1.6.3)

Updates `ch.qos.logback:logback-classic` from 1.5.35 to 1.6.3
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.5.35...v_1.6.3)

Updates `com.auth0:java-jwt` from 4.5.2 to 4.6.0
- [Release notes](https://github.com/auth0/java-jwt/releases)
- [Changelog](https://github.com/auth0/java-jwt/blob/master/CHANGELOG.md)
- [Commits](auth0/java-jwt@4.5.2...4.6.0)

Updates `com.google.dagger:dagger` from 2.59.2 to 2.60.1
- [Release notes](https://github.com/google/dagger/releases)
- [Changelog](https://github.com/google/dagger/blob/master/CHANGELOG.md)
- [Commits](google/dagger@dagger-2.59.2...dagger-2.60.1)

Updates `com.google.dagger:dagger-compiler` from 2.59.2 to 2.60.1
- [Release notes](https://github.com/google/dagger/releases)
- [Changelog](https://github.com/google/dagger/blob/master/CHANGELOG.md)
- [Commits](google/dagger@dagger-2.59.2...dagger-2.60.1)

Updates `org.junit.jupiter:junit-jupiter` from 6.1.0 to 6.1.3
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](junit-team/junit-framework@r6.1.0...r6.1.3)

Updates `com.google.dagger:dagger-compiler` from 2.59.2 to 2.60.1
- [Release notes](https://github.com/google/dagger/releases)
- [Changelog](https://github.com/google/dagger/blob/master/CHANGELOG.md)
- [Commits](google/dagger@dagger-2.59.2...dagger-2.60.1)

Updates `org.apache.maven.plugins:maven-jar-plugin` from 3.5.0 to 3.5.1
- [Release notes](https://github.com/apache/maven-jar-plugin/releases)
- [Commits](apache/maven-jar-plugin@maven-jar-plugin-3.5.0...maven-jar-plugin-3.5.1)

Updates `org.owasp:dependency-check-maven` from 12.2.2 to 13.0.0
- [Release notes](https://github.com/dependency-check/DependencyCheck/releases)
- [Changelog](https://github.com/dependency-check/DependencyCheck/blob/main/CHANGELOG.md)
- [Commits](dependency-check/DependencyCheck@v12.2.2...v13.0.0)

---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: com.auth0:java-jwt
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: com.google.dagger:dagger
  dependency-version: 2.60.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: com.google.dagger:dagger-compiler
  dependency-version: 2.60.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.junit.jupiter:junit-jupiter
  dependency-version: 6.1.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.google.dagger:dagger-compiler
  dependency-version: 2.60.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.apache.maven.plugins:maven-jar-plugin
  dependency-version: 3.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.owasp:dependency-check-maven
  dependency-version: 13.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: maven-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

Back | FazBrowse Home | New Git URL