Skip to content

[12.0.x EE10] Bump the dev-dependencies group across 1 directory with 14 updates - #15568

Closed
dependabot[bot] wants to merge 1 commit into
jetty-12.0.xfrom
dependabot/maven/jetty-ee10/jetty-12.0.x/dev-dependencies-a07323911a
Closed

[12.0.x EE10] Bump the dev-dependencies group across 1 directory with 14 updates#15568
dependabot[bot] wants to merge 1 commit into
jetty-12.0.xfrom
dependabot/maven/jetty-ee10/jetty-12.0.x/dev-dependencies-a07323911a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 14 updates in the /jetty-ee10 directory:

Package From To
org.conscrypt:conscrypt-openjdk-uber 2.6.0 2.6.1
commons-codec:commons-codec 1.22.0 1.22.1
org.mariadb.jdbc:mariadb-java-client 3.5.9 3.5.10
io.netty:netty-bom 4.2.16.Final 4.2.17.Final
ch.qos.logback:logback-core 1.5.38 1.6.1
io.grpc:grpc-core 1.82.2 1.83.1
io.grpc:grpc-netty-shaded 1.82.2 1.83.1
io.smallrye.common:smallrye-common-annotation 2.19.0 2.20.0
io.smallrye.common:smallrye-common-cpu 2.19.0 2.20.0
org.bouncycastle:bctls-jdk18on 1.84 1.85
org.eclipse.sisu:org.eclipse.sisu.inject 1.0.1 1.1.0
org.eclipse.sisu:org.eclipse.sisu.plexus 1.0.1 1.1.0
org.eclipse.jetty.toolchain:jetty-build-support 1.5 1.6
org.cyclonedx:cyclonedx-maven-plugin 2.9.2 2.9.3

Updates org.conscrypt:conscrypt-openjdk-uber from 2.6.0 to 2.6.1

Commits

Updates commons-codec:commons-codec from 1.22.0 to 1.22.1

Changelog

Sourced from commons-codec:commons-codec's changelog.

Apache Commons Codec 1.22.1 Release Notes

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.22.1.

The Apache Commons Codec component contains encoders and decoders for formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

Fixed Bugs

  • CODEC-344: Base64.Builder.setEncodeTable(byte...) accepts invalid custom alphabets. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-340: Base58.Builder.setEncodeTable(byte...) is ignored when encoding and decoding. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-342: Base32.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-343: Base32.Builder.setHexDecodeTable(boolean) sets the encode table to a decode lookup table. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-341: Base16.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-339: URLCodec.encodeUrl(BitSet, byte[]) allows custom safe sets to emit URL encoding control characters. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-338: PercentCodec loses literal '+' when plusForSpace is enabled. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-337: Digest ALL reuses System.in, so only the first algorithm sees the real input (#431). Thanks to Ruiqi Dong, Gary Gregory.
  •         Fix Base64.toIntegerBytes(BigInteger) for zero edge case ([#441](https://github.com/apache/commons-codec/issues/441)). Thanks to Gary Gregory.

  •         Add messages when throwing NullPointerException. Thanks to Gary Gregory.

  •         Add messages when throwing NullPointerException. Thanks to Gary Gregory.

  •         StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails fast on null input. Thanks to Gary Gregory.

Changes

  •         Bump org.apache.commons:commons-parent from 98 to 103. Thanks to Gary Gregory.

  •         Bump commons-io:commons-io from 2.21.0 to 2.22.0. Thanks to Gary Gregory.

For complete information on Apache Commons Codec, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Commons Codec website:

https://commons.apache.org/proper/commons-codec/

Download page: https://commons.apache.org/proper/commons-codec/download_codec.cgi

Commits
  • dc8f6c8 Prepare for the release candidate 1.22.1 RC1
  • 8203c1c Prepare for the next release candidate
  • 5647fe2 StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails
  • 00c27a9 Reduce vertical whitespace
  • 568f2d7 Remove unused method
  • 316fb15 Remove unused method
  • bf6b543 Bump actions/checkout from 7.0.0 to 7.0.1
  • e14cdfe Extract redundant code.
  • 3351e63 Add messages when throwing NullPointerException.
  • f22dab7 Update SCM tag
  • Additional commits viewable in compare view

Updates org.mariadb.jdbc:mariadb-java-client from 3.5.9 to 3.5.10

Release notes

Sourced from org.mariadb.jdbc:mariadb-java-client's releases.

MariaDB Connector/Java 3.5.10

3.5.10 (Jul 2026)

Full Changelog

Key Enhancements

  • CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
  • CONJ-1330 - add infer test to CI

Issues Resolved

  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)
  • CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder)
  • CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)
  • CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)
  • CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)
  • CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
  • CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR)
  • CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order
Changelog

Sourced from org.mariadb.jdbc:mariadb-java-client's changelog.

3.5.10 (Jul 2026)

Full Changelog

Key Enhancements

  • CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
  • CONJ-1330 - add infer test to CI

Issues Resolved

  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)
  • CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder)
  • CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)
  • CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)
  • CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)
  • CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
  • CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR)
  • CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order

3.4.4 (Jul 2026)

Full Changelog

Notable Changes
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
Bugs Fixed
  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)

... (truncated)

Commits
  • 6164678 [misc] update changelog
  • 6f58858 [CONJ-1335] getGeneratedKeys() throws SQLDataException "integer overflow" aft...
  • 9f06db7 [misc] CI stability improvement
  • 99aa9e2 [CONJ-1336] correction follow up
  • 28a1550 [CONJ-1336] strip trailing dot from hostname before SNI and hostname verifica...
  • b2b3f1b [misc] limit authentication switch requests to 10 per connection
  • 26ca60a [misc] bound the whole connection phase by connectTimeout
  • 15e08ff [CONJ-1337] Limit parsec authentication PBKDF2 iteration factor to the connec...
  • d3c4a72 bump 3.5.10 version
  • d85e05f [CONJ-1342] socketFactory option allows loading arbitrary bytecode via jar: U...
  • Additional commits viewable in compare view

Updates io.netty:netty-bom from 4.2.16.Final to 4.2.17.Final

Release notes

Sourced from io.netty:netty-bom's releases.

netty-4.2.17.Final

What's Changed

New Contributors

... (truncated)

Commits
  • e0789d3 [maven-release-plugin] prepare release netty-4.2.17.Final
  • 1b5abc6 Merge changes from forks (#17213)
  • 36fbf57 Update surefire plugin to latest version (#17210)
  • a96226c Add .editorconfig to enforce consistent coding style (#17052)
  • 14a4e6a OpenSSL: Allow to obtain used named group via OpenSslSession (#17058)
  • 26255b1 Weakly reference engines from the OpenSSL engine map (#17199)
  • ae41417 HttpServerCodec: do not consume the method queue for 1xx interim responses ...
  • 41f1db5 Do not write WebSocket handshake response to the tail of the pipeline (#17192)
  • 035d76e Update compress-lzf to 1.2.1 (#17194)
  • 7681aff Fix JdkZlibDecompressor losing the tail of highly compressible streams (#17191)
  • Additional commits viewable in compare view

Updates ch.qos.logback:logback-core from 1.5.38 to 1.6.1

Release notes

Sourced from ch.qos.logback:logback-core's releases.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

• On GZ, ZIP, or XZ compression failure, the original (uncompressed) log file is no longer deleted. Compression strategies now delete the source file only after successful compression and emit a warning that the original was left intact.

• ConsoleAppender with now probes JLine's org.jline.jansi.AnsiConsole first and falls back to the legacy FuseSource org.fusesource.jansi.AnsiConsole class. This keeps ANSI coloring working after Jansi moved under the JLine project. The optional org.jline:jansi-core artifact is declared as a dependency alongside the existing FuseSource jansi dependency. A preferredJansiClassName property was added for tests. This issue was reported in issues/1043 by seonwoo_jung who also provided the relevant PR.

• LayoutWrappingEncoder now reports an error at start() when no layout is set and guards encode() against a null layout. Previously, a missing layout (for example after an ignored // branch) allowed the encoder to start and then fail with a NullPointerException on every event, resulting in silent log loss. This issue was reported in issues/1046 by seonwoo_jung who also provided the relevant PR.

• FileCollisionAnalyser now detects file collisions involving nested appenders of SiftingAppender. When the nested file or fileNamePattern does not textually reference the discriminator key (e.g. ${userId}), a warning is issued at configuration time naming the appender, the key, and the shared target. This closes a gap where statically declared file appenders were checked but sifted nested appenders were not. This enhancement was contributed in [PR #1041](qos-ch/logback#1041) by seonwoo_jung.

• More defensive handling in SyslogOutputStream and SyslogAppenderBase: the close() method now ensures that resources are closed, writes and flushes check that the underlying resources are in a valid state and fallback to no-op otherwise.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 57759f433000a133088ef0441038963134437fbd associated with the tag v_1.6.1. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

• See https://logback.qos.ch/news.html#1.6.1 for the original text.

Logback 1.6.0

2026-07-23 Release of logback version 1.6.0

• Removed certain deprecated variables, methods, and classes. For the list of removed members see release_1.6.0.txt.

• In AsyncAppenderBase, the put(ILoggingEvent) method now has the protected modifier to allow access from derived classes. This change was requested by Thomas Skjølberg in pr#1053.

• Bump SLF4J dependency to version 2.0.18.

• See also the overview of the 1.6.x series.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit b07adf36019b51a10f824fdd94009985c587b1d3 associated with the tag v_1.6.0. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits
  • 57759f4 prepare release 1.6.1
  • 175f99f fix imports
  • 4b8773e add compressionFailureLeavesOriginalFileIntact test for XZ compression
  • cafaf11 do not delete original file if compression fails
  • ee50125 let the temporary file before compression be target file without the .gz or ....
  • 5626acc minor refactoring
  • d97da4f minor refactoring
  • 159c045 more defensive coding in SyslogOutputStream and in SyslogAppenderBase
  • 9427d6b slight refactoring for clarity
  • 79c4179 slight refactoring
  • Additional commits viewable in compare view

Updates io.grpc:grpc-core from 1.82.2 to 1.83.1

Release notes

Sourced from io.grpc:grpc-core's releases.

v1.83.1

gRPC Java 1.83.1 Release Notes

Improvements

  • netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12942). Enforces the limit proactively at startup without waiting for SETTINGS_ACK
  • core: Coalesce Contiguous Small Buffers for ReadableBuffer (#12944)

v1.83.0

gRPC Java 1.83.0 Release Notes

API Changes

  • api: Turn on RFC 3986 parsing by default and update javadoc. (4456721328)
  • api: Add Grpc.newChannelBuilder accepting NameResolverRegistry (#11901) (2b86f8f42f). This allows users to explicitly provide a NameResolverRegistry during channel creation rather than relying on the global registry, offering better isolation and control over name resolution per-channel.

Behavior Changes

  • okhttp: enable TLS 1.3 for servers on Android (3018ce341c). v1.82.0 enabled TLS 1.3 for clients; this does the same for servers
  • xds: enable orca to lrs propagation by default (#12836) (1e85674a40) Enables xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports as per gRFC A85
  • xds: Use leaf cluster name for backend service label in metrics, instead of aggregate cluster name (#12882) (c8079eed98). This only has an effect when using aggregate clusters
  • xds: Hold parsed service config in CdsUpdate (3db3235ebd). Previously, modifications to LoadBalancerRegistry could cause failures in the LB tree
  • xds: Revert "xds: reuse connections to the control plane across channels" added in 1.81.0 (d49c0b15d8). If using xds heavily with many targets, then MAX_CONCURRENT_STREAMS to the control plane could be exceeded. This then prevents loading resources for new targets, which causes those channels to hang on name resolution. RPCs would see the nondescript "DEADLINE_EXCEEDED: Deadline Context was exceeded after Xs" or "DEADLINE_EXCEEDED: Deadline CallOptions was exceeded after Xs"

Improvements

  • api: Move attributes to the end of ResolvedAddresses.toString(), for better legibility (103bd4b852)
  • core: normalize service config number values (#12826) (663c505dbd) This updates default service config validation to accept numeric values represented as Number, not only Double. Common JSON parsers may deserialize integer-looking JSON values such as maxAttempts: 4 and backoffMultiplier: 2 as Integer, which previously caused defaultServiceConfig() to fail with IllegalArgumentException. The values are normalized to Double when copied into the validated service config, preserving the existing internal representation expected by the service config parsing code.
  • core: DEADLINE_EXCEEDED before initial name resolution completes will now mention “name_resolver” in the error description (56d2b25eb5). Previously there was not a hint as to what gRPC was delayed on when the deadline was exceeded.
  • netty: Reduce TcpMetrics log from INFO to FINE (4ec83df1eb). This removes unnecessary log noise
  • core: Enable child channel plugins (#12578) (89aef90d52). This introduces the ChildChannelConfigurer API to allow intercepting and customizing the configuration (such as injecting interceptors or modifying credentials) of child channels created dynamically by load balancers.

Dependencies

  • Upgrade to Netty 4.2.15 (66c6ab1da6). If you need Netty 4.1 support, please file an issue
  • Upgrade codegen plugin to C++ Protobuf 35.1 (#12876) (c886f0a06b)
  • Upgrade various dependencies (064272c61d):
    • gson to 2.14.0
    • guava to 33.6.0
    • cel-java to 0.13.0
    • protobuf-java to 3.25.9
    • error-prone-annotations to 2.50.0
    • opentelemetry to 1.63.0

Documentation

  • Document how to build with Bazel and introduce bazel support for building android and binder (#12811) (f94574eff7)

Thanks to

... (truncated)

Commits
  • 8f621c0 Bump version to 1.83.1
  • 2bafe5e Update README etc to reference 1.83.1
  • e1f2dbd netty: Fix client-initiated stream limit bypass in NettyServerHandler (v1.83....
  • ee8232f core: Coalesce Contiguous Small Buffers for ReadableBuffer (v1.83.x backport)...
  • b4ca099 Fix docker tagging failure in upload_artifacts by using stable tag name (#12922)
  • b4fb7f4 build: Allow downloading pkgconfiglite with empty checksum
  • 1fbfa86 Bump version to 1.83.1-SNAPSHOT
  • 8ab6e0a Bump version to 1.83.0
  • 33ad6a4 Update README etc to reference 1.83.0
  • 17d5bd6 Revert "enable child channel plugins (#12578)" (v1.83.x backport) (#12913)
  • Additional commits viewable in compare view

Updates io.grpc:grpc-netty-shaded from 1.82.2 to 1.83.1

Release notes

Sourced from io.grpc:grpc-netty-shaded's releases.

v1.83.1

gRPC Java 1.83.1 Release Notes

Improvements

  • netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12942). Enforces the limit proactively at startup without waiting for SETTINGS_ACK
  • core: Coalesce Contiguous Small Buffers for ReadableBuffer (#12944)

v1.83.0

gRPC Java 1.83.0 Release Notes

API Changes

  • api: Turn on RFC 3986 parsing by default and update javadoc. (4456721328)
  • api: Add Grpc.newChannelBuilder accepting NameResolverRegistry (#11901) (2b86f8f42f). This allows users to explicitly provide a NameResolverRegistry during channel creation rather than relying on the global registry, offering better isolation and control over name resolution per-channel.

Behavior Changes

  • okhttp: enable TLS 1.3 for servers on Android (3018ce341c). v1.82.0 enabled TLS 1.3 for clients; this does the same for servers
  • xds: enable orca to lrs propagation by default (#12836) (1e85674a40) Enables xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports as per gRFC A85
  • xds: Use leaf cluster name for backend service label in metrics, instead of aggregate cluster name (#12882) (c8079eed98). This only has an effect when using aggregate clusters
  • xds: Hold parsed service config in CdsUpdate (3db3235ebd). Previously, modifications to LoadBalancerRegistry could cause failures in the LB tree
  • xds: Revert "xds: reuse connections to the control plane across channels" added in 1.81.0 (d49c0b15d8). If using xds heavily with many targets, then MAX_CONCURRENT_STREAMS to the control plane could be exceeded. This then prevents loading resources for new targets, which causes those channels to hang on name resolution. RPCs would see the nondescript "DEADLINE_EXCEEDED: Deadline Context was exceeded after Xs" or "DEADLINE_EXCEEDED: Deadline CallOptions was exceeded after Xs"

Improvements

  • api: Move attributes to the end of ResolvedAddresses.toString(), for better legibility (103bd4b852)
  • core: normalize service config number values (#12826) (663c505dbd) This updates default service config validation to accept numeric values represented as Number, not only Double. Common JSON parsers may deserialize integer-looking JSON values such as maxAttempts: 4 and backoffMultiplier: 2 as Integer, which previously caused defaultServiceConfig() to fail with IllegalArgumentException. The values are normalized to Double when copied into the validated service config, preserving the existing internal representation expected by the service config parsing code.
  • core: DEADLINE_EXCEEDED before initial name resolution completes will now mention “name_resolver” in the error description (56d2b25eb5). Previously there was not a hint as to what gRPC was delayed on when the deadline was exceeded.
  • netty: Reduce TcpMetrics log from INFO to FINE (4ec83df1eb). This removes unnecessary log noise
  • core: Enable child channel plugins (#12578) (89aef90d52). This introduces the ChildChannelConfigurer API to allow intercepting and customizing the configuration (such as injecting interceptors or modifying credentials) of child channels created dynamically by load balancers.

Dependencies

  • Upgrade to Netty 4.2.15 (66c6ab1da6). If you need Netty 4.1 support, please file an issue
  • Upgrade codegen plugin to C++ Protobuf 35.1 (#12876) (c886f0a06b)
  • Upgrade various dependencies (064272c61d):
    • gson to 2.14.0
    • guava to 33.6.0
    • cel-java to 0.13.0
    • protobuf-java to 3.25.9
    • error-prone-annotations to 2.50.0
    • opentelemetry to 1.63.0

Documentation

  • Document how to build with Bazel and introduce bazel support for building android and binder (#12811) (f94574eff7)

Thanks to

... (truncated)

Commits
  • 8f621c0 Bump version to 1.83.1
  • 2bafe5e Update README etc to reference 1.83.1
  • e1f2dbd netty: Fix client-initiated stream limit bypass in NettyServerHandler (v1.83....
  • ee8232f core: Coalesce Contiguous Small Buffers for ReadableBuffer (v1.83.x backport)...
  • b4ca099 Fix docker tagging failure in upload_artifacts by using stable tag name (#12922)
  • b4fb7f4 build: Allow downloading pkgconfiglite with empty checksum
  • 1fbfa86 Bump version to 1.83.1-SNAPSHOT
  • 8ab6e0a Bump version to 1.83.0
  • 33ad6a4 Update README etc to reference 1.83.0
  • 17d5bd6 Revert "enable child channel plugins (#12578)" (v1.83.x backport) (#12913)
  • Additional commits viewable in compare view

Updates io.grpc:grpc-netty-shaded from 1.82.2 to 1.83.1

Release notes

Sourced from io.grpc:grpc-netty-shaded's releases.

v1.83.1

gRPC Java 1.83.1 Release Notes

Improvements

  • netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12942). Enforces the limit proactively at startup without waiting for SETTINGS_ACK
  • core: Coalesce Contiguous Small Buffers for ReadableBuffer (#12944)

v1.83.0

gRPC Java 1.83.0 Release Notes

API Changes

  • api: Turn on RFC 3986 parsing by default and update javadoc. (4456721328)
  • api: Add Grpc.newChannelBuilder accepting NameResolverRegistry (#11901) (2b86f8f42f). This allows users to explicitly provide a NameResolverRegistry during channel creation rather than relying on the global registry, offering better isolation and control over name resolution per-channel.

Behavior Changes

  • okhttp: enable TLS 1.3 for servers on Android (3018ce341c). v1.82.0 enabled TLS 1.3 for clients; this does the same for servers
  • xds: enable orca to lrs propagation by default (#12836) (1e85674a40) Enables xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports as per gRFC A85
  • xds: Use leaf cluster name for backend service label in metrics, instead of aggregate cluster name (#12882) (c8079eed98). This only has an effect when using aggregate clusters
  • xds: Hold parsed service config in CdsUpdate (3db3235ebd). Previously, modifications to LoadBalancerRegistry could cause failures in the LB tree
  • xds: Revert "xds: reuse connections to the control plane across channels" added in 1.81.0 (d49c0b15d8). If using xds heavily with many targets, then MAX_CONCURRENT_STREAMS to the control plane could be exceeded. This then prevents loading resources for new targets, which causes those channels to hang on name resolution. RPCs would see the nondescript "DEADLINE_EXCEEDED: Deadline Context was exceeded after Xs" or "DEADLINE_EXCEEDED: Deadline CallOptions was exceeded after Xs"

Improvements

  • api: Move attributes to the end of ResolvedAddresses.toString(), for better legibility (103bd4b852)
  • core: normalize service config number values (#12826) (663c505dbd) This updates default service config validation to accept numeric values represented as Number, not only Double. Common JSON parsers may deserialize integer-looking JSON values such as maxAttempts: 4 and backoffMultiplier: 2 as Integer, which previously caused defaultServiceConfig() to fail with IllegalArgumentException. The values are normalized to Double when copied into the validated service config, preserving the existing internal representation expected by the service config parsing code.
  • core: DEADLINE_EXCEEDED before initial name resolution completes will now mention “name_resolver” in the error description (56d2b25eb5). Previously there was not a hint as to what gRPC was delayed on when the deadline was exceeded.
  • netty: Reduce TcpMetrics log from INFO to FINE (4ec83df1eb). This removes unnecessary log noise
  • core: Enable child channel plugins (#12578) (89aef90d52). This introduces the ChildChannelConfigurer API to allow intercepting and customizing the configuration (such as injecting interceptors or modifying credentials) of child channels created dynamically by load balancers.

Dependencies

  • Upgrade to Netty 4.2.15 (66c6ab1da6). If you need Netty 4.1 support, please file an issue
  • Upgrade codegen plugin to C++ Protobuf 35.1 (#12876) (c886f0a06b)
  • Upgrade various dependencies (064272c61d):
    • gson to 2.14.0
    • guava to 33.6.0
    • cel-java to 0.13.0
    • protobuf-java to 3.25.9
    • error-prone-annotations to 2.50.0
    • opentelemetry to 1.63.0

Documentation

  • Document how to build with Bazel and introduce bazel support for building android and binder (#12811) (f94574eff7)

Thanks to

... (truncated)

Commits
  • 8f621c0 Bump version to 1.83.1
  • 2bafe5e Update README etc to reference 1.83.1
  • e1f2dbd netty: Fix client-initiated stream limit bypass in NettyServerHandler (v1.83....
  • ee8232f core: Coalesce Contiguous Small Buffers for ReadableBuffer (v1.83.x backport)...
  • b4ca099 Fix docker tagging failure in upload_artifacts by using stable tag name (#12922)
  • b4fb7f4 build: Allow downloading pkgconfiglite with empty checksum
  • 1fbfa86 Bump version to 1.83.1-SNAPSHOT
  • 8ab6e0a Bump version to 1.83.0
  • 33ad6a4 Update README etc to reference 1.83.0
  • 17d5bd6 Revert "enable child channel plugins (#12578)" (v1.83.x backport) (#12913)
  • Additional commits viewable in compare view

Updates io.smallrye.common:smallrye-common-annotation from 2.19.0 to 2.20.0

Commits
  • defd310 [maven-release-plugin] prepare release 2.20.0
  • ffc98f6 Merge pull request #581 from smallrye/release
  • 7cf7fcc Release 2.20.0
  • e6f3c59 Merge pull request #579 from smallrye/dependabot/maven/version.vertx4-4.5.30
  • 232049f Bump version.vertx4 from 4.5.29 to 4.5.30
  • b89fee4 Merge pull request #576 from smallrye/dependabot/maven/org.graalvm.sdk-native...
  • d2c6a36 Bump org.graalvm.sdk:nativeimage from 25.0.3 to 25.1.3
  • dc37896 Merge pull request #578 from smallrye/dependabot/maven/version.vertx4-4.5.29
  • 3d73326 Bump version.vertx4 from 4.5.28 to 4.5.29
  • bdb9f0b Bump io.smallrye:smallrye-parent from 50 to 51 (#577)
  • Additional commits viewable in compare view

Updates io.smallrye.common:smallrye-common-cpu from 2.19.0 to 2.20.0

Commits
  • defd310 [maven-release-plugin] prepare release 2.20.0
  • ffc98f6 Merge pull request #581 from smallrye/release
  • 7cf7fcc Release 2.20.0
  • e6f3c59 Merge pull request #579 from smallrye/dependabot/maven/version.vertx4-4.5.30
  • 232049f Bump version.vertx4 from 4.5.29 to 4.5.30
  • b89fee4 Merge pull request #576 from smallrye/dependabot/maven/org.graalvm.sdk-native...
  • d2c6a36 Bump org.graalvm.sdk:nativeimage from 25.0.3 to 25.1.3
  • dc37896 Merge pull request #578 from smallrye/dependabot/maven/version.vertx4-4.5.29
  • 3d73326 Bump version.vertx4 from 4.5.28 to 4.5.29
  • bdb9f0b Bump io.smallrye:smallrye-parent from 50 to 51 (#577)
  • Additional commits viewable in compare view

Updates io.smallrye.common:smallrye-common-cpu from 2.19.0 to 2.20.0

Commits
  • defd310 [maven-release-plugin] prepare release 2.20.0
  • ffc98f6 Merge pull request #581 from smallrye/release
  • 7cf7fcc Release 2.20.0
  • e6f3c59 Merge pull request #579 from smallrye/dependabot/maven/version.vertx4-4.5.30
  • 232049f Bump version.vertx4 from 4.5.29 to 4.5.30
  • b89fee4 Merge pull request #576 from smallrye/dependabot/maven/org.graalvm.sdk-native...
  • d2c6a36 Bump org.graalvm.sdk:nativeimage from 25.0.3 to 25.1.3
  • dc37896 Merge pull request #578 from smallrye/dependabot/maven/version.vertx4-4.5.29
  • 3d73326 Bump version.vertx4 from 4.5.28 to 4.5.29
  • bdb9f0b Bump io.smallrye:smallrye-parent from 50 to 51 (#577)
  • Additional commits viewable in compare view

Updates org.bouncycastle:bctls-jdk18on from 1.84 to 1.85

Changelog

Sourced from org.bouncycastle:bctls-jdk18on's changelog.

... (truncated)

Commits

Updates org.eclipse.sisu:org.eclipse.sisu.inject from 1.0.1 to 1...

Description has been truncated

@dependabot
[12.0.x EE10] Bump the dev-dependencies group across 1 directory with…
698ecd3 
… 14 updates

Bumps the dev-dependencies group with 14 updates in the /jetty-ee10 directory:

| Package | From | To |
| --- | --- | --- |
| [org.conscrypt:conscrypt-openjdk-uber](https://github.com/google/conscrypt) | `2.6.0` | `2.6.1` |
| [commons-codec:commons-codec](https://github.com/apache/commons-codec) | `1.22.0` | `1.22.1` |
| [org.mariadb.jdbc:mariadb-java-client](https://github.com/mariadb-corporation/mariadb-connector-j) | `3.5.9` | `3.5.10` |
| [io.netty:netty-bom](https://github.com/netty/netty) | `4.2.16.Final` | `4.2.17.Final` |
| [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) | `1.5.38` | `1.6.1` |
| [io.grpc:grpc-core](https://github.com/grpc/grpc-java) | `1.82.2` | `1.83.1` |
| [io.grpc:grpc-netty-shaded](https://github.com/grpc/grpc-java) | `1.82.2` | `1.83.1` |
| [io.smallrye.common:smallrye-common-annotation](https://github.com/smallrye/smallrye-common) | `2.19.0` | `2.20.0` |
| [io.smallrye.common:smallrye-common-cpu](https://github.com/smallrye/smallrye-common) | `2.19.0` | `2.20.0` |
| [org.bouncycastle:bctls-jdk18on](https://github.com/bcgit/bc-java) | `1.84` | `1.85` |
| [org.eclipse.sisu:org.eclipse.sisu.inject](https://github.com/eclipse-sisu/sisu-project) | `1.0.1` | `1.1.0` |
| [org.eclipse.sisu:org.eclipse.sisu.plexus](https://github.com/eclipse-sisu/sisu-project) | `1.0.1` | `1.1.0` |
| org.eclipse.jetty.toolchain:jetty-build-support | `1.5` | `1.6` |
| [org.cyclonedx:cyclonedx-maven-plugin](https://github.com/CycloneDX/cyclonedx-maven-plugin) | `2.9.2` | `2.9.3` |



Updates `org.conscrypt:conscrypt-openjdk-uber` from 2.6.0 to 2.6.1
- [Release notes](https://github.com/google/conscrypt/releases)
- [Commits](google/conscrypt@2.6.0...2.6.1)

Updates `commons-codec:commons-codec` from 1.22.0 to 1.22.1
- [Changelog](https://github.com/apache/commons-codec/blob/master/RELEASE-NOTES.txt)
- [Commits](apache/commons-codec@rel/commons-codec-1.22.0...rel/commons-codec-1.22.1)

Updates `org.mariadb.jdbc:mariadb-java-client` from 3.5.9 to 3.5.10
- [Release notes](https://github.com/mariadb-corporation/mariadb-connector-j/releases)
- [Changelog](https://github.com/mariadb-corporation/mariadb-connector-j/blob/main/CHANGELOG.md)
- [Commits](mariadb-corporation/mariadb-connector-j@3.5.9...3.5.10)

Updates `io.netty:netty-bom` from 4.2.16.Final to 4.2.17.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.16.Final...netty-4.2.17.Final)

Updates `ch.qos.logback:logback-core` from 1.5.38 to 1.6.1
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.5.38...v_1.6.1)

Updates `io.grpc:grpc-core` from 1.82.2 to 1.83.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.82.2...v1.83.1)

Updates `io.grpc:grpc-netty-shaded` from 1.82.2 to 1.83.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.82.2...v1.83.1)

Updates `io.grpc:grpc-netty-shaded` from 1.82.2 to 1.83.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.82.2...v1.83.1)

Updates `io.smallrye.common:smallrye-common-annotation` from 2.19.0 to 2.20.0
- [Release notes](https://github.com/smallrye/smallrye-common/releases)
- [Commits](smallrye/smallrye-common@2.19.0...2.20.0)

Updates `io.smallrye.common:smallrye-common-cpu` from 2.19.0 to 2.20.0
- [Release notes](https://github.com/smallrye/smallrye-common/releases)
- [Commits](smallrye/smallrye-common@2.19.0...2.20.0)

Updates `io.smallrye.common:smallrye-common-cpu` from 2.19.0 to 2.20.0
- [Release notes](https://github.com/smallrye/smallrye-common/releases)
- [Commits](smallrye/smallrye-common@2.19.0...2.20.0)

Updates `org.bouncycastle:bctls-jdk18on` from 1.84 to 1.85
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.eclipse.sisu:org.eclipse.sisu.inject` from 1.0.1 to 1.1.0
- [Release notes](https://github.com/eclipse-sisu/sisu-project/releases)
- [Changelog](https://github.com/eclipse-sisu/sisu-project/blob/main/RELEASE.md)
- [Commits](eclipse-sisu/sisu-project@releases/1.0.1...releases/1.1.0)

Updates `org.eclipse.sisu:org.eclipse.sisu.plexus` from 1.0.1 to 1.1.0
- [Release notes](https://github.com/eclipse-sisu/sisu-project/releases)
- [Changelog](https://github.com/eclipse-sisu/sisu-project/blob/main/RELEASE.md)
- [Commits](eclipse-sisu/sisu-project@releases/1.0.1...releases/1.1.0)

Updates `org.eclipse.sisu:org.eclipse.sisu.plexus` from 1.0.1 to 1.1.0
- [Release notes](https://github.com/eclipse-sisu/sisu-project/releases)
- [Changelog](https://github.com/eclipse-sisu/sisu-project/blob/main/RELEASE.md)
- [Commits](eclipse-sisu/sisu-project@releases/1.0.1...releases/1.1.0)

Updates `org.eclipse.jetty.toolchain:jetty-build-support` from 1.5 to 1.6

Updates `org.cyclonedx:cyclonedx-maven-plugin` from 2.9.2 to 2.9.3
- [Release notes](https://github.com/CycloneDX/cyclonedx-maven-plugin/releases)
- [Commits](CycloneDX/cyclonedx-maven-plugin@cyclonedx-maven-plugin-2.9.2...cyclonedx-maven-plugin-2.9.3)

---
updated-dependencies:
- dependency-name: org.conscrypt:conscrypt-openjdk-uber
  dependency-version: 2.6.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: commons-codec:commons-codec
  dependency-version: 1.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: org.mariadb.jdbc:mariadb-java-client
  dependency-version: 3.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: io.netty:netty-bom
  dependency-version: 4.2.17.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: io.grpc:grpc-core
  dependency-version: 1.83.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: io.grpc:grpc-netty-shaded
  dependency-version: 1.83.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: io.grpc:grpc-netty-shaded
  dependency-version: 1.83.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: io.smallrye.common:smallrye-common-annotation
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: io.smallrye.common:smallrye-common-cpu
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: io.smallrye.common:smallrye-common-cpu
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: org.bouncycastle:bctls-jdk18on
  dependency-version: '1.85'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: org.eclipse.sisu:org.eclipse.sisu.inject
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: org.eclipse.sisu:org.eclipse.sisu.plexus
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: org.eclipse.sisu:org.eclipse.sisu.plexus
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: org.eclipse.jetty.toolchain:jetty-build-support
  dependency-version: '1.6'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: org.cyclonedx:cyclonedx-maven-plugin
  dependency-version: 2.9.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 8, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 15, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 15, 2026
@dependabot
dependabot Bot deleted the dependabot/maven/jetty-ee10/jetty-12.0.x/dev-dependencies-a07323911a branch August 15, 2026 00:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants