Bump the java-dependencies-minor-updates group across 1 directory with 26 updates by dependabot[bot] · Pull Request #2517 · data-team-uhn/cards

dependabot · 2026-10-30T00:06:54Z

Bumps the java-dependencies-minor-updates group with 26 updates in the / directory:

Package	From	To
org.apache.sling:org.apache.sling.auth.core	`2.0.2`	`2.1.2`
org.apache.sling:org.apache.sling.engine	`3.0.2`	`3.0.4`
org.apache.sling:org.apache.sling.resourceresolver	`2.0.6`	`2.0.8`
org.apache.commons:commons-lang3	`3.20.0`	`3.21.0`
org.slf4j:slf4j-api	`2.0.19`	`2.0.20`
org.slf4j:jcl-over-slf4j	`2.0.19`	`2.0.20`
org.slf4j:log4j-over-slf4j	`2.0.19`	`2.0.20`
org.slf4j:jcl-over-slf4j	`2.0.19`	`2.0.20`
org.slf4j:log4j-over-slf4j	`2.0.19`	`2.0.20`
org.apache.jackrabbit:jackrabbit-jcr-commons	`2.22.4`	`2.22.5`
org.apache.jackrabbit:jackrabbit-spi-commons	`2.22.4`	`2.22.5`
org.apache.jackrabbit:jackrabbit-spi-commons	`2.22.4`	`2.22.5`
org.apache.jackrabbit:oak-jackrabbit-api	`2.6.0`	`2.8.0`
org.apache.jackrabbit:oak-api	`2.6.0`	`2.8.0`
org.apache.jackrabbit:oak-core	`2.6.0`	`2.8.0`
org.apache.jackrabbit:oak-core-spi	`2.6.0`	`2.8.0`
org.apache.jackrabbit:oak-store-spi	`2.6.0`	`2.8.0`
org.apache.jackrabbit:oak-security-spi	`2.6.0`	`2.8.0`
org.apache.jackrabbit:oak-jcr	`2.6.0`	`2.8.0`
org.apache.jackrabbit:oak-commons	`2.6.0`	`2.8.0`
org.apache.jackrabbit:oak-query-spi	`2.6.0`	`2.8.0`
org.apache.jackrabbit:oak-shaded-guava	`2.6.0`	`2.8.0`
org.apache.jackrabbit:oak-api	`2.6.0`	`2.8.0`
org.apache.jackrabbit:oak-core	`2.6.0`	`2.8.0`
org.apache.jackrabbit:oak-core-spi	`2.6.0`	`2.8.0`
org.apache.jackrabbit:oak-store-spi	`2.6.0`	`2.8.0`
org.apache.jackrabbit:oak-security-spi	`2.6.0`	`2.8.0`
org.mockito:mockito-core	`5.23.0`	`5.24.0`
com.github.spotbugs:spotbugs	`4.10.4`	`4.10.5`
com.github.spotbugs:spotbugs-maven-plugin	`4.10.4.1`	`4.10.5.0`
org.jacoco:jacoco-maven-plugin	`0.8.15`	`0.8.16`
org.apache.maven.plugins:maven-surefire-plugin	`3.6.0`	`3.6.1`
org.sonatype.central:central-publishing-maven-plugin	`0.11.0`	`0.12.0`
org.apache.jackrabbit:oak-jcr	`2.6.0`	`2.8.0`
org.apache.jackrabbit:oak-commons	`2.6.0`	`2.8.0`
org.apache.jackrabbit:oak-query-spi	`2.6.0`	`2.8.0`
org.apache.jackrabbit:oak-shaded-guava	`2.6.0`	`2.8.0`
com.microsoft.sqlserver:mssql-jdbc	`13.6.0.jre11`	`13.6.1.jre11`

Updates org.apache.sling:org.apache.sling.auth.core from 2.0.2 to 2.1.2

Commits

264284a [maven-release-plugin] prepare release org.apache.sling.auth.core-2.1.2
7f52a63 SLING-13389 : terminate the request when a feedback handler committed the res...
00dd9d2 SLING-13389 : no NPE when an anonymous request carries a "resource" parameter
1901d27 [maven-release-plugin] prepare for next development iteration
fe2c76b [maven-release-plugin] prepare release org.apache.sling.auth.core-2.1.0
8630f92 SLING-13353 : prevent unbounded handleLoginFailure/getAnonymousResolver recur...
b8aa904 SLING-13353 : use explicit anonymous resolver marker check
794c684 chore: remove obsolete CLAUDE.md pointer (#30)
0b9270d SLING-13353 : prevent unbounded handleLoginFailure/getAnonymousResolver recur...
dde2537 SLING-13257: Improve Test Coverage (#27)
Additional commits viewable in compare view

Updates org.apache.sling:org.apache.sling.engine from 3.0.2 to 3.0.4

Commits

38c4a58 [maven-release-plugin] prepare release org.apache.sling.engine-3.0.4
4f9a404 chore: remove obsolete CLAUDE.md pointer (#98)
11bdcee SLING-13372 enforce configured multipart limits on streamed uploads (#102)
3b39e37 SLING-13371 Fix path resolution divergence for ';' path parameters (#101)
8f60137 SLING-13370 improve error handling (#100)
2e0ca88 SLING-13368 don't log sensitive information on the DefaulErrorHandler (#99)
d6feb03 SLING-13365 fail by default when providing more than 10'000 parameters (#96)
83af5ac SLING-13366 don't log un-escaped input (#97)
7ffd016 SLING-13364 if the parameter parsing fails throw a statuscode 400 (#95)
7b6c7b5 SLING-13362 fix parameter parsing (#94)
Additional commits viewable in compare view

Updates org.apache.sling:org.apache.sling.resourceresolver from 2.0.6 to 2.0.8

Commits

6ed39f7 [maven-release-plugin] prepare release org.apache.sling.resourceresolver-2.0.8
375dd66 SLING-13388: Paged query for aliases fails due to stale alias index and shift...
f57cea1 SLING-13326 Fix caching for getParentResourceType (#236)
baa80ed SLING-13384: Resource Resolver: add support for tests on actual JCR implement...
ce88b10 SLING-13323: when paging encounters unexpected values, log the position insid...
330d1f3 SLING-13327: add metrics related to observation events related to vanity path...
b3c87ef [maven-release-plugin] prepare for next development iteration
See full diff in compare view

Updates org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0

Updates org.slf4j:slf4j-api from 2.0.19 to 2.0.20

Updates org.slf4j:jcl-over-slf4j from 2.0.19 to 2.0.20

Updates org.slf4j:log4j-over-slf4j from 2.0.19 to 2.0.20

Updates org.slf4j:jcl-over-slf4j from 2.0.19 to 2.0.20

Updates org.slf4j:log4j-over-slf4j from 2.0.19 to 2.0.20

Updates org.apache.jackrabbit:jackrabbit-jcr-commons from 2.22.4 to 2.22.5

Changelog

Sourced from org.apache.jackrabbit:jackrabbit-jcr-commons's changelog.

Changes in Jackrabbit 2.22.5

** Improvement * [JCR-5260] - Uncaught non-RepositoryException types in HTTP responses break JCR clients * [JCR-5261] - WebDAV lock tokens violate specs due to path-based generation

For more detailed information about all the changes in this and other Jackrabbit releases, please see the Jackrabbit issue tracker at
https://issues.apache.org/jira/browse/JCR
Release Contents

This release consists of a single source archive packaged as a zip file. The archive can be unpacked with the jar tool from your JDK installation. See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a PGP signature that you can use to verify the authenticity of your download. The public key used for the PGP signature can be found at https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit

Apache Jackrabbit is a fully conforming implementation of the Content Repository for Java Technology API (JCR). A content repository is a hierarchical content store with support for structured and unstructured content, full text search, versioning, transactions, observation, and more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation

Established in 1999, The Apache Software Foundation provides organizational, legal, and financial support for more than 140 freely-available, collaboratively-developed Open Source projects. The pragmatic Apache License enables individual and commercial users to easily deploy Apache software; the Foundation's intellectual property framework limits the legal exposure of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks

... (truncated)

Commits

f1830d0 [maven-release-plugin] prepare release jackrabbit-2.22.5
f038478 JCR-5264: Release Jackrabbit 2.22.5 - Candidate Release Notes
2eba68d jcr-server: WebDAV lock tokens violate specs due to path-based generation (#377)
69b031e jcr2dav: Uncaught non-RepositoryException types in HTTP responses break JCR c...
e494ab2 JCR-5238: Release Jackrabbit 2.22.4 (#365)
63d7c8d [maven-release-plugin] prepare for next development iteration
2a86814 [maven-release-plugin] prepare release jackrabbit-2.22.4
See full diff in compare view

Updates org.apache.jackrabbit:jackrabbit-spi-commons from 2.22.4 to 2.22.5

Changelog

Sourced from org.apache.jackrabbit:jackrabbit-spi-commons's changelog.

Changes in Jackrabbit 2.22.5

** Improvement * [JCR-5260] - Uncaught non-RepositoryException types in HTTP responses break JCR clients * [JCR-5261] - WebDAV lock tokens violate specs due to path-based generation

For more detailed information about all the changes in this and other Jackrabbit releases, please see the Jackrabbit issue tracker at
https://issues.apache.org/jira/browse/JCR
Release Contents

This release consists of a single source archive packaged as a zip file. The archive can be unpacked with the jar tool from your JDK installation. See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a PGP signature that you can use to verify the authenticity of your download. The public key used for the PGP signature can be found at https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit

Apache Jackrabbit is a fully conforming implementation of the Content Repository for Java Technology API (JCR). A content repository is a hierarchical content store with support for structured and unstructured content, full text search, versioning, transactions, observation, and more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation

Established in 1999, The Apache Software Foundation provides organizational, legal, and financial support for more than 140 freely-available, collaboratively-developed Open Source projects. The pragmatic Apache License enables individual and commercial users to easily deploy Apache software; the Foundation's intellectual property framework limits the legal exposure of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks

... (truncated)

Commits

f1830d0 [maven-release-plugin] prepare release jackrabbit-2.22.5
f038478 JCR-5264: Release Jackrabbit 2.22.5 - Candidate Release Notes
2eba68d jcr-server: WebDAV lock tokens violate specs due to path-based generation (#377)
69b031e jcr2dav: Uncaught non-RepositoryException types in HTTP responses break JCR c...
e494ab2 JCR-5238: Release Jackrabbit 2.22.4 (#365)
63d7c8d [maven-release-plugin] prepare for next development iteration
2a86814 [maven-release-plugin] prepare release jackrabbit-2.22.4
See full diff in compare view

Updates org.apache.jackrabbit:jackrabbit-spi-commons from 2.22.4 to 2.22.5

Changelog

Sourced from org.apache.jackrabbit:jackrabbit-spi-commons's changelog.

Changes in Jackrabbit 2.22.5

** Improvement * [JCR-5260] - Uncaught non-RepositoryException types in HTTP responses break JCR clients * [JCR-5261] - WebDAV lock tokens violate specs due to path-based generation

For more detailed information about all the changes in this and other Jackrabbit releases, please see the Jackrabbit issue tracker at
https://issues.apache.org/jira/browse/JCR
Release Contents

This release consists of a single source archive packaged as a zip file. The archive can be unpacked with the jar tool from your JDK installation. See the README.txt file for instructions on how to build this release.

The source archive is accompanied by an SHA512 checksum and a PGP signature that you can use to verify the authenticity of your download. The public key used for the PGP signature can be found at https://www.apache.org/dist/jackrabbit/KEYS.

About Apache Jackrabbit

Apache Jackrabbit is a fully conforming implementation of the Content Repository for Java Technology API (JCR). A content repository is a hierarchical content store with support for structured and unstructured content, full text search, versioning, transactions, observation, and more.

For more information, visit http://jackrabbit.apache.org/

About The Apache Software Foundation

Established in 1999, The Apache Software Foundation provides organizational, legal, and financial support for more than 140 freely-available, collaboratively-developed Open Source projects. The pragmatic Apache License enables individual and commercial users to easily deploy Apache software; the Foundation's intellectual property framework limits the legal exposure of its 3,800+ contributors.

For more information, visit http://www.apache.org/

Trademarks

... (truncated)

Commits

f1830d0 [maven-release-plugin] prepare release jackrabbit-2.22.5
f038478 JCR-5264: Release Jackrabbit 2.22.5 - Candidate Release Notes
2eba68d jcr-server: WebDAV lock tokens violate specs due to path-based generation (#377)
69b031e jcr2dav: Uncaught non-RepositoryException types in HTTP responses break JCR c...
e494ab2 JCR-5238: Release Jackrabbit 2.22.4 (#365)
63d7c8d [maven-release-plugin] prepare for next development iteration
2a86814 [maven-release-plugin] prepare release jackrabbit-2.22.4
See full diff in compare view

Updates org.apache.jackrabbit:oak-jackrabbit-api from 2.6.0 to 2.8.0

Updates org.apache.jackrabbit:oak-api from 2.6.0 to 2.8.0

Updates org.apache.jackrabbit:oak-core from 2.6.0 to 2.8.0

Updates org.apache.jackrabbit:oak-core-spi from 2.6.0 to 2.8.0

Updates org.apache.jackrabbit:oak-store-spi from 2.6.0 to 2.8.0

Updates org.apache.jackrabbit:oak-security-spi from 2.6.0 to 2.8.0

Updates org.apache.jackrabbit:oak-jcr from 2.6.0 to 2.8.0

Updates org.apache.jackrabbit:oak-commons from 2.6.0 to 2.8.0

Updates org.apache.jackrabbit:oak-query-spi from 2.6.0 to 2.8.0

Updates org.apache.jackrabbit:oak-shaded-guava from 2.6.0 to 2.8.0

Updates org.apache.jackrabbit:oak-api from 2.6.0 to 2.8.0

Updates org.apache.jackrabbit:oak-core from 2.6.0 to 2.8.0

Updates org.apache.jackrabbit:oak-core-spi from 2.6.0 to 2.8.0

Updates org.apache.jackrabbit:oak-store-spi from 2.6.0 to 2.8.0

Updates org.apache.jackrabbit:oak-security-spi from 2.6.0 to 2.8.0

Updates org.mockito:mockito-core from 5.23.0 to 5.24.0

Release notes

Sourced from org.mockito:mockito-core's releases.

v5.24.0

Changelog generated by Shipkit Changelog Gradle Plugin

5.24.0

2026-09-23 - 27 commit(s) by Andrei Solntsev, DragonFSKY, Hünkar Can Tunç, Joshua Selbo, M. Minot, Markus Gaisbauer, Mirko Alicastro, Vinod Kumar M ( codingkiddo ), dependabot[bot]

Fix Mockito docs for -javaagent flag with Gradle [(#3866)](mockito/mockito#3866)

Kotlin example for adding Mockito as an agent is incorrect [(#3864)](mockito/mockito#3864)

Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 [(#3862)](mockito/mockito#3862)

Bump gradle/actions from 6.2.0 to 6.3.0 [(#3852)](mockito/mockito#3852)

Bump gradle/actions from 5 to 6.2.0 [(#3851)](mockito/mockito#3851)

Preserve method parameters when clearing inline mocks [(#3847)](mockito/mockito#3847)

Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 [(#3845)](mockito/mockito#3845)

Print object fields via reflection when toString() is not implemented [(#3844)](mockito/mockito#3844)

Migrate extensions-tests to JUnit Jupiter [(#3840)](mockito/mockito#3840)

Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 [(#3839)](mockito/mockito#3839)

docs(when-verify): fixes to explanations about redundancy [(#3838)](mockito/mockito#3838)

Confusing inconsistency in example method calls in “stubbing and verifying is redundant” note of “when” and “verify” Javadoc [(#3837)](mockito/mockito#3837)

Bump actions/checkout from 6 to 7 [(#3836)](mockito/mockito#3836)

Fixes #2740 : Add mockMaker option to @Spy annotation [(#3835)](mockito/mockito#3835)

Bump graalvm/setup-graalvm from 1.5.5 to 1.5.6 [(#3834)](mockito/mockito#3834)

Bump graalvm/setup-graalvm from 1.5.4 to 1.5.5 [(#3833)](mockito/mockito#3833)

Bump codecov/codecov-action from 6 to 7 [(#3831)](mockito/mockito#3831)

Bump graalvm/setup-graalvm from 1.4.5 to 1.5.4 [(#3830)](mockito/mockito#3830)

Fix clearInlineMocks not de-registering singleton mocks [(#3829)](mockito/mockito#3829)

Fix NotAMockException when using mockSingleton with MockitoJUnit [(#3827)](mockito/mockito#3827)

NotAMockException when using mockSingleton with MockitoSession or MockitoJUnit [(#3826)](mockito/mockito#3826)

Improve Gradle agent docs for configuration cache [(#3823)](mockito/mockito#3823)

Gradle documentation for setting up instrumentation with Gradle configuration cache [(#3822)](mockito/mockito#3822)

Fixes #3818 : Fix data race in InvocationContainerImpl.invocationForStubbing [(#3819)](mockito/mockito#3819)

Data race on invocationForPotentialStubbing [(#3818)](mockito/mockito#3818)

Fixes #3814 : implement package-level clinit suppression [(#3815)](mockito/mockito#3815)

Package-level clinit suppression [(#3814)](mockito/mockito#3814)

Upgrade Android Gradle Plugin to 8.13.2 [(#3812)](mockito/mockito#3812)

Replaces raw generic types with type parameters [(#3806)](mockito/mockito#3806)

Fixes #2398 : Implement global suppress static initialization leveraging java agent [(#3801)](mockito/mockito#3801)

Bump codecov/codecov-action from 5 to 6 [(#3800)](mockito/mockito#3800)

Fix non-deterministic AssertionError when using MockMakers.SUBCLASS (#3406, #2823) [(#3795)](mockito/mockito#3795)

Fixes #3536 : Implement SpyStatic API [(#3794)](mockito/mockito#3794)

The class's MethodParameters are removed after clearAllCaches is invoked [(#3763)](mockito/mockito#3763)

[FeatureRequest / Idea] Create Mockito.spyStatic [(#3536)](mockito/mockito#3536)

Add option to specify mockmaker for @Spy [(#2740)](mockito/mockito#2740)

How can I suppress static initializer? [(#2398)](mockito/mockito#2398)

Commits

5a2f0f8 Fix Mockito docs for -javaagent flag with Gradle (#3866)
9c5f36f Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 (#3862)
e7fd06d Preserve method parameters when clearing inline mocks (#3847)
5a676bc Bump gradle/actions from 6.2.0 to 6.3.0 (#3852)
508f8e7 Bump gradle/actions from 5 to 6.2.0 (#3851)
ee8a330 Print object fields via reflection when toString() is not implemented (#3844)
39b1aba Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 (#3845)
d8638e1 Migrate extensions-tests to JUnit Jupiter (#3840)
0aab922 Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 (#3839)
f3cf74c docs(when-verify): fixes to explanations about redundancy (#3838)
Additional commits viewable in compare view

Updates com.github.spotbugs:spotbugs from 4.10.4 to 4.10.5

Release notes

Sourced from com.github.spotbugs:spotbugs's releases.

4.10.5

SpotBugs 4.10.5

CHANGELOG

Added

Add ReflectiveAccessTracker to track fields accessed via reflection - such as VarHandle, MethodHandle or AtomicFieldUpdaters (#3954) to fix issue (#2749)

Add automatic completion of class names in GUI class filter (#749)

Changed

@SuppressFBWarnings annotation on a method or a constructor now suppresses warnings reported in their lambdas too (#724)

Replace deprecated calls to 'SignatureParser' to 'GenericSignatureParser' where feasible (#4336)

Declaring to the interface lists/maps (#4381)

Fixed

Fix NP_NULL_ON_SOME_PATH false positive when a field null check that throws uses field == null but not null == field (#4147)

Fix RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT false negative when the ignored result comes from Arrays.copyOf, Arrays.copyOfRange or any pure static method or constructor of a class using assert (#3900)

Fix AA_ASSERTION_OF_ARGUMENTS false negative when a public method validates a parameter with assert and instanceof (#4305)

Fix PT_ABSOLUTE_PATH_TRAVERSAL false negative for new File(parent, child), where the attacker controlled segment is the second argument (#4340)

Fix 'DM_USELESS_THREAD' false negative for Thread subclasses that do not override run() (#4306)

Fix UL_UNRELEASED_LOCK false negative when a method acquires a lock and never calls unlock (#4310)

Fix TLW_TWO_LOCK_WAIT false negatives when a class waits while holding two monitors but has no matching notify() call (#4323)

Fix NP_ALWAYS_NULL false positives when a non-null value is known to satisfy an instanceof check (#4272)

Fix RANGE_ARRAY_INDEX false positive when the array access is inside unreachable code caused by an impossible null condition (e.g. if (x == null && x != null)) (#4275)

Fix NP_NULL_ON_SOME_PATH false positive when instanceof check is always true because the value was created with new and its exact type is a subtype of the checked type (e.g. Base value = new Derived(); if (value instanceof Derived) result = new Object(); result.toString()) (#4273)

Fix NN_NAKED_NOTIFY false positive when guarded state is updated before the synchronized block that calls notify/notifyAll (#3786)

Fix SA_LOCAL_SELF_ASSIGNMENT false positive in methods with ++/-- inside a switch nested in a try-catch block (#3929)

Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE false negative for non-atomic read-modify-write in inner classes accessing enclosing shared fields (#4236)

Fix OS_OPEN_STREAM false positive when the result of PrintWriter.append() is reassigned before closing the writer (#4274)

Fix OS_OPEN_STREAM false positive when a stream is wrapped (e.g. in a PrintStream, BufferedOutputStream or PrintWriter) and the wrapped stream is closed instead of the wrapper (#4304)

Fix SING_SINGLETON_GETTER_NOT_SYNCHRONIZED false negative when lazy init uses a ternary assignment instead of an if statement (#4154)

Fix UR_UNINIT_READ false negative for compound assignment to a field (e.g. m_iType |= e) (#4233)

Fix NP_BOOLEAN_RETURN_NULL false negative when null is returned via a local variable (#4234)

Fix MS_EXPOSE_BUF and EI_EXPOSE_BUF false negative when returning Buffer.array() (#4235)

Fix OBL_UNSATISFIED_OBLIGATION false negatives for unclosed CallableStatements returned by Connection.prepareCall (#4148)

Fix LI_LAZY_INIT_STATIC false negative when field is lazily initialized using a method call (#4276)

Fix DMI_RANDOM_USED_ONLY_ONCE FP when Random is used inside loop but created before (#3937)

Fix SARIF output writing source-location URI syntax exceptions to stderr when source filenames are unknown (#1412)

Fix IL_INFINITE_LOOP false positives for loops with conditions that are statically known to be true or false (#3904)

Narrow the definition of singletons (#2985)

Fix NP_LOAD_OF_KNOWN_NULL_VALUE false negative when null check uses instanceof (#3916)

Fix MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR false negative when a constructor calls an overridable method that takes arguments, such as a setter (e.g. setValue(value)) (#4309)

Fix CLI launcher scripts intercepting -conserveSpace with a JVM system property instead passing it to Java Application as equivalent to -effort:min (#4268)

Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when clone() assigns a newly created lock object to the copy (#4320)

Fix CT_CONSTRUCTOR_THROW false positive with sealed classes (#4259)

Fix JrtfsCodeBase resolving JDK classes from the module image of the running JVM instead of the JDK the given jrt-fs.jar belongs to, so that -auxclasspath <other-jdk>/lib/jrt-fs.jar is honoured (#4329)

Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when a lock is assigned to a newly allocated object (#4331)

Do not flag writeReplace() and writeExternal() as mutators (#1719)

Prevent XML external entity resolution in user-controlled data (#4365)

Fix handling of JSpecify type-use annotations in CheckRelaxingNullnessAnnotation (#4389)

Stop reporting missing java.applet at java 26 or higher (#4390)

... (truncated)

Changelog

Sourced from com.github.spotbugs:spotbugs's changelog.

4.10.5 - 2026-10-11

Added

Add ReflectiveAccessTracker to track fields accessed via reflection - such as VarHandle, MethodHandle or AtomicFieldUpdaters (#3954) to fix issue (#2749)

Add automatic completion of class names in GUI class filter (#749)

Changed

@SuppressFBWarnings annotation on a method or a constructor now suppresses warnings reported in their lambdas too (#724)

Replace deprecated calls to 'SignatureParser' to 'GenericSignatureParser' where feasible (#4336)

Declaring to the interface lists/maps (#4381)

Fixed

Fix NP_NULL_ON_SOME_PATH false positive when a field null check that throws uses field == null but not null == field (#4147)

Fix RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT false negative when the ignored result comes from Arrays.copyOf, Arrays.copyOfRange or any pure static method or constructor of a class using assert (#3900)

Fix AA_ASSERTION_OF_ARGUMENTS false negative when a public method validates a parameter with assert and instanceof (#4305)

Fix PT_ABSOLUTE_PATH_TRAVERSAL false negative for new File(parent, child), where the attacker controlled segment is the second argument (#4340)

Fix 'DM_USELESS_THREAD' false negative for Thread subclasses that do not override run() (#4306)

Fix UL_UNRELEASED_LOCK false negative when a method acquires a lock and never calls unlock (#4310)

Fix TLW_TWO_LOCK_WAIT false negatives when a class waits while holding two monitors but has no matching notify() call (#4323)

Fix NP_ALWAYS_NULL false positives when a non-null value is known to satisfy an instanceof check (#4272)

Fix RANGE_ARRAY_INDEX false positive when the array access is inside unreachable code caused by an impossible null condition (e.g. if (x == null && x != null)) (#4275)

Fix NP_NULL_ON_SOME_PATH false positive when instanceof check is always true because the value was created with new and its exact type is a subtype of the checked type (e.g. Base value = new Derived(); if (value instanceof Derived) result = new Object(); result.toString()) (#4273)

Fix NN_NAKED_NOTIFY false positive when guarded state is updated before the synchronized block that calls notify/notifyAll (#3786)

Fix SA_LOCAL_SELF_ASSIGNMENT false positive in methods with ++/-- inside a switch nested in a try-catch block (#3929)

Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE false negative for non-atomic read-modify-write in inner classes accessing enclosing shared fields (#4236)

Fix OS_OPEN_STREAM false positive when the result of PrintWriter.append() is reassigned before closing the writer (#4274)

Fix OS_OPEN_STREAM false positive when a stream is wrapped (e.g. in a PrintStream, BufferedOutputStream or PrintWriter) and the wrapped stream is closed instead of the wrapper (#4304)

Fix SING_SINGLETON_GETTER_NOT_SYNCHRONIZED false negative when lazy init uses a ternary assignment instead of an if statement (#4154)

Fix UR_UNINIT_READ false negative for compound assignment to a field (e.g. m_iType |= e) (#4233)

Fix NP_BOOLEAN_RETURN_NULL false negative when null is returned via a local variable (#4234)

Fix MS_EXPOSE_BUF and EI_EXPOSE_BUF false negative when returning Buffer.array() (#4235)

Fix OBL_UNSATISFIED_OBLIGATION false negatives for unclosed CallableStatements returned by Connection.prepareCall (#4148)

Fix LI_LAZY_INIT_STATIC false negative when field is lazily initialized using a method call (#4276)

Fix DMI_RANDOM_USED_ONLY_ONCE FP when Random is used inside loop but created before (#3937)

Fix SARIF output writing source-location URI syntax exceptions to stderr when source filenames are unknown (#1412)

Fix IL_INFINITE_LOOP false positives for loops with conditions that are statically known to be true or false (#3904)

Narrow the definition of singletons (#2985)

Fix NP_LOAD_OF_KNOWN_NULL_VALUE false negative when null check uses instanceof (#3916)

Fix MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR false negative when a constructor calls an overridable method that takes arguments, such as a setter (e.g. setValue(value)) (#4309)

Fix CLI launcher scripts intercepting -conserveSpace with a JVM system property instead passing it to Java Application as equivalent to -effort:min (#4268)

Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when clone() assigns a newly created lock object to the copy (#4320)

Fix CT_CONSTRUCTOR_THROW false positive with sealed classes (#4259)

Fix JrtfsCodeBase resolving JDK classes from the module image of the running JVM instead of the JDK the given jrt-fs.jar belongs to, so that -auxclasspath <other-jdk>/lib/jrt-fs.jar is honoured (#4329)

Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when a lock is assigned to a newly allocated object (#4331)

Do not flag writeReplace() and writeExternal() as mutators (#1719)

Prevent XML external entity resolution in user-controlled data (#4365)

Fix handling of JSpecify type-use annotations in CheckRelaxingNullnessAnnotation (#4389)

Stop reporting missing java.applet at java 26 or higher (#4390)

Commits

6816eb2 release v4.10.5
6d4cc68 chore(tests): Migrate further to jspecify for Nonnull/Nullable in tests (#4392)
fd4200b chore(tests): Migrate further to jspecify for Nonnull/Nullable in tests (#4391)
c29dd08 chore(fix): Stop reporting missing java.applet at java 26 or higher (#4390)
7f809fc Fix handling of JSpecify type-use annotations in `CheckRelaxingNullnessAnnota...
8a1f6f9 fix(deps): update asm to v9.11 (#4388)
d2de0a3 chore(deps): update dependency com.diffplug.spotless:spotless-plugin-gradle t...
0b84657 chore(deps): update plugin com.diffplug.spotless to v8.10.4 (#4387)
9442ed2 fix(deps): update dependency org.checkerframework:checker-qual to v4.3.1 (#4385)
c359ba3 chore(cleanup): Minor cleanup (#4384)
Additional commits viewable in compare view

Updates com.github.spotbugs:spotbugs-maven-plugin from 4.10.4.1 to 4.10.5.0

Release notes

Sourced from com.github.spotbugs:spotbugs-maven-plugin's releases.

Spotbugs Maven Plugin 4.10.5.0

What's Changed

Supports spotbuts 4.10.5

Various other library updates, other pull requests listed below

Update groovy monorepo to v5.1.2 by @renovate[bot] in spotbugs/spotbugs-maven-plugin#1521

Update dependency org.codehaus.mojo:l10n-maven-plugin to v1.2.1 by @renovate[bot] in spotbugs/spotbugs-maven-plugin#1525

Update dependency org.codehaus.mojo:exec-maven-plugin to v3.6.4 by @renovate[bot] in spotbugs/spotbugs-maven-plugin#1524

Update dependency org.apache.bcel:bcel to v6.13.0 by @renovate[bot] in spotbugs/spotbugs-maven-plugin#1526

Update github/codeql-action action to v4.38.0 by @renovate[bot] in spotbugs/spotbugs-maven-plugin#1527

Update actions/setup-java action to v6.0.1 by @renovate[bot] in spotbugs/spotbugs-maven-plugin#1523

Update actions/setup-java digest to de7274f by @renovate[bot] in spotbugs/spotbugs-maven-plugin#1522

Update pluginPluginVersion to v3.16.0 by @renovate[bot] in spotbugs/spotbugs-maven-plugin#1528

Update byte-buddy.version to v1.18.14 by @renovate[bot] in spotbugs/spotbugs-maven-plugin#1530

Update dependency org.slf4j:slf4j-bom to v2.0.20 by @renovate[bot] in spotbugs/spotbugs-maven-plugin#1531

build updates by @hazendaz in spotbugs/spotbugs-maven-plugin#1532

Full Changelog: spotbugs/spotbugs-maven-plugin@spotbugs-maven-plugin-4.10.4.1...spotbugs-maven-plugin-4.10.5.0

Commits

74f5dd6 [maven-release-plugin] prepare release spotbugs-maven-plugin-4.10.5.0
37501b1 [pom] Exclude jcl over slf4j from maven core
fe7730c [pom] Adjust required to build maven to 3.9.16 as 3.10.0 needs more work
ee87607 [pom] Build internals off maven 3.10.0
18a8404 [pom] Bump maven shared utils to 3.5.0
abd6753 [pom] Bump groovy to 5.1.3
187fad4 [pom] Bump base parent to 62
9e4846b [pom] Bump commons-lang to 3.21.0
27cd67a [pom] Bump asm to 9.11
c556077 [pom] Bump to spotbugs 4.10.5
Additional commits viewable in compare view

Updates org.jacoco:jacoco-maven-plugin from 0.8.15 to 0.8.16

Release notes

Sourced from org.jacoco:jacoco-maven-plugin's releases.

0.8.16

New Features

JaCoCo now officially supports Java 27 (GitHub #2287).

Experimental support for Java 28 class files (GitHub #2170,

…h 26 updates Bumps the java-dependencies-minor-updates group with 26 updates in the / directory: | Package | From | To | | --- | --- | --- | | [org.apache.sling:org.apache.sling.auth.core](https://github.com/apache/sling-org-apache-sling-auth-core) | `2.0.2` | `2.1.2` | | [org.apache.sling:org.apache.sling.engine](https://github.com/apache/sling-org-apache-sling-engine) | `3.0.2` | `3.0.4` | | [org.apache.sling:org.apache.sling.resourceresolver](https://github.com/apache/sling-org-apache-sling-resourceresolver) | `2.0.6` | `2.0.8` | | org.apache.commons:commons-lang3 | `3.20.0` | `3.21.0` | | org.slf4j:slf4j-api | `2.0.19` | `2.0.20` | | org.slf4j:jcl-over-slf4j | `2.0.19` | `2.0.20` | | org.slf4j:log4j-over-slf4j | `2.0.19` | `2.0.20` | | org.slf4j:jcl-over-slf4j | `2.0.19` | `2.0.20` | | org.slf4j:log4j-over-slf4j | `2.0.19` | `2.0.20` | | [org.apache.jackrabbit:jackrabbit-jcr-commons](https://github.com/apache/jackrabbit) | `2.22.4` | `2.22.5` | | [org.apache.jackrabbit:jackrabbit-spi-commons](https://github.com/apache/jackrabbit) | `2.22.4` | `2.22.5` | | [org.apache.jackrabbit:jackrabbit-spi-commons](https://github.com/apache/jackrabbit) | `2.22.4` | `2.22.5` | | org.apache.jackrabbit:oak-jackrabbit-api | `2.6.0` | `2.8.0` | | org.apache.jackrabbit:oak-api | `2.6.0` | `2.8.0` | | org.apache.jackrabbit:oak-core | `2.6.0` | `2.8.0` | | org.apache.jackrabbit:oak-core-spi | `2.6.0` | `2.8.0` | | org.apache.jackrabbit:oak-store-spi | `2.6.0` | `2.8.0` | | org.apache.jackrabbit:oak-security-spi | `2.6.0` | `2.8.0` | | org.apache.jackrabbit:oak-jcr | `2.6.0` | `2.8.0` | | org.apache.jackrabbit:oak-commons | `2.6.0` | `2.8.0` | | org.apache.jackrabbit:oak-query-spi | `2.6.0` | `2.8.0` | | org.apache.jackrabbit:oak-shaded-guava | `2.6.0` | `2.8.0` | | org.apache.jackrabbit:oak-api | `2.6.0` | `2.8.0` | | org.apache.jackrabbit:oak-core | `2.6.0` | `2.8.0` | | org.apache.jackrabbit:oak-core-spi | `2.6.0` | `2.8.0` | | org.apache.jackrabbit:oak-store-spi | `2.6.0` | `2.8.0` | | org.apache.jackrabbit:oak-security-spi | `2.6.0` | `2.8.0` | | [org.mockito:mockito-core](https://github.com/mockito/mockito) | `5.23.0` | `5.24.0` | | [com.github.spotbugs:spotbugs](https://github.com/spotbugs/spotbugs) | `4.10.4` | `4.10.5` | | [com.github.spotbugs:spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) | `4.10.4.1` | `4.10.5.0` | | [org.jacoco:jacoco-maven-plugin](https://github.com/jacoco/jacoco) | `0.8.15` | `0.8.16` | | [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.6.0` | `3.6.1` | | [org.sonatype.central:central-publishing-maven-plugin](https://github.com/sonatype-nexus-community/central-publishing-maven-plugin) | `0.11.0` | `0.12.0` | | org.apache.jackrabbit:oak-jcr | `2.6.0` | `2.8.0` | | org.apache.jackrabbit:oak-commons | `2.6.0` | `2.8.0` | | org.apache.jackrabbit:oak-query-spi | `2.6.0` | `2.8.0` | | org.apache.jackrabbit:oak-shaded-guava | `2.6.0` | `2.8.0` | | [com.microsoft.sqlserver:mssql-jdbc](https://github.com/Microsoft/mssql-jdbc) | `13.6.0.jre11` | `13.6.1.jre11` | Updates `org.apache.sling:org.apache.sling.auth.core` from 2.0.2 to 2.1.2 - [Commits](apache/sling-org-apache-sling-auth-core@org.apache.sling.auth.core-2.0.2...org.apache.sling.auth.core-2.1.2) Updates `org.apache.sling:org.apache.sling.engine` from 3.0.2 to 3.0.4 - [Commits](apache/sling-org-apache-sling-engine@org.apache.sling.engine-3.0.2...org.apache.sling.engine-3.0.4) Updates `org.apache.sling:org.apache.sling.resourceresolver` from 2.0.6 to 2.0.8 - [Commits](apache/sling-org-apache-sling-resourceresolver@org.apache.sling.resourceresolver-2.0.6...org.apache.sling.resourceresolver-2.0.8) Updates `org.apache.commons:commons-lang3` from 3.20.0 to 3.21.0 Updates `org.slf4j:slf4j-api` from 2.0.19 to 2.0.20 Updates `org.slf4j:jcl-over-slf4j` from 2.0.19 to 2.0.20 Updates `org.slf4j:log4j-over-slf4j` from 2.0.19 to 2.0.20 Updates `org.slf4j:jcl-over-slf4j` from 2.0.19 to 2.0.20 Updates `org.slf4j:log4j-over-slf4j` from 2.0.19 to 2.0.20 Updates `org.apache.jackrabbit:jackrabbit-jcr-commons` from 2.22.4 to 2.22.5 - [Changelog](https://github.com/apache/jackrabbit/blob/jackrabbit-2.22.5/RELEASE-NOTES.txt) - [Commits](apache/jackrabbit@jackrabbit-2.22.4...jackrabbit-2.22.5) Updates `org.apache.jackrabbit:jackrabbit-spi-commons` from 2.22.4 to 2.22.5 - [Changelog](https://github.com/apache/jackrabbit/blob/jackrabbit-2.22.5/RELEASE-NOTES.txt) - [Commits](apache/jackrabbit@jackrabbit-2.22.4...jackrabbit-2.22.5) Updates `org.apache.jackrabbit:jackrabbit-spi-commons` from 2.22.4 to 2.22.5 - [Changelog](https://github.com/apache/jackrabbit/blob/jackrabbit-2.22.5/RELEASE-NOTES.txt) - [Commits](apache/jackrabbit@jackrabbit-2.22.4...jackrabbit-2.22.5) Updates `org.apache.jackrabbit:oak-jackrabbit-api` from 2.6.0 to 2.8.0 Updates `org.apache.jackrabbit:oak-api` from 2.6.0 to 2.8.0 Updates `org.apache.jackrabbit:oak-core` from 2.6.0 to 2.8.0 Updates `org.apache.jackrabbit:oak-core-spi` from 2.6.0 to 2.8.0 Updates `org.apache.jackrabbit:oak-store-spi` from 2.6.0 to 2.8.0 Updates `org.apache.jackrabbit:oak-security-spi` from 2.6.0 to 2.8.0 Updates `org.apache.jackrabbit:oak-jcr` from 2.6.0 to 2.8.0 Updates `org.apache.jackrabbit:oak-commons` from 2.6.0 to 2.8.0 Updates `org.apache.jackrabbit:oak-query-spi` from 2.6.0 to 2.8.0 Updates `org.apache.jackrabbit:oak-shaded-guava` from 2.6.0 to 2.8.0 Updates `org.apache.jackrabbit:oak-api` from 2.6.0 to 2.8.0 Updates `org.apache.jackrabbit:oak-core` from 2.6.0 to 2.8.0 Updates `org.apache.jackrabbit:oak-core-spi` from 2.6.0 to 2.8.0 Updates `org.apache.jackrabbit:oak-store-spi` from 2.6.0 to 2.8.0 Updates `org.apache.jackrabbit:oak-security-spi` from 2.6.0 to 2.8.0 Updates `org.mockito:mockito-core` from 5.23.0 to 5.24.0 - [Release notes](https://github.com/mockito/mockito/releases) - [Commits](mockito/mockito@v5.23.0...v5.24.0) Updates `com.github.spotbugs:spotbugs` from 4.10.4 to 4.10.5 - [Release notes](https://github.com/spotbugs/spotbugs/releases) - [Changelog](https://github.com/spotbugs/spotbugs/blob/master/CHANGELOG.md) - [Commits](spotbugs/spotbugs@4.10.4...4.10.5) Updates `com.github.spotbugs:spotbugs-maven-plugin` from 4.10.4.1 to 4.10.5.0 - [Release notes](https://github.com/spotbugs/spotbugs-maven-plugin/releases) - [Commits](spotbugs/spotbugs-maven-plugin@spotbugs-maven-plugin-4.10.4.1...spotbugs-maven-plugin-4.10.5.0) Updates `org.jacoco:jacoco-maven-plugin` from 0.8.15 to 0.8.16 - [Release notes](https://github.com/jacoco/jacoco/releases) - [Commits](jacoco/jacoco@v0.8.15...v0.8.16) Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.6.0 to 3.6.1 - [Release notes](https://github.com/apache/maven-surefire/releases) - [Commits](apache/maven-surefire@surefire-3.6.0...surefire-3.6.1) Updates `org.sonatype.central:central-publishing-maven-plugin` from 0.11.0 to 0.12.0 - [Release notes](https://github.com/sonatype-nexus-community/central-publishing-maven-plugin/releases) - [Commits](https://github.com/sonatype-nexus-community/central-publishing-maven-plugin/commits/release-0.12.0) Updates `org.apache.jackrabbit:oak-jcr` from 2.6.0 to 2.8.0 Updates `org.apache.jackrabbit:oak-commons` from 2.6.0 to 2.8.0 Updates `org.apache.jackrabbit:oak-query-spi` from 2.6.0 to 2.8.0 Updates `org.apache.jackrabbit:oak-shaded-guava` from 2.6.0 to 2.8.0 Updates `com.microsoft.sqlserver:mssql-jdbc` from 13.6.0.jre11 to 13.6.1.jre11 - [Release notes](https://github.com/Microsoft/mssql-jdbc/releases) - [Changelog](https://github.com/microsoft/mssql-jdbc/blob/main/CHANGELOG.md) - [Commits](https://github.com/Microsoft/mssql-jdbc/commits) --- updated-dependencies: - dependency-name: org.apache.sling:org.apache.sling.auth.core dependency-version: 2.1.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.sling:org.apache.sling.engine dependency-version: 3.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.sling:org.apache.sling.resourceresolver dependency-version: 2.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.commons:commons-lang3 dependency-version: 3.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.slf4j:slf4j-api dependency-version: 2.0.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: java-dependencies-minor-updates - dependency-name: org.slf4j:jcl-over-slf4j dependency-version: 2.0.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: java-dependencies-minor-updates - dependency-name: org.slf4j:log4j-over-slf4j dependency-version: 2.0.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: java-dependencies-minor-updates - dependency-name: org.slf4j:jcl-over-slf4j dependency-version: 2.0.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: java-dependencies-minor-updates - dependency-name: org.slf4j:log4j-over-slf4j dependency-version: 2.0.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:jackrabbit-jcr-commons dependency-version: 2.22.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:jackrabbit-spi-commons dependency-version: 2.22.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:jackrabbit-spi-commons dependency-version: 2.22.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-jackrabbit-api dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-api dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-core dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-core-spi dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-store-spi dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-security-spi dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-jcr dependency-version: 2.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-commons dependency-version: 2.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-query-spi dependency-version: 2.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-shaded-guava dependency-version: 2.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-api dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-core dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-core-spi dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-store-spi dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-security-spi dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.mockito:mockito-core dependency-version: 5.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: com.github.spotbugs:spotbugs dependency-version: 4.10.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: java-dependencies-minor-updates - dependency-name: com.github.spotbugs:spotbugs-maven-plugin dependency-version: 4.10.5.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: java-dependencies-minor-updates - dependency-name: org.jacoco:jacoco-maven-plugin dependency-version: 0.8.16 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.maven.plugins:maven-surefire-plugin dependency-version: 3.6.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: java-dependencies-minor-updates - dependency-name: org.sonatype.central:central-publishing-maven-plugin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-jcr dependency-version: 2.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-commons dependency-version: 2.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-query-spi dependency-version: 2.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: org.apache.jackrabbit:oak-shaded-guava dependency-version: 2.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: java-dependencies-minor-updates - dependency-name: com.microsoft.sqlserver:mssql-jdbc dependency-version: 13.6.1.jre11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: java-dependencies-minor-updates ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot requested a review from a team October 30, 2026 00:06

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Oct 30, 2026

Navigation Menu

Repository navigation

Bump the java-dependencies-minor-updates group across 1 directory with 26 updates - #2517

Bump the java-dependencies-minor-updates group across 1 directory with 26 updates#2517
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/maven/java-dependencies-minor-updates-2bb72600d9

dependabot Bot commented on behalf of github Oct 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 30, 2026

Changes in Jackrabbit 2.22.5

Release Contents

About Apache Jackrabbit

About The Apache Software Foundation

Trademarks

Changes in Jackrabbit 2.22.5

Release Contents

About Apache Jackrabbit

About The Apache Software Foundation

Trademarks

Changes in Jackrabbit 2.22.5

Release Contents

About Apache Jackrabbit

About The Apache Software Foundation

Trademarks

v5.24.0

5.24.0

4.10.5

CHANGELOG

Added

Changed

Fixed

4.10.5 - 2026-10-11

Added

Changed

Fixed

Spotbugs Maven Plugin 4.10.5.0

What's Changed

0.8.16

New Features

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants