deps(main): Bump the "main" group with 4 updates across multiple ecosystems

[dependabot]

Bumps the main group with 28 updates in the / directory:

Package	From	To
org.springframework.boot:spring-boot-starter-parent	3.5.6	3.5.16
io.rest-assured:rest-assured-bom	5.0.0	6.1.0
org.jacoco:jacoco-maven-plugin	0.8.14	0.8.15
com.bucket4j:bucket4j_jdk17-core	8.15.0	8.21.0
com.puppycrawl.tools:checkstyle	10.21.2	14.3.0
org.hibernate.validator:hibernate-validator	8.0.2.Final	9.1.4.Final
me.paulschwarz:spring-dotenv	4.0.0	5.1.0
io.rest-assured:rest-assured	5.0.0	6.1.0
com.google.guava:guava	33.5.0-jre	33.7.2-jre
org.flywaydb:flyway-core	11.1.0	13.10.0
org.flywaydb:flyway-database-postgresql	10.4.1	13.10.0
org.springdoc:springdoc-openapi-starter-webmvc-ui	2.8.2	3.1.1
net.dv8tion:JDA	5.3.0	6.7.0
org.eclipse.angus:jakarta.mail	2.0.3	2.0.5
com.auth0:java-jwt	4.5.0	4.6.1
org.projectlombok:lombok	1.18.42	1.18.48
org.jsoup:jsoup	1.23.1	1.23.2
redis.clients:jedis	7.0.0	8.0.2
io.github.resilience4j:resilience4j-spring-boot3	2.3.0	2.4.0
com.github.loki4j:loki-logback-appender	1.5.2	2.1.0
io.grpc:grpc-netty-shaded	1.84.1	1.84.2
io.grpc:grpc-protobuf	1.84.1	1.84.2
io.grpc:grpc-stub	1.84.1	1.84.2
org.codehaus.mojo:build-helper-maven-plugin	3.6.1	3.6.2
com.diffplug.spotless:spotless-maven-plugin	3.1.0	3.10.4
org.apache.maven.plugins:maven-compiler-plugin	3.14.1	3.16.0
org.springframework.boot:spring-boot-maven-plugin	3.5.6	4.1.1
org.flywaydb:flyway-maven-plugin	11.1.0	13.10.0

Updates org.springframework.boot:spring-boot-starter-parent from 3.5.6 to 3.5.16

Release notes

Sourced from org.springframework.boot:spring-boot-starter-parent's releases.

v3.5.16

🔨 Dependency Upgrades

• Upgrade to Spring AMQP 3.2.12 #50818
• Upgrade to Spring Data Bom 2025.0.13 #50819
• Upgrade to Spring Integration 6.5.10 #50820

v3.5.15

🐞 Bug Fixes

• Artemis auto-configuration uses a predictable default location for the embedded broker's data #50743
• MailSender auto-configuration does not enable hostname verification #50742
• SSL should not be enabled when a SSL bundle is overridden to an empty string #50624
• Layer written outside the output location of '//' exception is thrown when using extract layers in root directory #50501
• Docker Compose support does not restore thread interrupt flag when catching InterruptedException #50451
• RabbitProperties enables SSL even when spring.rabbitmq.ssl.bundle is overridden to an empty string #50429
• GraphQL WebSocket support does not configure allowed origins #50391
• Buildpack module does not validate long-to-int casts #50382
• MappingsEndpoint reports the context's own ID as parentId when a parent exists #50373
• Created StackTracePrinter instances have no access to the Environment #50303
• NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles #50301
• Spring Boot Loader Does Not Support RSA and EC Signed Jars #50292
• ConfigurationPropertiesReportEndpoint exposes AOP proxy internals #50273
• Actuator's '/cloudfoundryapplication' endpoint does not work if restrictive CORS configuration is provided using a bean named corsConfigurationSource #50254
• Meter registries are not removed from the global registry when the context is closed #50235
• ThreadPoolTaskScheduleBuilder unnecessarily loses precision when configuring await termination time #50225
• Apply HTML escaping to timestamp attribute in Whitelabel error page #50205
• NimbusJwtDecoder silently accepts unknown values for spring.security.oauth2.resourceserver.jwt.jws-algorithms #50118
• EndpointRequest links matcher unnecessarily matches HTTP methods other than GET #50095

📔 Documentation

• Fix reference to Gradle documentation for module replacement #50641
• Remove the use of Optional from Data Neo4j repository examples #50600
• Fix typos in documentation #50593
• Document Java 25 requirement for AOT cache #50482
• Clarify dependency requirement for Bean Validation support #50290
• Document SSL reloading with Let's Encrypt #50222
• Polish InvalidConfigurationPropertyValueException constructor javadoc #50212
• Document known testcontainers lifecycle issues #50210
• Document configuring multiple connectors with Jetty #50206
• Fix typo in Spring Security OAuth2 client registration documentation #50193

🔨 Dependency Upgrades

• Upgrade to Caffeine 3.2.4 #50308
• Upgrade to Cassandra Driver 4.19.3 #50670
• Upgrade to Glassfish JAXB 4.0.9 #50671
• Upgrade to Groovy 4.0.32 #50310
• Upgrade to Hibernate 6.6.53.Final #50721

... (truncated)

Commits

• 0566f69 Release v3.5.16
• 93edd16 Next development version (v3.5.16-SNAPSHOT)
• 5bafd0a Upgrade to Spring Integration 6.5.10
• baf3290 Upgrade to Spring AMQP 3.2.12
• 2c5964a Upgrade to Spring Data Bom 2025.0.13
• dbb08aa Upgrade Antora dependencies
• 9b281d5 Upgrade to actions/checkout 7.0.0
• a854058 Upgrade to jfrog/setup-jfrog-cli 5.1.0
• fc236ae Start building against Spring Integration 6.5.10 snapshots
• 5271da7 Start building against Spring Data Bom 2025.0.13 snapshots
• Additional commits viewable in compare view

Updates io.rest-assured:rest-assured-bom from 5.0.0 to 6.1.0

Changelog

Sourced from io.rest-assured:rest-assured-bom's changelog.

Changelog 6.1.0 (2026-10-09)

• Strip sensitive headers (Authorization and Cookie) when a redirect crosses to a different host, so a token or session isn't leaked to the redirect target. This is on by default and can be turned off with RedirectConfig.stripSensitiveHeadersOnCrossHostRedirect(false) (#1873). Thanks to the University of Sydney security research team (Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu) for the report.
• Fix JsonPath "properties" spread over a list of objects returning null when the first element lacks a "properties" key (e.g. a GeoJSON feature carrying only a geometry), a regression from the Groovy 5 migration (fixes #1875) (thanks to HDPark95 for PR #1878). Thanks to haskiindahouse for the report.
• Fix JsonPath returning null or Groovy meta-data for a nested "properties" navigation over a list of objects (e.g. items.properties.properties.x) on Groovy 5, because the list spread result was a plain list instead of the proxy list that carries the "properties" workaround forward (fixes #1879) (thanks to kdelay for PR #1880)
• Fix JsonPath returning -Infinity for finite negative JSON numbers whose magnitude exceeds Float.MAX_VALUE under the default FLOAT_AND_DOUBLE number configuration. The float/double selection compared the signed value against Float.MAX_VALUE, so any such negative number fell into the float branch and overflowed; it now compares the magnitude and promotes to double regardless of sign (fixes #1874) (thanks to kdelay for PR #1877). Thanks to haskiindahouse for the report.
• Decode JSON responses without an explicit charset as UTF-8 also when the content-type has parameters (e.g. "application/json; version=1") or is a "+json" type (e.g. "application/problem+json", "application/hal+json"). These used to fall back to the default content charset, which garbled non-ASCII characters in the body and in logged responses (related to #1885)
• Fix MalformedURLException when a request URL has no slash before a query string that contains another URL, e.g. get("https://example.com?redirect=https://example.com/callback") (fixes #1836) (thanks to renechoi for PR #1881)
• Apply user-configured SSL settings (such as relaxed HTTPS validation, trust/key stores and certificate authentication) when an http request is redirected to https. Previously they were only applied if the original request used https, so the redirected request failed with "PKIX path building failed". For a request that starts as http the SSL settings are only applied when REST Assured's default http client factory is used, so an https scheme registered by a custom HttpClientConfig.httpClientFactory is kept (fixes #790)
• Don't let request specific SSL settings (SSLConfig such as relaxed HTTPS validation, or certificate authentication) leak into later requests when the http client instance is reused (HttpClientConfig.reuseHttpClientInstance()). The client's original https scheme is restored after each request and https connections established with request specific SSL settings are no longer kept alive for reuse.
• json-schema-validator now supports JSON Schema draft-06, draft-07, 2019-09 and 2020-12 (e.g. const, if/then/else, propertyNames, prefixItems, $defs) using the networknt json-schema-validator (com.networknt:json-schema-validator 2.0.8, which is now a dependency of the module, together with slf4j-api). The draft is taken from the "$schema" keyword of the schema, so draft-03/draft-04 schemas are validated exactly as before. Schemas without "$schema" are still validated as draft-04 unless another version is configured, e.g. matchesJsonSchemaInClasspath("schema.json").using(JsonSchemaVersion.DRAFT_2020_12) or JsonSchemaValidatorSettings.schemaVersion(..). Note that: (1) schemas that already declared a draft-06+ "$schema" were previously validated with draft-04 semantics (newer keywords were ignored) and are now validated according to their declared draft, (2) a configured JsonSchemaFactory and checkedValidation only apply to draft-03/draft-04 schemas, (3) "format" is annotation-only (not validated) in 2019-09 and 2020-12, as required by those specifications (fixes #1823)
• Add ResponseSpecBuilder.expectHeader(String, ResponseAwareMatcher) and ResponseSpecification.header(String, ResponseAwareMatcher), so a reusable response specification can match a header against a value taken from the response, e.g. expectHeader("Location", response -> endsWith("/users/" + response.path("id"))) (fixes #1884) (thanks to seethinajayadileep for PR #1887)
• java.time values (LocalDate, Instant, OffsetDateTime, Duration, ZoneId and so on) used as path, query or form parameters, headers or cookies are now sent as their ISO-8601 toString() instead of being run through the object mapper, which quoted them or failed without the JSR-310 module (fixes #1781) (thanks to seethinajayadileep for PR #1888)
• A value object used as a parameter, header or cookie value that the object mapper serializes to a plain JSON string (for example a record with a @​JsonValue accessor) is now sent without the surrounding JSON quotes (fixes #1818)
• Add support for the HTTP QUERY method (a safe, idempotent method that carries a request body), e.g. given().body(..).when().query("/search"). Method.QUERY and query(..) overloads are added to RestAssured, RequestSender/RequestSpecification, RestAssuredMockMvc and RestAssuredWebTestClient (fixes #1872)
• Fix path parameters in the Spring WebTestClient module: an unnamed path parameter that isn't a String, e.g. get("/posts/{id}", 42L), no longer fails with a ClassCastException and is serialized the same way as a named path parameter, and path parameter values are no longer encoded twice, so a value such as "John Doe" or "100%" reaches the server unchanged instead of as "John%20Doe" or "100%25" (fixes #1824) (thanks to hantsy for PR #1825)
• Fix failures when the default locale is Turkish (tr-TR), such as an exception for every response with status code 400 or above and OPTIONS requests sent from a filter or HTTP methods given in lower case, e.g. request("options", ..), not working, by using Locale.ROOT for internal upper and lower case conversions. Cookie.toString() now also formats the Expires attribute as "EEE, dd MMM yyyy HH:mm:ss zzz" in English instead of using the default locale's short date format (thanks to rdmrtn for PR #1889)
• MultiPartSpecBuilder.charset(Charset) now rejects byte[] and InputStream content with an IllegalArgumentException, like charset(String) already did, instead of silently ignoring the charset (fixes #1691) (thanks to seethinajayadileep for PR #1886)
• Fix XmlPath and JsonPath not handling a hyphenated element or key name combined with a negative (from-the-end) list index, e.g. "root.some-list[-1]". XmlPath threw "The parameter ... was used but not defined" and JsonPath returned null (fixes #1876) (thanks to kdelay for PR #1882)
• Fix unnamed path parameters in the Spring MockMvc module not being serialized like named ones, so a value object such as a record with a @​JsonValue accessor passed by position, e.g. get("/users/{id}", new Id(42)), was sent as its toString() ("Id[42]") instead of its serialized value ("42"). Note that, as for named path parameters, any other object that isn't a simple value (number, string, boolean, enum, UUID, java.time value etc) passed by position is now serialized by the object mapper instead of using its toString(). In both the Spring MockMvc and WebTestClient modules this also works for multipart requests, since unnamed path parameters are serialized using the explicitly set content type, like named ones, and not the derived "multipart/form-data" (fixes #1905)
• Fix query parameters in the Spring WebTestClient module not reaching the server as given: a value containing "+", "&", "=" or "{...}", e.g. queryParam("name", "a+b"), was received as "a b", truncated at "&" or failed as a missing URI variable. Query parameters, as well as params and form params that are added to the query string, are now strictly encoded (so reserved characters such as "!" or "," in a value are now sent percent-encoded), and a query parameter without a value, e.g. queryParam("flag"), is sent as "flag" instead of the name of an internal class (fixes #1904)
• The charset given to MultiPartSpecBuilder.charset(..) is now sent in the Content-Type of a File multi-part (e.g. "text/plain; charset=UTF-8"). Previously it was silently ignored for File content and only applied to String content. Other parameters of the part mime-type (e.g. "application/xml; version=2") are now also kept when a charset is specified, instead of being dropped (fixes #1903)
• Fix XmlPath and JsonPath not handling a list range with a negative end that is followed by more path, e.g. "root.some-list[0..-1].sub-el" or "list[-2..-1].x". The dots in the range were treated as path separators, so XmlPath threw "The parameter ... was used but not defined" (or a Groovy compilation error) and JsonPath returned null or failed. JsonPath now also supports a range on a root array, e.g. "[0..1].x", and chained indexes after a hyphenated name, e.g. "some-list[0][1].x" (fixes #1906)

Changelog 6.0.1 (2026-07-10)

• Fix a JsonPath denial-of-service where oversized numeric literals in untrusted JSON were parsed into arbitrarily large BigIntegers, an O(n^2) CPU and heap cost. JSON number tokens are now capped at 1000 characters by default, configurable via JsonPathConfig.numberLengthLimit and JsonConfig.numberLengthLimit (a negative value disables the check). Thanks to Brian Lee (PhD security researcher, Georgia Tech SSLab) for the private report.
• Use custom Jackson 3 object mapper in JsonPath (#1858) (thanks to gkiel for PR)
• Fix Spring MockMvc cookie handling with Jakarta-only servlet APIs (fixes #1853)
• Use Jackson 3 mapper in JsonPath deserialization when Jackson 3 is the only Jackson on the classpath (#1865) (thanks to dickerpulli for PR)
• Add JsonPath.using(Jackson3ObjectMapperFactory) overload (#1861) (thanks to Anusha-7254 for PR)
• Fix typo in duplicate-finder-maven-plugin phase property (#1866) (thanks to metacosm for PR)
• Fix incorrect serialization of enum constants declared with a body when used as query/path parameters (#1799)
• The spring-mock-mvc and spring-web-test-client modules now target Spring Framework 7 and no longer expose their own Spring version as a transitive dependency (the Spring dependencies are declared optional), so they no longer drag Spring 5 onto a Spring Boot 4 / Spring Framework 7 classpath. This removes the need for manual Spring exclusions on Spring Boot 4 (fixes #1853, #1868). Thanks to spencerarq for the detailed investigation.

Changelog 5.5.7 (2026-01-16)

• Spring MockMvc module now supports Spring Framework 7.0 (thanks to Marcin Grzejszczak for PR)

Changelog 6.0.0 (2025-12-12)

• spring-mock-mvc module now supports Spring 7.x
• spring-web-test-client now supports Spring 7.x
• Upgraded commons-lang3 from 3.18.0 to 3.19.0
• The spring modules now required Spring 5.3+ (previously 5.1 was required)
• New minimum Java baseline is now 17
• New minimum Groovy base is now 5.x
• Support for Jackson 3 object mapping
• Support for Yasson 3 object mapping
• Support for jakarta JsonB/Johnzon 3 object mapping

... (truncated)

Commits

• 7765379 [maven-release-plugin] prepare release rest-assured-6.1.0
• a52e86f [ci skip] Preparing changelog for release
• d9e1a3e Serialize unnamed path params like named ones in MockMvc (#1910)
• a78ec80 Strictly encode query parameters in WebTestClient (#1908)
• 549260a Send the multipart charset in the Content-Type of File parts (#1909)
• 9335c59 Handle list ranges with a negative end followed by more path in XmlPath and J...
• 88410f2 Support non-string path params and stop double encoding in WebTestClient (#1902)
• 1437357 Use a fixed locale for case conversions so REST Assured works under Turkish l...
• ffe66bb Validate charset in MultiPartSpecBuilder.charset(Charset) (#1900)
• 9db3677 Escape hyphenated XmlPath and JsonPath names with a negative list index (#1899)
• Additional commits viewable in compare view

Updates org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15

Release notes

Sourced from org.jacoco:jacoco-maven-plugin's releases.

0.8.15

New Features

• JaCoCo now officially supports Java 26 (GitHub #2076).
• Experimental support for Java 27 class files (GitHub #2004).
• Compatibility methods generated by Kotlin compiler for functions defined in interfaces are filtered out during generation of report (GitHub #1905).
• Compatibility methods generated by Kotlin compiler for exposed boxed inline value classes (JvmExposeBoxed annotation) are filtered out during generation of report (GitHub #1944).
• Methods generated by the Kotlin compiler for functions with JvmStatic annotation are filtered out during generation of report (GitHub #2097).
• Improved filtering of bytecode generated by Kotlin compiler for when expressions and statements with kotlin.String subject where first branch condition contains string with largest hash (GitHub #2098).
• Part of bytecode that javac versions from 24 to 26 generate for switch statements and expressions with selector expression of type java.lang.String inside lambdas is filtered out during generation of report (GitHub #2023).
• Improved performance of Kotlin files analysis by parsing SMAPs only once per class (GitHub #2114).
• For better performance agent output methods tcpclient and tcpserver use BufferedOutputStream to write execution data to socket. Maven plugin, Ant tasks, CLI, API usage examples, and ExecDumpClient API use BufferedInputStream to read execution data from socket. Third-party integrations should do the same to benefit from this change in agent (GitHub #2089).

Fixed bugs

• Fixed processing of Kotlin SMAP in synthetic classes (GitHub #1985).
• Multiple JaCoCo runtimes within one JVM writing to the same output file should not cause data corruption when running on JDK versions from 6 to 10 affected by JDK-8166253 (GitHub #2065, #2074).
• For better performance agent writes to output file via BufferedOutputStream, this fixes regression introduced in version 0.6.2 (GitHub #2073).
• Fixed NullPointerException when JaCoCo agent is loaded by non system class loader, for example when loaded by JBoss Modules (GitHub #1651).

Non-functional Changes

• JaCoCo now depends on ASM 9.10.1 (GitHub #2134).

Commits

• 6c5260a Prepare release v0.8.15
• 5c05141 Transfer of execution data through socket should use buffered stream (#2089)
• ab5efa9 Remove from Azure Pipelines all builds except with JDK 5 and JDK EA (#2148)
• 5f6ea38 Use Windows 2025 image in GitHub Actions (#2130)
• 35a8af2 Use Renovate instead of Dependabot for updates of ASM (#2137)
• 85b8ddf Upgrade ASM to 9.10.1 (#2134)
• 2988647 AgentModule should use ClassLoader of agent instead of SystemClassLoader (#1651)
• 75a4e31 Add filter for Kotlin @JvmExposeBoxed (#1944)
• 691fa1d Use Renovate instead of Dependabot for updates of GitHub Actions (#2132)
• 3e18f17 Require at least JDK 21 for build (#2128)
• Additional commits viewable in compare view

Updates com.bucket4j:bucket4j_jdk17-core from 8.15.0 to 8.21.0

Release notes

Sourced from com.bucket4j:bucket4j_jdk17-core's releases.

8.21.0

The features in release scope are following:

• #580 compare-and-swap retry mechanism
• #588 Support for Redis Sentinel via Lettuce
• #615 Gemfire/Geode support
• #617 bucket4j-bom module
• #622 Memcached support with CAS-based style
• #623 Support for fresh Coherence versions
• #625 Migrate serialization from ByteArrayOutputStream/ByteArrayInputStream to ByteBuffer
• #633 Support for Infinispan 16.x via a dedicated module
• #629 Apache Ignite 3 support
• #593 Apache Cassandra integration
• #634 Skip unnecessary token recalculation in bucket reset()

The bugfixes in release scope are following:

• #595 Disable stack trace generation in BucketExecutionException
• #606 Fix MySQL gap lock deadlocks
• Cassandra Integration by @​sahu-iisc in bucket4j/bucket4j#593

New Contributors

• @​Vishwajit-29 made their first contribution in bucket4j/bucket4j#628
• @​sahu-iisc made their first contribution in bucket4j/bucket4j#634

Full Changelog: bucket4j/bucket4j@8.20.0...8.21.0

8.20.0

What's Changed

• docs: add Compare&Swap implementation details for Redis by @​sunghyun1999 in bucket4j/bucket4j#597
• Bump org.postgresql:postgresql from 42.7.11 to 42.7.12 in /backward-compatibility-tests/common by @​dependabot[bot] in bucket4j/bucket4j#604
• Bump org.mariadb.jdbc:mariadb-java-client from 3.3.2 to 3.3.5 in /bucket4j-mariadb by @​dependabot[bot] in bucket4j/bucket4j#609
• perf: disable stack trace generation in BucketExecutionException and … by @​Palak24Ol in bucket4j/bucket4j#595
• bucket4j (lettuce) support for redis with sentinel by @​Rithra in bucket4j/bucket4j#588
• Bump com.fasterxml.jackson.core:jackson-databind from 2.13.4.2 to 2.18.9 in /bucket4j-parent by @​dependabot[bot] in bucket4j/bucket4j#611
• test: verify Valkey compatibility for Lettuce and Glide clients (#520) by @​thesahibnanda-max in bucket4j/bucket4j#608
• upgrade testcontainers to be compatible with OrbStack on Macos by @​vladimir-bukhtoyarov in bucket4j/bucket4j#612
• Fix examples compilation by @​vladimir-bukhtoyarov in bucket4j/bucket4j#613
• Fix build for macos by @​vladimir-bukhtoyarov in bucket4j/bucket4j#614
• Fix MySQL gap lock deadlocks by @​jumdo12 in bucket4j/bucket4j#606
• #468 Gemfire/Geode support by @​vladimir-bukhtoyarov in bucket4j/bucket4j#615

New Contributors

• @​sunghyun1999 made their first contribution in bucket4j/bucket4j#597
• @​Palak24Ol made their first contribution in bucket4j/bucket4j#595
• @​thesahibnanda-max made their first contribution in bucket4j/bucket4j#608
• @​jumdo12 made their first contribution in bucket4j/bucket4j#606

Full Changelog: bucket4j/bucket4j@8.19.0...8.20.0

8.19.0

What's Changed

... (truncated)

Commits

• a22b062 prepare 8.21.0 artifacts
• 0d89ef9 Cassandra Integration (#593)
• 5839b63 Ignite 3 (#629)
• dcefbcf #620 Fix build on GitHub actions and update actions configs (#637)
• 505c070 #620 fix snapshot deploy 409 conflict by cascading versions:set to all module...
• 5ac5230 Refractor bucketstate reset (#634)
• 5467db4 Bump com.fasterxml.jackson.core:jackson-databind in /bucket4j-parent (#635)
• 4473268 #632 fix InfinispanHotrodTest extension jar build when bucket4j-core resolves...
• 800458f #632 add support for Infinispan 16.x via a dedicated module (#633)
• 8f6e185 check compatibility with latest Ignite 2.x
• Additional commits viewable in compare view

Updates com.puppycrawl.tools:checkstyle from 10.21.2 to 14.3.0

Release notes

Sourced from com.puppycrawl.tools:checkstyle's releases.

checkstyle-14.3.0

Checkstyle 14.3.0 - https://checkstyle.org/releasenotes.html#Release_14.3.0

New:

#14120 - Make Checkstyle an java module with module-info.java.

checkstyle-14.2.0

Checkstyle 14.2.0 - https://checkstyle.org/releasenotes.html#Release_14.2.0

New:

#19513 - ModifiedOrder: New property modifierOrder. #17723 - WhitespaceAfter: new token SINGLE_LINE_COMMENT to catch missing whitespace checks around // comments. #8312 - NoWhitespaceAfter: Allow for use of DO_WHILE, LITERAL_CATCH, LITERAL_FOR, LITERAL_IF, and LITERAL_WHILE. #17172 - AnnotationLocation new token MODULE_DEF. Google-style: incomplete coverage on annotation rules for modules. #14986 - New Check UnnecessaryPermitsClause. #7541 - new Check: GoolgeRightCurly. #19949 - New check: JavadocSeeTagOrder. #20639 - new Check: OpenjdkMethodThrowsAlignment.

Bug fixes:

#17663 - Indentation: missing violations for '->' and ',' in return statement continuation. #20541 - False Positive: Lambda is incorrectly flaged by OperatorWrap. #21739 - UnusedLocalVariable: false positive on unnamed variable _ inside anonymous class. #21613 - False negative: UnusedTryResourceShouldBeUnnamed treats same-named identifiers in catch/finally blocks as resource usage. #21695 - openjdk style: use custon modifierOrder at RedundantModifier. #21689 - Add GoogleRightCurly to google_checks.xml instead of RightCurly. #10924 - All checks that use AbstractCheck#getLine() should check code points instead of characters for spacing. #21139 - Performance: Avoid duplicate regex match in SuppressFilterElement.isFileMatch. #21528 - Add checks for Sun Style [4.2 - Wrapping Lines]. #21578 - False Negative: LambdaParameterName silently passes lambdas in switch rule. #21579 - False Negative: NeedBraces silently passes lambdas in switch rule. #5895 - CLI XML output file: file stops dead when an execption occurs. #11410 - False Negative: LeftCurlyCheck. #21583 - Update Documentation Comments Style Guide: add JavadocSeeTagOrder. #21609 - NPE in RightCurlyCheck. #19724 - google_checks.xml: JavadocMethod accessModifiers should include protected to match MissingJavadocMethod scope. #20963 - False negative in LeftCurly for types with option=eol. #21547 - add OpenjdkMethodThrowsAlignment check in openjdk_checks.xml. #20636 - False negatives regarding LeftCurly in openjdk_checks.xml. #17170 - Google-style: unfollowed rule on ordering and spacing of module directives. #21454 - google_checks.xml: false negative 4.3 One statement per line. #21501 - CommonUtil.getFileExtension includes parent-directory dots in the extension. #21445 - google_checks.xml: false negative 3.3.1.1 No module imports. #21477 - Add checks for Sun Style [4.1 - Line Length]. #21444 - google_checks.xml: false negative 3.2 Package declaration.

... (truncated)

Commits

• bc58fc6 [maven-release-plugin] prepare release checkstyle-14.3.0
• 5711c72 doc: release notes for 14.3.0
• 4b8a5b3 minor: Bump version to 14.3.0-SNAPSHOT
• a93f8f2 Issue #14120: add module-info.java to make Checkstyle an explicit Java module
• 9e3482f [maven-release-plugin] prepare for next development iteration
• 6a200bc [maven-release-plugin] prepare release checkstyle-14.2.0
• 2d2b135 doc: release notes for 14.2.0
• 194e7a2 Issue #20590: Improve Input coverage for compact sources for SuperCloneCheck
• 123f477 Issue #17663: Indentation: missing violations for '->' and ',' in return stat...
• 4b2f353 Issue #20541: fix OperatorWrap false positive for lambda with block body
• Additional commits viewable in compare view

Updates org.hibernate.validator:hibernate-validator from 8.0.2.Final to 9.1.4.Final

Release notes

Sourced from org.hibernate.validator:hibernate-validator's releases.

Release 9.1.4.Final

Hibernate Validator 9.1.4.Final released

We are pleased to announce the release of Hibernate Validator 9.1: 9.1.4.Final.

You can find the full list of 9.1.4.Final changes here.

What's new

• See the website for requirements and compatibilities.
• See the What's New guide for details about new features and capabilities.

Conclusion

For additional details, see:

• the release page
• the Migration Guide
• the Getting started
• the Reference Guide
• the API docs

Visit the website for details on getting in touch with us.

Release 9.1.3.Final

Hibernate Validator 9.1.3.Final released

We are pleased to announce the release of Hibernate Validator 9.1: 9.1.3.Final.

You can find the full list of 9.1.3.Final changes here.

What's new

• See the website for requirements and compatibilities.
• See the What's New guide for details about new features and capabilities.

Conclusion

For additional details, see:

• the release page
• the Migration Guide
• the Getting started
• the Reference Guide
• the API docs

... (truncated)

Changelog

Sourced from org.hibernate.validator:hibernate-validator's changelog.

9.1.4.Final (2026-09-20)

Full changelog

Bug

• HV-2253 - ClassNotFoundException thrown when an EL implementation and OSGi are not on the class path

Improvement

• HV-2243 - Bump joda-time to 2.14.3
• HV-2242 - Update to OpenJFX to 17.0.20

Task

• HV-2244 - Tune the content of javadoc jars to reduce the size of files published to Maven Central

9.1.3.Final (2026-07-26)

Full changelog

Bug

• HV-2231 - RegexpURLValidator throws NPE when URL has no authority component

9.1.2.Final (2026-07-06)

Full changelog

Bug

• HV-2222 - ParameterNode.getParameterIndex throws NPE

9.1.1.Final (2026-06-22)

Full changelog

Bug

• HV-2217 HibernateConstraintValidatorContext::addExpressionVariable throws NPE when given null value
• HV-2164 NIP constraint javadoc incorrectly states that it is a 9 digit sequence
• HV-1923 CPF constraint accepting incorrect format

Improvement

• HV-2216 Use Maven 3.9.16 as a required minimum version for the build
• HV-2214 Enable automatic releases
• HV-2212 Bump joda-time to 2.14.2
• HV-2208 Update to OpenJFX to 17.0.19
• HV-2207 Use Maven 3.9.15 as a required minimum version for the build
• HV-2197 Update to JBoss logging 3.6.3.Final
• HV-2194 Bump joda-time to 2.14.1
• HV-2191 Simplify PlatformResourceBundleLocator#determineAvailabilityOfResourceBundleControl() to drop reflection

... (truncated)

Commits

• 5504b0c [Jenkins release job] Preparing release 9.1.4.Final
• 1306aab [Jenkins release job] changelog.md updated by release build 9.1.4.Final
• 715cbdb [Jenkins release job] README.md updated by release build 9.1.4.Final
• 84e8d2e HV-2253 When determining the Jakarta Expression Language implementation, igno...
• f3002a3 [9.1] Bump org.codehaus.mojo:build-helper-maven-plugin
• 971d85b [9.1] Bump the build-dependencies group with 3 updates
• dcb1305 Tune the content of javadoc jars to reduce the size of files published to Mav...
• d01ed37 [9.1] Bump version.org.apache.groovy from 5.0.7 to 5.0.8
• 6023258 Bump joda-time to 2.14.3 HV-2243
• 3db152e Update to OpenJFX to 17.0.20 HV-2242
• Additional commits viewable in compare view

Updates me.paulschwarz:spring-dotenv from 4.0.0 to 5.1.0

Release notes

Sourced from me.paulschwarz:spring-dotenv's releases.

Release 5.1.0

Install

Recommended: use the BOM to keep versions aligned.

Gradle (BOM + choose one module)

dependencies {
    implementation(platform("me.paulschwarz:spring-dotenv-bom:5.1.0"))
// Choose one:
// developmentOnly("me.paulschwarz:spring-dotenv")
// developmentOnly("me.paulschwarz:springboot3-dotenv")
// developmentOnly("me.paulschwarz:springboot4-dotenv")
developmentOnly("me.paulschwarz:springboot3-dotenv")

}

Maven (BOM + choose one module)

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>me.paulschwarz</groupId>
            <artifactId>spring-dotenv-bom</artifactId>
            <version>5.1.0</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>

Then add one:

• Spring Framework (no Boot): me.paulschwarz:spring-dotenv
• Spring Boot 3: me.paulschwarz:springboot3-dotenv
• Spring Boot 4: me.paulschwarz:springboot4-dotenv

<dependency>
    <groupId>me.paulschwarz</groupId>
    <artifactId>springboot3-dotenv</artifactId>
    <optional>true</optional>
</dependency>

... (truncated)

Changelog

Sourced from me.paulschwarz:spring-dotenv's changelog.

[5.1.0] – 2026-01-02

✨ Enhancements

Relaxed binding for springdotenv.* Description has been truncated

[pat-agent]

Available PR Commands

• /migrate - Applies this PR's database migrations to the staging DB (can only be run by someone on @Patina-Network/codebloom)
• /copy - Triggers copy from production to staging db (can only be run by tahminator or angelayu0530)

[pat-agent]

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-standup-bot-arm/tags under the following tags:

• codebloom-standup-bot-arm:staging-latest
• codebloom-standup-bot-arm:staging-2026.10.19-14.35.18
• codebloom-standup-bot-arm:staging-43b9100

[pat-agent]

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-standup-bot/tags under the following tags:

• codebloom-standup-bot:staging-latest
• codebloom-standup-bot:staging-2026.10.19-14.35.09
• codebloom-standup-bot:staging-43b9100