[dependabot]

Bumps the main group with 28 updates in the / directory:

Package	From	To
org.springframework.boot:spring-boot-starter-parent	3.5.6	4.1.1
io.rest-assured:rest-assured-bom	5.0.0	6.2.0
org.jacoco:jacoco-maven-plugin	0.8.14	0.8.15
com.bucket4j:bucket4j_jdk17-core	8.15.0	8.21.0
com.puppycrawl.tools:checkstyle	10.21.2	14.3.0
org.hibernate.validator:hibernate-validator	8.0.2.Final	9.1.5.Final
me.paulschwarz:spring-dotenv	4.0.0	5.1.0
io.rest-assured:rest-assured	5.0.0	6.2.0
com.google.guava:guava	33.5.0-jre	33.7.2-jre
org.flywaydb:flyway-core	11.1.0	13.10.3
org.flywaydb:flyway-database-postgresql	10.4.1	13.10.3
org.springdoc:springdoc-openapi-starter-webmvc-ui	2.8.2	3.1.1
net.dv8tion:JDA	5.3.0	6.7.0
org.eclipse.angus:jakarta.mail	2.0.3	2.0.5
com.auth0:java-jwt	4.5.0	4.6.2
org.projectlombok:lombok	1.18.42	1.18.48
org.jsoup:jsoup	1.23.1	1.23.2
redis.clients:jedis	7.0.0	8.0.2
io.github.resilience4j:resilience4j-spring-boot3	2.3.0	2.4.0
com.github.loki4j:loki-logback-appender	1.5.2	2.1.0
io.grpc:grpc-netty-shaded	1.84.1	1.85.0
io.grpc:grpc-protobuf	1.84.1	1.85.0
io.grpc:grpc-stub	1.84.1	1.85.0
org.codehaus.mojo:build-helper-maven-plugin	3.6.1	3.6.2
com.diffplug.spotless:spotless-maven-plugin	3.1.0	3.10.4
org.apache.maven.plugins:maven-compiler-plugin	3.14.1	3.16.0
org.springframework.boot:spring-boot-maven-plugin	3.5.6	4.1.1
org.flywaydb:flyway-maven-plugin	11.1.0	13.10.3

Updates org.springframework.boot:spring-boot-starter-parent from 3.5.6 to 4.1.1

Release notes

Sourced from org.springframework.boot:spring-boot-starter-parent's releases.

v4.1.1

⚠️ Attention Required

• Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied. This behavior caused problems for those using Protobuf without gRPC. To opt in to the configuration of gRPC, configure the protobuf extension with the grpc plugin using an empty block. The Spring Boot Gradle plugin will then automatically configure the use of protoc-gen-grpc-java as before. #50822

🐞 Bug Fixes

• Kafka consumer-specific security protocol is not taken into account #51369
• Structured logging: a failed JSON encode corrupts the next log event written on the same thread #51156
• Micrometer registries pin the application context #51135
• Temporary file is not deleted when ExportedImageTar construction fails #51132
• Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records #51098
• spring-boot-h2-console pulls servlet-api as transitive dependency #51095
• PropertiesLauncher does not log nested archive paths #51089
• Methods that return the result of Map#remove are not declared with a @Nullable return type #51087
• NativeImageResourceProvider flattens Flyway migration paths in subdirectories #50964
• Fix ordering of Kotlinx Serialization CodecCustomizer #50961
• JarFile is not closed when finding main class from archive #50959
• Application-managed JUL bridge handler should only be removed if installed #50950
• CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined #50944
• Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health #50942
• Resources are not cleaned up when resolving an image that is not yet present in the builder #50941
• GraphQlWebMvcAutoConfiguration should apply customizers in order #50914
• Auto-configured RedisMessageListenerContainer does not use virtual threads when spring.threads.virtual.enabled is true #50884
• Context refresh fails when using Actuator on Jersey without spring-boot-health #50872
• Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health #50871
• IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard #50856
• High number of connections due to Mongo health indicator #50852
• Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri #50849
• Return type nullability of ApplicationContextAssert's getBean methods does not indicate that bean may be null #50845
• PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #50843
• Exposing gRPC test server port should backoff if gRPC is not present #50825
• JpaBaseConfiguration#entityManagerConfiguration can cause a dependency loop on beans declaring AsyncTaskExecutor #50801
• spring.grpc.server.health.include-overall-health is not taken into account #50799
• Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute #50790
• Managed version of Prometheus Client is not aligned with Micrometer's micrometer-registry-prometheus #50780
• Map properties bound from empty strings fail with ConverterNotFoundException #50773
• Protobuf Common Protos should not be a managed dependency #50772
• An application that depends on spring-boot-security-oauth2-resource-server may fail to start with a ClassNotFoundException when Reactor is on the classpath but WebFlux is not #50764
• W3CHeaderParser's decoding is not compliant with RFC 3986 #50650

📔 Documentation

• Description of spring.graphql.websocket.connection-init-timeout does not render correctly in the reference guide #51348
• spring.profiles.group should have a 'spring-profile-name' hint provider #51284
• Remove reference to removed InfluxDB auto-configuration #51176
• Use JacksonJsonSerde in Kafka Streams documentation #51161
• Document alternatives to HttpMessageConverters #51129
• Fix stale type reference for OTLP logging transport metadata #51119
• Metadata for spring.test.mockmvc.htmlunit.url declares the wrong type #51115

... (truncated)

Commits

• 6fdf67e Release 4.1.1
• fde599b Upgrade to Spring Pulsar 2.0.7
• 9daa58f Upgrade to Spring HATEOAS 3.1.2
• 353993e Upgrade to Spring Data Bom 2026.0.1
• 24ba596 Upgrade to Spring Session 4.1.1
• 5cb5c29 Upgrade to Spring Security 7.1.1
• 4adc8eb Upgrade to Spring LDAP 4.1.1
• 4d9c19c Upgrade to Spring Kafka 4.1.1
• f30f612 Upgrade to Spring Integration 7.1.1
• b930283 Upgrade to Spring gRPC 1.1.1
• Additional commits viewable in compare view

Updates io.rest-assured:rest-assured-bom from 5.0.0 to 6.2.0

Changelog

Sourced from io.rest-assured:rest-assured-bom's changelog.

Changelog 6.2.0 (2026-10-16)

• Fix spring-web-test-client-kotlin-extensions bringing jakarta.servlet-api, jakarta.jakartaee-web-api and about 20 other Jakarta EE API jars to your classpath at runtime. They were declared with a scope that Maven doesn't know (optional), which it treated as a compile dependency, and are now provided, like in spring-mock-mvc-kotlin-extensions (#1992)
• Upgraded scala-library in scala-support from 2.13.0 to 2.13.18, which fixes CVE-2022-36944, scala3-library_3 in scala-extensions from 3.3.3 to 3.3.8, Jackson 2 (jackson-databind, jackson-core and jackson-module-kotlin) from 2.17.1 to 2.22.3, Jackson 3 (tools.jackson) from 3.0.2 to 3.2.3, Gson from 2.9.0 to 2.14.0, Guava in json-schema-validator from 33.2.1-jre to 33.7.2-jre, commons-lang3 from 3.19.0 to 3.21.0, Yasson from 3.0.4 to 3.0.5 (now with its new group id org.eclipse.yasson, since org.eclipse:yasson 3.0.5 only relocates to it), Parsson from 1.1.7 to 1.1.9, Johnzon (johnzon-mapper) from 2.0.2 to 2.2.0 and jaxb-impl from 2.3.4 to 2.3.9 (#1986)
• Non-backward compatible change: sending a request directly from a request specification created by RequestSpecBuilder.build() (for example spec.when().get("/x") or spec.post()) now fails with an IllegalStateException that tells you to use given().spec(spec) or given(spec), instead of a NullPointerException. then(), expect() and response() on such a specification also throw this exception, where they returned null before. The specification is meant to be added to a request, and isn't changed by the failed call. The javadoc of RequestSpecBuilder.build() now explains this (part of #1863)
• Non-backward compatible change: sending a request directly from a response specification created by ResponseSpecBuilder.build() (for example responseSpec.when().get("/x")) now fails with an IllegalStateException that tells you to use given().spec(requestSpec).expect().spec(responseSpec), then().spec(responseSpec) or given(requestSpec, responseSpec), instead of a NullPointerException. when(), given(), with() and request() on such a specification also throw this exception, where they returned null before. Using the specification in a request, or as RestAssured.responseSpecification, works as before. The javadoc of ResponseSpecBuilder.build() now explains this (related to #1863)
• JsonPath and JSON body assertions can now read a key that contains a colon with the dot notation, such as jsonPath.getInt("message.ErrorCode:") or body("message.ErrorCode:", equalTo(0)), which failed with "Invalid JSON expression" before. A colon in a ternary (a ? b : c) or Elvis (a ?: b) expression, in a closure or in a quoted string is left as is (fixes #1766)
• Fix request logging of a multipart File whose mime type isn't text, such as application/octet-stream (the default) or image/png, which since 5.5.0 printed the whole file content to the log. Such a part is now logged as the path of the file, as before 5.5.0. The content of a file with a text mime type (text/*, JSON, XML or HTML) is still logged, and is now read with the charset of the part (or of its mime type), or UTF-8 if none is given, instead of the platform default charset. A text file that can't be read is logged as its path, so sending the request reports the error (fixes #1819)
• Upgraded Groovy from 5.0.3 to 5.0.8 and Apache HttpClient (httpclient and httpmime) from 4.5.13 to 4.5.14 (#1971)
• Fix races in the static configuration of REST Assured when tests run in parallel. RestAssured.filters(..), replaceFiltersWith(..), registerParser(..) and unregisterParser(..), and RestAssuredMockMvc.resultHandlers(..) and postProcessors(..), could make a given() in another thread fail with a ConcurrentModificationException or copy a default filter list with missing or null filters. given() (and when(), with(), expect() and the static request methods) no longer changes any shared state. The public static fields of RestAssured, RestAssuredMockMvc and RestAssuredWebTestClient, and JsonPath.config, XmlPath.config and JsonSchemaValidator.settings, are now volatile, so a value set before the tests start is seen by every thread. The javadoc of RestAssured, RestAssuredMockMvc and RestAssuredWebTestClient now explains how to use the static configuration when tests run in parallel (fixes #1967)
• Non-backward compatible change: given() no longer writes the session id into the RestAssured.config field or RestAssured.defaultParser into the global parser registry. While RestAssured.sessionId is set, RestAssured.config() returns the config with the session id, but the RestAssured.config field doesn't contain it, also not after a request, so given().config(RestAssured.config) no longer sends the static session id (use RestAssured.config() instead). Setting RestAssured.sessionId or RestAssured.defaultParser back to null now takes effect without RestAssured.reset(). A list returned by RestAssured.filters() before replaceFiltersWith(..) keeps showing the old filters (fixes #1967)
• Fix HttpClientConfig.reuseHttpClientInstance() creating more than one HttpClient when several threads send their first request at the same time, and make the default Yasson (JSON-B) object mapper share one Jsonb instance between threads in the same way. Note that the reused HttpClient is reconfigured by every request, so it still must not be used by requests that run at the same time (fixes #1967)
• Non-backward compatible change: auth().certificate(certURL, password) and RestAssured.certificate(certURL, password), with or without CertificateAuthSettings, now use the file at certURL as key store, as documented, so the client certificate in it is sent to servers that ask for one (mutual TLS). Before, the file was only used as trust store, which it still is. This means that a private key in the file is now offered to any server that asks for a client certificate, also where it's optional (such as nginx with ssl_verify_client optional), which may then reject a certificate it doesn't trust, and that the private key must have the password of the file. To avoid this, or to use the JVM's default trust store, use RestAssured.certificate(trustStorePath, trustStorePassword, keyStorePath, keyStorePassword, CertificateAuthSettings) (as RestAssured.authentication or with RequestSpecBuilder.setAuth(..)), where an empty path means no key store or the default trust store (fixes #1158, related to #1325)
• Fix a root path with more than one placeholder left for a later withArgs(..), such as rootPath("a.%s.%s.%s", withArgs("x")).body(withArgs("y", "z"), ..), which failed with a MissingFormatArgumentException. All placeholders without an argument, including ones such as %d, are now kept for later arguments. body(withArgs(..), matcher) also no longer adds a trailing dot to the path, which showed up in failure messages such as "JSON path a.d.e. doesn't match." (fixes #1949)
• The rest-assured module is now written entirely in Java and no longer depends on Groovy (org.apache.groovy:groovy and groovy-xml) directly. Groovy still comes transitively through json-path and xml-path, which use it for GPath, so the dependencies on the classpath are unchanged. The rest-assured and rest-assured-common OSGi bundles no longer import the groovy packages, and rest-assured-common no longer depends on Groovy at all (#1917, #1932)
• Non-backward compatible change: a Groovy closure used as request body now fails with an IllegalArgumentException. This could only happen when a custom ObjectMapper returned a Closure from serialize(..), in which case the closure was run as a builder (a JsonBuilder for JSON, a StreamingMarkupBuilder for XML and HTML, or with a Writer or OutputStream for text and binary content). Return a String, byte[] or InputStream from the ObjectMapper instead (#1914)
• Non-backward compatible change: a request body that isn't a String (for example a byte[], InputStream or File) sent with content-type application/x-www-form-urlencoded now fails with an IllegalArgumentException explaining that a form url-encoded body must be a String, instead of a groovy.lang.MissingMethodException (#1914)
• Non-backward compatible change: a groovy.lang.Writable request body sent with a text content-type is now sent as its toString() instead of what its writeTo(..) method writes. Groovy's own Writables (such as JsonBuilder and GString) produce the same output either way. A Groovy WritableFile (file.asWritable()) is now sent like any other File, read with the charset of the request content-type (#1914)
• Fix the failure message of a body path assertion when the response body can't be parsed into something the path can navigate (for example a JSON body that is just a string), which showed the literal text $contentParser instead of the response body (#1922)
• Fix form authentication failing with "IllegalArgumentException: parameterValues cannot be null" when an additional input field given to FormAuthConfig.withAdditionalField(s)(..) is an input tag without a value attribute on the login page. The field is now sent as a form parameter without a value (#1921)
• Fix matchesDtd(URL) in RestAssuredMatchers, RestAssuredMockMvcMatchers and RestAssuredWebTestClientMatchers, which always failed with a GroovyCastException ("Cannot cast object '' with class 'java.lang.String' to class 'java.io.InputStream'") when the response was validated. The DTD is now read from the URL, every time the matcher is used (#1920)
• Non-backward compatible change: matchesXsdInClasspath(..) and matchesDtdInClasspath(..) (in RestAssuredMatchers, RestAssuredMockMvcMatchers and RestAssuredWebTestClientMatchers) now fail with an IllegalArgumentException saying that the XSD or DTD couldn't be found in classpath, instead of a groovy.lang.GroovyRuntimeException ("Ambiguous method overloading"). The XSD and DTD matchers now also fail with an IllegalArgumentException when asked to match something that isn't a String, for example body("some.path", matchesXsd(..)) where the path returns an element that has child elements, instead of a Groovy exception (#1920)
• Non-backward compatible change: io.restassured.assertion.HeaderMatcher, DetailedCookieAssertion, ResponseTimeMatcher and StreamVerifier are now written in Java and no longer implement groovy.lang.GroovyObject. HeaderMatcher.validateHeader(..), DetailedCookieAssertion.validateCookies(..) and ResponseTimeMatcher.validate(..) now return Map<String, Object> instead of Object, HeaderMatcher.validateHeader(..) takes a Response, and HeaderMatcher.getMatcher() and get/setResponseAwareMatcher(..) are now generically typed (Matcher<?> and ResponseAwareMatcher) (#1919)
• A header expectation whose header name is neither a String nor a GString (for example an Integer key in the map passed to headers(Map)) now checks the header named by the key's string form instead of failing with a groovy.lang.MissingMethodException (#1919)
• Non-backward compatible change: io.restassured.internal.http.HTTPBuilder, which a custom AuthenticationScheme receives in authenticate(..), no longer uses Groovy closures. Its get(..) methods, the request(..) overloads that took a Closure, getHandler() and the post(..) and patch(..) overloads without a response handler are removed. post(..), patch(..) and request(..) now take an HttpResponseHandler or a RequestConfigurer, and response handlers always take two arguments (the response and its parsed content) (#1923)
• A parameter name that is neither a String nor a GString (for example an Integer key in the map passed to params(Map), queryParams(Map), formParams(Map) or pathParams(Map)) is now used in its string form, so 1 becomes "1", instead of failing with a groovy.lang.MissingMethodException (#1927)
• Non-backward compatible change: io.restassured.internal.RestAssuredResponseOptionsGroovyImpl is removed and its logic now lives in RestAssuredResponseOptionsImpl, so getGroovyResponse(), setGroovyResponse(..) and the protected groovyResponse field of RestAssuredResponseOptionsImpl are gone. This affects code that calls these methods or subclasses the internal response classes. A subclass that overrides a method such as asString() now also sees that override used by path(..), jsonPath(), as(..) and the other methods that read the body (#1926)
• Fix asByteArray() on a response with body expectations whose body was replaced by an InputStream (for example by a filter using ResponseBuilder.clone(..).setBody(inputStream)), which failed with a groovy.lang.MissingMethodException (#1926)
• Non-backward compatible change: the authentication schemes in io.restassured.authentication (BasicAuthScheme, CertAuthScheme, ExplicitNoAuthScheme, FormAuthScheme, NTLMAuthScheme, NoAuthScheme, OAuth2Scheme, OAuthScheme, PreemptiveBasicAuthScheme and PreemptiveOAuth2HeaderScheme), and the AuthenticationScheme interface are now written in Java, and the classes no longer implement groovy.lang.GroovyObject. Their constructors, getters and setters are unchanged. A custom AuthenticationScheme written in Java can now get the authentication configuration from HTTPBuilder.getAuth() (#1925)
• Non-backward compatible change: io.restassured.internal.matcher.xml.XmlXsdMatcher (the return type of RestAssuredMatchers.matchesXsd(..)) and XmlDtdMatcher are now written in Java and no longer implement groovy.lang.GroovyObject (#1920)
• A CertAuthScheme whose key store or trust store path (setPathToKeyStore(..) or setPathToTrustStore(..)) is neither a String nor a java.io.File now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#1925)
• Fix FilterContext.send(..) for a request whose HTTP method has no method of its own in RequestSender, such as TRACE or a custom method given to request(..) (for example request("PURGE", "/x")). It failed with a groovy.lang.MissingMethodException and now sends the request. FilterContext.send(..) now always calls RequestSender.request(method, path) on the request sender it is given, instead of get(path), post(path) and so on (#1929)
• Fix getResponseContentType() of the response specification that filters receive (FilterableResponseSpecification), which always failed with a StackOverflowError. It now returns the expected content type, the description of the expected content type matcher, or "/" when no content type is expected (#1928)
• Non-backward compatible change: using a ResponseSpecification that wasn't created by REST Assured, with spec(..) or specification(..) on a response specification or as RestAssured.responseSpecification, now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#1928)
• A body expectation path that is neither a String nor a GString (for example an Integer key among the additional key/matcher pairs of body(..)) is now used in its string form instead of failing with a groovy.lang.MissingMethodException. A list given as path, or as path arguments to body(..), rootPath(..), root(..) or appendRootPath(..), whose elements aren't all io.restassured.specification.Argument (as created by withArgs(..)) now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#1928)
• Fix cookies(Map) and cookies(String, Object, Object...) on a request specification, which failed with a groovy.lang.GroovyRuntimeException ("Could not find matching constructor for: io.restassured.http.Cookie$Builder(String, Integer)") when a cookie value wasn't a String, for example an Integer. Such a value is now converted the same way as a value given to cookie(String, Object, Object...), so 1 becomes "1" (#1930)
• Fix keyStore(KeyStore) on a request specification and RequestSpecBuilder.setKeyStore(KeyStore), which always failed with a groovy.lang.MissingMethodException. SSLConfig gets the keyStore(KeyStore) method that the documentation of keyStore(KeyStore) refers to. A password-protected key store needs its password set with SSLConfig.keyStore(String) on the same SSLConfig, for example config(config().sslConfig(sslConfig().keyStore(keyStore).keyStore("password"))). Calling config(..) after keyStore(KeyStore) replaces the config and drops the key store. relaxedHTTPSValidation() only uses a key store given by path, not a KeyStore object (#1930)
• Fix multiPart(String, Object) with a String and no request content type, which failed with a groovy.lang.GroovyRuntimeException ("Ambiguous method overloading"). It now adds a text/plain part (#1930)
• Non-backward compatible change: using a RequestSpecification that wasn't created by REST Assured with spec(..) or specification(..) on a request specification now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#1930)
• A header or cookie name given to headers(..) or cookies(..) (as a map key or in the name/value varargs) that isn't a String (for example an Integer) is now used in its string form instead of failing with a groovy.lang.GroovyRuntimeException (#1931)
• Fix merging a request specification that has unnamed path parameters, for example the request specification that a filter receives for get("/users/{id}", 1), with spec(..) or RequestSpecBuilder.addRequestSpecification(..). The resulting specification failed with a groovy.lang.MissingPropertyException when it was sent with unnamed path parameters, merged again, or asked for its URI or unnamed path parameters (for example getURI() or getUnnamedPathParamValues()). It now gets the unnamed path parameters of the specification it was merged with (#1931)
• Fix form authentication failing with "IllegalArgumentException: Invalid number of path parameters" when the login page is fetched for a request with path parameters, for example given().auth().form("John", "Doe").get("/secured/{id}", 1). The login page is now also fetched at the right URL when the path or a path parameter contains characters that need URL encoding, such as a space or a non-ASCII character, which used to be URL encoded twice (fixes #1940)
• Non-backward compatible change: form authentication now fails with an IllegalArgumentException that names the field when an additional input field given to FormAuthConfig.withAdditionalField(s)(..) isn't on the login page. Such a field used to be sent with the value "[]" (fixes #1941)
• Fix form authentication not passing the session filter of the request on to the login request when the filter is a subclass of SessionFilter (for example new SessionFilter() {}), so the subclass didn't get the session id (fixes #1941)
• Fix form authentication failing with a NullPointerException when the login form has no action attribute. Such a form is now posted to the path and query of the URL of the login page, like a browser does: the URL that the request for the login page was redirected to, or the CSRF token page (including the base path) when CSRF is enabled. As for any form action, it is posted to the host of the request (fixes #1941)
• Non-backward compatible change: form authentication now posts a login form with an empty action (action="") to the URL of the login page, like a browser does, instead of to "/" (fixes #1941)
• Fix form authentication URL encoding the path and query of a form action read from the login page twice, so for example a form with action "/login?r=a%20b" was posted to /login?r=a%2520b. A "+" in the query of such a form action is decoded as a space, as servlet containers do, an encoded "/", "?", "#", "{" or "}" in its path is kept encoded, and a fragment ("#..") is left out. A form action given to FormAuthConfig is still used as it is (#1954)
• Non-backward compatible change: form authentication now resolves a relative form action read from the login page against the URL of the login page (or its ), like a browser does. An action without a leading slash used to be resolved against the root, so for example action="login" on the page /secured/page was posted to /login and is now posted to /secured/login (#1954)
• Fix form authentication for an absolute form action read from the login page (for example action="http://localhost:8080/login"), which was appended as a path to the host of the request. Like any other form action, its path and query are now posted to the host of the request (#1954)
• Form authentication now fails with a message saying that the Location header is missing when the request for the login page is redirected (302) without a Location header, instead of "IllegalArgumentException: path cannot be null" (fixes #1941)

... (truncated)

Commits

• a75cb9a [maven-release-plugin] prepare release rest-assured-6.2.0
• 28af02d [ci skip] Preparing changelog for release
• 9673680 [ci skip] Updated changelog to reflect the latest changes (#1994)
• 45d4a64 Stop spring-web-test-client-kotlin-extensions from bringing Jakarta EE APIs a...
• 21877e4 Give a clear error when a ResponseSpecBuilder spec sends a request directly (...
• c2415c4 Upgrade vulnerable dependencies in examples and tests (#1993)
• 5dd9f3b Upgrade published dependencies for 6.2.0, including scala-library for CVE-202...
• fd9efcc [ci skip] Updated changelog to reflect the latest changes (#1978)
• 83bcbda Give a clear error when a RequestSpecBuilder spec sends a request directly (#...
• 670f51f Read JSON keys that contain a colon with the dot notation (#1970)
• Additional commits viewable in compare view

Updates org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15

Release notes

Sourced from org.jacoco:jacoco-maven-plugin's releases.

0.8.15

New Features

• JaCoCo now officially supports Java 26 (GitHub #2076).
• Experimental support for Java 27 class files (GitHub #2004).
• Compatibility methods generated by Kotlin compiler for functions defined in interfaces are filtered out during generation of report (GitHub #1905).
• Compatibility methods generated by Kotlin compiler for exposed boxed inline value classes (JvmExposeBoxed annotation) are filtered out during generation of report (GitHub #1944).
• Methods generated by the Kotlin compiler for functions with JvmStatic annotation are filtered out during generation of report (GitHub #2097).
• Improved filtering of bytecode generated by Kotlin compiler for when expressions and statements with kotlin.String subject where first branch condition contains string with largest hash (GitHub #2098).
• Part of bytecode that javac versions from 24 to 26 generate for switch statements and expressions with selector expression of type java.lang.String inside lambdas is filtered out during generation of report (GitHub #2023).
• Improved performance of Kotlin files analysis by parsing SMAPs only once per class (GitHub #2114).
• For better performance agent output methods tcpclient and tcpserver use BufferedOutputStream to write execution data to socket. Maven plugin, Ant tasks, CLI, API usage examples, and ExecDumpClient API use BufferedInputStream to read execution data from socket. Third-party integrations should do the same to benefit from this change in agent (GitHub #2089).

Fixed bugs

• Fixed processing of Kotlin SMAP in synthetic classes (GitHub #1985).
• Multiple JaCoCo runtimes within one JVM writing to the same output file should not cause data corruption when running on JDK versions from 6 to 10 affected by JDK-8166253 (GitHub #2065, #2074).
• For better performance agent writes to output file via BufferedOutputStream, this fixes regression introduced in version 0.6.2 (GitHub #2073).
• Fixed NullPointerException when JaCoCo agent is loaded by non system class loader, for example when loaded by JBoss Modules (GitHub #1651).

Non-functional Changes

• JaCoCo now depends on ASM 9.10.1 (GitHub #2134).

Commits

• 6c5260a Prepare release v0.8.15
• 5c05141 Transfer of execution data through socket should use buffered stream (#2089)
• ab5efa9 Remove from Azure Pipelines all builds except with JDK 5 and JDK EA (#2148)
• 5f6ea38 Use Windows 2025 image in GitHub Actions (#2130)
• 35a8af2 Use Renovate instead of Dependabot for updates of ASM (#2137)
• 85b8ddf Upgrade ASM to 9.10.1 (#2134)
• 2988647 AgentModule should use ClassLoader of agent instead of SystemClassLoader (#1651)
• 75a4e31 Add filter for Kotlin @JvmExposeBoxed (#1944)
• 691fa1d Use Renovate instead of Dependabot for updates of GitHub Actions (#2132)
• 3e18f17 Require at least JDK 21 for build (#2128)
• Additional commits viewable in compare view

Updates com.bucket4j:bucket4j_jdk17-core from 8.15.0 to 8.21.0

Release notes

Sourced from com.bucket4j:bucket4j_jdk17-core's releases.

8.21.0

The features in release scope are following:

• #580 compare-and-swap retry mechanism
• #588 Support for Redis Sentinel via Lettuce
• #615 Gemfire/Geode support
• #617 bucket4j-bom module
• #622 Memcached support with CAS-based style
• #623 Support for fresh Coherence versions
• #625 Migrate serialization from ByteArrayOutputStream/ByteArrayInputStream to ByteBuffer
• #633 Support for Infinispan 16.x via a dedicated module
• #629 Apache Ignite 3 support
• #593 Apache Cassandra integration
• #634 Skip unnecessary token recalculation in bucket reset()

The bugfixes in release scope are following:

• #595 Disable stack trace generation in BucketExecutionException
• #606 Fix MySQL gap lock deadlocks
• Cassandra Integration by @​sahu-iisc in bucket4j/bucket4j#593

New Contributors

• @​Vishwajit-29 made their first contribution in bucket4j/bucket4j#628
• @​sahu-iisc made their first contribution in bucket4j/bucket4j#634

Full Changelog: bucket4j/bucket4j@8.20.0...8.21.0

8.20.0

What's Changed

• docs: add Compare&Swap implementation details for Redis by @​sunghyun1999 in bucket4j/bucket4j#597
• Bump org.postgresql:postgresql from 42.7.11 to 42.7.12 in /backward-compatibility-tests/common by @​dependabot[bot] in bucket4j/bucket4j#604
• Bump org.mariadb.jdbc:mariadb-java-client from 3.3.2 to 3.3.5 in /bucket4j-mariadb by @​dependabot[bot] in bucket4j/bucket4j#609
• perf: disable stack trace generation in BucketExecutionException and … by @​Palak24Ol in bucket4j/bucket4j#595
• bucket4j (lettuce) support for redis with sentinel by @​Rithra in bucket4j/bucket4j#588
• Bump com.fasterxml.jackson.core:jackson-databind from 2.13.4.2 to 2.18.9 in /bucket4j-parent by @​dependabot[bot] in bucket4j/bucket4j#611
• test: verify Valkey compatibility for Lettuce and Glide clients (#520) by @​thesahibnanda-max in bucket4j/bucket4j#608
• upgrade testcontainers to be compatible with OrbStack on Macos by @​vladimir-bukhtoyarov in bucket4j/bucket4j#612
• Fix examples compilation by @​vladimir-bukhtoyarov in bucket4j/bucket4j#613
• Fix build for macos by @​vladimir-bukhtoyarov in bucket4j/bucket4j#614
• Fix MySQL gap lock deadlocks by @​jumdo12 in bucket4j/bucket4j#606
• #468 Gemfire/Geode support by @​vladimir-bukhtoyarov in bucket4j/bucket4j#615

New Contributors

• @​sunghyun1999 made their first contribution in bucket4j/bucket4j#597
• @​Palak24Ol made their first contribution in bucket4j/bucket4j#595
• @​thesahibnanda-max made their first contribution in bucket4j/bucket4j#608
• @​jumdo12 made their first contribution in bucket4j/bucket4j#606

Full Changelog: bucket4j/bucket4j@8.19.0...8.20.0

8.19.0

What's Changed

... (truncated)

Commits

• a22b062 prepare 8.21.0 artifacts
• 0d89ef9 Cassandra Integration (#593)
• 5839b63 Ignite 3 (#629)
• dcefbcf #620 Fix build on GitHub actions and update actions configs (#637)
• 505c070 #620 fix snapshot deploy 409 conflict by cascading versions:set to all module...
• 5ac5230 Refractor bucketstate reset (#634)
• 5467db4 Bump com.fasterxml.jackson.core:jackson-databind in /bucket4j-parent (#635)
• 4473268 #632 fix InfinispanHotrodTest extension jar build when bucket4j-core resolves...
• 800458f #632 add support for Infinispan 16.x via a dedicated module (#633)
• 8f6e185 check compatibility with latest Ignite 2.x
• Additional commits viewable in compare view

Updates com.puppycrawl.tools:checkstyle from 10.21.2 to 14.3.0

Release notes

Sourced from com.puppycrawl.tools:checkstyle's releases.

checkstyle-14.3.0

Checkstyle 14.3.0 - https://checkstyle.org/releasenotes.html#Release_14.3.0

New:

#14120 - Make Checkstyle an java module with module-info.java.

checkstyle-14.2.0

Checkstyle 14.2.0 - https://checkstyle.org/releasenotes.html#Release_14.2.0

New:

#19513 - ModifiedOrder: New property modifierOrder. #17723 - WhitespaceAfter: new token SINGLE_LINE_COMMENT to catch missing whitespace checks around // comments. #8312 - NoWhitespaceAfter: Allow for use of DO_WHILE, LITERAL_CATCH, LITERAL_FOR, LITERAL_IF, and LITERAL_WHILE. #17172 - AnnotationLocation new token MODULE_DEF. Google-style: incomplete coverage on annotation rules for modules. #14986 - New Check UnnecessaryPermitsClause. #7541 - new Check: GoolgeRightCurly. #19949 - New check: JavadocSeeTagOrder. #20639 - new Check: OpenjdkMethodThrowsAlignment.

Bug fixes:

#17663 - Indentation: missing violations for '->' and ',' in return statement continuation. #20541 - False Positive: Lambda is incorrectly flaged by OperatorWrap. #21739 - UnusedLocalVariable: false positive on unnamed variable _ inside anonymous class. #21613 - False negative: UnusedTryResourceShouldBeUnnamed treats same-named identifiers in catch/finally blocks as resource usage. #21695 - openjdk style: use custon modifierOrder at RedundantModifier. #21689 - Add GoogleRightCurly to google_checks.xml instead of RightCurly. #10924 - All checks that use AbstractCheck#getLine() should check code points instead of characters for spacing. #21139 - Performance: Avoid duplicate regex match in SuppressFilterElement.isFileMatch. #21528 - Add checks for Sun Style [4.2 - Wrapping Lines]. #21578 - False Negative: LambdaParameterName silently passes lambdas in switch rule. #21579 - False Negative: NeedBraces silently passes lambdas in switch rule. #5895 - CLI XML output file: file stops dead when an execption occurs. #11410 - False Negative: LeftCurlyCheck. #21583 - Update Documentation Comments Style Guide: add JavadocSeeTagOrder. #21609 - NPE in RightCurlyCheck. #19724 - google_checks.xml: JavadocMethod accessModifiers should include protected to match MissingJavadocMethod scope. #20963 - False negative in LeftCurly for types with option=eol. #21547 - add OpenjdkMethodThrowsAlignment check in openjdk_checks.xml. #20636 - False negatives regarding LeftCurly in openjdk_checks.xml. #17170 - Google-style: unfollowed rule on ordering and spacing of module directives. #21454 - google_checks.xml: false negative 4.3 One statement per line. #21501 - CommonUtil.getFileExtension includes parent-directory dots in the extension. #21445 - google_checks.xml: false negative 3.3.1.1 No module imports. #21477 - Add checks for Sun Style [4.1 - Line Length]. #21444 - google_checks.xml: false negative 3.2 Package declaration.

... (truncated)

Commits

• bc58fc6 [maven-release-plugin] prepare release checkstyle-14.3.0
• 5711c72 doc: release notes for 14.3.0
• 4b8a5b3 minor: Bump version to 14.3.0-SNAPSHOT
• a93f8f2 Issue #14120: add module-info.java to make Checkstyle an explicit Java module
• 9e3482f [maven-release-plugin] prepare for next development iteration
• 6a200bc [maven-release-plugin] prepare release checkstyle-14.2.0
• 2d2b135 doc: release notes for 14.2.0
• 194e7a2 Issue #20590: Improve Input coverage for compact sources for SuperCloneCheck
• 123f477 Issue #17663: Indentation: missing violations for '->' and ',' in return stat...

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9236b5f8-2758-4ce4-aa01-743f02d12261

📥 Commits

Reviewing files that changed from the base of the PR and between f0825de and 4f56487.

⛔ Files ignored due to path filters: 4

• e2e/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• email/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• internal/leetcode-auth-stealer-service/uv.lock is excluded by !**/*.lock
• js/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing: 6

• e2e/package.json
• email/package.json
• infra/Dockerfile
• internal/leetcode-auth-stealer-service/Dockerfile
• js/package.json
• pom.xml

+----------------------------------------------------------+
| Solving problems you didn't know you were about to have. |
+----------------------------------------------------------+
  \
   \     /)/)
        ( '')
        /  |
      o(___)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[pat-agent]

Available PR Commands

• /migrate - Applies this PR's database migrations to the staging DB (can only be run by someone on @Patina-Network/codebloom)
• /copy - Triggers copy from production to staging db (can only be run by tahminator or angelayu0530)

[dependabot]

Superseded by #1052.

[pat-agent]

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-standup-bot-arm/tags under the following tags:

• codebloom-standup-bot-arm:staging-latest
• codebloom-standup-bot-arm:staging-2026.10.23-18.34.17
• codebloom-standup-bot-arm:staging-4e5acbf

[pat-agent]

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-standup-bot/tags under the following tags:

• codebloom-standup-bot:staging-latest
• codebloom-standup-bot:staging-2026.10.23-18.34.07
• codebloom-standup-bot:staging-4e5acbf