[dependabot]

Bumps the backend-deps group with 6 updates in the /backend directory:

Package	From	To
tools.jackson.core:jackson-core	3.2.3	3.2.4
tools.jackson.core:jackson-databind	3.2.3	3.2.4
org.springdoc:springdoc-openapi-starter-webmvc-ui	3.1.1	3.2.0
com.squareup.okhttp3:mockwebserver	4.12.0	4.12.1
org.springframework.boot	4.1.1	4.1.2
gradle-wrapper	9.8.1	9.8.2

Updates tools.jackson.core:jackson-core from 3.2.3 to 3.2.4

Commits

• 9fefe69 [maven-release-plugin] prepare release jackson-core-3.2.4
• f86dddd Prep for 3.2.4 release
• bfca6c2 Merge branch '3.1' into 3.2
• ca96e4a Post-release dep version bump
• be44fb6 [maven-release-plugin] prepare for next development iteration
• 072a872 [maven-release-plugin] prepare release jackson-core-3.1.8
• ffc7645 Prep for 3.1.8 release
• 97f607f Merge branch '2.x' into 3.1
• 156a91f Merge branch '2.22' into 2.x
• 400f036 Post-release dep version bump
• Additional commits viewable in compare view

Updates tools.jackson.core:jackson-databind from 3.2.3 to 3.2.4

Commits

• 461f8ec [maven-release-plugin] prepare release jackson-databind-3.2.4
• 2a502c9 Prep for 3.2.4 release
• 64a4813 Merge branch '3.1' into 3.2
• 5d64697 Post-release dep version bump
• 9b5fe86 [maven-release-plugin] prepare for next development iteration
• 893c391 [maven-release-plugin] prepare release jackson-databind-3.1.8
• 22442d0 Prep for 3.1.8 release
• df230c1 Merge branch '2.x' into 3.1
• 69ddc80 Merge branch '2.22' into 2.x
• 72bb78e Post-release dep version bump
• Additional commits viewable in compare view

Updates org.springdoc:springdoc-openapi-starter-webmvc-ui from 3.1.1 to 3.2.0

Release notes

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's releases.

springdoc-openapi v3.2.0 released!

Spring Boot 4.1.x line (built on Spring Boot 4.1.2).

⚠️ Changes you may notice

• Default API version (#3354): the default API version is now only listed in the version header or query parameter of the operations that actually serve it (a handler mapped to it, or one without a version). Operations mapped only to other versions no longer show it as an allowed value or as their default. This also fixes the HTTP 500 raised when the version parameter declared @Schema(allowableValues).
• Newly required properties (#3360, #3361): the PagedModel / PageMetadata properties and the amount / currency properties of MonetaryAmount are now marked as required, as they are always serialized. Generated clients will see them as non-nullable.
• Scalar 0.6 (#3359): upgraded to 0.6.83. The first tag is now open by default, and model links changed from #model/name to #models/Name.
• Scalar's standalone integration (#3387): with the Swagger UI or API-only starters, Scalar's own auto-configuration is no longer disabled by springdoc. If you have com.scalar.maven on the classpath and don't want it, set scalar.enabled=false.

New

• Opt-in nullability for Java models (#3382): springdoc.model-converters.java-nullable-property-customizer.enabled=true marks properties annotated with @Nullable (JSpecify, Spring, JSR-305) as nullable, including $ref and oneOf properties, without changing shared components.
• Polymorphic oneOf as reusable components (#3390): springdoc.model-converters.polymorphic-converter.one-of-as-ref=true, with the name suffix set by springdoc.model-converters.polymorphic-converter.one-of-ref-suffix (Variant by default).
• ParameterCustomizer can read type-use annotations, including inside Optional<@MyAnnotation Foo> (#3370).
• MCP tools are registered with a McpStatelessSyncServer, for the Spring AI STATELESS protocol (#3388).

Fixed

• @ResponseStatus on a controller class is applied to its operations (#3352).
• An injected WebSession is no longer documented as a query parameter in WebFlux (#3355).
• The application no longer fails to start with Spring HATEOAS on the classpath but no LinkRelationProvider bean (#3364).
• WebAsyncTask return types are unwrapped (#3368).
• A JSpecify @Nullable on a controller parameter makes its schema nullable (#3377).
• Nullable Kotlin properties described by a oneOf (e.g. sealed classes) are documented as nullable (#3381).
• Gradle builds no longer lift Jackson 2 above the version managed by Spring Boot (#3373).

Security

• The MCP dashboard no longer pre-fills the OAuth2 token endpoint, client id and client secret, and warns when the token endpoint is not HTTPS.

Dependencies

Spring Boot 4.1.2 · swagger-ui 5.34.0 · Scalar 0.6.83 · Spring AI 2.0.1 · Spring Cloud Function 5.0.5 · spring-security-oauth2-authorization-server managed by Spring Boot (7.1.2)

Thanks to all the contributors of this release: @​MaxFreedomPollard, @​kdelay, @​arimu1, @​dpkass, @​anupamchaubey, @​Mattias-Sehlstedt, @​Naresh7175, @​ys0v9, @​sharanggupta, @​itd-sw, @​gwr0-0, @​Tework123, @​awinishere.

Changelog

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's changelog.

[3.2.0] - 2026-10-24

Added

• #3370 – A ParameterCustomizer can read the type-use annotations of a parameter, including the ones declared on the value wrapped in an Optional, such as Optional<@MyAnnotation Foo>
• #3382 – Mark the Java properties annotated with @Nullable (JSpecify, Spring, JSR-305) as nullable in their schema, including $ref and oneOf properties. Opt-in with springdoc.model-converters.java-nullable-property-customizer.enabled=true
• #3390 – Add springdoc.model-converters.polymorphic-converter.one-of-as-ref to emit the polymorphic oneOf unions as reusable component schemas, named after the parent schema with the suffix set by springdoc.model-converters.polymorphic-converter.one-of-ref-suffix (Variant by default)
• #3388 – Register the MCP tools with a McpStatelessSyncServer, for the STATELESS protocol

Changed

• The MCP dashboard no longer pre-fills the OAuth2 token endpoint, client id and client secret. The form shows hints instead, and warns when the token endpoint is not HTTPS
• #3354 – The default API version is only listed in the header or query parameter of the operations that serve it: a handler method mapped to it, or one without a version
• #3360 – The properties of Spring Data PagedModel and its PageMetadata are now marked as required, as they are always serialized
• #3361 – The amount and currency properties of MonetaryAmount are now marked as required
• #3359 – Upgrade Scalar to version 0.6.83. The first tag is now open by default, and the links to models changed from #model/name to #models/Name
• #3383 – Upgrade Spring AI to version 2.0.1. The MCP SDK version is now the one required by Spring AI
• Upgrade spring-boot to version 4.1.2
• Upgrade swagger-ui to version 5.34.0
• Upgrade spring-cloud-function to version 5.0.5
• Use the spring-security-oauth2-authorization-server version managed by Spring Boot (7.1.2) instead of 2.0.0-M2

Fixed

• #3352 – A @ResponseStatus on a controller class is now applied to the responses of its operations
• #3355 – An injected WebSession parameter is no longer documented as a query parameter in WebFlux applications
• #3354 – /v3/api-docs no longer fails when an API version parameter declares @Schema(allowableValues)
• #3364 – The application no longer fails to start when Spring HATEOAS is on the classpath without a LinkRelationProvider bean
• #3368 – A WebAsyncTask return type is now unwrapped, so its response is described by its result type
• #3377 – A JSpecify @Nullable on a controller method parameter now makes its schema nullable
• #3381 – A nullable Kotlin property described by a oneOf schema, such as a sealed class, is now documented as nullable
• #3387 – Scalar's own integration works again with the Swagger UI and API-only starters: only the Springdoc Scalar starters replace it
• #3373 – springdoc no longer lifts Jackson 2 above the version managed by Spring Boot in Gradle builds

Commits

• 6b79ced [maven-release-plugin] prepare release v3.2.0
• 689fc13 Describe the nullable property customizer flags in the configuration metadata
• 7a1b506 Correct the LocalTime format in the changelog entry of gh-3351
• 96245a2 Upgrade Scalar to 0.6.83
• c494456 Build against the GA versions of the optional Spring dependencies
• 2d4595f Restore the changelog entries lost in the unreleased fixed section
• dd807bd Upgrade swagger-ui to version 5.34.0
• e649960 Upgrade spring-boot to 4.1.2
• b170ca8 Use the Jackson 2 managed by Spring Boot
• ae52fe7 Register the MCP tools with a McpStatelessSyncServer
• Additional commits viewable in compare view

Updates com.squareup.okhttp3:mockwebserver from 4.12.0 to 4.12.1

Commits

• f5dc9a0 Prepare for release 4.12.1.
• e4c28ad OkHttp 4.12.x: Blocklist 8 certificates for CVE-2026-111943 (#9806)
• See full diff in compare view

Updates org.springframework.boot from 4.1.1 to 4.1.2

Release notes

Sourced from org.springframework.boot's releases.

v4.1.2

⭐ New Features

• Add TWENTY_SEVEN to JavaVersion enum #51426

🐞 Bug Fixes

• OriginTrackedResource does not implement equals correctly #52267
• OriginTrackedPropertiesLoader drops properties whose name starts with # or ! #52265
• JWTs are rejected when issuer-uri is empty and jwk-set-uri is set #52260
• Package manifest attributes are missing for nested jars without directory entries #52258
• Logback ColorConverter unnecessarily parses its options for every log event #52228
• Empty system property in TestPropertyValues is cleared instead of being restored to its empty value #52208
• Graceful shutdown of Tomcat or Jetty may call back with REQUESTS_ACTIVE when stop is called immediately after shutDownGracefully on an idle server #52197
• NettyWebServer stop may hang when called immediately after shutDownGracefully #52196
• gRPC client 'grpc' load balancing fails to bind with a NullPointerException when no child policies are configured #52193
• Prevent gRPC client properties from overriding user customizations #52175
• MongoDB fails to connect when credentials contain a space #52168
• Authentication fails when password configured in spring.elasticsearch.uris contains a colon #52166
• Logging can be lost when a context is paused by the test context framework #52088
• Docker Compose support for MongoDB fails to connect when credentials contain a character that requires URL encoding #52084
• Jersey does not use the endpoint ObjectMapper when Actuator is running on a separate port #51982
• Fractions of a second are handled incorrectly when configuring gRPC service config durations #51957
• Configuration property descriptions may be lost when building incrementally with Gradle #51925
• BasicJsonParser mishandles escaped characters in nested lists and maps #51908
• Zero week value conversion fails with 'intValue cannot be extracted from WEEKS' exception #51894
• App fails to start when using DevTools and manually configuring JDBC or R2DBC without spring-boot-jdbc or spring-boot-r2dbc #51890
• Docker Compose support incorrectly recognizes MARIADB_ALLOW_EMPTY_PASSWORD instead of MARIADB_ALLOW_EMPTY_ROOT_PASSWORD #51888
• Auto-configured Kotlinx Serialization JSON codec customization is not applied #51877
• NullPointerException can be thrown when using uber jars due to a race condition in NestedJarFileResources #51745
• DevTools does not detect a reactive web environment #51730
• spring.http.clients.cookie-handling has no effect when using a reactive client backed by an HttpComponents connector #51724
• Connection fails when rabbitmq Docker Compose service is configured to use SSL #51667
• SBOM-related manifest attributes are missing from Maven-packaged wars #51651
• When server.reactive.session.cookie.same-site is not set, session cookies have no SameSite attribute #51639
• OAuth2 resource server ignores authorities-claim-delimiter when set on its own #51630
• developmentOnly and testAndDevelopmentOnly configurations do not specify any attributes causing potential resolution problems #51623
• In a reactive web application, Cloud Foundry security integration returns a 500 rather than a 503 when the cloud controller URL is unavailable #51614
• Layer temp file is not deleted when layer creation fails #51581
• Docker Compose integration for RabbitMQ skips credential fallbacks when an environment variable has no value #51578
• Some assertion messages name the wrong parameter #51574
• OAuth2ResourceServerProperties.Jwt has a setter that does not match its getter #51562
• jarmode tools commands print stacktrace instead of an error message #51547
• Docker Compose ProcessRunner can hang or leave orphan processes #51538
• NestedByteChannel.read(ByteBuffer) incorrectly returns 0 when buffer could not be filled #51520
• Customizer null checks in HTTP client builders assert the wrong attribute #51513
• SSL host config customizations may be lost during Tomcat initialization #51511
• SQL Server Docker Compose integration may duplicate the JDBC URL's encrypt parameter #51481
• WritableJson.toByteArray() may corrupt supplementary characters #51464
• SSL host config customizations are lost when reloading SSL bundles #51457

... (truncated)

Commits

• 634e6fd Release 4.1.2
• 6b43cf1 Upgrade to Spring WS 5.0.3
• a73dfad Upgrade to Spring Security 7.1.2
• 0485f1e Upgrade to Spring RESTDocs 4.0.2
• de2c11a Upgrade to Spring Pulsar 2.0.8
• 8d0359e Upgrade to Spring LDAP 4.1.2
• f22c6e6 Upgrade to Spring Kafka 4.1.2
• ed55709 Upgrade to Spring Integration 7.1.2
• 2e88a38 Upgrade to Spring HATEOAS 3.1.3
• 0d69ce5 Upgrade to Spring gRPC 1.1.2
• Additional commits viewable in compare view

Updates gradle-wrapper from 9.8.1 to 9.8.2

Release notes

Sourced from gradle-wrapper's releases.

9.8.2

The Gradle team is excited to announce Gradle 9.8.2.

Here are the highlights of this release:

• Java 27 support
• Maven mirror settings reuse
• Linked problem locations in build output

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam, Björn Kautler, Eng Zer Jun, Hashim Khan, Julian Krannich, KBS, Labh R Jethe, Mark Dodgson, Maxim, monkey, nataphon-ktsystems, Paul King, Qiu Tian, rg_sandesh, Roberto Perez Alcolea, Sean, Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.2 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.2 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

Commits

• 8de7bcf Speed up the AllVersionsCrossVersion flaky quarantine (#39494)
• 66805db Run all cross-version targets in flaky quarantine
• cdd4c8f Skip empty test tasks in the flaky test quarantine
• 6badb77 Split the AllVersionsCrossVersion quarantine across agents
• 1655e44 Prepare for 9.8.2 (#39492)
• 6702214 Prepare for 9.8.2
• 688c0c1 Fix false warning about unstable graph (#39479)
• 3601d4f Clarify selector reuse comments in SelectorState
• 6e836fd Fix false warning about unstable graph
• a0790e5 Fix hidden artifact cleanup pattern in CheckProject (#39451)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions