build(deps): bump the dependencies group with 8 updates

[dependabot]

Bumps the dependencies group with 8 updates:

Package	From	To
org.junit:junit-bom	6.1.2	6.1.3
ch.qos.logback:logback-classic	1.6.1	1.6.2
org.conscrypt:conscrypt-openjdk-uber	2.6.1	2.6.2
com.puppycrawl.tools:checkstyle	13.9.0	13.10.0
io.github.classgraph:classgraph	4.8.186	4.8.192
software.amazon.awssdk:bom	2.51.2	2.53.0
io.opentelemetry:opentelemetry-bom	1.64.0	1.65.0
org.asynchttpclient:async-http-client	3.0.11	3.0.13

Updates org.junit:junit-bom from 6.1.2 to 6.1.3

Release notes

Sourced from org.junit:junit-bom's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

Commits

• f59f60d Release 6.1.3
• cd8ec92 Finalize 6.1.3 release notes
• c8729f2 Restore compatibility with GraalVM 25 (#5901)
• ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
• fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
• 62afc02 Delay GraalVM plugin updates for 3 days
• 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
• f6bbfc5 Move GraalVM tests to separate test task (#5903)
• e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
• 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
• Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.6.1 to 1.6.2

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

• Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

• Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

  <property name="logback.skipCallerContradictionAnalysis" value="true"/>

• SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

• Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

• Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

• Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits

• e3d7833 prepare release 1.6.2
• 919127d test for skipping contradiction analysis
• 67dcd40 allow skipping caller contradiction analysis
• 2619c6d remove unused message string in CallerContradictionWarnAnalyser
• 22cfade add support for SMTPAppender in caller data contradiction analysis
• 656fb6d minor javadoc change in SMTPAppenderBase
• efb1ce2 cover SocketAppender in caller contradiction analysis
• d3a01f8 more tests for caller contradiction analysis
• b1a80d6 more complete logic in caller contradiction analysis
• 0678954 SimpleSocketServer and SLLSimpleSocketServer now accept whitelisted
• Additional commits viewable in compare view

Updates org.conscrypt:conscrypt-openjdk-uber from 2.6.1 to 2.6.2

Release notes

Sourced from org.conscrypt:conscrypt-openjdk-uber's releases.

v2.6.2

• Fixes google/conscrypt#1526
• Fixes robolectric/robolectric#11362

Commits

• 657e1c6 Use an Ubuntu 20.04 container to build Concrypt on GitHub CI, and make Make a...
• 44a3630 Close contexts after each test in SSLEngineVersionCompatibilityTest. (#1524)
• See full diff in compare view

Updates com.puppycrawl.tools:checkstyle from 13.9.0 to 13.10.0

Release notes

Sourced from com.puppycrawl.tools:checkstyle's releases.

checkstyle-13.10.0

Checkstyle 13.10.0 - https://checkstyle.org/releasenotes.html#Release_13.10.0

Breaking backward compatibility:

#5744 - JavadocVariable MissingJavadocMethod MissingJavadocType: Expand Javadoc violation messages to include named context.

New:

#21071 - WriteTag: new messages when violation is on method. #19991 - NonEmptyAtclauseDescription should to validate since tags. #17841 - New Check: GoogleMethodName to fix false-negative on method names with underscores. #21079 - New Check: IllegalBlockTag. #20987 - New check: JavadocRegexp. #18064 - New check: ArrayBracketWhitespace. #18420 - New Check: GoogleMethodNameCheck to enforce Google Java Style Guide method naming.

Bug fixes:

#20995 - Add MultilineCommentLeadingAsteriskPresence check to google_checks.xml. #3469 - JavadocMethod: check for duplicate parameter block tags. #20972 - Javadoc parse error on HTML comment with a line ending in a hyphen. #19931 - Documentation Comments Style Guide - Contents of package.html source file. #18842 - google_checks.xml incorrectly marks return inlined tag as violation from SummaryJavadoc. #19925 - Documentation Comments Style Guide - Custom Tags and Annotations. #19919 - Documentation Comments Style Guide - @param. #19808 - Add checks for Documentation Comments Style Guide - Notes.

... (truncated)

Commits

• a9eec04 [maven-release-plugin] prepare release checkstyle-13.10.0
• 1b9b260 doc: release notes for 13.10.0
• dfa2dc8 Issue #20514: Code changes for enabling toc in website
• 1d9666f Issue #20514: Added xml and xml template toc changes
• b709107 Issue #17841: Add GoogleMethodName to google_checks
• ec37719 Issue #21119: Fix duplicate violation behavior in examples: methodname
• 13f477f minor: Update expected size in XmlMetaReaderTest
• 2c40ae6 Issue #20995: Add MultilineCommentLeadingAsteriskPresence to google_checks
• 913f6cf Issue #21119: Fix duplicate violation behavior in examples: typename
• 91a7bf2 Issue #21079: New Check IllegalBlockTag
• Additional commits viewable in compare view

Updates io.github.classgraph:classgraph from 4.8.186 to 4.8.192

Release notes

Sourced from io.github.classgraph:classgraph's releases.

ClassGraph 4.8.192

ClassGraph 5.0.0 is coming shortly, and requires JDK 17 or newer. 4.8.192 is a bugfix release on the 4.x maintenance branch, and continues the file-by-file audit of the codebase that produced 4.8.190 and 4.8.191. As before, the bugs listed here were found by Claude through careful code analysis, and were fixed on the v5 branch and backported to v4.

Bug fixes: zipfile reading

• A zip entry name was decoded as UTF-8 whether or not the entry said it was UTF-8. The zip specification says a name is encoded in IBM Code Page 437 unless bit 11 of the entry's general purpose bit flag is set, and Windows Explorer and Info-ZIP are among the tools that follow it. So the name of an entry written by one of those tools came out as garbage as soon as it contained a byte outside ASCII, and the class or resource could not be found under the name it was stored with. The flag is now read before the name, and the name decoded as CP437 or UTF-8 accordingly. Malformed UTF-8 no longer throws either: an undecodable byte is replaced rather than the whole entry being lost, which is what java.util.zip does.

Bug fixes: resources

• Resource#read() returned a buffer covering the entire jarfile rather than the entry, when memory mapping was in use. The buffer's position was the entry's offset, so a sequential read returned the right bytes, but capacity() was the size of the whole jarfile, an absolute read such as get(0) read from the start of the jarfile, and clear() widened the buffer back out over the zip headers and every other entry. The mapping is now narrowed to the entry, so the buffer starts at position zero and cannot be widened again.

• A module resource's content was aliased rather than copied. The buffer belongs to the ModuleReader, which reclaims it when the resource is closed, so the content could change underneath a caller that kept the buffer.

Bug fixes: classpath order

• A classpath element named from more than one place got a single position, when it does not have one. The index of a classpath element within the Class-Path manifest entry (or lib directory) of the element that named it was stored on the child element rather than on the edge from the parent, and merged to the smallest index across every reference to that child. The same jarfile can be named by the Class-Path entries of two different jarfiles at a different position within each of them, so there is no one position it occupies.

  Two consequences, both of which decide which of two copies of a class masks the other: an element that was also listed on the top-level classpath sorted ahead of all of its parent's other entries, and an element named by two parents took the lower of its two indices under both, so it could tie with a sibling and fall back on whichever order the parallel scan tasks happened to finish in. Fixes #810.

ClassGraph 4.8.191

ClassGraph 5.0.0 is coming shortly, and requires JDK 17 or newer. 4.8.191 is a bugfix release on the 4.x maintenance branch, and continues the file-by-file audit of the codebase that produced 4.8.190. As before, the bugs listed here were found by Claude through careful code analysis, and were fixed on the v5 branch and backported to v4.

Spring Boot 3.2 and later

• A Spring Boot 3.2+ or 4.x executable jar is now scanned. Since 3.2, the Spring Boot launcher addresses an entry inside an executable jar or war using its own nested: URL protocol, which separates the path of the outer archive from the name of the entry within it with /! rather than the standard !/ — for example jar:nested:/path/to/app.jar/!BOOT-INF/lib/dependency.jar!/. Those are the URLs its classloader hands out, so ClassGraph resolved every one of them as a relative file path and found nothing at all: a scan of a Spring Boot 3.2+ executable jar returned zero classes. Such URLs are now converted to the equivalent jar: URL, and a classpath string containing one is no longer split at the nested: scheme's colon.

Behavior changes

• The classpath order no longer depends on the order a filesystem happens to return directory entries in. The jars of an automatic lib directory of a directory classpath element (lib/, BOOT-INF/lib/, WEB-INF/lib/ and the rest) and the JRE's own lib and ext jars are now sorted by filename, so the same JRE and the same application produce the same classpath order on every machine, and which of two jars containing the same class masks the other no longer varies from run to run. Each lib directory is sorted on its own, so the order of the lib directory prefixes still decides which one's jars come first. A dir/* wildcard classpath entry is deliberately left unsorted, because that reproduces the java launcher's own expansion order.

• ScanResult#getPackageInfo() and #getModuleInfo() return sorted lists. They previously returned hashmap iteration order, which varies between runs.

Bug fixes: zipfile reading

• Every zipfile larger than 4 GB was misread. The Zip64 extended information extra field was read as though all of its values are always present, when in fact it carries only the values that overflowed their 32-bit fields, in a fixed order. The fields present are now determined by which of the 32-bit values are set to the overflow marker.

• A zipfile whose comment is longer than 65514 bytes could not be opened. The search for the end-of-central-directory record stopped short of the largest comment the format permits.

• A zip entry whose compressed size runs past the end of the archive threw IllegalArgumentException out of the zipfile reader, rather than being reported as the malformed archive it is. An entry whose Zip64 compressed size overflowed a 64-bit addition was silently read past its end. Both now throw IOException.

• A central directory record declaring an extra field area that extends past the end of the central directory made the whole zipfile unopenable. An empty Info-ZIP Unicode path extra field also made ClassGraph read one byte outside the field. Records are now read strictly within their own bounds.

• A zip entry's Unix timestamp extra field was read as an 8-byte time rather than the 4-byte time the format specifies, so entries written by zip(1), Info-ZIP or Gradle silently fell back to their coarse local-time MS-DOS timestamps.

• A stream that returned zero from two consecutive reads made ClassGraph read a jarfile as empty. A zero-length read is not end of stream.

• A classfile attribute close to 2 GB wrapped the read position negative in ClassfileReader.skip(int).

• The log message "Skipping zip entry with invalid extra field size" claimed an entry was skipped when it was still read.

... (truncated)

Commits

• 1014e87 [maven-release-plugin] prepare release classgraph-4.8.192
• a10fafe Order child classpath elements by their position within each parent
• b804842 Return a buffer that covers only the requested resource
• c7d5192 Decode zip entry names as CP437 unless the entry says they are UTF-8
• 71fe4d9 [maven-release-plugin] prepare for next development iteration
• ac292fd [maven-release-plugin] prepare release classgraph-4.8.191
• 7493141 Fix a JRE lib jar sorting test that assumed a canonical temp directory
• 4a56491 Scan Spring Boot executable jars addressed by "nested:" URLs
• db01c87 Sort directory listings that feed the classpath into a fixed order
• 7d8eb6d Decode characters outside the Basic Multilingual Plane in a URL path
• Additional commits viewable in compare view

Updates software.amazon.awssdk:bom from 2.51.2 to 2.53.0

Updates io.opentelemetry:opentelemetry-bom from 1.64.0 to 1.65.0

Release notes

Sourced from io.opentelemetry:opentelemetry-bom's releases.

Version 1.65.0

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector exporter.

API

• Ignore empty baggage keys in ImmutableBaggage.put (#8658)
• Use NumberFormatException in baggage decoder (#8593)
• Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice (#8613)

Incubating

• Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram, BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge, BoundDoubleGauge) to the incubator metrics API (#8527)

Extensions

• Trace propagators: Fix JaegerPropagator baggage header key case sensitivity (#8496)
• Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
• Trace propagators: Skip empty baggage keys in OtTracePropagator extract (#8631)
• Trace propagators: Stop parsing a jaeger-baggage header after 64 tokens, including malformed tokens (#8702)

SDK

• Update SDK attributes implementation (AttributesMap) to enforce last-value-win semantics based on string value of AttributeKey.getKey() (#8548)

Traces

• Add Sampler shutdown lifecycle: Sampler now extends Closeable and exposes a default shutdown() invoked when the SdkTracerProvider is shut down; JaegerRemoteSampler implements it to stop its polling executor (#8574)

Metrics

• Gate PeriodicMetricReader self-observability metrics by internal telemetry version (#8597)
• Record error.type on failed collections in PeriodicMetricReader (#8650)
• Testing: Fix LongExemplarAssert.hasFilteredAttributesSatisfyingExactly to enforce exact attribute matching (#8518)

Logs

• Fix ReadWriteLogRecord default getObservedTimestampEpochNanos returning the record timestamp (#8504)

Profiles

• Fix profiles data model attribute count parameter name and timestamp doc unit (#8514)

Exporters

• WARNING Zipkin: Delete opentelemetry-exporter-zipkin; the artifact is no longer published (#8677)
• OTLP: Use HTTP error response bodies in HttpExporter warning logs (#8428)
• OTLP: Fix OkHttpHttpSender mTLS when using the platform default trust store (#8565)
• OTLP: Fix sign extension on LogRecord flags in the low-allocation log marshaler (#8493)
• OTLP: Standardize OkHttpHttpSender, JdkHttpSender, and UpstreamGrpcSender shutdown to await executor/channel termination (#8495, #8627, #8624)
• OTLP: Log the underlying except/ion when a gRPC response frame is invalid (#8626)

... (truncated)

Changelog

Sourced from io.opentelemetry:opentelemetry-bom's changelog.

Version 1.65.0 (2026-08-07)

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector exporter.

API

• Ignore empty baggage keys in ImmutableBaggage.put (#8658)
• Use NumberFormatException in baggage decoder (#8593)
• Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice (#8613)

Incubating

• Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram, BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge, BoundDoubleGauge) to the incubator metrics API (#8527)

Extensions

• Trace propagators: Fix JaegerPropagator baggage header key case sensitivity (#8496)
• Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
• Trace propagators: Skip empty baggage keys in OtTracePropagator extract (#8631)
• Trace propagators: Stop parsing a jaeger-baggage header after 64 tokens, including malformed tokens (#8702)

SDK

• Update SDK attributes implementation (AttributesMap) to enforce last-value-win semantics based on string value of AttributeKey.getKey() (#8548)

Traces

• Add Sampler shutdown lifecycle: Sampler now extends Closeable and exposes a default shutdown() invoked when the SdkTracerProvider is shut down; JaegerRemoteSampler implements it to stop its polling executor (#8574)

Metrics

• Gate PeriodicMetricReader self-observability metrics by internal telemetry version (#8597)

... (truncated)

Commits

• 7bc11ed [release/v1.65.x] Prepare release 1.65.0 (#8705)
• 60d7ecf Prepare 1.65.0 (#8700)
• 6d41aa4 Bound jaeger-baggage parsing work by tokens rather than accepted entries (#8702)
• db1d6be Enforce last-value-wins semantics in AttributesMap without performance regres...
• 995cb3c Avoid unsafe string encoder on Android (#8637)
• 48b0185 Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
• 2009d58 Avoid exposing configuration values in errors (#8669)
• 3cafbbb Deprecate OpenCensus shim public API (#8674)
• 0e033e2 Remove stray token from addLogRecordProcessorCustomizer Javadoc (#8641)
• 3d1cce8 Fix ObfuscatedLoggerProvider Javadoc copy-paste example (#8639)
• Additional commits viewable in compare view

Updates org.asynchttpclient:async-http-client from 3.0.11 to 3.0.13

Release notes

Sourced from org.asynchttpclient:async-http-client's releases.

AHC v3.0.13 Release

Security

• GHSA-rqf5-2wxv-rjf4 - Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
• GHSA-jmqq-x5g9-9p2w - Replay to a different host sends the original host's request and credentials to the new host
• GHSA-vvp4-63h8-v5pm - Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
• GHSA-f9m8-cv68-674w - Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
• GHSA-qhv6-3pmh-95q4 - Digest mutual authentication is switched off by a peer offering qop=auth-int

Behaviour changes

• A Digest challenge carrying no nonce now selects Digest rather than Basic. Such an exchange previously appeared to work because the client answered in Basic, and it will now fail. It was sending the password in the clear.
• A server offering qop="auth-int" and nothing else now falls back to the qop-less digest of RFC 2069, which has weaker replay protection. The client logs a warning when this happens.
• Realm.Builder.matchParam keeps a backslash that precedes any character other than a quote or another backslash. This repairs a 3.0.12 regression that corrupted DOMAIN\Users to DOMAINUsers and broke Digest against those realms.
• NTLM and Negotiate connections are pooled per principal, so an application authenticating as several identities against one host holds more connections than before.
• A cookie whose Domain names a public suffix is refused. A host whose own name is a public suffix, such as the short names Docker Compose and Kubernetes hand out, can still set a cookie for itself.

Known issues

• Over HTTP/2, an intercepted 401 or a redirect completes the caller's future exceptionally even though the exchange succeeds on the wire. Use HTTP/1.1 where authentication or redirects are involved.

AHC v3.0.12 Release

What's Changed

• Release v3.0.11 by @​hyperxpro in AsyncHttpClient/async-http-client#2198
• Reduce per-request allocation in ThreadSafeCookieStore.get() by @​hyperxpro in AsyncHttpClient/async-http-client#2201
• escape quote and crlf in multipart content-disposition values by @​jmestwa-coder in AsyncHttpClient/async-http-client#2203
• Avoid Uri reallocation in UriEncoder.encode() on the no-op path by @​hyperxpro in AsyncHttpClient/async-http-client#2204
• Reuse a per-thread UriParser scratch to avoid per-parse allocation by @​hyperxpro in AsyncHttpClient/async-http-client#2205
• Intern known request header names to static AsciiString by @​hyperxpro in AsyncHttpClient/async-http-client#2206
• Match HTTP/2 content-encoding with AsciiString constants instead of toLowerCase by @​hyperxpro in AsyncHttpClient/async-http-client#2207
• Improve CI Release Workflow by @​hyperxpro in AsyncHttpClient/async-http-client#2208
• Fall back to NIO instead of throwing when no native transport is available by @​hyperxpro in AsyncHttpClient/async-http-client#2209
• fail websocket handshake on invalid sec-websocket-accept by @​jmestwa-coder in AsyncHttpClient/async-http-client#2211
• Localize tests that depended on public endpoints by @​hyperxpro in AsyncHttpClient/async-http-client#2215
• [Performance] Raise default HTTP/2 initial window size to 16 MiB by @​hyperxpro in AsyncHttpClient/async-http-client#2213
• Add LoadBalance.ROUND_ROBIN for per-request IP round-robin by @​pavel-ptashyts in AsyncHttpClient/async-http-client#2202
• Bump the dependencies group with 5 updates by @​dependabot[bot] in AsyncHttpClient/async-http-client#2222
• Bump actions/checkout from 6 to 7 in the actions group by @​dependabot[bot] in AsyncHttpClient/async-http-client#2223
• use SecureRandom for digest auth cnonce by @​jmestwa-coder in AsyncHttpClient/async-http-client#2220
• skip origin Authorization on CONNECT proxy request by @​madib06ops in AsyncHttpClient/async-http-client#2234
• escape quoted-string params in Digest Authorization header by @​madib06ops in AsyncHttpClient/async-http-client#2236
• stop config realm leaking to a cross-origin redirect target by @​jmestwa-coder in AsyncHttpClient/async-http-client#2224
• fail SCRAM exchange on invalid ServerSignature by @​madib06ops in AsyncHttpClient/async-http-client#2235
• normalize the scheme case in the Uri constructor by @​madib06ops in AsyncHttpClient/async-http-client#2239
• Fix LICENSE file for Apache 2.0 by @​hyperxpro in AsyncHttpClient/async-http-client#2242
• Enable HTTPS endpoint identification in JsseSslEngineFactory by @​hyperxpro in AsyncHttpClient/async-http-client#2243
• Reject CR/LF in raw multipart part-header fields by @​hyperxpro in AsyncHttpClient/async-http-client#2244
• Read InputStream bodies straight into the buffer, no staging array by @​pavel-ptashyts in AsyncHttpClient/async-http-client#2233
• Bind origin Kerberos/SPNEGO token to the origin service, not the proxy by @​hyperxpro in AsyncHttpClient/async-http-client#2245
• Avoid per-connect lock on shared Bootstrap options map (#2218) by @​pavel-ptashyts in AsyncHttpClient/async-http-client#2219

... (truncated)

Commits

• 35ad15f [maven-release-plugin] prepare release async-http-client-project-3.0.13
• 83e552e Keep a connection authenticated by one principal away from another
• 3302678 Refuse a cookie whose Domain names a public suffix
• c363701 Warn when an auth-int-only challenge forces the RFC 2069 fallback
• a542249 Stop negotiating a qop whose mutual authentication cannot be verified
• 15b2545 Move the target, the proxy and the pool key together when a request is replayed
• c0fd24e Disable autoPublish
• 8376866 Fail a Digest challenge with no usable nonce instead of downgrading to Basic
• fc6c9b7 [maven-release-plugin] prepare for next development iteration
• c07038b [maven-release-plugin] prepare release async-http-client-project-3.0.12
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions