[renovate-bot]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
actions/setup-java	action	minor	v6.0.1 → v6.1.0
apache/kafka		minor	4.2.0-rc2 → 4.4.0-rc2
gradle (source)		minor	9.7.1 → 9.8.2
gradle/actions	action	patch	v6.4.0 → v6.4.1
gradle/actions	action	minor	v6.3.0 → v6.4.1
localstack/localstack		minor	2.1 → 2.3
mariadb (source)		minor	12.2 → 12.3
postgres (source)	service	minor	18.3 → 18.6
tomcat (source)		patch	10.1.59-jdk25-temurin → 10.1.61-jdk25-temurin
zizmorcore/zizmor-action	action	minor	v0.7.1 → v0.8.0
at.yawk.lz4:lz4-java	devDependencies	minor	1.11.4 → 1.12.1
io.netty:netty-transport-native-unix-common (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-transport-classes-epoll (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-transport (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-resolver (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-handler-proxy (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-handler (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-codec-socks (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-codec-protobuf (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-codec-marshalling (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-codec-http2 (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-codec-http (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-codec-compression (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-codec-base (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-codec (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-common (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-buffer (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
com.nimbusds:nimbus-jose-jwt	devDependencies	minor	10.9 → 10.10
org.apache.commons:commons-lang3 (source)	devDependencies	minor	3.20.0 → 3.21.0
io.cucumber:cucumber-spring (source)	devDependencies	patch	7.34.3 → 7.34.9
io.cucumber:cucumber-junit-platform-engine (source)	devDependencies	patch	7.34.3 → 7.34.9
io.cucumber:cucumber-java8 (source)	devDependencies	patch	7.34.3 → 7.34.9
io.cucumber:cucumber-java (source)	devDependencies	patch	7.34.3 → 7.34.9
org.apache.sshd:sshd-core (source)	devDependencies	minor	2.17.1 → 2.20.1
org.apache.sshd:sshd-common (source)	devDependencies	minor	2.17.1 → 2.20.1
com.tngtech.archunit:archunit	devDependencies	minor	1.4.2 → 1.5.1
org.postgresql:postgresql (source)	devDependencies	patch	42.7.13 → 42.7.14
org.mariadb.jdbc:mariadb-java-client (source)	devDependencies	patch	3.5.10 → 3.5.11
org.apache.avro:avro (source)	devDependencies	patch	1.12.1 → 1.12.2
io.rest-assured:xml-path (source)	devDependencies	minor	6.0.1 → 6.3.0
io.rest-assured:json-path (source)	devDependencies	minor	6.0.1 → 6.3.0
io.rest-assured:rest-assured (source)	devDependencies	minor	6.0.1 → 6.3.0
org.hibernate.validator:hibernate-validator (source)	devDependencies	patch	9.1.3.Final → 9.1.5.Final
io.swagger.core.v3:swagger-core-jakarta	devDependencies	patch	2.2.49 → 2.2.55
io.swagger.core.v3:swagger-jaxrs2-jakarta	devDependencies	patch	2.2.49 → 2.2.55
io.swagger.core.v3:swagger-annotations-jakarta	devDependencies	patch	2.2.49 → 2.2.55
org.apache.activemq:activemq-client (source)	devDependencies	minor	6.2.5 → 6.4.0
org.springdoc:springdoc-openapi-starter-webmvc-ui (source)	devDependencies	minor	3.0.3 → 3.2.0
org.apache.maven:maven-artifact (source)	devDependencies	minor	3.9.16 → 3.10.0
org.eclipse.jgit:org.eclipse.jgit	devDependencies	minor	7.6.0.202603022253-r → 7.8.0.202609011348-r
org.bouncycastle:bcutil-jdk18on (source)	devDependencies	minor	1.84 → 1.86
org.bouncycastle:bcprov-jdk18on (source)	devDependencies	minor	1.84 → 1.86
org.bouncycastle:bcpkix-jdk18on (source)	devDependencies	minor	1.84 → 1.86
org.projectlombok:lombok (source)	devDependencies	patch	1.18.46 → 1.18.48
commons-codec:commons-codec (source)	devDependencies	minor	1.22.0 → 1.23.0
org.mock-server:mockserver-junit-jupiter (source)	devDependencies	minor	5.14.0 → 5.15.0
com.github.spotbugs:spotbugs-annotations (source)	devDependencies	minor	4.9.8 → 4.10.5
io.github.classgraph:classgraph	devDependencies	patch	4.8.184 → 4.8.199
joda-time:joda-time (source)	devDependencies	minor	2.14.2 → 2.15.1
org.cyclonedx.bom	plugin	minor	3.4.1 → 3.5.1
me.champeau.jmh	plugin	patch	0.7.3 → 0.7.4
com.gradleup.shadow	plugin	minor	9.4.1 → 9.6.1
org.openapi.generator	plugin	minor	7.22.0 → 7.26.0
com.github.spotbugs	plugin	patch	6.5.4 → 6.5.13
com.github.andygoossens.modernizer	plugin	minor	1.13.0 → 1.15.0
io.swagger.core.v3.swagger-gradle-plugin	plugin	patch	2.2.49 → 2.2.55
org.springframework.boot (source)	plugin	patch	4.1.1 → 4.1.2
org.zeroturnaround.gradle.jrebel	plugin	patch	1.2.2 → 1.2.3
org.nosphere.apache.rat	plugin	minor	0.8.1 → 0.11.0
com.diffplug.spotless	plugin	patch	8.10.2 → 8.10.4
org.apache.tika:tika-core (source)	devDependencies	patch	3.3.0 → 3.3.3
org.barfuin.gradle.taskinfo	plugin	minor	3.0.2 → 3.1.0
com.github.librepdf:openpdf	devDependencies	patch	3.0.4 → 3.0.5
software.amazon.msk:aws-msk-iam-auth (source)	devDependencies	patch	2.3.6 → 2.3.9
org.apache.commons:commons-collections4 (source)	devDependencies	minor	4.5.0 → 4.6.0
com.google.googlejavaformat:google-java-format	devDependencies	minor	1.35.0 → 1.37.0
com.google.code.gson:gson	devDependencies	minor	2.14.0 → 2.15.0
com.google.guava:guava	devDependencies	minor	33.6.0-jre → 33.7.2-jre
ch.qos.logback:logback-classic (source, changelog)	devDependencies	minor	1.5.38 → 1.6.6
ch.qos.logback:logback-core (source, changelog)	devDependencies	minor	1.5.38 → 1.6.6
org.springframework.modulith:spring-modulith-bom (source)	devDependencies	patch	2.1.1 → 2.1.2
org.glassfish.jersey:jersey-bom (source)	devDependencies	patch	4.0.2 → 4.0.3
software.amazon.awssdk:bom	devDependencies	minor	2.44.4 → 2.57.7
org.mockito:mockito-bom	devDependencies	minor	5.23.0 → 5.24.0
io.cucumber:cucumber-bom (source)	devDependencies	patch	7.34.3 → 7.34.9
com.fasterxml.jackson:jackson-bom	devDependencies	patch	2.22.3 → 2.22.4
org.junit:junit-bom (source)	devDependencies	minor	6.0.3 → 6.1.3
org.jetbrains.kotlin:kotlin-bom (source)	devDependencies	minor	2.3.21 → 2.4.21
io.opentelemetry:opentelemetry-bom	devDependencies	minor	1.62.0 → 1.67.0
io.awspring.cloud:spring-cloud-aws-dependencies (source)	devDependencies	minor	4.0.2 → 4.2.1
org.springframework.boot:spring-boot-dependencies (source)	devDependencies	patch	4.1.1 → 4.1.2
io.micrometer:micrometer-bom	devDependencies	minor	1.16.5 → 1.17.2
org.slf4j:slf4j-bom (source, changelog)	devDependencies	patch	2.0.17 → 2.0.20
com.squareup.okhttp3:okhttp-bom (source)	devDependencies	patch	5.5.0 → 5.5.1
io.qameta.allure	plugin	minor	4.1.0 → 4.3.0

---

Release Notes

actions/setup-java

v6.1.0

Compare Source

What's Changed

• Preserve compound Liberica build versions from .sdkmanrc by @​brunoborges with @​Copilot in #​1268
• Support Temurin on Linux RISC-V by @​yawkat in #​1269
• Stop GPG agent before removing signature-verification home by @​brunoborges with @​Copilot in #​1273
• Prefer Zulu 4-segment hotfix builds when resolving version ranges by @​brunoborges in #​1278
• Support Temurin JEP 322 patch versions like 26.0.2.1+1 by @​brunoborges in #​1279
• chore(deps): bump undici from 6.28.0 to 6.29.0 by @​dependabot[bot] in #​1274
• chore(deps): bump the monthly-npm-updates group with 13 updates by @​dependabot[bot] in #​1276
• feat: support Maven server credential origins by @​YunaBraska in #​1282
• Support Maven plugin repositories in generated settings.xml by @​brunoborges in #​1286

New Contributors

• @​yawkat made their first contribution in #​1269
• @​YunaBraska made their first contribution in #​1282

Full Changelog: actions/setup-java@v6.0.1...v6.1.0

apache/kafka

v4.4.0

Compare Source

v4.3.1

Compare Source

v4.3.0

Compare Source

gradle/gradle (gradle)

v9.8.2: 9.8.2

Compare Source

The Gradle team is excited to announce Gradle 9.8.2.

Here are the highlights of this release:

• Java 27 support
• Maven mirror settings reuse
• Linked problem locations in build output

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
Aman Gautam,
Björn Kautler,
Eng Zer Jun,
Hashim Khan,
Julian Krannich,
KBS,
Labh R Jethe,
Mark Dodgson,
Maxim,
monkey,
nataphon-ktsystems,
Paul King,
Qiu Tian,
rg_sandesh,
Roberto Perez Alcolea,
Sean,
Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.2 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.2 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

v9.8.1: 9.8.1

Compare Source

This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.

This release addresses three high rated vulnerabilities:

• Unauthenticated worker-to-daemon channel deserializes untrusted Java objects
• Deserialization of untrusted Java objects before authentication in the client - daemon communication
• Failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts

The following issues were resolved:

• [Gradle 9.8.0 complains again about invalid Toolchains on Debian / Ubuntu packaged systems]- (#​39358)
• Gradle 9.8.0 removes root java.util.logging handlers installed by a custom LogManager (breaks Quarkus test log capture)
• Dependency resolution regression

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
Aman Gautam,
Björn Kautler,
Eng Zer Jun,
Hashim Khan,
Julian Krannich,
KBS,
Labh R Jethe,
Mark Dodgson,
Maxim,
monkey,
nataphon-ktsystems,
Paul King,
Qiu Tian,
rg_sandesh,
Roberto Perez Alcolea,
Sean,
Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

v9.8.0: 9.8.0

Compare Source

The Gradle team is excited to announce Gradle 9.8.0.

Here are the highlights of this release:

• Java 27 support
• Maven mirror settings reuse
• Linked problem locations in build output

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
Aman Gautam,
Björn Kautler,
Eng Zer Jun,
Hashim Khan,
Julian Krannich,
KBS,
Labh R Jethe,
Mark Dodgson,
Maxim,
monkey,
nataphon-ktsystems,
Paul King,
Qiu Tian,
rg_sandesh,
Roberto Perez Alcolea,
Sean,
Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.0 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.0 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

gradle/actions

v6.4.1

Compare Source

Security fix

This release fixes a security vulnerability in the dependency-submission action: GHSA-chpw-2mqm-95cc. All users should upgrade.

What's Changed

• Combined dependency updates by @​bigdaz in #​1105
• Update to latest Dependency Graph plugin by @​bigdaz in #​1106

Full Changelog: gradle/actions@v6.4.0...v6.4.1

zizmorcore/zizmor-action

v0.8.0

Compare Source

The action now supports prereleases.

The default has not changed, but you can pass a prerelease version
of zizmor or version: prerelease to get whatever latest
prerelease the action knows about.

What's Changed

• Support prereleases by @​woodruffw in #​182
• Sync zizmor versions by @​github-actions[bot] in #​184

Full Changelog: zizmorcore/zizmor-action@v0.7.1...v0.8.0

yawkat/lz4-java (at.yawk.lz4:lz4-java)

v1.12.1: lz4-java v1.12.1

Security release for GHSA-48mj-8f7c-7qfm.

What's Changed

• Update dependency me.qoomon:maven-git-versioning-extension to v9.12.3 by @​renovate[bot] in #​152
• Update dependency maven to v3.10.0 by @​renovate[bot] in #​153
• Update github/codeql-action action to v4.38.3 by @​renovate[bot] in #​156
• Update dependency org.sonatype.central:central-publishing-maven-plugin to v0.12.0 by @​renovate[bot] in #​159
• Update ossf/scorecard-action action to v2.5.0 by @​renovate[bot] in #​158
• Update astral-sh/setup-uv action to v10.3.0 by @​renovate[bot] in #​157
• Update actions/upload-artifact digest to cf430e0 by @​renovate[bot] in #​155
• Update actions/setup-java action to v6 by @​renovate[bot] in #​87
• Update actions/download-artifact digest to 9000827 by @​renovate[bot] in #​154
• Throw LZ4Exception for input shorter than the length prefix by @​yawkat in #​160
• Bound the compressed length of oversized LZ4 blocks by @​yawkat in #​162
• Update github/codeql-action action to v4.39.0 by @​renovate[bot] in #​163
• Use the buffer limit for the safe decompress(ByteBuffer, int, ByteBuffer, int) by @​yawkat in #​161
• Allocate stream block buffers only as block data arrives by @​yawkat in #​167
• Update astral-sh/setup-uv action to v10.3.1 by @​renovate[bot] in #​166
• Update github/codeql-action action to v4.39.1 by @​renovate[bot] in #​165
• Update dependency org.mvel:mvel2 to v2.6.0.Final by @​renovate[bot] in #​164

Full Changelog: yawkat/lz4-java@v1.12.0...v1.12.1

v1.12.0: lz4-java v1.12.0

Note that lz4-java v1.11.4, also released today, contains security fixes. This minor release contains some additional tightening of input validation that could in theory be breaking but should be fine for most if not all users. I recommend you upgrade to 1.12.0, but 1.11.4 is an option if that breaks.

What's Changed

• Render README tables on the website by @​yawkat in #​150
• Throw IOException for invalid or unsupported frame descriptors by @​yawkat in #​133
• Replace Codecov with a coverage badge from the documentation site by @​yawkat in #​151
• Reject short output in LZ4DecompressorWithLength safe paths by @​yawkat in #​126
• Make stream failures sticky in LZ4FrameInputStream and LZ4BlockInputStream by @​yawkat in #​145

Full Changelog: yawkat/lz4-java@v1.11.4...v1.12.0

connect2id/nimbus-jose-jwt (com.nimbusds:nimbus-jose-jwt)

v10.10

Compare Source

[v10.9.1](https://bitbucket.org/con

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[galovics]

Mostly mechanical, but a few bumps I'd like a second look at before this goes in:

• apache/kafka:4.4.0-rc2 in docker-compose-postgresql-kafka.yml: why an -rc image, and a two-minor jump (4.2 to 4.4)? Can we pin a GA tag, or leave it out of this PR?
• netty 4.1.138 to 4.2.19 is a different Netty line even though it is labelled non-major. Which of Kafka, the AWS SDK, Tomcat or Jersey in our tree was built against 4.2? Did the integration and messaging suites run on this? (Also: 16 hand-pinned netty artifacts where netty-bom exists, a follow-up.)
• logback 1.5.38 to 1.6.5: compatible with our slf4j / Spring Boot versions, anything in the logback XML config deprecated in 1.6?
• localstack/localstack 2.1 to 2.3: do the S3/SQS behaviours our tests rely on stay the same?
• lz4-java substitution is pinned in two files, keep them in sync.

Let's hold for green CI.

[adamsaghy]

As part of the 1.16.0 release, all stories were closed, including FINERACT-2684. We won't accept any more PRs against them.

Please use the new "minor bugfixes" story, FINERACT-2968, instead: change the PR title and the commit message prefix from FINERACT-2684: to FINERACT-2968:.