Skip to content

Bump the dependencies group across 1 directory with 8 updates - #210

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/dependencies-a0d4fb24f4
Closed

Bump the dependencies group across 1 directory with 8 updates#210
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/dependencies-a0d4fb24f4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 8 updates in the / directory:

Package From To
de.fraunhofer.iosb.ilt:Configurable 0.37 0.38
ch.qos.logback:logback-classic 1.5.38 1.6.3
org.apache.commons:commons-collections4 4.5.0 4.6.0
org.geotools:gt-epsg-hsql 35.0 35.1
org.geotools:gt-referencing 35.0 35.1
org.apache.maven.plugins:maven-compiler-plugin 3.15.0 3.16.0
com.diffplug.spotless:spotless-maven-plugin 3.8.0 3.10.1
io.github.git-commit-id:git-commit-id-maven-plugin 10.0.0 10.0.1

Updates de.fraunhofer.iosb.ilt:Configurable from 0.37 to 0.38

Changelog

Sourced from de.fraunhofer.iosb.ilt:Configurable's changelog.

Version 0.38

Updates

  • [FX] Hide options dropdown in map (class) editor when its empty.
  • Updated dependencies.
Commits
  • fd42353 Release v0.38
  • 1f4410d [FX] Hide options dropdown in map (class) editor when its empty
  • 5edf948 Bump the dependencies group across 1 directory with 7 updates (#178)
  • e54d5f6 Bump the dependencies group across 1 directory with 2 updates (#173)
  • 0b1d067 Bump the dependencies group with 2 updates (#165)
  • 5e3654a Bump the dependencies group across 1 directory with 7 updates (#170)
  • 26df65e Bump the dependencies group across 1 directory with 2 updates (#164)
  • 5d7485b Bumped dependencies
  • af77ab1 Prepare for next development iteration
  • See full diff in compare view

Updates ch.qos.logback:logback-classic from 1.5.38 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

  • In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

  • Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

  • The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

  • ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

  • Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

  • The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

-- Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

  • Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

  • Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

    <property name="logback.skipCallerContradictionAnalysis" value="true"/>

  • SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

  • Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

  • Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

  • Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

... (truncated)

Commits
  • e8e824d prepare release 1.6.3
  • 761821b MDCBasedDiscriminator has a gated warning mechanism
  • 53ed122 update copyright year
  • c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
  • b5aa931 added BatchedSimpleInvocationGate
  • 1f22af7 add javadocs to SimpleInvocationGate
  • 638ffa7 prevent forward and backward slashes to escape to other directories
  • 7d6b9a4 add missing ch.qos.logback.core.property package
  • fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
  • c73b43f deprecate the withJansi path
  • Additional commits viewable in compare view

Updates org.apache.commons:commons-collections4 from 4.5.0 to 4.6.0

Updates org.geotools:gt-epsg-hsql from 35.0 to 35.1

Updates org.geotools:gt-referencing from 35.0 to 35.1

Updates org.geotools:gt-referencing from 35.0 to 35.1

Updates org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0

Release notes

Sourced from org.apache.maven.plugins:maven-compiler-plugin's releases.

3.16.0

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

📦 Dependency updates

Commits
  • e7bba6e [maven-release-plugin] prepare release maven-compiler-plugin-3.16.0
  • c906809 Avoid using deprecated method CompilerConfiguration.setCompilerVersion
  • ad74fee Replace adopt-openj9 by semeru JDK distribution on GH
  • beb0eda Recompile when dependencies change (#1102)
  • a0b689e [MCOMPILER-578] Track outputs across compiler executions (#1091)
  • 2e81228 Fix incremental detection of empty sources, 3.x (#1075)
  • 2132f5b configure ATR project
  • 5992b77 Build fails when annotation processor list is empty (but present) (#1077)
  • acccef7 Bump plexusCompilerVersion from 2.16.2 to 2.17.0
  • 72bc445 Bump org.codehaus.plexus:plexus-java from 1.5.2 to 1.6.0
  • Additional commits viewable in compare view

Updates com.diffplug.spotless:spotless-maven-plugin from 3.8.0 to 3.10.1

Release notes

Sourced from com.diffplug.spotless:spotless-maven-plugin's releases.

Maven Plugin v3.10.1

Fixed

  • <prettier> and other npm-based steps no longer fail to start on npm 12 (EUNKNOWNCONFIG from --scripts-prepend-node-path). (#3024)

Maven Plugin v3.10.0

Added

  • New <shortenFullyQualifiedTypes> step for Java, which replaces fully-qualified type names with their simple names and adds the imports they need. Best combined with <importOrder> and <removeUnusedImports>. (#2945)
  • Add embedded lockfiles to Eclipse JDT for every supported version (4.9 through 4.40), so eclipse() resolves from Maven Central instead of querying a P2 update site. Versions without an embedded lockfile still fall back to P2 provisioning. (#1996)
  • Add support to apply alternate license header within same format (#872)
  • Add support to skip license header application based on source file content pattern (#650).

Fixed

  • removeUnusedImports no longer fails on Java import module declarations. (#2890)
  • Concurrent P2 provisioning no longer races Solstice's on-disk cache (affects Eclipse-based formatters under parallel builds). (#3004)

Changes

  • Default google-java-format remains 1.28.0 on JVM 17; bumps to 1.30.0 on JVM 21+; require at least 1.30.0 on JVM 25+ for import module support.
  • Bump default eclipse version to latest 4.39 -> 4.40. (#1996)
  • Document Maven skip properties spotless.skip, spotless.check.skip, and spotless.apply.skip. Goal-specific skips now live on their own mojos so they no longer leak across goals. (#3009)
  • Bump default adocfmt version 0.2.0 -> 0.3.1, which adds table formatting support (<formatTables>, <tableLayout>, <tableMaxLineWidth>, <tableBlankLines>).

Maven Plugin v3.9.0

Added

Changes

  • Replace RDF formatter library de.atextor:turtle-formatter (discontinued) with cool.rdf:cool-rdf-formatter (its new coordinates); the RDF/turtle formatter now requires Java 25+. (#2995)
  • Bump default greclipse version to latest 4.39 -> 4.40. (#2989)
  • Bump default tabletest-formatter version 1.1.1 -> 1.1.2.
Commits
  • 4ea1c6c Published maven/3.10.1
  • f2f2348 Published gradle/8.10.1
  • 4bc8980 Published lib/4.10.1
  • 6fedfd5 chore(deps): update plugin errorprone to v5.1.1 (#3035)
  • 5e10f0b chore(deps): update plugin errorprone to v5.1.1
  • 3aa82b5 fix: expand a directory passed to targetExclude into the files under it (#3032)
  • 68bddde shortenFullyQualifiedTypes: skip FQNs whose simple name clashes with types de...
  • 6f73ed3 fix(deps): update dependency org.codehaus.plexus:plexus-utils to v4.1.0 (#3030)
  • bdeafe7 docs: changelog entry for the targetExclude directory fix
  • 4187eb3 fix: expand a directory passed to targetExclude into the files under it
  • Additional commits viewable in compare view

Updates io.github.git-commit-id:git-commit-id-maven-plugin from 10.0.0 to 10.0.1

Release notes

Sourced from io.github.git-commit-id:git-commit-id-maven-plugin's releases.

Version 10.0.1 is finally there and includes various bug-fixes and improvements :-)

What's Changed

Dependencies used by the plugin

Github Action

Maven Plugins used by the plugin

Getting the latest release

The plugin is available from Maven Central (see here), so you don't have to configure any additional repositories to use this plugin. All you need to do is to configure it inside your project as dependency:

<dependency>
    <groupId>io.github.git-commit-id</groupId>
    <artifactId>git-commit-id-maven-plugin</artifactId>
    <version>10.0.1</version>
</dependency>

Getting the latest snapshot (build automatically)

If you can't wait for the next release, you can also get the latest snapshot version from sonatype, that is being deployed automatically by github actions:

<pluginRepositories>
    <pluginRepository>
        <id>sonatype-snapshots</id>
        <name>Sonatype Snapshots</name>
         <url>https://s01.oss.sonatype.org/content/repositories/snapshots/</url>
    </pluginRepository>
</pluginRepositories>

Even though the github actions will only deploy a new snapshot once all tests have finished, it is recommended to rely on the released and more stable version.

Known Issues / Limitations:

  • This plugin is unfortunately not working with Heroku which is due to the fact how Heroku works. In summary Heroku does not copy over the .git-repository but in order to determine the git properties this plugin relies on the fact that it has access to the git-repository. A somewhat workaround to get some information is outlined in ktoso/maven-git-commit-id-plugin#279
  • Using maven's plugin prefix resolution (e.g. mvn com.test.plugins:myPlugin:myMojo) might result in unresolved properties even with <injectAllReactorProjects>true</injectAllReactorProjects>. Please refer to git-commit-id/maven-git-commit-id-plugin#287 or git-commit-id/maven-git-commit-id-plugin#413 for details and potential workarounds

... (truncated)

Commits
  • 73542f2 Bump version: 10.0.0 → 10.0.1
  • 7e95a7e Revert "add tests for java 27"
  • dae217c add tests for java 27
  • dc5b90b run tests with the latest maven versions 3.9.9 -> 3.9.16; 4.0.0-rc-5 -> 4.0.0...
  • 28f14aa bump git-commit-id-plugin-core from 6.2.0 to 6.2.1 (refs https://github.com/g...
  • dcf31ab Merge pull request #934 from git-commit-id/dependabot/maven/org.apache.maven....
  • e4e48ba Merge pull request #933 from git-commit-id/dependabot/maven/org.jspecify-jspe...
  • ef3c336 Merge pull request #935 from git-commit-id/dependabot/github_actions/actions/...
  • eacd498 Merge pull request #930 from git-commit-id/dependabot/maven/org.sonatype.cent...
  • d892203 build(deps): bump actions/setup-java from 5 to 6
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the dependencies group across 1 directory with 8 updates
fbf2df3 
Bumps the dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [de.fraunhofer.iosb.ilt:Configurable](https://github.com/FraunhoferIOSB/Configurable) | `0.37` | `0.38` |
| [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.5.38` | `1.6.3` |
| org.apache.commons:commons-collections4 | `4.5.0` | `4.6.0` |
| org.geotools:gt-epsg-hsql | `35.0` | `35.1` |
| org.geotools:gt-referencing | `35.0` | `35.1` |
| [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) | `3.15.0` | `3.16.0` |
| [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) | `3.8.0` | `3.10.1` |
| [io.github.git-commit-id:git-commit-id-maven-plugin](https://github.com/git-commit-id/git-commit-id-maven-plugin) | `10.0.0` | `10.0.1` |



Updates `de.fraunhofer.iosb.ilt:Configurable` from 0.37 to 0.38
- [Changelog](https://github.com/FraunhoferIOSB/Configurable/blob/master/CHANGELOG.md)
- [Commits](FraunhoferIOSB/Configurable@v0.37...v0.38)

Updates `ch.qos.logback:logback-classic` from 1.5.38 to 1.6.3
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.5.38...v_1.6.3)

Updates `org.apache.commons:commons-collections4` from 4.5.0 to 4.6.0

Updates `org.geotools:gt-epsg-hsql` from 35.0 to 35.1

Updates `org.geotools:gt-referencing` from 35.0 to 35.1

Updates `org.geotools:gt-referencing` from 35.0 to 35.1

Updates `org.apache.maven.plugins:maven-compiler-plugin` from 3.15.0 to 3.16.0
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.15.0...maven-compiler-plugin-3.16.0)

Updates `com.diffplug.spotless:spotless-maven-plugin` from 3.8.0 to 3.10.1
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](diffplug/spotless@maven/3.8.0...maven/3.10.1)

Updates `io.github.git-commit-id:git-commit-id-maven-plugin` from 10.0.0 to 10.0.1
- [Release notes](https://github.com/git-commit-id/git-commit-id-maven-plugin/releases)
- [Commits](git-commit-id/git-commit-id-maven-plugin@v10.0.0...v10.0.1)

---
updated-dependencies:
- dependency-name: de.fraunhofer.iosb.ilt:Configurable
  dependency-version: '0.38'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: org.apache.commons:commons-collections4
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: org.geotools:gt-epsg-hsql
  dependency-version: '35.1'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: org.geotools:gt-referencing
  dependency-version: '35.1'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: org.geotools:gt-referencing
  dependency-version: '35.1'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-version: 3.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-version: 3.10.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.github.git-commit-id:git-commit-id-maven-plugin
  dependency-version: 10.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 7, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 10, 2026
@dependabot
dependabot Bot deleted the dependabot/maven/dependencies-a0d4fb24f4 branch September 10, 2026 12:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants