Bump the maven-dependencies group across 1 directory with 19 updates

[dependabot]

Bumps the maven-dependencies group with 19 updates in the / directory:

Package	From	To
org.junit:junit-bom	6.1.0	6.1.3
org.slf4j:slf4j-api	2.0.18	2.0.19
org.slf4j:slf4j-simple	2.0.18	2.0.19
ch.qos.logback:logback-classic	1.5.36	1.6.3
io.smallrye.config:smallrye-config	3.17.2	3.18.2
org.mongodb:mongodb-driver-sync	5.8.0	5.11.0
org.mongodb:mongodb-driver-legacy	5.8.0	5.11.0
org.zeroturnaround:zt-exec	1.12	1.13.0
com.fasterxml.jackson.core:jackson-databind	2.22.0	2.22.2
com.fasterxml.jackson.dataformat:jackson-dataformat-yaml	2.22.0	2.22.2
org.jsoup:jsoup	1.22.2	1.23.2
com.github.spotbugs:spotbugs-annotations	4.10.2	4.10.4
net.bytebuddy:byte-buddy	1.18.10	1.18.13
io.github.classgraph:classgraph	4.8.184	4.8.195
com.google.devtools.ksp:symbol-processing-api	2.3.9	2.3.11
com.google.devtools.ksp:symbol-processing-common-deps	2.3.9	2.3.11
com.google.devtools.ksp:symbol-processing-aa-embeddable	2.3.9	2.3.11
org.apache.maven.plugins:maven-compiler-plugin	3.15.0	3.16.0
org.apache.maven.plugins:maven-jar-plugin	3.5.0	3.5.1

Updates org.junit:junit-bom from 6.1.0 to 6.1.3

Release notes

Sourced from org.junit:junit-bom's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.1...r6.1.2

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

Commits

• f59f60d Release 6.1.3
• cd8ec92 Finalize 6.1.3 release notes
• c8729f2 Restore compatibility with GraalVM 25 (#5901)
• ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
• fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
• 62afc02 Delay GraalVM plugin updates for 3 days
• 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
• f6bbfc5 Move GraalVM tests to separate test task (#5903)
• e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
• 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
• Additional commits viewable in compare view

Updates org.slf4j:slf4j-api from 2.0.18 to 2.0.19

Updates org.slf4j:slf4j-simple from 2.0.18 to 2.0.19

Updates org.slf4j:slf4j-simple from 2.0.18 to 2.0.19

Updates ch.qos.logback:logback-classic from 1.5.36 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

• In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

• Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

• The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

• ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

• Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

• The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

-- Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

• Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

• Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

  <property name="logback.skipCallerContradictionAnalysis" value="true"/>

• SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

• Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

• Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

• Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

... (truncated)

Commits

• e8e824d prepare release 1.6.3
• 761821b MDCBasedDiscriminator has a gated warning mechanism
• 53ed122 update copyright year
• c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
• b5aa931 added BatchedSimpleInvocationGate
• 1f22af7 add javadocs to SimpleInvocationGate
• 638ffa7 prevent forward and backward slashes to escape to other directories
• 7d6b9a4 add missing ch.qos.logback.core.property package
• fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
• c73b43f deprecate the withJansi path
• Additional commits viewable in compare view

Updates io.smallrye.config:smallrye-config from 3.17.2 to 3.18.2

Release notes

Sourced from io.smallrye.config:smallrye-config's releases.

3.18.2

• #1558 Release 3.18.2
• #1557 Preserve multiline file content in FileSystemConfigSource
• #1555 Bump io.fabric8:docker-maven-plugin from 0.48.1 to 0.49.0
• #1553 Bump pymdown-extensions from 10.21.3 to 11.0.1 in /documentation
• #1551 Collect nested ConfigMappingClass entries in getConfigMappingsMetadata
• #1550 Ignore @​WithDefault on Map and Collection with nested group values
• #1549 Bump actions/setup-python from 6 to 7
• #1548 Bump io.smallrye.common:smallrye-common-bom from 2.19.0 to 2.20.0
• #1545 Bump kotlin.version from 2.4.0 to 2.4.10

3.18.1

• #1547 Release 3.18.1
• #1546 @​WithUnnamedKey#eager to control if default keys are present in the mapping Map

3.18.0

• #1544 Release 3.18.0
• #1543 Bump io.smallrye:smallrye-parent from 50 to 51
• #1541 Fix ConfigMapping hashCode collision for Map properties with equal keys and values
• #1540 Bump Python version from 3.9 to 3.12 in CI documentation workflows
• #1539 Remove deprecated Jasypt support
• #1538 Support nested config classes in class-based mappings
• #1537 Bump actions/checkout from 6 to 7
• #1536 Configure Surefire to display parameterized test names in reports
• #1535 Fix HOCON property name rendering
• #1534 Reproduce issue with @WithUnnamedKey config group considered present even if unconfigured
• #1533 Bump io.smallrye:smallrye-parent from 49 to 50
• #1532 Add SPI ConfigMappingHandler to split handling of @​ConfigMapping and @​ConfigProperties
• #1531 Bump io.smallrye.common:smallrye-common-bom from 2.18.1 to 2.19.0
• #1530 Bump com.typesafe:config from 1.4.8 to 1.4.9
• #1529 Bump kotlin.version from 2.3.21 to 2.4.0
• #1528 Update MicroProfile Config to 3.1.1
• #1527 Stabilize hashCode of ConfigClass
• #1526 Bump org.ow2.asm:asm from 9.10 to 9.10.1
• #1525 Bump idna from 3.11 to 3.15 in /documentation
• #1524 Bump pymdown-extensions from 10.21.2 to 10.21.3 in /documentation
• #1523 Bump org.ow2.asm:asm from 9.9.1 to 9.10
• #1522 Bump io.smallrye.common:smallrye-common-bom from 2.18.0 to 2.18.1
• #1520 Bump urllib3 from 2.6.3 to 2.7.0 in /documentation
• #1519 Bump io.smallrye.common:smallrye-common-bom from 2.17.1 to 2.18.0
• #1518 Bump com.typesafe:config from 1.4.7 to 1.4.8
• #1516 Bump com.typesafe:config from 1.4.6 to 1.4.7
• #1515 Bump io.smallrye:smallrye-parent from 48 to 49
• #1514 Bump kotlin.version from 2.3.20 to 2.3.21
• #1513 Bump org.jboss.bridger:bridger from 1.6.Final to 1.8
• #1510 Bump io.sundr:sundr-maven-plugin from 0.240.1 to 0.300.0

Commits

• a83950b [maven-release-plugin] prepare release 3.18.2
• 8395ec8 Release 3.18.2 (#1558)
• 4bd8290 Preserve multiline file content in FileSystemConfigSource (#1557)
• 683f471 Bump pymdown-extensions from 10.21.3 to 11.0.1 in /documentation (#1553)
• 36e36e0 Bump io.fabric8:docker-maven-plugin from 0.48.1 to 0.49.0 (#1555)
• 99e32ba Bump actions/setup-python from 6 to 7 (#1549)
• 96de53b Bump kotlin.version from 2.4.0 to 2.4.10 (#1545)
• 8a8abf7 Collect nested ConfigMappingClass entries in getConfigMappingsMetadata (#1551)
• 9458d40 Ignore @​WithDefault on Map and Collection with nested group values (#1550)
• 63980bb Bump io.smallrye.common:smallrye-common-bom from 2.19.0 to 2.20.0 (#1548)
• Additional commits viewable in compare view

Updates org.mongodb:mongodb-driver-sync from 5.8.0 to 5.11.0

Release notes

Sourced from org.mongodb:mongodb-driver-sync's releases.

Java Driver 5.11.0 (August 28, 2026)

What's Changed

• Java 6173 CSFLE/QE Support for HTTP Proxies by @​strogiyotec in mongodb/mongo-java-driver#2043

CSFLE/QE Http proxies notes

• The driver always negotiates TLS with the KMS host itself, using the SSLContext configured for the KMS provider. Implementations must not negotiate TLS with the KMS host; doing so would let an intermediary read the key material in transit.
• An implementation may use TLS for its own connection to the intermediary, in which case it returns an SSLSocket and the driver layers the KMS host's TLS session on top of it.
• Ownership of the returned socket passes to the driver, which closes it when the KMS request completes. A socket that is never returned must be closed by the implementation.
• Applicable only to the synchronous driver. The reactive streams driver rejects(RuntimeException) a configured callback.

Code example

Code example uses only the JDK API , so no HTTP client dependency is required. If you use your own HTTP client, it must return the tunnelled socket without negotiating TLS with the KMS host

First define the callback

private static final String PROXY_HOST = "proxy.example.com";
private static final int PROXY_PORT = 8080;
private static final int TIMEOUT_MILLIS = 10_000;
// Routes every KMS request through an HTTP proxy using the HTTP CONNECT method

// refer to the docs https://www.rfc-editor.org/info/rfc9110/#section-9.3.6

KmsConnectCallback proxyCallback = context -> {

Socket socket = new Socket();

try {

// 1. Connect to the proxy, not to the KMS host.

socket.connect(new InetSocketAddress(PROXY_HOST, PROXY_PORT), TIMEOUT_MILLIS);

socket.setSoTimeout(TIMEOUT_MILLIS);
    // 2. Ask the proxy to open a tunnel to the KMS host the driver wants to reach. Only the
    //    driver knows which host that is, so always take it from the context rather than
    //    hard-coding it.
    String target = context.getHost() + ":" + context.getPort();
    String connectRequest = "CONNECT " + target + " HTTP/1.1\r\n"
            + "Host: " + target + "\r\n"
            // If the proxy requires authentication, add the appropriate header, for example:
            // + "Proxy-Authorization: Basic " + base64("user:password") + "\r\n"
            + "\r\n";
    socket.getOutputStream().write(connectRequest.getBytes(StandardCharsets.US_ASCII));
// 3. Check the proxy accepted the tunnel before handing the socket back.
checkProxyAcceptedTunnel(socket.getInputStream());

} catch (IOException | RuntimeException e) {

// The driver never received this socket, so it cannot close it for you.

socket.close();

throw e;


</tr></table>

... (truncated)

Commits

• c96aad1 Version: bump 5.11.0
• 027d4cc CSFLE/QE Support for HTTP Proxies (#2043)
• 9af9be1 Version: bump 5.11.0-SNAPSHOT
• 09aa019 Merge commit from fork (#2035)
• d751950 Evergreen CI windows fixes
• 533b2b6 Ensure Kotlin can encode ByteArrays efficiently (#2019)
• 94863fa Support $vectorSearch against nested embeddings and arrays of embeddings (#2026)
• 1b958ae JAVA-5990 Hybrid Search Score Fusion (#2024)
• dd814f8 JAVA-6146 Move detail out of the root AGENTS.md into references
• d87d93a Fluent API for $score (#2023)
• Additional commits viewable in compare view

Updates org.mongodb:mongodb-driver-legacy from 5.8.0 to 5.11.0

Release notes

Sourced from org.mongodb:mongodb-driver-legacy's releases.

Java Driver 5.11.0 (August 28, 2026)

What's Changed

• Java 6173 CSFLE/QE Support for HTTP Proxies by @​strogiyotec in mongodb/mongo-java-driver#2043

CSFLE/QE Http proxies notes

• The driver always negotiates TLS with the KMS host itself, using the SSLContext configured for the KMS provider. Implementations must not negotiate TLS with the KMS host; doing so would let an intermediary read the key material in transit.
• An implementation may use TLS for its own connection to the intermediary, in which case it returns an SSLSocket and the driver layers the KMS host's TLS session on top of it.
• Ownership of the returned socket passes to the driver, which closes it when the KMS request completes. A socket that is never returned must be closed by the implementation.
• Applicable only to the synchronous driver. The reactive streams driver rejects(RuntimeException) a configured callback.

Code example

Code example uses only the JDK API , so no HTTP client dependency is required. If you use your own HTTP client, it must return the tunnelled socket without negotiating TLS with the KMS host

First define the callback

private static final String PROXY_HOST = "proxy.example.com";
private static final int PROXY_PORT = 8080;
private static final int TIMEOUT_MILLIS = 10_000;
// Routes every KMS request through an HTTP proxy using the HTTP CONNECT method

// refer to the docs https://www.rfc-editor.org/info/rfc9110/#section-9.3.6

KmsConnectCallback proxyCallback = context -> {

Socket socket = new Socket();

try {

// 1. Connect to the proxy, not to the KMS host.

socket.connect(new InetSocketAddress(PROXY_HOST, PROXY_PORT), TIMEOUT_MILLIS);

socket.setSoTimeout(TIMEOUT_MILLIS);
    // 2. Ask the proxy to open a tunnel to the KMS host the driver wants to reach. Only the
    //    driver knows which host that is, so always take it from the context rather than
    //    hard-coding it.
    String target = context.getHost() + ":" + context.getPort();
    String connectRequest = "CONNECT " + target + " HTTP/1.1\r\n"
            + "Host: " + target + "\r\n"
            // If the proxy requires authentication, add the appropriate header, for example:
            // + "Proxy-Authorization: Basic " + base64("user:password") + "\r\n"
            + "\r\n";
    socket.getOutputStream().write(connectRequest.getBytes(StandardCharsets.US_ASCII));
// 3. Check the proxy accepted the tunnel before handing the socket back.
checkProxyAcceptedTunnel(socket.getInputStream());

} catch (IOException | RuntimeException e) {

// The driver never received this socket, so it cannot close it for you.

socket.close();

throw e;


</tr></table>

... (truncated)

Commits

• c96aad1 Version: bump 5.11.0
• 027d4cc CSFLE/QE Support for HTTP Proxies (#2043)
• 9af9be1 Version: bump 5.11.0-SNAPSHOT
• 09aa019 Merge commit from fork (#2035)
• d751950 Evergreen CI windows fixes
• 533b2b6 Ensure Kotlin can encode ByteArrays efficiently (#2019)
• 94863fa Support $vectorSearch against nested embeddings and arrays of embeddings (#2026)
• 1b958ae JAVA-5990 Hybrid Search Score Fusion (#2024)
• dd814f8 JAVA-6146 Move detail out of the root AGENTS.md into references
• d87d93a Fluent API for $score (#2023)
• Additional commits viewable in compare view

Updates org.mongodb:mongodb-driver-legacy from 5.8.0 to 5.11.0

Release notes

Sourced from org.mongodb:mongodb-driver-legacy's releases.

Java Driver 5.11.0 (August 28, 2026)

What's Changed

• Java 6173 CSFLE/QE Support for HTTP Proxies by @​strogiyotec in mongodb/mongo-java-driver#2043

CSFLE/QE Http proxies notes

• The driver always negotiates TLS with the KMS host itself, using the SSLContext configured for the KMS provider. Implementations must not negotiate TLS with the KMS host; doing so would let an intermediary read the key material in transit.
• An implementation may use TLS for its own connection to the intermediary, in which case it returns an SSLSocket and the driver layers the KMS host's TLS session on top of it.
• Ownership of the returned socket passes to the driver, which closes it when the KMS request completes. A socket that is never returned must be closed by the implementation.
• Applicable only to the synchronous driver. The reactive streams driver rejects(RuntimeException) a configured callback.

Code example

Code example uses only the JDK API , so no HTTP client dependency is required. If you use your own HTTP client, it must return the tunnelled socket without negotiating TLS with the KMS host

First define the callback

private static final String PROXY_HOST = "proxy.example.com";
private static final int PROXY_PORT = 8080;
private static final int TIMEOUT_MILLIS = 10_000;
// Routes every KMS request through an HTTP proxy using the HTTP CONNECT method

// refer to the docs https://www.rfc-editor.org/info/rfc9110/#section-9.3.6

KmsConnectCallback proxyCallback = context -> {

Socket socket = new Socket();

try {

// 1. Connect to the proxy, not to the KMS host.

socket.connect(new InetSocketAddress(PROXY_HOST, PROXY_PORT), TIMEOUT_MILLIS);

socket.setSoTimeout(TIMEOUT_MILLIS);
    // 2. Ask the proxy to open a tunnel to the KMS host the driver wants to reach. Only the
    //    driver knows which host that is, so always take it from the context rather than
    //    hard-coding it.
    String target = context.getHost() + ":" + context.getPort();
    String connectRequest = "CONNECT " + target + " HTTP/1.1\r\n"
            + "Host: " + target + "\r\n"
            // If the proxy requires authentication, add the appropriate header, for example:
            // + "Proxy-Authorization: Basic " + base64("user:password") + "\r\n"
            + "\r\n";
    socket.getOutputStream().write(connectRequest.getBytes(StandardCharsets.US_ASCII));
// 3. Check the proxy accepted the tunnel before handing the socket back.
checkProxyAcceptedTunnel(socket.getInputStream());

} catch (IOException | RuntimeException e) {

// The driver never received this socket, so it cannot close it for you.

socket.close();

throw e;


</tr></table>

... (truncated)

Commits

• c96aad1 Version: bump 5.11.0
• 027d4cc CSFLE/QE Support for HTTP Proxies (#2043)
• 9af9be1 Version: bump 5.11.0-SNAPSHOT
• 09aa019 Merge commit from fork (#2035)
• d751950 Evergreen CI windows fixes
• 533b2b6 Ensure Kotlin can encode ByteArrays efficiently (#2019)
• 94863fa Support $vectorSearch against nested embeddings and arrays of embeddings (#2026)
• 1b958ae JAVA-5990 Hybrid Search Score Fusion (#2024)
• dd814f8 JAVA-6146 Move detail out of the root AGENTS.md into references
• d87d93a Fluent API for $score (#2023)
• Additional commits viewable in compare view

Updates org.zeroturnaround:zt-exec from 1.12 to 1.13.0

Release notes

Sourced from org.zeroturnaround:zt-exec's releases.

v1.13.0

What's Changed

• Flush output written to process in after each write by @​guw in zeroturnaround/zt-exec#40
• Logoutputstream linebreaks by @​stefan-sachs in zeroturnaround/zt-exec#46
• Fix BEFORE_CODE and wrong indexOf check by @​schoepke in zeroturnaround/zt-exec#62
• Eliminate some cases of log-and-throw by @​tsjensen in zeroturnaround/zt-exec#68
• Remove dependency on apache-commons-io. by @​ketan in zeroturnaround/zt-exec#70
• Updated readme the link to maven by @​PaulWoitaschek in zeroturnaround/zt-exec#71
• Travis CI: openjdk8, openjdk11 by @​sullis in zeroturnaround/zt-exec#74
• maven-compiler-plugin 3.8.1 by @​sullis in zeroturnaround/zt-exec#75
• Added OSGi metadata support by @​swimmesberger in zeroturnaround/zt-exec#85
• LogOutputStream support change outputCharset for jvm charset diff with exe output charset by @​qxo in zeroturnaround/zt-exec#89
• Fix build on JDK11 and where JDK is OpenJDK by @​rnc in zeroturnaround/zt-exec#91
• Add an explicit module descriptor by @​aalmiray in zeroturnaround/zt-exec#106
• Upgrade Maven wrapper to 3.6.3 by @​nemecec in zeroturnaround/zt-exec#110
• Setup GitHub workflow by @​nemecec in zeroturnaround/zt-exec#109
• Switch "build status" badge from Travis CI to GitHub Actions by @​nemecec in zeroturnaround/zt-exec#111
• LogOutputStream.create(LineConsumer) by @​panchenko in zeroturnaround/zt-exec#107
• Bump ch.qos.logback:logback-classic from 1.2.12 to 1.2.13 by @​dependabot[bot] in zeroturnaround/zt-exec#114
• Convert build from Maven to Gradle by @​nemecec in zeroturnaround/zt-exec#122
• Bump commons-io:commons-io from 2.11.0 to 2.14.0 by @​dependabot[bot] in zeroturnaround/zt-exec#126
• Bump org.apache.commons:commons-lang3 from 3.12.0 to 3.18.0 by @​dependabot[bot] in zeroturnaround/zt-exec#125
• Bump the minor-and-patch group across 1 directory with 4 updates by @​dependabot[bot] in zeroturnaround/zt-exec#123
• List all consumer-facing changes since 1.12 in the changelog by @​nemecec in zeroturnaround/zt-exec#127

New Contributors

• @​guw made their first contribution in zeroturnaround/zt-exec#40
• @​stefan-sachs made their first contribution in zeroturnaround/zt-exec#46
• @​schoepke made their first contribution in zeroturnaround/zt-exec#62
• @​tsjensen made their first contribution in zeroturnaround/zt-exec#68
• @​ketan made their first contribution in zeroturnaround/zt-exec#70
• @​PaulWoitaschek made their first contribution in zeroturnaround/zt-exec#71
• @​sullis made their first contribution in zeroturnaround/zt-exec#74
• @​swimmesberger made their first contribution in zeroturnaround/zt-exec#85
• @​qxo made their first contribution in zeroturnaround/zt-exec#89
• @​rnc made their first contribution in zeroturnaround/zt-exec#91
• @​aalmiray made their first contribution in zeroturnaround/zt-exec#106
• @​nemecec made their first contribution in zeroturnaround/zt-exec#110
• @​panchenko made their first contribution in zeroturnaround/zt-exec#107
• @​dependabot[bot] made their first contribution in zeroturnaround/zt-exec#114

Full Changelog: https://github.com/zeroturnaround/zt-exec/commits/v1.13.0

Changelog

Sourced from org.zeroturnaround:zt-exec's changelog.

[1.13.0] - 2026-07-10

Added

• LogOutputStream.create(LineConsumer) to build a LogOutputStream from a lambda (#107).
• LogOutputStream.setOutputCharset(String) to control the charset used to decode the process output (#89).
• An OSGi bundle manifest (Bundle-SymbolicName, Export-Package) in the published jar (#85).
• A JPMS module descriptor for module org.zeroturnaround.exec, shipped as a Java 9 multi-release entry (#106).

Changed

• Raised the minimum Java runtime from 6 to 8 (bytecode target moved from 1.6 to 1.8).
• Upgraded the slf4j-api dependency from 1.7.2 to 1.7.32.
• Migrated the build from Maven to Gradle; releases now publish to Maven Central through the Sonatype Central Portal.

Commits

• f71a22a Release 1.13.0
• 13ca7bd List all consumer-facing changes since 1.12 in the changelog
• a614f50 Bump the minor-and-patch group across 1 directory with 4 updates
• d20fae7 Bump org.apache.commons:commons-lang3 from 3.12.0 to 3.18.0
• f16fd4e Bump commons-io:commons-io from 2.11.0 to 2.14.0
• 09612ed Suppress automatic-module warning on the slf4j requires directive
• 38f6ee9 Add CHANGELOG.md, security policy, and changelog release automation
• 1711820 Adopt vMAJOR.MINOR.PATCH release tags
• 6e8e4a6 Bump build tooling to current versions
• 5e0b895 Drop defunct ZeroTurnaround references from POM metadata
• Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-databind from 2.22.0 to 2.22.2

Commits

• 25b2a22 [maven-release-plugin] prepare release jackson-databind-2.22.2
• bab1c1a Prep for 2.22.2 release
• bc03cf8 Merge branch '2.21' into 2.22
• 83379fb Merge branch '2.20' into 2.21
• 0d400c9 Merge branch '2.19' into 2.20
• ce36a27 Merge branch '2.18' into 2.19
• 7a209e1 Post-release dep version bump
• a432707 [maven-release-plugin] prepare for next development iteration
• 176df1d [maven-release-plugin] prepare release jackson-databind-2.18.10
• 7785f5f Prep for 2.18.10 release
• Additional commits viewable in compare view

Updates com.fasterxml.jackson.dataformat:jackson-dataformat-yaml from 2.22.0 to 2.22.2

Commits

• 3aab026 [maven-release-plugin] prepare release jackson-dataformats-text-2.22.2
• 0e4e5b9 Prep for 2.22.2 release
• 3fd4238 Merge branch '2.21' into 2.22
• f0f9689 Merge branch '2.20' into 2.21
• 50d9dfa Merge branch '2.19' into 2.20
• 0e9bdd4 Merge branch '2.18' into 2.19
• 613de08 Post-release dep version bump
• 49dc929 [maven-release-plugin] prepare for next development iteration
• c09cd3f [maven-release-plugin] prepare release jackson-dataformats-text-2.18.10
• 096a670 Prep for 2.18.10 release
• Additional commits viewable in compare view

Updates com.fasterxml.jackson.dataformat:jackson-dataformat-yaml from 2.22.0 to 2.22.2

Commits

• 3aab026 [maven-release-plugin] prepare release jackson-dataformats-text-2.22.2
• 0e4e5b9 Prep for 2.22.2 release
• 3fd4238 Merge branch '2.21' into 2.22
• f0f9689 Merge branch '2.20' into 2.21
• 50d9dfa Merge branch '2.19' into 2.20
• 0e9bdd4 Merge branch '2.18' into 2.19
• 613de08 Post-release dep version bump
• 49dc929 [maven-release-plugin] prepare for next development iteration
• c09cd3f [maven-release-plugin] prepare release jackson-dataformats-text-2.18.10
• 096a670 Prep for 2.18.10 release
• Additional commits viewable in compare view

Updates org.jsoup:jsoup from 1.22.2 to 1.23.2

Release notes

Sourced from org.jsoup:jsoup's releases.

jsoup 1.23.2

jsoup 1.23.2 is out now. This release focuses largely on bug fixes, specification correctness, and performance improvements.

It brings closer alignment with the HTML, XML, URL, and form submission specifications; improves XML and W3C DOM conversion; and makes HTTP workloads more efficient through streamed request bodies and broader JDK HttpClient reuse.

This version also includes new node insertion methods for Elements, and DOM mutations now reject operations that would create a cycle.

jsoup is a Java library for working with real-world HTML and XML. It provides a very convenient API for extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors.

Download jsoup now.

Improvements

• Improved consecutive StreamParser.selectFirst() calls during progressive parsing, so later matches are returned with their parsed contents when earlier selections had left them as parser lookahead. E.g., given <title>One</title><p id=hit>Full</p><p>Next</p>, selecting title and then #hit now advances the partial lookahead and returns <p id="hit">Full</p>, rather than returning an empty <p id="hit"></p> before its content is parsed. The updated readiness tracking follows StreamParser's normal emission order across implicit HTML structure and parser recovery. #2551
• Improved XML parser performance and memory use for documents with many nested namespace declarations by recording namespace changes within each element scope. #2556
• Improved W3CDom conversion performance for documents with many nested namespace declarations. The W3C converter now uses the same optimized namespace tracking as the XML parser. #2559
• Improved W3CDom XML conversion to retain processing instructions, comments outside the root element, and CDATA sections, which were previously dropped or converted to text. #2572
• DOM mutation methods, including child insertion and replacement, now reject operations that would create a cycle, such as making a node its own child or moving an ancestor beneath a descendant. #2552
• Added Elements#before(Node), after(Node), prepend(Node), and append(Node) to match the existing HTML string methods. #953
• Large file-backed uploads through Connection.requestBodyStream(InputStream) now stream directly with the JDK HttpClient on Java 11+, rather than being loaded fully into memory first. #2575
• Extended Java 11+ HTTP client reuse from requests sharing a Jsoup.newSession() to ordinary Jsoup.connect() calls, reducing transport thread and connection setup churn under sustained request loads. Sessions with custom authentication or SSL contexts co...

  Description has been truncated