chore: [DevOps] bump the production-minor-patch group with 7 updates by dependabot[bot] · Pull Request #1251 · SAP/cloud-sdk-java

dependabot · 2026-08-10T22:04:37Z

Bumps the production-minor-patch group with 7 updates:

Package	From	To
io.swagger.core.v3:swagger-models	`2.2.52`	`2.2.53`
io.swagger.parser.v3:swagger-parser	`2.1.45`	`2.1.46`
io.swagger.parser.v3:swagger-parser-core	`2.1.45`	`2.1.46`
com.sap.cloud.security:java-bom	`4.0.8`	`4.1.0`
org.apache.httpcomponents.client5:httpclient5	`5.6.3`	`5.6.4`
org.checkerframework:checker-qual	`4.2.1`	`4.2.2`
io.netty:netty-bom	`4.2.16.Final`	`4.2.17.Final`

Updates io.swagger.core.v3:swagger-models from 2.2.52 to 2.2.53

Updates io.swagger.parser.v3:swagger-parser from 2.1.45 to 2.1.46

Release notes

Sourced from io.swagger.parser.v3:swagger-parser's releases.

Swagger-parser 2.1.46 released!

chore: introduce jackson bom and update to 2.22 line (#2368)

Commits

37d7afd prepare release 2.1.46 (#2369)
70a592c chore: introduce jackson bom and update to 2.22 line (#2368)
fcbd9ed bump snapshot 2.1.46-SNAPSHOT (#2361)
See full diff in compare view

Updates io.swagger.parser.v3:swagger-parser-core from 2.1.45 to 2.1.46

Updates com.sap.cloud.security:java-bom from 4.0.8 to 4.1.0

Release notes

Sourced from com.sap.cloud.security:java-bom's releases.

4.1.0

Skip IAS proof-token validation for tokens with a single audience or no audience claim

SapIdJwtSignatureValidator previously gated the proof-token / forwarded-client-cert check on the presence of the ias_apis claim. It now gates on token.getAudiences().size() > 1, so the check only runs for genuine app-to-app tokens (multiple audiences) and is skipped for app-to-service tokens (single audience) and tokens with a missing/empty aud claim

Eliminates spurious "client certificate could not be read" failures on requests where no x-forwarded-client-cert header is expected

Support additional JWT signature algorithms in JwtSignatureValidator. In addition to the previously supported RS256, tokens signed with the following algorithms (RFC 7518 §3.3 / §3.4 / §3.5) can now be validated:

RS384, RS512 (RSASSA-PKCS1-v1_5 with SHA-384 / SHA-512)

PS256, PS384, PS512 (RSASSA-PSS with SHA-256 / SHA-384 / SHA-512). The corresponding PSSParameterSpec is set automatically before signature verification.

ES256, ES384, ES512 (ECDSA on P-256 / P-384 / P-521 with SHA-256 / SHA-384 / SHA-512). The JCA name SHA*withECDSAinP1363Format is used so the raw R||S signature format mandated by RFC 7518 §3.4 is accepted directly. EC JWKs are constructed from crv/x/y with strict curve and coordinate-length validation per RFC 7518 §6.2.1.

Selection is driven by the JWT header alg value. Unknown values continue to be rejected with the existing "is not supported" error.

Expose the sap_id_type claim on SapIdToken

New SapIdToken#getIdType() returning a typed SapIdType enum (USER, APP); resolves to null if the claim is absent or carries an unknown value

New TokenClaims.SAP_ID_TYPE constant

DefaultIdTokenExtension#isTechnicalUser now prefers the sap_id_type claim and falls back to the sub == azp heuristic for tokens issued before the claim was introduced

Tolerate unsupported or malformed entries in a JWKS response

JsonWebKeySetFactory previously aborted the whole parse when a single entry resolved to an algorithm the library does not recognise (or was otherwise malformed), so an IdP adding a key for a new algorithm family broke token validation for every tenant sharing the endpoint — including tokens signed with algorithms this library DOES support

Each entry is now parsed in isolation: unsupported alg/kty is skipped with an INFO log, a malformed entry is skipped with a WARN, and both carry sanitized kid/kty/alg for diagnostics

When a caller later requests a kid that was silently dropped at parse time, the pre-throw WARN in OAuth2TokenKeyServiceWithCache now points at the earlier Skipping JWK entry log lines so the root cause is discoverable. The existing Key with kid <kid> not found in JWKS. exception message is unchanged for downstream log-based alerts

Update dependencies:

Jetty: 12.1.10 → 12.1.11

JUnit Jupiter: 6.1.0 → 6.1.2

log4j2: 2.26.0 → 2.26.1

org.json: 20260522 → 20260719

SpotBugs annotations: 4.10.2 → 4.10.3

SpotBugs Maven Plugin: 4.10.2.0 → 4.10.3.0

logback-core (test scope, token-client / token-client-spring / token-client-spring-3): 1.5.25 → 1.5.34

Changelog

Sourced from com.sap.cloud.security:java-bom's changelog.

4.1.0

Skip IAS proof-token validation for tokens with a single audience or no audience claim

SapIdJwtSignatureValidator previously gated the proof-token / forwarded-client-cert check on the presence of the ias_apis claim. It now gates on token.getAudiences().size() > 1, so the check only runs for genuine app-to-app tokens (multiple audiences) and is skipped for app-to-service tokens (single audience) and tokens with a missing/empty aud claim

Eliminates spurious "client certificate could not be read" failures on requests where no x-forwarded-client-cert header is expected

Support additional JWT signature algorithms in JwtSignatureValidator. In addition to the previously supported RS256, tokens signed with the following algorithms (RFC 7518 §3.3 / §3.4 / §3.5) can now be validated:

RS384, RS512 (RSASSA-PKCS1-v1_5 with SHA-384 / SHA-512)

PS256, PS384, PS512 (RSASSA-PSS with SHA-256 / SHA-384 / SHA-512). The corresponding PSSParameterSpec is set automatically before signature verification.

ES256, ES384, ES512 (ECDSA on P-256 / P-384 / P-521 with SHA-256 / SHA-384 / SHA-512). The JCA name SHA*withECDSAinP1363Format is used so the raw R||S signature format mandated by RFC 7518 §3.4 is accepted directly. EC JWKs are constructed from crv/x/y with strict curve and coordinate-length validation per RFC 7518 §6.2.1.

Selection is driven by the JWT header alg value. Unknown values continue to be rejected with the existing "is not supported" error.

Expose the sap_id_type claim on SapIdToken

New SapIdToken#getIdType() returning a typed SapIdType enum (USER, APP); resolves to null if the claim is absent or carries an unknown value

New TokenClaims.SAP_ID_TYPE constant

DefaultIdTokenExtension#isTechnicalUser now prefers the sap_id_type claim and falls back to the sub == azp heuristic for tokens issued before the claim was introduced

Tolerate unsupported or malformed entries in a JWKS response

JsonWebKeySetFactory previously aborted the whole parse when a single entry resolved to an algorithm the library does not recognise (or was otherwise malformed), so an IdP adding a key for a new algorithm family broke token validation for every tenant sharing the endpoint — including tokens signed with algorithms this library DOES support

Each entry is now parsed in isolation: unsupported alg/kty is skipped with an INFO log, a malformed entry is skipped with a WARN, and both carry sanitized kid/kty/alg for diagnostics

When a caller later requests a kid that was silently dropped at parse time, the pre-throw WARN in OAuth2TokenKeyServiceWithCache now points at the earlier Skipping JWK entry log lines so the root cause is discoverable. The existing Key with kid <kid> not found in JWKS. exception message is unchanged for downstream log-based alerts

Update dependencies:

Jetty: 12.1.10 → 12.1.11

JUnit Jupiter: 6.1.0 → 6.1.2

log4j2: 2.26.0 → 2.26.1

org.json: 20260522 → 20260719

SpotBugs annotations: 4.10.2 → 4.10.3

SpotBugs Maven Plugin: 4.10.2.0 → 4.10.3.0

logback-core (test scope, token-client / token-client-spring / token-client-spring-3): 1.5.25 → 1.5.34

Commits

e61fd6b Release 4.1.0 (#2011)
See full diff in compare view

Updates org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4

Changelog

Sourced from org.apache.httpcomponents.client5:httpclient5's changelog.

Release 5.6.4

This maintenance release fixes SSL parameter application in the async TLS upgrade strategy.

Change Log

BearerScheme to reject control characters in bearer token. Contributed by Javid Khan

Corrects application of SSL parameters in the async TLS upgrade method. Contributed by Oleg Kalnichevski

Commits

36508ce HttpClient 5.6.4 release
59b3d2e Updated release notes for HttpClient 5.6.4 release
c0af759 reject control characters in bearer token in BearerScheme
2422b6c Corrects application of SSL parameters in the async TLS upgrade method
66452ea Upgraded HttpClient version to 5.6.4-SNAPSHOT
See full diff in compare view

Updates org.checkerframework:checker-qual from 4.2.1 to 4.2.2

Release notes

Sourced from org.checkerframework:checker-qual's releases.

Checker Framework 4.2.2

Version 4.2.2 (2026-08-06)

Implementation details

Renamed CFAbstractValue.validateSet() to hasAnnotationFromEveryHierarchy().

Closed issues

#7723, #7784, #7806.

Changelog

Sourced from org.checkerframework:checker-qual's changelog.

Version 4.2.2 (2026-08-06)

Implementation details

Renamed CFAbstractValue.validateSet() to hasAnnotationFromEveryHierarchy().

Closed issues

#7723, #7784, #7806.

Commits

2dc79ee new release 4.2.2
c038044 Use the Gradle Nexus publish plugin.
51d31ca Update release date.
765fe18 Define equals() and hashCode() (#7892)
214e1a7 Don't use snapshot versions of libraries
83a2be9 Gradle improvements
6342795 Use object equality, not reference equality (#7891)
53ae357 Document side effect (#7897)
b7f5e73 Address alignment between declared and substituted type (#7885)
45a6235 The three alternatives of 18.5.2.1 are not mutually exclusive (#7883)
Additional commits viewable in compare view

Updates io.netty:netty-bom from 4.2.16.Final to 4.2.17.Final

Release notes

Sourced from io.netty:netty-bom's releases.

netty-4.2.17.Final

What's Changed

AsciiString.cached(String) should sanitize the provided String (#13749) by @vpelikh in netty/netty#17007

Fix deploy workflow by @normanmaurer in netty/netty#17071

Fix AsciiString.cached(String) performance regression by @dreamlike-ocean in netty/netty#17074

SslHandler: Fix possible buffer leak when an OOME is thrown during allocation by @normanmaurer in netty/netty#17059

Avoid leak presence detector in leak profile by @yawkat in netty/netty#17073

Add HttpContentCompressor constructor with ability to specify desired maxPipelineDepth by @reta in netty/netty#17068

IoUring: preserve readPending when rescheduling cancelled reads by @dreamlike-ocean in netty/netty#17087

Reject negative maxOrder in PooledByteBufAllocator by @coderbruis in netty/netty#17093

Fix AdaptiveByteBuf._setLongLE calling checked setLongLE by @franz1981 in netty/netty#17098

Snappy: Guard decoder against invalid chunk lengths by @yawkat in netty/netty#17099

Fix OCSP Tests by @chrisvest in netty/netty#17114

Update to latest netty-tcnative release by @normanmaurer in netty/netty#17056

Use safe decompressor in Lz4FrameDecoder by @yawkat in netty/netty#17118

Configure TestLens for the PR builds by @chrisvest in netty/netty#17129

IoUring: add SO_INQ support for Unix domain sockets by @dreamlike-ocean in netty/netty#17127

fix(mqtt): drop UNSUBACK reason codes for MQTT 3.x encoding by @ChunMengLu in netty/netty#17117

Propagate the CI envionment variables through to the docker builds by @chrisvest in netty/netty#17138

Codec-compression: Add decompressor API by @yawkat in netty/netty#16745

Fix silent failures and optimize error short-circuit in multi-threaded tests by @rajan-github in netty/netty#17106

Codec-compression: Add Bzip2Decompressor by @yawkat in netty/netty#17145

Fix buddy cache evicting chunks with live buffers by @franz1981 in netty/netty#17154

Codec-compression: Add Snappy frame decompressor by @yawkat in netty/netty#17153

Codec-compression: Add zlib decompressors by @yawkat in netty/netty#17155

Codec-compression: Add Zstd decompressor by @yawkat in netty/netty#17152

Codec-compression: Add LZF decompressor by @yawkat in netty/netty#17147

Codec-compression: Add BrotliDecompressor by @yawkat in netty/netty#17146

Codec-compression: Add Lz4FrameDecompressor by @yawkat in netty/netty#17148

HttpObjectEncoder / DefaultHttp2FrameWriter: fix buffer leak when a Throwable is thrown during header encoding by @HwangRock in netty/netty#17089

Fix direct memory OOM on low-core containers by @franz1981 in netty/netty#17166

IoUring: Fix the recvmmsg emulation by @dreamlike-ocean in netty/netty#17187

Avoid classloader leak via GlobalEventExecutor terminationFuture failure by @seonwooj0810 in netty/netty#17140

BrotliEncoder: Prevent duplicate close scheduling by @yawkat in netty/netty#17175

Fix JdkZlibDecompressor losing the tail of highly compressible streams by @renechoi in netty/netty#17191

Update compress-lzf to 1.2.1 by @yawkat in netty/netty#17194

Do not write WebSocket handshake response to the tail of the pipeline by @el-psy-kongroo-d in netty/netty#17192

HttpServerCodec: do not consume the method queue for 1xx interim responses by @HwangRock in netty/netty#17182

Weakly reference engines from the OpenSSL engine map by @bryce-anderson in netty/netty#17199

OpenSSL: Allow to obtain used named group via OpenSslSession by @normanmaurer in netty/netty#17058

Add .editorconfig to enforce consistent coding style by @vpelikh in netty/netty#17052

Update surefire plugin to latest version by @normanmaurer in netty/netty#17210

Merge changes from forks by @chrisvest in netty/netty#17213

New Contributors

@vpelikh made their first contribution in netty/netty#17007

@ChunMengLu made their first contribution in netty/netty#17117

@rajan-github made their first contribution in netty/netty#17106

@seonwooj0810 made their first contribution in netty/netty#17140

@renechoi made their first contribution in netty/netty#17191

... (truncated)

Commits

e0789d3 [maven-release-plugin] prepare release netty-4.2.17.Final
1b5abc6 Merge changes from forks (#17213)
36fbf57 Update surefire plugin to latest version (#17210)
a96226c Add .editorconfig to enforce consistent coding style (#17052)
14a4e6a OpenSSL: Allow to obtain used named group via OpenSslSession (#17058)
26255b1 Weakly reference engines from the OpenSSL engine map (#17199)
ae41417 HttpServerCodec: do not consume the method queue for 1xx interim responses ...
41f1db5 Do not write WebSocket handshake response to the tail of the pipeline (#17192)
035d76e Update compress-lzf to 1.2.1 (#17194)
7681aff Fix JdkZlibDecompressor losing the tail of highly compressible streams (#17191)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the production-minor-patch group with 7 updates: | Package | From | To | | --- | --- | --- | | io.swagger.core.v3:swagger-models | `2.2.52` | `2.2.53` | | [io.swagger.parser.v3:swagger-parser](https://github.com/swagger-api/swagger-parser) | `2.1.45` | `2.1.46` | | io.swagger.parser.v3:swagger-parser-core | `2.1.45` | `2.1.46` | | [com.sap.cloud.security:java-bom](https://github.com/SAP/cloud-security-xsuaa-integration) | `4.0.8` | `4.1.0` | | [org.apache.httpcomponents.client5:httpclient5](https://github.com/apache/httpcomponents-client) | `5.6.3` | `5.6.4` | | [org.checkerframework:checker-qual](https://github.com/typetools/checker-framework) | `4.2.1` | `4.2.2` | | [io.netty:netty-bom](https://github.com/netty/netty) | `4.2.16.Final` | `4.2.17.Final` | Updates `io.swagger.core.v3:swagger-models` from 2.2.52 to 2.2.53 Updates `io.swagger.parser.v3:swagger-parser` from 2.1.45 to 2.1.46 - [Release notes](https://github.com/swagger-api/swagger-parser/releases) - [Commits](swagger-api/swagger-parser@v2.1.45...v2.1.46) Updates `io.swagger.parser.v3:swagger-parser-core` from 2.1.45 to 2.1.46 Updates `io.swagger.parser.v3:swagger-parser-core` from 2.1.45 to 2.1.46 Updates `com.sap.cloud.security:java-bom` from 4.0.8 to 4.1.0 - [Release notes](https://github.com/SAP/cloud-security-xsuaa-integration/releases) - [Changelog](https://github.com/SAP/cloud-security-services-integration-library/blob/main/CHANGELOG.md) - [Commits](SAP/cloud-security-services-integration-library@4.0.8...4.1.0) Updates `org.apache.httpcomponents.client5:httpclient5` from 5.6.3 to 5.6.4 - [Changelog](https://github.com/apache/httpcomponents-client/blob/rel/v5.6.4/RELEASE_NOTES.txt) - [Commits](apache/httpcomponents-client@rel/v5.6.3...rel/v5.6.4) Updates `org.checkerframework:checker-qual` from 4.2.1 to 4.2.2 - [Release notes](https://github.com/typetools/checker-framework/releases) - [Changelog](https://github.com/typetools/checker-framework/blob/master/docs/CHANGELOG.md) - [Commits](typetools/checker-framework@checker-framework-4.2.1...checker-framework-4.2.2) Updates `io.netty:netty-bom` from 4.2.16.Final to 4.2.17.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.16.Final...netty-4.2.17.Final) --- updated-dependencies: - dependency-name: io.swagger.core.v3:swagger-models dependency-version: 2.2.53 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: io.swagger.parser.v3:swagger-parser dependency-version: 2.1.46 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: io.swagger.parser.v3:swagger-parser-core dependency-version: 2.1.46 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: io.swagger.parser.v3:swagger-parser-core dependency-version: 2.1.46 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: com.sap.cloud.security:java-bom dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-patch - dependency-name: org.apache.httpcomponents.client5:httpclient5 dependency-version: 5.6.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: org.checkerframework:checker-qual dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch - dependency-name: io.netty:netty-bom dependency-version: 4.2.17.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 10, 2026

Navigation Menu

Uh oh!

chore: [DevOps] bump the production-minor-patch group with 7 updates - #1251

chore: [DevOps] bump the production-minor-patch group with 7 updates#1251
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/main/production-minor-patch-4afa8bcedb

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 10, 2026

Swagger-parser 2.1.46 released!

4.1.0

4.1.0

Release 5.6.4

Change Log

Checker Framework 4.2.2

Version 4.2.2 (2026-08-06)

Implementation details

Closed issues

Version 4.2.2 (2026-08-06)

Implementation details

Closed issues

netty-4.2.17.Final

What's Changed

New Contributors

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants