Update all patch/minor versions (master)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Confidence
tomcat (source)	final	patch	11.0.25-jre21-temurin-jammy → 11.0.26-jre21-temurin-jammy
com.github.spotbugs	plugin	patch	6.5.11 → 6.5.12
org.slf4j:jul-to-slf4j (source, changelog)	dependencies	patch	2.0.18 → 2.0.20
org.slf4j:jcl-over-slf4j (source, changelog)	dependencies	patch	2.0.18 → 2.0.20
org.slf4j:slf4j-api (source, changelog)	dependencies	patch	2.0.18 → 2.0.20
io.sentry:sentry-logback	dependencies	minor	8.54.0 → 8.59.0	8.60.0
org.mockito:mockito-core	dependencies	minor	5.23.0 → 5.24.0
ch.qos.logback:logback-classic (source, changelog)	dependencies	patch	1.6.3 → 1.6.5
joda-time:joda-time (source)	dependencies	minor	2.14.3 → 2.15.0
com.twelvemonkeys.imageio:imageio-webp (source)	dependencies	minor	3.14.0 → 3.15.2	3.15.3
io.hypersistence:hypersistence-utils-hibernate-63	dependencies	minor	3.15.5 → 3.16.0
org.hibernate:hibernate-core (source)	dependencies	patch	6.6.56.Final → 6.6.58.Final
com.h2database:h2 (source)	dependencies	minor	2.4.240 → 2.5.252
com.google.guava:guava	dependencies	patch	33.7.1-jre → 33.7.2-jre
org.apache.groovy:groovy-xml (source)	dependencies	patch	5.1.1 → 5.1.3
org.apache.groovy:groovy-json (source)	dependencies	patch	5.1.1 → 5.1.3
org.apache.groovy:groovy-all (source)	dependencies	patch	5.1.1 → 5.1.3
ar.com.fdvs:DynamicJasper	dependencies	minor	5.3.9 → 5.4.1
org.apache.commons:commons-lang3 (source)	dependencies	minor	3.20.0 → 3.21.0
org.checkerframework:checker-qual (source)	dependencies	minor	4.2.2 → 4.3.0	4.3.1
com.mchange:c3p0 (source)	dependencies	patch	0.14.1 → 0.14.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

getsentry/sentry-java (io.sentry:sentry-logback)

v8.59.0

Compare Source

Breaking Changes

• Capture direct Sentry.logger() and Sentry.metrics() calls regardless of options.getLogs().isEnabled() and options.getMetrics().isEnabled() (#​6184)
  • Automatic logging integrations still only capture logs when options.getLogs().isEnabled() is true. options.getMetrics().setEnabled(...) currently has no effect because there are no automatic Metrics integrations. Both enable options will be removed in the upcoming major release, and each logging integration will then have a separate opt-in flag.
  • Use options.getLogs().setBeforeSend(...) and options.getMetrics().setBeforeSend(...) to filter manually emitted telemetry. Return null from either callback to drop it.

Fixes

• Keep the videos of already captured session replay segments when the replay stops, so segments that are still queued are no longer sent without their video (#​6177)

Features

• Deprecate sendDefaultPii in favor of dataCollection ahead of its removal in 9.0 (#​6158)
• Make the tombstone merge time threshold configurable via SentryAndroidOptions.setTombstoneMergeTimeThresholdMillis and the io.sentry.tombstone.merge-time-threshold-millis manifest option (#​6154)
• Add sentry-apollo-5 integration for Apollo Kotlin 5, providing HTTP tracing and failed GraphQL request reporting (#​6074)
• Add OkHttp autoconfiguration for Spring Boot (#​5797)

Fixes

• Prevent infinite loops when capturing exceptions with cyclic cause chains (#​6073)

Improvements

• Recover Android 17 MemoryLimiter app exits recorded as ApplicationExitInfo.REASON_MEMORY_LIMITER (#​6174)

Dependencies

• Bump Native SDK from v0.16.6 to v0.17.1 (#​6135)
  • changelog
  • diff

v8.58.0

Compare Source

Features

• Add LocalSentrySpan to sentry-compose so apps can provide a parent ISpan to a composable subtree and have nested SentryTraced spans attach to it ([#​6112]#​6112)
• Add dataCollection, a fine-grained replacement for sendDefaultPii, for controlling data collected automatically by SDK integrations. See the Data Collection documentation for Android, Java, and Spring Boot (#​5759)

[!WARNING]
sendDefaultPii will be removed in the next major SDK version. Migrate to dataCollection before upgrading.

Fixes

• Disable URL caching when reading META-INF/MANIFEST.MF files during version detection so that the SDK no longer keeps jar file handles open for the life of the process (#​6124
• Keep the EventListener wrapped by SentryOkHttpEventListener per Call (#​6003)

v8.57.0

Compare Source

Behavioral Changes

• Measure HTTP rate-limit backoff on a monotonic clock instead of the wall clock, so that a device time change no longer lifts or extends an active rate limit (#​6030)

Features

• Add Android SDK support for reporting MemoryLimiter app exits recovered from ApplicationExitInfo (#​6111).
• Sentry can now configure Log4j2 automatically for Spring Boot 4 when sentry-log4j2 is on the classpath and Log4j2 Core is the active logging backend (#​5403)
  • Enable automatic appender registration with:

    sentry.logging.enabled=true

    Automatic registration is disabled by default for now and will be enabled by default in the next major release.
  • The appender is attached to the root logger by default. To attach it to specific loggers instead, configure one or more non-overlapping logger names:

    sentry.logging.loggers[0]=com.example
    sentry.logging.loggers[1]=org.example

  • Configure the minimum level for creating breadcrumbs. The default is INFO:

    sentry.logging.minimum-breadcrumb-level=INFO

  • Configure the minimum level for creating Sentry error events. The default is ERROR:

    sentry.logging.minimum-event-level=ERROR

  • Configure the minimum level for sending Sentry structured logs. The default is INFO:

    sentry.logging.minimum-level=INFO

    Structured logs must also be enabled:

    sentry.logs.enabled=true

• Sentry can now configure Log4j2 automatically for Spring Boot 3 when sentry-log4j2 is on the classpath and Log4j2 Core is the active logging backend (#​6072)
  • Disabled by default for now; enable it and configure levels the same way as described in the Spring Boot 4 entry above (sentry.logging.enabled=true)

Fixes

• Support ws and wss URL parsing for WebSocket instrumentation (#​6064)
• Keep resolving the server name after Sentry.close() or a re-init. Closing the SDK shut down the shared hostname cache for the life of the process, so server_name silently froze at the value it had last resolved (#​6119)
• Order breadcrumbs by the timestamp they carry rather than by when they were created in the current process, so breadcrumbs restored from disk or handed over by a hybrid SDK no longer sort as if they had just happened (#​6097)

Internal

• Deprecate RateLimiter(ICurrentDateProvider, SentryOptions) in favor of RateLimiter(SentryOptions), whose backoff is measured on a monotonic ticker (#​6030)
• Deprecate AndroidCurrentDateProvider.getInstance() in favor of MonotonicTicker, which counts time spent in deep sleep and cannot be confused with the epoch-based CurrentDateProvider (#​6103)

v8.56.0

Compare Source

Fixes

• Update SentryTraced so that it now honors options.setIgnoredSpanOrigins (#​6058)
• SentryTraced now checks for its owning transaction dynamically rather than once per app process. The latter caused SentryTraced spans to be dropped process-wide once the original transaction finished (#​6057)
• Fix typos in Spring GraphQL integration names (GrahQL to GraphQL) (#​6061)
• Populate the Android connection status cache during the first two minutes after boot, instead of treating the empty cache as up to date (#​6029)
• Prevent SentryTraced from producing dangling spans if recomposition is abandoned or drawing fails (#​6049)
• Report a consistent app start type across the app start measurement, contexts.app and the app.start span attributes (#​6006)

Improvements

• Emit a single ui.compose span per SentryTraced on initial composition instead of one on every recomposition, and set the origin on ui.render spans (#​6051)

Internal

• Add an internal MonotonicTicker abstraction with Deadline and Stopwatch primitives (#​6028)
• Add internal Timestamp, EpochClock and AnchoredClock, so related instants project from one wall-clock reading instead of each reading the clock (#​6045)

Dependencies

• Bump Native SDK from v0.16.5 to v0.16.6 (#​6079)
  • changelog
  • diff

v8.55.0

Compare Source

Features

• Add Session.State.Unhandled for unhandled errors that do not terminate the process (#​5919)

Improvements

• Move ANR profiling out of experimental (#​6042)

Fixes

• Keep dropped tombstone and ANR events dropped, instead of reporting the same app exit again at every app start (#​6002)
• Clear the persisted replay id on SDK init, so a replay id from a previous process is no longer attached to ANR events from the current one (#​6033)
• Apply Sentry.withScope and Sentry.withIsolationScope data to events captured inside the callback when globalHubMode is enabled (#​6004)
  • globalHubMode is enabled by default on Android, where tags, extras, contexts and level set inside the callback were silently dropped
  • Scopes that are explicitly made current, e.g. via Sentry.setCurrentScopes or the SentryContext coroutine integration, are now also honoured when globalHubMode is enabled
  • Sentry.pushScope, Sentry.pushIsolationScope and Sentry.popScope remain no-ops when globalHubMode is enabled
• Drop the profiler_id from transactions and spans when no Perfetto profile covers them, e.g. when Android's ProfilingManager rate limits the profiling request (#​6015)
• Prevent events from being dropped when feature flags are added while an event is being captured (#​5989)

Internal

• Add InternalSentrySdk.captureEnvelopeNonTerminating for hybrid SDKs (e.g. Flutter) so unhandled exceptions that don't terminate the process no longer end the session as crashed (#​5921)
• Add InternalSentrySdk.updateSessionForDroppedEventNonTerminating so hybrid SDKs can still update the session when an error is dropped by sampling (#​5990)

Dependencies

• Bump Native SDK from v0.16.4 to v0.16.5 (#​6034)
  • changelog
  • diff

mockito/mockito (org.mockito:mockito-core)

v5.24.0

^{Changelog generated by Shipkit Changelog Gradle Plugin}

5.24.0

• 2026-09-23 - 27 commit(s) by Andrei Solntsev, DragonFSKY, Hünkar Can Tunç, Joshua Selbo, M. Minot, Markus Gaisbauer, Mirko Alicastro, Vinod Kumar M ( codingkiddo ), dependabot[bot]
• Fix Mockito docs for -javaagent flag with Gradle (#​3866)
• Kotlin example for adding Mockito as an agent is incorrect (#​3864)
• Bump graalvm/setup-graalvm from 1.6.3 to 1.6.6 (#​3862)
• Bump gradle/actions from 6.2.0 to 6.3.0 (#​3852)
• Bump gradle/actions from 5 to 6.2.0 (#​3851)
• Preserve method parameters when clearing inline mocks (#​3847)
• Bump graalvm/setup-graalvm from 1.6.0 to 1.6.3 (#​3845)
• Print object fields via reflection when toString() is not implemented (#​3844)
• Migrate extensions-tests to JUnit Jupiter (#​3840)
• Bump graalvm/setup-graalvm from 1.5.6 to 1.6.0 (#​3839)
• docs(when-verify): fixes to explanations about redundancy (#​3838)
• Confusing inconsistency in example method calls in “stubbing and verifying is redundant” note of “when” and “verify” Javadoc (#​3837)
• Bump actions/checkout from 6 to 7 (#​3836)
• Fixes #​2740 : Add mockMaker option to @Spy annotation (#​3835)
• Bump graalvm/setup-graalvm from 1.5.5 to 1.5.6 (#​3834)
• Bump graalvm/setup-graalvm from 1.5.4 to 1.5.5 (#​3833)
• Bump codecov/codecov-action from 6 to 7 (#​3831)
• Bump graalvm/setup-graalvm from 1.4.5 to 1.5.4 (#​3830)
• Fix clearInlineMocks not de-registering singleton mocks (#​3829)
• Fix NotAMockException when using mockSingleton with MockitoJUnit (#​3827)
• NotAMockException when using mockSingleton with MockitoSession or MockitoJUnit (#​3826)
• Improve Gradle agent docs for configuration cache (#​3823)
• Gradle documentation for setting up instrumentation with Gradle configuration cache (#​3822)
• Fixes #​3818 : Fix data race in InvocationContainerImpl.invocationForStubbing (#​3819)
• Data race on invocationForPotentialStubbing (#​3818)
• Fixes #​3814 : implement package-level clinit suppression (#​3815)
• Package-level clinit suppression (#​3814)
• Upgrade Android Gradle Plugin to 8.13.2 (#​3812)
• Replaces raw generic types with type parameters (#​3806)
• Fixes #​2398 : Implement global suppress static initialization leveraging java agent (#​3801)
• Bump codecov/codecov-action from 5 to 6 (#​3800)
• Fix non-deterministic AssertionError when using MockMakers.SUBCLASS (#​3406, #​2823) (#​3795)
• Fixes #​3536 : Implement SpyStatic API (#​3794)
• The class's MethodParameters are removed after clearAllCaches is invoked (#​3763)
• [FeatureRequest / Idea] Create Mockito.spyStatic (#​3536)
• Add option to specify mockmaker for @Spy (#​2740)
• How can I suppress static initializer? (#​2398)

JodaOrg/joda-time (joda-time:joda-time)

v2.15.0

Compare Source

See the change notes for more information.

What's Changed

• Fix DelegatedDurationField by @​jodastephen in #​838
• Update time zone data to 2026egtz by @​jodastephen in #​841

Full Changelog: JodaOrg/joda-time@v2.14.4...v2.15.0

v2.14.4

Compare Source

See the change notes for more information.

What's Changed

• Update time zone data to 2026dgtz by @​jodastephen in #​836

Full Changelog: JodaOrg/joda-time@v2.14.3...v2.14.4

vladmihalcea/hypersistence-utils (io.hypersistence:hypersistence-utils-hibernate-63)

v3.16.0

================================================================================

NullPointerException is thrown when JsonType is used to persist an @​Embeddable #​866

EnumArrayType throws NullPointerException when the entity is audited with Hibernate Envers #​863

Inet cannot be cast to java.lang.Comparable #​843

JsonBinaryType causes deserialization errors after upgrading to Spring Boot 4 #​839

Add support for pgvector #​647

StringArrayType.INSTANCE is not working with a two-dimensional String array parameter on PostgreSQL #​436

hibernate/hibernate-orm (org.hibernate:hibernate-core)

v6.6.58.Final

Compare Source

v6.6.57.Final

Compare Source

intive-FDV/DynamicJasper (ar.com.fdvs:DynamicJasper)

v5.4.1

Compare Source

v5.4.0

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "after 5pm on the first day of the month,on the first day of the month"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.