Skip to content

[dependency]: Bump the core-dependencies group across 1 directory with 7 updates - #989

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/maven/core/dev/core-dependencies-67bbf43473
Open

[dependency]: Bump the core-dependencies group across 1 directory with 7 updates#989
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/maven/core/dev/core-dependencies-67bbf43473

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the core-dependencies group with 7 updates in the /core directory:

Package From To
commons-codec:commons-codec 1.22.0 1.23.0
org.codehaus.mojo:versions-maven-plugin 2.21.0 2.23.0
org.apache.maven.plugins:maven-compiler-plugin 3.15.0 3.16.0
org.apache.maven.plugins:maven-jar-plugin 3.5.0 3.5.1
org.codehaus.mojo:build-helper-maven-plugin 3.6.1 3.6.2
org.apache.maven.plugins:maven-surefire-plugin 3.5.6 3.6.0
org.apache.maven.plugins:maven-failsafe-plugin 3.5.6 3.6.0

Updates commons-codec:commons-codec from 1.22.0 to 1.23.0

Changelog

Sourced from commons-codec:commons-codec's changelog.

Apache Commons Codec 1.23.0 Release Notes

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.23.0.

The Apache Commons Codec component contains encoders and decoders for formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

New features

  •         Add and use PhoneticEngine.Builder and deprecate old constructors. Thanks to Gary Gregory.

  •         Add BeiderMorseEncoder.Builder and deprecate old constructor. Thanks to Gary Gregory.

  •         Add PhoneticEngine.Builder.setMaxInputLength(int). Thanks to Yu Bao, Gary Gregory.

  •         Add Base45 support. Thanks to Gary Gregory.

  •         Add URLCodec.decodeUrl(BitSet, byte[]) to decode with a custom safe set. Thanks to Gary Gregory.

Fixed Bugs

  •         GitIdentifiers orders tree entries by unsigned UTF-8 bytes, as Git does, instead of UTF-16 code units. Thanks to Jeff Lenamon.

  •         Optimize PhoneticEngine.encode(String, LanguageSet) for speed. Thanks to Yu Bao, Gary Gregory.

  •         RFC1522Codec.decodeText(String) now throws a DecoderException instead of a StringIndexOutOfBoundsException when a separator is missing. Thanks to Yu Bao, Gary Gregory.

  •         Optimize Base58.convertFromBase58(byte[], Context) for speed and temporary object allocation. Thanks to Yu Bao, Gary Gregory.

  •         Allocate a single MessageDigest and use it in Sha2Crypt.sha2Crypt(byte[], String, String, int, String). Thanks to Yu Bao, Gary Gregory.

  •         Javadoc improvements. Thanks to Gary Gregory.

  •         Throw IOException instead of IllegalArgumentException in BaseNCodecOutputStream and BaseNCodecOutputStream IO methods. Thanks to Gary Gregory.

  •         Throw DecoderException instead of IllegalArgumentException in RFC1522Codec.decodeText(String). Thanks to Gary Gregory.

  •         Fix Blake3 KDF example and clarify finalization semantics. Thanks to Gary Gregory.

  •         Base32 and Base64 STRICT decoding now require the encoder's canonical alphabet, padding, and line separators, and validate streams through EOF. Use LENIENT to retain permissive decoding. Thanks to Gary Gregory.

  •         Limit Base58 decoding to 8192 encoded bytes by default, checking cumulative stream input before buffering. Use Base58.Builder.setMaxDecodeLength(int) for larger trusted input. Encoding defaults to a configurable 8192-byte binary input limit through Base58.Builder.setMaxEncodeLength(int). Thanks to Gary Gregory.

  •         Grow Base58 accumulation buffers geometrically within the configured input limits and validate actual accumulated length. Thanks to Gary Gregory.

  •         Implement Base58 encoded-length calculation and explicitly reject unsupported line chunking. Thanks to Gary Gregory.

  •         Close the underlying BaseNCodecOutputStream output even when final conversion or flushing fails, preserving suppressed close exceptions. Thanks to Gary Gregory.

  •         Reject invalid GitIdentifiers tree entry names and file/directory name conflicts to prevent ambiguous tree serialization and colliding identifiers. Thanks to Gary Gregory.

  •         Hex decoding now accepts only ASCII hexadecimal characters (0-9, A-F, a-f). Previously accepted non-ASCII Unicode digits and fullwidth letters now cause DecoderException, including when supplied as UTF-8 bytes or ByteBuffers. Thanks to Gary Gregory.

  •         Restrict Hex decoding to ASCII hexadecimal characters. Thanks to Gary Gregory.

  •         Validate BinaryCodec input while preserving leading-bit truncation. Thanks to Gary Gregory.

  •         Reject oversized Beider-Morse input before language guessing. Thanks to Gary Gregory.

  •         QuotedPrintableCodec decoding now preserves hard CRLF line breaks and, leniently, unpaired CR and LF bytes instead of discarding them. Soft line breaks require the full =CRLF sequence; previously accepted =CR without LF now throws DecoderException. This affects both constructor modes and QCodec, which shares the decoder. Thanks to Gary Gregory.

  •         Bound Sha2Crypt rounds from caller-supplied salts. Thanks to Gary Gregory.

  •         Bound Sha2Crypt password length to prevent quadratic CPU DoS. Thanks to Gary Gregory.

  •         Make the @param names in BaseNCodec match the parameters they document ([#444](https://github.com/apache/commons-codec/issues/444)). Thanks to geonseok, Gary Gregory.
  • CODEC-345: Restore URLCodec.encodeUrl(BitSet, byte[]) support for custom safe sets containing percent and plus, and document the decoding limitations. Thanks to Ganesh Gautam, Gary Gregory.
  • CODEC-245: Reject malformed Sha2Crypt salt syntax (#445). Thanks to Efe, Gary Gregory.

... (truncated)

Commits
  • 1147e78 Add github.autolink_jira
  • 129a289 Prepare for the release candidate 1.23.0 RC1
  • d7bff67 Prepare for the release candidate
  • 89d6498 Update GH CI from Java 26 to 27
  • 5444a15 [test] Bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0
  • 6685826 Bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0 (#446)
  • 7221073 Parameterize some unit tests
  • cb9c04d Parameterize some unit tests
  • 6837802 [CODEC-245] Reject malformed Sha2Crypt salt syntax
  • 3e05f66 [CODEC-245] Reject malformed Sha2Crypt salt syntax (#445)
  • Additional commits viewable in compare view

Updates org.codehaus.mojo:versions-maven-plugin from 2.21.0 to 2.23.0

Release notes

Sourced from org.codehaus.mojo:versions-maven-plugin's releases.

2.23.0

Versions Maven Plugin 2.23.0 makes the property goals more reliable on multi-module projects and adds a few options people have asked for over the years. It still runs on Java 8 and Maven 3.6.3 or later.

Property updates

  • update-property and update-properties now update a property that is defined in a reactor parent POM, rather than leaving it untouched (#997).
  • A property shared by a plugin and an excluded dependency is no longer updated behind the exclude's back (#1199).
  • The property goals look up all properties in parallel, which shortens runs on POMs with many version properties (#1157).
  • A dependency whose type or classifier is itself a property, such as ${native.classifier}, no longer breaks the property goals on Maven 3.10 and 4 (#1409).
  • lock-snapshots and unlock-snapshots now rewrite snapshot versions held in properties, where that is safe (#1269).

Other fixes and additions

  • versions:set with selected projects (-pl) updates the modules that inherit the version again, on Maven 3 and Maven 4 (#1338, #1339, #1357).
  • Includes and excludes now filter the candidate versions too, so an excluded version is never proposed as an update (#1378).
  • display-dependency-updates -Dversions.showNewestPerSegment lists the newest incremental, minor and major version, for example 1.0.3 -> 1.0.9, 1.3.9, 4.0.6 (#1043).
  • parent-updates-report supports formats, including XML (#975), and the XML property updates report now fills in the current version (#976).
  • The plugin update reports share their lookup with display-plugin-updates and include plugins declared only in <reporting> (#1250).

Thanks to @​wilx and @​adityaanikam for their contributions to this release.

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

... (truncated)

Commits
  • 701cf76 [maven-release-plugin] prepare release 2.23.0
  • 05854d0 Mark the API added since 2.22.0 as @​since 2.23.0
  • a8fac27 Prepare 2.23.0
  • 58a2ea5 Resolve property versions in parallel
  • 4a89885 Update a shared parent POM from one module at a time
  • 2230fbe Update properties defined in a reactor parent POM
  • b495844 Honor excludes of modules that inherit an update-properties property
  • 3330666 Show the newest version of each segment in display-dependency-updates
  • fe0be9a Rewrite timestamped and SNAPSHOT versions held in properties in unlock-snapsh...
  • bfb8f3a Support the xml format in parent-updates-report
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0

Release notes

Sourced from org.apache.maven.plugins:maven-compiler-plugin's releases.

3.16.0

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

📦 Dependency updates

Commits
  • e7bba6e [maven-release-plugin] prepare release maven-compiler-plugin-3.16.0
  • c906809 Avoid using deprecated method CompilerConfiguration.setCompilerVersion
  • ad74fee Replace adopt-openj9 by semeru JDK distribution on GH
  • beb0eda Recompile when dependencies change (#1102)
  • a0b689e [MCOMPILER-578] Track outputs across compiler executions (#1091)
  • 2e81228 Fix incremental detection of empty sources, 3.x (#1075)
  • 2132f5b configure ATR project
  • 5992b77 Build fails when annotation processor list is empty (but present) (#1077)
  • acccef7 Bump plexusCompilerVersion from 2.16.2 to 2.17.0
  • 72bc445 Bump org.codehaus.plexus:plexus-java from 1.5.2 to 1.6.0
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1

Release notes

Sourced from org.apache.maven.plugins:maven-jar-plugin's releases.

3.5.1

📝 Documentation updates

  • Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#550) @​potiuk

👻 Maintenance

  • Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#550) @​potiuk
  • Use plugin version properties (3.x) (#535) @​Bukama

📦 Dependency updates

Commits
  • b0cd63d [maven-release-plugin] prepare release maven-jar-plugin-3.5.1
  • 5318a4f Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability
  • 8e0b9bb Bump org.apache.maven.plugins:maven-plugins from 48 to 49 (#547)
  • d5a438b Fix javadoc
  • 774fac9 Bump org.codehaus.plexus:plexus-archiver from 4.11.0 to 4.12.0
  • b71f403 Bump mavenVersion from 3.9.15 to 3.9.16 (#536)
  • 9f2a001 Use plugin version properties (3.x) (#535)
  • 68a978f Bump org.apache.maven.plugins:maven-plugins from 47 to 48 (#534)
  • e105821 Bump commons-io:commons-io from 2.21.0 to 2.22.0 (#529)
  • 953dc1a Bump mavenVersion from 3.9.14 to 3.9.15 (#528)
  • Additional commits viewable in compare view

Updates org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2

Release notes

Sourced from org.codehaus.mojo:build-helper-maven-plugin's releases.

3.6.2

🐛 Bug Fixes

👻 Maintenance

  • Remove redundant maven-resolver-api dependency and ignore Resolver/SLF4J 2.x in Dependabot (#248) @​slachiewicz

📦 Dependency updates

Commits
  • 813bc7d [maven-release-plugin] prepare release 3.6.2
  • 07d9109 Remove redundant maven-resolver-api and ignore Resolver/SLF4J 2.x in Dependabot
  • 9abd552 Bump org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0
  • 3c15526 Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml
  • 3b1f104 Bump org.codehaus.mojo:mojo-parent from 96 to 97
  • 1749855 Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml
  • 5230041 Bump org.codehaus.plexus:plexus-utils from 4.0.2 to 4.0.3
  • c0e9375 Delete .github/release-drafter.yml
  • 84a839e Bump org.codehaus.mojo:mojo-parent from 95 to 96
  • a85c668 Replace raw NPEx with customized exception message
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0

Release notes

Sourced from org.apache.maven.plugins:maven-surefire-plugin's releases.

3.6.0

Please refer to the main page for what's new https://maven.apache.org/surefire/ And the migration page https://maven.apache.org/surefire/maven-surefire-plugin/whats-new-3-6-0.html

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

... (truncated)

Commits
  • 0ff622b [maven-release-plugin] prepare release surefire-3.6.0
  • bb3932a Let's go for 3.6.0 release
  • 3002a16 Bump mavenVersion from 3.9.14 to 3.9.16
  • 61a531d Bump Maven parent version from 47 to 49 (#3449)
  • e52ead4 [SUREFIRE-523] Link all reported tests to source XRef (#3445)
  • 45102fa [SUREFIRE-3446] Fix direct selection of JUnit Jupiter @​Nested classes (#3447)
  • b2e1f70 Fix #3303: distinguish JUnit 6 ParameterizedClass invocations (#3432)
  • c051938 Discover tests in a fork when a toolchain JDK is used (#3444)
  • db75df8 Bump org.codehaus.plexus:plexus-java from 1.5.2 to 1.6.0 (#3441)
  • 77f2759 Bump org.codehaus.plexus:plexus-interpolation from 1.29 to 1.30.0
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-failsafe-plugin from 3.5.6 to 3.6.0

Release notes

Sourced from org.apache.maven.plugins:maven-failsafe-plugin's releases.

3.6.0

Please refer to the main page for what's new https://maven.apache.org/surefire/ And the migration page https://maven.apache.org/surefire/maven-surefire-plugin/whats-new-3-6-0.html

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

... (truncated)

Commits
  • 0ff622b [maven-release-plugin] prepare release surefire-3.6.0
  • bb3932a Let's go for 3.6.0 release
  • 3002a16 Bump mavenVersion from 3.9.14 to 3.9.16
  • 61a531d Bump Maven parent version from 47 to 49 (#3449)
  • e52ead4 [SUREFIRE-523] Link all reported tests to source XRef (#3445)
  • 45102fa [SUREFIRE-3446] Fix direct selection of JUnit Jupiter @​Nested classes (#3447)
  • b2e1f70 Fix #3303: distinguish JUnit 6 ParameterizedClass invocations (#3432)
  • c051938 Discover tests in a fork when a toolchain JDK is used (#3444)

@dependabot dependabot Bot added the core Related to the Core Java package label Sep 19, 2026
@Wayonb
Wayonb force-pushed the dependabot/maven/core/dev/core-dependencies-67bbf43473 branch from b45979c to 713e670 Compare October 7, 2026 19:49
@Wayonb

Wayonb commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

@dependabot recreate

@dependabot
dependabot Bot force-pushed the dependabot/maven/core/dev/core-dependencies-67bbf43473 branch 2 times, most recently from bcee7dd to 2c18946 Compare October 10, 2026 15:13
@dependabot
dependabot Bot force-pushed the dependabot/maven/core/dev/core-dependencies-67bbf43473 branch from 2c18946 to a438f49 Compare October 17, 2026 15:12
@github-actions github-actions Bot mentioned this pull request Oct 18, 2026
Open
@dependabot @Wayonb
[dependency]: Bump the core-dependencies group across 1 directory wit…
64fa5ad 
…h 7 updates

Bumps the core-dependencies group with 7 updates in the /core directory:

| Package | From | To |
| --- | --- | --- |
| [commons-codec:commons-codec](https://github.com/apache/commons-codec) | `1.22.0` | `1.23.0` |
| [org.codehaus.mojo:versions-maven-plugin](https://github.com/mojohaus/versions) | `2.21.0` | `2.23.0` |
| [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) | `3.15.0` | `3.16.0` |
| [org.apache.maven.plugins:maven-jar-plugin](https://github.com/apache/maven-jar-plugin) | `3.5.0` | `3.5.1` |
| [org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin) | `3.6.1` | `3.6.2` |
| [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.5.6` | `3.6.0` |
| [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire) | `3.5.6` | `3.6.0` |



Updates `commons-codec:commons-codec` from 1.22.0 to 1.23.0
- [Changelog](https://github.com/apache/commons-codec/blob/master/RELEASE-NOTES.txt)
- [Commits](apache/commons-codec@rel/commons-codec-1.22.0...rel/commons-codec-1.23.0)

Updates `org.codehaus.mojo:versions-maven-plugin` from 2.21.0 to 2.23.0
- [Release notes](https://github.com/mojohaus/versions/releases)
- [Changelog](https://github.com/mojohaus/versions/blob/master/ReleaseNotes.md)
- [Commits](mojohaus/versions@2.21.0...2.23.0)

Updates `org.apache.maven.plugins:maven-compiler-plugin` from 3.15.0 to 3.16.0
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.15.0...maven-compiler-plugin-3.16.0)

Updates `org.apache.maven.plugins:maven-jar-plugin` from 3.5.0 to 3.5.1
- [Release notes](https://github.com/apache/maven-jar-plugin/releases)
- [Commits](apache/maven-jar-plugin@maven-jar-plugin-3.5.0...maven-jar-plugin-3.5.1)

Updates `org.codehaus.mojo:build-helper-maven-plugin` from 3.6.1 to 3.6.2
- [Release notes](https://github.com/mojohaus/build-helper-maven-plugin/releases)
- [Commits](mojohaus/build-helper-maven-plugin@3.6.1...3.6.2)

Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.5.6 to 3.6.0
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.5.6...surefire-3.6.0)

Updates `org.apache.maven.plugins:maven-failsafe-plugin` from 3.5.6 to 3.6.0
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.5.6...surefire-3.6.0)

---
updated-dependencies:
- dependency-name: commons-codec:commons-codec
  dependency-version: 1.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: core-dependencies
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-version: 3.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: core-dependencies
- dependency-name: org.apache.maven.plugins:maven-failsafe-plugin
  dependency-version: 3.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: core-dependencies
- dependency-name: org.apache.maven.plugins:maven-jar-plugin
  dependency-version: 3.5.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: core-dependencies
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-version: 3.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: core-dependencies
- dependency-name: org.codehaus.mojo:build-helper-maven-plugin
  dependency-version: 3.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: core-dependencies
- dependency-name: org.codehaus.mojo:versions-maven-plugin
  dependency-version: 2.22.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: core-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@Wayonb
Wayonb force-pushed the dependabot/maven/core/dev/core-dependencies-67bbf43473 branch from a438f49 to 64fa5ad Compare October 22, 2026 17:06

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

core Related to the Core Java package

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Wayonb