Bump the minor-and-patch group across 1 directory with 4 updates

[dependabot]

Bumps the minor-and-patch group with 4 updates in the / directory: com.github.oshi:oshi-core, org.springdoc:springdoc-openapi-starter-webmvc-ui, org.jsoup:jsoup and gradle-wrapper.

Updates com.github.oshi:oshi-core from 7.4.2 to 7.4.4

Release notes

Sourced from com.github.oshi:oshi-core's releases.

Release 7.4.4

Bug Fixes and Improvements

• #3561: Fix AIX reporting the current instant as its boot time, and an uptime of zero, when the uptime command transiently failed; parse the year-less who -b format AIX 7.3 emits, and add ParseUtil.parseYearlessDateToEpoch - @​dbwiddis.
• #3562: Make Linux getMaxFreq() reproducible by resolving it from the cpufreq policy, lshw, and the vendor frequency rather than folding in a live frequency reading, returning -1 when none of those reports a maximum - @​dbwiddis.
• #3564: Fix Linux getSoftOpenFileLimit() returning -1 for a process whose hard open-file limit is unlimited, discarding a valid soft limit - @​dbwiddis.
• #3566: Read the OpenBSD host name from gethostname rather than resolving it, so getHostName() no longer reports localhost on a host whose name is not resolvable - @​dbwiddis.
• #3568: Fix the Windows FFM getProcess(pid) and getProcesses(pids) returning a process that getProcesses() does not list, reporting a recently exited process as running with no path, no threads, and no CPU time - @​dbwiddis.
• #3569: Fix three JNA/FFM divergences on the file-system and network paths: the macOS FFM file store never bailed when the DiskArbitration session failed to open (the guard tested a foreign pointer for Java null, which it can never be); Windows volumes whose mount-point list exceeds the buffer were dropped rather than re-read on ERROR_MORE_DATA (missing entirely on JNA, keyed on the wrong error code on FFM); and the Windows FFM TCP/UDP connection queries could transiently return no connections under connection churn, where JNA retries on ERROR_INSUFFICIENT_BUFFER - @​dbwiddis.
• #3573: Report Linux VRAM from NVML rather than summing the prefetchable PCI BARs, which measures the card's address aperture (capped at 256 MiB without Resizable BAR) instead of its memory size - @​Krillsson.
• #3574: Never report a decrease in a BSD process's or thread's kernel or user time across updateAttributes(). DragonFly's ps TIME column sums only the currently live LWPs, so an exiting thread takes its accumulated CPU time out of the process total - @​dbwiddis.
• #3577: Fix macOS OSProcess#getArguments() and getEnvironmentVariables() corrupting every entry after one containing a non-ASCII character. The KERN_PROCARGS2 parser advanced its offset by each entry's length in characters rather than bytes, landing mid-character and returning garbage in place of the remaining arguments - @​dbwiddis.
• #3578: Fix the Windows JNA AMD GPU path reporting a power draw of -1 on Overdrive 6-era Radeon cards. Power draw is read through the Overdrive 6 API but was gated on Overdrive N support, rejecting the cards that implement the call; the Overdrive capability check also ignored the library's supported flag - @​dbwiddis.
• #3579: Align the macOS FFM firmware, baseboard, computer system, and CPU manufacturer strings with the JNA backend when decoding IORegistry byte properties, which are NUL-terminated within a fixed-width buffer. The FFM path stripped every NUL and trimmed, so a property holding several NUL-separated strings would be returned concatenated and significant leading or trailing spaces discarded, where the JNA twin stopped at the first NUL. Add ParseUtil.decodeNulTerminated and decode through it on both backends - @​dbwiddis.
• #3581: Fix ParseUtil.parseHertz throwing NumberFormatException instead of returning the documented -1 when the decimals are introduced by something other than a decimal point, such as the comma separator a localized frequency string can carry - @​dbwiddis.
• #3582: Fix AIX dropping the highest-pid processes from getProcesses(), and getProcess() returning null for them, when enough processes spawn between the two perfstat_process calls to overrun the padded buffer. Because perfstat sorts by pid, the entry most often lost is the calling JVM's own - @​dbwiddis.
• #3583: Guarantee OperatingSystem#getCurrentProcess() never returns null. It delegated to getProcess(int), which is documented to return null, so a failed read of the calling process left every non-Linux getCurrentThread() throwing a NullPointerException - @​dbwiddis.

Full change log

Release 7.4.3

Bug Fixes and Improvements

• #3526: Fix a potential NullPointerException in the macOS FFM process backend when an IOPlatformDevice entry has no readable name, and guard the native passwd/group struct dereferences against a null return - @​dbwiddis.
• #3527: Consolidate the SLF4J log level dispatch duplicated in ExceptionUtil and PerfDataUtil into a new oshi.util.LogUtil, whose isEnabled method offers the slf4j 1.x-compatible equivalent of Logger#isEnabledForLevel - @​dbwiddis.
• #3531: Stop reporting an implausible CPU or GPU temperature on Apple Silicon. An idle core cluster is power-gated and its die sensors then report a fixed parked value below room ambient, which was previously returned as a reading; Sensors#getCpuTemperature now reports 0 (unavailable) instead - @​dbwiddis.
• #3535: Fix Sensors#getCpuTemperature returning 0 on Apple Silicon chips whose per-core SMC keys differ from the hardcoded set (e.g. the M3 Pro, where all five are absent). Prefer the chip-independent, firmware-computed CPU-die aggregate keys TCMb (die average) and TCMz (die max) before the per-core keys, reporting the die average - @​dbwiddis.
• #3536: Discover Apple Silicon GPU temperature SMC keys at runtime instead of reading a fixed list of four chip-specific keys, and report the hottest GPU cluster rather than the first one found. Adds oshi.os.mac.sensors.gputemperature.keys to override the discovered keys - @​dbwiddis.
• #3541: Identify Apple Silicon chips at runtime rather than from hardcoded tables that stopped at the M4. PhysicalProcessor#getEfficiency now classifies performance and efficiency cores from the IORegistry cluster-type property, fixing an all-zero classification (and the degraded per-core frequencies that followed from it) on newer chips, and ProcessorIdentifier#getMicroarchitecture falls back to a description derived from the core codenames instead of reporting unknown. An entry in oshi.architecture.properties still takes precedence where one exists - @​dbwiddis.
• #3555: Fix Linux graphics cards all reporting the same VRAM, DRM device and GPU metrics: request the stable lspci -vnnmm machine-readable format so the Slot: field exists, stop discarding the PCI slot when entering a card record, and identify display controllers by PCI class 0x03 rather than a VGA substring match (expands to include XGA and others) - @​Krillsson.

Full change log

Changelog

Sourced from com.github.oshi:oshi-core's changelog.

Commits

• 3df3d3b [maven-release-plugin] prepare release oshi-parent-7.4.4
• 62543ba 7.4.4 Release
• a16e1ab Synchronize the BSD ps-family updateAttributes instead of suppressing S3078 (...
• cd7034c Drop the dead attempt bound from the AIX perfstat loop guards
• 6ed5e8d Update github/codeql-action digest to 5595cca (#3584)
• c7550d5 Thank the Claude for Open Source program, and widen the temporary-code note
• 65876d6 Update vmactions/netbsd-vm digest to 00081e8 (#3585)
• f5290f3 Guarantee getCurrentProcess() never returns null (#3583)
• fdafcf6 Document the semver boundary in AGENTS.md
• b2cdb43 Retry the AIX perfstat_process fill when the buffer filled exactly (#3582)
• Additional commits viewable in compare view

Updates org.springdoc:springdoc-openapi-starter-webmvc-ui from 3.0.3 to 3.1.0

Release notes

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's releases.

springdoc-openapi v3,1,0 released!

What's Changed

• Fix request-specific Swagger UI index transformations by @​limehee in springdoc/springdoc-openapi#3279
• Fix #3282: preserve nest() version predicate across all routes in nest by @​seonwooj0810 in springdoc/springdoc-openapi#3296
• Upgrade Spring Boot to version 4.1.0
• Upgrade Spring AI to version 2.0.0
• Upgrade swagger-core to version 2.2.52
• Upgrade swagger-ui to version 5.32.11
• #3307 – Act upon SonarQube warnings
• #3306 – Act upon SonarQube warnings

Added

• #3269 – Add mechanism to disable nullable for Kotlin properties
• Allow request-specific Swagger UI index transformation

Fixed

• #3304 – Kotlin parent class's field is not properly marked as nullable
• #3294 – Duplicated path getting swagger-config
• #3293 – Inconsistent OpenAPI schema naming with SNAKE_CASE: some Java record fields remain camelCase
• #3292 – Make WebProperties and WebMvcProperties optional in SwaggerConfig
• #3284 – Upgrade swagger-core from version 2.2.48 to 2.2.49
• #3282 – Preserve version from nest() predicate across all routes in nest
• #3281 – Stabilize Spring Data Page schema property order
• #3274 – Description disappears from the generated json after upgrade to 3.0.3
• #3270 – Validation annotation of ParameterObject property applied to PathVariable with the same name, even in unrelated endpoints
• #3266 – Upgrade swagger-core from version 2.2.47 to 2.2.48
• #3263 – Null key for a Map not allowed in JSON

Full Changelog: springdoc/springdoc-openapi@v3.0.3...v3.1.0

Changelog

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's changelog.

[3.1.0] - 2026-07-31

Added

• #3269 – Add mechanism to disable nullable for Kotlin properties
• Allow request-specific Swagger UI index transformation

Changed

• Upgrade Spring Boot to version 4.1.0
• Upgrade Spring AI to version 2.0.0
• Upgrade swagger-core to version 2.2.52
• Upgrade swagger-ui to version 5.32.11
• #3307 – Act upon SonarQube warnings
• #3306 – Act upon SonarQube warnings

Fixed

• #3304 – Kotlin parent class's field is not properly marked as nullable
• #3294 – Duplicated path getting swagger-config
• #3293 – Inconsistent OpenAPI schema naming with SNAKE_CASE: some Java record fields remain camelCase
• #3292 – Make WebProperties and WebMvcProperties optional in SwaggerConfig
• #3284 – Upgrade swagger-core from version 2.2.48 to 2.2.49
• #3282 – Preserve version from nest() predicate across all routes in nest
• #3281 – Stabilize Spring Data Page schema property order
• #3274 – Description disappears from the generated json after upgrade to 3.0.3
• #3270 – Validation annotation of ParameterObject property applied to PathVariable with the same name, even in unrelated endpoints
• #3266 – Upgrade swagger-core from version 2.2.47 to 2.2.48
• #3263 – Null key for a Map not allowed in JSON

Commits

• e04f91f [maven-release-plugin] prepare release v3.1.0
• 83551ce CHANGELOG.md update
• 4a2b5bd CHANGELOG.md update
• ad0a5a5 swagger-ui upgrade to version 5.32.11
• 6e14cb4 Fix sonarqube errors
• eae2056 Fix sonarqube errors
• b09a77b chore: act upon SonarQube warnings
• cc3d86d upgrade spring-ai to version 2.0.0
• df1c2ba spring-boot upgrade to 4.1.0
• b6e5212 Kotlin parent class's field is not properly marked as nullable. Fixes #3304
• Additional commits viewable in compare view

Updates org.jsoup:jsoup from 1.22.2 to 1.23.1

Release notes

Sourced from org.jsoup:jsoup's releases.

jsoup 1.23.1

jsoup Java HTML Parser release 1.23.1

jsoup 1.23.1 is out now, with a faster and more memory-efficient HTML parser, improved alignment with the HTML standard across noscript, CDATA, SVG, and MathML parsing, and safer, specification-correct HTTP redirects. The release also adds a fast immutable Element#classList(), direct outer-HTML output to an Appendable, and fixes across RCDATA parsing, XML conversion, tag-name handling, and Cleaner link detection.

Performance optimization was a major focus for this release. In our OpenJDK 21 benchmarks, ordinary string parsing is now 18% faster on average, parsing from an InputStream is 11% faster, and parsing with source position tracking is 70% faster while allocating 64% fewer bytes per document.

Source-tracked DOMs retain 58-65% less memory on representative medium-to-large documents, and the improvements hold under concurrent parsing without introducing new contention. Exact gains will naturally vary with document shape, JVM, and hardware.

This release also fixes a security issue in the Cleaner that could expose markup when malformed HTML is cleaned with a custom Safelist permitting certain raw-text elements. The built-in Safelists are unaffected.

jsoup is a Java library for working with real-world HTML and XML. It provides a very convenient API for extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors.

Download jsoup now.

Improvements

• Reduced retained memory when parsing with source position tracking enabled (Parser#setTrackPosition(true)). Source ranges are now stored in compact parser-owned span records instead of node and attribute user data, and Position objects are created lazily when source ranges are read. This cuts tracked DOM retained size by about 50-60% on representative benchmark documents, while keeping Node#sourceRange(), Element#endSourceRange(), and Attribute#sourceRange() behavior intact. #2498
• Added Element#classList(), an immutable snapshot of an element's class names in attribute order. Use hasClass() when you just need to test for one class, classList() when you want to read or iterate classes without needing a mutable result, and classNames() when you want the existing mutable, deduplicated set that can be written back with classNames(Set). The class APIs now share an HTML-whitespace scanner, which also makes classNames() faster and lighter on allocation, especially when walking many elements without class names. #2500
• Aligned HTML parser scope classification with the current HTML spec for select, foreignObject, and template. #2501
• Simplified the HTML tree builder's scope, implied-end-tag, and special-element checks by caching parser-only options on Tag. That improves HTML parser throughput by about 10% on small inputs and up to about 30% on larger inputs in the benchmark fixtures. #2502
• Improved HTML parser throughput stability by making hot tokeniser scan paths compile more predictably. #2507
• <noscript> fallback markup is now parsed into an inspectable DOM subtree in both the document head and body. The fallback acts as a contained parsing island, so malformed markup cannot disrupt the surrounding document structure, while normal HTML tokenization still applies within it. This also improves round-trip serialization. #2537
• Improved redirect credential handling as a defense-in-depth measure: explicit authorization headers and request cookies are no longer forwarded across origins, reducing exposure through open redirects and aligning with HTTP guidance. Cookies managed by a CookieStore continue to follow their configured scope. #2540
• Elements can now append their outer HTML, including their own tags, directly to an Appendable with Node#outerHtml(Appendable), without first creating a String. This complements Element#html(Appendable), which appends inner HTML only. #2532
• Aligned CDATA tokenization with the HTML spec: CDATA syntax in HTML content is parsed as a bogus comment, while it remains supported in SVG, MathML, and XML. Also improved namespace-aware fragment parsing so SVG and MathML contexts, HTML integration points, and context-sensitive tokenizer states are handled correctly. #2542
• When using the optional re2j regular expression engine, stack overflows caused by complex selector patterns are now normalized to a ValidationException with a Pattern complexity error message. #2548

Bug Fixes

• Fixed HTML parsing of mixed-case RCDATA end tags after tag-shaped text. For example, <title><p>Foo</TiTLE> and <textarea><img src=x></TeXtArEa> now keep the tag-shaped content as text instead of promoting it to markup. #2503
• Fixed W3CDom XML conversion so plain XML elements don't serialize with the reserved XML namespace as the default namespace. Explicit XML namespaces and xml:* attributes are still preserved. #2504
• Preserve control characters in parsed tag names #2538
• Updated HTTP redirects to follow the specification: 307 and 308 preserve the request method and content, 301 and 302 only change POST to GET, and Location is followed only for 301, 302, 303, 307, and 308 responses. Streamed request bodies are not buffered; if an automatic redirect requires replaying one, execution fails, so the caller can resend with a fresh stream. #2540
• Corrected the Cleaner's same-site link detection to compare hostnames rather than URL prefixes when applying rel=nofollow. #2543

Build Changes

• Cleaned up the Maven build for the multi-release JAR so Java 8 and Java 11+ sources compile as separate source sets. This avoids spurious Java 8 compiler warnings from newer-language overlay sources, keeps long-running parser checks behind an explicit profile, and preserves the same published artifacts and runtime behavior.
• Improved parallelism and tuned timing in our integration tests, so that a full mvn clean verify drops from ~ 1m18s to ~ 21 seconds.

---

My sincere thanks to everyone who contributed to this release! If you have any suggestions for the next release, I would love to hear them; please get in touch via jsoup discussions, or with me directly.

You can also follow me (@jhy@tilde.zone) on Mastodon / Fediverse to receive occasional notes about jsoup releases.

Changelog

Sourced from org.jsoup:jsoup's changelog.

1.23.1 (2026-Jul-30)

Improvements

• Reduced retained memory when parsing with source position tracking enabled (Parser#setTrackPosition(true)). Source ranges are now stored in compact parser-owned span records instead of node and attribute user data, and Position objects are created lazily when source ranges are read. This cuts tracked DOM retained size by about 50-60% on representative benchmark documents, while keeping Node#sourceRange(), Element#endSourceRange(), and Attribute#sourceRange() behavior intact. #2498
• Added Element#classList(), an immutable snapshot of an element's class names in attribute order. Use hasClass() when you just need to test for one class, classList() when you want to read or iterate classes without needing a mutable result, and classNames() when you want the existing mutable, deduplicated set that can be written back with classNames(Set). The class APIs now share an HTML-whitespace scanner, which also makes classNames() faster and lighter on allocation, especially when walking many elements without class names. #2500
• Aligned HTML parser scope classification with the current HTML spec for select, foreignObject, and template. #2501
• Simplified the HTML tree builder's scope, implied-end-tag, and special-element checks by caching parser-only options on Tag. That improves HTML parser throughput by about 10% on small inputs and up to about 30% on larger inputs in the benchmark fixtures. #2502
• Improved HTML parser throughput stability by making hot tokeniser scan paths compile more predictably. #2507
• <noscript> fallback markup is now parsed into an inspectable DOM subtree in both the document head and body. The fallback acts as a contained parsing island, so malformed markup cannot disrupt the surrounding document structure, while normal HTML tokenization still applies within it. This also improves round-trip serialization. #2537
• Improved redirect credential handling as a defense-in-depth measure: explicit authorization headers and request cookies are no longer forwarded across origins, reducing exposure through open redirects and aligning with HTTP guidance. Cookies managed by a CookieStore continue to follow their configured scope. #2540
• Elements can now append their outer HTML, including their own tags, directly to an Appendable with Node#outerHtml(Appendable), without first creating a String. This complements Element#html(Appendable), which appends inner HTML only. #2532
• Aligned CDATA tokenization with the HTML spec: CDATA syntax in HTML content is parsed as a bogus comment, while it remains supported in SVG, MathML, and XML. Also improved namespace-aware fragment parsing so SVG and MathML contexts, HTML integration points, and context-sensitive tokenizer states are handled correctly. #2542
• When using the optional re2j regular expression engine, stack overflows caused by complex selector patterns are now normalized to a ValidationException with a Pattern complexity error message. #2548

Bug Fixes

• Fixed HTML parsing of mixed-case RCDATA end tags after tag-shaped text. For example, <title><p>Foo</TiTLE> and <textarea><img src=x></TeXtArEa> now keep the tag-shaped content as text instead of promoting it to markup. #2503
• Fixed W3CDom XML conversion so plain XML elements don't serialize with the reserved XML namespace as the default namespace. Explicit XML namespaces and xml:* attributes are still preserved. #2504
• Preserve control characters in parsed tag names #2538
• Updated HTTP redirects to follow the specification: 307 and 308 preserve the request method and content, 301 and 302 only change POST to GET, and Location is followed only for 301, 302, 303, 307, and 308 responses. Streamed request bodies are not buffered; if an automatic redirect requires replaying one, execution fails, so the caller can resend with a fresh stream. #2540
• Corrected the Cleaner's same-site link detection to compare hostnames rather than URL prefixes when applying rel=nofollow. #2543

Build Changes

• Cleaned up the Maven build for the multi-release JAR so Java 8 and Java 11+ sources compile as separate source sets. This avoids spurious Java 8 compiler warnings from newer-language overlay sources, keeps long-running parser checks behind an explicit profile, and preserves the same published artifacts and runtime behavior.
• Improved parallelism and tuned timing in our integration tests, so that a full mvn clean verify drops from ~ 1m18s to ~ 21 seconds.

Commits

• bb077a8 [maven-release-plugin] prepare release jsoup-1.23.1
• cdb5579 Harden the test some
• b86b282 Normalize re2j complexity exceptions
• 0fcc369 Bump github/codeql-action from 4.37.0 to 4.37.1
• aea4a1b Bump actions/setup-java from 5.5.0 to 5.6.0
• ec9c879 Bump actions/checkout from 7.0.0 to 7.0.1
• 1fb2c97 Fix KeyVal.inputStream validation
• 3475afc Handle non-string internal attribute values; test for internal attribute data
• be8c375 Parse CDATA according to the context namespace
• 8996fce Add appendable outer HTML output
• Additional commits viewable in compare view

Updates gradle-wrapper from 9.6.1 to 9.7.0

Release notes

Sourced from gradle-wrapper's releases.

9.7.0

The Gradle team is excited to announce Gradle 9.7.0.

Here are the highlights of this release:

• Isolated Projects graduates to incubating
• Broader Configuration Cache compatibility
• More source locations in problem reports

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Adam, Aman Gautam, Aman Kumar, Anton Dubrouski, Aurimas, gbhavya07, Josh Friend, nicklauslittle-gov, Pragati, project516, Qin Mi, Ravi, sk-reddy17, Suvrat Acharya, Yongshun Ye.

Upgrade instructions

Switch your build to use Gradle 9.7.0 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.7.0 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

9.7.0 RC3

The Gradle team is excited to announce Gradle 9.7.0 RC3.

Here are the highlights of this release:

• Isolated Projects graduates to incubating

... (truncated)

Commits

• 3defbfc make DistributionIntegrationSpec more permissive for releases (#38766)
• f176043 make DistributionIntegrationSpec more permissive for releases
• b0828da Prepare release notes for Gradle 9.7.0GA (#38756)
• 064b6d6 cleanup
• dfe7bdc add new training to release notes
• 7561968 add release notes for 37801
• 68a1f35 cherrypick 38367 to release
• a462c95 Rebalance AllVersionsCrossVersion buckets for agents without TestDistribution...
• 820e2b1 Update Gradle wrapper to version 9.7.0-rc-3 (#38743)
• 75ea3d7 Update Gradle wrapper to version 9.7.0-rc-3
• Additional commits viewable in compare view