From 88e288f122eefd1d77fbe0d9c59456b1459a41d9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 21 Jul 2026 02:35:06 +0000 Subject: [PATCH] Bump the gradle-dependencies group with 6 updates Bumps the gradle-dependencies group with 6 updates: | Package | From | To | | --- | --- | --- | | [io.swagger.parser.v3:swagger-parser](https://github.com/swagger-api/swagger-parser) | `2.1.22` | `2.1.45` | | [io.netty:netty-bom](https://github.com/netty/netty) | `4.2.15.Final` | `4.2.16.Final` | | [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) | `2.21.5` | `2.22.1` | | [org.apache.commons:commons-compress](https://github.com/apache/commons-compress) | `1.26.0` | `1.28.0` | | org.apache.commons:commons-lang3 | `3.18.0` | `3.20.0` | | [org.mozilla:rhino](https://github.com/mozilla/rhino) | `1.7.14.1` | `1.9.1` | Updates `io.swagger.parser.v3:swagger-parser` from 2.1.22 to 2.1.45 - [Release notes](https://github.com/swagger-api/swagger-parser/releases) - [Commits](https://github.com/swagger-api/swagger-parser/compare/v2.1.22...v2.1.45) Updates `io.netty:netty-bom` from 4.2.15.Final to 4.2.16.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](https://github.com/netty/netty/compare/netty-4.2.15.Final...netty-4.2.16.Final) Updates `com.fasterxml.jackson:jackson-bom` from 2.21.5 to 2.22.1 - [Commits](https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.21.5...jackson-bom-2.22.1) Updates `org.apache.commons:commons-compress` from 1.26.0 to 1.28.0 - [Changelog](https://github.com/apache/commons-compress/blob/master/RELEASE-NOTES.txt) - [Commits](https://github.com/apache/commons-compress/compare/rel/commons-compress-1.26.0...rel/commons-compress-1.28.0) Updates `org.apache.commons:commons-lang3` from 3.18.0 to 3.20.0 Updates `org.mozilla:rhino` from 1.7.14.1 to 1.9.1 - [Release notes](https://github.com/mozilla/rhino/releases) - [Changelog](https://github.com/mozilla/rhino/blob/master/RELEASE-NOTES.md) - [Commits](https://github.com/mozilla/rhino/commits) --- updated-dependencies: - dependency-name: io.swagger.parser.v3:swagger-parser dependency-version: 2.1.45 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-dependencies - dependency-name: io.netty:netty-bom dependency-version: 4.2.16.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-dependencies - dependency-name: com.fasterxml.jackson:jackson-bom dependency-version: 2.22.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-dependencies - dependency-name: org.apache.commons:commons-compress dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-dependencies - dependency-name: org.apache.commons:commons-lang3 dependency-version: 3.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-dependencies - dependency-name: org.mozilla:rhino dependency-version: 1.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-dependencies ... Signed-off-by: dependabot[bot] --- gradle/libs.versions.toml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 3d032a6..8896204 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -50,7 +50,7 @@ testcontainers = "1.21.4" # OpenAPI parsing — validates the committed velocity-api spec is well-formed OpenAPI 3.1 in a test # (velocity-api OpenApiSpecTest). velocity-only; tracks the current latest 2.1.x. -swagger-parser = "2.1.22" +swagger-parser = "2.1.45" # Test bundle (wired in the test convention plugin). Pinned to pk-auth. junit-jupiter = "6.1.2" @@ -64,11 +64,11 @@ logback = "1.5.38" # Testcontainers, rhino via swagger-parser). Each value is the first patched release for the # corresponding Dependabot advisory; it is applied as a *floor*, not a pin, so a higher version # on any resolution path still wins. Dependabot keeps these current on its weekly gradle run. -netty = "4.2.15.Final" # netty-handler / netty-resolver-dns advisories (GHSA, high) -jackson2 = "2.21.5" # jackson-databind 2.x case-insensitive @JsonIgnoreProperties bypass -commons-compress = "1.26.0" # Pack200 OOM + corrupted-DUMP infinite-loop DoS -commons-lang3 = "3.18.0" # uncontrolled recursion on long inputs -rhino = "1.7.14.1" # toFixed() high-CPU DoS +netty = "4.2.16.Final" # netty-handler / netty-resolver-dns advisories (GHSA, high) +jackson2 = "2.22.1" # jackson-databind 2.x case-insensitive @JsonIgnoreProperties bypass +commons-compress = "1.28.0" # Pack200 OOM + corrupted-DUMP infinite-loop DoS +commons-lang3 = "3.20.0" # uncontrolled recursion on long inputs +rhino = "1.9.1" # toFixed() high-CPU DoS [libraries] jspecify = { module = "org.jspecify:jspecify", version.ref = "jspecify" }