Skip to content

chore(deps): bump the low-risk group across 1 directory with 8 updates#357

Merged
RichardSlater merged 1 commit intomainfrom
dependabot/maven/low-risk-ce3e219f1b
Apr 29, 2026
Merged

chore(deps): bump the low-risk group across 1 directory with 8 updates#357
RichardSlater merged 1 commit intomainfrom
dependabot/maven/low-risk-ce3e219f1b

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 27, 2026

Bumps the low-risk group with 8 updates in the / directory:

Package From To
org.projectlombok:lombok 1.18.44 1.18.46
nl.jqno.equalsverifier:equalsverifier 4.4.2 4.5
io.projectreactor:reactor-bom 2025.0.4 2025.0.5
org.springframework.boot:spring-boot-dependencies 3.5.13 3.5.14
io.projectreactor.netty:reactor-netty-core 1.3.4 1.3.5
org.pitest:pitest-parent 1.23.0 1.23.1
org.pitest:pitest-maven 1.23.0 1.23.1
com.google.code.gson:gson 2.13.2 2.14.0

Updates org.projectlombok:lombok from 1.18.44 to 1.18.46

Changelog

Sourced from org.projectlombok:lombok's changelog.

v1.18.46 (April 22nd, 2026)

  • PLATFORM: JDK26 support added #4019.
  • PLATFORM: Spring Tools Suite 5 supported #3985.
  • BUGFIX: @Jacksonized no longer stops generating @JsonProperty once an explicit @JsonIgnore annotations is encountered #4022.
  • BUGFIX: In eclipse, mixing @Jacksonized and fluent = true no longer causes the error com.fasterxml.jackson.annotation.JsonProperty is not a repeatable annotation interface. #3934.
  • BUGFIX: Some finishing touches for v1.18.44's support of Jackson3 #4004.
Commits
  • 936ca59 [build] lombok's launcher is still intended to be 1.4 compatible, or at least...
  • fcdab3f [version] pre-release version bump
  • 1cb7d49 [changelog]#4004 Mention Jackson3 final touches in changelog.
  • 12a15b0 Fix: Bump EA_JDK to 27 (25 and 26 have been released)
  • 2be766c Merge branch 'jackson3-final-touches'
  • 290fa4c [trivial] constantize the warning we spit out for ambiguous jackson2/3, and m...
  • e6567b6 test: Add Jackson 3 test cases and version ambiguity warnings
  • 45e72e2 feat: Add Jackson 3 databind/dataformat annotations to HandlerUtil copy lists
  • 184d423 feat: Add Jackson 3 support to @​Jacksonized handlers
  • e027ad0 refactored to ShadowClassLoader use Collections::enumeration instead of Vector
  • Additional commits viewable in compare view

Updates nl.jqno.equalsverifier:equalsverifier from 4.4.2 to 4.5

Release notes

Sourced from nl.jqno.equalsverifier:equalsverifier's releases.

Release equalsverifier-4.5

For a list of changes in this version, see CHANGELOG.md.

Changelog

Sourced from nl.jqno.equalsverifier:equalsverifier's changelog.

[4.5] - 2026-04-17

Added

  • EqualsVerifier now detects when java.net.URL fields are used in equals or hashCode, since URL.equals() and URL.hashCode() perform DNS resolution, making them network-dependent and non-deterministic. Consider using URI.create(url.toString()) instead. This check can be suppressed with Warning.URL_EQUALITY. (Issue #1203)
Commits
  • 3f72cbc Bumps version to 4.5
  • abd5aa9 Updates CHANGELOG for release
  • 04f89c1 Merge pull request #1204 from jqno/add-url-fieldcheck
  • ffc7f03 Streamlines UrlTest
  • e9cf3be Adds URL FieldCheck
  • 472e8b1 Update copyright year in README.md
  • 94ebdf6 Merge pull request #1202 from jqno/vendors-signedjar-test
  • 8d6327d Excludes equalsverifier-test-signedjar from PITest coverage
  • 7b828dc All signed-jar tests should run via failsafe so it runs through the actual ja...
  • 377c217 Incorporates SignedJarTest from separate repository
  • Additional commits viewable in compare view

Updates io.projectreactor:reactor-bom from 2025.0.4 to 2025.0.5

Release notes

Sourced from io.projectreactor:reactor-bom's releases.

2025.0.5

2025.0.5 release train is made of:

These artifacts didn't have any changes:

  • reactor-addons 3.6.0
  • reactor-kotlin-extensions 1.3.0
Commits
  • 23647bf [release] Prepare and release BOM 2025.0.5
  • a06b97c Merge-ignore release 2024.0.17 into 2025.0.5
  • 5d94ca6 [release] Back to snapshots, next BOM will be SR 18
  • 2f52f4a [release] Prepare and release BOM 2024.0.17
  • e68d8ad Merge bbbf5d86 into 2025.0.5
  • bbbf5d8 Fix Gradle deprecation warnings scheduled for removal in Gradle 10
  • 1e8ee7c Merge #777 into 2025.0.5
  • 997c971 Bump gradle-wrapper from 9.4.0 to 9.4.1 (#777)
  • ba97cff Remove dependabot ignore configuration
  • b8cb92a Merge 5e94cb91 into 2025.0.5
  • Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-dependencies from 3.5.13 to 3.5.14

Release notes

Sourced from org.springframework.boot:spring-boot-dependencies's releases.

v3.5.14

🐞 Bug Fixes

  • ApplicationPidFileWriter does not handle symlinks correctly #50173
  • RandomValuePropertySource is not suitable for secrets #50172
  • Cassandra auto-configuration misconfigures CqlSessionBuilder #50171
  • ApplicationTemp does not handle symlinks correctly #50170
  • Remote DevTools performs comparison incorrectly #50169
  • spring.rabbitmq.ssl.verify-hostname is applied inconsistently #50168
  • EnversRevisionRepositoriesRegistrar should reuse @EnableEnversRepositories rather than configuring the JPA counterpart #50035
  • Annotations like @Ssl don't work on @Bean methods when using @ServiceConnection #50033
  • Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter #50021
  • WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links #50008
  • 500 response from env endpoint when supplied pattern is invalid #49942
  • HTTP method is lost when configuring excludes in EndpointRequest #49885
  • Docker Compose support doesn't work with apache/artemis image #49865
  • Honor HttpMethod for reactive additional endpoint paths #49864
  • Docker Compose support doesn't work with apache/activemq image #49863
  • Imports on a containing test class are ignored when a nested class has imports #49860

📔 Documentation

  • Link to the observability section of the Lettuce documentation is broken #50092
  • Javadoc for StaticResourceLocation.FAVICON doesn't describe icons location #50083
  • MySamlRelyingPartyConfiguration is missing a Kotlin sample #50023
  • Incorrect default value for management.httpexchanges.recording.include in configuration metadata #50010
  • Link to the Kubernetes documentation when discussing startup probes #50007
  • Update docs to encourage Java fundamentals for beginners that prefer to learn that way #49895
  • Clarify that configuration property default values are not available through the Environment #49835

🔨 Dependency Upgrades

... (truncated)

Commits
  • 7d7b3ac Release v3.5.14
  • 9dc5aa2 Polish
  • f533a45 Do not follow symlinks when writing PID file
  • f3b8eb0 Use SecureRandom in RandomValuePropertySource
  • e22083a Enable hostname verification for SSL connections to Cassandra
  • 5ceb1a2 Improve ApplicationTemp's temporary directory creation
  • 4b0862c Use constant-time comparison for remote DevTools secret
  • e4febe2 Apply verify-hostname consistently
  • 2c2ffe5 Fix Windows test failure
  • 0046a44 Protect against corrupt buildpack archives
  • Additional commits viewable in compare view

Updates io.projectreactor.netty:reactor-netty-core from 1.3.4 to 1.3.5

Release notes

Sourced from io.projectreactor.netty:reactor-netty-core's releases.

v1.3.5

Reactor Netty 1.3.5 is part of 2025.0.5 Release Train.

What's Changed

✨ New features and improvements

🐞 Bug fixes

  • Ensure connection concurrency and acquired counters are updated before delivering the slot by @​violetagg in #4179
  • Fix StackOverflowError in ServerTransport graceful shutdown by @​violetagg in #4181
  • Fix invalidated connection reuse in Http2Pool by @​violetagg in #4180

New Contributors

Full Changelog: reactor/reactor-netty@v1.3.4...v1.3.5

Commits
  • b68daca [release] Prepare and release 1.3.5
  • f8fc51b Merge-ignore release 1.2.17 into 1.3.5
  • 4cffaf0 [release] Back to snapshots, next is 1.2.18-SNAPSHOT
  • 3f6ae4c Defer asciidoctor-pdf check to execution time
  • 9f6f3e0 [release] Prepare and release 1.2.17
  • 7b2c429 Merge #4190 into 1.3.5
  • 6225c6d Bump ruby/setup-ruby from 1.299.0 to 1.301.0 (#4190)
  • f4f9b50 Bump org.bouncycastle:bcpkix-jdk18on from 1.83 to 1.84 (#4191)
  • 5b344dc Merge #4187 into 1.3.5
  • e177f39 Bump @​springio/antora-extensions from 1.14.10 to 1.14.11 in /docs (#4187)
  • Additional commits viewable in compare view

Updates org.pitest:pitest-parent from 1.23.0 to 1.23.1

Release notes

Sourced from org.pitest:pitest-parent's releases.

1.23.1

  • #1463 extend unmodifiable collections filtering
Commits

Updates org.pitest:pitest-maven from 1.23.0 to 1.23.1

Release notes

Sourced from org.pitest:pitest-maven's releases.

1.23.1

  • #1463 extend unmodifiable collections filtering
Commits

Updates com.google.code.gson:gson from 2.13.2 to 2.14.0

Release notes

Sourced from com.google.code.gson:gson's releases.

Gson 2.14.0

What's Changed

  • Add type adapters for java.time classes by @​eamonnmcmanus in google/gson#2948

    When the java.time API is available, Gson automatically can read and write instances of classes like Instant and Duration. The format it uses essentially freezes the JSON representation that ReflectiveTypeAdapterFactory established by default, based on the private fields of java.time classes. That's not a great representation, but it is understandable. Changing it to anything else would break compatibility with systems that are expecting the current format.

    With this change, Gson no longer tries to access private fields of these classes using reflection. So it is no longer necessary to run with --add-opens for these classes on recent JDKs.

  • Remove com.google.gson.graph by @​eamonnmcmanus in google/gson#2990.

    This package was not part of any released artifact and depended on Gson internals in potentially problematic ways.

  • Validate that strings being parsed as integers consist of ASCII characters by @​eamonnmcmanus in google/gson#2995

    Previously, strings could contain non-ASCII Unicode digits and still be parsed as integers. That's inconsistent with how JSON numbers are treated.

  • Fix duplicate key detection when first value is null by @​andrewstellman in google/gson#3006

    This could potentially break code that was relying on the incorrect behaviour. For example, this JSON string was previously accepted but will no longer be: {"foo": null, "foo": bar}.

  • Remove Serializable from internal Type implementation classes. by @​eamonnmcmanus in google/gson#3011

    The nested classes ParameterizedTypeImpl, GenericArrayTypeImpl, and WildcardTypeImpl in GsonTypes are implementations of the corresponding types (without Impl) in java.lang.reflect. For some reason, they were serializable, even though the java.lang.reflect implementations are not. Having unnecessarily serializable classes could conceivably have been a security problem if they were part of a larger exploit using serialization. (We do not consider this a likely scenario and do not suggest that you need to update Gson just to get this change.)

  • Add LegacyProtoTypeAdapterFactory. by @​eamonnmcmanus in google/gson#3014

    This is not part of any released artifact, but may be of use when trying to fix code that is currently accessing the internals of protobuf classes via reflection.

  • Make AppendableWriter do flush and close if delegation object supports by @​MukjepScarlet in google/gson#2925

Other less visible changes

New Contributors

Full Changelog: google/gson@gson-parent-2.13.2...gson-parent-2.14.0

Commits
  • 3ff35d6 [maven-release-plugin] prepare release gson-parent-2.14.0
  • a3024fd Bump the maven group with 13 updates (#3002)
  • 5689ffe Bump the github-actions group across 1 directory with 3 updates (#3018)
  • 48db33c Add LegacyProtoTypeAdapterFactory. (#3014)
  • 53d703e Update outdated comment regarding serializable types (#3012)
  • 0189b72 Remove Serializable from internal Type implementation classes. (#3011)
  • f4d371d Fix duplicate key detection when first value is null (#3006)
  • 27d9ba1 Fix typo in README (JPMS dependencies section) (#3005)
  • 1fa9b7a Validate that strings being parsed as integers consist of ASCII characters (#...
  • b7d5954 Add iterator fail-fast tests for LinkedTreeMap.clear() (#2992)
  • Additional commits viewable in compare view

Updates org.pitest:pitest-maven from 1.23.0 to 1.23.1

Release notes

Sourced from org.pitest:pitest-maven's releases.

1.23.1

  • #1463 extend unmodifiable collections filtering
Commits

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
org.springframework.boot:spring-boot-dependencies [>= 4.a0, < 5]

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the low-risk group across 1 directory with 8 updates
5698561 
Bumps the low-risk group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [org.projectlombok:lombok](https://github.com/projectlombok/lombok) | `1.18.44` | `1.18.46` |
| [nl.jqno.equalsverifier:equalsverifier](https://github.com/jqno/equalsverifier) | `4.4.2` | `4.5` |
| [io.projectreactor:reactor-bom](https://github.com/reactor/reactor) | `2025.0.4` | `2025.0.5` |
| [org.springframework.boot:spring-boot-dependencies](https://github.com/spring-projects/spring-boot) | `3.5.13` | `3.5.14` |
| [io.projectreactor.netty:reactor-netty-core](https://github.com/reactor/reactor-netty) | `1.3.4` | `1.3.5` |
| [org.pitest:pitest-parent](https://github.com/hcoles/pitest) | `1.23.0` | `1.23.1` |
| [org.pitest:pitest-maven](https://github.com/hcoles/pitest) | `1.23.0` | `1.23.1` |
| [com.google.code.gson:gson](https://github.com/google/gson) | `2.13.2` | `2.14.0` |



Updates `org.projectlombok:lombok` from 1.18.44 to 1.18.46
- [Changelog](https://github.com/projectlombok/lombok/blob/master/doc/changelog.markdown)
- [Commits](projectlombok/lombok@v1.18.44...v1.18.46)

Updates `nl.jqno.equalsverifier:equalsverifier` from 4.4.2 to 4.5
- [Release notes](https://github.com/jqno/equalsverifier/releases)
- [Changelog](https://github.com/jqno/equalsverifier/blob/main/CHANGELOG.md)
- [Commits](jqno/equalsverifier@equalsverifier-4.4.2...equalsverifier-4.5)

Updates `io.projectreactor:reactor-bom` from 2025.0.4 to 2025.0.5
- [Release notes](https://github.com/reactor/reactor/releases)
- [Commits](reactor/reactor@2025.0.4...2025.0.5)

Updates `org.springframework.boot:spring-boot-dependencies` from 3.5.13 to 3.5.14
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.13...v3.5.14)

Updates `io.projectreactor.netty:reactor-netty-core` from 1.3.4 to 1.3.5
- [Release notes](https://github.com/reactor/reactor-netty/releases)
- [Commits](reactor/reactor-netty@v1.3.4...v1.3.5)

Updates `org.pitest:pitest-parent` from 1.23.0 to 1.23.1
- [Release notes](https://github.com/hcoles/pitest/releases)
- [Commits](hcoles/pitest@1.23.0...1.23.1)

Updates `org.pitest:pitest-maven` from 1.23.0 to 1.23.1
- [Release notes](https://github.com/hcoles/pitest/releases)
- [Commits](hcoles/pitest@1.23.0...1.23.1)

Updates `com.google.code.gson:gson` from 2.13.2 to 2.14.0
- [Release notes](https://github.com/google/gson/releases)
- [Changelog](https://github.com/google/gson/blob/main/CHANGELOG.md)
- [Commits](google/gson@gson-parent-2.13.2...gson-parent-2.14.0)

Updates `org.pitest:pitest-maven` from 1.23.0 to 1.23.1
- [Release notes](https://github.com/hcoles/pitest/releases)
- [Commits](hcoles/pitest@1.23.0...1.23.1)

---
updated-dependencies:
- dependency-name: org.projectlombok:lombok
  dependency-version: 1.18.46
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: low-risk
- dependency-name: nl.jqno.equalsverifier:equalsverifier
  dependency-version: '4.5'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: low-risk
- dependency-name: io.projectreactor:reactor-bom
  dependency-version: 2025.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: low-risk
- dependency-name: org.springframework.boot:spring-boot-dependencies
  dependency-version: 3.5.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: low-risk
- dependency-name: io.projectreactor.netty:reactor-netty-core
  dependency-version: 1.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: low-risk
- dependency-name: org.pitest:pitest-parent
  dependency-version: 1.23.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: low-risk
- dependency-name: org.pitest:pitest-maven
  dependency-version: 1.23.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: low-risk
- dependency-name: com.google.code.gson:gson
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: low-risk
- dependency-name: org.pitest:pitest-maven
  dependency-version: 1.23.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: low-risk
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Apr 27, 2026
@dependabot dependabot Bot requested review from Copilot and removed request for Copilot April 27, 2026 08:45
@RichardSlater
Copy link
Copy Markdown
Contributor

RichardSlater commented Apr 29, 2026

/azp run

@azure-pipelines
Copy link
Copy Markdown

azure-pipelines Bot commented Apr 29, 2026

Azure Pipelines successfully started running 1 pipeline(s).

@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Apr 29, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

RichardSlater
RichardSlater approved these changes Apr 29, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@RichardSlater RichardSlater left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Patch bump, standard pre-approved change.

@RichardSlater RichardSlater merged commit e1795e2 into main Apr 29, 2026
2 checks passed
@RichardSlater RichardSlater deleted the dependabot/maven/low-risk-ce3e219f1b branch April 29, 2026 08:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@RichardSlater RichardSlater RichardSlater approved these changes

Assignees

@RichardSlater RichardSlater

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@RichardSlater