Sourced from org.springframework.boot:spring-boot-starter-web's releases.

v2.5.12

🐞 Bug Fixes

• MustacheAutoConfiguration in a Servlet web application fails with a ClassNotFoundException when Spring MVC is not on the classpath #30456

📔 Documentation

• Javadoc of org.springframework.boot.gradle.plugin.ResolveMainClassName.setClasspath(Object) is inaccurate #30468
• Document that @DefaultValue can be used on a record component #30460

🔨 Dependency Upgrades

• Upgrade to Jackson Bom 2.12.6.20220326 #30477
• Upgrade to Spring Framework 5.3.18 #30491

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

• @​quaff
• @​eddumelendez
• @​candrews

v2.5.11

⭐ New Features

• Add EIGHTEEN to JavaVersion enum #29524

🐞 Bug Fixes

• Thymeleaf auto-configuration in a reactive application can fail due to duplicate templateEngine beans #30384
• ConfigurationPropertyName#equals is not symmetric when adapt has removed trailing characters from an element #30317
• server.tomcat.keep-alive-timeout is not applied to HTTP/2 #30267
• Setting spring.mustache.enabled to false has no effect #30250
• bootWar is configured eagerly #30211
• Actuator @ReadOperation on Flux cancels request after first element emitted #30095
• No metrics are bound for R2DBC ConnectionPools that have been wrapped #30090
• Unnecessary allocations in Prometheus scraping endpoint #30085
• Condition evaluation report entry for a @ConditionalOnSingleCandidate that does not match due to multiple primary beans isn't as clear as it could be #30073
• Generated password are logged without an "unsuitable for production use" note #30061
• Files in META-INF are not found when deploying a Gradle-built executable war to a servlet container #30026
• spring-boot-configuration-processor fails compilation due to @DefaultValue with a long value and generates invalid metadata for byte and short properties with out-of-range default values #30020
• Dependency management for Netty tcNative is incomplete leading to possible version conflicts #30010
• Dependency management for Apache Kafka is incomplete #29023

📔 Documentation

• Fix JsonSerializer example in reference guide #30329
• Default value of spring.thymeleaf.reactive.media-types is not documented #30280
• Add Netty in "Enable HTTP Response Compression" #30234

... (truncated)

• 35105a0 Release v2.5.12
• 17936b8 Polish
• 94c40c7 Upgrade to Spring Framework 5.3.18
• 2e90fd2 Upgrade CI to Docker 20.10.14
• 6cded5b Upgrade Java 18 version in CI image
• 06c5e26 Upgrade to Jackson Bom 2.12.6.20220326
• c0c32d8 Merge pull request #30456 from candrews
• 8cb11b7 Polish "Make MustacheViewResolver bean back off without Spring MVC"
• 7101b50 Make MustacheViewResolver bean back off without Spring MVC
• 05b7bef Fix javadoc of ResolveMainClassName setClasspath(Object)
• Additional commits viewable in compare view

Sourced from junit:junit's releases.

JUnit 4.13.1

Please refer to the release notes for details.

JUnit 4.13

Please refer to the release notes for details.

JUnit 4.13 RC 2

Please refer to the release notes for details.

JUnit 4.13 RC 1

Please refer to the release notes for details.

JUnit 4.13 Beta 3

Please refer to the release notes for details.

JUnit 4.13 Beta 2

Please refer to the release notes for details.

JUnit 4.13 Beta 1

Please refer to the release notes for details.

• 1b683f4 [maven-release-plugin] prepare release r4.13.1
• ce6ce3a Draft 4.13.1 release notes
• c29dd82 Change version to 4.13.1-SNAPSHOT
• 1d17486 Add a link to assertThrows in exception testing
• 543905d Use separate line for annotation in Javadoc
• 510e906 Add sub headlines to class Javadoc
• 610155b Merge pull request from GHSA-269g-pwp5-87pp
• b6cfd1e Explicitly wrap float parameter for consistency (#1671)
• a5d205c Fix GitHub link in FAQ (#1672)
• 3a5c6b4 Deprecated since jdk9 replacing constructor instance of Double and Float (#1660)
• Additional commits viewable in compare view

Sourced from mysql:mysql-connector-java's changelog.

Changelog

https://dev.mysql.com/doc/relnotes/connector-j/en/

Version 8.4.0

• WL#15706, Add OpenTelemetry tracing.

• WL#16174, Support for VECTOR data type.

• Fix for Bug#36380711, Tests failing due to removal of deprecated features.

• Fix for Bug#113600 (Bug#36171575), Contribution: Fix join condition for retrieval of imported primary keys. Thanks to Henning Pöttker for his contribution.

• WL#16196, GPL License Exception Update.

• Fix for Bug#111031 (Bug#35392222), Contribution: Update SyntaxRegressionTest.java. Thanks to Abby Palmero for her contribution.

• Fix for Bug#113599 (Bug#36171571), Contribution: Replace StringBuffer with StringBuilder in ValueEncoders. Thanks to Henning Pöttker for his contribution.

• Fix for Bug#91550 (Bug#28297874), DatabaseMetaData specifies incorrect extra name characters.

• Fix for Bug#113129 (Bug#36043145), setting the FetchSize on a Statement object does not affect.

• Fix for Bug#22931632, GETPARAMETERBINDINGS() ON A PS RETURNS NPE WHEN NOT ALL PARAMETERS ARE BOUND.

• WL#16147, Remove support for FIDO authentication.

• Fix for Bug#110286 (Bug#35152855), Only call Messages.getString(...) when it's needed (when the SQLException is thrown). Thanks to Janick Reynders for his contribution.

• Fix for Bug#23143279, CLIENT HANG WHEN LOADBALANCESTRATEGY IS BESTRESPONSETIME.

Version 8.3.0

• Fix for Bug#107107 (Bug#34101635), Redundant "Reset stmt" when setting useServerPrepStmts&cachePrepStmts to true. Thanks to Marcos Albe for his contribution.

• Fix for Bug#19845752, COMMENT PARSING IS NOT PROPER IN CONNECTOR JDBC.

• Fix for Bug#112884 (Bug#36043166), Setting a large timeout leads to errors when executing SQL.

• WL#16077, Upgrade 3rd party libraries and tools.

• WL#16074, Upgrade Protocol Buffers dependency to protobuf-java-3.25.1.

• Fix for Bug#35929119, Issue with mysql-connector-j 8.0.33 connector (XDEVAPI) - getsession is slow.

... (truncated)

• 7ff2161 Updating copyright years
• b13af38 Fix for DateTimeTest according to changes in MySQL server.
• 5c7b775 Update in test for Bug#96900 (30355150).
• e1169ee Fix for Bug#99260 (31189960), statement.setQueryTimeout,creates a database co...
• 05778ef Fix for Bug#103324 (32770013), X DevAPI Collection.replaceOne() missing match...
• 48219f2 Fix for Bug#105197 (33461744), Statement.executeQuery() may return non-naviga...
• 24cf7e2 Fix for Bug#105323 (33507321), README.md contains broken links.
• ad46620 Fix for Bug#96900 (30355150), STATEMENT.CANCEL()CREATE A DATABASE
• 4d19ea1 Fix for Bug#104067 (33054827), No reset autoCommit after unknown issue occurs.
• bc45d35 Fix for Bug#85223 (25656020), MYSQLSQLXML SETSTRING CRASH.
• Additional commits viewable in compare view

Sourced from com.google.guava:guava's releases.

32.0.0

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>32.0.0-jre</version>
  <!-- or, for Android: -->
  <version>32.0.0-android</version>
</dependency>

Jar files

• 32.0.0-jre.jar
• 32.0.0-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.1.jar

Javadoc

• 32.0.0-jre
• 32.0.0-android

JDiff

• 32.0.0-jre vs. 31.1-jre
• 32.0.0-android vs. 31.1-android
• 32.0.0-android vs. 32.0.0-jre

Changelog

Security fixes

• Reimplemented Files.createTempDir and FileBackedOutputStream to further address CVE-2020-8908 (#4011) and CVE-2023-2976 (#2575). (feb83a1c8f)

While CVE-2020-8908 was officially closed when we deprecated Files.createTempDir in Guava 30.0, we've heard from users that even recent versions of Guava have been listed as vulnerable in other databases of security vulnerabilities. In response, we've reimplemented the method (and the very rarely used FileBackedOutputStream class, which had a similar issue) to eliminate the insecure behavior entirely. This change could technically affect users in a number of different ways (discussed under "Incompatible changes" below), but in practice, the only problem users are likely to encounter is with Windows. If you are using those APIs under Windows, you should skip 32.0.0 and go straight to 32.0.1 which fixes the problem. (Unfortunately, we didn't think of the Windows problem until after the release. And while we warn that common.io in particular may not work under Windows, we didn't intend to regress support.) Sorry for the trouble.

Incompatible changes

Although this release bumps Guava's major version number, it makes no binary-incompatible changes to the guava artifact.

One change could cause issues for Widows users, and a few other changes could cause issues for users in more usual situations:

• The new implementations of Files.createTempDir and FileBackedOutputStream throw an exception under Windows. This is fixed in 32.0.1. Sorry for the trouble.
• guava-gwt now requires GWT 2.10.0.
• This release makes a binary-incompatible change to a @Beta API in the separate artifact guava-testlib. Specifically, we changed the return type of TestingExecutors.sameThreadScheduledExecutor to ListeningScheduledExecutorService. The old return type was a package-private class, which caused the Kotlin compiler to produce warnings. (dafaa3e435)

... (truncated)

• See full diff in compare view

• bd907c3 [maven-release-plugin] prepare release netty-4.1.42.Final
• 2791f0f Avoid use of global AtomicLong for ScheduledFutureTask ids (#9599)
• 86ff76a Fix incorrect comment (#9598)
• 5e69a13 Cleanup JNI code to always correctly free memory when loading fails and also ...
• eb3c4bd ChunkedNioFile can use absolute FileChannel::read to read chunks (#9592)
• 76592db Close eventfd shutdown/wakeup race by closely tracking epoll edges (#9586)
• 0a2d85f Fix GraalVM native image build error (#9593)
• dc4de7f We need to use NewGloblRef when caching jclass instances (#9595)
• 4499384 Update to netty-tcnative 2.0.26.Final (#9589)
• 8648171 Fix *SslEngineTest to not throw ClassCastException and pass in all cases (#9588)
• Additional commits viewable in compare view

Sourced from net.lingala.zip4j:zip4j's releases.

v2.11.3

Security fixes:

#485 Fix CVE-2023-22899

v2.11.2

Improvements:

Use SecureRandom instead of Random to implement a cryptographically strong random number

Bug fixes:

Fix null check Append file separator to path check only if required Fix endOfCentralDirectory location calculation when setting comment Use Path comparison over String comparison for Path traversal vulnerability Set lastModifiedFileTime for all entries and not just directories Use charset when generating AES vendor id info

v2.11.1

Bug fixes:

#396 Use case sensitive comparison for file headers #440 Replace Windows file separator with zip separator #442 Remove file attributes check

v2.11.0

Bug fixes:

#328 Add option to handle passwords with or without utf8 charset #333 Fix issue with reading 7Zip split files with headers not just in first split part #421 Remove clone method #428 Add close method in NumberedSplitRandomAccessFile #432 Fallback to zip standard charset if utf-8 flag is not set #433 Add directories to zip as well when symlink target is a directory #434 Use last modified file time from ZipParameters #435 Add null check when getting and applying Windows file attributes #438 Remove lines to skip reading content if entry is directory

v2.10.0

Improvements:

#403 - Use utf-8 by default when reading zip file names #416 - Add NoCompression deflate compression level

Bug fixes:

#366 - Validate AES extra data record size #368 - Include pos in array copy length calculation #370 - Change IllegalArgumentException to ZipException

... (truncated)

• 7b9a500 Release v2.11.3
• ddd8fdc #485 Calculate AES mac with cache and push back functionality
• 597b31a #485 Check for MAC even when DataDescritor exists
• 942fe57 Release v2.11.2
• c64f9eb #474 Use charset when generating aes vendor id info
• 4aaa10a Code analysis cleanup and #435 mistake? (#458)
• 5013235 vuln-fix: Partial Path Traversal Vulnerability (#466)
• 3eb5867 #473 set lastModifiedFileTime to 0 if negative value is passed
• 7a74670 #473 set lastModifiedFileTime for all entries and not just directories
• 0ffcaec #462 Append file separator to path check only if required
• Additional commits viewable in compare view

• See full diff in compare view

Sourced from com.google.guava:guava's releases.

32.0.0

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>32.0.0-jre</version>
  <!-- or, for Android: -->
  <version>32.0.0-android</version>
</dependency>

Jar files

• 32.0.0-jre.jar
• 32.0.0-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.1.jar

Javadoc

• 32.0.0-jre
• 32.0.0-android

JDiff

• 32.0.0-jre vs. 31.1-jre
• 32.0.0-android vs. 31.1-android
• 32.0.0-android vs. 32.0.0-jre

Changelog

Security fixes

• Reimplemented Files.createTempDir and FileBackedOutputStream to further address CVE-2020-8908 (#4011) and CVE-2023-2976 (#2575). (feb83a1c8f)

While CVE-2020-8908 was officially closed when we deprecated Files.createTempDir in Guava 30.0, we've heard from users that even recent versions of Guava have been listed as vulnerable in other databases of security vulnerabilities. In response, we've reimplemented the method (and the very rarely used FileBackedOutputStream class, which had a similar issue) to eliminate the insecure behavior entirely. This change could technically affect users in a number of different ways (discussed under "Incompatible changes" below), but in practice, the only problem users are likely to encounter is with Windows. If you are using those APIs under Windows, you should skip 32.0.0 and go straight to 32.0.1 which fixes the problem. (Unfortunately, we didn't think of the Windows problem until after the release. And while we warn that common.io in particular may not work under Windows, we didn't intend to regress support.) Sorry for the trouble.

Incompatible changes

Although this release bumps Guava's major version number, it makes no binary-incompatible changes to the guava artifact.

One change could cause issues for Widows users, and a few other changes could cause issues for users in more usual situations:

• The new implementations of Files.createTempDir and FileBackedOutputStream throw an exception under Windows. This is fixed in 32.0.1. Sorry for the trouble.
• guava-gwt now requires GWT 2.10.0.
• This release makes a binary-incompatible change to a @Beta API in the separate artifact guava-testlib. Specifically, we changed the return type of TestingExecutors.sameThreadScheduledExecutor to ListeningScheduledExecutorService. The old return type was a package-private class, which caused the Kotlin compiler to produce warnings. (dafaa3e435)

... (truncated)

• See full diff in compare view

• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.