Sourced from org.immutables:value's releases.
2.12.2
Maintenance release
What's Changed
- #1642 Fix to find nested elements on plain element with nested elements with mongo backend by
@rgatbertin immutables/immutables#1643- #1642 Fix for further problems to find nested elements on plain element with nested elements with mongo backend by
@rgatbertin immutables/immutables#1644- #1645 enhance docs about records for implementationNestedInBuilder by
@bmarwellin immutables/immutables#1646- #1655 Fix TYPE_USE
@Nullableon concrete array types by@viditochaniin immutables/immutables#1658New Contributors
@rgatbertmade their first contribution in immutables/immutables#1643@bmarwellmade their first contribution in immutables/immutables#1646@viditochanimade their first contribution in immutables/immutables#1658Full Changelog: https://github.com/immutables/immutables/compare/2.12.1...2.12.2
6f1918f
v2.12.271d350b
node24 v5 github actionsbb26b40
#1655
additional ECJ workaroundda6acc8
Merge pull request #1658
from viditochani/fix-concrete-array-nullableccd6896
#1655
Fix TYPE_USE @Nullable on
concrete array types78f43d4
#1649
Jackson3 meta-annotated packagef3fe649
#1640
Where.WITH_COPY for copy methods83cdfdb
Change JUnit5 dependency to use BOMcf04f2c
Upgrade jackson3: 3.0.1 -> 3.1.031308e7
Upgrade jackson: 2.19.2 -> 2.21.2Sourced from io.netty:netty-bom's releases.
netty-4.2.14.Final
What's Changed
- HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by
@normanmaurerin netty/netty#16748- HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by
@normanmaurerin netty/netty#16747- Marshalling: Explicit document security requirements by
@normanmaurerin netty/netty#16752- Fix io_uring op completion TRACE logging by
@chrisvestin netty/netty#16755- Quic: Ensure writes are done before notify close promise of QuicheQui… by
@normanmaurerin netty/netty#16758- Avoid re-parsing openssl key material with non-cached provider by
@chrisvestin netty/netty#16759- Pin HTTP/RTSP version + method normalization to Locale.US by
@daguimuin netty/netty#16765- Fill MsgHdrMemoryArray#hdrs with null entry on release by
@tsegismontin netty/netty#16764- Revapi: Use default "oldVersion" by
@chrisvestin netty/netty#16774- Adaptive: Fix concurrency issue in adaptive allocator by
@chrisvestin netty/netty#16767- Auto-port 4.2: Make bulk byte moving in ByteBuf faster by
@netty-project-botin netty/netty#16781- Pin multipart Content-Type / Content-Transfer-Encoding case folding to Locale.US by
@daguimuin netty/netty#16768- Remove dead native declarations by
@pandareenin netty/netty#16783- Isolate tests that modify available Security providers by
@chrisvestin netty/netty#16793- Remove test annotations from a method that isn't a test by
@chrisvestin netty/netty#16792- Enable OpenSslCachingKeyMaterialProvider to evict stale entries after cert rotation by
@zhangweikopin netty/netty#16523- IoUring: extend user data from short to long by
@dreamlike-oceanin netty/netty#16682- Revert CompositeByteBuf component search fast path by
@yawkatin netty/netty#16811- HTTP2: Use 100 as default max concurrent streams setting by
@normanmaurerin netty/netty#16804- Fix ResumptionController wrapping by
@chrisvestin netty/netty#16815- Resolve all localhost addresses without querying DNS servers by
@JulianVennenin netty/netty#16749- IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules are configured but remote peer is using ipv4 by
@normanmaurerin netty/netty#16803- Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe by
@dreamlike-oceanin netty/netty#16788- Route synchronous onLookupComplete exceptions via fireExceptionCaught by
@kwondh5217in netty/netty#16794- IoUring: Stop generic FileRegion drain loop when transferred() reaches count() by
@LuciferYangin netty/netty#16826- MQTT: Allow MQTT 5 CONNECT with password only by
@shblue21in netty/netty#16833- Fix MQTT decoder size check after variable header replay by
@daguimuin netty/netty#16787New Contributors
@pandareenmade their first contribution in netty/netty#16783@zhangweikopmade their first contribution in netty/netty#16523@JulianVennenmade their first contribution in netty/netty#16749@kwondh5217made their first contribution in netty/netty#16794@shblue21made their first contribution in netty/netty#16833Full Changelog: https://github.com/netty/netty/compare/netty-4.2.13.Final...netty-4.2.14.Final
0a60b75
[maven-release-plugin] prepare release netty-4.2.14.Final72df658
Fix MQTT decoder size check after variable header replay (#16787)7125dba
MQTT: Allow MQTT 5 CONNECT with password only (#16833)9e19320
IoUring: Stop generic FileRegion drain loop when transferred() reaches
count(...4ce9f17
Route synchronous onLookupComplete exceptions via fireExceptionCaught
(#16794)f7b1b7d
Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without
Unsafe...0ccb265
IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6
rules ...a6aeb6d
Resolve all localhost addresses without querying DNS servers (#16749)c328ba2
Fix ResumptionController wrapping (#16815)bc5862b
HTTP2: Use 100 as default max concurrent streams setting (#16804)Sourced from com.nimbusds:oauth2-oidc-sdk's changelog.
version 1.0 (2012-05-29) * First official release with authorisation endpoint, token endpoint, check ID endpoint and UserInfo endpoint support. * JSON Web Tokens (JWTs) support through the Nimbus-JWT library. * Language Tags (RFC 5646) support through the Nimbus-LangTag library. * JSON support through the JSON Smart library.
version 2.0 (2013-05-13) * Intermediary development release with Maven build, published to Maven Central.
version 2.1 (2013-06-06) * Updates the APIs to OpenID Connect Messages draft 20, OpenID Connect Standard draft 21, OpenID Connect Discovery draft 17 and OpenID Connect Registration draft 19. * Major refactoring of the APIs for greater simplicity. * Adds JUnit tests.
version 2.2 (2013-06-18) * Refactors dynamic OpenID Connect client registration. * Adds partial support of the OAuth 2.0 Dynamic Client Registration Protocol (draft-ietf-oauth-dyn-reg-12). * Optimises parsing of request parameters consisting of one or more tokens (scope, response type, etc).
version 2.3 (2013-06-19) * Renames OAuth 2.0 dynamic client registration package. * Adds ClientInformation.getClientMetadata() method. * Adds OIDCClientInformation class.
version 2.4 (2013-06-20) * Adds static OIDCClientInformation.parse(JSONObject) method.
version 2.5 (2013-06-22) * Adds support OAuth 2.0 dynamic client update. * Adds OpenID Connect dynamic client registration classes.
version 2.6 (2013-06-25) * Enforces order of preference of ACR values in OpenID Connect client metadata, as required by the specification. * Documentation and performance improvements.
version 2.7 (2013-06-26) * Switches Identifier generation to java.security.SecureRandom.
version 2.8 (2013-06-30) * Fixes serialisation and assignment bugs in ClientMetadata. * Switches Secret generation to java.security.SecureRandom.
version 2.9 (2013-09-17)
... (truncated)
fedf633
[maven-release-plugin] prepare for next development iteration29b77a0
Updates to JSON Smart 2.6.06e53206
[maven-release-plugin] prepare release 11.37.2Sourced from docker/login-action's releases.
v4.2.0
- Bump
@actions/corefrom 3.0.0 to 3.0.1 in docker/login-action#976- Bump
@aws-sdk/client-ecrand@aws-sdk/client-ecr-publicto 3.1050.0 in docker/login-action#960- Bump
@docker/actions-toolkitfrom 0.86.0 to 0.90.0 in docker/login-action#970- Bump brace-expansion from 2.0.1 to 5.0.6 in docker/login-action#993
- Bump fast-xml-builder from 1.1.4 to 1.2.0 in docker/login-action#985
- Bump fast-xml-parser from 5.3.6 to 5.8.0 in docker/login-action#963
- Bump http-proxy-agent and https-proxy-agent to 9.0.0 in docker/login-action#961
- Bump postcss from 8.5.6 to 8.5.10 in docker/login-action#979
- Bump tar from 6.2.1 to 7.5.15 in docker/login-action#991
- Bump vite from 7.3.1 to 7.3.3 in docker/login-action#986
Full Changelog: https://github.com/docker/login-action/compare/v4.1.0...v4.2.0
650006c
Merge pull request #960
from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...99df1a3
chore: update generated content3ab375f
build(deps): bump the aws-sdk-dependencies group across 1 directory with
2 up...39d8580
Merge pull request #970
from docker/dependabot/npm_and_yarn/docker/actions-to...4eefcd3
chore: update generated content56d092c
build(deps): bump @docker/actions-toolkit from 0.86.0 to
0.90.0e2e31ca
Merge pull request #976
from docker/dependabot/npm_and_yarn/actions/core-3.0.10bced94
chore: update generated content3e75a0f
build(deps): bump @actions/core from 3.0.0 to 3.0.1365bebd
Merge pull request #984
from docker/dependabot/github_actions/aws-actions/con...Sourced from org.checkerframework:checker-qual's releases.
Checker Framework 4.2.0
Version 4.2.0 (2026-06-01)
User-visible changes
Renamed error message key "createsmustcallfor.target.unparseable" to "createsmustcallfor.target.unparsable".
Implementation details
In
AnnotatedTypeFactory:
- new overload
canonicalAnnotation(AnnotationMirror, TypeMirror).In
TypeHierarchy:
- new methods
equalsShallowEffective().Closed issues
Sourced from org.checkerframework:checker-qual's changelog.
Version 4.2.0 (2026-06-01)
User-visible changes
Renamed error message key "createsmustcallfor.target.unparseable" to "createsmustcallfor.target.unparsable".
Implementation details
In
AnnotatedTypeFactory:
- new overload
canonicalAnnotation(AnnotationMirror, TypeMirror).In
TypeHierarchy:
- new methods
equalsShallowEffective().Closed issues
231e855
new release 4.2.0e59f66f
Prep for release.bcc021f
Fix problem with type var in a method reference (#7729)91392e5
Use gradle-git-properties version 4cdae258
Increase constraint limit (#7752)dbb553d
Fix check of receiver override (#7746)264c73d
Fix "unneeded.suppression" warning (#7747)d118b89
New methods equalsShallowEffective() (#7745)a916913
Simplify logic (#7744)227974f
Update plugin com-gradleup-shadow to v9.4.2 (#7749)Sourced from org.checkerframework:checker's releases.
Checker Framework 4.2.0
Version 4.2.0 (2026-06-01)
User-visible changes
Renamed error message key "createsmustcallfor.target.unparseable" to "createsmustcallfor.target.unparsable".
Implementation details
In
AnnotatedTypeFactory:
- new overload
canonicalAnnotation(AnnotationMirror, TypeMirror).In
TypeHierarchy:
- new methods
equalsShallowEffective().Closed issues
Sourced from org.checkerframework:checker's changelog.
Version 4.2.0 (2026-06-01)
User-visible changes
Renamed error message key "createsmustcallfor.target.unparseable" to "createsmustcallfor.target.unparsable".
Implementation details
In
AnnotatedTypeFactory:
- new overload
canonicalAnnotation(AnnotationMirror, TypeMirror).In
TypeHierarchy:
- new methods
equalsShallowEffective().Closed issues
231e855
new release 4.2.0e59f66f
Prep for release.bcc021f
Fix problem with type var in a method reference (#7729)91392e5
Use gradle-git-properties version 4cdae258
Increase constraint limit (#7752)dbb553d
Fix check of receiver override (#7746)264c73d
Fix "unneeded.suppression" warning (#7747)d118b89
New methods equalsShallowEffective() (#7745)a916913
Simplify logic (#7744)227974f
Update plugin com-gradleup-shadow to v9.4.2 (#7749)Sourced from org.junit.jupiter:junit-jupiter-engine's releases.
JUnit 6.1.0 = Platform 6.1.0 + Jupiter 6.1.0 + Vintage 6.1.0
See Release Notes.
New Contributors
@JarvisCraftmade their first contribution in junit-team/junit-framework#5633@Maran23made their first contribution in junit-team/junit-framework#5644Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.3...r6.1.0
JUnit 6.1.0-RC1 = Platform 6.1.0-RC1 + Jupiter 6.1.0-RC1 + Vintage 6.1.0-RC1
See Release Notes.
New Contributors
@mariokhoury4made their first contribution in junit-team/junit-framework#4574@Ogu1208made their first contribution in junit-team/junit-framework#5145@HyungGeun94made their first contribution in junit-team/junit-framework#5271@yalishevantmade their first contribution in junit-team/junit-framework#5316@JINU-CHANGmade their first contribution in junit-team/junit-framework#5290@jaschdocmade their first contribution in junit-team/junit-framework#5427@kawshikbuet17made their first contribution in junit-team/junit-framework#5561@msridharmade their first contribution in junit-team/junit-framework#5602Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.0-M1...r6.1.0-RC1
JUnit 6.1.0-M1 = Platform 6.1.0-M1 + Jupiter 6.1.0-M1 + Vintage 6.1.0-M1
See Release Notes.
New Contributors
@vymade their first contribution in junit-team/junit-framework#5041@Pankraz76made their first contribution in junit-team/junit-framework#5006@arukiidoumade their first contribution in junit-team/junit-framework#5066@laeubimade their first contribution in junit-team/junit-framework#5092@jihun4452made their first contribution in junit-team/junit-framework#5088@TWiStErRobmade their first contribution in junit-team/junit-framework#5133Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.0...r6.1.0-M1
JUnit 6.0.3 = Platform 6.0.3 + Jupiter 6.0.3 + Vintage 6.0.3
See Release Notes.
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.2...r6.0.3
JUnit 6.0.2 = Platform 6.0.2 + Jupiter 6.0.2 + Vintage 6.0.2
See Release Notes.
... (truncated)
0dc3af1
Release 6.1.01d13002
Prepare 6.1.0 release notes072b217
Update plugin spotless to v8.5.0 (#5668)3a53480
Update Gradle to v9.5.1 (#5666)0e18a20
Update zizmorcore/zizmor-action action to v0.5.4 (#5669)0a2634f
Update github/codeql-action action to v4.35.5 (#5671)4dbd556
Restructure workflows to have single "status" job (#5670)f2194ce
Increase timeout to reduce flakiness5c8fdd2
Update dependency org.apache.groovy:groovy to v5.0.6 (#5659)43c6982
Update dependency org.slf4j:slf4j-jdk14 to v2.0.18 (#5667)Sourced from org.junit.jupiter:junit-jupiter-api's releases.
JUnit 6.1.0 = Platform 6.1.0 + Jupiter 6.1.0 + Vintage 6.1.0
See Release Notes.
New Contributors
@JarvisCraftmade their first contribution in junit-team/junit-framework#5633@Maran23made their first contribution in junit-team/junit-framework#5644Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.3...r6.1.0
JUnit 6.1.0-RC1 = Platform 6.1.0-RC1 + Jupiter 6.1.0-RC1 + Vintage 6.1.0-RC1
See Release Notes.
New Contributors
@mariokhoury4made their first contribution in junit-team/junit-framework#4574@Ogu1208made their first contribution in junit-team/junit-framework#5145@HyungGeun94made their first contribution in junit-team/junit-framework#5271@yalishevantmade their first contribution in junit-team/junit-framework#5316@JINU-CHANGmade their first contribution in junit-team/junit-framework#5290@jaschdocmade their first contribution in junit-team/junit-framework#5427@kawshikbuet17made their first contribution in junit-team/junit-framework#5561@msridharmade their first contribution in junit-team/junit-framework#5602Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.0-M1...r6.1.0-RC1
JUnit 6.1.0-M1 = Platform 6.1.0-M1 + Jupiter 6.1.0-M1 + Vintage 6.1.0-M1
See Release Notes.
New Contributors
@vymade their first contribution in junit-team/junit-framework#5041@Pankraz76made their first contribution in junit-team/junit-framework#5006@arukiidoumade their first contribution in junit-team/junit-framework#5066@laeubimade their first contribution in junit-team/junit-framework#5092@jihun4452made their first contribution in junit-team/junit-framework#5088@TWiStErRobmade their first contribution in junit-team/junit-framework#5133Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.0...r6.1.0-M1
JUnit 6.0.3 = Platform 6.0.3 + Jupiter 6.0.3 + Vintage 6.0.3
See Release Notes.
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.2...r6.0.3
JUnit 6.0.2 = Platform 6.0.2 + Jupiter 6.0.2 + Vintage 6.0.2
See Release Notes.
... (truncated)
0dc3af1
Release 6.1.01d13002
Prepare 6.1.0 release notes072b217
Update plugin spotless to v8.5.0 (#5668)3a53480
Update Gradle to v9.5.1 (#5666)0e18a20
Update zizmorcore/zizmor-action action to v0.5.4 (#5669)0a2634f
Update github/codeql-action action to v4.35.5 (#5671)4dbd556
Restructure workflows to have single "status" job (#5670)f2194ce
Increase timeout to reduce flakiness5c8fdd2
Update dependency org.apache.groovy:groovy to v5.0.6 (#5659)43c6982
Update dependency org.slf4j:slf4j-jdk14 to v2.0.18 (#5667)Sourced from org.junit.jupiter:junit-jupiter-params's releases.
JUnit 6.1.0 = Platform 6.1.0 + Jupiter 6.1.0 + Vintage 6.1.0
See Release Notes.
New Contributors
@JarvisCraftmade their first contribution in junit-team/junit-framework#5633@Maran23made their first contribution in junit-team/junit-framework#5644Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.3...r6.1.0
JUnit 6.1.0-RC1 = Platform 6.1.0-RC1 + Jupiter 6.1.0-RC1 + Vintage 6.1.0-RC1
See Release Notes.
New Contributors
@mariokhoury4made their first contribution in junit-team/junit-framework#4574@Ogu1208made their first contribution in junit-team/junit-framework#5145@HyungGeun94made their first contribution in junit-team/junit-framework#5271@yalishevantmade their first contribution in junit-team/junit-framework#5316@JINU-CHANGmade their first contribution in junit-team/junit-framework#5290@jaschdocmade their first contribution in junit-team/junit-framework#5427@kawshikbuet17made their first contribution in junit-team/junit-framework#5561@msridharmade their first contribution in junit-team/junit-framework#5602Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.0-M1...r6.1.0-RC1
JUnit 6.1.0-M1 = Platform 6.1.0-M1 + Jupiter 6.1.0-M1 + Vintage 6.1.0-M1
See Release Notes.
New Contributors
@vymade their first contribution in junit-team/junit-framework#5041@Pankraz76made their first contribution in junit-team/junit-framework#5006@arukiidoumade their first contribution in junit-team/junit-framework#5066@laeubimade their first contribution in junit-team/junit-framework#5092@jihun4452made their first contribution in junit-team/junit-framework#5088@TWiStErRobmade their first contribution in junit-team/junit-framework#5133Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.0...r6.1.0-M1
JUnit 6.0.3 = Platform 6.0.3 + Jupiter 6.0.3 + Vintage 6.0.3
See Release Notes.
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.0.2...r6.0.3
JUnit 6.0.2 = Platform 6.0.2 + Jupiter 6.0.2 + Vintage 6.0.2
See Release Notes.
... (truncated)
0dc3af1
Release 6.1.01d13002
Prepare 6.1.0 release notes072b217
Update plugin spotless to v8.5.0 (#5668)3a53480
Update Gradle to v9.5.1 (#5666)0e18a20
Update zizmorcore/zizmor-action action to v0.5.4 (#5669)0a2634f
Update github/codeql-action action to v4.35.5 (#5671)4dbd556
Restructure workflows to have single "status" job (#5670)f2194ce
Increase timeout to reduce flakiness5c8fdd2
Update dependency org.apache.groovy:groovy to v5.0.6 (#5659)43c6982
Update dependency org.slf4j:slf4j-jdk14 to v2.0.18 (#5667)6e1c179
chore(main): release 2.64.0 (#3954)7a2f0b0
chore: update upper bound dependencies file (#3966)1e4a7e5
chore: update googleapis commit at Fri Oct 17 02:31:11 UTC 2025 (#3951)ffb557c
deps: Bump grpc-java to v1.76.0 (#3942)9ad8a4d
chore: remove internal/librariangen following migration to librarian
repo (#3...0a1bbea
chore(librariangen): Generate to use languagecontainer.Run (#3968)452d703
feat(librariangen): generate grpc stubs and resource helpers (#3967)85057e8
ci: remove librarian skipping on matrix builds (#3969)a26a6d9
chore(librariangen): languagecontainer package to parse release-init
request ...c86b4ea
ci: exclude internal/librariangen/** using dorny/paths-filter (#3961)112e859
[maven-release-plugin] prepare release jackson-bom-2.22.02cae2ce
Prep for 2.22.0 release7955d21
Merge branch '2.21' into 2.x8922a05
Post-release dep version bump1fa9943
[maven-release-plugin] prepare for next development iterationd1abd31
[maven-release-plugin] prepare release jackson-bom-2.21.42aaea43
Prep for 2.21.4 release902ec69
Update Woodstox/stax2-api (to 7.2.0/4.3.0)2570647
Merge branch '2.21' into 2.x9d3a9d5
Post-release dep version bumpSourced from com.diffplug.spotless:spotless-maven-plugin's releases.
Maven Plugin v3.6.0
Added
- Add
<cacheDirectory>to<eclipse>,<greclipse>, and<eclipseCdt>for the Equo/Solstice P2 cache. (#2944)EclipseJdtFormtterStepnow can conditionally set compiler source/compliance options. Allows for better parsing of AST Node for newer language features and more correct sorting; e.g. records or seal classes. (#2942)Fixed
<versionCatalog>no longer splits long inline tables across multiple lines — Gradle's TOML 1.0 parser cannot read multi-line inline tables. ThemaxLineLengthoption has been removed. (#2948)spotless:applyno longer aborts on the first file with lints; it now formats all files and reports a single aggregated lint failure across every file, matching the Gradle plugin's behavior. (#2937)<greclipse>and<eclipseCdt>now default P2 data to the Maven local repository. (#2944)forbidWildcardImportsandforbidModuleImportsnow detect imports that have leading whitespace (indentation/tabs). (#2939)Changes
- Improved formatting performance by eliminating redundant per-step line-ending normalization in the core formatter loop. (#2934)
Maven Plugin v3.5.1
Fixed
<licenseHeader>with<yearMode>SET_FROM_GIT</yearMode>no longer runsgit logthrough a shell, eliminating a shell-injection vector when formatting files whose names contain shell metacharacters.- Bump transitive
plexus-utils4.0.2->4.0.3to address CVE-2025-67030. (#2919)Maven Plugin v3.5.0
Added
<scalafmt>now reads the version from theversionfield in the scalafmt config file when no<version>is explicitly set, falling back to the built-in default only if neither is available. (#2922)- Add
<toml>format type with<versionCatalog>step for formatting and sorting Gradle version catalog files. (#2916)- Add
<javaparserVersion>option to<cleanthat>, allowing users to override the JavaParser version pulled in transitively by Cleanthat. (#2903)- Add a
expandWildcardImportsAPI for java (#2829)Fixed
- Preserve case of JDBI named bind params that collide with SQL keywords (e.g.
:limit,:offset) in the DBeaver SQL formatter. (#2899)- The
-Dspotless.ratchetFrom=...user property now takes priority over<ratchetFrom>configured in the plugin or in individual formatters, instead of being overridden by them. (#2896, fixes #2842)- Fix non-idempotent formatting when
importOrder()is combined withgreclipse(): a single catch-all group no longer strips blank lines thatgreclipse()independently inserted between import groups. (#2914)Changes
- Fix
expandWildcardImportsfailing on JDK XML types such asorg.xml.sax.InputSource. (#2921)- Use Eclipse JDT's collator-based comparison when sorting Java members to better match Eclipse save actions. (#2920)
- Bump default
cleanthatversion2.24->2.25. (#2903)- Bump default
eclipse-jdtversion from4.35to4.39. (#2912)
71a433c
Published maven/3.6.03a0f101
Published gradle/8.6.0007e9d8
Published lib/4.6.2a074d53
Allow setting the local P2 cache dir in the Spotless Gradle plugin (#2944)a266fc2
Merge branch 'main' into add-cache-directory-dsle0d466e
Fix: sort members treats record declarations as types (#2942)3936b6f
Merge branch 'main' into main278765f
fix: expandWildcardImports support pom type dependency, fix #2839
(#2935)a18ddec
Remove maxLineLength from versionCatalog step (#2949)b91ad87
Add changelog entries for versionCatalog maxLineLength removalSourced from io.netty:netty-bom's releases.
netty-4.2.15.Final
Security fixes
- CVE-2026-48059: memory exhaustion in
io.netty:netty-codec-haproxy(high).- CVE-2026-47691: DNS cache poisoning in
io.netty:netty-resolver-dns(high).- CVE-2026-50560: DDoS in
io.netty:netty-codec-http2.- CVE-2026-50011: memory exhaustion in
io.netty:netty-codec-redis(high).- CVE-2026-44250: memory exhaustion in
io.netty:netty-codec-redis(high).- CVE-2026-44890: memory exhaustion in
io.netty:netty-codec-redis(high).- CVE-2026-50009: information disclosure and denial of service in
io.netty:netty-codec-classes-quic.- CVE-2026-44249: IPv6 subnet filter bypass in
io.netty:netty-handler(high).- CVE-2026-50020: request smuggling in
io.netty:netty-codec-http.- CVE-2026-44892: memory exhaustion in
io.netty:netty-codec-http3(high).- CVE-2026-44893: memory leak in
io.netty:netty-codec-haproxy(high).- CVE-2026-44894: traffic amplification in
io.netty:netty-codec-classes-quic(high).- CVE-2026-50010: TLS hostname verification accidentally disabled in
io.netty:netty-handler(high).- CVE-2026-45673: DNS cache poisoning in
io.netty:netty-resolver-dns.- CVE-2026-45416: excessive memory usage from SNIHandler in
io.netty:netty-handler(high).- CVE-2026-45536: file descriptor leak in
io.netty:netty-transport-native-epollandio.netty:netty-transport-native-kqueue.- CVE-2026-45674: DNS cache poisoning in
io.netty:netty-resolver-dns(high).- CVE-2026-46340: memory exhaustion in
io.netty:netty-transport-sctp(high).- CVE-2026-47244: denial of service in
io.netty:netty-codec-http2.- CVE-2026-48006: memory exhaustion in
io.netty:netty-codec-redis(high).- CVE-2026-48748: memory exhaustion in
io.netty:netty-codec-http3(high).- CVE-2026-48043: memory exhaustion in
io.netty:netty-codec-http2.What's Changed
- Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by
@dreamlike-oceanin netty/netty#16836- HTTP/2: Parse request-target path like Vert.x by
@yawkatin netty/netty#16810- Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by
@netty-project-botin netty/netty#16853- FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by
@schiemonin netty/netty#16837- Pass maxAllocation to Brotli and Zstd decoders by
@fedinskiyin netty/netty#16844- Fix revapi warnings by
@chrisvestin netty/netty#16885- Fix SCTP and Redis tests by
@chrisvestin netty/netty#16893- Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by
@skyguard1in netty/netty#16850- Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by
@netty-project-botin netty/netty#16890New Contributors
@schiemonmade their first contribution in netty/netty#16837@fedinskiymade their first contribution in netty/netty#16844Full Changelog: https://github.com/netty/netty/compare/netty-4.2.14.Final...netty-4.2.15.Final
a41f7b2
[maven-release-plugin] prepare release netty-4.2.15.Final2394530
Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero
Remain...0bd1657
Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)76291f5
Fix SCTP and Redis tests (#16893)e067b6e
Fix revapi warnings (#16885)5a52600
Pass maxAllocation to Brotli and Zstd decoders (#16844)541add0
Merge commit from fork270800e
Merge commit from fork3d45a1e
Merge commit from fork75127ca
Merge commit from forkSourced from com.squareup.okhttp3:mockwebserver3-junit5's changelog.
Version 5.4.0
2026-06-08
- New: Add superpowers to interceptors. Interceptors can now override anything settable on
OkHttpClient.Builder, such as the cache, connection pool, socket factory, and DNS. We expect this will allow most users to use interceptors everywhere, insted of mixing and matching interceptors with customCall.Factorywrappers.- Fix: Limit each HTTP/2 response to 256 KiB of total headers.
- Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is used by the optional
okhttp-coroutinesartifact.- Upgrade: [GraalVM 25.0.3][graalvm_25].
- Upgrade: [Okio 3.17.0][okio_3_17_0].
61423f4
Prepare for release 5.4.0.d7e6eff
Update eclipse.osgi to v3.24.200 (#9480)7a35098
Update bnd to v7.3.0 (#9475)0c5a45b
Update dependency com.puppycrawl.tools:checkstyle to v13.5.0 (#9468)113ad17
Update dependency macos to v26 (#9457)84f601a
Update shadow.plugin to v9.4.2 (#9466)7d463f4
Update spotless.plugin to v8.6.0 (#9464)3bf00f5
Update plugin com.diffplug.spotless to v8.6.0 (#9463)cfc45a3
Update spotless.plugin to v8.5.1 (#9456)81c5006
Apply gradle lint correctly (#9459)Sourced from org.jacoco:jacoco-maven-plugin's releases.
0.8.15
New Features
- JaCoCo now officially supports Java 26 (GitHub #2076).
- Experimental support for Java 27 class files (GitHub #2004).
- Compatibility methods generated by Kotlin compiler for functions defined in interfaces are filtered out during generation of report (GitHub #1905).
- Compatibility methods generated by Kotlin compiler for exposed boxed inline value classes (JvmExposeBoxed annotation) are filtered out during generation of report (GitHub #1944).
- Methods generated by the Kotlin compiler for functions with JvmStatic annotation are filtered out during generation of report (GitHub #2097).
- Improved filtering of bytecode generated by Kotlin compiler for when expressions and statements with kotlin.String subject where first branch condition contains string with largest hash (GitHub #2098).
- Part of bytecode that javac versions from 24 to 26 generate for switch statements and expressions with selector expression of type java.lang.String inside lambdas is filtered out during generation of report (GitHub #2023).
- Improved performance of Kotlin files analysis by parsing SMAPs only once per class (GitHub #2114).
- For better performance agent output methods tcpclient and tcpserver use BufferedOutputStream to write execution data to socket. Maven plugin, Ant tasks, CLI, API usage examples, and ExecDumpClient API use BufferedInputStream to read execution data from socket. Third-party integrations should do the same to benefit from this change in agent (GitHub #2089).
Fixed bugs
- Fixed processing of Kotlin SMAP in synthetic classes (GitHub #1985).
- Multiple JaCoCo runtimes within one JVM writing to the same output file should not cause data corruption when running on JDK versions from 6 to 10 affected by JDK-8166253 (GitHub #2065, #2074).
- For better performance agent writes to output file via BufferedOutputStream, this fixes regression introduced in version 0.6.2 (GitHub #2073).
- Fixed NullPointerException when JaCoCo agent is loaded by non system class loader, for example when loaded by JBoss Modules (GitHub #1651).
Non-functional Changes
- JaCoCo now depends on ASM 9.10.1 (GitHub #2134).
6c5260a
Prepare release v0.8.155c05141
Transfer of execution data through socket should use buffered stream (#2089)ab5efa9
Remove from Azure Pipelines all builds except with JDK 5 and JDK EA (#2148)5f6ea38
Use Windows 2025 image in GitHub Actions (#2130)35a8af2
Use Renovate instead of Dependabot for updates of ASM (#2137)85b8ddf
Upgrade ASM to 9.10.1 (#2134)2988647
AgentModule should use ClassLoader of agent instead of SystemClassLoader
(#1651)75a4e31
Add filter for Kotlin @JvmExposeBoxed (#1944)691fa1d
Use Renovate instead of Dependabot for updates of GitHub Actions (#2132)3e18f17
Require at least JDK 21 for build (#2128)... (truncated)
7b5e9ff
Bump version to 1.82.120768f1
Update README etc to reference 1.82.15ab5eba
kokoro: Remove extra / in architecture replacement6726caf
buildscripts: add regional td config for psm-interop (v1.82.x backport)
(#12864)022256f
Bump version to 1.82.1-SNAPSHOT78fb519
Bump version to 1.82.0b62b0fc
Update README etc to reference 1.82.08802dc3
build: downgrade multiarch to Ubuntu 20.04 and consolidate images (#12830)be300bd
kokoro: Avoid brew on Mac OS4111f6f
core: throw IOException when ProxySelector returns null or empty list
(#12793)Sourced from org.junit.jupiter:junit-jupiter-engine's releases.
JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1
See Release Notes.
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1
0d85889
Release 6.1.10363eee
Finalize 6.1.1 release notesa6d540a
Move entry to 6.1.1 release notes69339d5
Only pass timeout when publishing to avoid failure in nmcp plugindec2eb9
Allow excluding engines from memory cleanup mode (#5786)a5f4270
Publish sha256/sha512 checksums again but filter out signature ones (#5796)8213012
Update plugin nmcp-settings to v1.6.0 (#5787)d1bf847
Generate Javadoc for aggregator modulesd721de5
Pass --no-fonts to javadoc conventiond289ec6
Restore original SetSystemProperty values in a ParameterizedTest (#5720)Sourced from org.junit.jupiter:junit-jupiter-api's releases.
JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1
See Release Notes.
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1
0d85889
Release 6.1.10363eee
Finalize 6.1.1 release notesa6d540a
Move entry to 6.1.1 release notes69339d5
Only pass timeout when publishing to avoid failure in nmcp plugindec2eb9
Allow excluding engines from memory cleanup mode (#5786)a5f4270
Publish sha256/sha512 checksums again but filter out signature ones (#5796)8213012
Update plugin nmcp-settings to v1.6.0 (#5787)d1bf847
Generate Javadoc for aggregator modulesd721de5
Pass --no-fonts to javadoc conventiond289ec6
Restore original SetSystemProperty values in a ParameterizedTest (#5720)Sourced from org.junit.jupiter:junit-jupiter-params's releases.
JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1
See Release Notes.
Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1
0d85889
Release 6.1.10363eee
Finalize 6.1.1 release notesa6d540a
Move entry to 6.1.1 release notes69339d5
Only pass timeout when publishing to avoid failure in nmcp plugindec2eb9
Allow excluding engines from memory cleanup mode (#5786)a5f4270
Publish sha256/sha512 checksums again but filter out signature ones (#5796)8213012
Update plugin nmcp-settings to v1.6.0 (#5787)d1bf847
Generate Javadoc for aggregator modulesd721de5
Pass --no-fonts to javadoc conventiond289ec6
Restore original SetSystemProperty values in a ParameterizedTest (#5720)Sourced from actions/cache's releases.
v6.0.0
What's Changed
- Update packages, migrate to ESM by
@Samiratin actions/cache#1760Full Changelog: https://github.com/actions/cache/compare/v5...v6.0.0
v5.1.0
What's Changed
- Bump
@actions/cacheto v5.1.0 - handle read-only cache access by@jasonginin actions/cache#1775Full Changelog: https://github.com/actions/cache/compare/v5...v5.1.0
v5.0.5
What's Changed
- Update ts-http-runtime dependency by
@yacaovsncin actions/cache#1747Full Changelog: https://github.com/actions/cache/compare/v5...v5.0.5
v5.0.4
What's Changed
- Add release instructions and update maintainer docs by
@Link- in actions/cache#1696- Potential fix for code scanning alert no. 52: Workflow does not contain permissions by
@Link- in actions/cache#1697- Fix workflow permissions and cleanup workflow names / formatting by
@Link- in actions/cache#1699- docs: Update examples to use the latest version by
@XZTDeanin actions/cache#1690- Fix proxy integration tests by
@Link- in actions/cache#1701- Fix cache key in examples.md for bun.lock by
@RyPeckin actions/cache#1722- Update dependencies & patch security vulnerabilities by
@Link- in actions/cache#1738New Contributors
@XZTDeanmade their first contribution in actions/cache#1690@RyPeckmade their first contribution in actions/cache#1722Full Changelog: https://github.com/actions/cache/compare/v5...v5.0.4
v5.0.3
What's Changed
- Bump
@actions/cacheto v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)- Bump
@actions/coreto v2.0.3Full Changelog: https://github.com/actions/cache/compare/v5...v5.0.3
v.5.0.2
v5.0.2
What's Changed
... (truncated)
55cc834
Merge pull request #1768
from jasongin/readonly-cached8cd72f
Bump @actions/cache to v6.1.0 - handle cache write error
due to RO token2c8a9bd
Merge pull request #1760
from actions/samirat/esm_migration_and_package_updatee9b91fd
Prettier fixese4884b8
Rebuild dist10baf01
Fixed licensese39b386
Fix test mock return orderb692820
PR feedback6074912
Rebuild dist bundles as ESM to match type:module5a912e8
Fix lint and jest issuesSourced from actions/checkout's releases.
v7.0.0
What's Changed
- block checking out fork pr for pull_request_target and workflow_run by
@aiqiaoyin actions/checkout#2454- Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by
@dependabot[bot] in actions/checkout#2458- Bump flatted from 3.3.1 to 3.4.2 by
@dependabot[bot] in actions/checkout#2460- Bump js-yaml from 4.1.0 to 4.2.0 by
@dependabot[bot] in actions/checkout#2461- Bump
@actions/coreand@actions/tool-cacheand Remove uuid by@dependabot[bot] in actions/checkout#2459- upgrade module to esm and update dependencies by
@aiqiaoyin actions/checkout#2463- Bump the minor-npm-dependencies group across 1 directory with 3 updates by
@dependabot[bot] in actions/checkout#2462- getting ready for checkout v7 release by
@aiqiaoyin actions/checkout#2464- update error wording by
@aiqiaoyin actions/checkout#2467New Contributors
@aiqiaoymade their first contribution in actions/checkout#2454Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v7.0.0
v6.0.3
What's Changed
- Update changelog by
@ericsciplein actions/checkout#2357- fix: expand merge commit SHA regex and add SHA-256 test cases by
@yaananthin actions/checkout#2414- Fix checkout init for SHA-256 repositories by
@yaananthin actions/checkout#2439- Update changelog for v6.0.3 by
@yaananthin actions/checkout#2446New Contributors
@yaananthmade their first contribution in actions/checkout#2414Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.3
v6.0.2
What's Changed
- Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by
@TingluoHuangin actions/checkout#2355- Fix tag handling: preserve annotations and explicit fetch-tags by
@ericsciplein actions/checkout#2356Full Changelog: https://github.com/actions/checkout/compare/v6.0.1...v6.0.2
v6.0.1
What's Changed
- Update all references from v5 and v4 to v6 by
@ericsciplein actions/checkout#2314- Add worktree support for persist-credentials includeIf by
@ericsciplein actions/checkout#2327- Clarify v6 README by
@ericsciplein actions/checkout#2328Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.1
Sourced from actions/checkout's changelog.
Changelog
v7.0.0
- Block checking out fork PR for pull_request_target and workflow_run by
@aiqiaoyin actions/checkout#2454- Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by
@dependabot[bot] in actions/checkout#2458- Bump flatted from 3.3.1 to 3.4.2 by
@dependabot[bot] in actions/checkout#2460- Bump js-yaml from 4.1.0 to 4.2.0 by
@dependabot[bot] in actions/checkout#2461- Bump
@actions/coreand@actions/tool-cacheand Remove uuid by@dependabot[bot] in actions/checkout#2459- upgrade module to esm and update dependencies by
@aiqiaoyin actions/checkout#2463- Bump the minor-npm-dependencies group across 1 directory with 3 updates by
@dependabot[bot] in actions/checkout#2462v6.0.3
- Fix checkout init for SHA-256 repositories by
@yaananthin actions/checkout#2439- fix: expand merge commit SHA regex and add SHA-256 test cases by
@yaananthin actions/checkout#2414v6.0.2
- Fix tag handling: preserve annotations and explicit fetch-tags by
@ericsciplein actions/checkout#2356v6.0.1
- Add worktree support for persist-credentials includeIf by
@ericsciplein actions/checkout#2327v6.0.0
- Persist creds to a separate file by
@ericsciplein actions/checkout#2286- Update README to include Node.js 24 support details and requirements by
@salmanmkcin actions/checkout#2248v5.0.1
- Port v6 cleanup to v5 by
@ericsciplein actions/checkout#2301v5.0.0
- Update actions checkout to use node 24 by
@salmanmkcin actions/checkout#2226v4.3.1
- Port v6 cleanup to v4 by
@ericsciplein actions/checkout#2305v4.3.0
- docs: update README.md by
@motssin actions/checkout#1971- Add internal repos for checking out multiple repositories by
@mouismailin actions/checkout#1977- Documentation update - add recommended permissions to Readme by
@benwellsin actions/checkout#2043- Adjust positioning of user email note and permissions heading by
@joshmgrossin actions/checkout#2044- Update README.md by
@nebuk89in actions/checkout#2194- Update CODEOWNERS for actions by
@TingluoHuangin actions/checkout#2224- Update package dependencies by
@salmanmkcin actions/checkout#2236v4.2.2
url-helper.tsnow leverages well-known environment variables by@jww3in actions/checkout#1941- Expand unit test coverage for
isGhesby@jww3in actions/checkout#1946v4.2.1
- Check out other refs/* by commit if provided, fall back to ref by
@orhantoyin actions/checkout#1924
... (truncated)
9c091bb
update error wording (#2467)1044a6d
getting ready for checkout v7 release (#2464)f028218
Bump the minor-npm-dependencies group across 1 directory with 3 updates
(#2462)d914b26
upgrade module to esm and update dependencies (#2463)537c7ef
Bump @actions/core and @actions/tool-cache
and Remove uuid (#2459)130a169
Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575
Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aa
Bump actions/publish-immutable-action (#2458)f9e715a
block checking out fork pr for pull_request_target and workflow_run (#2454)Sourced from org.cyclonedx:cyclonedx-maven-plugin's releases.
2.9.2
🚀 New features and improvements
- chore: upgrade maven-dependency-analyzer/asm, support Java 25 (#630)
@shihyuho📦 Dependency updates
- Bump commons-codec:commons-codec from 1.17.1 to 1.22.0 (#650) @dependabot[bot]
- Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.19.0 (#622) @dependabot[bot]
- chore: upgrade maven-dependency-analyzer/asm, support Java 25 (#630)
@shihyuho🔧 Build
- update scm urls (#662)
@hboutemy- switch to Central Publishing Portal (#659)
@hboutemy- Bump org.apache.maven.plugins:maven-project-info-reports-plugin from 3.8.0 to 3.9.0 (#655) @dependabot[bot]
- Bump plugin-tools.version from 3.15.0 to 3.15.2 (#654) @dependabot[bot]
- Bump io.takari.maven.plugins:takari-plugin-integration-testing from 3.0.1 to 3.1.1 (#616) @dependabot[bot]
- Bump org.apache.maven.plugins:maven-invoker-plugin from 3.7.0 to 3.9.1 (#617) @dependabot[bot]
- Bump io.takari.maven.plugins:takari-plugin-testing from 3.0.0 to 3.1.1 (#618) @dependabot[bot]
- Bump org.apache.maven.plugins:maven-compiler-plugin from 3.13.0 to 3.14.1 (#621) @dependabot[bot]
- Bump actions/checkout from 6.0.1 to 6.0.2 (#639) @dependabot[bot]
- Bump actions/setup-java from 4 to 5 (#620) @dependabot[bot]
- use shields.io badge (#648)
@hboutemy- Bump actions/checkout from 6.0.0 to 6.0.1 (#635) @dependabot[bot]
- Bump actions/checkout from 4.2.2 to 6.0.0 (#633) @dependabot[bot]
- chore: GH workflow permissions (#606)
@jkowalleck- simplify compiler release configuration (#518)
@hboutemy- Bump JamesIves/github-pages-deploy-action from 4.7.1 to 4.7.3 (#590) @dependabot[bot]
- upgrade to Doxia 2: m-site-p and skin (#593)
@hboutemy- add Reproducible Central report (#592)
@hboutemy
0fe189d
[maven-release-plugin] prepare release cyclonedx-maven-plugin-2.9.296c218c
update scm urls0fe08b4
Revert "Bump JamesIves/github-pages-deploy-action from 4.7.3 to
4.8.0"6779e48
Revert "Bump release-drafter/release-drafter from 6 to 7"955fead
switch to Central Publishing Portal50dbac7
Bump release-drafter/release-drafter from 6 to 7d50bc58
Bump org.apache.maven.plugins:maven-project-info-reports-plugin1034644
Bump plugin-tools.version from 3.15.0 to 3.15.2018ab8e
Bump commons-codec:commons-codec from 1.17.1 to 1.22.0e359705
Bump JamesIves/github-pages-deploy-action from 4.7.3 to 4.8.0Sourced from ch.qos.logback:logback-classic's releases.
Logback 1.5.34
2026-06-01 Release of logback version 1.5.34
• In case certain StackTraceElement values returned by the Throwable.getStackTrace method are null, StackTraceElementProxy substitutes a dummy instance instead of throwing an IllegalArgumentException. This resolves [issues #1040](qos-ch/logback#1040), reported by Naotsugu Kobayashi.
• HardenedObjectInputStream will now throw an InvalidClassException during deserialization attempts of Proxy classes. This change addresses potential deserialization whitelist bypass vulnerability reported by York Shen and registered as CVE-2026-10532.
• A bitwise identical binary of this version can be reproduced by building from source code at commit e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag v_1.5.34. This release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.
Logback 1.5.33
2026-05-27 Release of logback version 1.5.33
•
PropertiesConfiguratorModelHandlernow registers properties file URLs to theConfigurationWatchListwhen scan is enabled (via local scan="true" attribute or top-level configuration scan), ensuring changes are detected and reconfiguration occurs. This problem was reported in issues/1034.• When processing
<conversionRule>elements and bothclassandconverterClassattributes are specified, silently use the class attribute without issuing a warning. However, if the attribute values differ, a warning will be issued. This change was requested in issues/1031.•
HardenedModelInputStreamwill no longer accept to deserialize all classes located under the "java.lang" and "java.util" packages but a limited number of explicitly authorized classes in those packages. This potential deserialization whitelist bypass vulnerability was reported by York Shen and registered as CVE-2026-9828.• SSL parameters for
SSLSocketAppendernow enable hostname verification by default. Moreover, the default protocol is now "TLSv1.2". This potential vulnerability was reported by York Shen.• When printing the status message field,
ViewStatusMessagesServletBasenow escapes special characters such as "&" as character entities. This potential vulnerability was reported by York Shen.• A bit-wise identical binary of this version can be reproduced by building from source code at commit 124e8b49b55ac34d08743a0646bd463410192647 associated with the tag v_1.5.33. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.
e62272a
prepare release 1.5.341e9e926
add resolveProxyClassRejectsDynamicProxies unit test2de5cbe
added StackTraceElementProxyTest, minor edits to AGENTS.md0e9b927
in case StackTraceElement is null use a substitute, fixing
issues/1040f7a0654
prevent resolveProxyClass bypass249b81f
docs are no longer distributed1c3b26a
start work on 1.5.34-SNAPSHOT124e8b4
prepare release 1.5.33d8fd6f2
escapeTags in message field when printing status messages95edbeb
hostnameVerification default to true in SSLParametersConfiguration,
SSL.DEFAU...Sourced from ch.qos.logback:logback-core's releases.
Logback 1.5.34
2026-06-01 Release of logback version 1.5.34
• In case certain StackTraceElement values returned by the Throwable.getStackTrace method are null, StackTraceElementProxy substitutes a dummy instance instead of throwing an IllegalArgumentException. This resolves [issues #1040](qos-ch/logback#1040), reported by Naotsugu Kobayashi.
• HardenedObjectInputStream will now throw an InvalidClassException during deserialization attempts of Proxy classes. This change addresses potential deserialization whitelist bypass vulnerability reported by York Shen and registered as CVE-2026-10532.
• A bitwise identical binary of this version can be reproduced by building from source code at commit e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag v_1.5.34. This release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.
Logback 1.5.33
2026-05-27 Release of logback version 1.5.33
•
PropertiesConfiguratorModelHandlernow registers properties file URLs to theConfigurationWatchListwhen scan is enabled (via local scan="true" attribute or top-level configuration scan), ensuring changes are detected and reconfiguration occurs. This problem was reported in issues/1034.• When processing
<conversionRule>elements and bothclassandconverterClassattributes are specified, silently use the class attribute without issuing a warning. However, if the attribute values differ, a warning will be issued. This change was requested in issues/1031.•
HardenedModelInputStreamwill no longer accept to deserialize all classes located under the "java.lang" and "java.util" packages but a limited number of explicitly authorized classes in those packages. This potential deserialization whitelist bypass vulnerability was reported by York Shen and registered as CVE-2026-9828.• SSL parameters for
SSLSocketAppendernow enable hostname verification by default. Moreover, the default protocol is now "TLSv1.2". This potential vulnerability was reported by York Shen.• When printing the status message field,
ViewStatusMessagesServletBasenow escapes special characters such as "&" as character entities. This potential vulnerability was reported by York Shen.• A bit-wise identical binary of this version can be reproduced by building from source code at commit 124e8b49b55ac34d08743a0646bd463410192647 associated with the tag v_1.5.33. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.
e62272a
prepare release 1.5.341e9e926
add resolveProxyClassRejectsDynamicProxies unit test2de5cbe
added StackTraceElementProxyTest, minor edits to AGENTS.md0e9b927
in case StackTraceElement is null use a substitute, fixing
issues/1040f7a0654
prevent resolveProxyClass bypass249b81f
docs are no longer distributed1c3b26a
start work on 1.5.34-SNAPSHOT124e8b4
prepare release 1.5.33d8fd6f2
escapeTags in message field when printing status messages95edbeb
hostnameVerification default to true in SSLParametersConfiguration,
SSL.DEFAU...Sourced from com.squareup.okhttp3:mockwebserver3's changelog.
Version 5.4.0
2026-06-08
- New: Add superpowers to interceptors. Interceptors can now override anything settable on
OkHttpClient.Builder, such as the cache, connection pool, socket factory, and DNS. We expect this will allow most users to use interceptors everywhere, insted of mixing and matching interceptors with customCall.Factorywrappers.- Fix: Limit each HTTP/2 response to 256 KiB of total headers.
- Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is used by the optional
okhttp-coroutinesartifact.- Upgrade: [GraalVM 25.0.3][graalvm_25].
- Upgrade: [Okio 3.17.0][okio_3_17_0].
61423f4
Prepare for release 5.4.0.d7e6eff
Update eclipse.osgi to v3.24.200 (#9480)7a35098
Update bnd to v7.3.0 (#9475)0c5a45b
Update dependency com.puppycrawl.tools:checkstyle to v13.5.0 (#9468)113ad17
Update dependency macos to v26 (#9457)84f601a
Update shadow.plugin to v9.4.2 (#9466)7d463f4
Update spotless.plugin to v8.6.0 (#9464)3bf00f5
Update plugin com.diffplug.spotless to v8.6.0 (#9463)cfc45a3
Update spotless.plugin to v8.5.1 (#9456)81c5006
Apply gradle lint correctly (#9459)Sourced from com.diffplug.spotless:spotless-maven-plugin's releases.
Maven Plugin v3.8.0
Added
- Add support for custom string format for license header copyright year via
yearStringFormat(). (#2965)Fixed
<expandWildcardImports>no longer triggers a full transitive dependency resolution on every build. Dependency resolution is now deferred until the step actually runs, so projects that do not use<expandWildcardImports>(or that use version ranges) are no longer penalized. (#2983)Maven Plugin v3.7.0
Fixed
- Parse standard git year output in LicenseHeaderStep. (#2940)
<toggleOffOn>no longer disables lint-only steps such as<forbidWildcardImports>. (#2962)- Fix
StringIndexOutOfBoundsExceptionin scenarios where copyright year is surrounded by whitespace. (#2973)Added
Sourced from com.diffplug.spotless:spotless-maven-plugin's changelog.
spotless-lib and spotless-lib-extra releases
If you are a Spotless user (as opposed to developer), then you are probably looking for:
- https://github.com/diffplug/spotless/blob/main/plugin-gradle/CHANGES.md
- https://github.com/diffplug/spotless/blob/main/plugin-maven/CHANGES.md
This document is intended for Spotless developers.
We adhere to the keepachangelog format (starting after version
1.27.0).[Unreleased]
[4.8.0] - 2026-06-29
Added
- Add support for custom string format for license header copyright year via
yearStringFormat(). (#2965)[4.7.0] - 2026-06-16
Added
- Add support for AsciiDoc formatting via
adocfmt. (#2960)flexmarkstep now supports arbitrary formatter options via aformatterOptionsmap. (#2968)Fixed
FenceStep.preserveWithinnow forwards lints from nested steps while still suppressing lints inside preserved blocks. (#2962)- Support
ktfmt0.63 and use its new builder API for formatting options to better avoid future breaking changes.- Parse standard git year output in LicenseHeaderStep. (#2940)
- Fix
StringIndexOutOfBoundsExceptionin scenarios where copyright year is surrounded by whitespace. (#2973)Changes
- Bump default
greclipseversion to latest4.35->4.39. (#2924)[4.6.2] - 2026-05-27
Fixed
P2Provisionernow passes cache directory overrides directly to Solstice. (#2944)forbidWildcardImportsandforbidModuleImportsnow detect imports that have leading whitespace (indentation/tabs). (#2939)versionCatalogstep no longer splits long inline tables across multiple lines — Gradle's TOML 1.0 parser cannot read multi-line inline tables. ThemaxLineLengthoption has been removed. (#2948)Changes
EclipseJdtFormtterStepnow can conditionally set compiler source/compliance options. Allows for better parsing of AST Node for newer language features and more correct sorting; e.g. records or seal classes. (#2942)Formatterno longer recomputes line-ending normalization (LineEnding.toUnix) a second time for every formatter step that changes content, removing redundant O(n) work from the core formatting loop. (#2934)- expandWildcardImports support pom type dependency. (#2839)
[4.6.1] - 2026-05-15
Fixed
LicenseHeaderStepinSET_FROM_GITyear mode no longer invokesgit logthroughbash -c/cmd /c, eliminating a shell-injection vector when processing repositories that contain files whose names include shell metacharacters.[4.6.0] - 2026-05-14
Added
scalafmt()now reads the version from theversionfield in the scalafmt config file when no version is explicitly set in the plugin config, falling back to the built-in default only if neither is available. (#2922)- Add
versionCatalogstep for formatting and sorting Gradle version catalog (.toml) files. (#2916)- Add
javaparserVersionoption to the Cleanthat step, allowing callers to override the JavaParser version pulled in transitively by Cleanthat. (#2903)Fixed
... (truncated)
03d43ba
Published maven/3.8.08b80c13
Published gradle/8.8.08ee6cf9
Published lib/4.8.06c02c0b
Add missing changelog entry.264f4cc
Add regression test for forbidWildcardImports inside toggleOffOn (#2982)6abb064
fix #2983,
expandWildcardImports triggers a full transitive reso… (#2984)f4536d4
Update plugin spotbugs to v6.5.8 (#2987)873454a
Update plugin spotbugs to v6.5.8000b8a8
Update dependency org.junit.jupiter:junit-jupiter to v6.1.1 (#2985)84ebcab
Update dependency org.junit.jupiter:junit-jupiter to v6.1.1Sourced from com.gradle:common-custom-user-data-maven-extension's releases.
2.3.0
- [NEW] Capture Cursor as an AI agent via the
CURSOR_AGENTenvironment variable
61a5a45
[maven-release-plugin] prepare release v2.3.0398a231
[Renovate Bot] Update actions/setup-java digest to 1bcf9fb (#389)f66a5c6
Merge pull request #391
from gradle/erichaagdev/capture-cursor-ai-agent8311f58
Capture Cursor as an AI agent0236fc8
[Renovate Bot] Update dependency
org.eclipse.sisu:org.eclipse.sisu.inject to ...0d8c2c5
[Renovate Bot] Update GitHub Actions to v7 (#386)21ef159
[Renovate Bot] Update Maven dependencies (#387)d9240f0
[Renovate Bot] Update Maven dependencies to v0.11.0 (#384)83935cc
Auto-merge GitHub Actions digest re-pins (#385)9d03ae6
[Renovate Bot] Update GitHub Actions to ad2b381 (#383)Sourced from org.checkerframework:checker-qual's releases.
Checker Framework 4.2.1
Version 4.2.1 (2026-07-01)
Closed issues
Sourced from org.checkerframework:checker-qual's changelog.
Version 4.2.1 (2026-07-01)
Closed issues
ef8cecd
new release 4.2.15d04611
Prep for release.0907ddc
Use @MonotonicNonNull6a7d71c
Gradle formattingc10d86a
Update plugin com-gradleup-shadow to v9.4.3 (#7778)ec79d1f
Update Gradle to v9.6.1 (#7779)f95a2e0
More examples for -AresourceLeakIgnoredExceptions (#7774)79948a2
Update Gradle to v9.6.0 (#7775)e013552
Update actions/checkout action to v7 (#7776)4ba90c2
Update plugin com-diffplug-spotless to v8.7.0 (#7773)Sourced from org.checkerframework:checker's releases.
Checker Framework 4.2.1
Version 4.2.1 (2026-07-01)
Closed issues
Sourced from org.checkerframework:checker's changelog.
Version 4.2.1 (2026-07-01)
Closed issues
ef8cecd
new release 4.2.15d04611
Prep for release.0907ddc
Use @MonotonicNonNull6a7d71c
Gradle formattingc10d86a
Update plugin com-gradleup-shadow to v9.4.3 (#7778)ec79d1f
Update Gradle to v9.6.1 (#7779)f95a2e0
More examples for -AresourceLeakIgnoredExceptions (#7774)79948a2
Update Gradle to v9.6.0 (#7775)e013552
Update actions/checkout action to v7 (#7776)4ba90c2
Update plugin com-diffplug-spotless to v8.7.0 (#7773)Sourced from docker/login-action's releases.
v4.4.0
- Skip empty
registry-authsecret mask by@crazy-maxin docker/login-action#1035- Bump
@aws-sdk/client-ecrand@aws-sdk/client-ecr-publicto 3.1077.0 docker/login-action#1034Full Changelog: https://github.com/docker/login-action/compare/v4.3.0...v4.4.0
v4.3.0
- Preserve names in esbuild bundle by
@crazy-maxin docker/login-action#1022- Bump
@aws-sdk/client-ecrand@aws-sdk/client-ecr-publicto 3.1076.0 docker/login-action#999 docker/login-action#1030- Bump
@docker/actions-toolkitfrom 0.90.0 to 0.92.0 in docker/login-action#1004 docker/login-action#1027- Bump
@sigstore/corefrom 3.1.0 to 3.2.1 in docker/login-action#1023- Bump
@sigstore/verifyfrom 3.1.0 to 3.1.1 in docker/login-action#1029- Bump http-proxy-agent and https-proxy-agent to 9.1.0 in docker/login-action#1017
- Bump js-yaml from 4.1.1 to 5.2.0 in docker/login-action#1028
- Bump sigstore from 4.1.0 to 4.1.1 in docker/login-action#1031
- Bump tmp from 0.2.5 to 0.2.7 in docker/login-action#1002
- Bump undici from 6.24.1 to 6.27.0 in docker/login-action#1020
- Bump vite from 7.3.3 to 7.3.6 in docker/login-action#1019
Full Changelog: https://github.com/docker/login-action/compare/v4.2.0...v4.3.0
af1e73f
Merge pull request #1034
from docker/dependabot/npm_and_yarn/aws-sdk-dependen...da722bd
[dependabot skip] chore: update generated content2916ad6
build(deps): bump the aws-sdk-dependencies group across 1 directory with
2 up...ca0a662
Merge pull request #1035
from crazy-max/fix-registry-auth-empty-maskc455755
chore: update generated content4835190
skip empty registry-auth secret mask992421c
Merge pull request #1033
from docker/dependabot/github_actions/docker/bake-ac...b249b43
Merge pull request #1032
from docker/dependabot/github_actions/docker/bake-ac...1b67977
build(deps): bump docker/bake-action from 7.2.0 to 7.3.09d49d6a
build(deps): bump docker/bake-action/subaction/matrixSourced from ch.qos.logback:logback-classic's releases.
Logback 1.5.37
2026-06-26 Release of logback version 1.5.37
- • Given the numerous vulnerabilities related to conditional configuration processing based on the evaluation of Java expressions using the Janino library, support for such expressions has been removed. Users are offered the an online migration service or the
<condition>element introduced in version 1.5.20. See the relevant documentation for more details.• A bitwise identical binary of this version can be reproduced by building from source code at commit c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag v_1.5.37. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.
Logback 1.5.36
2026-06-25 Release of logback version 1.5.36
• The 'condition' attribute in
<if>elements now reject certain references that are associated with ACE attacks. This issue was reported by "yulate" (yulate531@gmail.com.com) and registered as CVE-2026-13006. Please note that version 1.5.37 provides the full fix to this vulnerability.• A bitwise identical binary of this version can be reproduced by building from source code at commit 9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag v_1.5.36. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.
Logback 1.5.35
026-06-23 Release of logback version 1.5.35
• The 'condition' attribute in
<if>elements now rejects unicode escape sequences (\u and \U). This closes a bypass of the existing prohibition on the new operator in Janino-evaluated conditions. This issue was reported by IcySun (icysun@qq.com) and registered as CVE-2026-13006. Please note that version 1.5.37 provides the full fix to this vulnerability.• Added
ConfiguratorRank.AUTHENTICATING(rank 100), the highest configurator rank, for certified/authenticating configurators discovered via the ServiceLoader mechanism.ContextInitializernow requires that at most one such configurator exist on the classpath; if more than one is found, initialization aborts with an error.•
ConsoleCharsetPropertyDefineris no longer shipped. The Java 21 multi-release compilation of logback-core has been disabled, which removes this class from the published artifact. Configurations that referencedch.qos.logback.core.property.ConsoleCharsetPropertyDefinerwill need an alternative approach for console charset detection.• The logback-examples module is now included in artifacts published to Maven Central.
•
JoranConfigurator.makeAnotherInstance()andDefaultJoranConfigurator.performMultiStepConfigurationFileSearch()are now protected, allowing derived configurators to override these methods.• A bitwise identical binary of this version can be reproduced by building from source code at commit 08bd1598d565d83444f72983935e7da4746783b7 associated with the tag v_1.5.35. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.
c1df7f5
prepare release 1.5.37a189967
remove conditional based on janinoaaa9052
start work on 1.5.37-SNAPSHOT9b94c37
prepare release 1.5.36e6a8280
prevent attacks using disallowed references24c4b63
start work on 1.5.36-SNAPSHOT08bd159
preapre release 1.5.3537d256b
indentation changes onlyd3d7307
minor commentfa0411a
radomize file locationSourced from ch.qos.logback:logback-core's releases.
Logback 1.5.37
2026-06-26 Release of logback version 1.5.37
- • Given the numerous vulnerabilities related to conditional configuration processing based on the evaluation of Java expressions using the Janino library, support for such expressions has been removed. Users are offered the an online migration service or the
<condition>element introduced in version 1.5.20. See the relevant documentation for more details.• A bitwise identical binary of this version can be reproduced by building from source code at commit c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag v_1.5.37. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.
Logback 1.5.36
2026-06-25 Release of logback version 1.5.36
• The 'condition' attribute in
<if>elements now reject certain references that are associated with ACE attacks. This issue was reported by "yulate" (yulate531@gmail.com.com) and registered as CVE-2026-13006. Please note that version 1.5.37 provides the full fix to this vulnerability.• A bitwise identical binary of this version can be reproduced by building from source code at commit 9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag v_1.5.36. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.
Logback 1.5.35
026-06-23 Release of logback version 1.5.35
• The 'condition' attribute in
<if>elements now rejects unicode escape sequences (\u and \U). This closes a bypass of the existing prohibition on the new operator in Janino-evaluated conditions. This issue was reported by IcySun (icysun@qq.com) and registered as CVE-2026-13006. Please note that version 1.5.37 provides the full fix to this vulnerability.• Added
ConfiguratorRank.AUTHENTICATING(rank 100), the highest configurator rank, for certified/authenticating configurators discovered via the ServiceLoader mechanism.ContextInitializernow requires that at most one such configurator exist on the classpath; if more than one is found, initialization aborts with an error.•
ConsoleCharsetPropertyDefineris no longer shipped. The Java 21 multi-release compilation of logback-core has been disabled, which removes this class from the published artifact. Configurations that referencedch.qos.logback.core.property.ConsoleCharsetPropertyDefinerwill need an alternative approach for console charset detection.• The logback-examples module is now included in artifacts published to Maven Central.
•
JoranConfigurator.makeAnotherInstance()andDefaultJoranConfigurator.performMultiStepConfigurationFileSearch()are now protected, allowing derived configurators to override these methods.• A bitwise identical binary of this version can be reproduced by building from source code at commit 08bd1598d565d83444f72983935e7da4746783b7 associated with the tag v_1.5.35. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.
c1df7f5
prepare release 1.5.37a189967
remove conditional based on janinoaaa9052
start work on 1.5.37-SNAPSHOT9b94c37
prepare release 1.5.36e6a8280
prevent attacks using disallowed references24c4b63
start work on 1.5.36-SNAPSHOT08bd159
preapre release 1.5.3537d256b
indentation changes onlyd3d7307
minor commentfa0411a
radomize file locationSourced from com.squareup.okhttp3:okhttp-jvm's changelog.
Version 5.4.0
2026-06-08
- New: Add superpowers to interceptors. Interceptors can now override anything settable on
OkHttpClient.Builder, such as the cache, connection pool, socket factory, and DNS. We expect this will allow most users to use interceptors everywhere, insted of mixing and matching interceptors with customCall.Factorywrappers.- Fix: Limit each HTTP/2 response to 256 KiB of total headers.
- Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is used by the optional
okhttp-coroutinesartifact.- Upgrade: [GraalVM 25.0.3][graalvm_25].
- Upgrade: [Okio 3.17.0][okio_3_17_0].
61423f4
Prepare for release 5.4.0.d7e6eff
Update eclipse.osgi to v3.24.200 (#9480)7a35098
Update bnd to v7.3.0 (#9475)0c5a45b
Update dependency com.puppycrawl.tools:checkstyle to v13.5.0 (#9468)113ad17
Update dependency macos to v26 (#9457)84f601a
Update shadow.plugin to v9.4.2 (#9466)7d463f4
Update spotless.plugin to v8.6.0 (#9464)3bf00f5
Update plugin com.diffplug.spotless to v8.6.0 (#9463)cfc45a3
Update spotless.plugin to v8.5.1 (#9456)81c5006
Apply gradle lint correctly (#9459)Sourced from actions/setup-python's releases.
v7.0.0
What's Changed
Enhancements
- Migrate to ESM and upgrade dependencies by
@priyagupta108in actions/setup-python#1330- Pin SHA commits and update docs with latest versions by
@HarithaVattikutiin actions/setup-python#1338- Remove the pip-install input by
@gowridurgadin actions/setup-python#1336Bug Fix
- Fix to Classify stderr warning messages as warnings instead of errors in annotations by
@lmvysakhin actions/setup-python#1335- Validate and retry manifest fetch to prevent silent failures by
@priyagupta108in actions/setup-python#1332Dependency Upgrade
- Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data by
@dependabotin actions/setup-python#1328- Remove EOL Python versions and Bumps numpy text fixture by
@priya-kinthaliin actions/setup-python#1333- Upgrade
@actions/cacheto 6.2.0 by@philip-gaiin actions/setup-python#1337New Contributors
@lmvysakhmade their first contribution in actions/setup-python#1335@philip-gaimade their first contribution in actions/setup-python#1337Full Changelog: https://github.com/actions/setup-python/compare/v6...v7.0.0
v6.3.0
What's Changed
Enhancement
- Add RHEL support and include Linux distro in cache keys by
@priyagupta108in actions/setup-python#1323- Fix pip cache error handling on Windows by
@priyagupta108in actions/setup-python#1040Dependency update
- Upgrade minimatch from 3.1.2 to 3.1.5 by
@dependabotin actions/setup-python#1281- Upgrade actions dependencies by
@gowridurgadwith@Copilotin actions/setup-python#1303- Upgrade
@actions/cacheto 5.1.0, log cache write denied by@jasonginin actions/setup-python#1324- Upgrade dependency versions and test workflow configuration by
@HarithaVattikutiin actions/setup-python#1322Documentation
- Update advanced-usage.md by
@Dunky-Zin actions/setup-python#811New Contributors
@gowridurgadwith@Copilotmade their first contribution in actions/setup-python#1303@jasonginmade their first contribution in actions/setup-python#1324@Dunky-Zmade their first contribution in actions/setup-python#811Full Changelog: https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0
v6.2.0
What's Changed
Dependency Upgrades
- Upgrade dependencies to Node 24 compatible versions by
@salmanmkcin actions/setup-python#1259
... (truncated)
5fda3b9
Pin SHA commits and update docs with latest versions (#1338)4ab7e95
Merge pull request #1337
from actions/philip-gai/bump-actions-cache-6-2-00f3a009
Remove the pip-install input (#1336)f8cf429
Migrate to ESM and upgrade dependencies (#1330)54baeea
Validate and retry manifest fetch to prevent silent failures (#1332)c709277
Annotation code fix (#1335)6849080
remove EOL Python versions and Bumps numpy text fixture (#1333)0903b46
Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data
(#1328)A "producer" allocator owns the exported batch; if the C Data release callback fires, the
+ * producer drains to zero. A too-small consumer allocator forces an OOM part-way through the
+ * import. The test asserts the producer drains, confirming the release callback fired despite the
+ * failure.
+ */
+final class ImportOutOfMemoryTest {
+ private static final int ROWS = 1024;
+ private static final int VALUE_BYTES = 256;
+ private static final int COLUMNS = 4;
+ // Far smaller than the exported batch, so the import OOMs part-way through the buffers.
+ private static final long TINY_LIMIT = 16 * 1024;
+
+ private RootAllocator root;
+
+ @BeforeEach
+ public void setUp() {
+ root = new RootAllocator(Long.MAX_VALUE);
+ }
+
+ @AfterEach
+ public void tearDown() {
+ root.close();
+ }
+
+ @Test
+ public void importOomDoesNotLeakExportedArray() {
+ // "producer" owns only the exported batch buffers; the C Data struct containers live on a
+ // separate allocator (they are consumed/closed by import, which would otherwise muddy the
+ // producer's balance). So producer draining to zero is an exact signal that the array's release
+ // callback fired.
+ try (BufferAllocator producer = root.newChildAllocator("producer", 0, Long.MAX_VALUE);
+ BufferAllocator structs = root.newChildAllocator("structs", 0, Long.MAX_VALUE)) {
+ try (ArrowArray array = ArrowArray.allocateNew(structs);
+ ArrowSchema schema = ArrowSchema.allocateNew(structs)) {
+ exportBatch(producer, array, schema);
+ assertTrue(
+ producer.getAllocatedMemory() > 0, "producer holds the exported batch before import");
+
+ // A consumer allocator far too small to hold the batch: the import throws part-way through.
+ try (BufferAllocator consumer = root.newChildAllocator("consumer", 0, TINY_LIMIT);
+ CDataDictionaryProvider provider = new CDataDictionaryProvider()) {
+ Schema importSchema = Data.importSchema(consumer, schema, provider);
+ try (VectorSchemaRoot importRoot = VectorSchemaRoot.create(importSchema, consumer)) {
+ Exception thrown =
+ assertThrows(
+ Exception.class,
+ () -> Data.importIntoVectorSchemaRoot(consumer, array, importRoot, provider));
+ assertTrue(
+ hasOutOfMemoryCause(thrown),
+ "mid-import failure must be an allocator OOM: " + thrown);
+ }
+ }
+
+ // The array's release callback must have fired despite the mid-import OOM, freeing the
+ // whole exported batch. On the unfixed retain-before-wrap code the batch is stranded.
+ assertEquals(
+ 0L,
+ producer.getAllocatedMemory(),
+ "import OOM leaked the exported batch (producer not drained)");
+ }
+ }
+ }
+
+ /** True if {@code t} is, or is caused by, an Arrow {@link OutOfMemoryException}. */
+ private static boolean hasOutOfMemoryCause(Throwable t) {
+ for (Throwable cause = t; cause != null; cause = cause.getCause()) {
+ if (cause instanceof OutOfMemoryException) {
+ return true;
+ }
+ }
+ return false;
+ }
+
+ /**
+ * Builds a wide multi-column VarChar batch on {@code alloc} and exports it into the C structs.
+ */
+ private void exportBatch(BufferAllocator alloc, ArrowArray array, ArrowSchema schema) {
+ byte[] value = new byte[VALUE_BYTES];
+ for (int i = 0; i < value.length; i++) {
+ value[i] = (byte) 'x';
+ }
+ List