Skip to content

fix(deps): update all minor updates - #295

Open
ZxBot wants to merge 1 commit into
mainfrom
renovate/all-minor-updates
Open

ZxBot wants to merge 1 commit into
mainfrom
renovate/all-minor-updates

Conversation

@ZxBot

@ZxBot ZxBot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Confidence
zextras/jenkins-lib-common minor v4.10.11v4.11.0 age confidence
com.tngtech.archunit:archunit test minor 1.4.21.5.0 age confidence
io.vavr:vavr (source) compile minor 0.10.40.11.0 age confidence
commons-validator:commons-validator (source) compile minor 1.9.01.11.0 age confidence
com.google.guava:guava compile minor 33.4.8-jre33.7.1-jre age confidence
org.sonarsource.scanner.maven:sonar-maven-plugin (source) build minor 5.5.0.63565.8.0.7211 age confidence
org.apache.maven.plugins:maven-surefire-plugin (source) build minor 3.5.63.6.0 age confidence
org.apache.maven.plugins:maven-failsafe-plugin (source) build minor 3.5.63.6.0 age confidence
org.apache.maven.plugins:maven-compiler-plugin (source) build minor 3.15.03.16.0 age confidence
org.codehaus.mojo:flatten-maven-plugin (source) build minor 1.7.31.8.0 age confidence
io.quarkus:quarkus-maven-plugin build minor 3.37.33.39.4 age confidence
io.quarkus:quarkus-bom import minor 3.37.33.39.4 age confidence
com.zextras.carbonio.quarkus:carbonio-quarkus-extensions-rest-sdk-parent parent minor 1.12.0-11.14.0-1 age confidence

Release Notes

zextras/jenkins-lib-common (zextras/jenkins-lib-common)

v4.11.0

Compare Source

Features
  • dt3_pipeline: add optional mavenArgs appended to every Maven command (#​207) (c580644)
TNG/ArchUnit (com.tngtech.archunit:archunit)

v1.5.0: ArchUnit 1.5.0

Compare Source

Enhancements

Core

  • Support Java 27 / class file major version 71 (#​1618)
  • Improve descriptions of JavaAccess.Predicates.originOwner and JavaAccess.Predicates.targetOwner (#​1603; thanks to @​StefanGraeber 👋)
  • Expose information on sealed classes via JavaClass: isSealed() and getPermittedSubclasses() (#​1677)
  • Consider dependencies from caught exceptions (#​1555; thanks to @​bannmann 👋)
  • ImportOption.DoNotIncludeTests and OnlyIncludeTests consider tests in custom Gradle source sets (#​1660; thanks to @​Develop-KIM 👋)

Lang

  • ArchConditions offers new ArchCondition<JavaClass> haveAnyDependenciesThat(DescribedPredicate<Dependency>) (#​1580; thanks to @​wakingrufus 👋)

Library

JUnit

Documentation

Internal Improvements

vavr-io/vavr (io.vavr:vavr)

v0.11.0

Compare Source

The day has come - Vavr 0.11.0 is out, marking the first minor release in several years.

giphy

From here on, the focus shifts toward Vavr 1.0.0, starting with a significant Java version bump.

The 0.11.x line will continue to receive bugfixes and maintenance updates, but no new features are planned. Roadmap details can be found here.

Huge thanks to everyone who contributed in any form.

Significant Additions

Lazy For() Comprehension (#​3085)

The for-comprehension API has been expanded with lazy, evaluation-friendly signatures that accept functions instead of eagerly-evaluated objects:

Option<Integer> result = API.For(
  calculate1(),
  (r1) -> calculate2(r1),
  (r1, r2) -> calculate3(r1, r2))
  .yield((r1, r2, r3) -> r1 + r2 + r3);
JSpecify Integration (#​3113)

Vavr now integrates JSpecify annotations, enhancing null-safety support in IDEs and modern static analysis tools.

Better Future Cancellation (#​3107)

As a result of internal refactoring, cancellation is now possible for Futures that have not yet started execution.

Various API Additions
  • Either/Validation.cond()
  • Value.mapTo(U) and Value.mapToVoid()
  • Try.toEither(Throwable -> L)

What's Changed

New Contributors

Full Changelog: vavr-io/vavr@v0.10.7...v0.11.0

v0.10.7

Compare Source

Maintenance release - fixed broken JavaDoc stylesheets.

btw, we're getting really close to shipping v0.11.0...

v0.10.6: Patch Release 0.10.6

Compare Source

This release brings Virtual-Thread-friendliness and documentation updates.

This is the last planned patch release for the 0.10.x train. 0.11.x incoming!

Changes

Full Changelog: vavr-io/vavr@v0.10.5...v0.10.6

Committers

🎉 MANY THANKS TO ALL COMMITTERS! 🎉

v0.10.5: Patch Release 0.10.5

Compare Source

Vavr is back with a new maintainer, roadmap, and... a release.

image

This release brings various performance enhancements, bugfixes, and explicit jlink-friendly module declarations instead of automatic modules.

Committers

🎉 MANY THANKS TO ALL COMMITTERS! 🎉
@​KrnSaurabh @​achinaou @​sleepytomcat @​j-baker @​Kevin222004 @​pivovarit

Changes

SonarSource/sonar-scanner-maven (org.sonarsource.scanner.maven:sonar-maven-plugin)

v5.8.0.7211

Compare Source

Release notes - Sonar Scanner for Maven - 5.8

Maintenance

SCANMAVEN-382 Prepare next development iteration 5.8.0

SCANMAVEN-384 Fix QG broken by the new testing rules

SCANMAVEN-385 Code Quality reorganization from jvm to CI Experience Squad

SCANMAVEN-386 ToggleLockBranch: Add additional-message

SCANMAVEN-387 Code Quality Slack channel reorganization

SCANMAVEN-390 Upgrade orchestrator to version 6.3.0

SCANMAVEN-392 Upgrade jetty test dependencies to version 9.4.58.v20250814

SCANMAVEN-395 Remove scheduled invocation of sonar:sonar shorthand test

SCANMAVEN-397 Replace Maven 4.0.0-rc-5 in ITs with Maven 4.0.0-rc-6

SCANMAVEN-398 Upgrade orchestrator to version 6.4.0

SCANMAVEN-399 Update sonar-scanner-java-library to 4.1.2.1663

SCANMAVEN-401 Upgrade Jetty used by e2e tests

SCANMAVEN-402 Upgrade orchestrator to version 6.4.3.4676

Feature

SCANMAVEN-403 Releasability status fails on property-dump-plugin version

v5.7.0.6970

Compare Source

Release notes - Sonar Scanner for Maven - 5.7

Feature

SCANMAVEN-317 Support encryption of sonar.token, and other new secure properties
SCANMAVEN-332 support modular-jar artifact type
SCANMAVEN-341 Rework the support of encrypted properties

Maintenance

SCANMAVEN-370 Prepare next development iteration 5.7.0
SCANMAVEN-372 Configure Renovate for sonar-scanner-maven
SCANMAVEN-373 SubmitReview: Use Vault token
SCANMAVEN-374 Unpin internal GitHub actions
SCANMAVEN-376 Use SonarSource/.../sonar-update-center-release@​v1 instead of @​master
SCANMAVEN-377 Update dependency org.assertj:assertj-core to v3.27.7 [SECURITY]

v5.6.0.6792

Compare Source

Release notes - Sonar Scanner for Maven - 5.6

Maintenance

SCANMAVEN-318 Update Orchestrator and fix e2e matrix
SCANMAVEN-324 Convert e2e tests to invoker
SCANMAVEN-346 Fix CI failure
SCANMAVEN-347 Automate detection of sonar:sonar shorthand failure
SCANMAVEN-348 Bump org.assertj:assertj-core from 3.26.3 to 3.27.7 in /sonar-maven-plugin
SCANMAVEN-349 Remove Maven 4 e2e tests from promotion requirements
SCANMAVEN-356 Add automated release workflow
SCANMAVEN-357 Licence packaging standard - Maven Scanner
SCANMAVEN-358 Create SonarUpdateCenterRelease.yml
SCANMAVEN-361 Add issue-categories in automated release
SCANMAVEN-363 Fix e2e tests with Maven 4
SCANMAVEN-364 Do not run nightly builds on weekends
SCANMAVEN-365 Set up orchestrator cache
SCANMAVEN-366 Update sonar-scanner-java-library to 4.1.0.1619
SCANMAVEN-367 Update sonar-scanner-java-library to 4.1.1.1633
SCANMAVEN-369 Update parent pom to 87.0.0.3057

Feature

SCANMAVEN-281 Irrelevant encrypted properties are not filtered out in multi-module project with "sonar" in the name

mojohaus/flatten-maven-plugin (org.codehaus.mojo:flatten-maven-plugin)

v1.8.0

Compare Source

🚀 New features and improvements

🐛 Bug Fixes

🔧 Build

📦 Dependency updates

quarkusio/quarkus (io.quarkus:quarkus-maven-plugin)

v3.39.4

Compare Source

Complete changelog
  • #​35814 - Quarkus Security with Jakarta Persistence guide doesn't mention security-jpa-reactive extension
  • #​37745 - Docs: security-oauth2 and security-oauth2-quickstart Guide
  • #​41734 - Probable bug in CognitoPrincipal lines 62 70
  • #​53739 - ConfigDiagnostic.configFiles() crashes with AccessDeniedException on Windows when CWD is system32
  • #​54925 - Formatting fails with a NullPointerException and the log record is dropped
  • #​54926 - Fix JSON logging with null formatter keys
  • #​55111 - [quarkus-info] Allow hiding the quarkus version
  • #​55763 - Make the OIDC token JWE decryption algorithm configurable
  • #​55910 - Remove unreachable duplicate Claims.groups branch in CognitoPrincipal
  • #​55916 - DPoPNonceProvider should accept DPoP proof jti
  • #​56160 - JBang integration fails on Java 24+ with IllegalAccessError: module java.base does not open java.lang
  • #​56287 - Add forgotten extension-status includes – and remove extension status from guides for stable extensions
  • #​56303 - OIDC: make DPoPNonceProvider accept DPoP proof jti
  • #​56453 - Allow TEST_TO_MAIN_MAPPINGS to be set as a system property
  • #​56514 - Restore the third callout entry in the Hibernate ORM interceptor example
  • #​56515 - Add the missing callout entry in the Infinispan client Greeting example
  • #​56517 - Keep the Keycloak Dev Services resource-mapping callout list together
  • #​56518 - Use a callout list for the generated resources extension example
  • #​56519 - Add the two missing callout entries in the Vert.x OIDC migration guide
  • #​56523 - Bootstrap Maven command from Getting started guide fails
  • #​56527 - Fix reproducibility issue in Avro
  • #​56529 - Strip quotes from extension names in Maven create command
  • #​56537 - Bump GraalVM SDK version to 25.0.4.1
  • #​56540 - NPE in getEffectiveMapper when response entity is an anonymous class (e.g. Stream)
  • #​56541 - Fix NPE in getEffectiveMapper when response entity is an anonymous class
  • #​56552 - the --debug-port or -DdebugPort parameter doesn't seem to work properly, always binding to port 5005
  • #​56556 - Upgrade Apache HttpClient5 to 5.6.4
  • #​56559 - Fix custom debug port being ignored in dev mode
  • #​56560 - [3.39] Bump to Vert.x 4.5.34
  • #​56561 - Remove empty RemoveableLateBoundSpanProcessor and LateBoundSpanProcessor files
  • #​56562 - Customize OIDC token decryption algorithm
  • #​56563 - [Keycloak dev service] - Make dev service access token lifespan configurable
  • #​56583 - Avoid an internal error when a bean parameter field is not a class type
  • #​56584 - docs: remove duplicate 'the' in OpenTelemetry logging guide
  • #​56585 - docs: remove duplicate 'the' in Dev UI Patterns note
  • #​56586 - Fix 'allows to' grammar in Config programmatic access docs
  • #​56587 - Fix 'allows to storage' grammar in MongoDB guide
  • #​56590 - Skip configuration directories that cannot be read when looking for unknown config files
  • #​56593 - docs: remove duplicate 'the' in OIDC application-type note
  • #​56604 - Keycloak Dev Service: make default realm's token lifespan configurable
  • #​56613 - Compare Cognito claim names with strings instead of Claims enum constants
  • #​56617 - Run the effective command of quarkus:update, with the local repository property
  • #​56623 - Pass the add-opens requirements to JBang
  • #​56626 - Fix the imports of the resource examples in the OAuth2 guide
  • #​56627 - Mention the reactive extension in the Jakarta Persistence security guide
  • #​56628 - Cache generated Jackson deserializers
  • #​56630 - cyclonedx guide doesn't list quarkus.cyclonedx.endpoint.* configuration options in reference section
  • #​56631 - Additional test coverage for CycloneDX
  • #​56635 - Info - Allow disabling Quarkus version
  • #​56637 - Add missing CycloneDX endpoint configuration to guide
  • #​56654 - Flaky test: io.quarkus.micrometer.deployment.binder.VertxTcpMetricsTest.testTcpMetrics
  • #​56656 - Flaky test: io.quarkus.quartz.test.PausedSchedulerTest.testSchedulerPauseResume
  • #​56657 - Flaky test: io.quarkus.redis.datasource.PubSubCommandsTest.subscribeToSingleWithMultiAsMessages
  • #​56667 - Update outdated native SSL guide summary
  • #​56669 - Fix flaky test DevMojoIT.testResourcesFromClasspath on Windows
  • #​56671 - Fix flaky PubSubCommandsTest by awaiting reactive subscriptions
  • #​56708 - Fix flaky PausedSchedulerTest
  • #​56749 - Drop testEmbeddedSbomUncompressed as quarkus.cyclonedx.embedded.compress was repurposed for the SBOM endpoint
  • #​56754 - Prevent leakage between Micrometer tests

v3.39.3

Compare Source

Complete changelog
  • #​42976 - Quarkus REST in NATIVE - abstract resources with @Path requires impl. to be CDI beans while RESTEasy does not
  • #​45257 - update guide on writing extension regarding docs generation
  • #​45791 - Range response status reset when using a @ServerResponseFilter
  • #​55119 - Use branch instead of version to avoid dead link on main guides
  • #​55674 - context propagation not working correctly
  • #​55739 - Fix race in AeshLauncherImpl causing flaky test timeouts
  • #​55835 - Quarkus 3.38 in dev mode - WARNING: java.lang.foreign.Linker::downcallHandle has been called by org.aesh.terminal.tty.impl.LibC in an unnamed module
  • #​55962 - Enable WebSocket traffic logging in aesh websocket tests
  • #​55999 - [Docs]: Lift and Shift review of Deploying to OpenShift guide
  • #​56018 - Aesh: fix flaky WebSocket tests on Semeru by closing WebSocketClient
  • #​56103 - Mention the quarkus-config-doc-maven-plugin
  • #​56106 - Add licenses for generic file components in SBOMs
  • #​56120 - Move SSH enabled config to build time and gate all processor build steps
  • #​56129 - Fix wrapWithSpan context propagation
  • #​56153 - Keep the 206 status of Range responses when the JAX-RS response has been materialized
  • #​56222 - Make sure the callouts follow the Asciidoc syntax
  • #​56240 - Update redirect instructions for Roq
  • #​56279 - Security overview guide style review (3.40)
  • #​56301 - Upgrade aesh to 3.17.5 and improve AeshLauncher test framework
  • #​56336 - [3.39] Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine
  • #​56340 - Add a packaging overview guide
  • #​56346 - Manage projectreactor in the bom, update to 3.8.7
  • #​56348 - Update building-docs skill and docs-preview.sh for Roq migration
  • #​56354 - Upgrade hibernate ORM from 7.4.5.Final to 7.4.7.Final
  • #​56357 - [3.39] backport of doc improvement
  • #​56359 - Check Keycloak token type on the OIDC server-less verification path
  • #​56365 - [3.39] Upgrade RESTEasy to 6.2.18.Final
  • #​56374 - Remove warning from PeriodicMetricReader
  • #​56386 - Style and syntax violations in docs callouts
  • #​56389 - Do not use attributes in guide title to work around Roq/Yupiik limitation
  • #​56391 - Fix numbered callout lists in documentation examples
  • #​56393 - ReactiveRedisDataSource.withConnection leaks pool permit when cancelled before connection is acquired
  • #​56395 - Suppress PeriodicMetricReader exporter warnings
  • #​56400 - rest-jackson: ContextResolver result cached by entity class, dropping the media type from the key
  • #​56402 - rest-jackson: SecurityCustomSerialization caches its ObjectWriter in a JVM-wide static field, dropping the ObjectMapper from the key
  • #​56408 - Update the logging guide for supported APIs
  • #​56413 - Redis client: fix connection leaks caused by cancellation during acquisition
  • #​56424 - Quarkus REST: fix native mode when abstract resource with path is extended by a subclass without paths
  • #​56425 - Doc - place callout lists after source listings
  • #​56429 - Typo fixes in websockets-next guides
  • #​56430 - Ensure FullyFeaturedServerJacksonMessageBodyWriter uses media type properly
  • #​56431 - Ensure SecurityCustomSerialization uses ContextResolver
  • #​56432 - Remove orphaned callout markers with missing explanations
  • #​56444 - Drop steps for discarded toc plugin in docs preview
  • #​56449 - Fix remaining callout list placement issues in docs
  • #​56470 - [3.39] Decouple types discovery and generation of reflection-free Jackson serializers
  • #​56480 - fix: align docs-preview.sh default port to 8042
  • #​56487 - Update to Avro 1.12.2, auto-trust Avro-generated classes, add properties to configure additional Avro-trusted classes
  • #​56489 - SBOM component to product attribution
  • #​56493 - Certificate reload skips restored certificates by comparing against startup snapshot
  • #​56497 - [3.39] SBOM CPE attribution
  • #​56498 - Ensure restoring certificate to original works

v3.39.2

Compare Source

Complete changelog
  • #​55234 - quarkus cli is missing the classname option
  • #​55239 - Add resource class name to CreateApp
  • #​55355 - Bump com.fasterxml.jackson:jackson-bom from 2.22.0 to 2.22.1
  • #​55360 - quarkus-container-image-buildpack fails on Windows with UnsupportedOperationException when building container image
  • #​55545 - Support multiple colons in @PermissionsAllowed value
  • #​55665 - Update buildpack lib to 0.0.17
  • #​55907 - Quarkus 3.38 Date serialization issue
  • #​56016 - Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.1 to 5.6.3 in /bom/application
  • #​56030 - WriterInterceptor not called for response mapped from exception
  • #​56064 - quarkus-rest-jackson: reflection-free (de)serializers treat a Map subclass as a bean and drop every map entry
  • #​56126 - Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2
  • #​56152 - Run writer interceptors for responses mapped from exceptions thrown before the interceptor handler
  • #​56161 - Allow multiple colons in @PermissionsAllowed
  • #​56165 - OIDC Redis TokenStateManager returns null instead of failing when the token state is missing, leading to an NPE and HTTP 500
  • #​56173 - JarResource: cached toExternalForm() breaks relative URL resolution against CodeSource.getLocation()
  • #​56176 - Fix resolving sibling URL in JarResource
  • #​56182 - Issue using both Caffeine and Redis for caching
  • #​56206 - Fix dead link
  • #​56209 - Update preview workflow for Roq
  • #​56216 - Avoid early token acquisition for DeferredOidcClient
  • #​56223 - [3.39] Fix serialization of string-shaped dates without a pattern in reflection-free Jackson serializers
  • #​56224 - [3.39] Support reflection-free json serialization of a Map subtype
  • #​56234 - Force re-authentication when the OIDC session token state is no longer available
  • #​56237 - Bump org.asynchttpclient:async-http-client from 2.15.0 to 2.16.0 in /bom/application
  • #​56242 - Fix Redis cache backend type resolution
  • #​56244 - Fix docs preview: Drop invalid condition and unused mtime
  • #​56257 - Signals: docs - add comparison with CDI events and Vert.x EventBus
  • #​56278 - security-getting-started-tutorial guide style review (3.40)
  • #​56280 - security-authorize-web-endpoints-reference guide style review (3.40)
  • #​56281 - security-keycloak-authorization guide style review (3.40)
  • #​56282 - security-architecture guide style review (3.40)
  • #​56292 - Fix typo sytem -> system in the dev services databases guide
  • #​56293 - docs: fix typo exisits -> exists
  • #​56300 - Allow --path parameter on quarkus create app cli for parity with maven creation
  • #​56306 - Typo fixes in deploying-to-abc guides
  • #​56308 - [3.39] Fix reading headers in Spring Web - Quarkus REST
  • #​56320 - [3.39] Use composite key for token introspection and userinfo cache
  • #​56333 - [3.39] Upgrade SmallRye GraphQL to 2.18.5

v3.39.1

Compare Source

Complete changelog

Important

✂ PR body was truncated to here.


Configuration

📅 Schedule: (in timezone Europe/Rome)

  • Branch creation
    • "after 9am and before 6pm every weekday except after 12pm and before 2pm"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@ZxBot ZxBot added dependencies Pull requests that update a dependency file renovate labels Jul 21, 2026
@ZxBot
ZxBot force-pushed the renovate/all-minor-updates branch from 0c884bb to 9166481 Compare July 22, 2026 16:45
@ZxBot ZxBot changed the title fix(deps): update dependency commons-io:commons-io to v2.22.0 fix(deps): update all minor updates Jul 22, 2026
@ZxBot
ZxBot force-pushed the renovate/all-minor-updates branch 5 times, most recently from 118a2dc to 8fb6b13 Compare July 29, 2026 00:20
@ZxBot
ZxBot force-pushed the renovate/all-minor-updates branch 6 times, most recently from d384562 to 7473ed7 Compare August 6, 2026 00:10
@ZxBot
ZxBot force-pushed the renovate/all-minor-updates branch 4 times, most recently from bccf977 to 51ff9f2 Compare August 14, 2026 00:04
@ZxBot
ZxBot force-pushed the renovate/all-minor-updates branch 2 times, most recently from 4014985 to 1836b2a Compare August 21, 2026 08:58
@ZxBot
ZxBot force-pushed the renovate/all-minor-updates branch 4 times, most recently from 2d8e07f to 6e318e1 Compare August 26, 2026 13:19
@gjed
gjed requested a review from galvagnimatteo August 26, 2026 15:44
@gjed

gjed commented Aug 26, 2026

Copy link
Copy Markdown
Member

@galvagnimatteo please validate the changes so I can verify https://github.com/zextras/infra-renovate-config/pull/29

nb: the ci failed on a later stage, third party should be ok

@ZxBot
ZxBot force-pushed the renovate/all-minor-updates branch 4 times, most recently from b4c012e to ad88e78 Compare September 9, 2026 23:58
@ZxBot
ZxBot force-pushed the renovate/all-minor-updates branch 5 times, most recently from 6e77407 to 2dd1e76 Compare September 18, 2026 00:04
@sonarqube-zextras

Copy link
Copy Markdown

@ZxBot
ZxBot force-pushed the renovate/all-minor-updates branch from 2dd1e76 to c54b9b5 Compare September 22, 2026 00:07
@ZxBot

ZxBot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined
Command failed: bash -c test -f .ci/thirdparties/generate-thirdparties.sh || exit 0; command -v mvn >/dev/null 2>&1 || { install-tool java && install-tool maven; }; bash .ci/thirdparties/generate-thirdparties.sh

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file renovate

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants