[dependabot]

Bumps the dependencies group with 22 updates:

Package	From	To
org.ow2.asm:asm	9.11	9.11.1
org.ow2.asm:asm-util	9.11	9.11.1
com.squareup.okhttp3:okhttp-jvm	5.5.0	5.5.1
com.squareup.okhttp3:okhttp-sse	5.5.0	5.5.1
com.squareup.okhttp3:okhttp-tls	5.5.0	5.5.1
org.conscrypt:conscrypt-openjdk-uber	2.7.0	2.8.0
io.rest-assured:rest-assured	6.1.0	6.2.0
io.vertx:vertx-core	5.2.1	5.2.2
io.vertx:vertx-sql-client	5.2.1	5.2.2
io.vertx:vertx-mysql-client	5.2.1	5.2.2
io.vertx:vertx-pg-client	5.2.1	5.2.2
io.github.classgraph:classgraph	5.0.0	6.0.0
io.projectreactor:reactor-core	3.8.7	3.8.8
io.grpc:grpc-protobuf	1.85.0	1.85.1
io.grpc:grpc-stub	1.85.0	1.85.1
io.grpc:grpc-inprocess	1.85.0	1.85.1
io.grpc:grpc-services	1.85.0	1.85.1
io.grpc:grpc-servlet	1.85.0	1.85.1
io.grpc:grpc-netty-shaded	1.85.0	1.85.1
io.grpc:grpc-okhttp	1.85.0	1.85.1
software.amazon.awssdk:bom	2.56.0	2.57.3
io.smallrye.reactive:mutiny	3.3.0	3.3.1

Updates org.ow2.asm:asm from 9.11 to 9.11.1

Updates org.ow2.asm:asm-util from 9.11 to 9.11.1

Updates org.ow2.asm:asm-util from 9.11 to 9.11.1

Updates com.squareup.okhttp3:okhttp-jvm from 5.5.0 to 5.5.1

Changelog

Sourced from com.squareup.okhttp3:okhttp-jvm's changelog.

Version 5.5.1

2026_10_22

• Fix: [Block 8 compromised eMudhra intermediate certificates][Mozilla_eMudhra]. Note that this update is not necessary for Android devices with Google Play Services as Google has issued an [automatic update][Google_eMudhra]. This change protects JVMs and AOSP devices that are exposed to the compromised certificates.

Commits

• be5151a Prepare for release 5.5.1.
• 6db9802 OkHttp 5.5.x: Blocklist 8 certificates for CVE-2026-111943 (#9805)
• See full diff in compare view

Updates com.squareup.okhttp3:okhttp-sse from 5.5.0 to 5.5.1

Changelog

Sourced from com.squareup.okhttp3:okhttp-sse's changelog.

Version 5.5.1

2026_10_22

• Fix: [Block 8 compromised eMudhra intermediate certificates][Mozilla_eMudhra]. Note that this update is not necessary for Android devices with Google Play Services as Google has issued an [automatic update][Google_eMudhra]. This change protects JVMs and AOSP devices that are exposed to the compromised certificates.

Commits

• be5151a Prepare for release 5.5.1.
• 6db9802 OkHttp 5.5.x: Blocklist 8 certificates for CVE-2026-111943 (#9805)
• See full diff in compare view

Updates com.squareup.okhttp3:okhttp-tls from 5.5.0 to 5.5.1

Changelog

Sourced from com.squareup.okhttp3:okhttp-tls's changelog.

Version 5.5.1

2026_10_22

• Fix: [Block 8 compromised eMudhra intermediate certificates][Mozilla_eMudhra]. Note that this update is not necessary for Android devices with Google Play Services as Google has issued an [automatic update][Google_eMudhra]. This change protects JVMs and AOSP devices that are exposed to the compromised certificates.

Commits

• be5151a Prepare for release 5.5.1.
• 6db9802 OkHttp 5.5.x: Blocklist 8 certificates for CVE-2026-111943 (#9805)
• See full diff in compare view

Updates com.squareup.okhttp3:okhttp-sse from 5.5.0 to 5.5.1

Changelog

Sourced from com.squareup.okhttp3:okhttp-sse's changelog.

Version 5.5.1

2026_10_22

• Fix: [Block 8 compromised eMudhra intermediate certificates][Mozilla_eMudhra]. Note that this update is not necessary for Android devices with Google Play Services as Google has issued an [automatic update][Google_eMudhra]. This change protects JVMs and AOSP devices that are exposed to the compromised certificates.

Commits

• be5151a Prepare for release 5.5.1.
• 6db9802 OkHttp 5.5.x: Blocklist 8 certificates for CVE-2026-111943 (#9805)
• See full diff in compare view

Updates org.conscrypt:conscrypt-openjdk-uber from 2.7.0 to 2.8.0

Release notes

Sourced from org.conscrypt:conscrypt-openjdk-uber's releases.

v2.8.0

Conscrypt Version 2.8.0.

This is a new release of conscrypt-openjdk, conscrypt-openjdk-uber and conscrypt-android on maven.

It includes the following changes:

• Support for XChaCha20-Poly1305 (XChaCha20/Poly1305/NoPadding cipher, XChaCha20 KeyGenerator, and XChaCha20 AlgorithmParameters).
• Bug fixes, error handling improvements, and cleanups.

Commits

• 7cff5d9 Merge pull request #1553 from google/google3-export
• 52069ae Project import generated by Copybara.
• e8bac4c Add KEM and KDF interface and implementations. (#1551)
• d8840cc Project import generated by Copybara. (#1549)
• c528536 Project import generated by Copybara. (#1548)
• 9add7ce Add OpenSSLX509CRLTest. (#1547)
• 9af1f30 Make TestSSLContext implement Closeable and adopt try-with-resources.- #1545 ...
• 6461a8a Pass explicit TestSSLContext to TestSSLEnginePair.create() and close after te...
• 538dd33 Add some tests for ML-KEM and ML-DSA, and add check for HKDF. (#1543)
• 53f333b Re-enabled some tests in NativeCryptoTest. (#1542)
• Additional commits viewable in compare view

Updates io.rest-assured:rest-assured from 6.1.0 to 6.2.0

Changelog

Sourced from io.rest-assured:rest-assured's changelog.

Changelog 6.2.0 (2026-10-16)

• Fix spring-web-test-client-kotlin-extensions bringing jakarta.servlet-api, jakarta.jakartaee-web-api and about 20 other Jakarta EE API jars to your classpath at runtime. They were declared with a scope that Maven doesn't know (optional), which it treated as a compile dependency, and are now provided, like in spring-mock-mvc-kotlin-extensions (#1992)
• Upgraded scala-library in scala-support from 2.13.0 to 2.13.18, which fixes CVE-2022-36944, scala3-library_3 in scala-extensions from 3.3.3 to 3.3.8, Jackson 2 (jackson-databind, jackson-core and jackson-module-kotlin) from 2.17.1 to 2.22.3, Jackson 3 (tools.jackson) from 3.0.2 to 3.2.3, Gson from 2.9.0 to 2.14.0, Guava in json-schema-validator from 33.2.1-jre to 33.7.2-jre, commons-lang3 from 3.19.0 to 3.21.0, Yasson from 3.0.4 to 3.0.5 (now with its new group id org.eclipse.yasson, since org.eclipse:yasson 3.0.5 only relocates to it), Parsson from 1.1.7 to 1.1.9, Johnzon (johnzon-mapper) from 2.0.2 to 2.2.0 and jaxb-impl from 2.3.4 to 2.3.9 (#1986)
• Non-backward compatible change: sending a request directly from a request specification created by RequestSpecBuilder.build() (for example spec.when().get("/x") or spec.post()) now fails with an IllegalStateException that tells you to use given().spec(spec) or given(spec), instead of a NullPointerException. then(), expect() and response() on such a specification also throw this exception, where they returned null before. The specification is meant to be added to a request, and isn't changed by the failed call. The javadoc of RequestSpecBuilder.build() now explains this (part of #1863)
• Non-backward compatible change: sending a request directly from a response specification created by ResponseSpecBuilder.build() (for example responseSpec.when().get("/x")) now fails with an IllegalStateException that tells you to use given().spec(requestSpec).expect().spec(responseSpec), then().spec(responseSpec) or given(requestSpec, responseSpec), instead of a NullPointerException. when(), given(), with() and request() on such a specification also throw this exception, where they returned null before. Using the specification in a request, or as RestAssured.responseSpecification, works as before. The javadoc of ResponseSpecBuilder.build() now explains this (related to #1863)
• JsonPath and JSON body assertions can now read a key that contains a colon with the dot notation, such as jsonPath.getInt("message.ErrorCode:") or body("message.ErrorCode:", equalTo(0)), which failed with "Invalid JSON expression" before. A colon in a ternary (a ? b : c) or Elvis (a ?: b) expression, in a closure or in a quoted string is left as is (fixes #1766)
• Fix request logging of a multipart File whose mime type isn't text, such as application/octet-stream (the default) or image/png, which since 5.5.0 printed the whole file content to the log. Such a part is now logged as the path of the file, as before 5.5.0. The content of a file with a text mime type (text/*, JSON, XML or HTML) is still logged, and is now read with the charset of the part (or of its mime type), or UTF-8 if none is given, instead of the platform default charset. A text file that can't be read is logged as its path, so sending the request reports the error (fixes #1819)
• Upgraded Groovy from 5.0.3 to 5.0.8 and Apache HttpClient (httpclient and httpmime) from 4.5.13 to 4.5.14 (#1971)
• Fix races in the static configuration of REST Assured when tests run in parallel. RestAssured.filters(..), replaceFiltersWith(..), registerParser(..) and unregisterParser(..), and RestAssuredMockMvc.resultHandlers(..) and postProcessors(..), could make a given() in another thread fail with a ConcurrentModificationException or copy a default filter list with missing or null filters. given() (and when(), with(), expect() and the static request methods) no longer changes any shared state. The public static fields of RestAssured, RestAssuredMockMvc and RestAssuredWebTestClient, and JsonPath.config, XmlPath.config and JsonSchemaValidator.settings, are now volatile, so a value set before the tests start is seen by every thread. The javadoc of RestAssured, RestAssuredMockMvc and RestAssuredWebTestClient now explains how to use the static configuration when tests run in parallel (fixes #1967)
• Non-backward compatible change: given() no longer writes the session id into the RestAssured.config field or RestAssured.defaultParser into the global parser registry. While RestAssured.sessionId is set, RestAssured.config() returns the config with the session id, but the RestAssured.config field doesn't contain it, also not after a request, so given().config(RestAssured.config) no longer sends the static session id (use RestAssured.config() instead). Setting RestAssured.sessionId or RestAssured.defaultParser back to null now takes effect without RestAssured.reset(). A list returned by RestAssured.filters() before replaceFiltersWith(..) keeps showing the old filters (fixes #1967)
• Fix HttpClientConfig.reuseHttpClientInstance() creating more than one HttpClient when several threads send their first request at the same time, and make the default Yasson (JSON-B) object mapper share one Jsonb instance between threads in the same way. Note that the reused HttpClient is reconfigured by every request, so it still must not be used by requests that run at the same time (fixes #1967)
• Non-backward compatible change: auth().certificate(certURL, password) and RestAssured.certificate(certURL, password), with or without CertificateAuthSettings, now use the file at certURL as key store, as documented, so the client certificate in it is sent to servers that ask for one (mutual TLS). Before, the file was only used as trust store, which it still is. This means that a private key in the file is now offered to any server that asks for a client certificate, also where it's optional (such as nginx with ssl_verify_client optional), which may then reject a certificate it doesn't trust, and that the private key must have the password of the file. To avoid this, or to use the JVM's default trust store, use RestAssured.certificate(trustStorePath, trustStorePassword, keyStorePath, keyStorePassword, CertificateAuthSettings) (as RestAssured.authentication or with RequestSpecBuilder.setAuth(..)), where an empty path means no key store or the default trust store (fixes #1158, related to #1325)
• Fix a root path with more than one placeholder left for a later withArgs(..), such as rootPath("a.%s.%s.%s", withArgs("x")).body(withArgs("y", "z"), ..), which failed with a MissingFormatArgumentException. All placeholders without an argument, including ones such as %d, are now kept for later arguments. body(withArgs(..), matcher) also no longer adds a trailing dot to the path, which showed up in failure messages such as "JSON path a.d.e. doesn't match." (fixes #1949)
• The rest-assured module is now written entirely in Java and no longer depends on Groovy (org.apache.groovy:groovy and groovy-xml) directly. Groovy still comes transitively through json-path and xml-path, which use it for GPath, so the dependencies on the classpath are unchanged. The rest-assured and rest-assured-common OSGi bundles no longer import the groovy packages, and rest-assured-common no longer depends on Groovy at all (#1917, #1932)
• Non-backward compatible change: a Groovy closure used as request body now fails with an IllegalArgumentException. This could only happen when a custom ObjectMapper returned a Closure from serialize(..), in which case the closure was run as a builder (a JsonBuilder for JSON, a StreamingMarkupBuilder for XML and HTML, or with a Writer or OutputStream for text and binary content). Return a String, byte[] or InputStream from the ObjectMapper instead (#1914)
• Non-backward compatible change: a request body that isn't a String (for example a byte[], InputStream or File) sent with content-type application/x-www-form-urlencoded now fails with an IllegalArgumentException explaining that a form url-encoded body must be a String, instead of a groovy.lang.MissingMethodException (#1914)
• Non-backward compatible change: a groovy.lang.Writable request body sent with a text content-type is now sent as its toString() instead of what its writeTo(..) method writes. Groovy's own Writables (such as JsonBuilder and GString) produce the same output either way. A Groovy WritableFile (file.asWritable()) is now sent like any other File, read with the charset of the request content-type (#1914)
• Fix the failure message of a body path assertion when the response body can't be parsed into something the path can navigate (for example a JSON body that is just a string), which showed the literal text $contentParser instead of the response body (#1922)
• Fix form authentication failing with "IllegalArgumentException: parameterValues cannot be null" when an additional input field given to FormAuthConfig.withAdditionalField(s)(..) is an input tag without a value attribute on the login page. The field is now sent as a form parameter without a value (#1921)
• Fix matchesDtd(URL) in RestAssuredMatchers, RestAssuredMockMvcMatchers and RestAssuredWebTestClientMatchers, which always failed with a GroovyCastException ("Cannot cast object '' with class 'java.lang.String' to class 'java.io.InputStream'") when the response was validated. The DTD is now read from the URL, every time the matcher is used (#1920)
• Non-backward compatible change: matchesXsdInClasspath(..) and matchesDtdInClasspath(..) (in RestAssuredMatchers, RestAssuredMockMvcMatchers and RestAssuredWebTestClientMatchers) now fail with an IllegalArgumentException saying that the XSD or DTD couldn't be found in classpath, instead of a groovy.lang.GroovyRuntimeException ("Ambiguous method overloading"). The XSD and DTD matchers now also fail with an IllegalArgumentException when asked to match something that isn't a String, for example body("some.path", matchesXsd(..)) where the path returns an element that has child elements, instead of a Groovy exception (#1920)
• Non-backward compatible change: io.restassured.assertion.HeaderMatcher, DetailedCookieAssertion, ResponseTimeMatcher and StreamVerifier are now written in Java and no longer implement groovy.lang.GroovyObject. HeaderMatcher.validateHeader(..), DetailedCookieAssertion.validateCookies(..) and ResponseTimeMatcher.validate(..) now return Map<String, Object> instead of Object, HeaderMatcher.validateHeader(..) takes a Response, and HeaderMatcher.getMatcher() and get/setResponseAwareMatcher(..) are now generically typed (Matcher<?> and ResponseAwareMatcher) (#1919)
• A header expectation whose header name is neither a String nor a GString (for example an Integer key in the map passed to headers(Map)) now checks the header named by the key's string form instead of failing with a groovy.lang.MissingMethodException (#1919)
• Non-backward compatible change: io.restassured.internal.http.HTTPBuilder, which a custom AuthenticationScheme receives in authenticate(..), no longer uses Groovy closures. Its get(..) methods, the request(..) overloads that took a Closure, getHandler() and the post(..) and patch(..) overloads without a response handler are removed. post(..), patch(..) and request(..) now take an HttpResponseHandler or a RequestConfigurer, and response handlers always take two arguments (the response and its parsed content) (#1923)
• A parameter name that is neither a String nor a GString (for example an Integer key in the map passed to params(Map), queryParams(Map), formParams(Map) or pathParams(Map)) is now used in its string form, so 1 becomes "1", instead of failing with a groovy.lang.MissingMethodException (#1927)
• Non-backward compatible change: io.restassured.internal.RestAssuredResponseOptionsGroovyImpl is removed and its logic now lives in RestAssuredResponseOptionsImpl, so getGroovyResponse(), setGroovyResponse(..) and the protected groovyResponse field of RestAssuredResponseOptionsImpl are gone. This affects code that calls these methods or subclasses the internal response classes. A subclass that overrides a method such as asString() now also sees that override used by path(..), jsonPath(), as(..) and the other methods that read the body (#1926)
• Fix asByteArray() on a response with body expectations whose body was replaced by an InputStream (for example by a filter using ResponseBuilder.clone(..).setBody(inputStream)), which failed with a groovy.lang.MissingMethodException (#1926)
• Non-backward compatible change: the authentication schemes in io.restassured.authentication (BasicAuthScheme, CertAuthScheme, ExplicitNoAuthScheme, FormAuthScheme, NTLMAuthScheme, NoAuthScheme, OAuth2Scheme, OAuthScheme, PreemptiveBasicAuthScheme and PreemptiveOAuth2HeaderScheme), and the AuthenticationScheme interface are now written in Java, and the classes no longer implement groovy.lang.GroovyObject. Their constructors, getters and setters are unchanged. A custom AuthenticationScheme written in Java can now get the authentication configuration from HTTPBuilder.getAuth() (#1925)
• Non-backward compatible change: io.restassured.internal.matcher.xml.XmlXsdMatcher (the return type of RestAssuredMatchers.matchesXsd(..)) and XmlDtdMatcher are now written in Java and no longer implement groovy.lang.GroovyObject (#1920)
• A CertAuthScheme whose key store or trust store path (setPathToKeyStore(..) or setPathToTrustStore(..)) is neither a String nor a java.io.File now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#1925)
• Fix FilterContext.send(..) for a request whose HTTP method has no method of its own in RequestSender, such as TRACE or a custom method given to request(..) (for example request("PURGE", "/x")). It failed with a groovy.lang.MissingMethodException and now sends the request. FilterContext.send(..) now always calls RequestSender.request(method, path) on the request sender it is given, instead of get(path), post(path) and so on (#1929)
• Fix getResponseContentType() of the response specification that filters receive (FilterableResponseSpecification), which always failed with a StackOverflowError. It now returns the expected content type, the description of the expected content type matcher, or "/" when no content type is expected (#1928)
• Non-backward compatible change: using a ResponseSpecification that wasn't created by REST Assured, with spec(..) or specification(..) on a response specification or as RestAssured.responseSpecification, now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#1928)
• A body expectation path that is neither a String nor a GString (for example an Integer key among the additional key/matcher pairs of body(..)) is now used in its string form instead of failing with a groovy.lang.MissingMethodException. A list given as path, or as path arguments to body(..), rootPath(..), root(..) or appendRootPath(..), whose elements aren't all io.restassured.specification.Argument (as created by withArgs(..)) now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#1928)
• Fix cookies(Map) and cookies(String, Object, Object...) on a request specification, which failed with a groovy.lang.GroovyRuntimeException ("Could not find matching constructor for: io.restassured.http.Cookie$Builder(String, Integer)") when a cookie value wasn't a String, for example an Integer. Such a value is now converted the same way as a value given to cookie(String, Object, Object...), so 1 becomes "1" (#1930)
• Fix keyStore(KeyStore) on a request specification and RequestSpecBuilder.setKeyStore(KeyStore), which always failed with a groovy.lang.MissingMethodException. SSLConfig gets the keyStore(KeyStore) method that the documentation of keyStore(KeyStore) refers to. A password-protected key store needs its password set with SSLConfig.keyStore(String) on the same SSLConfig, for example config(config().sslConfig(sslConfig().keyStore(keyStore).keyStore("password"))). Calling config(..) after keyStore(KeyStore) replaces the config and drops the key store. relaxedHTTPSValidation() only uses a key store given by path, not a KeyStore object (#1930)
• Fix multiPart(String, Object) with a String and no request content type, which failed with a groovy.lang.GroovyRuntimeException ("Ambiguous method overloading"). It now adds a text/plain part (#1930)
• Non-backward compatible change: using a RequestSpecification that wasn't created by REST Assured with spec(..) or specification(..) on a request specification now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#1930)
• A header or cookie name given to headers(..) or cookies(..) (as a map key or in the name/value varargs) that isn't a String (for example an Integer) is now used in its string form instead of failing with a groovy.lang.GroovyRuntimeException (#1931)
• Fix merging a request specification that has unnamed path parameters, for example the request specification that a filter receives for get("/users/{id}", 1), with spec(..) or RequestSpecBuilder.addRequestSpecification(..). The resulting specification failed with a groovy.lang.MissingPropertyException when it was sent with unnamed path parameters, merged again, or asked for its URI or unnamed path parameters (for example getURI() or getUnnamedPathParamValues()). It now gets the unnamed path parameters of the specification it was merged with (#1931)
• Fix form authentication failing with "IllegalArgumentException: Invalid number of path parameters" when the login page is fetched for a request with path parameters, for example given().auth().form("John", "Doe").get("/secured/{id}", 1). The login page is now also fetched at the right URL when the path or a path parameter contains characters that need URL encoding, such as a space or a non-ASCII character, which used to be URL encoded twice (fixes #1940)
• Non-backward compatible change: form authentication now fails with an IllegalArgumentException that names the field when an additional input field given to FormAuthConfig.withAdditionalField(s)(..) isn't on the login page. Such a field used to be sent with the value "[]" (fixes #1941)
• Fix form authentication not passing the session filter of the request on to the login request when the filter is a subclass of SessionFilter (for example new SessionFilter() {}), so the subclass didn't get the session id (fixes #1941)
• Fix form authentication failing with a NullPointerException when the login form has no action attribute. Such a form is now posted to the path and query of the URL of the login page, like a browser does: the URL that the request for the login page was redirected to, or the CSRF token page (including the base path) when CSRF is enabled. As for any form action, it is posted to the host of the request (fixes #1941)
• Non-backward compatible change: form authentication now posts a login form with an empty action (action="") to the URL of the login page, like a browser does, instead of to "/" (fixes #1941)
• Fix form authentication URL encoding the path and query of a form action read from the login page twice, so for example a form with action "/login?r=a%20b" was posted to /login?r=a%2520b. A "+" in the query of such a form action is decoded as a space, as servlet containers do, an encoded "/", "?", "#", "{" or "}" in its path is kept encoded, and a fragment ("#..") is left out. A form action given to FormAuthConfig is still used as it is (#1954)
• Non-backward compatible change: form authentication now resolves a relative form action read from the login page against the URL of the login page (or its ), like a browser does. An action without a leading slash used to be resolved against the root, so for example action="login" on the page /secured/page was posted to /login and is now posted to /secured/login (#1954)
• Fix form authentication for an absolute form action read from the login page (for example action="http://localhost:8080/login"), which was appended as a path to the host of the request. Like any other form action, its path and query are now posted to the host of the request (#1954)
• Form authentication now fails with a message saying that the Location header is missing when the request for the login page is redirected (302) without a Location header, instead of "IllegalArgumentException: path cannot be null" (fixes #1941)

... (truncated)

Commits

• a75cb9a [maven-release-plugin] prepare release rest-assured-6.2.0
• 28af02d [ci skip] Preparing changelog for release
• 9673680 [ci skip] Updated changelog to reflect the latest changes (#1994)
• 45d4a64 Stop spring-web-test-client-kotlin-extensions from bringing Jakarta EE APIs a...
• 21877e4 Give a clear error when a ResponseSpecBuilder spec sends a request directly (...
• c2415c4 Upgrade vulnerable dependencies in examples and tests (#1993)
• 5dd9f3b Upgrade published dependencies for 6.2.0, including scala-library for CVE-202...
• fd9efcc [ci skip] Updated changelog to reflect the latest changes (#1978)
• 83bcbda Give a clear error when a RequestSpecBuilder spec sends a request directly (#...
• 670f51f Read JSON keys that contain a colon with the dot notation (#1970)
• Additional commits viewable in compare view

Updates io.vertx:vertx-core from 5.2.1 to 5.2.2

Commits

• 583c863 Releasing 5.2.2
• 961482e Use a smaller MPSC queue default chunk size.
• 197ee95 Fix WebSocket decompression max allocation overflow with large size limits
• 5c801a9 WebSocket tests: cover the client max frame and message size enforcement
• 66a1004 Fail WebSocket writes after close with HttpClosedException
• 1340d0e Use a concurrent map for HTTP/3 connection streams
• 05d0b82 Fix trailers race delivery when the HTTP stream is being drained.
• 03321cc Set next snapshot version
• See full diff in compare view

Updates io.vertx:vertx-sql-client from 5.2.1 to 5.2.2

Commits

• 8544df3 Releasing 5.2.2
• 7b2fbd8 Fix caching_sha2_password auth over Unix domain sockets (#1757) (#1758)
• 31253d3 Evict cached statements on schema change for tables with 10+ columns (#1752) ...
• c588635 Cancel pool connection timeout timer when acquisition fails (#1712) (#1750)
• c4d6248 Flaky Pg testCancelRequest: delay cancel until pg_sleep is executing (#1746)
• 8b45fb0 Fix Oracle JSON nested null values returning Tuple.JSON_NULL instead of null ...
• 0a35d47 Set next snapshot version
• See full diff in compare view

Updates io.vertx:vertx-mysql-client from 5.2.1 to 5.2.2

Commits

• 8544df3 Releasing 5.2.2
• 7b2fbd8 Fix caching_sha2_password auth over Unix domain sockets (#1757) (#1758)
• 31253d3 Evict cached statements on schema change for tables with 10+ columns (#1752) ...
• c588635 Cancel pool connection timeout timer when acquisition fails (#1712) (#1750)
• c4d6248 Flaky Pg testCancelRequest: delay cancel until pg_sleep is executing (#1746)
• 8b45fb0 Fix Oracle JSON nested null values returning Tuple.JSON_NULL instead of null ...
• 0a35d47 Set next snapshot version
• See full diff in compare view

Updates io.vertx:vertx-pg-client from 5.2.1 to 5.2.2

Commits

• 8544df3 Releasing 5.2.2
• 7b2fbd8 Fix caching_sha2_password auth over Unix domain sockets (#1757) (#1758)
• 31253d3 Evict cached statements on schema change for tables with 10+ columns (#1752) ...
• c588635 Cancel pool connection timeout timer when acquisition fails (#1712) (#1750)
• c4d6248 Flaky Pg testCancelRequest: delay cancel until pg_sleep is executing (#1746)
• 8b45fb0 Fix Oracle JSON nested null values returning Tuple.JSON_NULL instead of null ...
• 0a35d47 Set next snapshot version
• See full diff in compare view

Updates io.github.classgraph:classgraph from 5.0.0 to 6.0.0

Release notes

Sourced from io.github.classgraph:classgraph's releases.

ClassGraph 6.0.0

ClassGraph 6 is the new mainline release of ClassGraph, for JDK 25 and newer. All code that uses ClassGraph should be ported to it. Its API is new, and is not source- or binary-compatible with 4.x: the porting guide walks through the port step by step, and a coding agent can follow it for you.

Version	JDK	Status
ClassGraph 6	25+	The current release. Use this.
ClassGraph 5	17 to 24	A stop-gap for projects that cannot yet run JDK 25. Same API and behavior as ClassGraph 6, kept in sync with it for the near future.
ClassGraph 4	8 to 16	End of life, other than releases that backport fixes for serious bugs.

What is new

• ClassGraph is split into five reusable libraries, so a project depends only on the part it uses:
  • classgraph-base -- shared internals, and the verbose log.
  • classgraph-vfs -- a read-only virtual filesystem over directories, jarfiles and modules, and the fastest, most flexible, most powerful and most parallelizable virtual filesystem for the JVM ecosystem. It opens a directory, jarfile or module however it is named, reads jarfiles nested to any depth in place without extracting them, and returns content as a stream, channel, ByteBuffer, byte array, string or java.nio.file.Path. Lookups and reads take no locks: looking up every entry of a 26,970-entry jarfile is 6× faster than java.util.zip.ZipFile on one thread and 141× faster on 32 threads. See the benchmarks. The scanner itself now reads through it.
  • classgraph-classpath -- finds the classpath and module path of a running JVM, in classloader order, including the classpath of Spring Boot, Tomcat, JBoss, WebLogic, WebSphere, OSGi, Quarkus and other container classloaders. You can now register your own ClassLoaderHandler for a classloader ClassGraph does not know.
  • classgraph -- scanning, and the class graph API. Depending on it brings in the three above.
  • classgraph-viz -- GraphViz .dot file generation.
• Nothing is scanned until you say what to scan: a scan enables the classpath, the module path, or specific classloaders, module layers or classpath entries.
• Consistent naming: getAll... for a transitive closure and getDirect... for the direct answer, so the 4.x mistake of using a transitive result as a direct one cannot happen silently. One glob syntax everywhere.
• ClassGraph no longer loads classes, so it no longer runs static initializers as a side effect of a query or keeps classloaders alive after a scan. Load classes yourself with Class.forName().
• A stricter, more modern API: nullability declared throughout with JSpecify; every returned collection is unmodifiable; lists instead of arrays and getters instead of public fields; fluent setters everywhere; callbacks are Predicate and Consumer. The JSON serializer has been removed.

A large number of bugs were found and fixed during the transition from ClassGraph 4 to ClassGraph 5 and 6. The most important fixes were backported to ClassGraph 4.

What JDK 25 allows

ClassGraph 6 has the same API and behavior as ClassGraph 5. Requiring JDK 25 let it drop the legacy code that ClassGraph 5 still needs:

• Files are mapped and unmapped through java.lang.foreign.Arena, called directly. The Unsafe cleaner path, the reflective calls and the jdk.unsupported dependency are gone.
• All SecurityManager handling is gone, since JDK 24 and newer cannot trigger it.
• Other workarounds for older JDKs were removed, such as the custom thread factory that avoided a ThreadGroup leak fixed in JDK 19.
• The code uses language features newer than JDK 17, such as pattern-matching switch and unnamed variables.

Getting it

<dependency>
    <groupId>io.github.classgraph</groupId>
    <artifactId>classgraph</artifactId>
    <version>6.0.0</version>
</dependency>

Commits

• ebde6d3 [maven-release-plugin] prepare release classgraph-6.0.0
• 47fa99a Announce ClassGraph 6 in the README
• 14bfc1e Keep one stream open across consecutive transferTo calls
• 540b834 Correct comments left out of date by the iterative walks
• 14e6b9e Sort imports into one consistent grouping
• 803d66b Remove CODEX-REVIEW.md
• 25129a0 Sort the imports of VfsFileSystem and VfsFileSystemProvider
• 4834a21 Return the storage URI from VfsPath.toUri() again (revert R07)
• cdf397b Restore 4.x interface order in getMethodInfo() (revert R15)
• fdf0b71 Restore 4.x member-query results (revert R01 and R02)
• Additional commits viewable in compare view

Updates io.projectreactor:reactor-core from 3.8.7 to 3.8.8

Release notes

Sourced from io.projectreactor:reactor-core's releases.

v3.8.8

Reactor Core 3.8.8 is part of the 2025.0.8 Release Train.

What's Changed

⚠️ Update considerations and deprecations

• Upgrade NullAway to 0.14.2 and Error Prone Gradle plugin to 5.1.1 by @​chemicL in #4434

✨ New features and improvements

• Bump Byte Buddy to 1.18.14 and adjust shading by @​chemicL in #4432
• Bump Micrometer to 1.16.8 by @​chemicL in fbc03a4334b4ceb437ed2f64083496d83d8e8027
• Bump Micrometer Tracing to 1.6.8 by @​chemicL in fbc03a4334b4ceb437ed2f64083496d83d8e8027
• Bump BlockHound to 1.0.18.RELEASE by @​chemicL in fbc03a4334b4ceb437ed2f64083496d83d8e8027
• Remove sun.misc for OSGi imports on Java 11 or newer by @​rombert in 15014b1370d8b962fbeb34de1248403d2d20b6fa

New Contributors

• @​rombert made their first contribution in 15014b1370d8b962fbeb34de1248403d2d20b6fa

Full Changelog: reactor/reactor-core@v3.8.7...v3.8.8

Commits

• fbc03a4 [release] Prepare and release 3.8.8
• 2ea3aa1 Prepare release/3.8.8 branch
• fd20856 Prepare 3.8.x-internal branch
• 84e8e27 Bump ruby/setup-ruby from 1.328.0 to 1.329.0 in /.github/workflows (#4438)
• 15014b1 fix: remove sun.misc for OSGi imports on Java 11 or newer
• e876ee1 Upgrade NullAway to 0.14.2 and Error Prone Gradle plugin to 5.1.1 (#4434)
• 8e0e1ab Bump org.jspecify:jspecify from 1.0.0 to 1.0.1 (#4342)
• 9bfeffe Bump brace-expansion from 5.0.6 to 5.0.12 in /docs
• 850ca36 Bump @​antora/pdf-extension from 1.0.0 to 1.0.1 in /docs in the docs group (#4...
• 7770e25 Bump com.diffplug.spotless from 8.10.3 to 8.10.4 (#4428)
• Additional commits viewable in compare view

Updates io.grpc:grpc-protobuf from 1.85.0 to 1.85.1

Release notes

Sourced from io.grpc:grpc-protobuf's releases.

v1.85.1

What's Changed

• netty: Include pseudo-headers in GrpcHttp2RequestHeaders.iterator() (v1.85.x backport) by @​AgraVator in grpc/grpc-java#13120
• core: Delayed deserialization for unary/server-streaming calls (v1.85.x backport) by @​kannanjgithub in grpc/grpc-java#13132
• xDS: fix DistributorWatcher thread safety in CertificateProvider (v1.85.x backport) by @​kannanjgithub in grpc/grpc-java#13133

Commits

• 54c634a Bump version to 1.85.1
• fcedb64 Update README etc to reference 1.85.1
• a523900 xDS: fix DistributorWatcher thread safety in CertificateProvider (v1.85.x bac...
• f1ba10e core: Delayed deserialization for unary/server-streaming calls (v1.85.x backp...
• ca2f8c1 netty: Include pseudo-headers in GrpcHttp2RequestHeaders.iterator() (v1.85.x ...
• af34f7f Bump version to 1.85.1-SNAPSHOT
• See full diff in compare view

Updates io.grpc:grpc-stub from 1.85.0 to 1.85.1

Release notes

Sourced from io.grpc:grpc-stub's releases.

v1.85.1

What's Changed

• netty: Include pseudo-headers in GrpcHttp2RequestHeaders.iterator() (v1.85.x backport) by @​AgraVator in grpc/grpc-java#13120
• core: Delayed deserialization for unary/server-streaming calls (v1.85.x backport) by @​kannanjgithub in grpc/grpc-java#13132
• xDS: fix DistributorWatcher thread safety in CertificateProvider (v1.85.x backport) by @​kannanjgithub in grpc/grpc-java#13133

Commits

• 54c634a Bump version to 1.85.1
• fcedb64 Update README etc to reference 1.85.1
• a523900 xDS: fix DistributorWatcher thread safety in CertificateProvider (v1.85.x bac...
• f1ba10e core: Delayed deserialization for unary/server-streaming calls (v1.85.x backp...
• ca2f8c1 netty: Include pseudo-headers in GrpcHttp2RequestHeaders.iterator() (v1.85.x ...
• af34f7f Bump version to 1.85.1-SNAPSHOT
• See full diff in compare view

Updates io.grpc:grpc-inprocess from 1.85.0 to 1.85.1

Release notes

Sourced from io.grpc:grpc-inprocess's releases.

v1.85.1

What's Changed

• netty: Include pseudo-headers in GrpcHttp2RequestHeaders.iterator() (v1.85.x backport) by @​AgraVator in grpc/grpc-java#13120
• core: Delayed deserialization for unary/server-streaming calls (v1.85.x backport) by @​kannanjgithub in grpc/grpc-java#13132
• xDS: fix DistributorWatcher thread safety in CertificateProvider (v1.85.x backport) by @​kannanjgithub in grpc/grpc-java#13133

Commits

• 54c634a Bump version to 1.85.1
• fcedb64 Update README etc to reference 1.85.1
• a523900 xDS: fix DistributorWatcher thread safet...

  Description has been truncated