Skip to content

chore(deps): bump the maven-minor group across 1 directory with 16 updates - #646

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/maven-minor-47e516dfed
Open

chore(deps): bump the maven-minor group across 1 directory with 16 updates#646
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/maven-minor-47e516dfed

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor

Bumps the maven-minor group with 16 updates in the / directory:

Package From To
org.junit:junit-bom 6.1.1 6.1.2
org.hibernate.validator:hibernate-validator 9.1.2.Final 9.1.3.Final
org.omnifaces:omnifaces 5.3.4 5.4.5
org.primefaces:primefaces 15.0.16 15.0.17
com.twelvemonkeys.servlet:servlet 3.13.1 3.14.0
com.twelvemonkeys.imageio:imageio-bmp 3.13.1 3.14.0
com.twelvemonkeys.imageio:imageio-jpeg 3.13.1 3.14.0
com.twelvemonkeys.imageio:imageio-tiff 3.13.1 3.14.0
com.twelvemonkeys.imageio:imageio-hdr 3.13.1 3.14.0
com.twelvemonkeys.imageio:imageio-webp 3.13.1 3.14.0
org.mariadb.jdbc:mariadb-java-client 3.5.9 3.5.10
io.sentry:sentry-log4j2 8.47.0 8.51.0
org.jsoup:jsoup 1.22.2 1.23.1
org.eclipse.jetty.ee11:jetty-ee11-cdi 12.1.10 12.1.11
org.eclipse.jetty.ee11:jetty-ee11-maven-plugin 12.1.10 12.1.11
com.github.spotbugs:spotbugs-maven-plugin 4.10.2.0 4.10.3.0

Updates org.junit:junit-bom from 6.1.1 to 6.1.2

Release notes

Sourced from org.junit:junit-bom's releases.

JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.1...r6.1.2

Commits
  • b685426 Release 6.1.2
  • ae244a6 Remove blanket outputDirectoryCreator from SuiteEngineTests (#5793)
  • 43bd154 Finalize 6.1.2 release notes
  • 0cd9510 Fix order of release note sections
  • a1507cb Add initial 6.1.2 release notes to release notes index
  • 9326641 Fix NoTestsDiscoveredException for suites containing only dynamic tests (#5839)
  • 2ef1123 Create initial 6.1.2 release notes from template
  • 83fa9ab Back to snapshots for further development
  • See full diff in compare view

Updates org.hibernate.validator:hibernate-validator from 9.1.2.Final to 9.1.3.Final

Release notes

Sourced from org.hibernate.validator:hibernate-validator's releases.

Release 9.1.3.Final

Hibernate Validator 9.1.3.Final released

We are pleased to announce the release of Hibernate Validator 9.1: 9.1.3.Final.

You can find the full list of 9.1.3.Final changes here.

What's new

  • See the website for requirements and compatibilities.
  • See the What's New guide for details about new features and capabilities.

Conclusion

For additional details, see:

Visit the website for details on getting in touch with us.

Changelog

Sourced from org.hibernate.validator:hibernate-validator's changelog.

9.1.3.Final (2026-07-26)

Full changelog

Bug

  • HV-2231 - RegexpURLValidator throws NPE when URL has no authority component
Commits
  • 8ab68bc [Jenkins release job] Preparing release 9.1.3.Final
  • 36a8551 [Jenkins release job] changelog.md updated by release build 9.1.3.Final
  • e8b4ebd [Jenkins release job] README.md updated by release build 9.1.3.Final
  • 8ba5072 HV-2231 Fix NPE in RegexpURLValidator when URL has no host
  • e9d4856 [9.1] Bump the build-dependencies group with 3 updates
  • 7793c80 Use correct env var name for additional arguments in the release script
  • 8cffdd8 [Jenkins release job] Preparing next development iteration
  • See full diff in compare view

Updates org.omnifaces:omnifaces from 5.3.4 to 5.4.5

Commits
  • 56e9e56 Prepare 5.4.5 release
  • 5a1e6dd Ref #976 commit the SSE response head on Liberty as well as Quarkus
  • 7f6ae19 Branch is now ready for 5.4.5 development
  • 9825389 Prepare 5.4.4 release
  • 9c82c26 Ref #976 explain why the push integration tests are disabled on Quarkus
  • 416b397 Ref #976 allow @​Push injection points to be activated at build time
  • 486414c Ref #976 commit the SSE response head explicitly
  • 3cce20f Fix #975 o:socket fails in Quarkus since security fix in 5.4.2
  • aeb249b Merge remote-tracking branch 'origin/4.x' into 5.x
  • efb5181 Merge remote-tracking branch 'origin/4.x' into 5.x
  • Additional commits viewable in compare view

Updates org.primefaces:primefaces from 15.0.16 to 15.0.17

Release notes

Sourced from org.primefaces:primefaces's releases.

15.0.17

What's Changed

New Contributors

Full Changelog: primefaces/primefaces@v15.0.16...v15.0.17

Commits

Updates com.twelvemonkeys.servlet:servlet from 3.13.1 to 3.14.0

Release notes

Sourced from com.twelvemonkeys.servlet:servlet's releases.

TwelveMonkeys ImageIO 3.14.0 release notes

Introduces memory allocation guards, to avoid OOME situations.

What's Changed

New Contributors

Full Changelog: haraldk/TwelveMonkeys@twelvemonkeys-3.13.1...twelvemonkeys-3.14.0

Commits
  • 62f6e2f [maven-release-plugin] prepare release twelvemonkeys-3.14.0
  • 157a26c #1265: VP8Frame clean-up
  • f6bbfe4 #1278: common-image unit test clean-up
  • 94a2a46 Add common-image unit tests (#1278)
  • fd923d5 Avoid full-frame VP8 macroblock allocation for subsampled WebP reads (#1265)
  • cc9af05 Bump org.apache.maven.plugins:maven-help-plugin from 3.5.1 to 3.5.2
  • f4d813c Bump actions/setup-java from 5.3.0 to 5.4.0 in /.github/workflows
  • 7f209dc refactor(imageio): address review on destination allocation guard
  • d24bc14 fix(imageio): guard against unbounded allocation from declared dimensions
  • 942a1eb Bump mikepenz/action-junit-report in /.github/workflows
  • Additional commits viewable in compare view

Updates com.twelvemonkeys.imageio:imageio-bmp from 3.13.1 to 3.14.0

Updates com.twelvemonkeys.imageio:imageio-jpeg from 3.13.1 to 3.14.0

Updates com.twelvemonkeys.imageio:imageio-tiff from 3.13.1 to 3.14.0

Updates com.twelvemonkeys.imageio:imageio-hdr from 3.13.1 to 3.14.0

Updates com.twelvemonkeys.imageio:imageio-webp from 3.13.1 to 3.14.0

Updates com.twelvemonkeys.imageio:imageio-bmp from 3.13.1 to 3.14.0

Updates com.twelvemonkeys.imageio:imageio-jpeg from 3.13.1 to 3.14.0

Updates com.twelvemonkeys.imageio:imageio-tiff from 3.13.1 to 3.14.0

Updates com.twelvemonkeys.imageio:imageio-hdr from 3.13.1 to 3.14.0

Updates com.twelvemonkeys.imageio:imageio-webp from 3.13.1 to 3.14.0

Updates org.mariadb.jdbc:mariadb-java-client from 3.5.9 to 3.5.10

Release notes

Sourced from org.mariadb.jdbc:mariadb-java-client's releases.

MariaDB Connector/Java 3.5.10

3.5.10 (Jul 2026)

Full Changelog

Key Enhancements

  • CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
  • CONJ-1330 - add infer test to CI

Issues Resolved

  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)
  • CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder)
  • CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)
  • CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)
  • CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)
  • CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
  • CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR)
  • CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order
Changelog

Sourced from org.mariadb.jdbc:mariadb-java-client's changelog.

3.5.10 (Jul 2026)

Full Changelog

Key Enhancements

  • CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
  • CONJ-1330 - add infer test to CI

Issues Resolved

  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)
  • CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder)
  • CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)
  • CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)
  • CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)
  • CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
  • CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR)
  • CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order

3.4.4 (Jul 2026)

Full Changelog

Notable Changes
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
Bugs Fixed
  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)

... (truncated)

Commits
  • 6164678 [misc] update changelog
  • 6f58858 [CONJ-1335] getGeneratedKeys() throws SQLDataException "integer overflow" aft...
  • 9f06db7 [misc] CI stability improvement
  • 99aa9e2 [CONJ-1336] correction follow up
  • 28a1550 [CONJ-1336] strip trailing dot from hostname before SNI and hostname verifica...
  • b2b3f1b [misc] limit authentication switch requests to 10 per connection
  • 26ca60a [misc] bound the whole connection phase by connectTimeout
  • 15e08ff [CONJ-1337] Limit parsec authentication PBKDF2 iteration factor to the connec...
  • d3c4a72 bump 3.5.10 version
  • d85e05f [CONJ-1342] socketFactory option allows loading arbitrary bytecode via jar: U...
  • Additional commits viewable in compare view

Updates io.sentry:sentry-log4j2 from 8.47.0 to 8.51.0

Release notes

Sourced from io.sentry:sentry-log4j2's releases.

8.51.0

Features

  • Use Android's ProfilingManager (Perfetto) for continuous profiling on API 35+ devices (#5251)
    • On API 35+ devices, continuous profiling now automatically uses Android's system ProfilingManager with Perfetto-based stack sampling, providing lower-overhead and more accurate profiles. No configuration change is required.
    • Devices below API 35 keep using the legacy Debug-based profiler.
    • Added an enableLegacyProfiling option (default true) to disable the legacy Debug-based profiler. Setting it to false disables continuous profiling on API < 35 devices as well as transaction-based profiling (profilesSampleRate/profilesSampler) on all devices, since transaction-based profiling is not supported by Perfetto.
    • It can also be configured via the io.sentry.profiling.enable-legacy-profiling manifest flag.
    • See the Android profiling docs for details.

Behavioral Changes

  • The outbox and cache directories are no longer created by Sentry.init (#5792)
    • They are now created lazily by whichever component first writes into them, off the init thread. As a result, the directories at SentryOptions.getOutboxPath() and SentryOptions.getCacheDirPath() are not guaranteed to exist once Sentry.init returns.
    • If you write envelopes into the outbox path yourself instead of going through the SDK — as hybrid SDKs do for captureEnvelope — create the directory first, e.g. new File(outboxPath).mkdirs().

Improvements

  • Skip building Android manifest metadata debug log messages when debug logging is disabled, reducing allocations during SDK init (#5790)

Fixes

  • Use the original app build's ProGuard UUID for ANR profile chunks (#5852)
  • Fix potential ANR/deadlock in Session Replay when checkCanRecord runs on the replay executor thread (#5837)
  • Prevent concurrent PixelCopy access during Session Replay masking and bitmap cleanup (#5808)
  • Release MediaMuxer when the replay video encoder fails to start to avoid a resource leak (#5607)
  • Set the correct platform (android instead of java) on ANR profile chunks so they are billed as UI Profile Hours rather than Continuous Profile Hours (#5836)
  • Skip encoding and capturing buffered session replay segments while rate-limited, so we don't waste resources on envelopes the transport will drop (#5813)
    • These skipped replays are now reported as ratelimit_backoff discarded events in client reports, so they no longer disappear from drop statistics. One event is recorded per buffer flush rather than per segment.
    • Buffer mode is also kept while rate-limited instead of switching to session mode, so the rolling buffer stays warm and the next error after the rate limit expires can send a complete replay.

Performance

  • Create the outbox and cache directories lazily in their consumers instead of during SDK init, moving the mkdirs() calls off the init (main) thread (#5792)
  • Reduce the number of SDK threads: LifecycleWatcher now schedules the session-end task on the shared timer executor instead of creating a dedicated java.util.Timer thread (#5819)
  • Reduce the number of SDK threads: RateLimiter now schedules its rate-limit-lifted notifications on the shared timer executor instead of creating a dedicated java.util.Timer thread (#5814)
  • Speed up deserialization of arbitrary JSON objects by typing numbers without throwing exceptions (#5783)

Dependencies

8.50.1

Fixes

  • Pin the published Sentry Android SDK's AAR metadata minCompileSdk to our minSdk (21) instead of AGP 9's new default of the SDK's own compileSdk (37), so apps that depend on the SDK aren't forced to raise their compileSdk (#5823)

8.50.0

... (truncated)

Changelog

Sourced from io.sentry:sentry-log4j2's changelog.

8.51.0

Features

  • Use Android's ProfilingManager (Perfetto) for continuous profiling on API 35+ devices (#5251)
    • On API 35+ devices, continuous profiling now automatically uses Android's system ProfilingManager with Perfetto-based stack sampling, providing lower-overhead and more accurate profiles. No configuration change is required.
    • Devices below API 35 keep using the legacy Debug-based profiler.
    • Added an enableLegacyProfiling option (default true) to disable the legacy Debug-based profiler. Setting it to false disables continuous profiling on API < 35 devices as well as transaction-based profiling (profilesSampleRate/profilesSampler) on all devices, since transaction-based profiling is not supported by Perfetto.
    • It can also be configured via the io.sentry.profiling.enable-legacy-profiling manifest flag.
    • See the Android profiling docs for details.

Behavioral Changes

  • The outbox and cache directories are no longer created by Sentry.init (#5792)
    • They are now created lazily by whichever component first writes into them, off the init thread. As a result, the directories at SentryOptions.getOutboxPath() and SentryOptions.getCacheDirPath() are not guaranteed to exist once Sentry.init returns.
    • If you write envelopes into the outbox path yourself instead of going through the SDK — as hybrid SDKs do for captureEnvelope — create the directory first, e.g. new File(outboxPath).mkdirs().

Improvements

  • Skip building Android manifest metadata debug log messages when debug logging is disabled, reducing allocations during SDK init (#5790)

Fixes

  • Use the original app build's ProGuard UUID for ANR profile chunks (#5852)
  • Fix potential ANR/deadlock in Session Replay when checkCanRecord runs on the replay executor thread (#5837)
  • Prevent concurrent PixelCopy access during Session Replay masking and bitmap cleanup (#5808)
  • Release MediaMuxer when the replay video encoder fails to start to avoid a resource leak (#5607)
  • Set the correct platform (android instead of java) on ANR profile chunks so they are billed as UI Profile Hours rather than Continuous Profile Hours (#5836)
  • Skip encoding and capturing buffered session replay segments while rate-limited, so we don't waste resources on envelopes the transport will drop (#5813)
    • These skipped replays are now reported as ratelimit_backoff discarded events in client reports, so they no longer disappear from drop statistics. One event is recorded per buffer flush rather than per segment.
    • Buffer mode is also kept while rate-limited instead of switching to session mode, so the rolling buffer stays warm and the next error after the rate limit expires can send a complete replay.

Performance

  • Create the outbox and cache directories lazily in their consumers instead of during SDK init, moving the mkdirs() calls off the init (main) thread (#5792)
  • Reduce the number of SDK threads: LifecycleWatcher now schedules the session-end task on the shared timer executor instead of creating a dedicated java.util.Timer thread (#5819)
  • Reduce the number of SDK threads: RateLimiter now schedules its rate-limit-lifted notifications on the shared timer executor instead of creating a dedicated java.util.Timer thread (#5814)
  • Speed up deserialization of arbitrary JSON objects by typing numbers without throwing exceptions (#5783)

Dependencies

8.50.1

Fixes

  • Pin the published Sentry Android SDK's AAR metadata minCompileSdk to our minSdk (21) instead of AGP 9's new default of the SDK's own compileSdk (37), so apps that depend on the SDK aren't forced to raise their compileSdk (#5823)

... (truncated)

Commits
  • b01b159 release: 8.51.0
  • 1c74da0 chore(changelog): Fix Changelog (#5868)
  • 7055ed1 feat(profiling): Add Android ProfilingManager (Perfetto) support (#5251)
  • 80c3e67 build: Replace Gradle APIs removed in Gradle 10 (#5864)
  • 1b40080 fix(anr): Use Proguard ID from origination ANR process with ANR profie chunks...
  • 91e71ac build: Upgrade Gradle to 9.6.1 (#5863)
  • 8f86119 fix(anr-profiling): Properly bill ANR profiling under UI Profile Hours (#5836)
  • 5e6844d perf(core): Create outbox and cache dirs lazily instead of during init (JAVA-...
  • c318acd perf: Schedule rate-limit notifications on shared executor (JAVA-653) (#5814)
  • d1f9ed4 chore(deps): bump the github-actions group across 1 directory with 3 updates ...
  • Additional commits viewable in compare view

Updates org.jsoup:jsoup from 1.22.2 to 1.23.1

Release notes

Sourced from org.jsoup:jsoup's releases.

jsoup 1.23.1

jsoup Java HTML Parser release 1.23.1

jsoup 1.23.1 is out now, with a faster and more memory-efficient HTML parser, improved alignment with the HTML standard across noscript, CDATA, SVG, and MathML parsing, and safer, specification-correct HTTP redirects. The release also adds a fast immutable Element#classList(), direct outer-HTML output to an Appendable, and fixes across RCDATA parsing, XML conversion, tag-name handling, and Cleaner link detection.

Performance optimization was a major focus for this release. In our OpenJDK 21 benchmarks, ordinary string parsing is now 18% faster on average, parsing from an InputStream is 11% faster, and parsing with source position tracking is 70% faster while allocating 64% fewer bytes per document.

Source-tracked DOMs retain 58-65% less memory on representative medium-to-large documents, and the improvements hold under concurrent parsing without introducing new contention. Exact gains will naturally vary with document shape, JVM, and hardware.

This release also fixes a security issue in the Cleaner that could expose markup when malformed HTML is cleaned with a custom Safelist permitting certain raw-text elements. The built-in Safelists are unaffected.

jsoup is a Java library for working with real-world HTML and XML. It provides a very convenient API for extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors.

Download jsoup now.

Improvements

  • Reduced retained memory when parsing with source position tracking enabled (Parser#setTrackPosition(true)). Source ranges are now stored in compact parser-owned span records instead of node and attribute user data, and Position objects are created lazily when source ranges are read. This cuts tracked DOM retained size by about 50-60% on representative benchmark documents, while keeping Node#sourceRange(), Element#endSourceRange(), and Attribute#sourceRange() behavior intact. #2498
  • Added Element#classList(), an immutable snapshot of an element's class names in attribute order. Use hasClass() when you just need to test for one class, classList() when you want to read or iterate classes without needing a mutable result, and classNames() when you want the existing mutable, deduplicated set that can be written back with classNames(Set). The class APIs now share an HTML-whitespace scanner, which also makes classNames() faster and lighter on allocation, especially when walking many elements without class names. #2500
  • Aligned HTML parser scope classification with the current HTML spec for select, foreignObject, and template. #2501
  • Simplified the HTML tree builder's scope, implied-end-tag, and special-element checks by caching parser-only options on Tag. That improves HTML parser throughput by about 10% on small inputs and up to about 30% on larger inputs in the benchmark fixtures. #2502
  • Improved HTML parser throughput stability by making hot tokeniser scan paths compile more predictably. #2507
  • <noscript> fallback markup is now parsed into an inspectable DOM subtree in both the document head and body. The fallback acts as a contained parsing island, so malformed markup cannot disrupt the surrounding document structure, while normal HTML tokenization still applies within it. This also improves round-trip serialization. #2537
  • Improved redirect credential handling as a defense-in-depth measure: explicit authorization headers and request cookies are no longer forwarded across origins, reducing exposure through open redirects and aligning with HTTP guidance. Cookies managed by a CookieStore continue to follow their configured scope. #2540
  • Elements can now append their outer HTML, including their own tags, directly to an Appendable with Node#outerHtml(Appendable), without first creating a String. This complements Element#html(Appendable), which appends inner HTML only. #2532
  • Aligned CDATA tokenization with the HTML spec: CDATA syntax in HTML content is parsed as a bogus comment, while it remains supported in SVG, MathML, and XML. Also improved namespace-aware fragment parsing so SVG and MathML contexts, HTML integration points, and context-sensitive tokenizer states are handled correctly. #2542
  • When using the optional re2j regular expression engine, stack overflows caused by complex selector patterns are now normalized to a ValidationException with a Pattern complexity error message. #2548

Bug Fixes

  • Fixed HTML parsing of mixed-case RCDATA end tags after tag-shaped text. For example, <title><p>Foo</TiTLE> and <textarea><img src=x></TeXtArEa> now keep the tag-shaped content as text instead of promoting it to markup. #2503
  • Fixed W3CDom XML conversion so plain XML elements don't serialize with the reserved XML namespace as the default namespace. Explicit XML namespaces and xml:* attributes are still preserved. #2504
  • Preserve control characters in parsed tag names #2538
  • Updated HTTP redirects to follow the specification: 307 and 308 preserve the request method and content, 301 and 302 only change POST to GET, and Location is followed only for 301, 302, 303, 307, and 308 responses. Streamed request bodies are not buffered; if an automatic redirect requires replaying one, execution fails, so the caller can resend with a fresh stream. #2540
  • Corrected the Cleaner's same-site link detection to compare hostnames rather than URL prefixes when applying rel=nofollow. #2543

Build Changes

  • Cleaned up the Maven build for the multi-release JAR so Java 8 and Java 11+ sources compile as separate source sets. This avoids spurious Java 8 compiler warnings from newer-language overlay sources, keeps long-running parser checks behind an explicit profile, and preserves the same published artifacts and runtime behavior.
  • Improved parallelism and tuned timing in our integration tests, so that a full mvn clean verify drops from ~ 1m18s to ~ 21 seconds.

My sincere thanks to everyone who contributed to this release! If you have any suggestions for the next release, I would love to hear them; please get in touch via jsoup discussions, or with me directly.

You can also follow me (@jhy@tilde.zone) on Mastodon / Fediverse to receive occasional notes about jsoup releases.

Changelog

Sourced from org.jsoup:jsoup's changelog.

1.23.1 (2026-Jul-30)

Improvements

  • Reduced retained memory when parsing with source position tracking enabled (Parser#setTrackPosition(true)). Source ranges are now stored in compact parser-owned span records instead of node and attribute user data, and Position objects are created lazily when source ranges are read. This cuts tracked DOM retained size by about 50-60% on representative benchmark documents, while keeping Node#sourceRange(), Element#endSourceRange(), and Attribute#sourceRange() behavior intact. #2498
  • Added Element#classList(), an immutable snapshot of an element's class names in attribute order. Use hasClass() when you just need to test for one class, classList() when you want to read or iterate classes without needing a mutable result, and classNames() when you want the existing mutable, deduplicated set that can be written back with classNames(Set). The class APIs now share an HTML-whitespace scanner, which also makes classNames() faster and lighter on allocation, especially when walking many elements without class names. #2500
  • Aligned HTML parser scope classification with the current HTML spec for select, foreignObject, and template. #2501
  • Simplified the HTML tree builder's scope, implied-end-tag, and special-element checks by caching parser-only options on Tag. That improves HTML parser throughput by about 10% on small inputs and up to about 30% on larger inputs in the benchmark fixtures. #2502
  • Improved HTML parser throughput stability by making hot tokeniser scan paths compile more predictably. #2507
  • <noscript> fallback markup is now parsed into an inspectable DOM subtree in both the document head and body. The fallback acts as a contained parsing island, so malformed markup cannot disrupt the surrounding document structure, while normal HTML tokenization still applies within it. This also improves round-trip serialization. #2537
  • Improved redirect credential handling as a defense-in-depth measure: explicit authorization headers and request cookies are no longer forwarded across origins, reducing exposure through open redirects and aligning with HTTP guidance. Cookies managed by a CookieStore continue to follow their configured scope. #2540
  • Elements can now append their outer HTML, including their own tags, directly to an Appendable with Node#outerHtml(Appendable), without first creating a String. This complements Element#html(Appendable), which appends inner HTML only. #2532
  • Aligned CDATA tokenization with the HTML spec: CDATA syntax in HTML content is parsed as a bogus comment, while it remains supported in SVG, MathML, and XML. Also improved namespace-aware fragment parsing so SVG and MathML contexts, HTML integration points, and context-sensitive tokenizer states are handled correctly. #2542
  • When using the optional re2j regular expression engine, stack overflows caused by complex selector patterns are now normalized to a ValidationException with a Pattern complexity error message. #2548

Bug Fixes

  • Fixed HTML parsing of mixed-case RCDATA end tags after tag-shaped text. For example, <title><p>Foo</TiTLE> and <textarea><img src=x></TeXtArEa> now keep the tag-shaped content as text instead of promoting it to markup. #2503
  • Fixed W3CDom XML conversion so plain XML elements don't serialize with the reserved XML namespace as the default namespace. Explicit XML namespaces and xml:* attributes are still preserved. #2504
  • Preserve control characters in parsed tag names #2538
  • Updated HTTP redirects to follow the specification: 307 and 308 preserve the request method and content, 301 and 302 only change POST to GET, and Location is followed only for 301, 302, 303, 307, and 308 responses. Streamed request bodies are not buffered; if an automatic redirect requires replaying one, execution fails, so the caller can resend with a fresh stream. #2540
  • Corrected the Cleaner's same-site link detection to compare hostnames rather than URL prefixes when applying rel=nofollow. #2543

Build Changes

  • Cleaned up the Maven build for the multi-release JAR so Java 8 and Java 11+ sources compile as separate source sets. This avoids spurious Java 8 compiler warnings from newer-language overlay sources, keeps long-running parser checks behind an explicit profile, and preserves the same published artifacts and runtime behavior.
  • Improved parallelism and tuned timing in our integration tests, so that a full mvn clean verify drops from ~ 1m18s to ~ 21 seconds.
Commits
  • bb077a8 [maven-release-plugin] prepare release jsoup-1.23.1
  • cdb5579 Harden the test some
  • b86b282 Normalize re2j complexity exceptions
  • 0fcc369 Bump github/codeql-action from 4.37.0 to 4.37.1
  • aea4a1b Bump actions/setup-java from 5.5.0 to 5.6.0
  • ec9c879 Bump actions/checkout from 7.0.0 to 7.0.1
  • 1fb2c97 Fix KeyVal.inputStream validation
  • 3475afc Handle non-string internal attribute values; test for internal attribute data
  • be8c375 Parse CDATA according to the context namespace
  • 8996fce Add appendable outer HTML output
  • Additional commits viewable in compare view

Updates org.eclipse.jetty.ee11:jetty-ee11-cdi from 12.1.10 to 12.1.11

Updates org.eclipse.jetty.ee11:jetty-ee11-maven-plugin from 12.1.10 to 12.1.11

Updates com.github.spotbugs:spotbugs-maven-plugin from 4.10.2.0 to 4.10.3.0

Release notes

Sourced from com.github.spotbugs:spotbugs-maven-plugin's releases.

Spotbugs Maven Plugin 4.10.3.0

Summary

This release delivers improvements to reliability, maintainability, and reproducibility. The SpotBugs execution path has been modernized by replacing the Ant-based launcher with ProcessBuilder, temporary auxiliary classpath handling has been improved, and toolchain detection has been made more robust. Build tooling has also been cleaned up with Maven modernization efforts, improved reproducible artifact generation, and updated documentation. Additional fixes include improved artifact handling, test coverage improvements, and dependency updates.

What's Changed

@dependabot
chore(deps): bump the maven-minor group across 1 directory with 16 up…
f271891 
…dates

Bumps the maven-minor group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [org.junit:junit-bom](https://github.com/junit-team/junit-framework) | `6.1.1` | `6.1.2` |
| [org.hibernate.validator:hibernate-validator](https://github.com/hibernate/hibernate-validator) | `9.1.2.Final` | `9.1.3.Final` |
| [org.omnifaces:omnifaces](https://github.com/omnifaces/omnifaces) | `5.3.4` | `5.4.5` |
| [org.primefaces:primefaces](https://github.com/primefaces/primefaces) | `15.0.16` | `15.0.17` |
| [com.twelvemonkeys.servlet:servlet](https://github.com/haraldk/TwelveMonkeys) | `3.13.1` | `3.14.0` |
| com.twelvemonkeys.imageio:imageio-bmp | `3.13.1` | `3.14.0` |
| com.twelvemonkeys.imageio:imageio-jpeg | `3.13.1` | `3.14.0` |
| com.twelvemonkeys.imageio:imageio-tiff | `3.13.1` | `3.14.0` |
| com.twelvemonkeys.imageio:imageio-hdr | `3.13.1` | `3.14.0` |
| com.twelvemonkeys.imageio:imageio-webp | `3.13.1` | `3.14.0` |
| [org.mariadb.jdbc:mariadb-java-client](https://github.com/mariadb-corporation/mariadb-connector-j) | `3.5.9` | `3.5.10` |
| [io.sentry:sentry-log4j2](https://github.com/getsentry/sentry-java) | `8.47.0` | `8.51.0` |
| [org.jsoup:jsoup](https://github.com/jhy/jsoup) | `1.22.2` | `1.23.1` |
| org.eclipse.jetty.ee11:jetty-ee11-cdi | `12.1.10` | `12.1.11` |
| org.eclipse.jetty.ee11:jetty-ee11-maven-plugin | `12.1.10` | `12.1.11` |
| [com.github.spotbugs:spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) | `4.10.2.0` | `4.10.3.0` |



Updates `org.junit:junit-bom` from 6.1.1 to 6.1.2
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](junit-team/junit-framework@r6.1.1...r6.1.2)

Updates `org.hibernate.validator:hibernate-validator` from 9.1.2.Final to 9.1.3.Final
- [Release notes](https://github.com/hibernate/hibernate-validator/releases)
- [Changelog](https://github.com/hibernate/hibernate-validator/blob/9.1.3.Final/changelog.md)
- [Commits](hibernate/hibernate-validator@9.1.2.Final...9.1.3.Final)

Updates `org.omnifaces:omnifaces` from 5.3.4 to 5.4.5
- [Commits](omnifaces/omnifaces@5.3.4...5.4.5)

Updates `org.primefaces:primefaces` from 15.0.16 to 15.0.17
- [Release notes](https://github.com/primefaces/primefaces/releases)
- [Commits](primefaces/primefaces@v15.0.16...v15.0.17)

Updates `com.twelvemonkeys.servlet:servlet` from 3.13.1 to 3.14.0
- [Release notes](https://github.com/haraldk/TwelveMonkeys/releases)
- [Commits](haraldk/TwelveMonkeys@twelvemonkeys-3.13.1...twelvemonkeys-3.14.0)

Updates `com.twelvemonkeys.imageio:imageio-bmp` from 3.13.1 to 3.14.0

Updates `com.twelvemonkeys.imageio:imageio-jpeg` from 3.13.1 to 3.14.0

Updates `com.twelvemonkeys.imageio:imageio-tiff` from 3.13.1 to 3.14.0

Updates `com.twelvemonkeys.imageio:imageio-hdr` from 3.13.1 to 3.14.0

Updates `com.twelvemonkeys.imageio:imageio-webp` from 3.13.1 to 3.14.0

Updates `com.twelvemonkeys.imageio:imageio-bmp` from 3.13.1 to 3.14.0

Updates `com.twelvemonkeys.imageio:imageio-jpeg` from 3.13.1 to 3.14.0

Updates `com.twelvemonkeys.imageio:imageio-tiff` from 3.13.1 to 3.14.0

Updates `com.twelvemonkeys.imageio:imageio-hdr` from 3.13.1 to 3.14.0

Updates `com.twelvemonkeys.imageio:imageio-webp` from 3.13.1 to 3.14.0

Updates `org.mariadb.jdbc:mariadb-java-client` from 3.5.9 to 3.5.10
- [Release notes](https://github.com/mariadb-corporation/mariadb-connector-j/releases)
- [Changelog](https://github.com/mariadb-corporation/mariadb-connector-j/blob/main/CHANGELOG.md)
- [Commits](mariadb-corporation/mariadb-connector-j@3.5.9...3.5.10)

Updates `io.sentry:sentry-log4j2` from 8.47.0 to 8.51.0
- [Release notes](https://github.com/getsentry/sentry-java/releases)
- [Changelog](https://github.com/getsentry/sentry-java/blob/main/CHANGELOG.md)
- [Commits](getsentry/sentry-java@8.47.0...8.51.0)

Updates `org.jsoup:jsoup` from 1.22.2 to 1.23.1
- [Release notes](https://github.com/jhy/jsoup/releases)
- [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES.md)
- [Commits](jhy/jsoup@jsoup-1.22.2...jsoup-1.23.1)

Updates `org.eclipse.jetty.ee11:jetty-ee11-cdi` from 12.1.10 to 12.1.11

Updates `org.eclipse.jetty.ee11:jetty-ee11-maven-plugin` from 12.1.10 to 12.1.11

Updates `com.github.spotbugs:spotbugs-maven-plugin` from 4.10.2.0 to 4.10.3.0
- [Release notes](https://github.com/spotbugs/spotbugs-maven-plugin/releases)
- [Commits](spotbugs/spotbugs-maven-plugin@spotbugs-maven-plugin-4.10.2.0...spotbugs-maven-plugin-4.10.3.0)

Updates `org.eclipse.jetty.ee11:jetty-ee11-maven-plugin` from 12.1.10 to 12.1.11

---
updated-dependencies:
- dependency-name: org.junit:junit-bom
  dependency-version: 6.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: org.hibernate.validator:hibernate-validator
  dependency-version: 9.1.3.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: org.omnifaces:omnifaces
  dependency-version: 5.4.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: org.primefaces:primefaces
  dependency-version: 15.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.servlet:servlet
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-bmp
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-jpeg
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-tiff
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-hdr
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-webp
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-bmp
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-jpeg
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-tiff
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-hdr
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: com.twelvemonkeys.imageio:imageio-webp
  dependency-version: 3.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: org.mariadb.jdbc:mariadb-java-client
  dependency-version: 3.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: io.sentry:sentry-log4j2
  dependency-version: 8.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: org.jsoup:jsoup
  dependency-version: 1.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-minor
- dependency-name: org.eclipse.jetty.ee11:jetty-ee11-cdi
  dependency-version: 12.1.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: org.eclipse.jetty.ee11:jetty-ee11-maven-plugin
  dependency-version: 12.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: com.github.spotbugs:spotbugs-maven-plugin
  dependency-version: 4.10.3.0
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-minor
- dependency-name: org.eclipse.jetty.ee11:jetty-ee11-maven-plugin
  dependency-version: 12.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants