build(deps): bump the java-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the java-dependencies group with 4 updates in the /api directory: org.springframework.boot:spring-boot-starter-parent, org.springdoc:springdoc-openapi-starter-webmvc-ui, com.diffplug.spotless:spotless-maven-plugin and org.apache.maven:apache-maven.

Updates org.springframework.boot:spring-boot-starter-parent from 4.1.0 to 4.1.1

Release notes

Sourced from org.springframework.boot:spring-boot-starter-parent's releases.

v4.1.1

⚠️ Attention Required

• Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied. This behavior caused problems for those using Protobuf without gRPC. To opt in to the configuration of gRPC, configure the protobuf extension with the grpc plugin using an empty block. The Spring Boot Gradle plugin will then automatically configure the use of protoc-gen-grpc-java as before. #50822

🐞 Bug Fixes

• Kafka consumer-specific security protocol is not taken into account #51369
• Structured logging: a failed JSON encode corrupts the next log event written on the same thread #51156
• Micrometer registries pin the application context #51135
• Temporary file is not deleted when ExportedImageTar construction fails #51132
• Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records #51098
• spring-boot-h2-console pulls servlet-api as transitive dependency #51095
• PropertiesLauncher does not log nested archive paths #51089
• Methods that return the result of Map#remove are not declared with a @Nullable return type #51087
• NativeImageResourceProvider flattens Flyway migration paths in subdirectories #50964
• Fix ordering of Kotlinx Serialization CodecCustomizer #50961
• JarFile is not closed when finding main class from archive #50959
• Application-managed JUL bridge handler should only be removed if installed #50950
• CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined #50944
• Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health #50942
• Resources are not cleaned up when resolving an image that is not yet present in the builder #50941
• GraphQlWebMvcAutoConfiguration should apply customizers in order #50914
• Auto-configured RedisMessageListenerContainer does not use virtual threads when spring.threads.virtual.enabled is true #50884
• Context refresh fails when using Actuator on Jersey without spring-boot-health #50872
• Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health #50871
• IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard #50856
• High number of connections due to Mongo health indicator #50852
• Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri #50849
• Return type nullability of ApplicationContextAssert's getBean methods does not indicate that bean may be null #50845
• PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #50843
• Exposing gRPC test server port should backoff if gRPC is not present #50825
• JpaBaseConfiguration#entityManagerConfiguration can cause a dependency loop on beans declaring AsyncTaskExecutor #50801
• spring.grpc.server.health.include-overall-health is not taken into account #50799
• Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute #50790
• Managed version of Prometheus Client is not aligned with Micrometer's micrometer-registry-prometheus #50780
• Map properties bound from empty strings fail with ConverterNotFoundException #50773
• Protobuf Common Protos should not be a managed dependency #50772
• An application that depends on spring-boot-security-oauth2-resource-server may fail to start with a ClassNotFoundException when Reactor is on the classpath but WebFlux is not #50764
• W3CHeaderParser's decoding is not compliant with RFC 3986 #50650

📔 Documentation

• Description of spring.graphql.websocket.connection-init-timeout does not render correctly in the reference guide #51348
• spring.profiles.group should have a 'spring-profile-name' hint provider #51284
• Remove reference to removed InfluxDB auto-configuration #51176
• Use JacksonJsonSerde in Kafka Streams documentation #51161
• Document alternatives to HttpMessageConverters #51129
• Fix stale type reference for OTLP logging transport metadata #51119
• Metadata for spring.test.mockmvc.htmlunit.url declares the wrong type #51115

... (truncated)

Commits

• 6fdf67e Release 4.1.1
• fde599b Upgrade to Spring Pulsar 2.0.7
• 9daa58f Upgrade to Spring HATEOAS 3.1.2
• 353993e Upgrade to Spring Data Bom 2026.0.1
• 24ba596 Upgrade to Spring Session 4.1.1
• 5cb5c29 Upgrade to Spring Security 7.1.1
• 4adc8eb Upgrade to Spring LDAP 4.1.1
• 4d9c19c Upgrade to Spring Kafka 4.1.1
• f30f612 Upgrade to Spring Integration 7.1.1
• b930283 Upgrade to Spring gRPC 1.1.1
• Additional commits viewable in compare view

Updates org.springdoc:springdoc-openapi-starter-webmvc-ui from 3.0.3 to 3.1.0

Release notes

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's releases.

springdoc-openapi v3,1,0 released!

What's Changed

• Fix request-specific Swagger UI index transformations by @​limehee in springdoc/springdoc-openapi#3279
• Fix #3282: preserve nest() version predicate across all routes in nest by @​seonwooj0810 in springdoc/springdoc-openapi#3296
• Upgrade Spring Boot to version 4.1.0
• Upgrade Spring AI to version 2.0.0
• Upgrade swagger-core to version 2.2.52
• Upgrade swagger-ui to version 5.32.11
• #3307 – Act upon SonarQube warnings
• #3306 – Act upon SonarQube warnings

Added

• #3269 – Add mechanism to disable nullable for Kotlin properties
• Allow request-specific Swagger UI index transformation

Fixed

• #3304 – Kotlin parent class's field is not properly marked as nullable
• #3294 – Duplicated path getting swagger-config
• #3293 – Inconsistent OpenAPI schema naming with SNAKE_CASE: some Java record fields remain camelCase
• #3292 – Make WebProperties and WebMvcProperties optional in SwaggerConfig
• #3284 – Upgrade swagger-core from version 2.2.48 to 2.2.49
• #3282 – Preserve version from nest() predicate across all routes in nest
• #3281 – Stabilize Spring Data Page schema property order
• #3274 – Description disappears from the generated json after upgrade to 3.0.3
• #3270 – Validation annotation of ParameterObject property applied to PathVariable with the same name, even in unrelated endpoints
• #3266 – Upgrade swagger-core from version 2.2.47 to 2.2.48
• #3263 – Null key for a Map not allowed in JSON

Full Changelog: springdoc/springdoc-openapi@v3.0.3...v3.1.0

Changelog

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's changelog.

[3.1.0] - 2026-07-31

Added

• #3269 – Add mechanism to disable nullable for Kotlin properties
• Allow request-specific Swagger UI index transformation

Changed

• Upgrade Spring Boot to version 4.1.0
• Upgrade Spring AI to version 2.0.0
• Upgrade swagger-core to version 2.2.52
• Upgrade swagger-ui to version 5.32.11
• #3307 – Act upon SonarQube warnings
• #3306 – Act upon SonarQube warnings

Fixed

• #3304 – Kotlin parent class's field is not properly marked as nullable
• #3294 – Duplicated path getting swagger-config
• #3293 – Inconsistent OpenAPI schema naming with SNAKE_CASE: some Java record fields remain camelCase
• #3292 – Make WebProperties and WebMvcProperties optional in SwaggerConfig
• #3284 – Upgrade swagger-core from version 2.2.48 to 2.2.49
• #3282 – Preserve version from nest() predicate across all routes in nest
• #3281 – Stabilize Spring Data Page schema property order
• #3274 – Description disappears from the generated json after upgrade to 3.0.3
• #3270 – Validation annotation of ParameterObject property applied to PathVariable with the same name, even in unrelated endpoints
• #3266 – Upgrade swagger-core from version 2.2.47 to 2.2.48
• #3263 – Null key for a Map not allowed in JSON

Commits

• e04f91f [maven-release-plugin] prepare release v3.1.0
• 83551ce CHANGELOG.md update
• 4a2b5bd CHANGELOG.md update
• ad0a5a5 swagger-ui upgrade to version 5.32.11
• 6e14cb4 Fix sonarqube errors
• eae2056 Fix sonarqube errors
• b09a77b chore: act upon SonarQube warnings
• cc3d86d upgrade spring-ai to version 2.0.0
• df1c2ba spring-boot upgrade to 4.1.0
• b6e5212 Kotlin parent class's field is not properly marked as nullable. Fixes #3304
• Additional commits viewable in compare view

Updates com.diffplug.spotless:spotless-maven-plugin from 3.8.0 to 3.10.0

Release notes

Sourced from com.diffplug.spotless:spotless-maven-plugin's releases.

Maven Plugin v3.10.0

Added

• New <shortenFullyQualifiedTypes> step for Java, which replaces fully-qualified type names with their simple names and adds the imports they need. Best combined with <importOrder> and <removeUnusedImports>. (#2945)
• Add embedded lockfiles to Eclipse JDT for every supported version (4.9 through 4.40), so eclipse() resolves from Maven Central instead of querying a P2 update site. Versions without an embedded lockfile still fall back to P2 provisioning. (#1996)
• Add support to apply alternate license header within same format (#872)
• Add support to skip license header application based on source file content pattern (#650).

Fixed

• removeUnusedImports no longer fails on Java import module declarations. (#2890)
• Concurrent P2 provisioning no longer races Solstice's on-disk cache (affects Eclipse-based formatters under parallel builds). (#3004)

Changes

• Default google-java-format remains 1.28.0 on JVM 17; bumps to 1.30.0 on JVM 21+; require at least 1.30.0 on JVM 25+ for import module support.
• Bump default eclipse version to latest 4.39 -> 4.40. (#1996)
• Document Maven skip properties spotless.skip, spotless.check.skip, and spotless.apply.skip. Goal-specific skips now live on their own mojos so they no longer leak across goals. (#3009)
• Bump default adocfmt version 0.2.0 -> 0.3.1, which adds table formatting support (<formatTables>, <tableLayout>, <tableMaxLineWidth>, <tableBlankLines>).

Maven Plugin v3.9.0

Added

• Add support for Java formatting via prince-of-space with the new <princeOfSpace> step. (#2991)

Changes

• Replace RDF formatter library de.atextor:turtle-formatter (discontinued) with cool.rdf:cool-rdf-formatter (its new coordinates); the RDF/turtle formatter now requires Java 25+. (#2995)
• Bump default greclipse version to latest 4.39 -> 4.40. (#2989)
• Bump default tabletest-formatter version 1.1.1 -> 1.1.2.

Commits

• 426b21d Published maven/3.10.0
• 2fd42ea Published gradle/8.10.0
• d71ed1a Published lib/4.10.0
• 8b57c01 Add shortenFullyQualifiedTypes step (fixes #2945) (#3005 closes #2945)
• 6b42c5e fix: make the FQN-collecting visitor a named static class
• 4430823 Better organization on the changelogs.
• 45bea6d Better place to put the shortenFullyQualifiedTypes docs
• 0c49e65 chore: spotlessApply
• 1c5bc0a docs: list the Java import steps in the plugin README tables of contents
• cd57b58 docs: document shortenFullyQualifiedTypes in the plugin READMEs
• Additional commits viewable in compare view

Updates org.apache.maven:apache-maven from 3.9.12 to 3.9.16

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, java. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.