Skip to content

Bump the maven-dependencies group across 1 directory with 12 updates - #4334

Closed
dependabot[bot] wants to merge 1 commit into
2.5.xfrom
dependabot/maven/2.5.x/maven-dependencies-08467d4bef
Closed

Bump the maven-dependencies group across 1 directory with 12 updates#4334
dependabot[bot] wants to merge 1 commit into
2.5.xfrom
dependabot/maven/2.5.x/maven-dependencies-08467d4bef

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the maven-dependencies group with 12 updates in the / directory:

Package From To
org.slf4j:slf4j-api 2.0.19 2.0.20
org.slf4j:slf4j-simple 2.0.19 2.0.20
org.slf4j:slf4j-simple 2.0.19 2.0.20
ch.qos.logback:logback-classic 1.6.3 1.6.5
org.apache.maven:maven-model 3.9.16 3.10.0
org.apache.maven:maven-plugin-api 3.9.16 3.10.0
org.apache.maven:maven-core 3.9.16 3.10.0
org.mongodb:mongodb-driver-sync 5.11.1 5.13.0
org.mongodb:mongodb-driver-legacy 5.11.1 5.13.0
org.mongodb:mongodb-driver-legacy 5.11.1 5.13.0
com.fasterxml.jackson.core:jackson-databind 2.22.2 2.22.3
com.fasterxml.jackson.dataformat:jackson-dataformat-yaml 2.22.2 2.22.3
com.fasterxml.jackson.dataformat:jackson-dataformat-yaml 2.22.2 2.22.3
io.github.classgraph:classgraph 4.8.195 4.8.196
org.apache.maven:maven-plugin-api 3.9.16 3.10.0
org.apache.maven:maven-core 3.9.16 3.10.0
org.apache.maven:apache-maven 3.9.16 3.10.0

Updates org.slf4j:slf4j-api from 2.0.19 to 2.0.20

Updates org.slf4j:slf4j-simple from 2.0.19 to 2.0.20

Updates org.slf4j:slf4j-simple from 2.0.19 to 2.0.20

Updates ch.qos.logback:logback-classic from 1.6.3 to 1.6.5

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.5

2026-09-30 Release of logback version 1.6.5

• Fixed a vulnerability CVE-2026-104721 closely related to CVE-2026-19880. The fix in version 1.6.3, which strips forward and backward slashes from MDC values, was insufficient. An MDC value could still contain relative path components such as .., variable references such as /, or characters that are special in file name patterns and email addresses. This latest vulnerability was found and reported by François Martin (GitHub: @​martinfrancois, https://github.com/martinfrancois).

MDCBasedDiscriminator, used by SiftingAppender, now rejects MDC values instead of stripping characters from them. An MDC value is rejected if it is empty, if it is longer than 64 characters, if it contains the sequence .., or if it contains any of the following characters: / \ $ { } [ ] ( ) | ? * + % , @. When an MDC value is rejected, the discriminator returns the value of its DefaultValue property. A warning is emitted for each rejected value. These warnings are rate-limited.

• When compression is enabled, TimeBasedRollingPolicy and SizeAndTimeBasedRollingPolicy now also remove old log files that were never compressed, for example because the application was not running at rollover time. Previously, such files were ignored by maxHistory and accumulated indefinitely. This issue was discussed in discussions/1032. See TimeBasedRollingPolicy.

• SimpleInvocationGate, deprecated in version 1.6.3, is now marked for removal. Use FixedIntervalInvocationGate instead.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit d1b829dcdb9fd98511c64401beb1419a9c9384aa associated with the tag v_1.6.5. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.4

2026-09-24 Release of logback version 1.6.4

• Variable substitution is again applied to the scan attribute of the <configuration> element. The scanning refactoring in version 1.5.27 had dropped substitution, so values such as ${logback.scan.enabled:-true} were no longer resolved. As before version 1.5.27, an unrecognized non-empty value turns scanning on. The same substitution now applies to the scan attribute of <propertiesConfigurator>. This regression was reported in issues/1065 by vaibhavjain2.

• OutputStreamAppender and FileAppender now handle stateful encoders. The Encoder interface has a new default method called isStateful(), which returns false. An encoder that keeps state between calls to encode() can return true. For such encoders, the appender holds its write lock while encoding and while writing, so the output of concurrent appends cannot interleave. Stateless encoders still encode outside the lock, so their performance does not change. Existing encoders need no changes.

• Several race conditions in OutputStreamAppender and FileAppender were fixed. The appender is now marked started and the encoder header is written while the same lock is held, so a concurrent append can no longer write an event before the header. After acquiring the lock, the appender checks again whether it has been stopped, so no event is written after the footer. In prudent mode, FileAppender now encodes and writes each event while holding the lock.

• Fixed a data race on the logger count in LoggerContext. Loggers are created under the lock of their parent logger, so loggers with different parents could be created at the same time and increments of the shared counter could be lost. As a result, LoggerContext.size() could return a value lower than the actual number of loggers. The counter is now an AtomicInteger. This issue was reported in issues/1038 by hcantunc. The fix was contributed in PR #1055 by seonwoo_jung.

• TimeBasedRollingPolicy now supports half-day periods. Date patterns with the AM/PM marker, for example %d{yyyy-MM-dd-a}, used to be detected as daily and rolled over only at midnight. They now roll over at both 00:00 and 12:00. This issue was reported in issues/976 by shakthifuture. The fix was contributed in PR #1051 by seonwoo_jung. See TimeBasedRollingPolicy.

• If org.jline.jansi.AnsiConsole cannot be found on the class path, JansiConsoleAppender now emits warnings that explain how to add org.jline:jansi-core and then writes to the plain console stream. See codes.html#missingJlineJansi.

• The unused ch.qos.logback.classic.util.LogbackMDCAdapterSimple class was removed. LogbackMDCAdapter remains the default MDC adapter.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 07d291ca0d280bc5da934ec9ff5f1da634fd7937 associated with the tag v_1.6.4. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Full Changelog: qos-ch/logback@v_1.6.3...v_1.6.4

Commits
  • d1b829d prepare release 1.6.5
  • 065b9b2 enhance protectin against mischievious MDC values in MDCBasedDiscriminator
  • b69beab complete commit in relation to discussion_1032
  • 7266c0b fix intermittently failing SocketAppenderMessageLossTest rest condition
  • a633bb0 fix intermittently failing SocketAppenderMessageLossTest rest condition
  • 2bc5bcc renamed tbrp and eclosingTBRP, other minor changes
  • 2cd8762 fix typo in AGENTS.md
  • 647846c fix errors when running tests under intellij IDEA
  • 1048917 removed ConsoleCharsetPropertyDefiner.java
  • 39b5002 added 'since' and 'forRemoval' attributes to SimpleInvocationGate @​Deprecatio...
  • Additional commits viewable in compare view

Updates org.apache.maven:maven-model from 3.9.16 to 3.10.0

Updates org.apache.maven:maven-plugin-api from 3.9.16 to 3.10.0

Release notes

Sourced from org.apache.maven:maven-plugin-api's releases.

3.10.0

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

... (truncated)

Commits
  • c43a36b [maven-release-plugin] prepare release maven-3.10.0
  • 095eb17 Fix wrong links.
  • bec033e Use staged Maven Resolver 2.0.24
  • b39f8a7 deps: Update to Maven Resolver 2.0.24 (#13271)
  • ae59501 Issue #13265: let a settings server declare the repository origins its creden...
  • 6ab2433 [3.10.x] maintenance: Align use of profiles (#13274)
  • f68413c Do not depend on maven-resolver-supplier-mvn3 (#13266)
  • 3a0026c [Backport maven-3.10.x] Fix #11397: treat reactor BOM imports as ProjectSorte...
  • 82a0f20 docs: document plugin.xml V4 vs V3 [Backport maven-3.10.x]
  • 0fb1c8b [MNG-6797] Remember if Maven model problems were encountered. (#298)
  • Additional commits viewable in compare view

Updates org.apache.maven:maven-core from 3.9.16 to 3.10.0

Updates org.mongodb:mongodb-driver-sync from 5.11.1 to 5.13.0

Release notes

Sourced from org.mongodb:mongodb-driver-sync's releases.

Java Driver 5.13.0 (September 25, 2026)

What's Changed

New Contributors

Full Changelog: mongodb/mongo-java-driver@r5.12.0...r5.13.0

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/languages/java/mongodb-hibernate/upcoming/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Java Driver 5.12.0 (September 17, 2026)

What's Changed

Full Changelog: mongodb/mongo-java-driver@r5.11.0...r5.12.0

Intelligent Workload Management (IWM)

Added support for MongoDB 9.0's Intelligent Workload Management (IWM). The driver now gracefully handles write-blocking scenarios and optimizes connection establishment during high-load conditions to maintain application availability.

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/languages/java/mongodb-hibernate/upcoming/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8
Commits
  • f949913 Version: bump 5.13.0
  • 9174214 JAVA-6235 Add SRV allow hosts option to legacy driver (#2065)
  • ee2c0ba JAVA-6235: Configurable DNS domain validation for SRV records (#2054)
  • 551f88b JAVA-6312 Increase testConnectionPoolBackpressure completion time on CI (#2062)
  • ff74470 build(deps): bump testing/resources/specifications from 92b3c0b to `529a2dd...
  • 3e75708 Version: bump 5.13.0-SNAPSHOT
  • f0bc4cb Update the specifications submodule from d4d0cdf to 92b3c0b to match the `m...
  • dbcd762 Remove a TODO-BACKPRESSURE comment because it is no longer relevant
  • 795f7ce Introduce temporary fallback scheduler into DefaultAsyncClientExecutor (#2056)
  • 71c3f6e Add baseBackoffMS support (#2052)
  • Additional commits viewable in compare view

Updates org.mongodb:mongodb-driver-legacy from 5.11.1 to 5.13.0

Release notes

Sourced from org.mongodb:mongodb-driver-legacy's releases.

Java Driver 5.13.0 (September 25, 2026)

What's Changed

New Contributors

Full Changelog: mongodb/mongo-java-driver@r5.12.0...r5.13.0

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/languages/java/mongodb-hibernate/upcoming/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Java Driver 5.12.0 (September 17, 2026)

What's Changed

Full Changelog: mongodb/mongo-java-driver@r5.11.0...r5.12.0

Intelligent Workload Management (IWM)

Added support for MongoDB 9.0's Intelligent Workload Management (IWM). The driver now gracefully handles write-blocking scenarios and optimizes connection establishment during high-load conditions to maintain application availability.

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/languages/java/mongodb-hibernate/upcoming/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8
Commits
  • f949913 Version: bump 5.13.0
  • 9174214 JAVA-6235 Add SRV allow hosts option to legacy driver (#2065)
  • ee2c0ba JAVA-6235: Configurable DNS domain validation for SRV records (#2054)
  • 551f88b JAVA-6312 Increase testConnectionPoolBackpressure completion time on CI (#2062)
  • ff74470 build(deps): bump testing/resources/specifications from 92b3c0b to `529a2dd...
  • 3e75708 Version: bump 5.13.0-SNAPSHOT
  • f0bc4cb Update the specifications submodule from d4d0cdf to 92b3c0b to match the `m...
  • dbcd762 Remove a TODO-BACKPRESSURE comment because it is no longer relevant
  • 795f7ce Introduce temporary fallback scheduler into DefaultAsyncClientExecutor (#2056)
  • 71c3f6e Add baseBackoffMS support (#2052)
  • Additional commits viewable in compare view

Updates org.mongodb:mongodb-driver-legacy from 5.11.1 to 5.13.0

Release notes

Sourced from org.mongodb:mongodb-driver-legacy's releases.

Java Driver 5.13.0 (September 25, 2026)

What's Changed

New Contributors

Full Changelog: mongodb/mongo-java-driver@r5.12.0...r5.13.0

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/languages/java/mongodb-hibernate/upcoming/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8

Java Driver 5.12.0 (September 17, 2026)

What's Changed

Full Changelog: mongodb/mongo-java-driver@r5.11.0...r5.12.0

Intelligent Workload Management (IWM)

Added support for MongoDB 9.0's Intelligent Workload Management (IWM). The driver now gracefully handles write-blocking scenarios and optimizes connection establishment during high-load conditions to maintain application availability.

Verifying artifact signatures

Please refer to https://www.mongodb.com/docs/languages/java/mongodb-hibernate/upcoming/security/validate-signatures/ for the full procedure.

To download and import the public key for verifying signatures, execute

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 1a75005e142192223d6a7c3b76e0008d166740a8
Commits
  • f949913 Version: bump 5.13.0
  • 9174214 JAVA-6235 Add SRV allow hosts option to legacy driver (#2065)
  • ee2c0ba JAVA-6235: Configurable DNS domain validation for SRV records (#2054)
  • 551f88b JAVA-6312 Increase testConnectionPoolBackpressure completion time on CI (#2062)
  • ff74470 build(deps): bump testing/resources/specifications from 92b3c0b to `529a2dd...
  • 3e75708 Version: bump 5.13.0-SNAPSHOT
  • f0bc4cb Update the specifications submodule from d4d0cdf to 92b3c0b to match the `m...
  • dbcd762 Remove a TODO-BACKPRESSURE comment because it is no longer relevant
  • 795f7ce Introduce temporary fallback scheduler into DefaultAsyncClientExecutor (#2056)
  • 71c3f6e Add baseBackoffMS support (#2052)
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.3

Commits
  • 4385c5f [maven-release-plugin] prepare release jackson-databind-2.22.3
  • ccb4fd0 Prep for 2.22.3 release
  • 2958412 Merge branch '2.21' into 2.22
  • 1215b94 Post-release dep version bump
  • 1f0df62 [maven-release-plugin] prepare for next development iteration
  • 13a9ff4 [maven-release-plugin] prepare release jackson-databind-2.21.7
  • d168f96 Prep for 2.21.7 release
  • eaf5c76 Merge branch '2.21' into 2.22
  • e05ef4c Merge branch '2.20' into 2.21
  • f6d4000 Merge branch '2.19' into 2.20
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson.dataformat:jackson-dataformat-yaml from 2.22.2 to 2.22.3

Commits
  • e793b5f [maven-release-plugin] prepare release jackson-dataformats-text-2.22.3
  • e8e9ece Prep for 2.22.3 release
  • 2ea3d0c Merge branch '2.21' into 2.22
  • 8e88b85 Post-release dep version bump
  • 806abc9 [maven-release-plugin] prepare for next development iteration
  • a11273c [maven-release-plugin] prepare release jackson-dataformats-text-2.21.7
  • 5d16624 Prep for 2.21.7 release
  • f047dd5 Merge branch '2.21' into 2.22
  • 0f80164 Merge branch '2.20' into 2.21
  • 4dcc3da Merge branch '2.19' into 2.20
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson.dataformat:jackson-dataformat-yaml from 2.22.2 to 2.22.3

Commits
  • e793b5f [maven-release-plugin] prepare release jackson-dataformats-text-2.22.3
  • e8e9ece Prep for 2.22.3 release
  • 2ea3d0c Merge branch '2.21' into 2.22
  • 8e88b85 Post-release dep version bump
  • 806abc9 [maven-release-plugin] prepare for next development iteration
  • a11273c [maven-release-plugin] prepare release jackson-dataformats-text-2.21.7
  • 5d16624 Prep for 2.21.7 release
  • f047dd5 Merge branch '2.21' into 2.22
  • 0f80164 Merge branch '2.20' into 2.21
  • 4dcc3da Merge branch '2.19' into 2.20
  • Additional commits viewable in compare view

Updates io.github.classgraph:classgraph from 4.8.195 to 4.8.196

Release notes

Sourced from io.github.classgraph:classgraph's releases.

ClassGraph 4.8.196

ClassGraph 5.0.0 is coming shortly, and requires JDK 17 or newer. 4.8.196 is a bugfix release on the 4.x maintenance branch, and continues the file-by-file audit that produced 4.8.190 through 4.8.195. As before, most of the bugs listed here were found by Claude through careful code analysis, and were fixed on the v5 branch and backported to v4.

Mocking the list classes with mockk works again (#945)

Since 4.8.185, mockk failed to mock ResourceList, ClassInfoList and the other list classes, with "class redefinition failed: attempted to add a method". These classes extend a package-private class, and releases since 4.8.185 were built with JDK 8, whose javac does not emit public bridge methods in the public subclass for add(T), add(int, T), remove(int) and set(int, T). The list classes now declare these methods themselves, so they are present whichever JDK builds the release.

Bug fixes: classpath elements and jarfiles

  • The context classloader could be moved behind the application classloader. The classloaders found in the environment were sorted by descending delegation depth, so that a classloader is searched before its ancestors. That also put any classloader with more ancestors ahead of an unrelated one with fewer -- the application classloader ahead of a context classloader with no parent, for example -- although the context classloader is meant to be tried first. Each classloader is now inserted just ahead of the first of its ancestors that is already listed, which keeps descendants ahead of ancestors and otherwise keeps the preference order.

  • Class-Path and Bundle-ClassPath manifest attributes are now read with their specified syntax. A Class-Path entry is a relative URL, so its percent encoding is now decoded, as the JVM's own classloader decodes it. Before, a jarfile written as my%20lib.jar was looked for under that literal name, so a jarfile with a space in its name could not be named at all. Bundle-ClassPath paths are now trimmed, unquoted and separated from their parameters, following the OSGi header syntax. Before, . , inner.jar named inner.jar, and a quoted path or one with a parameter named nothing that exists.

  • When a zipfile has two entries with the same name, the last one is now used, as the JDK does. ClassGraph kept the first, so a scan could report a different resource, and open a different nested jarfile, than the JVM would load.

  • META-INF/versions/09/ is no longer read as multi-release version 9. The JDK looks up versioned entries only under the plain decimal version number, so ClassGraph could report a class that the JVM never loads.

  • The file of a nested jarfile is now always the outermost jarfile. It was the outer jarfile if the nested jarfile was stored, but null or a temporary file if it was deflated. ScanResult#getClasspathFiles() lists the outer jarfile once, however many jarfiles are nested within it.

  • A zipfile with an Info-ZIP Unicode path extra field of a version other than 1 could not be read. java.util.zip.ZipFile opens such a file, since the JDK does not read that field. The field is now logged and ignored.

  • A large nested jar with a long name could not be opened. A nested jar too large to hold in RAM is written to a temporary file named after its zip entry, and a long entry name made File.createTempFile fail with "File name too long". The name is now cut to its last 64 characters.

  • A jarfile URL that redirected from http to https failed with "Got response code 301", since HttpURLConnection only follows a redirect that keeps the same scheme. Redirects are now followed, up to 20 times. A redirect from https to http, or to a scheme that has not been enabled, is refused.

  • A SecurityManager that refused to let ClassGraph read a file's attributes stopped the scan of the rest of that directory. Only that file is now skipped.

  • The Quarkus classloader handler failed the whole scan when a field it reads held a null or unexpected value. Such elements are now skipped.

  • normalizePath did not collapse // in a path that did not end with a separator, so a//b stayed a//b while a//b/ became a/b.

Bug fixes: memory, file handles and temporary files

  • A file is no longer memory-mapped when it could not be unmapped again. A SecurityManager that denied access to the buffer cleaner made new ClassGraph() throw "Cannot get buffer cleaner method". Now, below JDK 22, a file is only memory-mapped when the cleaner is available, since otherwise the mapping, and on Windows the file lock, would last until the buffer was garbage collected.

  • A canceled scanAsync future leaked its ScanResult. A result that arrived after the future was canceled was never handed to anyone, so nothing closed it. It is now closed. The call stack and context classloader are still read on the calling thread, but the jarfiles are now opened when the task runs, so a task that is canceled before it starts opens nothing.

  • Temporary files no longer use deleteOnExit(). Closing the scan already deletes every temporary file, so deleteOnExit() only made the JDK hold every temporary path until the JVM exited.

  • A module reader could be left open if it was returned to its pool at the same moment the pool was being force-closed.

  • Reading a stream of declared length allocated a buffer of that whole length up front, up to the maximum buffered jar size. The first buffer is now at most 16MB, and grows as data arrives. A related method doubled its buffer whenever a read returned zero bytes, even when the buffer was not full; no scan was affected, since the streams it is given never return zero.

  • A refused unmap of a buffer view was logged as "Could not unmap ByteBuffer: java.lang.reflect.InvocationTargetException". Such a view is now refused without a log entry, and any other failure is logged with its real cause.

Bug fixes: the class graph

  • ClassInfo#isAnonymousInnerClass() returned true for named local classes. It now agrees with Class#isAnonymousClass(). getFullyQualifiedDefiningMethodName() returned <clinit> for a class declared in an instance initializer or an instance field initializer, which javac compiles into the constructors; it now returns null for these, as Class#getEnclosingMethod() does.

  • A local record, enum or interface was reported as not static.

... (truncated)

Commits
  • 8f16afe [maven-release-plugin] prepare release classgraph-4.8.196
  • f0f3d2d Declare the element methods in the public list classes, so mockk can mock the...
  • a4d872d [maven-release-plugin] prepare for next development iteration
  • 495b196 [maven-release-plugin] prepare release classgraph-4.8.196
  • 4d08ea2 Keep a '$' after a '.' in a class reference as part of the nested class name
  • 67c7d33 Follow an http to https redirect when downloading a jarfile
  • b8d2225 Check in the LocalRecordTest classfile fixtures, which .gitignore excluded
  • 1eb2fb2 Make AnnotationParameterValue.equals and hashCode agree with compareTo for un...
  • 707fea6 Resolve type variables of an enclosing class, and tell a method's type variab...
  • 534d034 Report local records as static, and fix type annotations on local class const...
  • Additional commits viewable in compare view

Updates org.apache.maven:maven-plugin-api from 3.9.16 to 3.10.0

Release notes

Sourced from org.apache.maven:maven-plugin-api's releases.

3.10.0

🚀 New features and improvements

🐛 Bug Fixes

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Oct 2, 2026
@evanchooly

evanchooly commented Oct 5, 2026

Copy link
Copy Markdown
Member

@dependabot recreate

@dependabot
dependabot Bot force-pushed the dependabot/maven/2.5.x/maven-dependencies-08467d4bef branch from 72a549e to 5caa267 Compare October 5, 2026 03:00
@evanchooly

evanchooly commented Oct 8, 2026

Copy link
Copy Markdown
Member

@dependabot recreate

@dependabot
Bump the maven-dependencies group across 1 directory with 12 updates
565e3a6 
Bumps the maven-dependencies group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| org.slf4j:slf4j-api | `2.0.19` | `2.0.20` |
| org.slf4j:slf4j-simple | `2.0.19` | `2.0.20` |
| org.slf4j:slf4j-simple | `2.0.19` | `2.0.20` |
| [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.6.3` | `1.6.5` |
| org.apache.maven:maven-model | `3.9.16` | `3.10.0` |
| [org.apache.maven:maven-plugin-api](https://github.com/apache/maven) | `3.9.16` | `3.10.0` |
| org.apache.maven:maven-core | `3.9.16` | `3.10.0` |
| [org.mongodb:mongodb-driver-sync](https://github.com/mongodb/mongo-java-driver) | `5.11.1` | `5.13.0` |
| [org.mongodb:mongodb-driver-legacy](https://github.com/mongodb/mongo-java-driver) | `5.11.1` | `5.13.0` |
| [org.mongodb:mongodb-driver-legacy](https://github.com/mongodb/mongo-java-driver) | `5.11.1` | `5.13.0` |
| [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) | `2.22.2` | `2.22.3` |
| [com.fasterxml.jackson.dataformat:jackson-dataformat-yaml](https://github.com/FasterXML/jackson-dataformats-text) | `2.22.2` | `2.22.3` |
| [com.fasterxml.jackson.dataformat:jackson-dataformat-yaml](https://github.com/FasterXML/jackson-dataformats-text) | `2.22.2` | `2.22.3` |
| [io.github.classgraph:classgraph](https://github.com/classgraph/classgraph) | `4.8.195` | `4.8.196` |
| [org.apache.maven:maven-plugin-api](https://github.com/apache/maven) | `3.9.16` | `3.10.0` |
| org.apache.maven:maven-core | `3.9.16` | `3.10.0` |
| org.apache.maven:apache-maven | `3.9.16` | `3.10.0` |



Updates `org.slf4j:slf4j-api` from 2.0.19 to 2.0.20

Updates `org.slf4j:slf4j-simple` from 2.0.19 to 2.0.20

Updates `org.slf4j:slf4j-simple` from 2.0.19 to 2.0.20

Updates `ch.qos.logback:logback-classic` from 1.6.3 to 1.6.5
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.6.3...v_1.6.5)

Updates `org.apache.maven:maven-model` from 3.9.16 to 3.10.0

Updates `org.apache.maven:maven-plugin-api` from 3.9.16 to 3.10.0
- [Release notes](https://github.com/apache/maven/releases)
- [Commits](apache/maven@maven-3.9.16...maven-3.10.0)

Updates `org.apache.maven:maven-core` from 3.9.16 to 3.10.0

Updates `org.mongodb:mongodb-driver-sync` from 5.11.1 to 5.13.0
- [Release notes](https://github.com/mongodb/mongo-java-driver/releases)
- [Commits](mongodb/mongo-java-driver@r5.11.1...r5.13.0)

Updates `org.mongodb:mongodb-driver-legacy` from 5.11.1 to 5.13.0
- [Release notes](https://github.com/mongodb/mongo-java-driver/releases)
- [Commits](mongodb/mongo-java-driver@r5.11.1...r5.13.0)

Updates `org.mongodb:mongodb-driver-legacy` from 5.11.1 to 5.13.0
- [Release notes](https://github.com/mongodb/mongo-java-driver/releases)
- [Commits](mongodb/mongo-java-driver@r5.11.1...r5.13.0)

Updates `com.fasterxml.jackson.core:jackson-databind` from 2.22.2 to 2.22.3
- [Commits](FasterXML/jackson-databind@jackson-databind-2.22.2...jackson-databind-2.22.3)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` from 2.22.2 to 2.22.3
- [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.22.2...jackson-dataformats-text-2.22.3)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` from 2.22.2 to 2.22.3
- [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.22.2...jackson-dataformats-text-2.22.3)

Updates `io.github.classgraph:classgraph` from 4.8.195 to 4.8.196
- [Release notes](https://github.com/classgraph/classgraph/releases)
- [Commits](classgraph/classgraph@classgraph-4.8.195...classgraph-4.8.196)

Updates `org.apache.maven:maven-plugin-api` from 3.9.16 to 3.10.0
- [Release notes](https://github.com/apache/maven/releases)
- [Commits](apache/maven@maven-3.9.16...maven-3.10.0)

Updates `org.apache.maven:maven-core` from 3.9.16 to 3.10.0

Updates `org.apache.maven:apache-maven` from 3.9.16 to 3.10.0

---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.22.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml
  dependency-version: 2.22.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml
  dependency-version: 2.22.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: io.github.classgraph:classgraph
  dependency-version: 4.8.196
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.apache.maven:apache-maven
  dependency-version: 3.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.apache.maven:maven-core
  dependency-version: 3.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.apache.maven:maven-core
  dependency-version: 3.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.apache.maven:maven-model
  dependency-version: 3.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.apache.maven:maven-plugin-api
  dependency-version: 3.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.apache.maven:maven-plugin-api
  dependency-version: 3.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.mongodb:mongodb-driver-legacy
  dependency-version: 5.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.mongodb:mongodb-driver-legacy
  dependency-version: 5.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.mongodb:mongodb-driver-sync
  dependency-version: 5.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.slf4j:slf4j-api
  dependency-version: 2.0.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.slf4j:slf4j-simple
  dependency-version: 2.0.20
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.slf4j:slf4j-simple
  dependency-version: 2.0.20
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/maven/2.5.x/maven-dependencies-08467d4bef branch from 5caa267 to 565e3a6 Compare October 8, 2026 04:46
@evanchooly

evanchooly commented Oct 8, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Oct 8, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR is already up-to-date with 2.5.x! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@evanchooly

evanchooly commented Oct 10, 2026

Copy link
Copy Markdown
Member

@dependabot recreate

@dependabot @github

dependabot Bot commented on behalf of github Oct 10, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 10, 2026
@dependabot
dependabot Bot deleted the dependabot/maven/2.5.x/maven-dependencies-08467d4bef branch October 10, 2026 21:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@evanchooly