[dependabot]

Bumps the main group with 29 updates in the / directory:

Package	From	To
org.springframework.boot:spring-boot-starter-parent	3.5.6	4.1.2
io.rest-assured:rest-assured-bom	5.0.0	6.3.0
org.jacoco:jacoco-maven-plugin	0.8.14	0.8.16
com.bucket4j:bucket4j_jdk17-core	8.15.0	8.21.0
com.puppycrawl.tools:checkstyle	10.21.2	14.3.0
org.hibernate.validator:hibernate-validator	8.0.2.Final	9.1.5.Final
me.paulschwarz:spring-dotenv	4.0.0	5.1.0
io.rest-assured:rest-assured	5.0.0	6.3.0
com.google.guava:guava	33.5.0-jre	33.7.2-jre
org.flywaydb:flyway-core	11.1.0	13.12.0
org.flywaydb:flyway-database-postgresql	10.4.1	13.12.0
org.springdoc:springdoc-openapi-starter-webmvc-ui	2.8.2	3.2.0
com.microsoft.playwright:playwright	1.63.0	1.64.0
net.dv8tion:JDA	5.3.0	6.7.0
org.eclipse.angus:jakarta.mail	2.0.3	2.0.5
com.auth0:java-jwt	4.5.0	4.6.2
org.projectlombok:lombok	1.18.42	1.18.48
org.jsoup:jsoup	1.23.1	1.23.2
redis.clients:jedis	7.0.0	8.0.2
io.github.resilience4j:resilience4j-spring-boot3	2.3.0	2.4.0
com.github.loki4j:loki-logback-appender	1.5.2	2.1.0
io.grpc:grpc-netty-shaded	1.84.1	1.85.1
io.grpc:grpc-protobuf	1.84.1	1.85.1
io.grpc:grpc-stub	1.84.1	1.85.1
org.codehaus.mojo:build-helper-maven-plugin	3.6.1	3.6.2
com.diffplug.spotless:spotless-maven-plugin	3.1.0	3.10.4
org.apache.maven.plugins:maven-compiler-plugin	3.14.1	3.16.0
org.springframework.boot:spring-boot-maven-plugin	3.5.6	4.1.2
org.flywaydb:flyway-maven-plugin	11.1.0	13.12.0

Updates org.springframework.boot:spring-boot-starter-parent from 3.5.6 to 4.1.2

Release notes

Sourced from org.springframework.boot:spring-boot-starter-parent's releases.

v4.1.2

⭐ New Features

• Add TWENTY_SEVEN to JavaVersion enum #51426

🐞 Bug Fixes

• OriginTrackedResource does not implement equals correctly #52267
• OriginTrackedPropertiesLoader drops properties whose name starts with # or ! #52265
• JWTs are rejected when issuer-uri is empty and jwk-set-uri is set #52260
• Package manifest attributes are missing for nested jars without directory entries #52258
• Logback ColorConverter unnecessarily parses its options for every log event #52228
• Empty system property in TestPropertyValues is cleared instead of being restored to its empty value #52208
• Graceful shutdown of Tomcat or Jetty may call back with REQUESTS_ACTIVE when stop is called immediately after shutDownGracefully on an idle server #52197
• NettyWebServer stop may hang when called immediately after shutDownGracefully #52196
• gRPC client 'grpc' load balancing fails to bind with a NullPointerException when no child policies are configured #52193
• Prevent gRPC client properties from overriding user customizations #52175
• MongoDB fails to connect when credentials contain a space #52168
• Authentication fails when password configured in spring.elasticsearch.uris contains a colon #52166
• Logging can be lost when a context is paused by the test context framework #52088
• Docker Compose support for MongoDB fails to connect when credentials contain a character that requires URL encoding #52084
• Jersey does not use the endpoint ObjectMapper when Actuator is running on a separate port #51982
• Fractions of a second are handled incorrectly when configuring gRPC service config durations #51957
• Configuration property descriptions may be lost when building incrementally with Gradle #51925
• BasicJsonParser mishandles escaped characters in nested lists and maps #51908
• Zero week value conversion fails with 'intValue cannot be extracted from WEEKS' exception #51894
• App fails to start when using DevTools and manually configuring JDBC or R2DBC without spring-boot-jdbc or spring-boot-r2dbc #51890
• Docker Compose support incorrectly recognizes MARIADB_ALLOW_EMPTY_PASSWORD instead of MARIADB_ALLOW_EMPTY_ROOT_PASSWORD #51888
• Auto-configured Kotlinx Serialization JSON codec customization is not applied #51877
• NullPointerException can be thrown when using uber jars due to a race condition in NestedJarFileResources #51745
• DevTools does not detect a reactive web environment #51730
• spring.http.clients.cookie-handling has no effect when using a reactive client backed by an HttpComponents connector #51724
• Connection fails when rabbitmq Docker Compose service is configured to use SSL #51667
• SBOM-related manifest attributes are missing from Maven-packaged wars #51651
• When server.reactive.session.cookie.same-site is not set, session cookies have no SameSite attribute #51639
• OAuth2 resource server ignores authorities-claim-delimiter when set on its own #51630
• developmentOnly and testAndDevelopmentOnly configurations do not specify any attributes causing potential resolution problems #51623
• In a reactive web application, Cloud Foundry security integration returns a 500 rather than a 503 when the cloud controller URL is unavailable #51614
• Layer temp file is not deleted when layer creation fails #51581
• Docker Compose integration for RabbitMQ skips credential fallbacks when an environment variable has no value #51578
• Some assertion messages name the wrong parameter #51574
• OAuth2ResourceServerProperties.Jwt has a setter that does not match its getter #51562
• jarmode tools commands print stacktrace instead of an error message #51547
• Docker Compose ProcessRunner can hang or leave orphan processes #51538
• NestedByteChannel.read(ByteBuffer) incorrectly returns 0 when buffer could not be filled #51520
• Customizer null checks in HTTP client builders assert the wrong attribute #51513
• SSL host config customizations may be lost during Tomcat initialization #51511
• SQL Server Docker Compose integration may duplicate the JDBC URL's encrypt parameter #51481
• WritableJson.toByteArray() may corrupt supplementary characters #51464
• SSL host config customizations are lost when reloading SSL bundles #51457

... (truncated)

Commits

• 634e6fd Release 4.1.2
• 6b43cf1 Upgrade to Spring WS 5.0.3
• a73dfad Upgrade to Spring Security 7.1.2
• 0485f1e Upgrade to Spring RESTDocs 4.0.2
• de2c11a Upgrade to Spring Pulsar 2.0.8
• 8d0359e Upgrade to Spring LDAP 4.1.2
• f22c6e6 Upgrade to Spring Kafka 4.1.2
• ed55709 Upgrade to Spring Integration 7.1.2
• 2e88a38 Upgrade to Spring HATEOAS 3.1.3
• 0d69ce5 Upgrade to Spring gRPC 1.1.2
• Additional commits viewable in compare view

Updates io.rest-assured:rest-assured-bom from 5.0.0 to 6.3.0

Changelog

Sourced from io.rest-assured:rest-assured-bom's changelog.

Changelog 6.3.0 (2026-10-23)

• Fix form authentication sending the request for the CSRF token page, the request that follows a 302 of the login page and the login request with the static RestAssured settings only, so a proxy, an SSL setting such as relaxedHTTPSValidation() or a keystore, or a config(..) set on the request (or in a request specification) wasn't used for them. They are now sent with the config and the proxy of the request, like the request for the login page already was (issue #1965) (#2010) (thanks to Obrams for PR)
• Fix form authentication sending the cookies set by the login page response to whatever host the 302 of a non-GET login page request pointed to. Like a browser, it only sends them when the redirect goes to the same host. The Location header is now also resolved against the URL of the login page, so a relative Location is followed on the host of the login page (issue #1965) (#2010) (thanks to Obrams for PR)
• Added SSLConfig.sslContext(SSLContext) and hostnameVerifier(HostnameVerifier), with getSSLContext() and getHostnameVerifier(), the same on CertificateAuthSettings, and the matching properties on CertAuthScheme. They take the JDK's javax.net.ssl types and replace sslSocketFactory(..), x509HostnameVerifier(..) and their getters, which take Apache HttpClient 4 types and are now deprecated, since HttpClient 4 types leave the API in REST Assured 7.0.0. Host names are still verified strictly by default when you set an SSLContext
• Added HttpClientConfig.connectTimeout(Duration), readTimeout(Duration), connectionRequestTimeout(Duration), keepResponseCookies(boolean), cookieDatePatterns(String...) and expectContinue(boolean), with getters, as replacements for the HttpClient 4 parameters http.connection.timeout, http.socket.timeout, http.conn-manager.timeout, http.protocol.cookie-policy, http.protocol.cookie-datepatterns and http.protocol.expect-continue. The parameter methods (the HttpClientConfig(Map) constructor, params(), setParam, withParams, setParams and addParams) are deprecated and will be removed in REST Assured 8.0.0
• Added RedirectConfig.followRedirectsForAllMethods(boolean) and followsRedirectsForAllMethods(). It follows redirects of POST, PUT, DELETE and other requests too. Use it instead of installing HttpClient 4's LaxRedirectStrategy through an HttpClientFactory
• Added REST Assured's own MultipartMode enum with HttpClientConfig.multipartMode(MultipartMode) and multipartMode(), replacing httpMultipartMode(HttpMultipartMode) and httpMultipartMode(), which are now deprecated
• Added CookieFilter.getCookies(), which returns the stored cookies as REST Assured Cookies, and CookieFilter.addCookie(Cookie), replacing getCookieStore(), which is now deprecated together with extractEffectiveUriFromContext(..)
• Deprecated HttpClientConfig.HttpClientFactory, httpClientFactory(..) and httpClientInstance(), and QueryableRequestSpecification.getHttpClient(), since HttpClient 4 types leave the API in REST Assured 7.0.0. REST Assured 7.0.0 adds customizeClient(..) to customize the HTTP client
• Added AuthenticationContext, AuthenticationScheme.authenticate(AuthenticationContext) and ContextAuthenticationScheme, so that a custom authentication scheme can set headers, answer Basic, Digest and NTLM challenges, sign with OAuth and use a client certificate without depending on HttpClient 4. Implement ContextAuthenticationScheme instead of AuthenticationScheme.authenticate(HTTPBuilder), which is now deprecated, since HTTPBuilder exposes HttpClient 4 and is removed in REST Assured 7.0.0
• Added the object mapper factory interfaces and their defaults (GsonObjectMapperFactory, Jackson2ObjectMapperFactory, Jackson3ObjectMapperFactory, JohnzonObjectMapperFactory, JsonbObjectMapperFactory, JAXBObjectMapperFactory and JakartaEEObjectMapperFactory, and DefaultGsonObjectMapperFactory and so on) to rest-assured-common in the package io.restassured.common.mapper.factory, and NumberReturnType to io.restassured.common.config. ObjectMapperConfig, JsonPathConfig, XmlPathConfig, JsonConfig, JsonPath.using(..) and XmlPath.using(..) accept them, and JsonConfig.DEFAULT_NUMBER_LENGTH_LIMIT is added. The old types in io.restassured.path.json.mapper.factory, io.restassured.path.xml.mapper.factory and JsonPathConfig.NumberReturnType are deprecated. The old factory types extend the new ones, so existing code keeps working. They're removed in REST Assured 8.0.0. Passing null to numberReturnType(..), new JsonConfig(..) or new JsonPathConfig(..) is now ambiguous and needs a cast
• Non-backward compatible change: in Groovy 4 (but not Groovy 5), passing a closure directly to a factory setter such as ObjectMapperConfig.jackson2ObjectMapperFactory { type, charset -> .. } now fails with "Ambiguous method overloading", since the setters take both the old and the new factory type. Cast the closure to the factory type, for example jackson2ObjectMapperFactory({ type, charset -> .. } as Jackson2ObjectMapperFactory)
• Deprecated the Jackson 1 object mapper factory setters (ObjectMapperConfig.jackson1ObjectMapperFactory(..), JsonPathConfig.jackson1ObjectMapperFactory(..) and JsonPath.using(Jackson1ObjectMapperFactory)), since Jackson 1 support is removed in REST Assured 7.0.0
• rest-assured-common now has optional dependencies on the JSON and XML mappers its factories use (Jackson 2 and 3, Gson, Johnzon, Yasson, JSON-B, JAXB and Jakarta XML Binding). They are optional, so nothing new ends up on your classpath
• REST Assured, RestAssuredMockMvc and RestAssuredWebTestClient now fail with an IllegalStateException that explains how to align the versions when an older rest-assured-common is on the classpath (for example one pinned by the Spring Boot 3 dependency management), instead of a NoClassDefFoundError
• Published json-path-gpath and xml-path-gpath, the REST Assured 7.0.0 names of json-path and xml-path. In 6.x they are relocation poms that resolve to json-path and xml-path at the same version, so you can switch your build to the new names before upgrading. They are also in rest-assured-bom
• Added the rest-assured-openrewrite module with the OpenRewrite recipe io.restassured.MigrateRestAssured6Deprecations, which moves Java code from the APIs deprecated in this version to their replacements: the object mapper factories and NumberReturnType in rest-assured-common, hostnameVerifier(..), multipartMode(..), and the HttpClientConfig settings that replace setParam(..) for the timeouts, the "ignoreCookies" and "default" cookie policies and expect-continue. It also marks subclasses of REST Assured's authentication schemes that only override authenticate(HTTPBuilder), which REST Assured 7.0.0 no longer calls. Run it with the rewrite-maven-plugin or the OpenRewrite Gradle plugin, with io.rest-assured:rest-assured-openrewrite as recipe dependency

Changelog 6.2.0 (2026-10-16)

• Fix spring-web-test-client-kotlin-extensions bringing jakarta.servlet-api, jakarta.jakartaee-web-api and about 20 other Jakarta EE API jars to your classpath at runtime. They were declared with a scope that Maven doesn't know (optional), which it treated as a compile dependency, and are now provided, like in spring-mock-mvc-kotlin-extensions (#1992)
• Upgraded scala-library in scala-support from 2.13.0 to 2.13.18, which fixes CVE-2022-36944, scala3-library_3 in scala-extensions from 3.3.3 to 3.3.8, Jackson 2 (jackson-databind, jackson-core and jackson-module-kotlin) from 2.17.1 to 2.22.3, Jackson 3 (tools.jackson) from 3.0.2 to 3.2.3, Gson from 2.9.0 to 2.14.0, Guava in json-schema-validator from 33.2.1-jre to 33.7.2-jre, commons-lang3 from 3.19.0 to 3.21.0, Yasson from 3.0.4 to 3.0.5 (now with its new group id org.eclipse.yasson, since org.eclipse:yasson 3.0.5 only relocates to it), Parsson from 1.1.7 to 1.1.9, Johnzon (johnzon-mapper) from 2.0.2 to 2.2.0 and jaxb-impl from 2.3.4 to 2.3.9 (#1986)
• Non-backward compatible change: sending a request directly from a request specification created by RequestSpecBuilder.build() (for example spec.when().get("/x") or spec.post()) now fails with an IllegalStateException that tells you to use given().spec(spec) or given(spec), instead of a NullPointerException. then(), expect() and response() on such a specification also throw this exception, where they returned null before. The specification is meant to be added to a request, and isn't changed by the failed call. The javadoc of RequestSpecBuilder.build() now explains this (part of #1863)
• Non-backward compatible change: sending a request directly from a response specification created by ResponseSpecBuilder.build() (for example responseSpec.when().get("/x")) now fails with an IllegalStateException that tells you to use given().spec(requestSpec).expect().spec(responseSpec), then().spec(responseSpec) or given(requestSpec, responseSpec), instead of a NullPointerException. when(), given(), with() and request() on such a specification also throw this exception, where they returned null before. Using the specification in a request, or as RestAssured.responseSpecification, works as before. The javadoc of ResponseSpecBuilder.build() now explains this (related to #1863)
• JsonPath and JSON body assertions can now read a key that contains a colon with the dot notation, such as jsonPath.getInt("message.ErrorCode:") or body("message.ErrorCode:", equalTo(0)), which failed with "Invalid JSON expression" before. A colon in a ternary (a ? b : c) or Elvis (a ?: b) expression, in a closure or in a quoted string is left as is (fixes #1766)
• Fix request logging of a multipart File whose mime type isn't text, such as application/octet-stream (the default) or image/png, which since 5.5.0 printed the whole file content to the log. Such a part is now logged as the path of the file, as before 5.5.0. The content of a file with a text mime type (text/*, JSON, XML or HTML) is still logged, and is now read with the charset of the part (or of its mime type), or UTF-8 if none is given, instead of the platform default charset. A text file that can't be read is logged as its path, so sending the request reports the error (fixes #1819)
• Upgraded Groovy from 5.0.3 to 5.0.8 and Apache HttpClient (httpclient and httpmime) from 4.5.13 to 4.5.14 (#1971)
• Fix races in the static configuration of REST Assured when tests run in parallel. RestAssured.filters(..), replaceFiltersWith(..), registerParser(..) and unregisterParser(..), and RestAssuredMockMvc.resultHandlers(..) and postProcessors(..), could make a given() in another thread fail with a ConcurrentModificationException or copy a default filter list with missing or null filters. given() (and when(), with(), expect() and the static request methods) no longer changes any shared state. The public static fields of RestAssured, RestAssuredMockMvc and RestAssuredWebTestClient, and JsonPath.config, XmlPath.config and JsonSchemaValidator.settings, are now volatile, so a value set before the tests start is seen by every thread. The javadoc of RestAssured, RestAssuredMockMvc and RestAssuredWebTestClient now explains how to use the static configuration when tests run in parallel (fixes #1967)
• Non-backward compatible change: given() no longer writes the session id into the RestAssured.config field or RestAssured.defaultParser into the global parser registry. While RestAssured.sessionId is set, RestAssured.config() returns the config with the session id, but the RestAssured.config field doesn't contain it, also not after a request, so given().config(RestAssured.config) no longer sends the static session id (use RestAssured.config() instead). Setting RestAssured.sessionId or RestAssured.defaultParser back to null now takes effect without RestAssured.reset(). A list returned by RestAssured.filters() before replaceFiltersWith(..) keeps showing the old filters (fixes #1967)
• Fix HttpClientConfig.reuseHttpClientInstance() creating more than one HttpClient when several threads send their first request at the same time, and make the default Yasson (JSON-B) object mapper share one Jsonb instance between threads in the same way. Note that the reused HttpClient is reconfigured by every request, so it still must not be used by requests that run at the same time (fixes #1967)
• Non-backward compatible change: auth().certificate(certURL, password) and RestAssured.certificate(certURL, password), with or without CertificateAuthSettings, now use the file at certURL as key store, as documented, so the client certificate in it is sent to servers that ask for one (mutual TLS). Before, the file was only used as trust store, which it still is. This means that a private key in the file is now offered to any server that asks for a client certificate, also where it's optional (such as nginx with ssl_verify_client optional), which may then reject a certificate it doesn't trust, and that the private key must have the password of the file. To avoid this, or to use the JVM's default trust store, use RestAssured.certificate(trustStorePath, trustStorePassword, keyStorePath, keyStorePassword, CertificateAuthSettings) (as RestAssured.authentication or with RequestSpecBuilder.setAuth(..)), where an empty path means no key store or the default trust store (fixes #1158, related to #1325)
• Fix a root path with more than one placeholder left for a later withArgs(..), such as rootPath("a.%s.%s.%s", withArgs("x")).body(withArgs("y", "z"), ..), which failed with a MissingFormatArgumentException. All placeholders without an argument, including ones such as %d, are now kept for later arguments. body(withArgs(..), matcher) also no longer adds a trailing dot to the path, which showed up in failure messages such as "JSON path a.d.e. doesn't match." (fixes #1949)
• The rest-assured module is now written entirely in Java and no longer depends on Groovy (org.apache.groovy:groovy and groovy-xml) directly. Groovy still comes transitively through json-path and xml-path, which use it for GPath, so the dependencies on the classpath are unchanged. The rest-assured and rest-assured-common OSGi bundles no longer import the groovy packages, and rest-assured-common no longer depends on Groovy at all (#1917, #1932)
• Non-backward compatible change: a Groovy closure used as request body now fails with an IllegalArgumentException. This could only happen when a custom ObjectMapper returned a Closure from serialize(..), in which case the closure was run as a builder (a JsonBuilder for JSON, a StreamingMarkupBuilder for XML and HTML, or with a Writer or OutputStream for text and binary content). Return a String, byte[] or InputStream from the ObjectMapper instead (#1914)
• Non-backward compatible change: a request body that isn't a String (for example a byte[], InputStream or File) sent with content-type application/x-www-form-urlencoded now fails with an IllegalArgumentException explaining that a form url-encoded body must be a String, instead of a groovy.lang.MissingMethodException (#1914)
• Non-backward compatible change: a groovy.lang.Writable request body sent with a text content-type is now sent as its toString() instead of what its writeTo(..) method writes. Groovy's own Writables (such as JsonBuilder and GString) produce the same output either way. A Groovy WritableFile (file.asWritable()) is now sent like any other File, read with the charset of the request content-type (#1914)
• Fix the failure message of a body path assertion when the response body can't be parsed into something the path can navigate (for example a JSON body that is just a string), which showed the literal text $contentParser instead of the response body (#1922)
• Fix form authentication failing with "IllegalArgumentException: parameterValues cannot be null" when an additional input field given to FormAuthConfig.withAdditionalField(s)(..) is an input tag without a value attribute on the login page. The field is now sent as a form parameter without a value (#1921)
• Fix matchesDtd(URL) in RestAssuredMatchers, RestAssuredMockMvcMatchers and RestAssuredWebTestClientMatchers, which always failed with a GroovyCastException ("Cannot cast object '' with class 'java.lang.String' to class 'java.io.InputStream'") when the response was validated. The DTD is now read from the URL, every time the matcher is used (#1920)
• Non-backward compatible change: matchesXsdInClasspath(..) and matchesDtdInClasspath(..) (in RestAssuredMatchers, RestAssuredMockMvcMatchers and RestAssuredWebTestClientMatchers) now fail with an IllegalArgumentException saying that the XSD or DTD couldn't be found in classpath, instead of a groovy.lang.GroovyRuntimeException ("Ambiguous method overloading"). The XSD and DTD matchers now also fail with an IllegalArgumentException when asked to match something that isn't a String, for example body("some.path", matchesXsd(..)) where the path returns an element that has child elements, instead of a Groovy exception (#1920)
• Non-backward compatible change: io.restassured.assertion.HeaderMatcher, DetailedCookieAssertion, ResponseTimeMatcher and StreamVerifier are now written in Java and no longer implement groovy.lang.GroovyObject. HeaderMatcher.validateHeader(..), DetailedCookieAssertion.validateCookies(..) and ResponseTimeMatcher.validate(..) now return Map<String, Object> instead of Object, HeaderMatcher.validateHeader(..) takes a Response, and HeaderMatcher.getMatcher() and get/setResponseAwareMatcher(..) are now generically typed (Matcher<?> and ResponseAwareMatcher) (#1919)
• A header expectation whose header name is neither a String nor a GString (for example an Integer key in the map passed to headers(Map)) now checks the header named by the key's string form instead of failing with a groovy.lang.MissingMethodException (#1919)
• Non-backward compatible change: io.restassured.internal.http.HTTPBuilder, which a custom AuthenticationScheme receives in authenticate(..), no longer uses Groovy closures. Its get(..) methods, the request(..) overloads that took a Closure, getHandler() and the post(..) and patch(..) overloads without a response handler are removed. post(..), patch(..) and request(..) now take an HttpResponseHandler or a RequestConfigurer, and response handlers always take two arguments (the response and its parsed content) (#1923)
• A parameter name that is neither a String nor a GString (for example an Integer key in the map passed to params(Map), queryParams(Map), formParams(Map) or pathParams(Map)) is now used in its string form, so 1 becomes "1", instead of failing with a groovy.lang.MissingMethodException (#1927)
• Non-backward compatible change: io.restassured.internal.RestAssuredResponseOptionsGroovyImpl is removed and its logic now lives in RestAssuredResponseOptionsImpl, so getGroovyResponse(), setGroovyResponse(..) and the protected groovyResponse field of RestAssuredResponseOptionsImpl are gone. This affects code that calls these methods or subclasses the internal response classes. A subclass that overrides a method such as asString() now also sees that override used by path(..), jsonPath(), as(..) and the other methods that read the body (#1926)
• Fix asByteArray() on a response with body expectations whose body was replaced by an InputStream (for example by a filter using ResponseBuilder.clone(..).setBody(inputStream)), which failed with a groovy.lang.MissingMethodException (#1926)
• Non-backward compatible change: the authentication schemes in io.restassured.authentication (BasicAuthScheme, CertAuthScheme, ExplicitNoAuthScheme, FormAuthScheme, NTLMAuthScheme, NoAuthScheme, OAuth2Scheme, OAuthScheme, PreemptiveBasicAuthScheme and PreemptiveOAuth2HeaderScheme), and the AuthenticationScheme interface are now written in Java, and the classes no longer implement groovy.lang.GroovyObject. Their constructors, getters and setters are unchanged. A custom AuthenticationScheme written in Java can now get the authentication configuration from HTTPBuilder.getAuth() (#1925)
• Non-backward compatible change: io.restassured.internal.matcher.xml.XmlXsdMatcher (the return type of RestAssuredMatchers.matchesXsd(..)) and XmlDtdMatcher are now written in Java and no longer implement groovy.lang.GroovyObject (#1920)
• A CertAuthScheme whose key store or trust store path (setPathToKeyStore(..) or setPathToTrustStore(..)) is neither a String nor a java.io.File now fails with an IllegalArgumentException instead of a groovy.lang.MissingMethodException (#1925)

... (truncated)

Commits

• b2fa63a [maven-release-plugin] prepare release rest-assured-6.3.0
• 9bee82b [ci skip] Preparing changelog for release
• 6511a84 [ci skip] Updated changelog to reflect the latest changes
• d1266d6 Send the extra requests of form authentication with the config and proxy of t...
• 0639bb3 Stop PathParamITest from calling google.se (#1995)
• 5de3595 Stop SSLITest from calling duckduckgo.com (#2009)
• 9078ee0 Fix issues found in the review of the 6.3.0 changes (#2008)
• 91576d5 Compile with maven.compiler.release=17 and run CI on JDK 17, 21 and 25 (#2007)
• 6cc8d43 Add rest-assured-openrewrite with the MigrateRestAssured6Deprecations recipe ...
• d35f1ca Publish json-path-gpath and xml-path-gpath as relocation poms (#2005)
• Additional commits viewable in compare view

Updates org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.16

Release notes

Sourced from org.jacoco:jacoco-maven-plugin's releases.

0.8.16

New Features

• JaCoCo now officially supports Java 27 (GitHub #2287).
• Experimental support for Java 28 class files (GitHub #2170, #2189).
• To instrument classes loaded by the platform class loader, introduced in JDK 9 by JEP 261, the agent option inclbootstrapclasses=true is required (GitHub #2155).

Non-functional Changes

• JaCoCo now depends on ASM 9.11.1 (GitHub #2299, #2304).

0.8.15

New Features

• JaCoCo now officially supports Java 26 (GitHub #2076).
• Experimental support for Java 27 class files (GitHub #2004).
• Compatibility methods generated by Kotlin compiler for functions defined in interfaces are filtered out during generation of report (GitHub #1905).
• Compatibility methods generated by Kotlin compiler for exposed boxed inline value classes (JvmExposeBoxed annotation) are filtered out during generation of report (GitHub #1944).
• Methods generated by the Kotlin compiler for functions with JvmStatic annotation are filtered out during generation of report (GitHub #2097).
• Improved filtering of bytecode generated by Kotlin compiler for when expressions and statements with kotlin.String subject where first branch condition contains string with largest hash (GitHub #2098).
• Part of bytecode that javac versions from 24 to 26 generate for switch statements and expressions with selector expression of type java.lang.String inside lambdas is filtered out during generation of report (GitHub #2023).
• Improved performance of Kotlin files analysis by parsing SMAPs only once per class (GitHub #2114).
• For better performance agent output methods tcpclient and tcpserver use BufferedOutputStream to write execution data to socket. Maven plugin, Ant tasks, CLI, API usage examples, and ExecDumpClient API use BufferedInputStream to read execution data from socket. Third-party integrations should do the same to benefit from this change in agent (GitHub #2089).

Fixed bugs

• Fixed processing of Kotlin SMAP in synthetic classes (GitHub #1985).
• Multiple JaCoCo runtimes within one JVM writing to the same output file should not cause data corruption when running on JDK versions from 6 to 10 affected by JDK-8166253 (GitHub #2065, #2074).
• For better performance agent writes to output file via BufferedOutputStream, this fixes regression introduced in version 0.6.2 (GitHub #2073).
• Fixed NullPointerException when JaCoCo agent is loaded by non system class loader, for example when loaded by JBoss Modules (GitHub #1651).

Non-functional Changes

• JaCoCo now depends on ASM 9.10.1 (GitHub #2134).

Commits

• 466838a Prepare release 0.8.16
• 64d0ef7 Upgrade ASM to 9.11.1 (#2304)
• fdaaab7 Upgrade ASM to 9.11 (#2299)
• d2571ae Upgrade Kotlin to 2.4.21 (#2302)
• 2f76394 Improve Renovate commit messages and PR titles (#2301)
• e9f2936 Use Ubuntu 26.04 (#2291)
• 4ffe9f0 Upgrade actions/upload-artifact to 7.0.2 (#2295)
• aaede90 Upgrade Maven to 3.10.0 (#2292)
• f638499 Enable comment-based updates in pom.xml and html files (#2294)
• 2e115bb Happy birthday Java 27! (#2287)
• Additional commits viewable in compare view

Updates com.bucket4j:bucket4j_jdk17-core from 8.15.0 to 8.21.0

Release notes

Sourced from com.bucket4j:bucket4j_jdk17-core's releases.

8.21.0

The features in release scope are following:

• #580 compare-and-swap retry mechanism
• #588 Support for Redis Sentinel via Lettuce
• #615 Gemfire/Geode support
• #617 bucket4j-bom module
• #622 Memcached support with CAS-based style
• #623 Support for fresh Coherence versions
• #625 Migrate serialization from ByteArrayOutputStream/ByteArrayInputStream to ByteBuffer
• #633 Support for Infinispan 16.x via a dedicated module
• #629 Apache Ignite 3 support
• #593 Apache Cassandra integration
• #634 Skip unnecessary token recalculation in bucket reset()

The bugfixes in release scope are following:

• #595 Disable stack trace generation in BucketExecutionException
• #606 Fix MySQL gap lock deadlocks
• Cassandra Integration by @​sahu-iisc in bucket4j/bucket4j#593

New Contributors

• @​Vishwajit-29 made their first contribution in bucket4j/bucket4j#628
• @​sahu-iisc made their first contribution in bucket4j/bucket4j#634

Full Changelog: bucket4j/bucket4j@8.20.0...8.21.0

8.20.0

What's Changed

• docs: add Compare&Swap implementation details for Redis by @​sunghyun1999 in bucket4j/bucket4j#597
• Bump org.postgresql:postgresql from 42.7.11 to 42.7.12 in /backward-compatibility-tests/common by @​dependabot[bot] in bucket4j/bucket4j#604
• Bump org.mariadb.jdbc:mariadb-java-client from 3.3.2 to 3.3.5 in /bucket4j-mariadb by @​dependabot[bot] in bucket4j/bucket4j#609
• perf: disable stack trace generation in BucketExecutionException and … by @​Palak24Ol in bucket4j/bucket4j#595
• bucket4j (lettuce) support for redis with sentinel by @​Rithra in bucket4j/bucket4j#588
• Bump com.fasterxml.jackson.core:jackson-databind from 2.13.4.2 to 2.18.9 in /bucket4j-parent by @​dependabot[bot] in bucket4j/bucket4j#611
• test: verify Valkey compatibility for Lettuce and Glide clients (#520) by @​thesahibnanda-max in bucket4j/bucket4j#608
• upgrade testcontainers to be compatible with OrbStack on Macos by @​vladimir-bukhtoyarov in bucket4j/bucket4j#612
• Fix examples compilation by @​vladimir-bukhtoyarov in bucket4j/bucket4j#613
• Fix build for macos by @​vladimir-bukhtoyarov in bucket4j/bucket4j#614
• Fix MySQL gap lock deadlocks by @​jumdo12 in bucket4j/bucket4j#606
• #468 Gemfire/Geode support by @​vladimir-bukhtoyarov in bucket4j/bucket4j#615

New Contributors

• @​sunghyun1999 made their first contribution in bucket4j/bucket4j#597
• @​Palak24Ol made their first contribution in bucket4j/bucket4j#595
• @​thesahibnanda-max made their first contribution in bucket4j/bucket4j#608
• @​jumdo12 made their first contribution in bucket4j/bucket4j#606

Full Changelog: bucket4j/bucket4j@8.19.0...8.20.0

8.19.0

What's Changed

... (truncated)

Commits

• a22b062 prepare 8.21.0 artifacts
• 0d89ef9 Cassandra Integration (#593)
• 5839b63 Ignite 3 (#629)
• dcefbcf #620 Fix build on GitHub actions and update actions configs (#637)
• 505c070 #620 fix snapshot deploy 409 conflict by cascading versions:set to all module...
• 5ac5230 Refractor bucketstate reset (#634)
• 5467db4 Bump com.fasterxml.jackson.core:jackson-databind in /bucket4j-parent (#635)
• 4473268 #632 fix InfinispanHotrodTest extension jar build when bucket4j-core resolves...
• 800458f #632 add support for Infinispan 16.x via a dedicated module (#633)
• 8f6e185 check compatibility with latest Ignite 2.x
• Additional commits viewable in compare view

Updates com.puppycrawl.tools:checkstyle from 10.21.2 to 14.3.0

Release notes

Sourced from com.puppycrawl.tools:checkstyle's releases.

checkstyle-14.3.0

Checkstyle 14.3.0 - https://checkstyle.org/releasenotes.html#Release_14.3.0

New:

#14120 - Make Checkstyle an java module with module-info.java.

checkstyle-14.2.0

Checkstyle 14.2.0 - https://checkstyle.org/releasenotes.html#Release_14.2.0

New:

#19513 - ModifiedOrder: New property modifierOrder. #17723 - WhitespaceAfter: new token SINGLE_LINE_COMMENT to catch missing whitespace checks around // comments. #8312 - NoWhitespaceAfter: Allow for use of DO_WHILE, LITERAL_CATCH, LITERAL_FOR, LITERAL_IF, and LITERAL_WHILE. #17172 - AnnotationLocation new token MODULE_DEF. Google-style: incomplete coverage on annotation rules for modules. #14986 - New Check UnnecessaryPermitsClause. #7541 - new Check: GoolgeRightCurly. #19949 - New check: JavadocSeeTagOrder. #20639 - new Check: OpenjdkMethodThrowsAlignment.

Bug fixes:

#17663 - Indentation: missing violations for '->' and ',' in return statement continuation. #20541 - False Positive: Lambda is incorrectly flaged by OperatorWrap. #21739 - UnusedLocalVariable: false positive on unnamed variable _ inside anonymous class. #21613 - False negative: UnusedTryResourceShouldBeUnnamed treats same-named identifiers in catch/finally blocks as resource usage. #21695 - openjdk style: use custon modifierOrder at RedundantModifier. #21689 - Add GoogleRightCurly to google_checks.xml instead of RightCurly. #10924 - All checks that use AbstractCheck#getLine() should check code points instead of characters for spacing. #21139 - Performance: Avoid duplicate regex match in SuppressFilterElement.isFileMatch. #21528 - Add checks for Sun Style [4.2 - Wrapping Lines]. #21578 - False Negative: LambdaParameterName silently passes lambdas in switch rule. #21579 - False Negative: NeedBraces silently passes lambdas in switch rule. #5895 - CLI XML output file: file stops dead when an execption occurs. #11410 - False Negative: LeftCurlyCheck. #21583 - Update Documentation Comments Style Guide: add JavadocSeeTagOrder. #21609 - NPE in RightCurlyCheck. #19724 - google_checks.xml: JavadocMethod accessModifiers should include protected to match MissingJavadocMethod scope. #20963 - False negative in LeftCurly for types with option=eol. #21547 - add OpenjdkMethodThrowsAlignment check in openjdk_checks.xml. #20636 - False negatives regarding LeftCurly in openjdk_checks.xml. #17170 - Google-style: unfollowed rule on ordering and spacing of module directives. #21454 - google_checks.xml: false negative 4.3 One statement per line. #21501 - CommonUtil.getFileExtension includes parent-directory dots in the extension. #21445 - google_checks.xml: false negative 3.3.1.1 No module imports. #21477 - Add checks for Sun Style [4.1 - Line Length]. #21444 - google_checks.xml: false negative 3.2 Package declaration.

... (truncated)

Commits

• bc58fc6 [maven-release-plugin] prepare release checkstyle-14.3.0
• 5711c72 doc: release notes for 14.3.0
• 4b8a5b3 minor: Bump version to 14.3.0-SNAPSHOT
• a93f8f2 Issue #14120: add module-info.java to make Checkstyle an explicit Java module
• 9e3482f [maven-release-plugin] prepare for next development iteration
• 6a200bc [maven-release-plugin] prepare release checkstyle-14.2.0
• 2d2b135 doc: release notes for 14.2.0
• 194e7a2 Issue #20590: Improve Input coverage for compact sources for SuperCloneCheck
• 123f477 Issue #17663: Indentation: missing violations for '->' and ',' in return stat...
• 4b2f353 Issue #20541: fix OperatorWrap false positive for lambda with block body
• Additional commits viewable in compare view

Updates org.hibernate.validator:hibernate-validator from 8.0.2.Final to 9.1.5.Final

Relea...

Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7b0bdec9-5ff9-48d8-8de7-eb87d14e2379

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[pat-agent]

Available PR Commands

• /migrate - Applies this PR's database migrations to the staging DB (can only be run by someone on @Patina-Network/codebloom)
• /copy - Triggers copy from production to staging db (can only be run by tahminator or angelayu0530)

[pat-agent]

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-leetcode-auth-stealer-service/tags under the following tags:

• codebloom-leetcode-auth-stealer-service:staging-latest
• codebloom-leetcode-auth-stealer-service:staging-2026.11.06-17.31.04
• codebloom-leetcode-auth-stealer-service:staging-f1aa658

[pat-agent]

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-standup-bot/tags under the following tags:

• codebloom-standup-bot:staging-latest
• codebloom-standup-bot:staging-2026.11.06-17.31.09
• codebloom-standup-bot:staging-f1aa658

[pat-agent]

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-standup-bot-arm/tags under the following tags:

• codebloom-standup-bot-arm:staging-latest
• codebloom-standup-bot-arm:staging-2026.11.06-17.31.07
• codebloom-standup-bot-arm:staging-f1aa658

[dependabot]

Superseded by #1069.

[pat-agent]

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-leetcode-auth-stealer-service-arm/tags under the following tags:

• codebloom-leetcode-auth-stealer-service-arm:staging-latest
• codebloom-leetcode-auth-stealer-service-arm:staging-2026.11.06-17.31.18
• codebloom-leetcode-auth-stealer-service-arm:staging-f1aa658