Skip to content

build(deps): bump the gradle group across 1 directory with 8 updates - #1229

Merged
ExtraToast merged 2 commits into
mainfrom
dependabot/gradle/gradle-9948594cda
Sep 16, 2026
Merged

build(deps): bump the gradle group across 1 directory with 8 updates#1229
ExtraToast merged 2 commits into
mainfrom
dependabot/gradle/gradle-9948594cda

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026 •
edited by github-actions Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the gradle group with 8 updates in the / directory:

Package From To
com.google.auth:google-auth-library-oauth2-http 1.51.0 1.52.0
org.flywaydb:flyway-mysql 13.4.0 13.5.0
org.springdoc:springdoc-openapi-starter-webmvc-ui 3.1.0 3.1.1
com.h2database:h2 2.4.240 2.5.250
org.graalvm.buildtools.native 1.1.11 1.1.12
io.cucumber:cucumber-java 7.34.7 7.34.8
io.cucumber:cucumber-picocontainer 7.34.7 7.34.8
io.cucumber:cucumber-junit-platform-engine 7.34.7 7.34.8

Updates com.google.auth:google-auth-library-oauth2-http from 1.51.0 to 1.52.0

Updates org.flywaydb:flyway-mysql from 13.4.0 to 13.5.0

Updates org.springdoc:springdoc-openapi-starter-webmvc-ui from 3.1.0 to 3.1.1

Release notes

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's releases.

springdoc-openapi v3.1.1 released!

Security

  • GHSA-6f5m-mhjg-qwxq – MCP tool callbacks do not encode path parameters, allowing request retargeting
  • GHSA-4v2q-56v7-2cpw – MCP transport, admin and dashboard endpoints are exposed by default
  • GHSA-m4cg-mhpg-rh2r – MCP audit events record credentials and request/response bodies without redaction
  • GHSA-5f9r-4mc4-qh3c – Unbounded MCP pending-confirmation store allows memory exhaustion
  • GHSA-jcgg-59c8-w4wh – MCP request context in a ThreadLocal can leak headers between concurrent WebFlux requests
  • GHSA-rhhx-6j8h-8cvw – Unbounded per-locale OpenAPI cache allows memory exhaustion via Accept-Language
  • GHSA-c925-vm88-mpp9 – Scalar starters trust client-supplied forwarded headers and render from a shared mutable bean
  • CVE-2026-75838 – Cross-site scripting in the DOMPurify bundled with swagger-ui, addressed by upgrading swagger-ui to 5.32.14

Added

  • #3340 – Describe JsonNullable values without their Java wrapper
  • #3325 – Manage the swagger artifacts in springdoc-openapi-bom, so that modules holding only the annotations stay in lockstep
  • #3321 – Add springdoc.login-endpoint.username-example and springdoc.login-endpoint.password-example to document the Spring Security login endpoint

Changed

  • MCP is now opt-in. Set springdoc.ai.mcp.enabled=true, and springdoc.ai.mcp.dashboard-enabled=true for the dashboard
  • The Scalar starters no longer register forwarded-header handling. Set server.forward-headers-strategy=framework (or native) behind a trusted proxy
  • Add springdoc.cache.max-entries (default 100) to bound the per-locale OpenAPI cache
  • Add springdoc.ai.mcp.audit.redact (default true) to mask secrets in MCP audit events
  • Document that the MCP approval flow is a confirmation step, not an authorization control
  • Document the security policy and the release versioning scheme
  • #3351 – java.time.Duration, LocalTime and OffsetTime are now resolved by swagger-core instead of being forced to a bare string, so they carry a format (duration and partial-time respectively for the first two)
  • A property whose type only implements Set indirectly (LinkedHashSet, TreeSet, …) is now described with uniqueItems: true, following swagger-api/swagger-core#5265
  • Upgrade swagger-core to version 2.2.55
  • Upgrade swagger-ui to version 5.32.14

Fixed

  • #3328, #3337 – /v3/api-docs fails with a NullPointerException when spring-hateoas is on the classpath without HateoasProperties
  • #3314 – Json Processing Exception occurred is logged for every constrained parameter whose schema is not a JsonSchema
  • #3317 – An injected HttpHeaders parameter is described as a schema
  • #3332 – The properties a Kotlin entity inherits from an @Embeddable are missing from the Spring Data REST schemas
  • #3320 – @Order and Ordered ignored when applying customizers
  • #3319 – A Page nested in another schema is not replaced by PagedModel
  • #3313 – Springdoc auto-configurations rely on unspecified auto-configuration ordering
  • #3331 – Validation annotations declared inside Optional parameters are dropped
  • #3322 – Validation annotations on a container's type argument leak between parameters
  • #3315 – An OAS 3.1 JsonSchema cannot be cloned through JSON
  • #3300 – TYPE_USE annotations on @ParameterObject fields are not passed along
  • #3341 – Stabilize Spring Data Sort and Pageable schema property order
  • #3338 – Kotlin nullability interpretation of the Any? type
  • #3136 – A Spring Data REST association to a non-exported entity expands its @EmbeddedId and @MapsId fields recursively in the response schemas
  • The Spring Data REST response post-processing rewrote an association property in place, so the …Response refs could leak into the schema shared with the request body representation

New Contributors

... (truncated)

Changelog

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's changelog.

[3.1.1] - 2026-09-06

Security

  • GHSA-6f5m-mhjg-qwxq – MCP tool callbacks do not encode path parameters, allowing request retargeting
  • GHSA-4v2q-56v7-2cpw – MCP transport, admin and dashboard endpoints are exposed by default
  • GHSA-m4cg-mhpg-rh2r – MCP audit events record credentials and request/response bodies without redaction
  • GHSA-5f9r-4mc4-qh3c – Unbounded MCP pending-confirmation store allows memory exhaustion
  • GHSA-jcgg-59c8-w4wh – MCP request context in a ThreadLocal can leak headers between concurrent WebFlux requests
  • GHSA-rhhx-6j8h-8cvw – Unbounded per-locale OpenAPI cache allows memory exhaustion via Accept-Language
  • GHSA-c925-vm88-mpp9 – Scalar starters trust client-supplied forwarded headers and render from a shared mutable bean
  • CVE-2026-75838 – Cross-site scripting in the DOMPurify bundled with swagger-ui, addressed by upgrading swagger-ui to 5.32.14

Added

  • #3340 – Describe JsonNullable values without their Java wrapper
  • #3325 – Manage the swagger artifacts in springdoc-openapi-bom, so that modules holding only the annotations stay in lockstep
  • #3321 – Add springdoc.login-endpoint.username-example and springdoc.login-endpoint.password-example to document the Spring Security login endpoint

Changed

  • MCP is now opt-in. Set springdoc.ai.mcp.enabled=true, and springdoc.ai.mcp.dashboard-enabled=true for the dashboard
  • The Scalar starters no longer register forwarded-header handling. Set server.forward-headers-strategy=framework (or native) behind a trusted proxy
  • Add springdoc.cache.max-entries (default 100) to bound the per-locale OpenAPI cache
  • Add springdoc.ai.mcp.audit.redact (default true) to mask secrets in MCP audit events
  • Document that the MCP approval flow is a confirmation step, not an authorization control
  • Document the security policy and the release versioning scheme
  • #3351 – java.time.Duration, LocalTime and OffsetTime are now resolved by swagger-core instead of being forced to a bare string, so they carry a format (duration and partial-time respectively for the first two)
  • A property whose type only implements Set indirectly (LinkedHashSet, TreeSet, …) is now described with uniqueItems: true, following swagger-api/swagger-core#5265
  • Upgrade swagger-core to version 2.2.55
  • Upgrade swagger-ui to version 5.32.14

Fixed

  • #3328, #3337 – /v3/api-docs fails with a NullPointerException when spring-hateoas is on the classpath without HateoasProperties
  • #3314 – Json Processing Exception occurred is logged for every constrained parameter whose schema is not a JsonSchema
  • #3317 – An injected HttpHeaders parameter is described as a schema
  • #3332 – The properties a Kotlin entity inherits from an @Embeddable are missing from the Spring Data REST schemas
  • #3320 – @Order and Ordered ignored when applying customizers
  • #3319 – A Page nested in another schema is not replaced by PagedModel
  • #3313 – Springdoc auto-configurations rely on unspecified auto-configuration ordering
  • #3331 – Validation annotations declared inside Optional parameters are dropped
  • #3322 – Validation annotations on a container's type argument leak between parameters
  • #3315 – An OAS 3.1 JsonSchema cannot be cloned through JSON
  • #3300 – TYPE_USE annotations on @ParameterObject fields are not passed along
  • #3341 – Stabilize Spring Data Sort and Pageable schema property order
  • #3338 – Kotlin nullability interpretation of the Any? type
  • #3136 – A Spring Data REST association to a non-exported entity expands its @EmbeddedId and @MapsId fields recursively in the response schemas
  • The Spring Data REST response post-processing rewrote an association property in place, so the …Response refs could leak into the schema shared with the request body representation
Commits
  • 1cc87a7 [maven-release-plugin] prepare release v3.1.1
  • 4e8ac26 docs: record the swagger-ui 5.32.14 upgrade as a security fix for 3.1.1
  • 958c79a Merge swagger-core 2.2.55 upgrade
  • cf7d7c7 Upgrade swagger-core to 2.2.55
  • 186adb3 Record the swagger-core 2.2.54 upgrade in the changelog
  • 2498ffb Merge pull request #3351 from Mattias-Sehlstedt/update-swagger-core
  • d78abd9 upgrade swagger-core from 2.2.53 to 2.2.54
  • 9f7f099 Rewrite a copy of a Spring Data REST association property
  • f47060e Record #3321 in the changelog and align the buildRequestBody indent
  • ccb2fc0 Merge pull request #3323 from Mattias-Sehlstedt/feature/3321-login-example-va...
  • Additional commits viewable in compare view

Updates com.h2database:h2 from 2.4.240 to 2.5.250

Release notes

Sourced from com.h2database:h2's releases.

version-2.5.250

Commits
  • bba342d in preparation for a release
  • 2763e82 in preparation for a release
  • 7a267bc Merge pull request #4375 from excaliware/patch-1
  • 297ff8e Merge pull request #4379 from jjh75607/fix/comment-on-view-column
  • 46b0823 Reject COMMENT ON COLUMN for views and other tables that cannot be altered
  • 9a8af38 Merge pull request #4363 from mayank1008-tech/Stop-server-everytime-db-instan...
  • 3f68b6b Merge pull request #4374 from brettwooldridge/patch-1
  • c436bf6 Merge pull request #4378 from momonari8/fix-getcostrangeindex-partial-sort-match
  • 66a9786 MVStore: fix data race causing spurious "Position 0" during chunk rewriting
  • 8d37836 Add regression test for the sort discount fix
  • Additional commits viewable in compare view

Updates org.graalvm.buildtools.native from 1.1.11 to 1.1.12

Release notes

Sourced from org.graalvm.buildtools.native's releases.

1.1.12

What's Changed

Full Changelog: graalvm/native-build-tools@1.1.11...1.1.12

Commits
  • b043a90 Release 1.1.12
  • aeed1ab Merge pull request #1041 from graalvm/update-metadata-to-1.0.13
  • 4d9fbd2 Update reachability metadata to 1.0.13
  • 976c054 Merge pull request #1040 from graalvm/bump-version-to-1.1.12-SNAPSHOT
  • 5025505 Bump version to 1.1.12-SNAPSHOT
  • a3f832d Improve native-image executable discovery with explicit/convention launcher d...
  • 510dbf4 Merge pull request #1037 from graalvm/release/1.1.11
  • See full diff in compare view

Updates io.cucumber:cucumber-java from 7.34.7 to 7.34.8

Release notes

Sourced from io.cucumber:cucumber-java's releases.

v7.34.8

Fixed

  • [TestNG] AbstractTestNGCucumberTests.scenarios() throws without setup (#3235)
Changelog

Sourced from io.cucumber:cucumber-java's changelog.

[7.34.8] - 2026-09-07

Fixed

  • [TestNG] AbstractTestNGCucumberTests.scenarios() throws without setup (#3235)
Commits
  • 6916f20 Prepare release v7.34.8
  • 55c383d [TestNG] AbstractTestNGCucumberTests.scenarios() throws without setup (#3235)
  • ed6d9be Prepare for the next development iteration
  • See full diff in compare view

Updates io.cucumber:cucumber-picocontainer from 7.34.7 to 7.34.8

Release notes

Sourced from io.cucumber:cucumber-picocontainer's releases.

v7.34.8

Fixed

  • [TestNG] AbstractTestNGCucumberTests.scenarios() throws without setup (#3235)
Changelog

Sourced from io.cucumber:cucumber-picocontainer's changelog.

[7.34.8] - 2026-09-07

Fixed

  • [TestNG] AbstractTestNGCucumberTests.scenarios() throws without setup (#3235)
Commits
  • 6916f20 Prepare release v7.34.8
  • 55c383d [TestNG] AbstractTestNGCucumberTests.scenarios() throws without setup (#3235)
  • ed6d9be Prepare for the next development iteration
  • See full diff in compare view

Updates io.cucumber:cucumber-junit-platform-engine from 7.34.7 to 7.34.8

Release notes

Sourced from io.cucumber:cucumber-junit-platform-engine's releases.

v7.34.8

Fixed

  • [TestNG] AbstractTestNGCucumberTests.scenarios() throws without setup (#3235)
Changelog

Sourced from io.cucumber:cucumber-junit-platform-engine's changelog.

[7.34.8] - 2026-09-07

Fixed

  • [TestNG] AbstractTestNGCucumberTests.scenarios() throws without setup (#3235)
Commits
  • 6916f20 Prepare release v7.34.8
  • 55c383d [TestNG] AbstractTestNGCucumberTests.scenarios() throws without setup (#3235)
  • ed6d9be Prepare for the next development iteration
  • See full diff in compare view

Updates io.cucumber:cucumber-picocontainer from 7.34.7 to 7.34.8

Release notes

Sourced from io.cucumber:cucumber-picocontainer's releases.

v7.34.8

Fixed

  • [TestNG] AbstractTestNGCucumberTests.scenarios() throws without setup (#3235)
Changelog

Sourced from io.cucumber:cucumber-picocontainer's changelog.

[7.34.8] - 2026-09-07

Fixed

  • [TestNG] AbstractTestNGCucumberTests.scenarios() throws without setup (#3235)
Commits
  • 6916f20 Prepare release v7.34.8
  • 55c383d [TestNG] AbstractTestNGCucumberTests.scenarios() throws without setup (#3235)
  • ed6d9be Prepare for the next development iteration
  • See full diff in compare view

Updates io.cucumber:cucumber-junit-platform-engine from 7.34.7 to 7.34.8

Release notes

Sourced from io.cucumber:cucumber-junit-platform-engine's releases.

v7.34.8

Fixed

  • [TestNG] AbstractTestNGCucumberTests.scenarios() throws without setup (#3235)
Changelog

Sourced from io.cucumber:cucumber-junit-platform-engine's changelog.

[7.34.8] - 2026-09-07

Fixed

  • [TestNG] AbstractTestNGCucumberTests.scenarios() throws without setup (#3235)
Commits
  • 6916f20 Prepare release v7.34.8
  • 55c383d [TestNG] AbstractTestNGCucumberTests.scenarios() throws without setup (#3235)
  • ed6d9be Prepare for the next development iteration
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Diff breakdown — █ added ░ removed, scaled to the largest row.

api                                                 +6     -6    1
  build & config     █████████████░░░░░░░░░░░░░     +6     -6    1
  generated          █████████████░░░░░░░░░░░░░    +16    -16    1  ~

system-tests                                        +1     -1    1
  system tests       ██░░                           +1     -1    1

──────────────────────────────────────────────────────────────────
production                                          +0     -0
tests                                               +1     -1
total (hand-written)                                +7     -7  2 files
~ generated (excluded)                             +16    -16  1 file

@dependabot
build(deps): bump the gradle group across 1 directory with 8 updates
d9dc861 
Bumps the gradle group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| com.google.auth:google-auth-library-oauth2-http | `1.51.0` | `1.52.0` |
| org.flywaydb:flyway-mysql | `13.4.0` | `13.5.0` |
| [org.springdoc:springdoc-openapi-starter-webmvc-ui](https://github.com/springdoc/springdoc-openapi) | `3.1.0` | `3.1.1` |
| [com.h2database:h2](https://github.com/h2database/h2database) | `2.4.240` | `2.5.250` |
| [org.graalvm.buildtools.native](https://github.com/graalvm/native-build-tools) | `1.1.11` | `1.1.12` |
| [io.cucumber:cucumber-java](https://github.com/cucumber/cucumber-jvm) | `7.34.7` | `7.34.8` |
| [io.cucumber:cucumber-picocontainer](https://github.com/cucumber/cucumber-jvm) | `7.34.7` | `7.34.8` |
| [io.cucumber:cucumber-junit-platform-engine](https://github.com/cucumber/cucumber-jvm) | `7.34.7` | `7.34.8` |



Updates `com.google.auth:google-auth-library-oauth2-http` from 1.51.0 to 1.52.0

Updates `org.flywaydb:flyway-mysql` from 13.4.0 to 13.5.0

Updates `org.springdoc:springdoc-openapi-starter-webmvc-ui` from 3.1.0 to 3.1.1
- [Release notes](https://github.com/springdoc/springdoc-openapi/releases)
- [Changelog](https://github.com/springdoc/springdoc-openapi/blob/main/CHANGELOG.md)
- [Commits](springdoc/springdoc-openapi@v3.1.0...v3.1.1)

Updates `com.h2database:h2` from 2.4.240 to 2.5.250
- [Release notes](https://github.com/h2database/h2database/releases)
- [Commits](h2database/h2database@version-2.4.240...version-2.5.250)

Updates `org.graalvm.buildtools.native` from 1.1.11 to 1.1.12
- [Release notes](https://github.com/graalvm/native-build-tools/releases)
- [Commits](graalvm/native-build-tools@1.1.11...1.1.12)

Updates `io.cucumber:cucumber-java` from 7.34.7 to 7.34.8
- [Release notes](https://github.com/cucumber/cucumber-jvm/releases)
- [Changelog](https://github.com/cucumber/cucumber-jvm/blob/main/CHANGELOG.md)
- [Commits](cucumber/cucumber-jvm@v7.34.7...v7.34.8)

Updates `io.cucumber:cucumber-picocontainer` from 7.34.7 to 7.34.8
- [Release notes](https://github.com/cucumber/cucumber-jvm/releases)
- [Changelog](https://github.com/cucumber/cucumber-jvm/blob/main/CHANGELOG.md)
- [Commits](cucumber/cucumber-jvm@v7.34.7...v7.34.8)

Updates `io.cucumber:cucumber-junit-platform-engine` from 7.34.7 to 7.34.8
- [Release notes](https://github.com/cucumber/cucumber-jvm/releases)
- [Changelog](https://github.com/cucumber/cucumber-jvm/blob/main/CHANGELOG.md)
- [Commits](cucumber/cucumber-jvm@v7.34.7...v7.34.8)

Updates `io.cucumber:cucumber-picocontainer` from 7.34.7 to 7.34.8
- [Release notes](https://github.com/cucumber/cucumber-jvm/releases)
- [Changelog](https://github.com/cucumber/cucumber-jvm/blob/main/CHANGELOG.md)
- [Commits](cucumber/cucumber-jvm@v7.34.7...v7.34.8)

Updates `io.cucumber:cucumber-junit-platform-engine` from 7.34.7 to 7.34.8
- [Release notes](https://github.com/cucumber/cucumber-jvm/releases)
- [Changelog](https://github.com/cucumber/cucumber-jvm/blob/main/CHANGELOG.md)
- [Commits](cucumber/cucumber-jvm@v7.34.7...v7.34.8)

---
updated-dependencies:
- dependency-name: com.google.auth:google-auth-library-oauth2-http
  dependency-version: 1.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: org.flywaydb:flyway-mysql
  dependency-version: 13.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: org.springdoc:springdoc-openapi-starter-webmvc-ui
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: com.h2database:h2
  dependency-version: 2.5.250
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: org.graalvm.buildtools.native
  dependency-version: 1.1.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: io.cucumber:cucumber-java
  dependency-version: 7.34.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: io.cucumber:cucumber-picocontainer
  dependency-version: 7.34.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: io.cucumber:cucumber-junit-platform-engine
  dependency-version: 7.34.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: io.cucumber:cucumber-picocontainer
  dependency-version: 7.34.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: io.cucumber:cucumber-junit-platform-engine
  dependency-version: 7.34.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Sep 14, 2026
@ExtraToast
build(deps): the regenerated spec says @positive excludes zero
59217dd 
springdoc 3.1.1 emits `exclusiveMinimum: 0` where 3.1.0 emitted `minimum: 0`
for a `@Positive` field, which is what the annotation means and what OpenAPI
3.1 asks for. Sixteen properties move. The generated TypeScript client is
unchanged: it carries no numeric bounds.

Without this the spec-sync check fails, because it regenerates the spec with
the bumped springdoc and compares it against the committed one.
@ExtraToast
ExtraToast merged commit ccda337 into main Sep 16, 2026
25 checks passed
@ExtraToast
ExtraToast deleted the dependabot/gradle/gradle-9948594cda branch September 16, 2026 12:50
@github-actions github-actions Bot mentioned this pull request Sep 16, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ExtraToast