Skip to content

Bump the prod-deps-ver group across 1 directory with 24 updates#1940

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/maven/prod-deps-ver-413acda5bf
Closed

Bump the prod-deps-ver group across 1 directory with 24 updates#1940
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/maven/prod-deps-ver-413acda5bf

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 14, 2026 •
edited
Loading

Bumps the prod-deps-ver group with 24 updates in the / directory:

Package From To
org.eclipse.jetty:jetty-bom 12.1.7 12.1.8
org.eclipse.jetty.ee10:jetty-ee10-servlet 12.1.7 12.1.8
org.eclipse.jetty.ee10:jetty-ee10-webapp 12.1.7 12.1.8
org.springframework.security:spring-security-bom 7.0.3 7.0.4
org.springframework.security:spring-security-core 7.0.3 7.0.4
org.springframework.boot:spring-boot-dependencies 4.0.3 4.0.5
org.springframework.boot:spring-boot-starter-test 3.5.9 4.0.5
org.springframework.boot:spring-boot-autoconfigure 3.5.9 4.0.5
org.springframework.boot:spring-boot-starter-tomcat 3.5.9 4.0.5
com.sap.cloud.environment.servicebinding:java-bom 0.21.0 0.30.0
com.sap.cloud.environment.servicebinding:java-sap-vcap-services 0.21.0 0.30.0
com.sap.cloud.environment.servicebinding:java-sap-service-operator 0.21.0 0.30.0
com.sap.cloud.environment.servicebinding.api:java-consumption-api 0.21.0 0.30.0
com.sap.cloud.environment.servicebinding.api:java-access-api 0.21.0 0.30.0
org.springframework:spring-core 7.0.5 7.0.6
org.springframework:spring-web 6.2.15 7.0.6
org.springframework:spring-aop 7.0.5 7.0.6
org.springframework:spring-beans 7.0.5 7.0.6
org.springframework.security:spring-security-oauth2-client 7.0.3 7.0.4
org.apache.logging.log4j:log4j-to-slf4j 2.25.3 2.25.4
org.apache.logging.log4j:log4j-api 2.25.3 2.25.4
io.projectreactor:reactor-core 3.8.2 3.8.4
org.mockito:mockito-core 5.22.0 5.23.0
io.projectreactor:reactor-test 3.8.2 3.8.4

Updates org.eclipse.jetty:jetty-bom from 12.1.7 to 12.1.8

Release notes

Sourced from org.eclipse.jetty:jetty-bom's releases.

12.1.8

Special Thanks to the following Eclipse Jetty community members

Changelog

  • #14752 - Jetty 12.1 Violation of RFC9113 with Host and :authority headers
  • #14747 - Revert usage of SLF4J2 fluent APIs
  • #14732 - possible race condition in jetty 12.x code
  • #14694 - Sync jetty-ee11 with jetty-ee10
  • #14689 - ThreadIdPool.take() bottlenecks QueuedThreadPool.tryExecute()
  • #14687 - Destinations don't keep track of redirections.
  • #14685 - CachingHttpContentFactory#getContent may return null if httpContent size is not set
  • #14651 - Retain negative Max-Age cookie attribute
  • #14494 - Review use of CharsetStringBuilder subclasses
  • #14431 - ServletContainerInitializers are always excluded when used with absolute-ordering
  • #14332 - Complete mess with idleTimeout
  • #13685 - Infinite loop on Content.copy() with Content.Source.from(... , Path, ) when Path has size 0.
  • #13513 - Make MemoryEndPoint use RBB.DynamicCapacity (@​afarber)
  • #10906 - Add Slf4j ConsoleRequestLog (JettySlf4jRequestLog) module
Commits
  • c9cdc9a Updating to version 12.1.8
  • 1f4039c Fixes for JASPI isMandatory, authType and isAuthenticationRequest params (#14...
  • 0bc383d Issue #14431 - fixes for ServletContainerInitializer exclusion with absolute-...
  • 31824d4 Optimize ThreadIdPool (#14746)
  • fc10b2d Fixes #14651 - Retain negative Max-Age cookie attribute. (#14652)
  • 3c269e3 Merge pull request #14687 from jetty/fix/jetty-12.1.x/108-cache-permanent-red...
  • 5a63f39 Fixes#108 - Destinations don't keep track of redirections.
  • 74fde46 Fixes #14751 - jetty-bom is missing jetty-quic-quiche-server
  • 124558c Fixes #14752 - Jetty 12.1 Violation of RFC9113 with Host and :authority heade...
  • 8c218d9 [12.1.x Root pom] Bump com.google.protobuf:protobuf-java (#14796)
  • Additional commits viewable in compare view

Updates org.eclipse.jetty.ee10:jetty-ee10-servlet from 12.1.7 to 12.1.8

Updates org.eclipse.jetty.ee10:jetty-ee10-webapp from 12.1.7 to 12.1.8

Updates org.springframework.security:spring-security-bom from 7.0.3 to 7.0.4

Release notes

Sourced from org.springframework.security:spring-security-bom's releases.

7.0.4

⭐ New Features

  • Update RestTemplateBuilder usage in opaque-token.adoc #18836

🪲 Bug Fixes

  • Fix GrantedAuthority.authority null in AuthoritiesAuthorizationManager #18784
  • Add Jackson Mixin for WebAuthnAuthentication #18878
  • Add Missing OnCommitedResponseWrapper Header Overrides #18799
  • Document the change in dependency coordinates with Spring Security 7 #18773
  • Ensure tests clear AuthorizationServerContextHolder #18768
  • Fix CookieRequestCache parameters #18864
  • Fix Flaky Crypto Tests #18842
  • Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs #18897
  • HttpMessageConverterAuthenticationSuccessHandler Supports Jackson 3 #18834
  • OAuth2DeviceVerificationEndpointFilter should be applied after AuthorizationFilter #18873
  • Restore upgradeEncoding condition in DaoAuthenticationProvider #18788
  • saveAuthenticationRequest should read relayState from authenticationRequest #18884
  • SecurityExpressionRoot#hasAuthority should delegate to AuthorizationManagerFactory#hasAuthority #18487
  • ServerHttpSecurityConfiguration should not set userDetailsPasswordService to a null value #18276
  • TokenBasedRememberMeServices documentation snippets should compile #18642
  • Update request-matcher XML property to support PathPatternRequestMatcher #18737

🔨 Dependency Upgrades

  • Bump @antora/collector-extension from 1.0.2 to 1.0.3 in /docs #18853
  • Bump actions/upload-artifact from 6.0.0 to 7.0.0 #18810
  • Bump ch.qos.logback:logback-classic from 1.5.29 to 1.5.32 #18752
  • Bump com.webauthn4j:webauthn4j-core from 0.31.0.RELEASE to 0.31.1.RELEASE #18830
  • Bump io.projectreactor:reactor-bom from 2025.0.3 to 2025.0.4 #18877
  • Bump org-apache-maven-resolver from 1.9.25 to 1.9.26 #18751
  • Bump org-apache-maven-resolver from 1.9.26 to 1.9.27 #18792
  • Bump org.apache.maven:maven-resolver-provider from 3.9.12 to 3.9.13 #18861
  • Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14 #18887
  • Bump org.junit:junit-bom from 6.0.2 to 6.0.3 #18743
  • Bump org.springframework.data:spring-data-bom from 2025.1.3 to 2025.1.4 #18904
  • Bump org.springframework:spring-framework-bom from 7.0.4 to 7.0.5 #18764
  • Bump org.springframework:spring-framework-bom from 7.0.5 to 7.0.6 #18905
  • Update Antora UI Spring to v0.4.26 #18893
  • Update to spring-security-release-tools 1.0.15 #18909

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​busoco-sjb, @​making, @​meliezer, @​ngocnhan-tran1996, @​rwinch, @​sephiroth-j, @​therepanic, @​thuri, and @​ziqin

Commits
  • 9bd793f Release 7.0.4
  • a2c0ac1 Update to spring-security-release-tools 1.0.15
  • ea6e7ab Merge branch '6.5.x' into 7.0.x
  • 01ff3b0 Add Workflow for Deferring Issues
  • e8cb0ef Merge Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs
  • 33e6f4b Merge Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs
  • 524ae92 Merge Add Jackson Mixin for WebAuthnAuthentication
  • 47146f3 Add Jackson Mixin for WebAuthnAuthentication
  • e7080e8 Update Antora UI Spring to v0.4.26
  • c348a7a Bump io.projectreactor:reactor-bom from 2025.0.3 to 2025.0.4
  • Additional commits viewable in compare view

Updates org.springframework.security:spring-security-core from 7.0.3 to 7.0.4

Release notes

Sourced from org.springframework.security:spring-security-core's releases.

7.0.4

⭐ New Features

  • Update RestTemplateBuilder usage in opaque-token.adoc #18836

🪲 Bug Fixes

  • Fix GrantedAuthority.authority null in AuthoritiesAuthorizationManager #18784
  • Add Jackson Mixin for WebAuthnAuthentication #18878
  • Add Missing OnCommitedResponseWrapper Header Overrides #18799
  • Document the change in dependency coordinates with Spring Security 7 #18773
  • Ensure tests clear AuthorizationServerContextHolder #18768
  • Fix CookieRequestCache parameters #18864
  • Fix Flaky Crypto Tests #18842
  • Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs #18897
  • HttpMessageConverterAuthenticationSuccessHandler Supports Jackson 3 #18834
  • OAuth2DeviceVerificationEndpointFilter should be applied after AuthorizationFilter #18873
  • Restore upgradeEncoding condition in DaoAuthenticationProvider #18788
  • saveAuthenticationRequest should read relayState from authenticationRequest #18884
  • SecurityExpressionRoot#hasAuthority should delegate to AuthorizationManagerFactory#hasAuthority #18487
  • ServerHttpSecurityConfiguration should not set userDetailsPasswordService to a null value #18276
  • TokenBasedRememberMeServices documentation snippets should compile #18642
  • Update request-matcher XML property to support PathPatternRequestMatcher #18737

🔨 Dependency Upgrades

  • Bump @antora/collector-extension from 1.0.2 to 1.0.3 in /docs #18853
  • Bump actions/upload-artifact from 6.0.0 to 7.0.0 #18810
  • Bump ch.qos.logback:logback-classic from 1.5.29 to 1.5.32 #18752
  • Bump com.webauthn4j:webauthn4j-core from 0.31.0.RELEASE to 0.31.1.RELEASE #18830
  • Bump io.projectreactor:reactor-bom from 2025.0.3 to 2025.0.4 #18877
  • Bump org-apache-maven-resolver from 1.9.25 to 1.9.26 #18751
  • Bump org-apache-maven-resolver from 1.9.26 to 1.9.27 #18792
  • Bump org.apache.maven:maven-resolver-provider from 3.9.12 to 3.9.13 #18861
  • Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14 #18887
  • Bump org.junit:junit-bom from 6.0.2 to 6.0.3 #18743
  • Bump org.springframework.data:spring-data-bom from 2025.1.3 to 2025.1.4 #18904
  • Bump org.springframework:spring-framework-bom from 7.0.4 to 7.0.5 #18764
  • Bump org.springframework:spring-framework-bom from 7.0.5 to 7.0.6 #18905
  • Update Antora UI Spring to v0.4.26 #18893
  • Update to spring-security-release-tools 1.0.15 #18909

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​busoco-sjb, @​making, @​meliezer, @​ngocnhan-tran1996, @​rwinch, @​sephiroth-j, @​therepanic, @​thuri, and @​ziqin

Commits
  • 9bd793f Release 7.0.4
  • a2c0ac1 Update to spring-security-release-tools 1.0.15
  • ea6e7ab Merge branch '6.5.x' into 7.0.x
  • 01ff3b0 Add Workflow for Deferring Issues
  • e8cb0ef Merge Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs
  • 33e6f4b Merge Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs
  • 524ae92 Merge Add Jackson Mixin for WebAuthnAuthentication
  • 47146f3 Add Jackson Mixin for WebAuthnAuthentication
  • e7080e8 Update Antora UI Spring to v0.4.26
  • c348a7a Bump io.projectreactor:reactor-bom from 2025.0.3 to 2025.0.4
  • Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-dependencies from 4.0.3 to 4.0.5

Release notes

Sourced from org.springframework.boot:spring-boot-dependencies's releases.

v4.0.5

🐞 Bug Fixes

  • Test starter for Spring Integration does not include Spring Integration test module #49784
  • Some sliced tests that import TransactionAutoConfiguration do not import TransactionManagerCustomizationAutoConfiguration #49782
  • WebSocket messaging's task executors are only auto-configured and stompWebSocketHandlerMapping is only forced to be eager when using Jackson #49753
  • WebSocket app fails to start when Jackson is on the classpath but there's no JsonMapper bean #49749
  • Metadata annotation processor ignores method-level @NestedConfigurationProperty when using constructor binding #49738
  • Override of property in external 'application.properties' or 'application.yaml' is ignored #49731
  • NativeImageResourceProvider does not find Flyway migration scripts in subdirectories #49706
  • Add @ConditionalOnWebApplication to NettyReactiveWebServerAutoConfiguration #49695
  • @GraphQlTest does not include @ControllerAdvice #49672

📔 Documentation

  • Fix incorrect indefinite articles in Javadoc #49727
  • Add some more Kotlin examples and trivial style fixes #49714
  • Overhaul Spring Session documentation following modularization #49704

🔨 Dependency Upgrades

  • Upgrade to Brave 6.3.1 #49763
  • Upgrade to Jackson 2 Bom 2.21.2 #49764
  • Upgrade to jOOQ 3.19.31 #49765
  • Upgrade to Netty 4.2.12.Final #49794
  • Upgrade to Tomcat 11.0.20 #49767
  • Upgrade to Zipkin Reporter 3.5.3 #49762

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Joowon-Seo, @​deejay1, @​dlwldnjs1009, @​kwondh5217, @​ljrmorgan, and @​quaff

v4.0.4

⚠️ Attention Required

  • OpenTelemetry's ZipkinSpanExporter has been deprecated and its support will be removed in Spring Boot 4.2. #49453
  • Jackson 2 has been upgraded to 2.21.1 in response to the Jackson team ending support for Jackson 2.20.x. #49389
  • Jackson has been upgraded to 3.1.0 in response to the Jackson team ending support for Jackson 3.0.x. #49383
  • The default value for server.tomcat.max-part-count has been increased from 10 to 50. This aligns it with Tomcat's own default and the default in Spring Boot 3.x. #49311

🐞 Bug Fixes

  • EndpointRequest request matcher for health groups is too complex #49649
  • "/cloudfoundryapplication" web path is not limited to Actuator #49646
  • Fix EndpointRequest.toLinks() when base-path is '/' #49617
  • Docker fails when a 'tcp://' address ends with a slash (for example 'tcp://docker:2375/') #49596
  • RSocket exposes duplicate endpoint for websocket setups #49593
  • Failure analysis for a missing mail sender is misleading #49582

... (truncated)

Commits
  • fe74b31 Release v4.0.5
  • e1d6e5a Merge branch '3.5.x' into 4.0.x
  • 6c9e52a Next development version (v3.5.14-SNAPSHOT)
  • a413e95 Upgrade to Netty 4.2.12.Final
  • c1694b5 Add missing Spring Integration test module to the relevant starter
  • 51ffdc6 Merge branch '3.5.x' into 4.0.x
  • 696a60e Full auto-configure transaction management in slice tests
  • ba70d41 Upgrade to Tomcat 11.0.20
  • fd94ca0 Upgrade to Netty 4.2.11.Final
  • 7e6833b Upgrade to jOOQ 3.19.31
  • Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-starter-test from 3.5.9 to 4.0.5

Release notes

Sourced from org.springframework.boot:spring-boot-starter-test's releases.

v4.0.5

🐞 Bug Fixes

  • Test starter for Spring Integration does not include Spring Integration test module #49784
  • Some sliced tests that import TransactionAutoConfiguration do not import TransactionManagerCustomizationAutoConfiguration #49782
  • WebSocket messaging's task executors are only auto-configured and stompWebSocketHandlerMapping is only forced to be eager when using Jackson #49753
  • WebSocket app fails to start when Jackson is on the classpath but there's no JsonMapper bean #49749
  • Metadata annotation processor ignores method-level @NestedConfigurationProperty when using constructor binding #49738
  • Override of property in external 'application.properties' or 'application.yaml' is ignored #49731
  • NativeImageResourceProvider does not find Flyway migration scripts in subdirectories #49706
  • Add @ConditionalOnWebApplication to NettyReactiveWebServerAutoConfiguration #49695
  • @GraphQlTest does not include @ControllerAdvice #49672

📔 Documentation

  • Fix incorrect indefinite articles in Javadoc #49727
  • Add some more Kotlin examples and trivial style fixes #49714
  • Overhaul Spring Session documentation following modularization #49704

🔨 Dependency Upgrades

  • Upgrade to Brave 6.3.1 #49763
  • Upgrade to Jackson 2 Bom 2.21.2 #49764
  • Upgrade to jOOQ 3.19.31 #49765
  • Upgrade to Netty 4.2.12.Final #49794
  • Upgrade to Tomcat 11.0.20 #49767
  • Upgrade to Zipkin Reporter 3.5.3 #49762

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Joowon-Seo, @​deejay1, @​dlwldnjs1009, @​kwondh5217, @​ljrmorgan, and @​quaff

v4.0.4

⚠️ Attention Required

  • OpenTelemetry's ZipkinSpanExporter has been deprecated and its support will be removed in Spring Boot 4.2. #49453
  • Jackson 2 has been upgraded to 2.21.1 in response to the Jackson team ending support for Jackson 2.20.x. #49389
  • Jackson has been upgraded to 3.1.0 in response to the Jackson team ending support for Jackson 3.0.x. #49383
  • The default value for server.tomcat.max-part-count has been increased from 10 to 50. This aligns it with Tomcat's own default and the default in Spring Boot 3.x. #49311

🐞 Bug Fixes

  • EndpointRequest request matcher for health groups is too complex #49649
  • "/cloudfoundryapplication" web path is not limited to Actuator #49646
  • Fix EndpointRequest.toLinks() when base-path is '/' #49617
  • Docker fails when a 'tcp://' address ends with a slash (for example 'tcp://docker:2375/') #49596
  • RSocket exposes duplicate endpoint for websocket setups #49593
  • Failure analysis for a missing mail sender is misleading #49582

... (truncated)

Commits
  • fe74b31 Release v4.0.5
  • e1d6e5a Merge branch '3.5.x' into 4.0.x
  • 6c9e52a Next development version (v3.5.14-SNAPSHOT)
  • a413e95 Upgrade to Netty 4.2.12.Final
  • c1694b5 Add missing Spring Integration test module to the relevant starter
  • 51ffdc6 Merge branch '3.5.x' into 4.0.x
  • 696a60e Full auto-configure transaction management in slice tests
  • ba70d41 Upgrade to Tomcat 11.0.20
  • fd94ca0 Upgrade to Netty 4.2.11.Final
  • 7e6833b Upgrade to jOOQ 3.19.31
  • Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-autoconfigure from 3.5.9 to 4.0.5

Release notes

Sourced from org.springframework.boot:spring-boot-autoconfigure's releases.

v4.0.5

🐞 Bug Fixes

  • Test starter for Spring Integration does not include Spring Integration test module #49784
  • Some sliced tests that import TransactionAutoConfiguration do not import TransactionManagerCustomizationAutoConfiguration #49782
  • WebSocket messaging's task executors are only auto-configured and stompWebSocketHandlerMapping is only forced to be eager when using Jackson #49753
  • WebSocket app fails to start when Jackson is on the classpath but there's no JsonMapper bean #49749
  • Metadata annotation processor ignores method-level @NestedConfigurationProperty when using constructor binding #49738
  • Override of property in external 'application.properties' or 'application.yaml' is ignored #49731
  • NativeImageResourceProvider does not find Flyway migration scripts in subdirectories #49706
  • Add @ConditionalOnWebApplication to NettyReactiveWebServerAutoConfiguration #49695
  • @GraphQlTest does not include @ControllerAdvice #49672

📔 Documentation

  • Fix incorrect indefinite articles in Javadoc #49727
  • Add some more Kotlin examples and trivial style fixes #49714
  • Overhaul Spring Session documentation following modularization #49704

🔨 Dependency Upgrades

  • Upgrade to Brave 6.3.1 #49763
  • Upgrade to Jackson 2 Bom 2.21.2 #49764
  • Upgrade to jOOQ 3.19.31 #49765
  • Upgrade to Netty 4.2.12.Final #49794
  • Upgrade to Tomcat 11.0.20 #49767
  • Upgrade to Zipkin Reporter 3.5.3 #49762

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Joowon-Seo, @​deejay1, @​dlwldnjs1009, @​kwondh5217, @​ljrmorgan, and @​quaff

v4.0.4

⚠️ Attention Required

  • OpenTelemetry's ZipkinSpanExporter has been deprecated and its support will be removed in Spring Boot 4.2. #49453
  • Jackson 2 has been upgraded to 2.21.1 in response to the Jackson team ending support for Jackson 2.20.x. #49389
  • Jackson has been upgraded to 3.1.0 in response to the Jackson team ending support for Jackson 3.0.x. #49383
  • The default value for server.tomcat.max-part-count has been increased from 10 to 50. This aligns it with Tomcat's own default and the default in Spring Boot 3.x. #49311

🐞 Bug Fixes

  • EndpointRequest request matcher for health groups is too complex #49649
  • "/cloudfoundryapplication" web path is not limited to Actuator #49646
  • Fix EndpointRequest.toLinks() when base-path is '/' #49617
  • Docker fails when a 'tcp://' address ends with a slash (for example 'tcp://docker:2375/') #49596
  • RSocket exposes duplicate endpoint for websocket setups #49593
  • Failure analysis for a missing mail sender is misleading #49582

... (truncated)

Commits
  • fe74b31 Release v4.0.5
  • e1d6e5a Merge branch '3.5.x' into 4.0.x
  • 6c9e52a Next development version (v3.5.14-SNAPSHOT)
  • a413e95 Upgrade to Netty 4.2.12.Final
  • c1694b5 Add missing Spring Integration test module to the relevant starter
  • 51ffdc6 Merge branch '3.5.x' into 4.0.x
  • 696a60e Full auto-configure transaction management in slice tests
  • ba70d41 Upgrade to Tomcat 11.0.20
  • fd94ca0 Upgrade to Netty 4.2.11.Final
  • 7e6833b Upgrade to jOOQ 3.19.31
  • Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-starter-tomcat from 3.5.9 to 4.0.5

Release notes

Sourced from org.springframework.boot:spring-boot-starter-tomcat's releases.

v4.0.5

🐞 Bug Fixes

  • Test starter for Spring Integration does not include Spring Integration test module #49784
  • Some sliced tests that import TransactionAutoConfiguration do not import TransactionManagerCustomizationAutoConfiguration #49782
  • WebSocket messaging's task executors are only auto-configured and stompWebSocketHandlerMapping is only forced to be eager when using Jackson #49753
  • WebSocket app fails to start when Jackson is on the classpath but there's no JsonMapper bean #49749
  • Metadata annotation processor ignores method-level @NestedConfigurationProperty when using constructor binding #49738
  • Override of property in external 'application.properties' or 'application.yaml' is ignored #49731
  • NativeImageResourceProvider does not find Flyway migration scripts in subdirectories #49706
  • Add @ConditionalOnWebApplication to NettyReactiveWebServerAutoConfiguration #49695
  • @GraphQlTest does not include @ControllerAdvice #49672

📔 Documentation

  • Fix incorrect indefinite articles in Javadoc #49727
  • Add some more Kotlin examples and trivial style fixes #49714
  • Overhaul Spring Session documentation following modularization #49704

🔨 Dependency Upgrades

  • Upgrade to Brave 6.3.1 #49763
  • Upgrade to Jackson 2 Bom 2.21.2 #49764
  • Upgrade to jOOQ 3.19.31 #49765
  • Upgrade to Netty 4.2.12.Final #49794
  • Upgrade to Tomcat 11.0.20 #49767
  • Upgrade to Zipkin Reporter 3.5.3 #49762

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Joowon-Seo, @​deejay1, @​dlwldnjs1009, @​kwondh5217, @​ljrmorgan, and @​quaff

v4.0.4

⚠️ Attention Required

  • OpenTelemetry's ZipkinSpanExporter has been deprecated and its support will be removed in Spring Boot 4.2. #49453
  • Jackson 2 has been upgraded to 2.21.1 in response to the Jackson team ending support for Jackson 2.20.x. #49389
  • Jackson has been upgraded to 3.1.0 in response to the Jackson team ending support for Jackson 3.0.x. #49383
  • The default value for server.tomcat.max-part-count has been increased from 10 to 50. This aligns it with Tomcat's own default and the default in Spring Boot 3.x. #49311

🐞 Bug Fixes

  • EndpointRequest request matcher for health groups is too complex #49649
  • "/cloudfoundryapplication" web path is not limited to Actuator #49646
  • Fix EndpointRequest.toLinks() when base-path is '/' #49617
  • Docker fails when a 'tcp://' address ends with a slash (for example 'tcp://docker:2375/') #49596
  • RSocket exposes duplicate endpoint for websocket setups #49593
  • Failure analysis for a missing mail sender is misleading #49582

... (truncated)

Commits
  • fe74b31 Release v4.0.5
  • e1d6e5a Merge branch '3.5.x' into 4.0.x
  • 6c9e52a Next development version (v3.5.14-SNAPSHOT)
  • a413e95 Upgrade to Netty 4.2.12.Final
  • c1694b5 Add missing Spring Integration test module to the relevant starter
  • 51ffdc6 Merge branch '3.5.x' into 4.0.x
  • 696a60e Full auto-configure transaction management in slice tests
  • ba70d41 Upgrade to Tomcat 11.0.20
  • fd94ca0 Upgrade to Netty 4.2.11.Final
  • 7e6833b Upgrade to jOOQ 3.19.31
  • Additional commits viewable in compare view

Updates com.sap.cloud.environment.servicebinding:java-bom from 0.21.0 to 0.30.0

Release notes

Sourced from com.sap.cloud.environment.servicebinding:java-bom's releases.

Release 0.30.0

What's Changed

Full Changelog: SAP/btp-environment-variable-access@0.21.0...0.30.0

Commits
  • 05ea8e1 bump version 0.21.0 -> 0.30.0
  • 83a813d chore: Add Names to each pom file (#321)
  • 41efb7e chore: Bump org.owasp:dependency-check-maven from 12.2.0 to 12.2.1 in the pro...

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Apr 14, 2026
@dependabot
Bump the prod-deps-ver group across 1 directory with 24 updates
ea45c33 
Bumps the prod-deps-ver group with 24 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [org.eclipse.jetty:jetty-bom](https://github.com/jetty/jetty.project) | `12.1.7` | `12.1.8` |
| org.eclipse.jetty.ee10:jetty-ee10-servlet | `12.1.7` | `12.1.8` |
| org.eclipse.jetty.ee10:jetty-ee10-webapp | `12.1.7` | `12.1.8` |
| [org.springframework.security:spring-security-bom](https://github.com/spring-projects/spring-security) | `7.0.3` | `7.0.4` |
| [org.springframework.security:spring-security-core](https://github.com/spring-projects/spring-security) | `7.0.3` | `7.0.4` |
| [org.springframework.boot:spring-boot-dependencies](https://github.com/spring-projects/spring-boot) | `4.0.3` | `4.0.5` |
| [org.springframework.boot:spring-boot-starter-test](https://github.com/spring-projects/spring-boot) | `3.5.9` | `4.0.5` |
| [org.springframework.boot:spring-boot-autoconfigure](https://github.com/spring-projects/spring-boot) | `3.5.9` | `4.0.5` |
| [org.springframework.boot:spring-boot-starter-tomcat](https://github.com/spring-projects/spring-boot) | `3.5.9` | `4.0.5` |
| [com.sap.cloud.environment.servicebinding:java-bom](https://github.com/SAP/btp-environment-variable-access) | `0.21.0` | `0.30.0` |
| [com.sap.cloud.environment.servicebinding:java-sap-vcap-services](https://github.com/SAP/btp-environment-variable-access) | `0.21.0` | `0.30.0` |
| [com.sap.cloud.environment.servicebinding:java-sap-service-operator](https://github.com/SAP/btp-environment-variable-access) | `0.21.0` | `0.30.0` |
| com.sap.cloud.environment.servicebinding.api:java-consumption-api | `0.21.0` | `0.30.0` |
| com.sap.cloud.environment.servicebinding.api:java-access-api | `0.21.0` | `0.30.0` |
| [org.springframework:spring-core](https://github.com/spring-projects/spring-framework) | `7.0.5` | `7.0.6` |
| [org.springframework:spring-web](https://github.com/spring-projects/spring-framework) | `6.2.15` | `7.0.6` |
| [org.springframework:spring-aop](https://github.com/spring-projects/spring-framework) | `7.0.5` | `7.0.6` |
| [org.springframework:spring-beans](https://github.com/spring-projects/spring-framework) | `7.0.5` | `7.0.6` |
| [org.springframework.security:spring-security-oauth2-client](https://github.com/spring-projects/spring-security) | `7.0.3` | `7.0.4` |
| org.apache.logging.log4j:log4j-to-slf4j | `2.25.3` | `2.25.4` |
| org.apache.logging.log4j:log4j-api | `2.25.3` | `2.25.4` |
| [io.projectreactor:reactor-core](https://github.com/reactor/reactor-core) | `3.8.2` | `3.8.4` |
| [org.mockito:mockito-core](https://github.com/mockito/mockito) | `5.22.0` | `5.23.0` |
| [io.projectreactor:reactor-test](https://github.com/reactor/reactor-core) | `3.8.2` | `3.8.4` |



Updates `org.eclipse.jetty:jetty-bom` from 12.1.7 to 12.1.8
- [Release notes](https://github.com/jetty/jetty.project/releases)
- [Commits](jetty/jetty.project@jetty-12.1.7...jetty-12.1.8)

Updates `org.eclipse.jetty.ee10:jetty-ee10-servlet` from 12.1.7 to 12.1.8

Updates `org.eclipse.jetty.ee10:jetty-ee10-webapp` from 12.1.7 to 12.1.8

Updates `org.springframework.security:spring-security-bom` from 7.0.3 to 7.0.4
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@7.0.3...7.0.4)

Updates `org.springframework.security:spring-security-core` from 7.0.3 to 7.0.4
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@7.0.3...7.0.4)

Updates `org.springframework.boot:spring-boot-dependencies` from 4.0.3 to 4.0.5
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v4.0.3...v4.0.5)

Updates `org.springframework.boot:spring-boot-starter-test` from 3.5.9 to 4.0.5
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.9...v4.0.5)

Updates `org.springframework.boot:spring-boot-autoconfigure` from 3.5.9 to 4.0.5
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.9...v4.0.5)

Updates `org.springframework.boot:spring-boot-starter-tomcat` from 3.5.9 to 4.0.5
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.9...v4.0.5)

Updates `com.sap.cloud.environment.servicebinding:java-bom` from 0.21.0 to 0.30.0
- [Release notes](https://github.com/SAP/btp-environment-variable-access/releases)
- [Commits](SAP/btp-environment-variable-access@0.21.0...0.30.0)

Updates `com.sap.cloud.environment.servicebinding:java-sap-vcap-services` from 0.21.0 to 0.30.0
- [Release notes](https://github.com/SAP/btp-environment-variable-access/releases)
- [Commits](SAP/btp-environment-variable-access@0.21.0...0.30.0)

Updates `com.sap.cloud.environment.servicebinding:java-sap-service-operator` from 0.21.0 to 0.30.0
- [Release notes](https://github.com/SAP/btp-environment-variable-access/releases)
- [Commits](SAP/btp-environment-variable-access@0.21.0...0.30.0)

Updates `com.sap.cloud.environment.servicebinding.api:java-consumption-api` from 0.21.0 to 0.30.0

Updates `com.sap.cloud.environment.servicebinding.api:java-access-api` from 0.21.0 to 0.30.0

Updates `org.springframework:spring-core` from 7.0.5 to 7.0.6
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.5...v7.0.6)

Updates `org.springframework:spring-web` from 6.2.15 to 7.0.6
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v6.2.15...v7.0.6)

Updates `org.springframework:spring-aop` from 7.0.5 to 7.0.6
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.5...v7.0.6)

Updates `org.springframework:spring-beans` from 7.0.5 to 7.0.6
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.5...v7.0.6)

Updates `org.springframework:spring-web` from 6.2.15 to 7.0.6
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v6.2.15...v7.0.6)

Updates `org.springframework:spring-aop` from 7.0.5 to 7.0.6
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.5...v7.0.6)

Updates `org.springframework:spring-beans` from 7.0.5 to 7.0.6
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.5...v7.0.6)

Updates `org.springframework.security:spring-security-oauth2-client` from 7.0.3 to 7.0.4
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@7.0.3...7.0.4)

Updates `org.apache.logging.log4j:log4j-to-slf4j` from 2.25.3 to 2.25.4

Updates `org.apache.logging.log4j:log4j-api` from 2.25.3 to 2.25.4

Updates `org.apache.logging.log4j:log4j-api` from 2.25.3 to 2.25.4

Updates `io.projectreactor:reactor-core` from 3.8.2 to 3.8.4
- [Release notes](https://github.com/reactor/reactor-core/releases)
- [Commits](reactor/reactor-core@v3.8.2...v3.8.4)

Updates `org.mockito:mockito-core` from 5.22.0 to 5.23.0
- [Release notes](https://github.com/mockito/mockito/releases)
- [Commits](mockito/mockito@v5.22.0...v5.23.0)

Updates `io.projectreactor:reactor-test` from 3.8.2 to 3.8.4
- [Release notes](https://github.com/reactor/reactor-core/releases)
- [Commits](reactor/reactor-core@v3.8.2...v3.8.4)

Updates `org.springframework.boot:spring-boot-starter-test` from 3.5.9 to 4.0.5
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.9...v4.0.5)

Updates `com.sap.cloud.environment.servicebinding:java-sap-vcap-services` from 0.21.0 to 0.30.0
- [Release notes](https://github.com/SAP/btp-environment-variable-access/releases)
- [Commits](SAP/btp-environment-variable-access@0.21.0...0.30.0)

Updates `com.sap.cloud.environment.servicebinding:java-sap-service-operator` from 0.21.0 to 0.30.0
- [Release notes](https://github.com/SAP/btp-environment-variable-access/releases)
- [Commits](SAP/btp-environment-variable-access@0.21.0...0.30.0)

Updates `com.sap.cloud.environment.servicebinding.api:java-consumption-api` from 0.21.0 to 0.30.0

Updates `com.sap.cloud.environment.servicebinding.api:java-access-api` from 0.21.0 to 0.30.0

Updates `org.springframework.security:spring-security-core` from 7.0.3 to 7.0.4
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@7.0.3...7.0.4)

Updates `org.springframework.boot:spring-boot-autoconfigure` from 3.5.9 to 4.0.5
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.9...v4.0.5)

Updates `org.springframework.boot:spring-boot-starter-tomcat` from 3.5.9 to 4.0.5
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.9...v4.0.5)

Updates `org.eclipse.jetty.ee10:jetty-ee10-servlet` from 12.1.7 to 12.1.8

Updates `org.eclipse.jetty.ee10:jetty-ee10-webapp` from 12.1.7 to 12.1.8

---
updated-dependencies:
- dependency-name: org.eclipse.jetty:jetty-bom
  dependency-version: 12.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-servlet
  dependency-version: 12.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-webapp
  dependency-version: 12.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.springframework.security:spring-security-bom
  dependency-version: 7.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.springframework.security:spring-security-core
  dependency-version: 7.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.springframework.boot:spring-boot-dependencies
  dependency-version: 4.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.springframework.boot:spring-boot-starter-test
  dependency-version: 4.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-deps-ver
- dependency-name: org.springframework.boot:spring-boot-autoconfigure
  dependency-version: 4.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-deps-ver
- dependency-name: org.springframework.boot:spring-boot-starter-tomcat
  dependency-version: 4.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-deps-ver
- dependency-name: com.sap.cloud.environment.servicebinding:java-bom
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
- dependency-name: com.sap.cloud.environment.servicebinding:java-sap-vcap-services
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
- dependency-name: com.sap.cloud.environment.servicebinding:java-sap-service-operator
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
- dependency-name: com.sap.cloud.environment.servicebinding.api:java-consumption-api
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
- dependency-name: com.sap.cloud.environment.servicebinding.api:java-access-api
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
- dependency-name: org.springframework:spring-core
  dependency-version: 7.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.springframework:spring-web
  dependency-version: 7.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-deps-ver
- dependency-name: org.springframework:spring-aop
  dependency-version: 7.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.springframework:spring-beans
  dependency-version: 7.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.springframework:spring-web
  dependency-version: 7.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-deps-ver
- dependency-name: org.springframework:spring-aop
  dependency-version: 7.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.springframework:spring-beans
  dependency-version: 7.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.springframework.security:spring-security-oauth2-client
  dependency-version: 7.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.apache.logging.log4j:log4j-to-slf4j
  dependency-version: 2.25.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.apache.logging.log4j:log4j-api
  dependency-version: 2.25.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.apache.logging.log4j:log4j-api
  dependency-version: 2.25.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: io.projectreactor:reactor-core
  dependency-version: 3.8.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.mockito:mockito-core
  dependency-version: 5.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
- dependency-name: io.projectreactor:reactor-test
  dependency-version: 3.8.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.springframework.boot:spring-boot-starter-test
  dependency-version: 4.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-deps-ver
- dependency-name: com.sap.cloud.environment.servicebinding:java-sap-vcap-services
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
- dependency-name: com.sap.cloud.environment.servicebinding:java-sap-service-operator
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
- dependency-name: com.sap.cloud.environment.servicebinding.api:java-consumption-api
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
- dependency-name: com.sap.cloud.environment.servicebinding.api:java-access-api
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps-ver
- dependency-name: org.springframework.security:spring-security-core
  dependency-version: 7.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.springframework.boot:spring-boot-autoconfigure
  dependency-version: 4.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-deps-ver
- dependency-name: org.springframework.boot:spring-boot-starter-tomcat
  dependency-version: 4.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-deps-ver
- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-servlet
  dependency-version: 12.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-webapp
  dependency-version: 12.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps-ver
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot force-pushed the dependabot/maven/prod-deps-ver-413acda5bf branch from b4f7b47 to ea45c33 Compare April 23, 2026 09:07
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 24, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Apr 24, 2026
@dependabot dependabot Bot deleted the dependabot/maven/prod-deps-ver-413acda5bf branch April 24, 2026 06:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants