Bump the maven group with 6 updates by dependabot[bot] · Pull Request #361 · belgif/rest-problem-java

dependabot · 2026-08-17T18:37:23Z

Bumps the maven group with 6 updates:

Package	From	To
ch.qos.logback:logback-classic	`1.6.1`	`1.6.3`
io.quarkus.platform:quarkus-bom	`3.38.1`	`3.38.2`
io.quarkus:quarkus-extension-processor	`3.38.1`	`3.38.2`
io.quarkus:quarkus-extension-maven-plugin	`3.38.1`	`3.38.2`
io.quarkus.platform:quarkus-maven-plugin	`3.38.1`	`3.38.2`
io.github.belgif.openapi:belgif-openapi-problem	`1.3.1`	`1.3.2`

Updates ch.qos.logback:logback-classic from 1.6.1 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3
2026-08-14 Release of logback version 1.6.3
In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).
Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.
The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.
ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.
Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.
The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.
A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.
Logback 1.6.2
clean.full.1.6.2.mp4
2026-08-10 Release of logback version 1.6.2
Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.
Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:
<propertyname="logback.skipCallerContradictionAnalysis"value="true"/>
SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.
Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.
Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.
Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.
A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits

e8e824d prepare release 1.6.3
761821b MDCBasedDiscriminator has a gated warning mechanism
53ed122 update copyright year
c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
b5aa931 added BatchedSimpleInvocationGate
1f22af7 add javadocs to SimpleInvocationGate
638ffa7 prevent forward and backward slashes to escape to other directories
7d6b9a4 add missing ch.qos.logback.core.property package
fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
c73b43f deprecate the withJansi path
Additional commits viewable in compare view

Updates io.quarkus.platform:quarkus-bom from 3.38.1 to 3.38.2

Commits

a158e24 [maven-release-plugin] prepare release 3.38.2
79af4a9 Merge pull request #2125 from quarkusio/quarkus-3.38.2
dd3c367 Merge pull request #2124 from quarkusio/update-automation/3.38-io.quarkiverse...
a864479 Ignore push event for Quarkus update pull requests
1d20f31 Upgrade to Quarkus 3.38.2
52bce9c Update io.quarkiverse.httpproblem to 3.38.2
9b036d2 Merge pull request #2121 from gsmet/fix-dbz-sync
7b122c1 Fix sync of Debezium
c3b0aae Merge pull request #2113 from quarkusio/update-automation/3.38-debezium-3.6.1...
4861be2 [maven-release-plugin] prepare for next development iteration
Additional commits viewable in compare view

Updates io.quarkus:quarkus-extension-processor from 3.38.1 to 3.38.2

Updates io.quarkus:quarkus-extension-maven-plugin from 3.38.1 to 3.38.2

Release notes

Sourced from io.quarkus:quarkus-extension-maven-plugin's releases.

3.38.2
Complete changelog
#55116 - Tight loop for AbstractResteasyReactiveContext due to race condition
#55169 - Changing how connection closure is handled to avoid a race condition
#55269 - [Quarkus Continuous Test] - Nested class not picked when using with quarkus test -Dtest flag
#55298 - Fix test selection for nested test classes
#55554 - Bump to Vert.x 4.5.31
#55560 - [3.x] maven native integration tests fail after #55461
#55584 - Qute localization breaks with too many entries
#55587 - Add presence checks on substituted Netty classes
#55653 - Fix VerifyError for large Qute message bundles
#55675 - Serialization issue in rest endpoints when class has empty constructor
#55684 - Use most suitable constructor for deserialization in reflection-free Jackson serializers
#55760 - Upgrade Yasson from 3.0.4 to 3.0.5
#55771 - Bump org.bouncycastle:bctls-fips from 2.1.23 to 2.1.24
#55809 - Bump org.mariadb.jdbc:mariadb-java-client from 3.5.9 to 3.5.10
#55818 - Quarkus REST sub-resource server exception mapper returning NPE for JSON object
#55844 - Quarkus REST: fix NPE when serializing JSON entity from sub-resource server exception mapper
#55848 - Combining multiple ReflectiveClassBuildItem might lose the publicConstructors element
#55849 - Merge isPublicConstructors() when a reflective class is registered twice
#55861 - Bump org.bouncycastle:bc-jdk18on-bom from 1.84 to 1.85
#55864 - Bump org.junit:junit-bom from 6.1.1 to 6.1.2
#55865 - Bump org.bouncycastle:bc-fips from 2.1.2 to 2.1.3
#55866 - Bump commons-codec:commons-codec from 1.22.0 to 1.22.1
#55867 - ArC: fix client proxy name collision for producers
#55868 - Allow generation of reflection-free Jackson serializers for JPA entity not doing lazy loading
#55872 - Fix Dev UI MCP Tools and Resources pages crashing when Dev MCP is disabled
#55887 - OIDC: malformed bearer token (empty or dots-only) causes NoSuchElementException in OidcCommonUtils.getJwtContentPart -> HTTP 500 instead of 401
#55905 - Guard against a JWT with no parts in OidcCommonUtils and OidcUtils
#55906 - Use AbstractConnection to prevent input loss, upgrade aesh to 3.16.8
#55908 - Fix PathTreeBuilder.getExcludes() returning the includes list
#55912 - Tree Shaker breaks hibernate filters
#55913 - [3.x] Bump to Vert.x 4.5.32 and Netty 4.1.137.Final
#55927 - Make sure package-info.class isn't treated as a regular class during tree-shaking
#55941 - Bump Keycloak version to 26.7.1 and Keycloak Client version to 26.0.12
#55951 - [3.38] Fix native image regression caused by Netty 4.1.136 SslContext API change

Commits

a160716 [RELEASE] - Bump version to 3.38.2
2d1b4e2 Merge pull request #55961 from gsmet/3.38.2-backports-1
ca6d508 Bump to Vert.x 4.5.32 and Netty 4.1.137.Final
5b94e27 Bump to Vert.x 4.5.31
02cfa9e Use AbstractConnection to prevent input loss, upgrade aesh to 3.16.8
ff35071 Bump Keycloak version to 26.7.1 and Keycloak Client version to 26.0.12
c6c9fbe fix: changing how connection closure is handled
88e7707 Initilize at runtime BC FIPS classes that embed Cleaner
4b2de67 Bump org.bouncycastle:bc-fips from 2.1.2 to 2.1.3
4065534 Bump org.bouncycastle:bc-jdk18on-bom from 1.84 to 1.85
Additional commits viewable in compare view

Updates io.quarkus.platform:quarkus-maven-plugin from 3.38.1 to 3.38.2

Commits

a158e24 [maven-release-plugin] prepare release 3.38.2
79af4a9 Merge pull request #2125 from quarkusio/quarkus-3.38.2
dd3c367 Merge pull request #2124 from quarkusio/update-automation/3.38-io.quarkiverse...
a864479 Ignore push event for Quarkus update pull requests
1d20f31 Upgrade to Quarkus 3.38.2
52bce9c Update io.quarkiverse.httpproblem to 3.38.2
9b036d2 Merge pull request #2121 from gsmet/fix-dbz-sync
7b122c1 Fix sync of Debezium
c3b0aae Merge pull request #2113 from quarkusio/update-automation/3.38-debezium-3.6.1...
4861be2 [maven-release-plugin] prepare for next development iteration
Additional commits viewable in compare view

Updates io.quarkus:quarkus-extension-processor from 3.38.1 to 3.38.2

Updates io.quarkus:quarkus-extension-maven-plugin from 3.38.1 to 3.38.2

Release notes

Sourced from io.quarkus:quarkus-extension-maven-plugin's releases.

3.38.2
Complete changelog
#55116 - Tight loop for AbstractResteasyReactiveContext due to race condition
#55169 - Changing how connection closure is handled to avoid a race condition
#55269 - [Quarkus Continuous Test] - Nested class not picked when using with quarkus test -Dtest flag
#55298 - Fix test selection for nested test classes
#55554 - Bump to Vert.x 4.5.31
#55560 - [3.x] maven native integration tests fail after #55461
#55584 - Qute localization breaks with too many entries
#55587 - Add presence checks on substituted Netty classes
#55653 - Fix VerifyError for large Qute message bundles
#55675 - Serialization issue in rest endpoints when class has empty constructor
#55684 - Use most suitable constructor for deserialization in reflection-free Jackson serializers
#55760 - Upgrade Yasson from 3.0.4 to 3.0.5
#55771 - Bump org.bouncycastle:bctls-fips from 2.1.23 to 2.1.24
#55809 - Bump org.mariadb.jdbc:mariadb-java-client from 3.5.9 to 3.5.10
#55818 - Quarkus REST sub-resource server exception mapper returning NPE for JSON object
#55844 - Quarkus REST: fix NPE when serializing JSON entity from sub-resource server exception mapper
#55848 - Combining multiple ReflectiveClassBuildItem might lose the publicConstructors element
#55849 - Merge isPublicConstructors() when a reflective class is registered twice
#55861 - Bump org.bouncycastle:bc-jdk18on-bom from 1.84 to 1.85
#55864 - Bump org.junit:junit-bom from 6.1.1 to 6.1.2
#55865 - Bump org.bouncycastle:bc-fips from 2.1.2 to 2.1.3
#55866 - Bump commons-codec:commons-codec from 1.22.0 to 1.22.1
#55867 - ArC: fix client proxy name collision for producers
#55868 - Allow generation of reflection-free Jackson serializers for JPA entity not doing lazy loading
#55872 - Fix Dev UI MCP Tools and Resources pages crashing when Dev MCP is disabled
#55887 - OIDC: malformed bearer token (empty or dots-only) causes NoSuchElementException in OidcCommonUtils.getJwtContentPart -> HTTP 500 instead of 401
#55905 - Guard against a JWT with no parts in OidcCommonUtils and OidcUtils
#55906 - Use AbstractConnection to prevent input loss, upgrade aesh to 3.16.8
#55908 - Fix PathTreeBuilder.getExcludes() returning the includes list
#55912 - Tree Shaker breaks hibernate filters
#55913 - [3.x] Bump to Vert.x 4.5.32 and Netty 4.1.137.Final
#55927 - Make sure package-info.class isn't treated as a regular class during tree-shaking
#55941 - Bump Keycloak version to 26.7.1 and Keycloak Client version to 26.0.12
#55951 - [3.38] Fix native image regression caused by Netty 4.1.136 SslContext API change

Commits

a160716 [RELEASE] - Bump version to 3.38.2
2d1b4e2 Merge pull request #55961 from gsmet/3.38.2-backports-1
ca6d508 Bump to Vert.x 4.5.32 and Netty 4.1.137.Final
5b94e27 Bump to Vert.x 4.5.31
02cfa9e Use AbstractConnection to prevent input loss, upgrade aesh to 3.16.8
ff35071 Bump Keycloak version to 26.7.1 and Keycloak Client version to 26.0.12
c6c9fbe fix: changing how connection closure is handled
88e7707 Initilize at runtime BC FIPS classes that embed Cleaner
4b2de67 Bump org.bouncycastle:bc-fips from 2.1.2 to 2.1.3
4065534 Bump org.bouncycastle:bc-jdk18on-bom from 1.84 to 1.85
Additional commits viewable in compare view

Updates io.quarkus.platform:quarkus-maven-plugin from 3.38.1 to 3.38.2

Commits

a158e24 [maven-release-plugin] prepare release 3.38.2
79af4a9 Merge pull request #2125 from quarkusio/quarkus-3.38.2
dd3c367 Merge pull request #2124 from quarkusio/update-automation/3.38-io.quarkiverse...
a864479 Ignore push event for Quarkus update pull requests
1d20f31 Upgrade to Quarkus 3.38.2
52bce9c Update io.quarkiverse.httpproblem to 3.38.2
9b036d2 Merge pull request #2121 from gsmet/fix-dbz-sync
7b122c1 Fix sync of Debezium
c3b0aae Merge pull request #2113 from quarkusio/update-automation/3.38-debezium-3.6.1...
4861be2 [maven-release-plugin] prepare for next development iteration
Additional commits viewable in compare view

Updates io.github.belgif.openapi:belgif-openapi-problem from 1.3.1 to 1.3.2

Release notes

Sourced from io.github.belgif.openapi:belgif-openapi-problem's releases.

Release v1.3.2
Changes:
Drop OpenAPI 2.0 support
Update examples:
Add href in issues of InputValidationProblem example in belgif/openapi-problem#21
Use JsonPointer format to reference invalid payload properties in belgif/openapi-problem#35

Commits

933d457 Use jsonpointer in example (#35)
e179f2b Bump io.github.belgif.rest.guide.validator:belgif-rest-guide-validator-maven-...
a5f78e3 Bump io.github.belgif.rest.guide.validator:belgif-rest-guide-validator-maven-...
b81ad5c Bump org.sonatype.central:central-publishing-maven-plugin
d8c65f8 Bump io.github.belgif.rest.guide.validator:belgif-rest-guide-validator-maven-...
1a5804a Bump io.github.belgif.rest.guide.validator:belgif-rest-guide-validator-maven-...
27fefa0 Bump io.github.belgif.rest.guide.validator:belgif-rest-guide-validator-maven-...
44eaec9 Bump io.github.belgif.rest.guide.validator:belgif-rest-guide-validator-maven-...
546ac0d Bump io.github.belgif.rest.guide.validator:belgif-rest-guide-validator-maven-...
ac25a1b Bump io.github.belgif.rest.guide.validator:belgif-rest-guide-validator-maven-...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the maven group with 6 updates: | Package | From | To | | --- | --- | --- | | [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.6.1` | `1.6.3` | | [io.quarkus.platform:quarkus-bom](https://github.com/quarkusio/quarkus-platform) | `3.38.1` | `3.38.2` | | io.quarkus:quarkus-extension-processor | `3.38.1` | `3.38.2` | | [io.quarkus:quarkus-extension-maven-plugin](https://github.com/quarkusio/quarkus) | `3.38.1` | `3.38.2` | | [io.quarkus.platform:quarkus-maven-plugin](https://github.com/quarkusio/quarkus-platform) | `3.38.1` | `3.38.2` | | [io.github.belgif.openapi:belgif-openapi-problem](https://github.com/belgif/openapi-problem) | `1.3.1` | `1.3.2` | Updates `ch.qos.logback:logback-classic` from 1.6.1 to 1.6.3 - [Release notes](https://github.com/qos-ch/logback/releases) - [Commits](qos-ch/logback@v_1.6.1...v_1.6.3) Updates `io.quarkus.platform:quarkus-bom` from 3.38.1 to 3.38.2 - [Commits](quarkusio/quarkus-platform@3.38.1...3.38.2) Updates `io.quarkus:quarkus-extension-processor` from 3.38.1 to 3.38.2 Updates `io.quarkus:quarkus-extension-maven-plugin` from 3.38.1 to 3.38.2 - [Release notes](https://github.com/quarkusio/quarkus/releases) - [Commits](quarkusio/quarkus@3.38.1...3.38.2) Updates `io.quarkus.platform:quarkus-maven-plugin` from 3.38.1 to 3.38.2 - [Commits](quarkusio/quarkus-platform@3.38.1...3.38.2) Updates `io.quarkus:quarkus-extension-processor` from 3.38.1 to 3.38.2 Updates `io.quarkus:quarkus-extension-maven-plugin` from 3.38.1 to 3.38.2 - [Release notes](https://github.com/quarkusio/quarkus/releases) - [Commits](quarkusio/quarkus@3.38.1...3.38.2) Updates `io.quarkus.platform:quarkus-maven-plugin` from 3.38.1 to 3.38.2 - [Commits](quarkusio/quarkus-platform@3.38.1...3.38.2) Updates `io.github.belgif.openapi:belgif-openapi-problem` from 1.3.1 to 1.3.2 - [Release notes](https://github.com/belgif/openapi-problem/releases) - [Commits](belgif/openapi-problem@v1.3.1...v1.3.2) --- updated-dependencies: - dependency-name: ch.qos.logback:logback-classic dependency-version: 1.6.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven - dependency-name: io.quarkus.platform:quarkus-bom dependency-version: 3.38.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven - dependency-name: io.quarkus:quarkus-extension-processor dependency-version: 3.38.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven - dependency-name: io.quarkus:quarkus-extension-maven-plugin dependency-version: 3.38.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven - dependency-name: io.quarkus.platform:quarkus-maven-plugin dependency-version: 3.38.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: maven - dependency-name: io.quarkus:quarkus-extension-processor dependency-version: 3.38.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven - dependency-name: io.quarkus:quarkus-extension-maven-plugin dependency-version: 3.38.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven - dependency-name: io.quarkus.platform:quarkus-maven-plugin dependency-version: 3.38.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: maven - dependency-name: io.github.belgif.openapi:belgif-openapi-problem dependency-version: 1.3.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: maven ... Signed-off-by: dependabot[bot] <support@github.com>

sonarqubecloud · 2026-08-17T18:48:31Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabotBot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 17, 2026

github-actionsBot approved these changes Aug 17, 2026
View reviewed changes

github-actionsBot enabled auto-merge (squash) August 17, 2026 18:37

github-actionsBot merged commit e2985f4 into mainAug 17, 2026
4 checks passed

github-actionsBot deleted the dependabot/maven/maven-9d9c9818d8 branch August 17, 2026 18:48

Navigation Menu

Uh oh!

Bump the maven group with 6 updates - #361

Bump the maven group with 6 updates#361
github-actions[bot] merged 1 commit into
mainfrom
dependabot/maven/maven-9d9c9818d8

dependabotBot commented on behalf of githubAug 17, 2026

Uh oh!

sonarqubecloudBot commented Aug 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabotBot commented on behalf of githubAug 17, 2026

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

Logback 1.6.2

2026-08-10 Release of logback version 1.6.2

3.38.2

Complete changelog

3.38.2

Complete changelog

Release v1.3.2

Uh oh!

sonarqubecloudBot commented Aug 17, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants