[dependabot]

Bumps the all-deps group with 5 updates:

Package	From	To
org.codehaus.mojo:versions-maven-plugin	2.22.0	2.23.0
org.apache.kafka:kafka-clients	4.3.1	4.4.0
com.github.ben-manes.caffeine:caffeine	3.3.0	3.3.1
io.rest-assured:rest-assured	6.0.1	6.1.0
net.bytebuddy:byte-buddy	1.18.14	1.18.15

Updates org.codehaus.mojo:versions-maven-plugin from 2.22.0 to 2.23.0

Release notes

Sourced from org.codehaus.mojo:versions-maven-plugin's releases.

2.23.0

Versions Maven Plugin 2.23.0 makes the property goals more reliable on multi-module projects and adds a few options people have asked for over the years. It still runs on Java 8 and Maven 3.6.3 or later.

Property updates

• update-property and update-properties now update a property that is defined in a reactor parent POM, rather than leaving it untouched (#997).
• A property shared by a plugin and an excluded dependency is no longer updated behind the exclude's back (#1199).
• The property goals look up all properties in parallel, which shortens runs on POMs with many version properties (#1157).
• A dependency whose type or classifier is itself a property, such as ${native.classifier}, no longer breaks the property goals on Maven 3.10 and 4 (#1409).
• lock-snapshots and unlock-snapshots now rewrite snapshot versions held in properties, where that is safe (#1269).

Other fixes and additions

• versions:set with selected projects (-pl) updates the modules that inherit the version again, on Maven 3 and Maven 4 (#1338, #1339, #1357).
• Includes and excludes now filter the candidate versions too, so an excluded version is never proposed as an update (#1378).
• display-dependency-updates -Dversions.showNewestPerSegment lists the newest incremental, minor and major version, for example 1.0.3 -> 1.0.9, 1.3.9, 4.0.6 (#1043).
• parent-updates-report supports formats, including XML (#975), and the XML property updates report now fills in the current version (#976).
• The plugin update reports share their lookup with display-plugin-updates and include plugins declared only in <reporting> (#1250).

Thanks to @​wilx and @​adityaanikam for their contributions to this release.

🚀 New features and improvements

• Resolve property versions in parallel (#1447, fixes #1157) @​slachiewicz
• Show the newest version of each segment in display-dependency-updates (#1450, fixes #1043) @​slachiewicz
• Lock and unlock snapshot versions held in properties (#1451, fixes #1269) @​slachiewicz
• Support the xml format in parent-updates-report (#1446, fixes #975) @​slachiewicz
• Share plugin discovery and version lookup between display and reports (#1397, fixes #1250) @​wilx

🐛 Bug Fixes

• Update properties defined in a reactor parent POM (#1448, fixes #997) @​slachiewicz
• Honor the excludes of modules that use an inherited property (#1449, fixes #1199) @​slachiewicz
• Restore versions:set propagation with selected projects (#1440, fixes #1338, #1339, #1357) @​wilx
• Apply excludes and includes to candidate versions, not just the current one (#1441, fixes #1378) @​adityaanikam
• Report the property's current version in the XML property updates report (#1437, fixes #976) @​slachiewicz
• Interpolate the type and classifier of dependencies whose version is a property (#1436, fixes #1409) @​slachiewicz

📝 Documentation updates

• Rewrite the README and add AGENTS.md (#1435) @​slachiewicz

👻 Maintenance

• Use localhost coordinates instead of real artifacts in the compare-dependencies fixtures (#1443) @​slachiewicz
• Delete the two integration tests that never ran (#1442) @​slachiewicz
• Move it-resolve-ranges-001 and it-unlock-snapshots-001 to unit tests (#1439) @​slachiewicz
• Run use-releases in it-use-releases-issue-134 (#1433) @​slachiewicz
• Write the remaining verify scripts as assertions (#1431) @​slachiewicz
• Move the tests of versions-common and versions-enforcer off Hamcrest (#1430) @​slachiewicz

... (truncated)

Commits

• 701cf76 [maven-release-plugin] prepare release 2.23.0
• 05854d0 Mark the API added since 2.22.0 as @​since 2.23.0
• a8fac27 Prepare 2.23.0
• 58a2ea5 Resolve property versions in parallel
• 4a89885 Update a shared parent POM from one module at a time
• 2230fbe Update properties defined in a reactor parent POM
• b495844 Honor excludes of modules that inherit an update-properties property
• 3330666 Show the newest version of each segment in display-dependency-updates
• fe0be9a Rewrite timestamped and SNAPSHOT versions held in properties in unlock-snapsh...
• bfb8f3a Support the xml format in parent-updates-report
• Additional commits viewable in compare view

Updates org.apache.kafka:kafka-clients from 4.3.1 to 4.4.0

Updates com.github.ben-manes.caffeine:caffeine from 3.3.0 to 3.3.1

Release notes

Sourced from com.github.ben-manes.caffeine:caffeine's releases.

3.3.1

• Added a workaround for ForkJoinPool queue corruption caused by resubmitting a reusable ForkJoinTask (#2021)
• Improved JCache read performance when using access expiration
• Fixed various minor issues found using AI audits

Commits

• aabb242 record the prefix-cache and warm-up findings
• 0117302 stop JCache access expiry from writing every hit
• 27fc6b8 skip rewriting an unchanged deadline on a read
• 7f87a7e restore coverage lost to recent fixes
• 75e2dc0 minor polish
• 5155a5a use nullRef() for null futures rejected by NullAway's generic inference (#2023)
• 998978c Avoid reusing a ForkJoinTask for maintenance (fixes #2021)
• 6999bfd add the Qwen Bailian prefix-cache traces
• 76dcbb5 fix canary test races and misc cleanups
• 7f46a43 pad the eviction sizes off the hit path's lines
• Additional commits viewable in compare view

Updates io.rest-assured:rest-assured from 6.0.1 to 6.1.0

Changelog

Sourced from io.rest-assured:rest-assured's changelog.

Changelog 6.1.0 (2026-10-09)

• Strip sensitive headers (Authorization and Cookie) when a redirect crosses to a different host, so a token or session isn't leaked to the redirect target. This is on by default and can be turned off with RedirectConfig.stripSensitiveHeadersOnCrossHostRedirect(false) (#1873). Thanks to the University of Sydney security research team (Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu) for the report.
• Fix JsonPath "properties" spread over a list of objects returning null when the first element lacks a "properties" key (e.g. a GeoJSON feature carrying only a geometry), a regression from the Groovy 5 migration (fixes #1875) (thanks to HDPark95 for PR #1878). Thanks to haskiindahouse for the report.
• Fix JsonPath returning null or Groovy meta-data for a nested "properties" navigation over a list of objects (e.g. items.properties.properties.x) on Groovy 5, because the list spread result was a plain list instead of the proxy list that carries the "properties" workaround forward (fixes #1879) (thanks to kdelay for PR #1880)
• Fix JsonPath returning -Infinity for finite negative JSON numbers whose magnitude exceeds Float.MAX_VALUE under the default FLOAT_AND_DOUBLE number configuration. The float/double selection compared the signed value against Float.MAX_VALUE, so any such negative number fell into the float branch and overflowed; it now compares the magnitude and promotes to double regardless of sign (fixes #1874) (thanks to kdelay for PR #1877). Thanks to haskiindahouse for the report.
• Decode JSON responses without an explicit charset as UTF-8 also when the content-type has parameters (e.g. "application/json; version=1") or is a "+json" type (e.g. "application/problem+json", "application/hal+json"). These used to fall back to the default content charset, which garbled non-ASCII characters in the body and in logged responses (related to #1885)
• Fix MalformedURLException when a request URL has no slash before a query string that contains another URL, e.g. get("https://example.com?redirect=https://example.com/callback") (fixes #1836) (thanks to renechoi for PR #1881)
• Apply user-configured SSL settings (such as relaxed HTTPS validation, trust/key stores and certificate authentication) when an http request is redirected to https. Previously they were only applied if the original request used https, so the redirected request failed with "PKIX path building failed". For a request that starts as http the SSL settings are only applied when REST Assured's default http client factory is used, so an https scheme registered by a custom HttpClientConfig.httpClientFactory is kept (fixes #790)
• Don't let request specific SSL settings (SSLConfig such as relaxed HTTPS validation, or certificate authentication) leak into later requests when the http client instance is reused (HttpClientConfig.reuseHttpClientInstance()). The client's original https scheme is restored after each request and https connections established with request specific SSL settings are no longer kept alive for reuse.
• json-schema-validator now supports JSON Schema draft-06, draft-07, 2019-09 and 2020-12 (e.g. const, if/then/else, propertyNames, prefixItems, $defs) using the networknt json-schema-validator (com.networknt:json-schema-validator 2.0.8, which is now a dependency of the module, together with slf4j-api). The draft is taken from the "$schema" keyword of the schema, so draft-03/draft-04 schemas are validated exactly as before. Schemas without "$schema" are still validated as draft-04 unless another version is configured, e.g. matchesJsonSchemaInClasspath("schema.json").using(JsonSchemaVersion.DRAFT_2020_12) or JsonSchemaValidatorSettings.schemaVersion(..). Note that: (1) schemas that already declared a draft-06+ "$schema" were previously validated with draft-04 semantics (newer keywords were ignored) and are now validated according to their declared draft, (2) a configured JsonSchemaFactory and checkedValidation only apply to draft-03/draft-04 schemas, (3) "format" is annotation-only (not validated) in 2019-09 and 2020-12, as required by those specifications (fixes #1823)
• Add ResponseSpecBuilder.expectHeader(String, ResponseAwareMatcher) and ResponseSpecification.header(String, ResponseAwareMatcher), so a reusable response specification can match a header against a value taken from the response, e.g. expectHeader("Location", response -> endsWith("/users/" + response.path("id"))) (fixes #1884) (thanks to seethinajayadileep for PR #1887)
• java.time values (LocalDate, Instant, OffsetDateTime, Duration, ZoneId and so on) used as path, query or form parameters, headers or cookies are now sent as their ISO-8601 toString() instead of being run through the object mapper, which quoted them or failed without the JSR-310 module (fixes #1781) (thanks to seethinajayadileep for PR #1888)
• A value object used as a parameter, header or cookie value that the object mapper serializes to a plain JSON string (for example a record with a @​JsonValue accessor) is now sent without the surrounding JSON quotes (fixes #1818)
• Add support for the HTTP QUERY method (a safe, idempotent method that carries a request body), e.g. given().body(..).when().query("/search"). Method.QUERY and query(..) overloads are added to RestAssured, RequestSender/RequestSpecification, RestAssuredMockMvc and RestAssuredWebTestClient (fixes #1872)
• Fix path parameters in the Spring WebTestClient module: an unnamed path parameter that isn't a String, e.g. get("/posts/{id}", 42L), no longer fails with a ClassCastException and is serialized the same way as a named path parameter, and path parameter values are no longer encoded twice, so a value such as "John Doe" or "100%" reaches the server unchanged instead of as "John%20Doe" or "100%25" (fixes #1824) (thanks to hantsy for PR #1825)
• Fix failures when the default locale is Turkish (tr-TR), such as an exception for every response with status code 400 or above and OPTIONS requests sent from a filter or HTTP methods given in lower case, e.g. request("options", ..), not working, by using Locale.ROOT for internal upper and lower case conversions. Cookie.toString() now also formats the Expires attribute as "EEE, dd MMM yyyy HH:mm:ss zzz" in English instead of using the default locale's short date format (thanks to rdmrtn for PR #1889)
• MultiPartSpecBuilder.charset(Charset) now rejects byte[] and InputStream content with an IllegalArgumentException, like charset(String) already did, instead of silently ignoring the charset (fixes #1691) (thanks to seethinajayadileep for PR #1886)
• Fix XmlPath and JsonPath not handling a hyphenated element or key name combined with a negative (from-the-end) list index, e.g. "root.some-list[-1]". XmlPath threw "The parameter ... was used but not defined" and JsonPath returned null (fixes #1876) (thanks to kdelay for PR #1882)
• Fix unnamed path parameters in the Spring MockMvc module not being serialized like named ones, so a value object such as a record with a @​JsonValue accessor passed by position, e.g. get("/users/{id}", new Id(42)), was sent as its toString() ("Id[42]") instead of its serialized value ("42"). Note that, as for named path parameters, any other object that isn't a simple value (number, string, boolean, enum, UUID, java.time value etc) passed by position is now serialized by the object mapper instead of using its toString(). In both the Spring MockMvc and WebTestClient modules this also works for multipart requests, since unnamed path parameters are serialized using the explicitly set content type, like named ones, and not the derived "multipart/form-data" (fixes #1905)
• Fix query parameters in the Spring WebTestClient module not reaching the server as given: a value containing "+", "&", "=" or "{...}", e.g. queryParam("name", "a+b"), was received as "a b", truncated at "&" or failed as a missing URI variable. Query parameters, as well as params and form params that are added to the query string, are now strictly encoded (so reserved characters such as "!" or "," in a value are now sent percent-encoded), and a query parameter without a value, e.g. queryParam("flag"), is sent as "flag" instead of the name of an internal class (fixes #1904)
• The charset given to MultiPartSpecBuilder.charset(..) is now sent in the Content-Type of a File multi-part (e.g. "text/plain; charset=UTF-8"). Previously it was silently ignored for File content and only applied to String content. Other parameters of the part mime-type (e.g. "application/xml; version=2") are now also kept when a charset is specified, instead of being dropped (fixes #1903)
• Fix XmlPath and JsonPath not handling a list range with a negative end that is followed by more path, e.g. "root.some-list[0..-1].sub-el" or "list[-2..-1].x". The dots in the range were treated as path separators, so XmlPath threw "The parameter ... was used but not defined" (or a Groovy compilation error) and JsonPath returned null or failed. JsonPath now also supports a range on a root array, e.g. "[0..1].x", and chained indexes after a hyphenated name, e.g. "some-list[0][1].x" (fixes #1906)

Commits

• 7765379 [maven-release-plugin] prepare release rest-assured-6.1.0
• a52e86f [ci skip] Preparing changelog for release
• d9e1a3e Serialize unnamed path params like named ones in MockMvc (#1910)
• a78ec80 Strictly encode query parameters in WebTestClient (#1908)
• 549260a Send the multipart charset in the Content-Type of File parts (#1909)
• 9335c59 Handle list ranges with a negative end followed by more path in XmlPath and J...
• 88410f2 Support non-string path params and stop double encoding in WebTestClient (#1902)
• 1437357 Use a fixed locale for case conversions so REST Assured works under Turkish l...
• ffe66bb Validate charset in MultiPartSpecBuilder.charset(Charset) (#1900)
• 9db3677 Escape hyphenated XmlPath and JsonPath names with a negative list index (#1899)
• Additional commits viewable in compare view

Updates net.bytebuddy:byte-buddy from 1.18.14 to 1.18.15

Changelog

Sourced from net.bytebuddy:byte-buddy's changelog.

Byte Buddy release notes

Commits

• f2dffef [publish] Releasing Byte Buddy 1.18.15
• 7af339e [release] Release new version
• 74b23dc Update ASM.
• 807fb56 Remove the sigstore dry run from the build pipeline.
• 2efd25c Break the build on binary incompatibility again.
• 29a92ee Update internal Byte Buddy and release notes.
• b6ebdb3 [publish] Start next development iteration 1.18.15-SNAPSHOT
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud