[dependabot]

Bumps the dependencies group with 1 update in the / directory: com.gradle:develocity-gradle-plugin.

Updates com.gradle:develocity-gradle-plugin from 4.4.1 to 4.6.1

Bumps the dependencies group with 6 updates in the /core directory:

Package	From	To
com.google.guava:guava	33.3.1-jre	33.7.2-jre
org.yaml:snakeyaml	2.6	2.7
org.junit.platform:junit-platform-launcher	1.14.3	1.14.4
org.junit.jupiter:junit-jupiter	5.13.4	5.14.4
redis.clients:jedis	7.4.1	8.0.2
com.rabbitmq:amqp-client	5.35.0	5.37.0

Updates com.google.guava:guava from 33.3.1-jre to 33.7.2-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.2

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.2-jre</version>
  <!-- or, for Android: -->
  <version>33.7.2-android</version>
</dependency>

Jar files

• 33.7.2-jre.jar
• 33.7.2-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.2-jre
• 33.7.2-android

JDiff

• 33.7.2-jre vs. 33.7.1-jre
• 33.7.2-android vs. 33.7.1-android
• 33.7.2-android vs. 33.7.2-jre

Changelog

• collect: Changed MapMaker, CompactHashMap, and CompactHashSet deserialization to avoid eagerly allocating as much memory as a serialization payload requests (CVE-2026-102554). (a0d0c36432)

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

... (truncated)

Commits

• See full diff in compare view

Updates org.yaml:snakeyaml from 2.6 to 2.7

Updates org.junit.platform:junit-platform-launcher from 1.14.3 to 1.14.4

Commits

• See full diff in compare view

Updates org.junit.jupiter:junit-jupiter from 5.13.4 to 5.14.4

Release notes

Sourced from org.junit.jupiter:junit-jupiter's releases.

JUnit 5.14.4 = Platform 1.14.4 + Jupiter 5.14.4 + Vintage 5.14.4

See Release Notes.

Full Changelog: junit-team/junit-framework@r5.14.3...r5.14.4

JUnit 5.14.3 = Platform 1.14.3 + Jupiter 5.14.3 + Vintage 5.14.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r5.14.2...r5.14.3

JUnit 5.14.2 = Platform 1.14.2 + Jupiter 5.14.2 + Vintage 5.14.2

See Release Notes.

New Contributors

• @​uglide made their first contribution in junit-team/junit-framework#5245

Full Changelog: junit-team/junit-framework@r5.14.1...r5.14.2

JUnit 5.14.1 = Platform 1.14.1 + Jupiter 5.14.1 + Vintage 5.14.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r5.14.0...r5.14.1

JUnit 5.14.0 = Platform 1.14.0 + Jupiter 5.14.0 + Vintage 5.14.0

See Release Notes.

Full Changelog: junit-team/junit-framework@r5.13.4...r5.14.0

JUnit 5.14.0-RC1 = Platform 1.14.0-RC1 + Jupiter 5.14.0-RC1 + Vintage 5.14.0-RC1

See Release Notes.

Full Changelog: junit-team/junit-framework@r5.13.4...r5.14.0-RC1

Commits

• 096fd69 Release 5.14.4
• 11fd02b Remove JDK 24 (EOL)
• 5b7f023 Fix integration tests on JDK 27
• 18f842a Test against JDK 26 (GA) and JDK 27 (EA)
• a5bf336 Polish 5.14.4 release notes
• 7667c14 Fix race condition in NodeTestTask (#5427)
• ac01f2d Include full display name in legacy XML reports (#5524)
• fbd4a8e Include class template invocation index in legacy reporting names
• 7d6f0c0 Only check PDF for GA releases
• 14f534d Test 5.14.x against JDK 25 ga (#5623)
• Additional commits viewable in compare view

Updates redis.clients:jedis from 7.4.1 to 8.0.2

Release notes

Sourced from redis.clients:jedis's releases.

8.0.2

Jedis 8.0.2 is a maintenance release for the 8.0 line, fixing MultiDbClient failover so it recovers to a healed database and keeps health checks running when no failover candidate is available.

Changes

🐛 Bug Fixes

• Fail over to a recovered database when the active one is inoperable (#4774)
• Keep MultiDbClient health checks alive when failover has no candidate (#4759)

🧰 Maintenance

• Document that automatic recovery is not guaranteed after the permanent failure (#4776)
• Update failover.md and some javadoc (#4772)

Contributors

We'd like to thank all the contributors who worked on this release!

@​ggivo

Full Changelog: redis/jedis@v8.0.1...v8.0.2

8.0.1

Jedis 8.0.1 is a maintenance release for the 8.0 line, fixing stale cluster topology after failover in JedisCluster.

Changes

🐛 Bug Fixes

• Refresh primaryNodesCache in JedisClusterInfoCache.discoverClusterSlots (#4692, backported in #4694)

Contributors

We'd like to thank all the contributors who worked on this release!

@​insaf021

Full Changelog: redis/jedis@v8.0.0...v8.0.1

8.0.0

Jedis 8.0.0 completes the client class consolidation started in 7.0.0, modernizes protocol defaults, tightens security defaults, and adds command coverage for Redis 8.8 and the Redis 8.10 preview.

• RESP3 auto-negotiation on by default for all UnifiedJedis-based clients (with graceful RESP2 fallback)
• Final removal of legacy JedisPooled / JedisSentineled classes in favor of the RedisClient family introduced in 7.0.0
• Removal of deprecated UnifiedJedis public constructors
• Internal refactoring that affects users of low-level extension points (custom CommandExecutor, Transaction subclasses, ClusterPipeline, CommandObjects) — protocol and connection wiring is now explicit at construction time
• Search modernization — the low-level cursor APIs are superseded by ftAggregateIterator(), and the manual broadcast API is removed (Redis 8.0+ broadcasts FT.CREATE server-side)
• TLS hostname verification enforced by default in DefaultJedisSocketFactory
• New Redis 8.8 command coverage — XNACK, JSON.SET FPHA, Array commands, INCREX, COUNT aggregator on ZINTER / ZUNION(STORE) and their *STORE variants, multi-aggregator TS.RANGE / TS.MRANGE, plus an experimental COLLECT parameter for FT.AGGREGATE
• Redis 8.10 command coverage — HIMPORT (Hinted Hash Templates), FT.ALIASLIST, MAXCOUNT / MAXSIZE on XREAD and XREADGROUP, SUNIONCARD / SDIFFCARD, LMOVEM / BLMOVEM, TS.READ, TS.NRANGE / TS.NREVRANGE, TS.QUERYLABELS, and EXCLUDEEMPTY on TS.MRANGE / TS.MREVRANGE

... (truncated)

Changelog

Sourced from redis.clients:jedis's changelog.

Release Process

Releases are drafted automatically by Release Drafter and deployed by the Release workflow when a draft is published.

Branches

Branch	Hosts	Example
master	next minor or major	8.1.0-SNAPSHOT
MAJOR.x	MAJOR.0.PATCH	7.x, 8.x
MAJOR.MINOR.x	MAJOR.MINOR.PATCH	7.5.x, 8.1.x

• Minor and major releases, including betas, are tagged on master.
• Patch releases are tagged on their maintenance branch, never on master.
• A maintenance branch is cut from the GA tag commit (8.1.x from v8.1.0).
• Fixes land on master first and are backported with a PR titled Backport #<pr> to <line>: <original title>, carrying the original labels.

How the draft is produced

On every push to master or a maintenance branch, Release Drafter updates one draft per branch:

• Version is derived from the nearest GA tag reachable from the branch, ignoring prerelease tags: patch bump on maintenance branches, minor bump on master. Example: 8.x at v8.0.1 drafts 8.0.2; master at v8.0.0 drafts 8.1.0.
• Changes are the pull requests merged to the branch since the latest GA release published from that branch. For the first patch after a branch is cut, the GA tag's commit date is used as the cutoff instead.
• Betas are prereleases and are not used as a base, so GA notes are cumulative since the previous GA.
• PRs labeled skip-changelog or churn are excluded. Unlabeled PRs appear uncategorized, so label backports.

Publishing

1. Review the draft on the Releases page and edit the notes if needed.
2. Publish from the draft. This keeps the release target on the right branch, which the next draft on that branch depends on. Do not create releases from the tag page.
3. For a patch of an older line, untick Set as the latest release.
4. Publishing creates the tag and triggers the Release workflow, which sets the Maven version from the tag and deploys to Maven Central.

Major releases and betas are not derived automatically. Run the workflow

... (truncated)

Commits

• eb8cd65 Backport #4777 to 8.0.x: Draft releases from maintenance branches (#4778)
• d18e256 Backport #4771 to 8.0.x: Document that automatic recovery is not guaranteed a...
• 53fecac Backport #4765 to 8.0.x: Fail over to a recovered database when the active on...
• b7f5067 Backport #4745 to 8.0.x: Update failover.md and some javadoc (#4772)
• af815c5 Backport #4756 to 8.0.x: Keep MultiDbClient health checks alive when failover...
• 96450d3 Bump snapshot version to 8.0.2 (#4715)
• 50ec1c8 Backport #4692 to 8.0.x: refresh primaryNodesCache in JedisClusterInfoCache.d...
• 36135a0 Point snapshot example at 8.0.1-SNAPSHOT on the 8.x branch
• 2de1a6d List Redis 8.6, 8.8 and 8.10 as supported in README
• fcf59cd Update version references in README and docs for 8.0.0
• Additional commits viewable in compare view

Updates com.rabbitmq:amqp-client from 5.35.0 to 5.37.0

Release notes

Sourced from com.rabbitmq:amqp-client's releases.

5.37.0

Changes between 5.36.0 and 5.37.0

This is a maintenance release with a bug fix, a usability improvement, and dependency upgrades. It is compatible with 5.36.0. All users are encouraged to upgrade.

Harden (deprecated) JSON reader

GitHub PR: #2100

Set preferred TLS protocol to version 1.3

GitHub issue: #2098

Bump dependencies

GitHub issue: #2093

Dependency

Maven

<dependency>
  <groupId>com.rabbitmq</groupId>
  <artifactId>amqp-client</artifactId>
  <version>5.37.0</version>
</dependency>

Gradle

compile 'com.rabbitmq:amqp-client:5.37.0'

5.36.0

Changes between 5.35.0 and 5.36.0

This is a maintenance release with bug fixes and dependency upgrades. It is compatible with 5.35.0. All users are encouraged to upgrade.

Do not enable hostname verification in useTlsWithNoVerification

GitHub PR: #2081

Be more defensive when parsing shortstr values in tables

GitHub PR: #2065

Bump dependencies

... (truncated)

Commits

• 0027775 [maven-release-plugin] prepare release v5.37.0
• 0f40842 Set release version to 5.37.0
• a93de83 Merge pull request #2107 from rabbitmq/dependabot/maven/v5.x/com.diffplug.spo...
• a544309 Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.2 to 3.10.3
• b47f881 Merge pull request #2104 from rabbitmq/dependabot/maven/v5.x/org.mockito-mock...
• 50b27c5 Bump org.mockito:mockito-core from 5.23.0 to 5.24.0
• 2a374aa Merge pull request #2102 from rabbitmq/dependabot/maven/v5.x/com.fasterxml.ja...
• 2d7a009 Bump com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.3
• a1f294a ci: use Erlang 28 alphas for 4.4
• b5572cf ci: test on Ubuntu 26.04
• Additional commits viewable in compare view

Bumps the dependencies group with 2 updates in the /modules/activemq directory: org.apache.activemq:activemq-client and org.apache.activemq:artemis-jakarta-client.
Bumps the dependencies group with 3 updates in the /modules/azure directory: com.squareup.okhttp3:okhttp, com.azure:azure-sdk-bom and com.microsoft.sqlserver:mssql-jdbc.
Bumps the dependencies group with 3 updates in the /modules/clickhouse directory: com.clickhouse:client-v2, com.clickhouse:clickhouse-r2dbc and com.clickhouse:clickhouse-jdbc.
Bumps the dependencies group with 1 update in the /modules/cockroachdb directory: org.postgresql:postgresql.
Bumps the dependencies group with 2 updates in the /modules/couchbase directory: com.squareup.okhttp3:okhttp and com.couchbase.client:java-client.
Bumps the dependencies group with 1 update in the /modules/cratedb directory: org.postgresql:postgresql.
Bumps the dependencies group with 1 update in the /modules/databend directory: com.databend:databend-jdbc.
Bumps the dependencies group with 1 update in the /modules/elasticsearch directory: org.elasticsearch.client:elasticsearch-rest-client.
Bumps the dependencies group with 1 update in the /modules/gcloud directory: com.google.cloud:libraries-bom.
Bumps the dependencies group with 8 updates in the /modules/hivemq directory:

Package	From	To
org.apache.commons:commons-lang3	3.20.0	3.21.0
commons-io:commons-io	2.21.0	2.22.0
org.javassist:javassist	3.32.0-GA	3.33.0-GA
org.jboss.shrinkwrap:shrinkwrap-api	1.2.6	2.0.0.Final
org.jboss.shrinkwrap:shrinkwrap-impl-base	1.2.6	2.0.0.Final
com.hivemq:hivemq-extension-sdk	4.50.0	4.56.1
com.hivemq:hivemq-mqtt-client	1.3.15	1.4.1
ch.qos.logback:logback-classic	1.5.37	1.6.6

Bumps the dependencies group with 1 update in the /modules/kafka directory: org.apache.kafka:kafka-clients.
Bumps the dependencies group with 1 update in the /modules/localstack directory: software.amazon.awssdk:bom.
Bumps the dependencies group with 1 update in the /modules/milvus directory: io.milvus:milvus-sdk-java.
Bumps the dependencies group with 1 update in the /modules/mongodb directory: org.mongodb:mongodb-driver-sync.
Bumps the dependencies group with 2 updates in the /modules/mssqlserver directory: com.microsoft.sqlserver:mssql-jdbc and io.r2dbc:r2dbc-mssql.
Bumps the dependencies group with 2 updates in the /modules/mysql directory: io.asyncer:r2dbc-mysql and com.mysql:mysql-connector-j.
Bumps the dependencies group with 1 update in the /modules/oceanbase directory: com.mysql:mysql-connector-j.
Bumps the dependencies group with 1 update in the /modules/openfga directory: dev.openfga:openfga-sdk.
Bumps the dependencies group with 1 update in the /modules/oracle-free directory: com.oracle.database.jdbc:ojdbc11.
Bumps the dependencies group with 1 update in the /modules/oracle-xe directory: com.oracle.database.jdbc:ojdbc11.
Bumps the dependencies group with 3 updates in the /modules/orientdb directory: com.orientechnologies:orientdb-client, org.apache.tinkerpop:gremlin-driver and com.orientechnologies:orientdb-gremlin.
Bumps the dependencies group with 1 update in the /modules/postgresql directory: org.postgresql:postgresql.
Bumps the dependencies group with 2 updates in the /modules/qdrant directory: io.qdrant:client and io.grpc:grpc-bom.
Bumps the dependencies group with 2 updates in the /modules/questdb directory: org.postgresql:postgresql and org.questdb:questdb.
Bumps the dependencies group with 1 update in the /modules/rabbitmq directory: com.rabbitmq:amqp-client.
Bumps the dependencies group with 2 updates in the /modules/scylladb directory: com.scylladb:java-driver-core and software.amazon.awssdk:dynamodb.
Bumps the dependencies group with 1 update in the /modules/tidb directory: com.mysql:mysql-connector-j.
Bumps the dependencies group with 1 update in the /modules/toxiproxy directory: redis.clients:jedis.
Bumps the dependencies group with 1 update in the /modules/trino directory: io.trino:trino-jdbc.
Bumps the dependencies group with 1 update in the /modules/weaviate directory: io.weaviate:client6.

Updates org.apache.activemq:activemq-client from 6.2.4 to 6.3.3

Release notes

Sourced from org.apache.activemq:activemq-client's releases.

Apache ActiveMQ 6.3.3

What's Changed

Full Changelog

Full Changelog: apache/activemq@activemq-6.3.2...activemq-6.3.3

Feature

• no new features on point release

Fixes

• [6.3.x] Improve GC checkpoint algorithm for empty durables (#2505) by @​cshannon in apache/activemq#2506
• [6.3.x] fix(jmx): avoid NPE in ConnectionView.getWireFormatInfo (#2270) by @​cshannon in apache/activemq#2515
• [6.3.x] fix: MQTTWireFormat rejecting valid 4-byte remaining lengths (#2517) by @​cshannon in apache/activemq#2521

Tasks

• [6.3.x] Post v6.3.2 release version update to 6.3.3-SNAPSHOT by @​mattrpav in apache/activemq#2507
• [6.3.x] Fix flaky TwoBrokerVirtualTopicSelectorAwareForwardingTest (link #2238) by @​jbonofre in apache/activemq#2626
• [6.3.x] Fix concurrent advisory message evaluation (#2519) (#2540) by @​cshannon in apache/activemq#2547
• [6.3.x] Fix nested values in MapMessage (#2672) by @​cshannon in apache/activemq#2673
• [6.3.x] Clear context write cache on ACL updates (#2685) by @​cshannon in apache/activemq#2687
• [6.3.x] Validate Subscription key length in KahaDB (#2686) by @​cshannon in apache/activemq#2689
• [6.3.x] Ensure subscriptions are cleaned up on failure (#2680) by @​cshannon in apache/activemq#2691
• [6.3.x] Ensure TransportConnection validates connection id (#2682) by @​cshannon in apache/activemq#2693
• [6.3.x] LDAP hardening (#2695) by @​mattrpav in apache/activemq#2703
• [6.3.x] #2583 Transacted fire-after-commit first exception exits loop prema… by @​mattrpav in apache/activemq#2716
• [6.3.x] #2583 Duplicate message publish during failover leads to incorrect … by @​mattrpav in apache/activemq#2717
• [6.3.x] #2434 Avoid per-command MDC add+remove in TransportConnection.servi… by @​mattrpav in apache/activemq#2719
• [6.3.x] #2436 Fix SizeStatisticImpl.addSize on isEnabled like CountStatisti… by @​mattrpav in apache/activemq#2718
• [6.3.x] Tighten default Jolokia access policy and bind the web console to loo… by @​mattrpav in apache/activemq#2721
• [6.3.x] fix(console): fix NPE in AbstractJmxCommand and AbstractCommand.handl… by @​mattrpav in apache/activemq#2720

Dependency updates

• [6.3.x] bump org.apache.felix:maven-bundle-plugin from 6.1.0 to 6.1.2 by @​dependabot[bot] in apache/activemq#2514
• [6.3.x] bump org.apache.ant:ant from 1.10.17 to 1.10.18 by @​dependabot[bot] in apache/activemq#2538
• [6.3.x] bump org.apache.groovy:groovy from 5.1.1 to 5.1.2 by @​dependabot[bot] in apache/activemq#2532
• [6.3.x] bump org.eclipse.jdt:ecj from 3.46.0 to 3.46.100 by @​dependabot[bot] in apache/activemq#2537
• [6.3.x] bump org.apache.groovy:groovy-ant from 5.1.1 to 5.1.2 by @​dependabot[bot] in apache/activemq#2530
• [6.3.x] bump jolokia-version from 2.6.1 to 2.6.2 by @​dependabot[bot] in apache/activemq#2536
• [6.3.x] bump com.h2database:h2 from 2.4.240 to 2.5.250 by @​dependabot[bot] in apache/activemq#2541
• [6.3.x] bump slf4j-version from 2.0.18 to 2.0.19 by @​dependabot[bot] in apache/activemq#2533
• [6.3.x] bump org.sonarsource.scanner.maven:sonar-maven-plugin from 5.7.0.6970 to 5.8.0.7211 by @​dependabot[bot] in apache/activemq#2560
• [6.3.x] bump netty-version from 4.2.17.Final to 4.2.18.Final by @​dependabot[bot] in apache/activemq#2565
• [6.3.x] bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 by @​dependabot[bot] in apache/activemq#2576
• [6.3.x] bump org.codehaus.mojo:taglist-maven-plugin from 3.2.2 to 3.2.3 by @​dependabot[bot] in apache/activemq#2571
• [6.3.x] bump org.codehaus.mojo:javacc-maven-plugin from 3.2.0 to 3.2.1 by @​dependabot[bot] in apache/activemq#2569
• [6.3.x] bump camel-version from 4.22.0 to 4.22.1 by @​dependabot[bot] in apache/activemq#2578
• [6.3.x] bump org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0 by @​dependabot[bot] in apache/activemq#2588
• [6.3.x] bump org.apache.groovy:groovy from 5.1.2 to 5.1.3 by @​dependabot[bot] in apache/activemq#2601
• [6.3.x] bump org.apache.groovy:groovy-ant from 5.1.2 to 5.1.3 by @​dependabot[bot] in apache/activemq#2597

... (truncated)

Commits

• 0369b45 [maven-release-plugin] prepare release activemq-6.3.3
• 9dec641 fix(console): fix NPE in AbstractJmxCommand and AbstractCommand.handleExcepti...
• 44f5ccc Tighten default Jolokia access policy and bind the web console to loopback (#...
• e0bdf00 #2436 Fix SizeStatisticImpl.addSize on isEnabled like CountStatisticImpl (#...
• 2bbecf7 #2434 Avoid per-command MDC add+remove in TransportConnection.service (#243...
• 3fe465d #2583 Duplicate message publish during failover leads to incorrect queue si...
• f0bc99b #2583 Transacted fire-after-commit first exception exits loop prematurely l...
• 46a1aa2 [6.3.x] bump jackson-version from 2.22.3 to 2.22.4 (#2722)
• 3496dc8 [6.3.x] bump org.ow2.asm:asm from 9.11 to 9.11.1 (#2708)
• 2f9bbf7 LDAP hardening (#2695) (#2703)
• Additional commits viewable in compare view

Updates org.apache.activemq:artemis-jakarta-client from 2.55.0 to 2.57.0

Updates com.squareup.okhttp3:okhttp from 5.4.0 to 5.5.1

Changelog

Sourced from com.squareup.okhttp3:okhttp's changelog.

Version 5.5.1

2026_10_22

• Fix: [Block 8 compromised eMudhra intermediate certificates][Mozilla_eMudhra]. Note that this update is not necessary for Android devices with Google Play Services as Google has issued an [automatic update][Google_eMudhra]. This change protects JVMs and AOSP devices that are exposed to the compromised certificates.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
</tr></table> 

... (truncated)

Commits

• be5151a Prepare for release 5.5.1.
• 6db9802 OkHttp 5.5.x: Blocklist 8 certificates for CVE-2026-111943 (#9805)
• a94bdf1 Prepare for release 5.5.0.
• ecc3b05 Use a fixed size for DoH request body (#9687)
• 9926082 Revert "Use a fixed size for DoH request body" (#9686)
• 0070c2e Use a fixed size for DoH request body
• 1576453 Order ServiceMetadata records per the spec (#9683)
• fb582e9 Flip wiring of Dns.SYSTEM (#9682)
• 4e884ab retryOnConnectionFailure doesn't impact ECH retries (#9681)
• 0433cee Only one contributing.md doc (#9678)
• Additional commits viewable in compare view

Updates com.azure:azure-sdk-bom from 1.2.32 to 1.3.9

Release notes

Sourced from com.azure:azure-sdk-bom's releases.

com.azure+azure-security-attestation_1.3.1

1.3.1 (2026-11-02)

Other Changes

Dependency Updates

• Upgraded azure-core from 1.60.0 to version 1.61.0.
• Upgraded nimbus-jose-jwt from 9.37.3 to version 9.37.4.

com.azure+azure-monitor-ingestion_1.3.1

1.3.1 (2026-11-02)

Other Changes

Dependency Updates

• Upgraded azure-core from 1.60.0 to version 1.61.0.
• Upgraded azure-core-http-netty from 1.16.8 to version 1.17.0.

com.azure+azure-identity-extensions_1.3.1

1.3.1 (2026-11-02)

Other Changes

Dependency Updates

• Upgraded azure-identity from 1.18.7 to version 1.19.0.

com.azure+azure-containers-containerregistry_1.3.1

1.3.1 (2026-11-02)

Other Changes

Dependency Updates

• Upgraded azure-core from 1.60.0 to version 1.61.0.
• Upgraded azure-core-http-netty from 1.16.8 to version 1.17.0.

com.azure+azure-communication-rooms_1.3.1

1.3.1 (2026-11-02)

Other Changes

Dependency Updates

... (truncated)

Commits

• d5b4973 Updating the SDK dependencies for azure-digitaltwins-core
• 18fe084 Reset changes to the patch version.
• 8ae8100 Increment package versions for openai releases (#35091)
• ababd85 [OpenAI] Update release date (#35085)
• 6421ba9 move the cleanup config to -SaveInputs parameter on the cli (#35088)
• f60e8e7 Reorganizing and consolidating samples (#35047)
• 8c91d3a Azure Monitor Ingestion: Add troubleshooting guide (#34944)
• be18200 Update patch_release_client.txt with ACS Email Library (#35083)
• 9063095 [OpenAI] Support for NonAzure OpenAI endpoint. (#35058)
• 7b20bee May eg release (#35084)
• Additional commits viewable in compare view

Updates com.microsoft.sqlserver:mssql-jdbc from 13.4.0.jre11 to 13.6.1.jre11

Release notes

Sourced from com.microsoft.sqlserver:mssql-jdbc's releases.

[13.6.0] Stable Release

Added

• Add FLOAT16 Vector Version Negotiation to the TVP Write Path #2997

  • What was added: Negotiated vector-version validation before writing VECTOR column metadata for table-valued parameters.
  • Who benefits: Applications sending vector columns through table-valued parameters.
  • Impact: Rejects all vectors on version 0 and FLOAT16 vectors on version 1 before data is written to the wire, with a clear driver error.

• Port Legacy FX Non-AE Test Scenarios to JUnit #3008

  • What was added: Forty-eight legacyFx-tagged JUnit tests covering previously unported non-Always-Encrypted functional scenarios.
  • Who benefits: Contributors and CI validation pipelines.
  • Impact: Improves regression coverage while advancing retirement of the legacy FX test suite.

• Add Cross-Driver Connection String Aliases for Unification #3011

  • What was added: Case-insensitive aliases for uid, trusted_connection, app, connectTimeout, columnEncryption, and quotedId, mapped to their canonical JDBC properties.
  • Who benefits: Applications sharing connection-string configuration across Microsoft data drivers.
  • Impact: Improves portability while preserving all existing JDBC property names and aliases.

• Add getCurrentApplicationName to PerformanceLogCallback #3018

  • What was added: A default getCurrentApplicationName() method that exposes the publishing connection's applicationName to performance callbacks.
  • Who benefits: Applications using connection pools and performance-event correlation.
  • Impact: Allows events to be associated with a pool or application without breaking existing callback implementations.

Changed

• Optimize MONEY, DECIMAL, and String Processing in the ResultSet Read Path #2991

  • What was changed: Removed intermediate allocations from MONEY/SMALLMONEY decoding, common BigDecimal encoding, short synchronous string reads, and NBCROW initialization.
  • Who benefits: Applications reading high-volume or wide result sets.
  • Impact: Reduces garbage-collection pressure and improves throughput while preserving decoded values and existing fallback behavior.

• Validate Reflective Class Names for Connection Properties #3004

  • What was changed: Added Java binary class-name validation before reflectively loading classes specified by properties such as socketFactoryClass and accessTokenCallbackClass.
  • Who benefits: Applications configuring custom callback, socket-factory, or related reflective classes.
  • Impact: Malformed class names now fail early with a dedicated driver error instead of producing confusing reflective-loading failures.

• Update Vector Tests for Server-Side FLOAT16/FLOAT32 Conversion #3005

  • What was changed: Updated and expanded vector tests for implicit and explicit conversion between FLOAT16 and FLOAT32 vector subtypes.
  • Who benefits: Contributors validating vector interoperability against servers supporting vector version 2.
  • Impact: Covers assignments, casts, conversions, bulk copy, routines, precision loss, nulls, and dimension mismatch behavior.

• Adjust License File to Enable GitHub Detection #3010

  • What was changed: Normalized the MIT license text formatting.
  • Who benefits: Repository users and automated tooling.
  • Impact: Enables GitHub to detect and display the repository license; there is no runtime impact.

• Suppress CodeQL False Positive for Protocol-Mandated MD5 #3014

  • What was changed: Documented and suppressed the CodeQL SM05136 finding for MD5 used by NTLM channel binding as required by MS-NLMP.
  • Who benefits: Contributors and security-scanning pipelines.
  • Impact: Reduces false-positive security findings without changing authentication behavior.

... (truncated)

Commits

• See full diff in compare view

Updates com.squareup.okhttp3:okhttp from 5.4.0 to 5.5.1

Changelog

Sourced from com.squareup.okhttp3:okhttp's changelog.

Version 5.5.1

2026_10_22

• Fix: [Block 8 compromised eMudhra intermediate certificates][Mozilla_eMudhra]. Note that this update is not necessary for Android devices with Google Play Services as Google has issued an [automatic update][Google_eMudhra]. This change protects JVMs and AOSP devices that are exposed to the compromised certificates.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
</tr></table> 

... (truncated)

Commits

• be5151a Prepare for release 5.5.1.
• 6db9802 OkHttp 5.5.x: Blocklist 8 certificates for CVE-2026-111943 (#9805)
• a94bdf1 Prepare for release 5.5.0.
• ecc3b05 Use a fixed size for DoH request body (#9687)
• 9926082 Revert "Use a fixed size for DoH request body" (#9686)
• 0070c2e Use a fixed size for DoH request body
• 1576453 Order ServiceMetadata records per the spec (#9683)
• fb582e9 Flip wiring of Dns.SYSTEM (#9682)
• 4e884ab retryOnConnectionFailure doesn't impact ECH retries (#9681)
• 0433cee Only one contributing.md doc (#9678)
• Additional commits viewable in compare view

Updates com.microsoft.sqlserver:mssql-jdbc from 13.4.0.jre11 to 13.6.1.jre11

Release notes

Sourced from com.microsoft.sqlserver:mssql-jdbc's releases.

[13.6.0] Stable Release

Added

• Add FLOAT16 Vector Version Negotiation to the TVP Write Path #2997

  • What was added: Negotiated vector-version validation before writing VECTOR column metadata for table-valued parameters.
  • Who benefits: Applications sending vector columns through table-valued parameters.
  • Impact: Rejects all vectors on version 0 and FLOAT16 vectors on version 1 before data is written to the wire, with a clear driver error.

• Port Legacy FX Non-AE Test Scenarios to JUnit #3008

  • What was added: Forty-eight legacyFx-tagged JUnit tests covering previously unported non-Always-Encrypted functional scenarios.
  • Who benefits: Contributors and CI validation pipelines.
  • Impact: Improves regression coverage while advancing retirement of the legacy FX test suite.

• Add Cross-Driver Connection String Aliases for Unification #3011

  • What was added: Case-insensitive aliases for uid, trusted_connection, app, connectTimeout, columnEncryption, and quotedId, mapped to their canonical JDBC properties.
  • Who benefits: Applications sharing connection-string configuration across Microsoft data drivers.
  • Impact: Improves portability while preserving all existing JDBC property names and aliases.

• Add getCurrentApplicationName to PerformanceLogCallback #3018

  • What was ad...

    Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9f1d9b71-f4a9-41be-be4f-fd54ad624456

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn