Skip to content

Bump the remaining-minor-updates group across 1 directory with 38 updates - #608

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/maven/develop/remaining-minor-updates-e33ff9518a
Open

Bump the remaining-minor-updates group across 1 directory with 38 updates#608
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/maven/develop/remaining-minor-updates-e33ff9518a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 15, 2026

Copy link
Copy Markdown

Bumps the remaining-minor-updates group with 38 updates in the / directory:

Package From To
org.bouncycastle:bcmail-jdk18on 1.86 1.87
org.bouncycastle:bcprov-jdk18on 1.86 1.87
org.bouncycastle:bcpkix-jdk18on 1.86 1.87
org.bouncycastle:bcprov-jdk18on 1.86 1.87
org.bouncycastle:bcpkix-jdk18on 1.86 1.87
com.fasterxml.jackson.core:jackson-databind 2.21.8 2.23.0
com.fasterxml.jackson.core:jackson-core 2.21.8 2.23.0
com.fasterxml.jackson.datatype:jackson-datatype-jsr310 2.21.8 2.23.0
com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations 2.21.8 2.23.0
com.fasterxml.jackson.dataformat:jackson-dataformat-yaml 2.21.8 2.23.0
com.fasterxml.jackson.core:jackson-annotations 2.21 2.23
com.fasterxml.jackson.core:jackson-core 2.21.8 2.23.0
com.fasterxml.jackson.datatype:jackson-datatype-jsr310 2.21.8 2.23.0
com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations 2.21.8 2.23.0
com.fasterxml.jackson.dataformat:jackson-dataformat-yaml 2.21.8 2.23.0
org.apache.commons:commons-lang3 3.21.0 3.22.0
com.google.guava:guava 33.7.2-jre 33.8.0-jre
com.google.code.gson:gson 2.14.0 2.15.0
org.operaton.bpm:operaton-engine 2.1.5 2.2.1
org.operaton.bpm:operaton-engine-spring 2.1.5 2.2.1
org.operaton.bpm.model:operaton-bpmn-model 2.1.5 2.2.1
org.operaton.bpm:operaton-engine-spring 2.1.5 2.2.1
org.operaton.bpm.model:operaton-bpmn-model 2.1.5 2.2.1
org.codehaus.mojo:buildnumber-maven-plugin 3.3.1 3.4.0
org.apache.maven.plugins:maven-enforcer-plugin 3.6.3 3.7.0
ca.uhn.hapi.fhir:hapi-fhir-structures-r4 8.4.2 8.12.1
ca.uhn.hapi.fhir:hapi-fhir-validation 8.4.2 8.12.1
ca.uhn.hapi.fhir:hapi-fhir-validation-resources-r4 8.4.2 8.12.1
ca.uhn.hapi.fhir:hapi-fhir-base 8.4.2 8.12.1
ca.uhn.hapi.fhir:hapi-fhir-converter 8.4.2 8.12.1
ca.uhn.hapi.fhir:hapi-fhir-client 8.4.2 8.12.1
ca.uhn.hapi.fhir:hapi-fhir-caching-api 8.4.2 8.12.1
ca.uhn.hapi.fhir:hapi-fhir-caching-caffeine 8.4.2 8.12.1
ca.uhn.hapi.fhir:hapi-fhir-structures-r5 8.4.2 8.12.1
ca.uhn.hapi.fhir:hapi-fhir-caching-api 8.4.2 8.12.1
ca.uhn.hapi.fhir:hapi-fhir-structures-r4 8.4.2 8.12.1
ca.uhn.hapi.fhir:hapi-fhir-validation 8.4.2 8.12.1
ca.uhn.hapi.fhir:hapi-fhir-validation-resources-r4 8.4.2 8.12.1
ca.uhn.hapi.fhir:hapi-fhir-caching-caffeine 8.4.2 8.12.1
ca.uhn.hapi.fhir:hapi-fhir-structures-r5 8.4.2 8.12.1
ca.uhn.hapi.fhir:hapi-fhir-validation-resources-r5 8.4.2 8.12.1
ca.uhn.hapi.fhir:hapi-fhir-structures-r5 8.4.2 8.12.1
ca.uhn.hapi.fhir:org.hl7.fhir.convertors 6.5.27 6.10.4
ca.uhn.hapi.fhir:org.hl7.fhir.r4 6.5.27 6.10.4
ca.uhn.hapi.fhir:org.hl7.fhir.r5 6.5.27 6.10.4
ca.uhn.hapi.fhir:org.hl7.fhir.utilities 6.5.27 6.10.4
ca.uhn.hapi.fhir:org.hl7.fhir.validation 6.5.27 6.10.4
ca.uhn.hapi.fhir:org.hl7.fhir.model 6.5.27 6.10.4
ca.uhn.hapi.fhir:org.hl7.fhir.support 6.5.27 6.10.4
ca.uhn.hapi.fhir:org.hl7.fhir.support 6.5.27 6.10.4
com.fasterxml.woodstox:woodstox-core 7.1.0 7.3.0
io.opentelemetry:opentelemetry-api 1.44.1 1.68.0
io.opentelemetry.instrumentation:opentelemetry-instrumentation-annotations 2.10.0 2.33.1
org.codehaus.woodstox:stax2-api 4.2.2 4.3.2
ca.uhn.hapi.fhir:hapi-fhir-validation-resources-r5 8.4.2 8.12.1

Updates org.bouncycastle:bcmail-jdk18on from 1.86 to 1.87

Changelog

Sourced from org.bouncycastle:bcmail-jdk18on's changelog.

Version 1.87

Release: 1.87
Date: 2026, 11th November.

Defects Fixed

  • PrivateKeyFactory, and so the ML-DSA and ML-KEM KeyFactory services, ignored the tag of the RFC 9881 / RFC 9935 private key CHOICE and applied no length checks, so mislabelled or inconsistent seed, expandedKey and both forms were accepted. Each form is now checked for its tag, exact lengths and consistency; the pre-RFC draft forms are still read.
  • X500Name.equals was quadratic in the number of RDNs for names that are equal but not byte-identical, and is reached from unverified CMS, TSP and S/MIME messages; the CMS signer and recipient stores could also be slowed with colliding ids. Name comparison is now n log n and the stores no longer hash their entries (CVE-2026-103611).
  • Tables keyed on ASN.1 object hash codes, which a sender can make collide - Extensions, X509Extensions, ExtendedKeyUsage, the CMS AttributeTable, the EST CSRAttributesResponse and the CMS digest algorithm sets - made parsing quadratic in the number of entries. They are now ordered maps and sets.
  • CMSSignedData digested the content once for every signer verified. Signers using the same digest algorithm now share one digest, and the new org.bouncycastle.cms.max_digest_algorithms property can bound the number of distinct digest algorithms computed over one message.
  • The verify side of the ML-DSA-CALCULATE-MU signature service, and MLDSASigner.verifyMu, did not absorb the message, so a correct mu was accepted only for an empty message, and the signer was left unusable afterwards. verifyMu now derives mu as generateMu does and compares in constant time.
  • KeyPairGenerator.getInstance("SM2", "BC") was built on the generic EC generator and could draw a private key of n - 1, which GB/T 32918.1 excludes. It now uses SM2KeyPairGenerator.
  • ESTResponse was quadratic in the number of repeated header lines, and a read limit only applied after the header block. Header values are now collected once and the header block counts against the read limit.
  • The C509 encoding of RFC 6955 proof-of-possession signature values and of the RFC 9883 privateKeyPossessionStatement attribute did not follow draft-ietf-cose-cbor-encoded-cert-21 and could not be reconstructed. Both now convert in each direction, and the draft-ietf-cose-c509-test-vectors-02 vectors drive the tests.
  • DANE SMIMEA support: JndiDANEFetcherFactory mangled the owner name of listed records so lookups failed, DANEEntryStore kept only one entry per owner name, and DANEEntrySelectorFactory mishandled addresses with a quoted local-part or no '@'. All three are corrected, and DANEEntry rejects a record that is not a full certificate entry.
  • TimeStampToken accepted a token whose signing-time attribute disagreed with the genTime in its TSTInfo. Such a token is now rejected (org.bouncycastle.tsp.allow_inconsistent_signing_time switches the check off), and TimeStampTokenGenerator sets signing-time from the genTime (CVE-2026-103615).
  • TimeStampToken.validate() accepted an MD5 message imprint and TSPAlgorithms.ALLOWED included MD5. MD5 is removed from ALLOWED, validate() rejects an imprint algorithm outside the allowed set, and TSPAlgorithms.LEGACY and org.bouncycastle.tsp.allowed_imprint_algorithms are provided for callers needing it (CVE-2026-103606).
  • CRL-based revocation checking mishandled a CRL entry reasonCode outside the RFC 5280 set: 11 left the certificate unrevoked and other values threw an unchecked exception. An undefined reasonCode is now processed as unspecified.
  • OERDefinition.enumItem(label, value) discarded the explicit enumerand value. The value is now kept and unnumbered items are numbered as X.680 sec. 20 specifies.
  • OERInputStream did not detect a stream ending inside an INTEGER or BIT STRING value, decoding the zero-padded buffer instead. Length-driven reads now fail with EOFException and do not allocate a declared length up front.
  • The OER codec encoded a signed INTEGER whose upper bound is exactly the maximum of a fixed-size word in the next word up; X.696 sec. 10.4 bounds are inclusive.
  • The ETSI TS 102 941 response code wrappers range-checked a truncated int value, so 2^32 was accepted as "ok". Out-of-range values are now rejected.
  • OERInputStream accepted an empty group of octets as zero in four places where X.696 requires at least one octet. Each now fails with an IOException.
  • OEROutputStream could not encode a CHOICE whose chosen alternative has a tag number of 63 or more.
  • OEROutputStream rejected a required SEQUENCE component as absent when it arrived wrapped in a defined OEROptional.
  • OERInputStream failed with a NullPointerException for an absent optional SEQUENCE component selected through a switch that has a default value.
  • OERInputStream truncated a SEQUENCE OF count to 32 bits. A count that does not fit in 31 bits is now rejected.
  • OERInputStream rejected a valid SEQUENCE OF on streams whose available() reported fewer bytes than the element count. The count is now bounded by the decoder's allocation ceiling instead.
  • OERInputStream could not decode a variable-size BIT STRING, and mis-sized a fixed one that is not a whole number of octets. Both forms of X.696 clause 13 are now decoded, and OERDefinition gains bitString() and bitString(lower, upper).
  • OEROutputStream wrote a negative INTEGER under a type with a non-negative lower bound as a different, positive value. It is now rejected.
  • OERInputStream.uint64() read its value as signed; it now reads unsigned.
  • The OER codec treated an INTEGER with a positive lower bound as signed, where X.696 sec. 10.2 gives it the unsigned encodings.
  • The OER codec encoded and decoded negative ENUMERATED values wrongly; both directions now follow X.696 sec. 11.4.
  • ASN1Enumerated rejected negative values, which X.680 allows. The checks are removed, isNegative() and longValueExact() are added, and valueOf() returns shared instances for 0 to 15.
  • A PBEKey stored in a BCFKS KeyStore was not reported as a key entry, so KeyStore.getEntry() returned null for it.
  • The CMS content-type decoders (SignedData, EnvelopedData, AuthenticatedData, AuthEnvelopedData, EncryptedData) and the streaming CMS parsers let unchecked exceptions escape for short or malformed content. Malformed content is now reported through the declared CMSException or IOException.
  • A KeyAgreement asked for its shared secret before doPhase returned data rather than throwing IllegalStateException - for Diffie-Hellman, the private value itself. Every key agreement in the provider now refuses the request.
  • Mac.getInstance and KeyGenerator.getInstance failed for the HMAC SHA-512/224 and SHA-512/256 object identifiers; both are now aliased.
  • A KTSParameterSpec naming an HKDF with parameters was accepted at Cipher init and failed with an unchecked exception from wrap or unwrap. The KTS Ciphers now report it at init as InvalidAlgorithmParameterException.
  • A DTLS handshake deadlocked when a handshake message ahead of the peer's ChangeCipherSpec was lost while the ChangeCipherSpec and Finished arrived, as retransmissions were discarded as belonging to the old epoch. They are now accepted until the handshake completes.
  • The lightweight key info factories encoded a GOST R 34.10-2012 key on a legacy CryptoPro curve under id-GostR3410-2001. The digestParamSet now decides, and is OPTIONAL on read and write per RFC 9215 (bc-csharp github #707).
  • Name-constraint checking canonicalised a host with an extra empty label, such as "example.com..", into a name that matched no constraint, escaping an excluded subtree. A tested name whose host carries an empty label is now refused where a constraint of that type is in force (github PR #2436).
  • SSLContext.createSSLEngine() from BCJSSE in the 1.86 bctls jar failed with NoSuchMethodError on JDK 9 and later, from a return type mismatch between the base and jdk1.9 copies of SSLEngineUtil. The copies now agree, and a new multiReleaseCheck build task checks every multi-release jar for such mismatches (github #2448).
  • The BCFKS key store derived its scrypt keys with the block size r in place of the parallelization parameter p, so stores with p != r were not RFC 7914 readable. Derivation now follows RFC 7914, older stores are still read, and org.bouncycastle.bcfks.scrypt_p_eq_r (default true) keeps written stores readable by earlier releases.
  • Building an evidence record was cubic in the number of data objects. SortedHashList and SortedIndexedHashList now sort once, with the same resulting order and root hashes (github #2456).
  • ERSDataGroup recomputed its hash on every request rather than using the ERSCachingData cache.
  • ERSArchiveTimeStampGenerator rebuilt its reduced hash tree on every call; it is now built once.
  • Grain-128AEAD returned corrupted plaintext, with no error, from a decryption driven in chunks carrying more than the tag length. One-shot decryption and encryption were unaffected (github PR #2447).
  • The certificate path validators looked up an indirect CRL entry by serial number alone, so where two issuers had revoked the same serial number a revoked certificate could be reported as not revoked. Entries are now matched on issuer and serial number, including for CRLs parsed by the JDK's provider and in the jdk1.4 distribution.

... (truncated)

Commits

Updates org.bouncycastle:bcprov-jdk18on from 1.86 to 1.87

Changelog

Sourced from org.bouncycastle:bcprov-jdk18on's changelog.

Version 1.87

Release: 1.87
Date: 2026, 11th November.

Defects Fixed

  • PrivateKeyFactory, and so the ML-DSA and ML-KEM KeyFactory services, ignored the tag of the RFC 9881 / RFC 9935 private key CHOICE and applied no length checks, so mislabelled or inconsistent seed, expandedKey and both forms were accepted. Each form is now checked for its tag, exact lengths and consistency; the pre-RFC draft forms are still read.
  • X500Name.equals was quadratic in the number of RDNs for names that are equal but not byte-identical, and is reached from unverified CMS, TSP and S/MIME messages; the CMS signer and recipient stores could also be slowed with colliding ids. Name comparison is now n log n and the stores no longer hash their entries (CVE-2026-103611).
  • Tables keyed on ASN.1 object hash codes, which a sender can make collide - Extensions, X509Extensions, ExtendedKeyUsage, the CMS AttributeTable, the EST CSRAttributesResponse and the CMS digest algorithm sets - made parsing quadratic in the number of entries. They are now ordered maps and sets.
  • CMSSignedData digested the content once for every signer verified. Signers using the same digest algorithm now share one digest, and the new org.bouncycastle.cms.max_digest_algorithms property can bound the number of distinct digest algorithms computed over one message.
  • The verify side of the ML-DSA-CALCULATE-MU signature service, and MLDSASigner.verifyMu, did not absorb the message, so a correct mu was accepted only for an empty message, and the signer was left unusable afterwards. verifyMu now derives mu as generateMu does and compares in constant time.
  • KeyPairGenerator.getInstance("SM2", "BC") was built on the generic EC generator and could draw a private key of n - 1, which GB/T 32918.1 excludes. It now uses SM2KeyPairGenerator.
  • ESTResponse was quadratic in the number of repeated header lines, and a read limit only applied after the header block. Header values are now collected once and the header block counts against the read limit.
  • The C509 encoding of RFC 6955 proof-of-possession signature values and of the RFC 9883 privateKeyPossessionStatement attribute did not follow draft-ietf-cose-cbor-encoded-cert-21 and could not be reconstructed. Both now convert in each direction, and the draft-ietf-cose-c509-test-vectors-02 vectors drive the tests.
  • DANE SMIMEA support: JndiDANEFetcherFactory mangled the owner name of listed records so lookups failed, DANEEntryStore kept only one entry per owner name, and DANEEntrySelectorFactory mishandled addresses with a quoted local-part or no '@'. All three are corrected, and DANEEntry rejects a record that is not a full certificate entry.
  • TimeStampToken accepted a token whose signing-time attribute disagreed with the genTime in its TSTInfo. Such a token is now rejected (org.bouncycastle.tsp.allow_inconsistent_signing_time switches the check off), and TimeStampTokenGenerator sets signing-time from the genTime (CVE-2026-103615).
  • TimeStampToken.validate() accepted an MD5 message imprint and TSPAlgorithms.ALLOWED included MD5. MD5 is removed from ALLOWED, validate() rejects an imprint algorithm outside the allowed set, and TSPAlgorithms.LEGACY and org.bouncycastle.tsp.allowed_imprint_algorithms are provided for callers needing it (CVE-2026-103606).
  • CRL-based revocation checking mishandled a CRL entry reasonCode outside the RFC 5280 set: 11 left the certificate unrevoked and other values threw an unchecked exception. An undefined reasonCode is now processed as unspecified.
  • OERDefinition.enumItem(label, value) discarded the explicit enumerand value. The value is now kept and unnumbered items are numbered as X.680 sec. 20 specifies.
  • OERInputStream did not detect a stream ending inside an INTEGER or BIT STRING value, decoding the zero-padded buffer instead. Length-driven reads now fail with EOFException and do not allocate a declared length up front.
  • The OER codec encoded a signed INTEGER whose upper bound is exactly the maximum of a fixed-size word in the next word up; X.696 sec. 10.4 bounds are inclusive.
  • The ETSI TS 102 941 response code wrappers range-checked a truncated int value, so 2^32 was accepted as "ok". Out-of-range values are now rejected.
  • OERInputStream accepted an empty group of octets as zero in four places where X.696 requires at least one octet. Each now fails with an IOException.
  • OEROutputStream could not encode a CHOICE whose chosen alternative has a tag number of 63 or more.
  • OEROutputStream rejected a required SEQUENCE component as absent when it arrived wrapped in a defined OEROptional.
  • OERInputStream failed with a NullPointerException for an absent optional SEQUENCE component selected through a switch that has a default value.
  • OERInputStream truncated a SEQUENCE OF count to 32 bits. A count that does not fit in 31 bits is now rejected.
  • OERInputStream rejected a valid SEQUENCE OF on streams whose available() reported fewer bytes than the element count. The count is now bounded by the decoder's allocation ceiling instead.
  • OERInputStream could not decode a variable-size BIT STRING, and mis-sized a fixed one that is not a whole number of octets. Both forms of X.696 clause 13 are now decoded, and OERDefinition gains bitString() and bitString(lower, upper).
  • OEROutputStream wrote a negative INTEGER under a type with a non-negative lower bound as a different, positive value. It is now rejected.
  • OERInputStream.uint64() read its value as signed; it now reads unsigned.
  • The OER codec treated an INTEGER with a positive lower bound as signed, where X.696 sec. 10.2 gives it the unsigned encodings.
  • The OER codec encoded and decoded negative ENUMERATED values wrongly; both directions now follow X.696 sec. 11.4.
  • ASN1Enumerated rejected negative values, which X.680 allows. The checks are removed, isNegative() and longValueExact() are added, and valueOf() returns shared instances for 0 to 15.
  • A PBEKey stored in a BCFKS KeyStore was not reported as a key entry, so KeyStore.getEntry() returned null for it.
  • The CMS content-type decoders (SignedData, EnvelopedData, AuthenticatedData, AuthEnvelopedData, EncryptedData) and the streaming CMS parsers let unchecked exceptions escape for short or malformed content. Malformed content is now reported through the declared CMSException or IOException.
  • A KeyAgreement asked for its shared secret before doPhase returned data rather than throwing IllegalStateException - for Diffie-Hellman, the private value itself. Every key agreement in the provider now refuses the request.
  • Mac.getInstance and KeyGenerator.getInstance failed for the HMAC SHA-512/224 and SHA-512/256 object identifiers; both are now aliased.
  • A KTSParameterSpec naming an HKDF with parameters was accepted at Cipher init and failed with an unchecked exception from wrap or unwrap. The KTS Ciphers now report it at init as InvalidAlgorithmParameterException.
  • A DTLS handshake deadlocked when a handshake message ahead of the peer's ChangeCipherSpec was lost while the ChangeCipherSpec and Finished arrived, as retransmissions were discarded as belonging to the old epoch. They are now accepted until the handshake completes.
  • The lightweight key info factories encoded a GOST R 34.10-2012 key on a legacy CryptoPro curve under id-GostR3410-2001. The digestParamSet now decides, and is OPTIONAL on read and write per RFC 9215 (bc-csharp github #707).
  • Name-constraint checking canonicalised a host with an extra empty label, such as "example.com..", into a name that matched no constraint, escaping an excluded subtree. A tested name whose host carries an empty label is now refused where a constraint of that type is in force (github PR #2436).
  • SSLContext.createSSLEngine() from BCJSSE in the 1.86 bctls jar failed with NoSuchMethodError on JDK 9 and later, from a return type mismatch between the base and jdk1.9 copies of SSLEngineUtil. The copies now agree, and a new multiReleaseCheck build task checks every multi-release jar for such mismatches (github #2448).
  • The BCFKS key store derived its scrypt keys with the block size r in place of the parallelization parameter p, so stores with p != r were not RFC 7914 readable. Derivation now follows RFC 7914, older stores are still read, and org.bouncycastle.bcfks.scrypt_p_eq_r (default true) keeps written stores readable by earlier releases.
  • Building an evidence record was cubic in the number of data objects. SortedHashList and SortedIndexedHashList now sort once, with the same resulting order and root hashes (github #2456).
  • ERSDataGroup recomputed its hash on every request rather than using the ERSCachingData cache.
  • ERSArchiveTimeStampGenerator rebuilt its reduced hash tree on every call; it is now built once.
  • Grain-128AEAD returned corrupted plaintext, with no error, from a decryption driven in chunks carrying more than the tag length. One-shot decryption and encryption were unaffected (github PR #2447).
  • The certificate path validators looked up an indirect CRL entry by serial number alone, so where two issuers had revoked the same serial number a revoked certificate could be reported as not revoked. Entries are now matched on issuer and serial number, including for CRLs parsed by the JDK's provider and in the jdk1.4 distribution.

... (truncated)

Commits

Updates org.bouncycastle:bcpkix-jdk18on from 1.86 to 1.87

Changelog

Sourced from org.bouncycastle:bcpkix-jdk18on's changelog.

Version 1.87

Release: 1.87
Date: 2026, 11th November.

Defects Fixed

  • PrivateKeyFactory, and so the ML-DSA and ML-KEM KeyFactory services, ignored the tag of the RFC 9881 / RFC 9935 private key CHOICE and applied no length checks, so mislabelled or inconsistent seed, expandedKey and both forms were accepted. Each form is now checked for its tag, exact lengths and consistency; the pre-RFC draft forms are still read.
  • X500Name.equals was quadratic in the number of RDNs for names that are equal but not byte-identical, and is reached from unverified CMS, TSP and S/MIME messages; the CMS signer and recipient stores could also be slowed with colliding ids. Name comparison is now n log n and the stores no longer hash their entries (CVE-2026-103611).
  • Tables keyed on ASN.1 object hash codes, which a sender can make collide - Extensions, X509Extensions, ExtendedKeyUsage, the CMS AttributeTable, the EST CSRAttributesResponse and the CMS digest algorithm sets - made parsing quadratic in the number of entries. They are now ordered maps and sets.
  • CMSSignedData digested the content once for every signer verified. Signers using the same digest algorithm now share one digest, and the new org.bouncycastle.cms.max_digest_algorithms property can bound the number of distinct digest algorithms computed over one message.
  • The verify side of the ML-DSA-CALCULATE-MU signature service, and MLDSASigner.verifyMu, did not absorb the message, so a correct mu was accepted only for an empty message, and the signer was left unusable afterwards. verifyMu now derives mu as generateMu does and compares in constant time.
  • KeyPairGenerator.getInstance("SM2", "BC") was built on the generic EC generator and could draw a private key of n - 1, which GB/T 32918.1 excludes. It now uses SM2KeyPairGenerator.
  • ESTResponse was quadratic in the number of repeated header lines, and a read limit only applied after the header block. Header values are now collected once and the header block counts against the read limit.
  • The C509 encoding of RFC 6955 proof-of-possession signature values and of the RFC 9883 privateKeyPossessionStatement attribute did not follow draft-ietf-cose-cbor-encoded-cert-21 and could not be reconstructed. Both now convert in each direction, and the draft-ietf-cose-c509-test-vectors-02 vectors drive the tests.
  • DANE SMIMEA support: JndiDANEFetcherFactory mangled the owner name of listed records so lookups failed, DANEEntryStore kept only one entry per owner name, and DANEEntrySelectorFactory mishandled addresses with a quoted local-part or no '@'. All three are corrected, and DANEEntry rejects a record that is not a full certificate entry.
  • TimeStampToken accepted a token whose signing-time attribute disagreed with the genTime in its TSTInfo. Such a token is now rejected (org.bouncycastle.tsp.allow_inconsistent_signing_time switches the check off), and TimeStampTokenGenerator sets signing-time from the genTime (CVE-2026-103615).
  • TimeStampToken.validate() accepted an MD5 message imprint and TSPAlgorithms.ALLOWED included MD5. MD5 is removed from ALLOWED, validate() rejects an imprint algorithm outside the allowed set, and TSPAlgorithms.LEGACY and org.bouncycastle.tsp.allowed_imprint_algorithms are provided for callers needing it (CVE-2026-103606).
  • CRL-based revocation checking mishandled a CRL entry reasonCode outside the RFC 5280 set: 11 left the certificate unrevoked and other values threw an unchecked exception. An undefined reasonCode is now processed as unspecified.
  • OERDefinition.enumItem(label, value) discarded the explicit enumerand value. The value is now kept and unnumbered items are numbered as X.680 sec. 20 specifies.
  • OERInputStream did not detect a stream ending inside an INTEGER or BIT STRING value, decoding the zero-padded buffer instead. Length-driven reads now fail with EOFException and do not allocate a declared length up front.
  • The OER codec encoded a signed INTEGER whose upper bound is exactly the maximum of a fixed-size word in the next word up; X.696 sec. 10.4 bounds are inclusive.
  • The ETSI TS 102 941 response code wrappers range-checked a truncated int value, so 2^32 was accepted as "ok". Out-of-range values are now rejected.
  • OERInputStream accepted an empty group of octets as zero in four places where X.696 requires at least one octet. Each now fails with an IOException.
  • OEROutputStream could not encode a CHOICE whose chosen alternative has a tag number of 63 or more.
  • OEROutputStream rejected a required SEQUENCE component as absent when it arrived wrapped in a defined OEROptional.
  • OERInputStream failed with a NullPointerException for an absent optional SEQUENCE component selected through a switch that has a default value.
  • OERInputStream truncated a SEQUENCE OF count to 32 bits. A count that does not fit in 31 bits is now rejected.
  • OERInputStream rejected a valid SEQUENCE OF on streams whose available() reported fewer bytes than the element count. The count is now bounded by the decoder's allocation ceiling instead.
  • OERInputStream could not decode a variable-size BIT STRING, and mis-sized a fixed one that is not a whole number of octets. Both forms of X.696 clause 13 are now decoded, and OERDefinition gains bitString() and bitString(lower, upper).
  • OEROutputStream wrote a negative INTEGER under a type with a non-negative lower bound as a different, positive value. It is now rejected.
  • OERInputStream.uint64() read its value as signed; it now reads unsigned.
  • The OER codec treated an INTEGER with a positive lower bound as signed, where X.696 sec. 10.2 gives it the unsigned encodings.
  • The OER codec encoded and decoded negative ENUMERATED values wrongly; both directions now follow X.696 sec. 11.4.
  • ASN1Enumerated rejected negative values, which X.680 allows. The checks are removed, isNegative() and longValueExact() are added, and valueOf() returns shared instances for 0 to 15.
  • A PBEKey stored in a BCFKS KeyStore was not reported as a key entry, so KeyStore.getEntry() returned null for it.
  • The CMS content-type decoders (SignedData, EnvelopedData, AuthenticatedData, AuthEnvelopedData, EncryptedData) and the streaming CMS parsers let unchecked exceptions escape for short or malformed content. Malformed content is now reported through the declared CMSException or IOException.
  • A KeyAgreement asked for its shared secret before doPhase returned data rather than throwing IllegalStateException - for Diffie-Hellman, the private value itself. Every key agreement in the provider now refuses the request.
  • Mac.getInstance and KeyGenerator.getInstance failed for the HMAC SHA-512/224 and SHA-512/256 object identifiers; both are now aliased.
  • A KTSParameterSpec naming an HKDF with parameters was accepted at Cipher init and failed with an unchecked exception from wrap or unwrap. The KTS Ciphers now report it at init as InvalidAlgorithmParameterException.
  • A DTLS handshake deadlocked when a handshake message ahead of the peer's ChangeCipherSpec was lost while the ChangeCipherSpec and Finished arrived, as retransmissions were discarded as belonging to the old epoch. They are now accepted until the handshake completes.
  • The lightweight key info factories encoded a GOST R 34.10-2012 key on a legacy CryptoPro curve under id-GostR3410-2001. The digestParamSet now decides, and is OPTIONAL on read and write per RFC 9215 (bc-csharp github #707).
  • Name-constraint checking canonicalised a host with an extra empty label, such as "example.com..", into a name that matched no constraint, escaping an excluded subtree. A tested name whose host carries an empty label is now refused where a constraint of that type is in force (github PR #2436).
  • SSLContext.createSSLEngine() from BCJSSE in the 1.86 bctls jar failed with NoSuchMethodError on JDK 9 and later, from a return type mismatch between the base and jdk1.9 copies of SSLEngineUtil. The copies now agree, and a new multiReleaseCheck build task checks every multi-release jar for such mismatches (github #2448).
  • The BCFKS key store derived its scrypt keys with the block size r in place of the parallelization parameter p, so stores with p != r were not RFC 7914 readable. Derivation now follows RFC 7914, older stores are still read, and org.bouncycastle.bcfks.scrypt_p_eq_r (default true) keeps written stores readable by earlier releases.
  • Building an evidence record was cubic in the number of data objects. SortedHashList and SortedIndexedHashList now sort once, with the same resulting order and root hashes (github #2456).
  • ERSDataGroup recomputed its hash on every request rather than using the ERSCachingData cache.
  • ERSArchiveTimeStampGenerator rebuilt its reduced hash tree on every call; it is now built once.
  • Grain-128AEAD returned corrupted plaintext, with no error, from a decryption driven in chunks carrying more than the tag length. One-shot decryption and encryption were unaffected (github PR #2447).
  • The certificate path validators looked up an indirect CRL entry by serial number alone, so where two issuers had revoked the same serial number a revoked certificate could be reported as not revoked. Entries are now matched on issuer and serial number, including for CRLs parsed by the JDK's provider and in the jdk1.4 distribution.

... (truncated)

Commits

Updates org.bouncycastle:bcprov-jdk18on from 1.86 to 1.87

Changelog

Sourced from org.bouncycastle:bcprov-jdk18on's changelog.

Version 1.87

Release: 1.87
Date: 2026, 11th November.

Defects Fixed

  • PrivateKeyFactory, and so the ML-DSA and ML-KEM KeyFactory services, ignored the tag of the RFC 9881 / RFC 9935 private key CHOICE and applied no length checks, so mislabelled or inconsistent seed, expandedKey and both forms were accepted. Each form is now checked for its tag, exact lengths and consistency; the pre-RFC draft forms are still read.
  • X500Name.equals was quadratic in the number of RDNs for names that are equal but not byte-identical, and is reached from unverified CMS, TSP and S/MIME messages; the CMS signer and recipient stores could also be slowed with colliding ids. Name comparison is now n log n and the stores no longer hash their entries (CVE-2026-103611).
  • Tables keyed on ASN.1 object hash codes, which a sender can make collide - Extensions, X509Extensions, ExtendedKeyUsage, the CMS AttributeTable, the EST CSRAttributesResponse and the CMS digest algorithm sets - made parsing quadratic in the number of entries. They are now ordered maps and sets.
  • CMSSignedData digested the content once for every signer verified. Signers using the same digest algorithm now share one digest, and the new org.bouncycastle.cms.max_digest_algorithms property can bound the number of distinct digest algorithms computed over one message.
  • The verify side of the ML-DSA-CALCULATE-MU signature service, and MLDSASigner.verifyMu, did not absorb the message, so a correct mu was accepted only for an empty message, and the signer was left unusable afterwards. verifyMu now derives mu as generateMu does and compares in constant time.
  • KeyPairGenerator.getInstance("SM2", "BC") was built on the generic EC generator and could draw a private key of n - 1, which GB/T 32918.1 excludes. It now uses SM2KeyPairGenerator.
  • ESTResponse was quadratic in the number of repeated header lines, and a read limit only applied after the header block. Header values are now collected once and the header block counts against the read limit.
  • The C509 encoding of RFC 6955 proof-of-possession signature values and of the RFC 9883 privateKeyPossessionStatement attribute did not follow draft-ietf-cose-cbor-encoded-cert-21 and could not be reconstructed. Both now convert in each direction, and the draft-ietf-cose-c509-test-vectors-02 vectors drive the tests.
  • DANE SMIMEA support: JndiDANEFetcherFactory mangled the owner name of listed records so lookups failed, DANEEntryStore kept only one entry per owner name, and DANEEntrySelectorFactory mishandled addresses with a quoted local-part or no '@'. All three are corrected, and DANEEntry rejects a record that is not a full certificate entry.
  • TimeStampToken accepted a token whose signing-time attribute disagreed with the genTime in its TSTInfo. Such a token is now rejected (org.bouncycastle.tsp.allow_inconsistent_signing_time switches the check off), and TimeStampTokenGenerator sets signing-time from the genTime (CVE-2026-103615).
  • TimeStampToken.validate() accepted an MD5 message imprint and TSPAlgorithms.ALLOWED included MD5. MD5 is removed from ALLOWED, validate() rejects an imprint algorithm outside the allowed set, and TSPAlgorithms.LEGACY and org.bouncycastle.tsp.allowed_imprint_algorithms are provided for callers needing it (CVE-2026-103606).
  • CRL-based revocation checking mishandled a CRL entry reasonCode outside the RFC 5280 set: 11 left the certificate unrevoked and other values threw an unchecked exception. An undefined reasonCode is now processed as unspecified.
  • OERDefinition.enumItem(label, value) discarded the explicit enumerand value. The value is now kept and unnumbered items are numbered as X.680 sec. 20 specifies.
  • OERInputStream did not detect a stream ending inside an INTEGER or BIT STRING value, decoding the zero-padded buffer instead. Length-driven reads now fail with EOFException and do not allocate a declared length up front.
  • The OER codec encoded a signed INTEGER whose upper bound is exactly the maximum of a fixed-size word in the next word up; X.696 sec. 10.4 bounds are inclusive.
  • The ETSI TS 102 941 response code wrappers range-checked a truncated int value, so 2^32 was accepted as "ok". Out-of-range values are now rejected.
  • OERInputStream accepted an empty group of octets as zero in four places where X.696 requires at least one octet. Each now fails with an IOException.
  • OEROutputStream could not encode a CHOICE whose chosen alternative has a tag number of 63 or more.
  • OEROutputStream rejected a required SEQUENCE component as absent when it arrived wrapped in a defined OEROptional.
  • OERInputStream failed with a NullPointerException for an absent optional SEQUENCE component selected through a switch that has a default value.
  • OERInputStream truncated a SEQUENCE OF count to 32 bits. A count that does not fit in 31 bits is now rejected.
  • OERInputStream rejected a valid SEQUENCE OF on streams whose available() reported fewer bytes than the element count. The count is now bounded by the decoder's allocation ceiling instead.
  • OERInputStream could not decode a variable-size BIT STRING, and mis-sized a fixed one that is not a whole number of octets. Both forms of X.696 clause 13 are now decoded, and OERDefinition gains bitString() and bitString(lower, upper).
  • OEROutputStream wrote a negative INTEGER under a type with a non-negative lower bound as a different, positive value. It is now rejected.
  • OERInputStream.uint64() read its value as signed; it now reads unsigned.
  • The OER codec treated an INTEGER with a positive lower bound as signed, where X.696 sec. 10.2 gives it the unsigned encodings.
  • The OER codec encoded and decoded negative ENUMERATED values wrongly; both directions now follow X.696 sec. 11.4.
  • ASN1Enumerated rejected negative values, which X.680 allows. The checks are removed, isNegative() and longValueExact() are added, and valueOf() returns shared instances for 0 to 15.
  • A PBEKey stored in a BCFKS KeyStore was not reported as a key entry, so KeyStore.getEntry() returned null for it.
  • The CMS content-type decoders (SignedData, EnvelopedData, AuthenticatedData, AuthEnvelopedData, EncryptedData) and the streaming CMS parsers let unchecked exceptions escape for short or malformed content. Malformed content is now reported through the declared CMSException or IOException.
  • A KeyAgreement asked for its shared secret before doPhase returned data rather than throwing IllegalStateException - for Diffie-Hellman, the private value itself. Every key agreement in the provider now refuses the request.
  • Mac.getInstance and KeyGenerator.getInstance failed for the HMAC SHA-512/224 and SHA-512/256 object identifiers; both are now aliased.
  • A KTSParameterSpec naming an HKDF with parameters was accepted at Cipher init and failed with an unchecked exception from wrap or unwrap. The KTS Ciphers now report it at init as InvalidAlgorithmParameterException.
  • A DTLS handshake deadlocked when a handshake message ahead of the peer's ChangeCipherSpec was lost while the ChangeCipherSpec and Finished arrived, as retransmissions were discarded as belonging to the old epoch. They are now accepted until the handshake completes.
  • The lightweight key info factories encoded a GOST R 34.10-2012 key on a legacy CryptoPro curve under id-GostR3410-2001. The digestParamSet now decides, and is OPTIONAL on read and write per RFC 9215 (bc-csharp github #707).
  • Name-constraint checking canonicalised a host with an extra empty label, such as "example.com..", into a name that matched no constraint, escaping an excluded subtree. A tested name whose host carries an empty label is now refused where a constraint of that type is in force (github PR #2436).
  • SSLContext.createSSLEngine() from BCJSSE in the 1.86 bctls jar failed with NoSuchMethodError on JDK 9 and later, from a return type mismatch between the base and jdk1.9 copies of SSLEngineUtil. The copies now agree, and a new multiReleaseCheck build task checks every multi-release jar for such mismatches (github #2448).
  • The BCFKS key store derived its scrypt keys with the block size r in place of the parallelization parameter p, so stores with p != r were not RFC 7914 readable. Derivation now follows RFC 7914, older stores are still read, and org.bouncycastle.bcfks.scrypt_p_eq_r (default true) keeps written stores readable by earlier releases.
  • Building an evidence record was cubic in the number of data objects. SortedHashList and SortedIndexedHashList now sort once, with the same resulting order and root hashes (github #2456).
  • ERSDataGroup recomputed its hash on every request rather than using the ERSCachingData cache.
  • ERSArchiveTimeStampGenerator rebuilt its reduced hash tree on every call; it is now built once.
  • Grain-128AEAD returned corrupted plaintext, with no error, from a decryption driven in chunks carrying more than the tag length. One-shot decryption and encryption were unaffected (github PR #2447).
  • The certificate path validators looked up an indirect CRL entry by serial number alone, so where two issuers had revoked the same serial number a revoked certificate could be reported as not revoked. Entries are now matched on issuer and serial number, including for CRLs parsed by the JDK's provider and in the jdk1.4 distribution.

... (truncated)

Commits

Updates org.bouncycastle:bcpkix-jdk18on from 1.86 to 1.87

Changelog

Sourced from org.bouncycastle:bcpkix-jdk18on's changelog.

Version 1.87

Release: 1.87
Date: 2026, 11th November.

Defects Fixed

  • PrivateKeyFactory, and so the ML-DSA and ML-KEM KeyFactory services, ignored the tag of the RFC 9881 / RFC 9935 private key CHOICE and applied no length checks, so mislabelled or inconsistent seed, expandedKey and both forms were accepted. Each form is now checked for its tag, exact lengths and consistency; the pre-RFC draft forms are still read.
  • X500Name.equals was quadratic in the number of RDNs for names that are equal but not byte-identical, and is reached from unverified CMS, TSP and S/MIME messages; the CMS signer and recipient stores could also be slowed with colliding ids. Name comparison is now n log n and the stores no longer hash their entries (CVE-2026-103611).
  • Tables keyed on ASN.1 object hash codes, which a sender can make collide - Extensions, X509Extensions, ExtendedKeyUsage, the CMS AttributeTable, the EST CSRAttributesResponse and the CMS digest algorithm sets - made parsing quadratic in the number of entries. They are now ordered maps and sets.
  • CMSSignedData digested the content once for every signer verified. Signers using the same digest algorithm now share one digest, and the new org.bouncycastle.cms.max_digest_algorithms property can bound the number of distinct digest algorithms computed over one message.
  • The verify side of the ML-DSA-CALCULATE-MU signature service, and MLDSASigner.verifyMu, did not absorb the message, so a correct mu was accepted only for an empty message, and the signer was left unusable afterwards. verifyMu now derives mu as generateMu does and compares in constant time.
  • KeyPairGenerator.getInstance("SM2", "BC") was built on the generic EC generator and could draw a private key of n - 1, which GB/T 32918.1 excludes. It now uses SM2KeyPairGenerator.
  • ESTResponse was quadratic in the number of repeated header lines, and a read limit only applied after the header block. Header values are now collected once and the header block counts against the read limit.
  • The C509 encoding of RFC 6955 proof-of-possession signature values and of the RFC 9883 privateKeyPossessionStatement attribute did not follow draft-ietf-cose-cbor-encoded-cert-21 and could not be reconstructed. Both now convert in each direction, and the draft-ietf-cose-c509-test-vectors-02 vectors drive the tests.
  • DANE SMIMEA support: JndiDANEFetcherFactory mangled the owner name of listed records so lookups failed, DANEEntryStore kept only one entry per owner name, and DANEEntrySelectorFactory mishandled addresses with a quoted local-part or no '@'. All three are corrected, and DANEEntry rejects a record that is not a full certificate entry.
  • TimeStampToken accepted a token whose signing-time attribute disagreed with the genTime in its TSTInfo. Such a token is now rejected (org.bouncycastle.tsp.allow_inconsistent_signing_time switches the check off), and TimeStampTokenGenerator sets signing-time from the genTime (CVE-2026-103615).
  • TimeStampToken.validate() accepted an MD5 message imprint and TSPAlgorithms.ALLOWED included MD5. MD5 is removed from ALLOWED, validate() rejects an imprint algorithm outside the allowed set, and TSPAlgorithms.LEGACY and org.bouncycastle.tsp.allowed_imprint_algorithms are provided for callers needing it (CVE-2026-103606).
  • CRL-based revocation checking mishandled a CRL entry reasonCode outside the RFC 5280 set: 11 left the certificate unrevoked and other values threw an unchecked exception. An undefined reasonCode is now processed as unspecified.
  • OERDefinition.enumItem(label, value) discarded the explicit enumerand value. The value is now kept and unnumbered items are numbered as X.680 sec. 20 specifies.
  • OERInputStream did not detect a stream ending inside an INTEGER or BIT STRING value, decoding the zero-padded buffer instead. Length-driven reads now fail with EOFException and do not allocate a declared length up front.
  • The OER codec encoded a signed INTEGER whose upper bound is exactly the maximum of a fixed-size word in the next word up; X.696 sec. 10.4 bounds are inclusive.
  • The ETSI TS 102 941 response code wrappers range-checked a truncated int value, so 2^32 was accepted as "ok". Out-of-range values are now rejected.
  • OERInputStream accepted an empty group of octets as zero in four places where X.696 requires at least one octet. Each now fails with an IOException.
  • OEROutputStream could not encode a CHOICE whose chosen alternative has a tag number of 63 or more.
  • OEROutputStream rejected a required SEQUENCE component as absent when it arrived wrapped in a defined OEROptional.
  • OERInputStream failed with a NullPointerException for an absent optional SEQUENCE component selected through a switch that has a default value.
  • OERInputStream truncated a SEQUENCE OF count to 32 bits. A count that does not fit in 31 bits is now rejected.
  • OERInputStream rejected a valid SEQUENCE OF on streams whose available() reported fewer bytes than the element count. The count is now bounded by the decoder's allocation ceiling instead.
  • OERInputStream could not decode a variable-size BIT STRING, and mis-sized a fixed one that is not a whole number of octets. Both forms of X.696 clause 13 are now decoded, and OERDefinition gains bitString() and bitString(lower, upper).
  • OEROutputStream wrote a negative INTEGER under a type with a non-negative lower bound as a different, positive value. It is now rejected.
  • OERInputStream.uint64() read its value as signed; it now reads unsigned.
  • The OER codec treated an INTEGER with a positive lower bound as signed, where X.696 sec. 10.2 gives it the unsigned encodings.
  • The OER codec encoded and decoded negative ENUMERATED values wrongly; both directions now follow X.696 sec. 11.4.
  • ASN1Enumerated rejected negative values, which X.680 allows. The checks are removed, isNegative() and longValueExact() are added, and valueOf() returns shared instances for 0 to 15.
  • A PBEKey stored in a BCFKS KeyStore was not reported as a key entry, so KeyStore.getEntry() returned null for it.
  • The CMS content-type decoders (SignedData, EnvelopedData, AuthenticatedData, AuthEnvelopedData, EncryptedData) and the streaming CMS parsers let unchecked exceptions escape for short or malformed content. Malformed content is now reported through the declared CMSException or IOException.
  • A KeyAgreement asked for its shared secret before doPhase returned data rather than throwing IllegalStateException - for Diffie-Hellman, the private value itself. Every key agreement in the provider now refuses the request.
  • Mac.getInstance and KeyGenerator.getInstance failed for the HMAC SHA-512/224 and SHA-512/256 object identifiers; both are now aliased.
  • A KTSParameterSpec naming an HKDF with parameters was accepted at Cipher init and failed with an unchecked exception from wrap or unwrap. The KTS Ciphers now report it at init as InvalidAlgorithmParameterException.
  • A DTLS handshake deadlocked when a handshake message ahead of the peer's ChangeCipherSpec was lost while the ChangeCipherSpec and Finished arrived, as retransmissions were discarded as belonging to the old epoch. They are now accepted until the handshake completes.
  • The lightweight key info factories encoded a GOST R 34.10-2012 key on a legacy CryptoPro curve under id-GostR3410-2001. The digestParamSet now decides, and is OPTIONAL on read and write per RFC 9215 (bc-csharp github #707).
  • Name-constraint checking canonicalised a host with an extra empty label, such as "example.com..", into a name that matched no constraint, escaping an excluded subtree. A tested name whose host carries an empty label is now refused where a constraint of that type is in force (github PR #2436).
  • SSLContext.createSSLEngine() from BCJSSE in the 1.86 bctls jar failed with NoSuchMethodError on JDK 9 and later, from a return type mismatch between the base and jdk1.9 copies of SSLEngineUtil. The copies now agree, and a new multiReleaseCheck build task checks every multi-release jar for such mismatches (github #2448).
  • The BCFKS key store derived its scrypt keys with the block size r in place of the parallelization parameter p, so stores with p != r were not RFC 7914 readable. Derivation now follows RFC 7914, older stores are still read, and org.bouncycastle.bcfks.scrypt_p_eq_r (default true) keeps written stores readable by earlier releases.
  • Building an evidence record was cubic in the number of data objects. SortedHashList and SortedIndexedHashList now sort once, with the same resulting order and root hashes (github #2456).
  • ERSDataGroup recomputed its hash on every request rather than using the ERSCachingData cache.
  • ERSArchiveTimeStampGenerator rebuilt its reduced hash tree on every call; it is now built once.
  • Grain-128AEAD returned corrupted plaintext, with no error, from a decryption driven in chunks carrying more than the tag length. One-shot decryption and encryption were unaffected (github PR #2447).
  • The certificate path validators looked up an indirect CRL entry by serial number alone, so where two issuers had revoked the same serial number a revoked certificate could be reported as not revoked. Entries are now matched on issuer and serial number, including for CRLs parsed by the JDK's provider and in the jdk1.4 distribution.

... (truncated)

Commits

Updates com.fasterxml.jackson.core:jackson-databind from 2.21.8 to 2.23.0

Commits

Updates com.fasterxml.jackson.core:jackson-core from 2.21.8 to 2.23.0

Commits

Updates com.fasterxml.jackson.datatype:jackson-datatype-jsr310 from 2.21.8 to 2.23.0

Updates com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations from 2.21.8 to 2.23.0

Commits
  • 75ac756 [maven-release-plugin] prepare release jackson-modules-base-2.23.0
  • 876d1bd Prep for 2.23.0 release
  • 4955ca4 Don't generate getters for inaccessible getters made accessible (#377)
  • cc320d9 Merge branch '2.22' into 2.x
  • afd4913 Merge branch '2.21' into 2.22
  • da6fe5a Correct CLAUDE.md on how it merges forward: 3.x branches keep their own
  • eefb46f Merge branch '2.22' into 2.x
  • c4957d3 Merge branch '2.21' into 2.22
  • 425962c Don't name a branch or version in CLAUDE.md, as it merges forward
  • d97abf3 Blackbird: use generated accessors for primitive double properties (#375)
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson.dataformat:jackson-dataformat-yaml from 2.21.8 to 2.23.0

Commits
  • 1f9438c [maven-release-plugin] prepare release jackson-dataformats-text-2.23.0

@dependabot
Bump the remaining-minor-updates group across 1 directory with 38 upd…
e27f555 
…ates

Bumps the remaining-minor-updates group with 38 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [org.bouncycastle:bcmail-jdk18on](https://github.com/bcgit/bc-java) | `1.86` | `1.87` |
| [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java) | `1.86` | `1.87` |
| [org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java) | `1.86` | `1.87` |
| [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java) | `1.86` | `1.87` |
| [org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java) | `1.86` | `1.87` |
| [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) | `2.21.8` | `2.23.0` |
| [com.fasterxml.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core) | `2.21.8` | `2.23.0` |
| com.fasterxml.jackson.datatype:jackson-datatype-jsr310 | `2.21.8` | `2.23.0` |
| [com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations](https://github.com/FasterXML/jackson-modules-base) | `2.21.8` | `2.23.0` |
| [com.fasterxml.jackson.dataformat:jackson-dataformat-yaml](https://github.com/FasterXML/jackson-dataformats-text) | `2.21.8` | `2.23.0` |
| [com.fasterxml.jackson.core:jackson-annotations](https://github.com/FasterXML/jackson-annotations) | `2.21` | `2.23` |
| [com.fasterxml.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core) | `2.21.8` | `2.23.0` |
| com.fasterxml.jackson.datatype:jackson-datatype-jsr310 | `2.21.8` | `2.23.0` |
| [com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations](https://github.com/FasterXML/jackson-modules-base) | `2.21.8` | `2.23.0` |
| [com.fasterxml.jackson.dataformat:jackson-dataformat-yaml](https://github.com/FasterXML/jackson-dataformats-text) | `2.21.8` | `2.23.0` |
| org.apache.commons:commons-lang3 | `3.21.0` | `3.22.0` |
| [com.google.guava:guava](https://github.com/google/guava) | `33.7.2-jre` | `33.8.0-jre` |
| [com.google.code.gson:gson](https://github.com/google/gson) | `2.14.0` | `2.15.0` |
| org.operaton.bpm:operaton-engine | `2.1.5` | `2.2.1` |
| org.operaton.bpm:operaton-engine-spring | `2.1.5` | `2.2.1` |
| org.operaton.bpm.model:operaton-bpmn-model | `2.1.5` | `2.2.1` |
| org.operaton.bpm:operaton-engine-spring | `2.1.5` | `2.2.1` |
| org.operaton.bpm.model:operaton-bpmn-model | `2.1.5` | `2.2.1` |
| [org.codehaus.mojo:buildnumber-maven-plugin](https://github.com/mojohaus/buildnumber-maven-plugin) | `3.3.1` | `3.4.0` |
| [org.apache.maven.plugins:maven-enforcer-plugin](https://github.com/apache/maven-enforcer) | `3.6.3` | `3.7.0` |
| ca.uhn.hapi.fhir:hapi-fhir-structures-r4 | `8.4.2` | `8.12.1` |
| ca.uhn.hapi.fhir:hapi-fhir-validation | `8.4.2` | `8.12.1` |
| ca.uhn.hapi.fhir:hapi-fhir-validation-resources-r4 | `8.4.2` | `8.12.1` |
| ca.uhn.hapi.fhir:hapi-fhir-base | `8.4.2` | `8.12.1` |
| ca.uhn.hapi.fhir:hapi-fhir-converter | `8.4.2` | `8.12.1` |
| ca.uhn.hapi.fhir:hapi-fhir-client | `8.4.2` | `8.12.1` |
| ca.uhn.hapi.fhir:hapi-fhir-caching-api | `8.4.2` | `8.12.1` |
| ca.uhn.hapi.fhir:hapi-fhir-caching-caffeine | `8.4.2` | `8.12.1` |
| ca.uhn.hapi.fhir:hapi-fhir-structures-r5 | `8.4.2` | `8.12.1` |
| ca.uhn.hapi.fhir:hapi-fhir-caching-api | `8.4.2` | `8.12.1` |
| ca.uhn.hapi.fhir:hapi-fhir-structures-r4 | `8.4.2` | `8.12.1` |
| ca.uhn.hapi.fhir:hapi-fhir-validation | `8.4.2` | `8.12.1` |
| ca.uhn.hapi.fhir:hapi-fhir-validation-resources-r4 | `8.4.2` | `8.12.1` |
| ca.uhn.hapi.fhir:hapi-fhir-caching-caffeine | `8.4.2` | `8.12.1` |
| ca.uhn.hapi.fhir:hapi-fhir-structures-r5 | `8.4.2` | `8.12.1` |
| ca.uhn.hapi.fhir:hapi-fhir-validation-resources-r5 | `8.4.2` | `8.12.1` |
| ca.uhn.hapi.fhir:hapi-fhir-structures-r5 | `8.4.2` | `8.12.1` |
| ca.uhn.hapi.fhir:org.hl7.fhir.convertors | `6.5.27` | `6.10.4` |
| ca.uhn.hapi.fhir:org.hl7.fhir.r4 | `6.5.27` | `6.10.4` |
| ca.uhn.hapi.fhir:org.hl7.fhir.r5 | `6.5.27` | `6.10.4` |
| ca.uhn.hapi.fhir:org.hl7.fhir.utilities | `6.5.27` | `6.10.4` |
| ca.uhn.hapi.fhir:org.hl7.fhir.validation | `6.5.27` | `6.10.4` |
| ca.uhn.hapi.fhir:org.hl7.fhir.model | `6.5.27` | `6.10.4` |
| ca.uhn.hapi.fhir:org.hl7.fhir.support | `6.5.27` | `6.10.4` |
| ca.uhn.hapi.fhir:org.hl7.fhir.support | `6.5.27` | `6.10.4` |
| [com.fasterxml.woodstox:woodstox-core](https://github.com/FasterXML/woodstox) | `7.1.0` | `7.3.0` |
| [io.opentelemetry:opentelemetry-api](https://github.com/open-telemetry/opentelemetry-java) | `1.44.1` | `1.68.0` |
| [io.opentelemetry.instrumentation:opentelemetry-instrumentation-annotations](https://github.com/open-telemetry/opentelemetry-java-instrumentation) | `2.10.0` | `2.33.1` |
| [org.codehaus.woodstox:stax2-api](https://github.com/FasterXML/stax2-api) | `4.2.2` | `4.3.2` |
| ca.uhn.hapi.fhir:hapi-fhir-validation-resources-r5 | `8.4.2` | `8.12.1` |



Updates `org.bouncycastle:bcmail-jdk18on` from 1.86 to 1.87
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcprov-jdk18on` from 1.86 to 1.87
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcpkix-jdk18on` from 1.86 to 1.87
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcprov-jdk18on` from 1.86 to 1.87
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcpkix-jdk18on` from 1.86 to 1.87
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `com.fasterxml.jackson.core:jackson-databind` from 2.21.8 to 2.23.0
- [Commits](FasterXML/jackson-databind@jackson-databind-2.21.8...jackson-databind-2.23.0)

Updates `com.fasterxml.jackson.core:jackson-core` from 2.21.8 to 2.23.0
- [Commits](FasterXML/jackson-core@jackson-core-2.21.8...jackson-core-2.23.0)

Updates `com.fasterxml.jackson.datatype:jackson-datatype-jsr310` from 2.21.8 to 2.23.0

Updates `com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations` from 2.21.8 to 2.23.0
- [Commits](FasterXML/jackson-modules-base@jackson-modules-base-2.21.8...jackson-modules-base-2.23.0)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` from 2.21.8 to 2.23.0
- [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.21.8...jackson-dataformats-text-2.23.0)

Updates `com.fasterxml.jackson.core:jackson-annotations` from 2.21 to 2.23
- [Commits](FasterXML/jackson-annotations@jackson-annotations-2.21...jackson-annotations-2.23)

Updates `com.fasterxml.jackson.core:jackson-core` from 2.21.8 to 2.23.0
- [Commits](FasterXML/jackson-core@jackson-core-2.21.8...jackson-core-2.23.0)

Updates `com.fasterxml.jackson.datatype:jackson-datatype-jsr310` from 2.21.8 to 2.23.0

Updates `com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations` from 2.21.8 to 2.23.0
- [Commits](FasterXML/jackson-modules-base@jackson-modules-base-2.21.8...jackson-modules-base-2.23.0)

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` from 2.21.8 to 2.23.0
- [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.21.8...jackson-dataformats-text-2.23.0)

Updates `org.apache.commons:commons-lang3` from 3.21.0 to 3.22.0

Updates `com.google.guava:guava` from 33.7.2-jre to 33.8.0-jre
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

Updates `com.google.code.gson:gson` from 2.14.0 to 2.15.0
- [Release notes](https://github.com/google/gson/releases)
- [Changelog](https://github.com/google/gson/blob/main/CHANGELOG.md)
- [Commits](google/gson@gson-parent-2.14.0...gson-parent-2.15.0)

Updates `org.operaton.bpm:operaton-engine` from 2.1.5 to 2.2.1

Updates `org.operaton.bpm:operaton-engine-spring` from 2.1.5 to 2.2.1

Updates `org.operaton.bpm.model:operaton-bpmn-model` from 2.1.5 to 2.2.1

Updates `org.operaton.bpm:operaton-engine-spring` from 2.1.5 to 2.2.1

Updates `org.operaton.bpm.model:operaton-bpmn-model` from 2.1.5 to 2.2.1

Updates `org.codehaus.mojo:buildnumber-maven-plugin` from 3.3.1 to 3.4.0
- [Release notes](https://github.com/mojohaus/buildnumber-maven-plugin/releases)
- [Commits](mojohaus/buildnumber-maven-plugin@buildnumber-maven-plugin-3.3.1...3.4.0)

Updates `org.apache.maven.plugins:maven-enforcer-plugin` from 3.6.3 to 3.7.0
- [Release notes](https://github.com/apache/maven-enforcer/releases)
- [Commits](apache/maven-enforcer@enforcer-3.6.3...enforcer-3.7.0)

Updates `ca.uhn.hapi.fhir:hapi-fhir-structures-r4` from 8.4.2 to 8.12.1

Updates `ca.uhn.hapi.fhir:hapi-fhir-validation` from 8.4.2 to 8.12.1

Updates `ca.uhn.hapi.fhir:hapi-fhir-validation-resources-r4` from 8.4.2 to 8.12.1

Updates `ca.uhn.hapi.fhir:hapi-fhir-base` from 8.4.2 to 8.12.1

Updates `ca.uhn.hapi.fhir:hapi-fhir-converter` from 8.4.2 to 8.12.1

Updates `ca.uhn.hapi.fhir:hapi-fhir-client` from 8.4.2 to 8.12.1

Updates `ca.uhn.hapi.fhir:hapi-fhir-caching-api` from 8.4.2 to 8.12.1

Updates `ca.uhn.hapi.fhir:hapi-fhir-caching-caffeine` from 8.4.2 to 8.12.1

Updates `ca.uhn.hapi.fhir:hapi-fhir-structures-r5` from 8.4.2 to 8.12.1

Updates `ca.uhn.hapi.fhir:hapi-fhir-caching-api` from 8.4.2 to 8.12.1

Updates `ca.uhn.hapi.fhir:hapi-fhir-structures-r4` from 8.4.2 to 8.12.1

Updates `ca.uhn.hapi.fhir:hapi-fhir-validation` from 8.4.2 to 8.12.1

Updates `ca.uhn.hapi.fhir:hapi-fhir-validation-resources-r4` from 8.4.2 to 8.12.1

Updates `ca.uhn.hapi.fhir:hapi-fhir-caching-caffeine` from 8.4.2 to 8.12.1

Updates `ca.uhn.hapi.fhir:hapi-fhir-structures-r5` from 8.4.2 to 8.12.1

Updates `ca.uhn.hapi.fhir:hapi-fhir-validation-resources-r5` from 8.4.2 to 8.12.1

Updates `ca.uhn.hapi.fhir:hapi-fhir-structures-r5` from 8.4.2 to 8.12.1

Updates `ca.uhn.hapi.fhir:org.hl7.fhir.convertors` from 6.5.27 to 6.10.4

Updates `ca.uhn.hapi.fhir:org.hl7.fhir.r4` from 6.5.27 to 6.10.4

Updates `ca.uhn.hapi.fhir:org.hl7.fhir.r5` from 6.5.27 to 6.10.4

Updates `ca.uhn.hapi.fhir:org.hl7.fhir.utilities` from 6.5.27 to 6.10.4

Updates `ca.uhn.hapi.fhir:org.hl7.fhir.validation` from 6.5.27 to 6.10.4

Updates `ca.uhn.hapi.fhir:org.hl7.fhir.model` from 6.5.27 to 6.10.4

Updates `ca.uhn.hapi.fhir:org.hl7.fhir.support` from 6.5.27 to 6.10.4

Updates `ca.uhn.hapi.fhir:org.hl7.fhir.support` from 6.5.27 to 6.10.4

Updates `com.fasterxml.woodstox:woodstox-core` from 7.1.0 to 7.3.0
- [Commits](FasterXML/woodstox@woodstox-core-7.1.0...woodstox-core-7.3.0)

Updates `io.opentelemetry:opentelemetry-api` from 1.44.1 to 1.68.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-java/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-java@v1.44.1...v1.68.0)

Updates `io.opentelemetry.instrumentation:opentelemetry-instrumentation-annotations` from 2.10.0 to 2.33.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java-instrumentation/blob/v2.33.1/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-java-instrumentation@v2.10.0...v2.33.1)

Updates `org.codehaus.woodstox:stax2-api` from 4.2.2 to 4.3.2
- [Commits](FasterXML/stax2-api@stax2-api-4.2.2...stax2-api-4.3.2)

Updates `ca.uhn.hapi.fhir:hapi-fhir-validation-resources-r5` from 8.4.2 to 8.12.1

---
updated-dependencies:
- dependency-name: org.bouncycastle:bcmail-jdk18on
  dependency-version: '1.87'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: org.bouncycastle:bcprov-jdk18on
  dependency-version: '1.87'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: org.bouncycastle:bcpkix-jdk18on
  dependency-version: '1.87'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: org.bouncycastle:bcprov-jdk18on
  dependency-version: '1.87'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: org.bouncycastle:bcpkix-jdk18on
  dependency-version: '1.87'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: com.fasterxml.jackson.core:jackson-core
  dependency-version: 2.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: com.fasterxml.jackson.datatype:jackson-datatype-jsr310
  dependency-version: 2.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations
  dependency-version: 2.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml
  dependency-version: 2.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: com.fasterxml.jackson.core:jackson-annotations
  dependency-version: '2.23'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: com.fasterxml.jackson.core:jackson-core
  dependency-version: 2.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: com.fasterxml.jackson.datatype:jackson-datatype-jsr310
  dependency-version: 2.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations
  dependency-version: 2.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml
  dependency-version: 2.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: org.apache.commons:commons-lang3
  dependency-version: 3.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: com.google.guava:guava
  dependency-version: 33.8.0-jre
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: com.google.code.gson:gson
  dependency-version: 2.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: org.operaton.bpm:operaton-engine
  dependency-version: 2.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: org.operaton.bpm:operaton-engine-spring
  dependency-version: 2.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: org.operaton.bpm.model:operaton-bpmn-model
  dependency-version: 2.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: org.operaton.bpm:operaton-engine-spring
  dependency-version: 2.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: org.operaton.bpm.model:operaton-bpmn-model
  dependency-version: 2.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: org.codehaus.mojo:buildnumber-maven-plugin
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: org.apache.maven.plugins:maven-enforcer-plugin
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-structures-r4
  dependency-version: 8.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-validation
  dependency-version: 8.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-validation-resources-r4
  dependency-version: 8.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-base
  dependency-version: 8.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-converter
  dependency-version: 8.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-client
  dependency-version: 8.12.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-caching-api
  dependency-version: 8.12.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-caching-caffeine
  dependency-version: 8.12.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-structures-r5
  dependency-version: 8.12.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-caching-api
  dependency-version: 8.12.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-structures-r4
  dependency-version: 8.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-validation
  dependency-version: 8.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-validation-resources-r4
  dependency-version: 8.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-caching-caffeine
  dependency-version: 8.12.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-structures-r5
  dependency-version: 8.12.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-validation-resources-r5
  dependency-version: 8.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-structures-r5
  dependency-version: 8.12.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:org.hl7.fhir.convertors
  dependency-version: 6.10.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:org.hl7.fhir.r4
  dependency-version: 6.10.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:org.hl7.fhir.r5
  dependency-version: 6.10.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:org.hl7.fhir.utilities
  dependency-version: 6.10.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:org.hl7.fhir.validation
  dependency-version: 6.10.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:org.hl7.fhir.model
  dependency-version: 6.10.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:org.hl7.fhir.support
  dependency-version: 6.10.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:org.hl7.fhir.support
  dependency-version: 6.10.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: com.fasterxml.woodstox:woodstox-core
  dependency-version: 7.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: io.opentelemetry:opentelemetry-api
  dependency-version: 1.68.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: io.opentelemetry.instrumentation:opentelemetry-instrumentation-annotations
  dependency-version: 2.33.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: org.codehaus.woodstox:stax2-api
  dependency-version: 4.3.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
- dependency-name: ca.uhn.hapi.fhir:hapi-fhir-validation-resources-r5
  dependency-version: 8.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: remaining-minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Nov 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants