Repository navigation
build(deps): bump the backend-deps group across 1 directory with 5 updates - #136
Merged
Merged
Conversation
dependabot
Bot
force-pushed
the
dependabot/gradle/backend/backend-deps-09857afe3e
branch
from
October 6, 2026 03:33
f397e28 to
54f7de4
Compare
Owner
|
@dependabot rebase |
…dates Bumps the backend-deps group with 5 updates in the /backend directory: | Package | From | To | | --- | --- | --- | | [org.springdoc:springdoc-openapi-starter-webmvc-ui](https://github.com/springdoc/springdoc-openapi) | `2.8.17` | `2.9.1` | | [jvm](https://github.com/JetBrains/kotlin) | `2.4.10` | `2.4.20` | | [plugin.spring](https://github.com/JetBrains/kotlin) | `2.4.10` | `2.4.20` | | [plugin.jpa](https://github.com/JetBrains/kotlin) | `2.4.10` | `2.4.20` | | [gradle-wrapper](https://github.com/gradle/gradle) | `9.6.1` | `9.8.0` | Updates `org.springdoc:springdoc-openapi-starter-webmvc-ui` from 2.8.17 to 2.9.1 - [Release notes](https://github.com/springdoc/springdoc-openapi/releases) - [Changelog](https://github.com/springdoc/springdoc-openapi/blob/v2.9.1/CHANGELOG.md) - [Commits](springdoc/springdoc-openapi@v2.8.17...v2.9.1) Updates `jvm` from 2.4.10 to 2.4.20 - [Release notes](https://github.com/JetBrains/kotlin/releases) - [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md) - [Commits](JetBrains/kotlin@v2.4.10...v2.4.20) Updates `plugin.spring` from 2.4.10 to 2.4.20 - [Release notes](https://github.com/JetBrains/kotlin/releases) - [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md) - [Commits](JetBrains/kotlin@v2.4.10...v2.4.20) Updates `plugin.jpa` from 2.4.10 to 2.4.20 - [Release notes](https://github.com/JetBrains/kotlin/releases) - [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md) - [Commits](JetBrains/kotlin@v2.4.10...v2.4.20) Updates `gradle-wrapper` from 9.6.1 to 9.8.0 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v9.6.1...v9.8.0) --- updated-dependencies: - dependency-name: gradle-wrapper dependency-version: 9.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-deps - dependency-name: jvm dependency-version: 2.4.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-deps - dependency-name: org.springdoc:springdoc-openapi-starter-webmvc-ui dependency-version: 2.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-deps - dependency-name: plugin.jpa dependency-version: 2.4.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-deps - dependency-name: plugin.spring dependency-version: 2.4.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-deps ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/gradle/backend/backend-deps-09857afe3e
branch
from
October 8, 2026 15:35
54f7de4 to
ac51c87
Compare
dependabot
Bot
deleted the
dependabot/gradle/backend/backend-deps-09857afe3e
branch
October 8, 2026 15:41
WolfTasks
pushed a commit
that referenced
this pull request
Oct 10, 2026
Override Spring Boot's log4j2.version so log4j-api and log4j-to-slf4j move together (Dependabot #90, MEDIUM). Lockfile regeneration also syncs the Kotlin compiler classpath to 2.4.20 (stale since #136) and adds compile-only OSGi/bnd annotation deps pulled in by log4j-api 2.25. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
WolfTasks
added a commit
that referenced
this pull request
Oct 10, 2026
* chore(security): trivyignore CVE-2026-47890 (spring-webmvc SSE fragments) Nightly Trivy FS scan red since 2026-10-09: spring-webmvc 6.2.19 is affected by CVE-2026-47890 (SSE stream corruption with view fragments). No OSS fix exists for 6.2.x (only 7.0.9 = Spring Boot 4); the backend uses neither SSE nor view fragments. Remove on Boot 4 migration. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(deps): log4j-api 2.24.3 -> 2.25.5 (CVE-2026-49844) Override Spring Boot's log4j2.version so log4j-api and log4j-to-slf4j move together (Dependabot #90, MEDIUM). Lockfile regeneration also syncs the Kotlin compiler classpath to 2.4.20 (stale since #136) and adds compile-only OSGi/bnd annotation deps pulled in by log4j-api 2.25. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(docker): upgrade tiff in frontend image (CVE-2026-4775) nginx:alpine ships tiff 4.7.1-r0 (HIGH); apk upgrade pulls 4.7.2-r0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Wolfgang Kozian <kozian.wolfgang@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the backend-deps group with 5 updates in the /backend directory:
2.8.172.9.12.4.102.4.202.4.102.4.202.4.102.4.209.6.19.8.0Updates
org.springdoc:springdoc-openapi-starter-webmvc-uifrom 2.8.17 to 2.9.1Release notes
Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's releases.
... (truncated)
Changelog
Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's changelog.
... (truncated)
Commits
1c53464[maven-release-plugin] prepare release v2.9.194190e9ci: give the 2.x branch its own release workflowbfd5703docs: record the swagger-ui 5.32.14 upgrade as a security fix for 2.9.1473785cMerge swagger-core 2.2.55 upgrade39968b3Upgrade swagger-core to 2.2.552e7d271Merge backport of #3351 - swagger-core 2.2.54c772cdcRecord the swagger-core 2.2.54 upgrade in the changeloga15cb5aupgrade swagger-core from 2.2.53 to 2.2.54f05b1fcMerge backport of #3323/#3321, #3317 and the Spring Data REST response fixes38acf19Record the backported fixes in the changelogUpdates
jvmfrom 2.4.10 to 2.4.20Release notes
Sourced from jvm's releases.
... (truncated)
Changelog
Sourced from jvm's changelog.
... (truncated)
Commits
890ac1dAdd Changelog for 2.4.20-RC38860aed🍒 [FIR] Fix suspend conversion when expected type is nullable (#7769)ab5bcd9Edit ChangeLog for 2.4.20-RC29464edcAdd ChangeLog for 2.4.20-RC20261e43Cherry-pick "FixasBodyAndResultVarcall in `visitInlinedLambdaInComposable...0763513[box-tests] Workaround for klib compatibility tests (#7626)045aec6[Wasm] Append scripts from webpack.config.d in the end of the file (#7615)cd7173b🍒 [2.4.20] [K/JS] Keep associated obj annotation only if getInstance survives...d36a2ffCastsOptimizationPass: break aliases cycles (#7578)8664983[CLI] Restore custom IC search scope creationUpdates
plugin.springfrom 2.4.10 to 2.4.20Release notes
Sourced from plugin.spring's releases.
... (truncated)
Changelog
Sourced from plugin.spring's changelog.
... (truncated)
Commits
890ac1dAdd Changelog for 2.4.20-RC38860aed🍒 [FIR] Fix suspend conversion when expected type is nullable (#7769)ab5bcd9Edit ChangeLog for 2.4.20-RC29464edcAdd ChangeLog for 2.4.20-RC20261e43Cherry-pick "FixasBodyAndResultVarcall in `visitInlinedLambdaInComposable...0763513[box-tests] Workaround for klib compatibility tests (#7626)045aec6[Wasm] Append scripts from webpack.config.d in the end of the file (#7615)cd7173b🍒 [2.4.20] [K/JS] Keep associated obj annotation only if getInstance survives...d36a2ffCastsOptimizationPass: break aliases cycles (#7578)8664983[CLI] Restore custom IC search scope creationUpdates
plugin.jpafrom 2.4.10 to 2.4.20Release notes
Sourced from plugin.jpa's releases.
... (truncated)
Changelog
Sourced from plugin.jpa's changelog.
... (truncated)
Commits
890ac1dAdd Changelog for 2.4.20-RC38860aed🍒 [FIR] Fix suspend conversion when expected type is nullable (#7769)ab5bcd9Edit ChangeLog for 2.4.20-RC29464edcAdd ChangeLog for 2.4.20-RC20261e43Cherry-pick "FixasBodyAndResultVarcall in `visitInlinedLambdaInComposable...0763513[box-tests] Workaround for klib compatibility tests (#7626)045aec6[Wasm] Append scripts from webpack.config.d in the end of the file (#7615)cd7173b🍒 [2.4.20] [K/JS] Keep associated obj annotation only if getInstance survives...d36a2ffCastsOptimizationPass: break aliases cycles (#7578)8664983[CLI] Restore custom IC search scope creationUpdates
gradle-wrapperfrom 9.6.1 to 9.8.0Release notes
Sourced from gradle-wrapper's releases.
... (truncated)
Commits
a927be5Add the Develocity plugin back to the Android smoke tests (#39273)eaee500Add the Develocity plugin back to the Android smoke tests189b672Route everything still hitting Maven Central through the mirror (#39257)36b1814Add back mavenCentral to doc snippets2740c2dUpdate Gradle wrapper to version 9.8.0-rc-3 (#39264)2099383Update Gradle wrapper to version 9.8.0-rc-3c80202fRoute everything still hitting Maven Central through the mirror3f6a534Fix when a best practice was introduced (#39253)9efc9edFix when a best practice was introduced459e143Route integration test dependencies through the repository mirror (#39239)