chore: [DevOps] bump the production-minor-patch group with 8 updates

[dependabot]

Bumps the production-minor-patch group with 8 updates:

Package	From	To
io.swagger.core.v3:swagger-models	2.2.54	2.2.55
io.swagger.parser.v3:swagger-parser	2.1.47	2.1.48
io.swagger.parser.v3:swagger-parser-core	2.1.47	2.1.48
org.yaml:snakeyaml	2.6	2.7
org.projectlombok:lombok	1.18.46	1.18.48
com.sap.cloud.security:java-bom	4.1.1	4.1.2
org.checkerframework:checker-qual	4.2.2	4.2.3
io.grpc:grpc-bom	1.83.1	1.84.0

Updates io.swagger.core.v3:swagger-models from 2.2.54 to 2.2.55

Updates io.swagger.parser.v3:swagger-parser from 2.1.47 to 2.1.48

Release notes

Sourced from io.swagger.parser.v3:swagger-parser's releases.

Swagger-parser 2.1.48 released!

• Fix: resolution of external refs inside path items with templated fragments (#2033) (#2394)
• fix: Fix relative references inside external path items (#1948, #2066) (#2393)
• chore: update dependency-check-maven to 12.2.2 (#2387)
• fix: Inlining of references with dot (#2109) (#2384)
• fix: Fix duplicate schemas from root document back-references (#1961) (#2383)
• fix: External Refs with same name are ignored (#2055) (#2382)
• build(deps): bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 (#2379)
• build(deps-dev): bump org.apache.maven.plugins:maven-compiler-plugin from 3.11.0 to 3.15.0 (#2378)
• build(deps): bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 (#2377)
• build(deps): bump swagger-core-version from 2.2.52 to 2.2.53 (#2376)

Commits

• a982879 prepare release 2.1.48 (#2397)
• 28b1a73 Fix: resolution of external refs inside path items with templated fragments (...
• b2a9955 fix: Fix relative references inside external path items (#1948, #2066) (#2393)
• f23d962 chore: update dependabot to 12.2.2 (#2387)
• d3398c8 fix: Inlining of references with dot (#2109) (#2384)
• 0255d18 fix: Fix duplicate schemas from root document back-references (#1961) (#2383)
• 2242451 build(deps): bump org.apache.maven.plugins:maven-jar-plugin (#2379)
• 8b683a9 build(deps-dev): bump org.apache.maven.plugins:maven-compiler-plugin (#2378)
• 9804796 build(deps): bump org.apache.maven.plugins:maven-surefire-plugin (#2377)
• aea5c1e build(deps): bump swagger-core-version from 2.2.52 to 2.2.53 (#2376)
• Additional commits viewable in compare view

Updates io.swagger.parser.v3:swagger-parser-core from 2.1.47 to 2.1.48

Updates io.swagger.parser.v3:swagger-parser-core from 2.1.47 to 2.1.48

Updates org.yaml:snakeyaml from 2.6 to 2.7

Updates org.projectlombok:lombok from 1.18.46 to 1.18.48

Changelog

Sourced from org.projectlombok:lombok's changelog.

v1.18.48 (September 1st, 2026)

• BREAKING CHANGE/BUGFIX: @Builder(builderClassName = "Builder") now generates an error, because the type names collide. #3857 (found after release)
• PLATFORM: JDK27 support added #4072.
• BUGFIX: @SneakyThrows usage on JDK26 no longer results in class files that require lombok.jar to be on the runtime classpath (which should not be neccessary). #4040.
• FEATURE: New config key lombok.checkReturnValueAnnotation (values: none, lombok; default: none) lets lombok generate @lombok.CheckReturnValue on generated methods where the return value should not be ignored, such as @With methods and @Builder.build(). A future lombok release may flip the default to lombok. #4013.
• PROMOTION: @SuperBuilder has been promoted to the main package. Otherwise, no changes have been made to the annotation. The old experimental annotation will remain for a few versions, at which point it will be marked as a deprecated annotation. Eventually it'll be removed. If you had lombok.config configuration for this annotation, the configuration keys for this feature have been renamed. #2209.
• OLD-CRUFT: lombok.experimental.Wither and lombok.Delegate are deprecated remnants; these features were moved (to respectively lombok.With and lombok.experimental.Delegate over 5 years ago. They are now removed entirely. If your project is dependent on an older version of lombok which still has those; fret not, lombok still processes these annotations. It just no longer includes them in the jar.
• FEATURE: CheckerFramework: Lombok now adds @SideEffectFree to constructors it makes if you have enabled checker framework via lombok.config.
• BUGFIX: CheckerFramework: Lombok would add @SideEffectFree to the build() method of any generated builder, even if it is a builder for invoking a method; in that case, the side-effect-free nature of build() mirrors the side-effect-free nature of the method invocation you've built. Lombok now checks if the method it generated a builder for is side effect free / 'check return type'.

Commits

• b48657c [version] pre-release version bump v1.18.48
• d1d0039 Merge branch 'jdk27'
• 1a23dad [review][refactor] No meaningful changes: Improved comments, javadoc, and cle...
• 40cdde8 [changelog] JDK27 support
• 25eae29 Add Danish Nawab to AUTHORS
• 10ab92b Support JDK27: end positions moved from EndPosTable to JCTree.endpos
• af01b7a Document the new configuration syntax for listy things
• 1be3857 There is no more HtAccess
• 405985d Semantic sections for website
• 04b7340 [trivial] fixing some outdated tests (tests were broken, not lombok).
• Additional commits viewable in compare view

Updates com.sap.cloud.security:java-bom from 4.1.1 to 4.1.2

Release notes

Sourced from com.sap.cloud.security:java-bom's releases.

4.1.2

• Enforce constructor-supplied service configurations in HybridTokenAuthenticator
  • The IAS and XSUAA delegate authenticators were constructed without the configurations explicitly passed to HybridTokenAuthenticator, causing them to fall back to Environments.getCurrent() at request time. The supplied SecurityHttpClient was similarly ignored by the delegates
  • The constructor now forwards iasConfig, xsuaaConfig, and httpClient to both delegates via withServiceConfiguration / withHttpClient. Applications that follow the documented pattern of loading configurations from Environments.getCurrent() are unaffected
  • Adds HybridTokenAuthenticatorConfigurationTest with real delegates (no reflection-based mock replacement) to guard against regressions on both the IAS and XSUAA validation paths
• Update dependencies:
  • Spring Boot: 4.1.0 → 4.1.1
  • Spring Framework: 7.0.8 → 7.0.9
  • Spring Security: 7.1.0 → 7.1.1
  • Jetty: 12.1.11 → 12.1.12
  • Reactor (core & test): 3.8.6 → 3.8.7
  • JUnit Jupiter: 6.1.2 → 6.1.3
  • SpotBugs annotations: 4.10.3 → 4.10.4
  • SpotBugs Maven Plugin: 4.10.3.0 → 4.10.4.0
  • logcaptor (test scope): 2.12.6 → 2.12.7
  • Legacy Spring Boot 3.x / Spring Framework 6.x compatibility versions for the spring-security-3 module: Spring Boot 3.5.14 → 3.5.16, Spring Framework 6.2.18 → 6.2.19, Spring Security 6.5.10 → 6.5.11, Reactor 3.8.2 → 3.8.7

Changelog

Sourced from com.sap.cloud.security:java-bom's changelog.

4.1.2

• Enforce constructor-supplied service configurations in HybridTokenAuthenticator
  • The IAS and XSUAA delegate authenticators were constructed without the configurations explicitly passed to HybridTokenAuthenticator, causing them to fall back to Environments.getCurrent() at request time. The supplied SecurityHttpClient was similarly ignored by the delegates
  • The constructor now forwards iasConfig, xsuaaConfig, and httpClient to both delegates via withServiceConfiguration / withHttpClient. Applications that follow the documented pattern of loading configurations from Environments.getCurrent() are unaffected
  • Adds HybridTokenAuthenticatorConfigurationTest with real delegates (no reflection-based mock replacement) to guard against regressions on both the IAS and XSUAA validation paths
• Update dependencies:
  • Spring Boot: 4.1.0 → 4.1.1
  • Spring Framework: 7.0.8 → 7.0.9
  • Spring Security: 7.1.0 → 7.1.1
  • Jetty: 12.1.11 → 12.1.12
  • Reactor (core & test): 3.8.6 → 3.8.7
  • JUnit Jupiter: 6.1.2 → 6.1.3
  • SpotBugs annotations: 4.10.3 → 4.10.4
  • SpotBugs Maven Plugin: 4.10.3.0 → 4.10.4.0
  • logcaptor (test scope): 2.12.6 → 2.12.7
  • Legacy Spring Boot 3.x / Spring Framework 6.x compatibility versions for the spring-security-3 module: Spring Boot 3.5.14 → 3.5.16, Spring Framework 6.2.18 → 6.2.19, Spring Security 6.5.10 → 6.5.11, Reactor 3.8.2 → 3.8.7

Commits

• d5e5972 Fix/hybrid token authenticator delegate configuration (#2023)
• See full diff in compare view

Updates org.checkerframework:checker-qual from 4.2.2 to 4.2.3

Release notes

Sourced from org.checkerframework:checker-qual's releases.

Checker Framework 4.2.3

Version 4.2.3 (2026-09-01)

User-visible changes

The -AsuggestPureMethods command-line option and the purity.effectively.pure warning no longer require -AcheckPurityAnnotations to also be supplied.

Implementation details

Made the field Java8InferenceContext.pathToExpression private; use getPathToExpression() and setPathToExpression() instead.

Renamed TreeUtils.isLikeDiamondMemberReference() to isRawTypedMemberReference().

Closed issues

#2816, #7677, #7678, #7681, #7682, #7684, #7693, #7694, #7696, #7698, #7701, #7702, #7875, #8046, #8047, #8048, #8050, #8052.

Changelog

Sourced from org.checkerframework:checker-qual's changelog.

Version 4.2.3 (2026-09-01)

User-visible changes

The -AsuggestPureMethods command-line option and the purity.effectively.pure warning no longer require -AcheckPurityAnnotations to also be supplied.

Changes for type system implementers

Made the field Java8InferenceContext.pathToExpression private; use getPathToExpression() and setPathToExpression() instead.

Renamed TreeUtils.isLikeDiamondMemberReference() to isRawTypedMemberReference().

Closed issues

#2816, #7677, #7678, #7681, #7682, #7684, #7693, #7694, #7696, #7698, #7701, #7702, #7875, #8046, #8047, #8048, #8050, #8052.

Commits

• ddd330d new release 4.2.3
• d44c55a Increase the timeout.
• d07e6ce Fix links.
• 0af4fa2 Prep for release.
• 455d690 Infer the type arguments of ReferenceType::Identifier where ReferenceType...
• 81173f8 Add javac equivalent class for AnnotationEqualityVisitor (#7692)
• 81b9930 AFU Javadoc
• ac24b72 Add ci_info jobs, simplify misc jobs
• d27d6b4 Clear SubtypeVisitHistory after each outermost isSubtype call (#8064)
• 3180cc2 Update actions/setup-java action to v6
• Additional commits viewable in compare view

Updates io.grpc:grpc-bom from 1.83.1 to 1.84.0

Release notes

Sourced from io.grpc:grpc-bom's releases.

V1.84.0

In this release we drop support for Android API level 23 or lower (Marshmallow or earlier), following Google Play Service’s now requiring a minimum of API level 24 (Android 7.0 Nougat).

API Changes

• xds: Supports injecting custom LDS Resource Name Resolvers (#12925) (ac02c6f37)
• xds: Add support for creating XdsServerBuilder with SocketAddresses (#12925) (ac02c6f37)
• api: Add a Supplier overload to Context (#12935) (696653600)

Behavior Changes

• core: update SPIFFE certificate extraction to comply with X509-SVID spec (#12961) (96807d898)
  Ignore all but the first certificate if the x5c JWK parameter contains multiple values.
  Skip the JWK entry instead of stopping execution or throwing when x5c is missing or contains an empty list, complying with the requirement that entries without x5c must be ignored.

Bug Fixes

• core: reference-count shared transport factory for OOB channels (#12985) (72c6e5f91)
  Fixes a bug whereby an OOB channel shutdown incorrectly shut down the shared transport factory with the main channel, and the main channel was unable to create subchannels anymore and faced an exception in doing so.
• xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982) (3cb700719)
• xds: Add Http11ProxyUpstreamTransport to MessagePrinter (#12971) (d49a589f4)
• core, xds: Append child channel configurators instead of overwriting (#12921) (296c007c1) Chains multiple childChannelConfigurator() calls instead of overwriting them in ManagedChannelImplBuilder and XdsServerBuilder, ensuring all configurators are preserved and executed when child channels are created.
• rls: Implement stale_header_data caching and propagation in RLS (#12972) (7843bd437) Caches header_data received in RouteLookupResponse and sends it back as stale_header_data in RouteLookupRequest when refreshing stale cache entries, complying with the RLS specification.

Improvements

• netty: Fix client-initiated stream limit bypass in NettyServerHandler (#12933) (56205f91c) Configure max active streams limit directly upon DefaultHttp2Connection initialization. Because NettyServerHandler instantiates DefaultHttp2Connection directly rather than using Netty's AbstractHttp2ConnectionHandlerBuilder, it missed Netty's built-in CVE-2026-47244 patch. This left a pre-handshake window where the server's local connection allowed up to Integer.MAX_VALUE active client-initiated streams until a SETTINGS_ACK was received. Enforcing the limit proactively at startup closes this vulnerability window and prevents client-initiated stream floods / resource exhaustion.
• servlet: AsyncServletOutputStreamWriter detect and handle write when not ready (#12732) (46f308051) In highly concurrent scenarios, cached servlet container ready to write state can become stale. The servlet container may have already transitioned to a 'not ready' state, but the corresponding callback has not yet updated gRPC's internal state. This fix makes the ready state to be evaluated explicitly before attempting to write directly to the servlet output stream.
• okhttp: Move connection window update before stream termination logic (#12990) (0f859c3bb) By RFC 9113, section 6.9, receivers must take frames into account for flow control even if they're errored. This change moves the stream error response logic after connection window updates
• core: Coalesce Contiguous Small Buffers for ReadableBuffer to prevent OOM (#12924) (0585d481a)
• s2a: Default to Post Quantum Cryptography key exchange group (#12894) (bc01994b7)
• binder: Let servers load their SecurityPolicy asynchronously (9fdef96dc)
• binder: normalize failed auth future status message (9ffa1e1b7)

Dependencies

• compiler: Update maximum supported edition to EDITION_2026 (#12945) (6ccd0658e). Update the maximum supported edition in the Java gRPC compiler plugin to EDITION_2026 when compiling against Protobuf version 7.35.0 (v35.0) or later.
• api: Bump Context to JDK 8 (5d0a012fa)
• netty: Upgrade Netty to 4.2.16 and netty-tcnative to 2.0.81 (#12969) (1bc2f5a34)

Documentation

• api: Better explain the executors and how to configure them (ee08f5337)

New Features

• core, opentelemetry: Implement LB Delay Observability (Proposal A121) (#12807) (073fd5ea1) Implements attempt-level RPC delay observability across the core delayed transport, built-in load balancers (pick_first, round_robin), RLS, and xDS policies, aligned with gRFC A121. Adds LoadBalancer.PickResult.withNoResult(delayType, delayReason) and delay tracing callbacks on ClientStreamTracer. Records attempt delay duration metrics (grpc.client.attempt.delay.duration) and child tracing spans ("Attempt Delay") via the OpenTelemetry plugin.

Thanks to

... (truncated)

Commits

• b3838c0 Bump version to 1.84.0
• eb21854 Update README etc to reference 1.84.0
• 118cb68 xds: Make RawMessageClientInterceptor conditional on ext_proc flags (v1.84.x ...
• e9cfe32 Revert "Implement gRFC A97: xDS JWT Call Credentials (#12951)" (v1.84.x backp...
• cb66582 build: Remove global setting to allow empty checksums for Choco (#12993)
• 0f859c3 okhttp: Move connection window update before stream termination logic (#12990)
• 292a361 binder,cronet: Handle double-ClientTransportFactory.close()
• 7843bd4 rls: implement stale_header_data caching and propagation in RLS (#12972)
• 3cb7007 xds: Fix shutdownNow() becoming a no-op after shutdown() (#12982)
• ab104f8 compiler: add retry loop and enable allowEmptyChecksums on Windows (#12962)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions