Skip to content

Bump the alldependencies group across 1 directory with 25 updates - #1953

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/gradle/alldependencies-157dd4082f
Open

Bump the alldependencies group across 1 directory with 25 updates#1953
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/gradle/alldependencies-157dd4082f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 16, 2026

Copy link
Copy Markdown
Contributor

Bumps the alldependencies group with 25 updates in the / directory:

Package From To
org.openapi.generator 7.15.0 7.25.0
org.slf4j:slf4j-api 2.0.17 2.0.19
org.slf4j:jul-to-slf4j 2.0.17 2.0.19
org.slf4j:jul-to-slf4j 2.0.17 2.0.19
ch.qos.logback:logback-classic 1.5.34 1.6.3
io.opentelemetry.instrumentation:opentelemetry-logback-mdc-1.0 2.29.0-alpha 2.31.1-alpha
io.opentelemetry:opentelemetry-api 1.63.0 1.66.0
io.opentelemetry:opentelemetry-sdk 1.63.0 1.66.0
io.opentelemetry:opentelemetry-exporter-logging 1.63.0 1.66.0
io.opentelemetry:opentelemetry-sdk 1.63.0 1.66.0
io.opentelemetry:opentelemetry-exporter-logging 1.63.0 1.66.0
io.opentelemetry.instrumentation:opentelemetry-instrumentation-api 2.29.0 2.31.1
com.google.errorprone:error_prone_annotations 2.15.0 2.50.0
io.swagger.core.v3:swagger-core 2.2.23 2.2.55
io.dropwizard.metrics:metrics-core 4.2.12 4.2.40
io.dropwizard.metrics:metrics-servlets 4.2.12 4.2.40
io.dropwizard.metrics:metrics-servlets 4.2.12 4.2.40
io.prometheus:prometheus-metrics-instrumentation-dropwizard 1.6.1 1.8.0
io.prometheus:prometheus-metrics-exporter-servlet-javax 1.6.1 1.8.0
io.prometheus:prometheus-metrics-exporter-servlet-javax 1.6.1 1.8.0
io.jsonwebtoken:jjwt-api 0.11.5 0.13.0
io.jsonwebtoken:jjwt-jackson 0.11.5 0.13.0
io.jsonwebtoken:jjwt-impl 0.11.5 0.13.0
io.jsonwebtoken:jjwt-jackson 0.11.5 0.13.0
io.jsonwebtoken:jjwt-impl 0.11.5 0.13.0
com.oracle.database.jdbc:ojdbc11 23.26.1.0.0 23.26.3.0.0
org.freemarker:freemarker 2.3.32 2.3.35
com.github.javaparser:javaparser-core 3.26.2 3.28.2
com.github.javaparser:javaparser-symbol-solver-core 3.26.2 3.28.2
com.github.javaparser:javaparser-symbol-solver-core 3.26.2 3.28.2
org.apache.tomcat.embed:tomcat-embed-core 9.0.121 9.0.122
org.apache.tomcat.embed:tomcat-embed-jasper 9.0.121 9.0.122
org.apache.tomcat:tomcat-jdbc 9.0.121 9.0.122
org.apache.tomcat.embed:tomcat-embed-jasper 9.0.121 9.0.122
org.apache.tomcat:tomcat-jdbc 9.0.121 9.0.122

Updates org.openapi.generator from 7.15.0 to 7.25.0

Updates org.slf4j:slf4j-api from 2.0.17 to 2.0.19

Updates org.slf4j:jul-to-slf4j from 2.0.17 to 2.0.19

Updates org.slf4j:jul-to-slf4j from 2.0.17 to 2.0.19

Updates ch.qos.logback:logback-classic from 1.5.34 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

  • In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

  • Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

  • The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

  • ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

  • Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

  • The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

-- Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

  • Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

  • Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

    <property name="logback.skipCallerContradictionAnalysis" value="true"/>

  • SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

  • Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

  • Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

  • Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

... (truncated)

Commits
  • e8e824d prepare release 1.6.3
  • 761821b MDCBasedDiscriminator has a gated warning mechanism
  • 53ed122 update copyright year
  • c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
  • b5aa931 added BatchedSimpleInvocationGate
  • 1f22af7 add javadocs to SimpleInvocationGate
  • 638ffa7 prevent forward and backward slashes to escape to other directories
  • 7d6b9a4 add missing ch.qos.logback.core.property package
  • fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
  • c73b43f deprecate the withJansi path
  • Additional commits viewable in compare view

Updates io.opentelemetry.instrumentation:opentelemetry-logback-mdc-1.0 from 2.29.0-alpha to 2.31.1-alpha

Release notes

Sourced from io.opentelemetry.instrumentation:opentelemetry-logback-mdc-1.0's releases.

Version 2.31.0

This release targets the OpenTelemetry SDK 1.65.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

  • Remove the deprecated ConfigPropertiesBackedConfigProvider and its create(ConfigProperties) compatibility API from the declarative config bridge. (#19305)
  • Stop exposing opentelemetry-instrumentation-api-incubator on library instrumentation compile classpaths. (#19612)

🚫 Deprecations

  • Deprecate otel.instrumentation.experimental.span-suppression-strategy in favor of Experimental.setSpanSuppressionStrategy(...). (#19180)
  • Deprecate HostIdResource.REGISTRY_QUERY in favor of the absolute-path reg.exe lookup used by HostIdResource. (#19293)
  • Deprecate MessageOperation in favor of MessagingOperationType, and the MessageOperation overloads of MessagingAttributesExtractor, MessagingConsumerMetrics, MessagingProducerMetrics, MessagingSpanKindExtractor, and MessagingSpanNameExtractor in favor of the corresponding MessagingOperationType APIs. (#19357)
  • Deprecate otel.traces.exporter=zipkin in favor of otel.traces.exporter=otlp, and otel.exporter.zipkin.endpoint in favor of otel.exporter.otlp.traces.endpoint. (#19400)
  • Deprecate OpenTelemetryMeterRegistryBuilder#setMicrometerHistogramGaugesEnabled(boolean) in favor of Experimental#setMicrometerHistogramGaugesEnabled(OpenTelemetryMeterRegistryBuilder, boolean). (#19404)
  • Deprecate legacy gRPC metadata, messaging header, and servlet request-parameter capture properties and APIs in favor of selector-based .included / .excluded configuration and IncludeExclude APIs. (#19494, #19522, #19523, #19638)
  • Deprecate otel.instrumentation.runtime-telemetry.experimental.prefer-jfr in favor of otel.instrumentation.runtime-telemetry.experimental.jfr-metrics.included, and setPreferJfrMetrics(...) in favor of setJfrMetrics(RuntimeTelemetryBuilder, IncludeExclude). (#19495)
  • Deprecate boolean and capture-list configuration for MDC/context data, map messages, key-value pairs, logger context, Logstash markers, and structured arguments in favor of .included / .excluded selectors and IncludeExclude APIs. (#19519, #19520, #19521, #19599, #19600, #19605, #19609, #19610)
  • Deprecate the declarative configuration field general.semconv_stability.opt_in in favor of general.stability_opt_in_list, and general.sanitization.url.sensitive_query_parameters/development in favor of general.sanitization.url.sensitive_query_parameters. (#19561)
  • Deprecate otel.instrumentation.graphql.add-operation-name-to-span-name.enabled in favor of otel.instrumentation.graphql.operation-name-in-span-name.enabled, and otel.instrumentation.runtime-telemetry.package-emitter.enabled / jars-per-second in favor of otel.instrumentation.runtime-telemetry.experimental.package-emitter.enabled / jars-per-second. (#19573)
  • Deprecate captured request and response header builder methods across HTTP library instrumentations in favor of selector-based requestHeaders(IncludeExclude) and responseHeaders(IncludeExclude) APIs. (#19598, #19601, #19602, #19603, #19604, #19606, #19607, #19608)
  • Deprecate otel.instrumentation.micrometer.histogram-gauges.enabled in favor of otel.instrumentation.micrometer.experimental.histogram-gauges.enabled. (#19613)

🌟 New javaagent instrumentation

  • Add Apache Commons Pool 2 instrumentation for object pool metrics. (#19091)
  • Add Apache HBase client 1.0 javaagent instrumentation. (#19243)
  • Add Redisson connection pool metrics for 3.26+. (#19392)
  • Add support for OpenTelemetry API 1.65 incubator metrics in the Java agent. (#19456)
  • Add Tomcat DBCP 8.0 javaagent instrumentation for database pool metrics. (#19472)

📈 Enhancements

  • Add opt-in OSGi bundle metadata for selected instrumentation, API, and SDK extension artifacts so they can be consumed directly in OSGi runtimes. (#18995)
  • Add cassandra.compaction.progress.completed and cassandra.compaction.progress.size gauges for in-flight Cassandra compactions. (#19290)
  • Preview the upcoming 3.0 messaging semantic conventions behind otel.semconv-stability.opt-in=messaging across AWS SQS and Lambda, JMS, Kafka, NATS, Pulsar, RabbitMQ, RocketMQ, Spring Integration, and Spring messaging instrumentations. (#19347, #19348, #19349, #19350, #19351, #19353, #19354, #19355, #19356, #19476, #19477, #19478, #19479, #19480, #19481, #19482, #19486, #19487, #19499, #19500, #19504, #19505, #19507, #19508, #19535, #19544, #19565, #19567, #19639, #19640)
  • Under the upcoming 3.0 RPC semantic conventions behind otel.semconv-stability.opt-in=rpc, Dubbo requests to unknown services emit server spans even when decoding fails before DubboProtocol.getInvoker(), and record the original method in rpc.method_original. (#16668)
  • Log4j context data now includes baggage.* entries even when there is no current span. (#19378)
  • When otel.instrumentation.common.v3-preview=true, the Micrometer bridge no longer exports .max gauges for Timer and DistributionSummary. (#19397)
  • Add the IncludeExclude selector API to opentelemetry-instrumentation-api for matching strings against included and excluded glob patterns. (#19451)
  • Emit Cassandra driver 3 consistency, coordinator, page size, idempotence, and speculative execution attributes. (#19629)
  • Expand the upcoming 3.0 database semantic conventions behind otel.semconv-stability.opt-in=database, including operation names, namespaces, collection names, operation parameters, batch telemetry, and error types for Couchbase, Redis clients, Elasticsearch, R2DBC, JDBC, ClickHouse, MongoDB, and HBase. (#19616, #19623, #19664, #19665, #19668, #19670, #19704, #19705, #19706, #19707, #19708)
  • Add otel.instrumentation.influxdb.query-sanitization.enabled to control InfluxDB query sanitization, taking precedence over otel.instrumentation.common.db.query-sanitization.enabled. (#19703)

🛠️ Bug fixes

  • Use stable database-derived metric names for unnamed Alibaba Druid, c3p0, Tomcat JDBC, HikariCP, and Vibur connection pools. (#19108, #19159, #19173, #19470, #19471)
  • Apache DBCP 2.0 metrics now register when the pool starts even without JMX registration, and they unregister on close(). (#19160)

... (truncated)

Changelog

Sourced from io.opentelemetry.instrumentation:opentelemetry-logback-mdc-1.0's changelog.

Changelog

Unreleased

⚠️ Breaking changes to non-stable APIs

  • Add the required isRequestStreaming(REQUEST) method to GenAiAttributesGetter. (#19879)
  • Elasticsearch REST javaagent and 7.x library instrumentation now capture sanitized search query bodies by default under v3-preview; outside v3-preview, capture defaults remain unchanged. The javaagent also sanitizes explicitly enabled capture by default, replacing literal values with ? while preserving the query structure. Javaagent sanitization can be disabled with otel.instrumentation.elasticsearch.query-sanitization.enabled=false. (#19675)
  • Remove the deprecated HostIdResource.REGISTRY_QUERY in favor of the absolute-path reg.exe lookup used by HostIdResource. (#19778)

🚫 Deprecations

  • Deprecate the Elasticsearch REST library artifacts and their public entrypoints. Elasticsearch Java API Client users should use its native OpenTelemetry support, available in 7.17.20+ on the 7.x line and 8.10+. Applications that use the REST Client directly have no drop-in library replacement; they can use the javaagent or migrate to the Java API Client. (#19697)
  • Deprecate SelectorConfig.resolve overloads that do not specify SelectorConfig.Stability in favor of overloads that require callers to choose the stability explicitly. (#19969)
  • Deprecate otel.instrumentation.opensearch.capture-search-query. There is no replacement.
  • Deprecate otel.instrumentation.elasticsearch.capture-search-query There is no replacement. (#19675)

Version 2.31.1 (2026-08-23)

This release targets the OpenTelemetry SDK 1.65.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

🛠️ Bug fixes

  • Restore stable semantic convention APIs to the compile classpaths of the Spring Boot autoconfigure and starter artifacts. (#19754)

Version 2.31.0 (2026-08-20)

This release targets the OpenTelemetry SDK 1.65.0.

... (truncated)

Commits

Updates io.opentelemetry:opentelemetry-api from 1.63.0 to 1.66.0

Release notes

Sourced from io.opentelemetry:opentelemetry-api's releases.

Version 1.66.0

API

  • Fix Baggage.fromContext() and Baggage.fromContextOrNull() to handle a null context (#8667)
  • Do not percent-encode W3C baggage metadata (#8682)
  • Fix ArrayIndexOutOfBoundsException in OtelEncodingUtils for invalid hex characters (#8748)

SDK

Traces

  • Record processed spans before export completes and reject new spans on shutdown in SpanProcessor self-observability instrumentation (#8735)

Metrics

  • Improve explicit bucket histogram contention performance (#8717)

Logs

  • Record processed logs before export completes and reject new logs on shutdown in LogRecordProcessor self-observability instrumentation (#8698)

Exporters

  • OTLP: Respect Retry-After in OTLP HTTP senders (#8633)
  • OTLP: Add setEnabledProtocols option to OTLP HTTP exporter builders (#8610)
  • OTLP: Reject mixing keyManager and sslContext in TlsConfigHelper (#8710)
  • OTLP: Fix OkHttpGrpcSender mTLS when using the platform default trust store (#8758)
  • OTLP: Suppress instrumentation of exporter requests in JdkHttpSender (#8757)
  • OTLP: Accept RFC 1123 hostnames in EndpointUtil.validateEndpoint for OkHttp senders (#8746)
  • OTLP: Include the number of affected items in exporter error logging (#8780)
  • OTLP: Add toString to OtlpJsonLogging{Span,Metric,LogRecord}Exporter (#8725)
  • OTLP Profiles: Improve JFR export example and align LinkData null-element handling with the spec (#8349)
  • Prometheus: Remove default host log warning in PrometheusHttpServerBuilder (#8679)
  • Prometheus: Align UCUM byte unit conversions with the specification table (#8752)

Extensions

  • BREAKING Declarative config: Rename generated model POJO setters from with<Prop> to set<Prop> (#8742)
  • Declarative config: Resolve experimental properties on stable APIs in generated model POJOs (#8654)
  • Declarative config: Fix inverted scope_info_enabled and target_info_enabled flags in the Prometheus component provider (#8750)
  • Declarative config: Support output_stream in otlp_file/development (#8676)
  • Incubator: Add toString to ComposableAnnotatingSampler (#8645)

Project tooling

  • Remediate zizmor findings in GitHub Actions workflows (#8592)

🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

... (truncated)

Changelog

Sourced from io.opentelemetry:opentelemetry-api's changelog.

Version 1.66.0 (2026-09-11)

API

  • Fix Baggage.fromContext() and Baggage.fromContextOrNull() to handle a null context (#8667)
  • Do not percent-encode W3C baggage metadata (#8682)
  • Fix ArrayIndexOutOfBoundsException in OtelEncodingUtils for invalid hex characters (#8748)

SDK

Traces

  • Record processed spans before export completes and reject new spans on shutdown in SpanProcessor self-observability instrumentation (#8735)

Metrics

  • Improve explicit bucket histogram contention performance (#8717)

Logs

  • Record processed logs before export completes and reject new logs on shutdown in LogRecordProcessor self-observability instrumentation (#8698)

Exporters

  • OTLP: Respect Retry-After in OTLP HTTP senders (#8633)
  • OTLP: Add setEnabledProtocols option to OTLP HTTP exporter builders (#8610)
  • OTLP: Reject mixing keyManager and sslContext in TlsConfigHelper (#8710)
  • OTLP: Fix OkHttpGrpcSender mTLS when using the platform default trust store (#8758)
  • OTLP: Suppress instrumentation of exporter requests in JdkHttpSender (#8757)
  • OTLP: Accept RFC 1123 hostnames in EndpointUtil.validateEndpoint for OkHttp senders (#8746)
  • OTLP: Include the number of affected items in exporter error logging (#8780)
  • OTLP: Add toString to OtlpJsonLogging{Span,Metric,LogRecord}Exporter (#8725)
  • OTLP Profiles: Improve JFR export example and align LinkData null-element handling with the spec (#8349)

... (truncated)

Commits
  • 300a358 [release/v1.66.x] Prepare release 1.66.0 (#8799)
  • dd71106 Prepare for 1.66.0 release (#8795)
  • 9284265 Manual 1.65.0 post release (#8794)
  • 10c7338 Align UCUM byte unit conversions with the specification table (#8752)
  • bf1a64c Accept RFC 1123 hostnames in EndpointUtil.validateEndpoint (#8746)
  • ab72956 Add number of affected items to Exporter error logging (#8780)
  • 275fe92 Update dependency com.squareup.wire:wire-bom to v7 (#8793)
  • 050f481 Remove unused parameter from B3 propagation integration tests (#8791)
  • 8d7bd65 Improve explicit histogram contention performance (#8717)
  • 2c880d9 Rename inverted grpc detection test in GrpcJavaOtlpIntegrationTest (#8790)
  • Additional commits viewable in compare view

Updates io.opentelemetry:opentelemetry-sdk from 1.63.0 to 1.66.0

Release notes

Sourced from io.opentelemetry:opentelemetry-sdk's releases.

Version 1.66.0

API

  • Fix Baggage.fromContext() and Baggage.fromContextOrNull() to handle a null context (#8667)
  • Do not percent-encode W3C baggage metadata (#8682)
  • Fix ArrayIndexOutOfBoundsException in OtelEncodingUtils for invalid hex characters (#8748)

SDK

Traces

  • Record processed spans before export completes and reject new spans on shutdown in SpanProcessor self-observability instrumentation (#8735)

Metrics

  • Improve explicit bucket histogram contention performance (#8717)

Logs

  • Record processed logs before export completes and reject new logs on shutdown in LogRecordProcessor self-observability instrumentation (#8698)

Exporters

  • OTLP: Respect Retry-After in OTLP HTTP senders (#8633)
  • OTLP: Add setEnabledProtocols option to OTLP HTTP exporter builders (#8610)
  • OTLP: Reject mixing keyManager and sslContext in TlsConfigHelper (#8710)
  • OTLP: Fix OkHttpGrpcSender mTLS when using the platform default trust store (#8758)
  • OTLP: Suppress instrumentation of exporter requests in JdkHttpSender (#8757)
  • OTLP: Accept RFC 1123 hostnames in EndpointUtil.validateEndpoint for OkHttp senders (#8746)
  • OTLP: Include the number of affected items in exporter error logging (#8780)
  • OTLP: Add toString to OtlpJsonLogging{Span,Metric,LogRecord}Exporter (#8725)
  • OTLP Profiles: Improve JFR export example and align LinkData null-element handling with the spec (#8349)
  • Prometheus: Remove default host log warning in PrometheusHttpServerBuilder (#8679)
  • Prometheus: Align UCUM byte unit conversions with the specification table (#8752)

Extensions

  • BREAKING Declarative config: Rename generated model POJO setters from with<Prop> to set<Prop> (#8742)
  • Declarative config: Resolve experimental properties on stable APIs in generated model POJOs (#8654)
  • Declarative config: Fix inverted scope_info_enabled and target_info_enabled flags in the Prometheus component provider (#8750)
  • Declarative config: Support output_stream in otlp_file/development (#8676)
  • Incubator: Add toString to ComposableAnnotatingSampler (#8645)

Project tooling

  • Remediate zizmor findings in GitHub Actions workflows (#8592)

🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

... (truncated)

Changelog

Sourced from io.opentelemetry:opentelemetry-sdk's changelog.

Version 1.66.0 (2026-09-11)

API

  • Fix Baggage.fromContext() and Baggage.fromContextOrNull() to handle a null context (#8667)
  • Do not percent-encode W3C baggage metadata (#8682)
  • Fix ArrayIndexOutOfBoundsException in OtelEncodingUtils for invalid hex characters (#8748)

SDK

Traces

  • Record processed spans before export completes and reject new spans on shutdown in SpanProcessor self-observability instrumentation (#8735)

Metrics

  • Improve explicit bucket histogram contention performance (#8717)

Logs

  • Record processed logs before export completes and reject new logs on shutdown in LogRecordProcessor self-observability instrumentation (#8698)

Exporters

  • OTLP: Respect Retry-After in OTLP HTTP senders (#8633)
  • OTLP: Add setEnabledProtocols option to OTLP HTTP exporter builders (#8610)
  • OTLP: Reject mixing keyManager and sslContext in TlsConfigHelper (#8710)
  • OTLP: Fix OkHttpGrpcSender mTLS when using the platform default trust store (#8758)
  • OTLP: Suppress instrumentation of exporter requests in JdkHttpSender (#8757)
  • OTLP: Accept RFC 1123 hostnames in EndpointUtil.validateEndpoint for OkHttp senders (#8746)
  • OTLP: Include the number of affected items in exporter error logging (#8780)
  • OTLP: Add toString to OtlpJsonLogging{Span,Metric,LogRecord}Exporter (#8725)
  • OTLP Profiles: Improve JFR export example and align LinkData null-element handling with the spec (#8349)

... (truncated)

Commits
  • 300a358 [release/v1.66.x] Prepare release 1.66.0 (#8799)
  • dd71106 Prepare for 1.66.0 release (#8795)
  • 9284265 Manual 1.65.0 post release (#8794)
  • 10c7338 Align UCUM byte unit conversions with the specification table (#8752)
  • bf1a64c Accept RFC 1123 hostnames in EndpointUtil.validateEndpoint (#8746)
  • ab72956 Add number of affected items to Exporter error logging (#8780)
  • 275fe92 Update dependency com.squareup.wire:wire-bom to v7 (#8793)
  • 050f481 Remove unused parameter from B3 propagation integration tests (#8791)
  • 8d7bd65 Improve explicit histogram contention performance (#8717)
  • 2c880d9 Rename inverted grpc detection test in GrpcJavaOtlpIntegrationTest (#8790)
  • Additional commits viewable in compare view

Updates io.opentelemetry:opentelemetry-exporter-logging from 1.63.0 to 1.66.0

Release notes

Sourced from io.opentelemetry:opentelemetry-exporter-logging's releases.

Version 1.66.0

API

  • Fix Baggage.fromContext() and Baggage.fromContextOrNull() to handle a null context (#8667)
  • Do not percent-encode W3C baggage metadata (#8682)
  • Fix ArrayIndexOutOfBoundsException in OtelEncodingUtils for invalid hex characters (#8748)

SDK

Traces

  • Record processed spans before export completes and reject new spans on shutdown in SpanProcessor self-observability instrumentation (#8735)

Metrics

  • Improve explicit bucket histogram contention performance (#8717)

Logs

  • Record processed logs before export completes and reject new logs on shutdown in LogRecordProcessor self-observability instrumentation (#8698)

Exporters

  • OTLP: Respect Retry-After in OTLP HTTP senders (#8633)
  • OTLP: Add setEnabledProtocols option to OTLP HTTP exporter builders (#8610)
  • OTLP: Reject mixing keyManager and sslContext in TlsConfigHelper (#8710)
  • OTLP: Fix OkHttpGrpcSender mTLS when using the platform default trust store (#8758)
  • OTLP: Suppress instrumentation of exporter requests in JdkHttpSender (#8757)
  • OTLP: Accept RFC 1123 hostnames in EndpointUtil.validateEndpoint for OkHttp senders (#8746)
  • OTLP: Include the number of affected items in exporter error logging (#8780)
  • OTLP: Add toString to OtlpJsonLogging{Span,Metric,LogRecord}Exporter (#8725)
  • OTLP Profiles: Improve JFR export example and align LinkData null-element handling with the spec (#8349)
  • Prometheus: Remove default host log warning in PrometheusHttpServerBuilder (#8679)
  • Prometheus: Align UCUM byte unit conversions with the specification table (#8752)

Extensions

  • BREAKING Declarative config: Rename generated model POJO setters from with<Prop> to set<Prop> (#8742)
  • Declarative config: Resolve experimental properties on stable APIs in generated model POJOs (#8654)
  • Declarative config: Fix inverted scope_info_enabled and target_info_enabled flags in the Prometheus component provider (#8750)
  • Declarative config: Support output_stream in otlp_file/development (#8676)
  • Incubator: Add toString to ComposableAnnotatingSampler (#8645)

Project tooling

  • Remediate zizmor findings in GitHub Actions workflows (#8592)

🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

... (truncated)

Changelog

Sourced from io.opentelemetry:opentelemetry-exporter-logging's changelog.

Version 1.66.0 (2026-09-11)

API

  • Fix Baggage.fromContext() and Baggage.fromContextOrNull() to handle a null context (#8667)
  • Do not percent-encode W3C baggage metadata (#8682)
  • Fix ArrayIndexOutOfBoundsException in OtelEncodingUtils for invalid hex characters (#8748)

SDK

Traces

  • Record processed spans before export completes and reject new spans on shutdown in SpanProcessor self-observability instrumentation (#8735)

Metrics

  • Improve explicit bucket histogram contention performance (#8717)

Logs

  • Record processed logs before export completes and reject new logs on shutdown in LogRecordProcessor self-observability instrumentation (#8698)

Exporters

  • OTLP: Respect Retry-After in OTLP HTTP senders (#8633)
  • OTLP: Add setEnabledProtocols option to OTLP HTTP exporter builders (#8610)
  • OTLP: Reject mixing keyManager and sslContext in TlsConfigHelper (#8710)
  • OTLP: Fix OkHttpGrpcSender mTLS when using the platform default trust store (#8758)
  • OTLP: Suppress instrumentation of exporter requests in JdkHttpSender (#8757)
  • OTLP: Accept RFC 1...

    Description has been truncated

@dependabot
Bump the alldependencies group across 1 directory with 25 updates
e35f26f 
Bumps the alldependencies group with 25 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| org.openapi.generator | `7.15.0` | `7.25.0` |
| org.slf4j:slf4j-api | `2.0.17` | `2.0.19` |
| org.slf4j:jul-to-slf4j | `2.0.17` | `2.0.19` |
| org.slf4j:jul-to-slf4j | `2.0.17` | `2.0.19` |
| [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.5.34` | `1.6.3` |
| [io.opentelemetry.instrumentation:opentelemetry-logback-mdc-1.0](https://github.com/open-telemetry/opentelemetry-java-instrumentation) | `2.29.0-alpha` | `2.31.1-alpha` |
| [io.opentelemetry:opentelemetry-api](https://github.com/open-telemetry/opentelemetry-java) | `1.63.0` | `1.66.0` |
| [io.opentelemetry:opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-java) | `1.63.0` | `1.66.0` |
| [io.opentelemetry:opentelemetry-exporter-logging](https://github.com/open-telemetry/opentelemetry-java) | `1.63.0` | `1.66.0` |
| [io.opentelemetry:opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-java) | `1.63.0` | `1.66.0` |
| [io.opentelemetry:opentelemetry-exporter-logging](https://github.com/open-telemetry/opentelemetry-java) | `1.63.0` | `1.66.0` |
| [io.opentelemetry.instrumentation:opentelemetry-instrumentation-api](https://github.com/open-telemetry/opentelemetry-java-instrumentation) | `2.29.0` | `2.31.1` |
| [com.google.errorprone:error_prone_annotations](https://github.com/google/error-prone) | `2.15.0` | `2.50.0` |
| [io.swagger.core.v3:swagger-core](https://github.com/swagger-api/swagger-core) | `2.2.23` | `2.2.55` |
| [io.dropwizard.metrics:metrics-core](https://github.com/dropwizard/metrics) | `4.2.12` | `4.2.40` |
| [io.dropwizard.metrics:metrics-servlets](https://github.com/dropwizard/metrics) | `4.2.12` | `4.2.40` |
| [io.dropwizard.metrics:metrics-servlets](https://github.com/dropwizard/metrics) | `4.2.12` | `4.2.40` |
| io.prometheus:prometheus-metrics-instrumentation-dropwizard | `1.6.1` | `1.8.0` |
| io.prometheus:prometheus-metrics-exporter-servlet-javax | `1.6.1` | `1.8.0` |
| io.prometheus:prometheus-metrics-exporter-servlet-javax | `1.6.1` | `1.8.0` |
| [io.jsonwebtoken:jjwt-api](https://github.com/jwtk/jjwt) | `0.11.5` | `0.13.0` |
| io.jsonwebtoken:jjwt-jackson | `0.11.5` | `0.13.0` |
| [io.jsonwebtoken:jjwt-impl](https://github.com/jwtk/jjwt) | `0.11.5` | `0.13.0` |
| io.jsonwebtoken:jjwt-jackson | `0.11.5` | `0.13.0` |
| [io.jsonwebtoken:jjwt-impl](https://github.com/jwtk/jjwt) | `0.11.5` | `0.13.0` |
| com.oracle.database.jdbc:ojdbc11 | `23.26.1.0.0` | `23.26.3.0.0` |
| org.freemarker:freemarker | `2.3.32` | `2.3.35` |
| [com.github.javaparser:javaparser-core](https://github.com/javaparser/javaparser) | `3.26.2` | `3.28.2` |
| [com.github.javaparser:javaparser-symbol-solver-core](https://github.com/javaparser/javaparser) | `3.26.2` | `3.28.2` |
| [com.github.javaparser:javaparser-symbol-solver-core](https://github.com/javaparser/javaparser) | `3.26.2` | `3.28.2` |
| org.apache.tomcat.embed:tomcat-embed-core | `9.0.121` | `9.0.122` |
| org.apache.tomcat.embed:tomcat-embed-jasper | `9.0.121` | `9.0.122` |
| org.apache.tomcat:tomcat-jdbc | `9.0.121` | `9.0.122` |
| org.apache.tomcat.embed:tomcat-embed-jasper | `9.0.121` | `9.0.122` |
| org.apache.tomcat:tomcat-jdbc | `9.0.121` | `9.0.122` |



Updates `org.openapi.generator` from 7.15.0 to 7.25.0

Updates `org.slf4j:slf4j-api` from 2.0.17 to 2.0.19

Updates `org.slf4j:jul-to-slf4j` from 2.0.17 to 2.0.19

Updates `org.slf4j:jul-to-slf4j` from 2.0.17 to 2.0.19

Updates `ch.qos.logback:logback-classic` from 1.5.34 to 1.6.3
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.5.34...v_1.6.3)

Updates `io.opentelemetry.instrumentation:opentelemetry-logback-mdc-1.0` from 2.29.0-alpha to 2.31.1-alpha
- [Release notes](https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java-instrumentation/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-java-instrumentation/commits)

Updates `io.opentelemetry:opentelemetry-api` from 1.63.0 to 1.66.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-java/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-java@v1.63.0...v1.66.0)

Updates `io.opentelemetry:opentelemetry-sdk` from 1.63.0 to 1.66.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-java/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-java@v1.63.0...v1.66.0)

Updates `io.opentelemetry:opentelemetry-exporter-logging` from 1.63.0 to 1.66.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-java/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-java@v1.63.0...v1.66.0)

Updates `io.opentelemetry:opentelemetry-sdk` from 1.63.0 to 1.66.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-java/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-java@v1.63.0...v1.66.0)

Updates `io.opentelemetry:opentelemetry-exporter-logging` from 1.63.0 to 1.66.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-java/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-java@v1.63.0...v1.66.0)

Updates `io.opentelemetry.instrumentation:opentelemetry-instrumentation-api` from 2.29.0 to 2.31.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java-instrumentation/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-java-instrumentation@v2.29.0...v2.31.1)

Updates `com.google.errorprone:error_prone_annotations` from 2.15.0 to 2.50.0
- [Release notes](https://github.com/google/error-prone/releases)
- [Commits](google/error-prone@v2.15.0...v2.50.0)

Updates `io.swagger.core.v3:swagger-core` from 2.2.23 to 2.2.55
- [Release notes](https://github.com/swagger-api/swagger-core/releases)
- [Changelog](https://github.com/swagger-api/swagger-core/blob/master/CHANGELOG.md)
- [Commits](swagger-api/swagger-core@v2.2.23...v2.2.55)

Updates `io.dropwizard.metrics:metrics-core` from 4.2.12 to 4.2.40
- [Release notes](https://github.com/dropwizard/metrics/releases)
- [Commits](dropwizard/metrics@v4.2.12...v4.2.40)

Updates `io.dropwizard.metrics:metrics-servlets` from 4.2.12 to 4.2.40
- [Release notes](https://github.com/dropwizard/metrics/releases)
- [Commits](dropwizard/metrics@v4.2.12...v4.2.40)

Updates `io.dropwizard.metrics:metrics-servlets` from 4.2.12 to 4.2.40
- [Release notes](https://github.com/dropwizard/metrics/releases)
- [Commits](dropwizard/metrics@v4.2.12...v4.2.40)

Updates `io.prometheus:prometheus-metrics-instrumentation-dropwizard` from 1.6.1 to 1.8.0

Updates `io.prometheus:prometheus-metrics-exporter-servlet-javax` from 1.6.1 to 1.8.0

Updates `io.prometheus:prometheus-metrics-exporter-servlet-javax` from 1.6.1 to 1.8.0

Updates `io.jsonwebtoken:jjwt-api` from 0.11.5 to 0.13.0
- [Release notes](https://github.com/jwtk/jjwt/releases)
- [Changelog](https://github.com/jwtk/jjwt/blob/main/CHANGELOG.md)
- [Commits](jwtk/jjwt@0.11.5...0.13.0)

Updates `io.jsonwebtoken:jjwt-jackson` from 0.11.5 to 0.13.0

Updates `io.jsonwebtoken:jjwt-impl` from 0.11.5 to 0.13.0
- [Release notes](https://github.com/jwtk/jjwt/releases)
- [Changelog](https://github.com/jwtk/jjwt/blob/main/CHANGELOG.md)
- [Commits](jwtk/jjwt@0.11.5...0.13.0)

Updates `io.jsonwebtoken:jjwt-jackson` from 0.11.5 to 0.13.0

Updates `io.jsonwebtoken:jjwt-impl` from 0.11.5 to 0.13.0
- [Release notes](https://github.com/jwtk/jjwt/releases)
- [Changelog](https://github.com/jwtk/jjwt/blob/main/CHANGELOG.md)
- [Commits](jwtk/jjwt@0.11.5...0.13.0)

Updates `com.oracle.database.jdbc:ojdbc11` from 23.26.1.0.0 to 23.26.3.0.0

Updates `org.freemarker:freemarker` from 2.3.32 to 2.3.35

Updates `com.github.javaparser:javaparser-core` from 3.26.2 to 3.28.2
- [Release notes](https://github.com/javaparser/javaparser/releases)
- [Changelog](https://github.com/javaparser/javaparser/blob/master/changelog.md)
- [Commits](javaparser/javaparser@javaparser-parent-3.26.2...javaparser-parent-3.28.2)

Updates `com.github.javaparser:javaparser-symbol-solver-core` from 3.26.2 to 3.28.2
- [Release notes](https://github.com/javaparser/javaparser/releases)
- [Changelog](https://github.com/javaparser/javaparser/blob/master/changelog.md)
- [Commits](javaparser/javaparser@javaparser-parent-3.26.2...javaparser-parent-3.28.2)

Updates `com.github.javaparser:javaparser-symbol-solver-core` from 3.26.2 to 3.28.2
- [Release notes](https://github.com/javaparser/javaparser/releases)
- [Changelog](https://github.com/javaparser/javaparser/blob/master/changelog.md)
- [Commits](javaparser/javaparser@javaparser-parent-3.26.2...javaparser-parent-3.28.2)

Updates `org.apache.tomcat.embed:tomcat-embed-core` from 9.0.121 to 9.0.122

Updates `org.apache.tomcat.embed:tomcat-embed-jasper` from 9.0.121 to 9.0.122

Updates `org.apache.tomcat:tomcat-jdbc` from 9.0.121 to 9.0.122

Updates `org.apache.tomcat.embed:tomcat-embed-jasper` from 9.0.121 to 9.0.122

Updates `org.apache.tomcat:tomcat-jdbc` from 9.0.121 to 9.0.122

---
updated-dependencies:
- dependency-name: org.openapi.generator
  dependency-version: 7.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: org.slf4j:slf4j-api
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: alldependencies
- dependency-name: org.slf4j:jul-to-slf4j
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: alldependencies
- dependency-name: org.slf4j:jul-to-slf4j
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: alldependencies
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: io.opentelemetry.instrumentation:opentelemetry-logback-mdc-1.0
  dependency-version: 2.31.1-alpha
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: io.opentelemetry:opentelemetry-api
  dependency-version: 1.66.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: io.opentelemetry:opentelemetry-sdk
  dependency-version: 1.66.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: io.opentelemetry:opentelemetry-exporter-logging
  dependency-version: 1.66.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: io.opentelemetry:opentelemetry-sdk
  dependency-version: 1.66.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: io.opentelemetry:opentelemetry-exporter-logging
  dependency-version: 1.66.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: io.opentelemetry.instrumentation:opentelemetry-instrumentation-api
  dependency-version: 2.31.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: com.google.errorprone:error_prone_annotations
  dependency-version: 2.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: io.swagger.core.v3:swagger-core
  dependency-version: 2.2.55
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: alldependencies
- dependency-name: io.dropwizard.metrics:metrics-core
  dependency-version: 4.2.40
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: alldependencies
- dependency-name: io.dropwizard.metrics:metrics-servlets
  dependency-version: 4.2.40
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: alldependencies
- dependency-name: io.dropwizard.metrics:metrics-servlets
  dependency-version: 4.2.40
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: alldependencies
- dependency-name: io.prometheus:prometheus-metrics-instrumentation-dropwizard
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: io.prometheus:prometheus-metrics-exporter-servlet-javax
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: io.prometheus:prometheus-metrics-exporter-servlet-javax
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: io.jsonwebtoken:jjwt-api
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: io.jsonwebtoken:jjwt-jackson
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: io.jsonwebtoken:jjwt-impl
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: io.jsonwebtoken:jjwt-jackson
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: io.jsonwebtoken:jjwt-impl
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: com.oracle.database.jdbc:ojdbc11
  dependency-version: 23.26.3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: alldependencies
- dependency-name: org.freemarker:freemarker
  dependency-version: 2.3.35
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: alldependencies
- dependency-name: com.github.javaparser:javaparser-core
  dependency-version: 3.28.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: com.github.javaparser:javaparser-symbol-solver-core
  dependency-version: 3.28.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: com.github.javaparser:javaparser-symbol-solver-core
  dependency-version: 3.28.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: alldependencies
- dependency-name: org.apache.tomcat.embed:tomcat-embed-core
  dependency-version: 9.0.122
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: alldependencies
- dependency-name: org.apache.tomcat.embed:tomcat-embed-jasper
  dependency-version: 9.0.122
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: alldependencies
- dependency-name: org.apache.tomcat:tomcat-jdbc
  dependency-version: 9.0.122
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: alldependencies
- dependency-name: org.apache.tomcat.embed:tomcat-embed-jasper
  dependency-version: 9.0.122
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: alldependencies
- dependency-name: org.apache.tomcat:tomcat-jdbc
  dependency-version: 9.0.122
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: alldependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants