Bump the minor-and-patch group across 1 directory with 7 updates by dependabot[bot] · Pull Request #1377 · azurras/christopherbell.dev

dependabot · 2026-08-22T18:59:31Z

Bumps the minor-and-patch group with 6 updates in the / directory:

Package	From	To
net.bytebuddy:byte-buddy	`1.18.11`	`1.18.12`
com.github.oshi:oshi-core	`7.4.2`	`7.5.0`
org.springdoc:springdoc-openapi-starter-webmvc-ui	`3.0.3`	`3.1.0`
com.azure:azure-data-tables	`12.5.11`	`12.5.12`
org.jsoup:jsoup	`1.22.2`	`1.23.1`
gradle-wrapper	`9.6.1`	`9.7.1`

Updates net.bytebuddy:byte-buddy from 1.18.11 to 1.18.12

Release notes

Sourced from net.bytebuddy:byte-buddy's releases.

Byte Buddy 1.18.12

Automatically support Kotlin in Gradle plugin.

Add support for native attach on Windows for ARM64.

Correct JNA injector which accidentally created on based on Unsafe.

Changelog

Sourced from net.bytebuddy:byte-buddy's changelog.

17. July 2026: version 1.18.12

Automatically support Kotlin in Gradle plugin.

Correct JNA injector which accidentally created on based on Unsafe.

Support dynamic attach on Windows ARM64 by shipping a native attach_hotspot_windows library for win32-aarch64.

Commits

706d4a4 [publish] Releasing Byte Buddy 1.18.12
b567461 [release] Release new version
bcb5d26 Avoid compilation issue on older JVMs.
e42d726 Remove unused import.
942efc4 [release] Release new version
7cff8e9 [release] Release new version
6d6cd85 feat(gradle/plugin): native kotlin support (#1925)
fe2f8d0 Add reproducible builds badge to readme.
440fa0a Add native attach library for Windows ARM64 to support dynamic attach.
373c52f Update internal Byte Buddy and release notes.
Additional commits viewable in compare view

Updates net.bytebuddy:byte-buddy-agent from 1.18.11 to 1.18.12

Release notes

Sourced from net.bytebuddy:byte-buddy-agent's releases.

Byte Buddy 1.18.12

Automatically support Kotlin in Gradle plugin.

Add support for native attach on Windows for ARM64.

Correct JNA injector which accidentally created on based on Unsafe.

Changelog

Sourced from net.bytebuddy:byte-buddy-agent's changelog.

17. July 2026: version 1.18.12

Automatically support Kotlin in Gradle plugin.

Correct JNA injector which accidentally created on based on Unsafe.

Support dynamic attach on Windows ARM64 by shipping a native attach_hotspot_windows library for win32-aarch64.

Commits

706d4a4 [publish] Releasing Byte Buddy 1.18.12
b567461 [release] Release new version
bcb5d26 Avoid compilation issue on older JVMs.
e42d726 Remove unused import.
942efc4 [release] Release new version
7cff8e9 [release] Release new version
6d6cd85 feat(gradle/plugin): native kotlin support (#1925)
fe2f8d0 Add reproducible builds badge to readme.
440fa0a Add native attach library for Windows ARM64 to support dynamic attach.
373c52f Update internal Byte Buddy and release notes.
Additional commits viewable in compare view

Updates com.github.oshi:oshi-core from 7.4.2 to 7.5.0

Release notes

Sourced from com.github.oshi:oshi-core's releases.

Release 7.5.0

New Features

#3614 - #3636: Adopt JSpecify nullability annotations project-wide and enforce them in continuous integration with NullAway, so every type in a signature is non-null unless it is annotated @Nullable. A method not annotated @Nullable is now a checked guarantee rather than an aspiration, and a null check against one is dead code you can delete. The public API packages and the oshi.util tree carry the marking in their package-info.java, where every consumer sees it, including on a Java 8 or classpath build; the implementation packages are marked on their module descriptors; the native mapping packages under oshi.jna and oshi.ffm.platform opt out, because nullability there is the operating system's to state rather than OSHI's. The org.jspecify:jspecify dependency is optional and compile-time only, so it does not reach your runtime classpath. See the FAQ for what this does and does not promise - @dbwiddis.

#3615: Add ParseUtil.getStringValueOrEmpty, which normalizes a nullable string to "", alongside the existing getStringValueOrUnknown - @dbwiddis.

#3641: Add HardwareAbstractionLayer.getVirtualization(), which identifies the hypervisor, container runtime or cloud platform hosting the system, promoting the long-standing DetectVM demo into the library. It returns an Optional<String> naming the platform, or an empty Optional when no signature matched - which means undetermined, not confirmed bare metal. Detection reads the processor's CPUID vendor string, the computer system's manufacturer and model, and network interface MAC address OUIs, in that order. The signature tables ship as the oshi.vm.properties and oshi.vmmacaddr.properties resources; placing a file of either name earlier on the classpath replaces that table, so you can teach OSHI about a platform it does not know - @dbwiddis.

#3646, #3647: Add NetworkParams.getRoutes(), which returns the operating system's routing table as a list of IPRoute objects covering both address families - @dbwiddis.

Behavior Changes

#3646: NetworkParams.getIpv6DefaultGateway() on OpenBSD returns the IPv6 gateway. It previously omitted the -inet6 flag and returned the IPv4 gateway. NetworkParams default gateways on AIX return an empty string when no default route is configured, matching the documented contract. They previously returned Constants.UNKNOWN.

#3614 - #3636: Stating each nullability contract explicitly during the JSpecify sweep surfaced implementations that did not honor it. Values that were documented as unreadable but returned null now return the sentinel the rest of the API uses. The following user-facing behavior changed:

DisplayInfo's preferred resolution, model and product serial number return an empty string rather than null for a synthesized display such as the Apple Silicon built-in panel.

SoundCard.getDriverVersion() and getCodec() return Constants.UNKNOWN rather than null when the platform reports neither, and Linux reports an unreadable ALSA driver version as Constants.UNKNOWN rather than the string not available.

UsbDevice.getVendor() and getUniqueDeviceId() return an empty string rather than null on Windows.

ComputerSystem, Baseboard and Firmware fields return Constants.UNKNOWN rather than null on AIX, Windows and the BSDs.

An installed application's name, version and vendor return an empty string rather than null on every platform.

NetworkParams.getDomainName() returns an empty string rather than null on FreeBSD.

A macOS process whose passwd or group entry cannot be read reports its numeric user and group id through the FFM implementation, matching JNA.

#3616: Report a disk's model or serial number, and a macOS partition's UUID, as Constants.UNKNOWN when it reads as an empty string, matching every other unreadable value. Affects AIX disks whose lscfg serial field is blank, and the Linux device-mapper and macOS equivalents. Partition filesystem UUIDs and labels are unchanged.

#3641: NetworkIF.isKnownVmMacAddr() recognizes five more prefixes, so it now returns true for a VMware interface using the 00:1C:14 allocation and for Amazon Web Services and Google Cloud Platform instances. oshi.demo.DetectVM.identifyVM() is deprecated in favor of HardwareAbstractionLayer.getVirtualization(), and now returns curated product names rather than whichever raw signature happened to match.

Bug Fixes and Improvements

#3589: Ship oshi-dist as a single .zip, excluding oshi-demo and its jfreechart and jackson dependencies, and attach it to each GitHub release. Test-javadoc jars and oshi-benchmark are no longer published - @dbwiddis.

#3611, #3612: Log exceptions with their stack trace and cause chain rather than substituting getMessage() into the log text, and attach the underlying failure as the cause of the InstantiationException from AbstractNetworkIF and the UnsatisfiedLinkError from ForeignFunctions.dlopenWithFlags. Two Windows logs that had been losing their argument now report it - @dbwiddis.

#3614 - #3636: Harden reads of incomplete platform output, found while stating the nullability contracts above. An empty line in a /proc statistics file, an AIX logical volume missing its type or partition count, a BSD ps line missing its process state, and a Solaris system with no SMBIOS section of a given type no longer throw. Windows CPU ticks are no longer reported as all zero when an optional processor utility counter is unavailable - @dbwiddis.

#3639: Fix a race in the Windows GPU utilization calculation, which tested its cached previous tick sample for null and then dereferenced it in a second read, so a concurrent poll could throw a NullPointerException. That sample and the cached ADL adapter index are now volatile, as a @ThreadSafe class requires - @dbwiddis.

#3643: Harden getSessions() against a corrupt utmpx entry on Linux, macOS, FreeBSD and Solaris. A single unreadable record now skips that one session instead of abandoning the native read and re-querying everything through the who command. The utmpx table is not reentrant, so a session ending while OSHI iterates it can legitimately yield a partially written entry; the who fallback now applies only when the native read returns nothing at all - @dbwiddis.

Full change log

Release 7.4.4

Bug Fixes and Improvements

#3561: Fix AIX reporting the current instant as its boot time, and an uptime of zero, when the uptime command transiently failed; parse the year-less who -b format AIX 7.3 emits, and add ParseUtil.parseYearlessDateToEpoch - @dbwiddis.

#3562: Make Linux getMaxFreq() reproducible by resolving it from the cpufreq policy, lshw, and the vendor frequency rather than folding in a live frequency reading, returning -1 when none of those reports a maximum - @dbwiddis.

#3564: Fix Linux getSoftOpenFileLimit() returning -1 for a process whose hard open-file limit is unlimited, discarding a valid soft limit - @dbwiddis.

#3566: Read the OpenBSD host name from gethostname rather than resolving it, so getHostName() no longer reports localhost on a host whose name is not resolvable - @dbwiddis.

#3568: Fix the Windows FFM getProcess(pid) and getProcesses(pids) returning a process that getProcesses() does not list, reporting a recently exited process as running with no path, no threads, and no CPU time - @dbwiddis.

#3569: Fix three JNA/FFM divergences on the file-system and network paths: the macOS FFM file store never bailed when the DiskArbitration session failed to open (the guard tested a foreign pointer for Java null, which it can never be); Windows volumes whose mount-point list exceeds the buffer were dropped rather than re-read on ERROR_MORE_DATA (missing entirely on JNA, keyed on the wrong error code on FFM); and the Windows FFM TCP/UDP connection queries could transiently return no connections under connection churn, where JNA retries on ERROR_INSUFFICIENT_BUFFER - @dbwiddis.

#3573: Report Linux VRAM from NVML rather than summing the prefetchable PCI BARs, which measures the card's address aperture (capped at 256 MiB without Resizable BAR) instead of its memory size - @Krillsson.

#3574: Never report a decrease in a BSD process's or thread's kernel or user time across updateAttributes(). DragonFly's ps TIME column sums only the currently live LWPs, so an exiting thread takes its accumulated CPU time out of the process total - @dbwiddis.

... (truncated)

Changelog

Sourced from com.github.oshi:oshi-core's changelog.

7.5.0 (2026-08-16)

New Features

#3614, #3615, #3618, #3619, #3620, #3621, #3622, #3623, #3624, #3625, #3626, #3627, #3628, #3629, #3630, #3631, #3632, #3633, #3634, #3635, #3636: Adopt JSpecify nullability annotations project-wide and enforce them in continuous integration with NullAway, so every type in a signature is non-null unless it is annotated @Nullable. A method not annotated @Nullable is now a checked guarantee rather than an aspiration, and a null check against one is dead code you can delete. The public API packages and the oshi.util tree carry the marking in their package-info.java, where every consumer sees it, including on a Java 8 or classpath build; the implementation packages are marked on their module descriptors; the native mapping packages under oshi.jna and oshi.ffm.platform opt out, because nullability there is the operating system's to state rather than OSHI's. The org.jspecify:jspecify dependency is optional and compile-time only, so it does not reach your runtime classpath. See the FAQ for what this does and does not promise - @dbwiddis.

#3615: Add ParseUtil.getStringValueOrEmpty, which normalizes a nullable string to "", alongside the existing getStringValueOrUnknown - @dbwiddis.

#3641: Add HardwareAbstractionLayer.getVirtualization(), which identifies the hypervisor, container runtime or cloud platform hosting the system, promoting the long-standing DetectVM demo into the library. It returns an Optional<String> naming the platform, or an empty Optional when no signature matched - which means undetermined, not confirmed bare metal. Detection reads the processor's CPUID vendor string, the computer system's manufacturer and model, and network interface MAC address OUIs, in that order. The signature tables ship as the oshi.vm.properties and oshi.vmmacaddr.properties resources; placing a file of either name earlier on the classpath replaces that table, so you can teach OSHI about a platform it does not know - @dbwiddis.

#3646, #3647: Add NetworkParams.getRoutes(), which returns the operating system's routing table as a list of IPRoute objects covering both address families - @dbwiddis.

Behavior Changes

#3646: NetworkParams.getIpv6DefaultGateway() on OpenBSD returns the IPv6 gateway. It previously omitted the -inet6 flag and returned the IPv4 gateway. NetworkParams default gateways on AIX return an empty string when no default route is configured, matching the documented contract. They previously returned Constants.UNKNOWN.

#3614 - #3636: Stating each nullability contract explicitly during the JSpecify sweep surfaced implementations that did not honor it. Values that were documented as unreadable but returned null now return the sentinel the rest of the API uses. The following user-facing behavior changed:

DisplayInfo's preferred resolution, model and product serial number return an empty string rather than null for a synthesized display such as the Apple Silicon built-in panel.

SoundCard.getDriverVersion() and getCodec() return Constants.UNKNOWN rather than null when the platform reports neither, and Linux reports an unreadable ALSA driver version as Constants.UNKNOWN rather than the string not available.

UsbDevice.getVendor() and getUniqueDeviceId() return an empty string rather than null on Windows.

ComputerSystem, Baseboard and Firmware fields return Constants.UNKNOWN rather than null on AIX, Windows and the BSDs.

An installed application's name, version and vendor return an empty string rather than null on every platform.

NetworkParams.getDomainName() returns an empty string rather than null on FreeBSD.

A macOS process whose passwd or group entry cannot be read reports its numeric user and group id through the FFM implementation, matching JNA.

#3616: Report a disk's model or serial number, and a macOS partition's UUID, as Constants.UNKNOWN when it reads as an empty string, matching every other unreadable value. Affects AIX disks whose lscfg serial field is blank, and the Linux device-mapper and macOS equivalents. Partition filesystem UUIDs and labels are unchanged.

#3641: NetworkIF.isKnownVmMacAddr() recognizes five more prefixes, so it now returns true for a VMware interface using the 00:1C:14 allocation and for Amazon Web Services and Google Cloud Platform instances. oshi.demo.DetectVM.identifyVM() is deprecated in favor of HardwareAbstractionLayer.getVirtualization(), and now returns curated product names rather than whichever raw signature happened to match.

... (truncated)

Commits

377d945 [maven-release-plugin] prepare release oshi-parent-7.5.0
36e1f70 7.5.0 Release
f3ec583 Update dependency com.diffplug.spotless:spotless-maven-plugin to v3.10.0 (#3649)
2bc9570 Clear the Sonar findings from the routing table work (#3648)
b6d943c Report the prefix length of an abbreviated network on DragonFly BSD (#3647)
7f5ca26 Update dependency com.puppycrawl.tools:checkstyle to v13.11.0 (#3645)
92b4372 Update dependency com.fasterxml.jackson.core:jackson-databind to v2.22.2 (#3644)
6d77432 Add NetworkParams.getRoutes() routing table API (#3646)
327fcf5 Skip a corrupt utmpx entry rather than abandoning the whole read (#3643)
a97bd07 Fix the OpenIndiana OOM failures by capping the ZFS ARC (#3642)
Additional commits viewable in compare view

Updates org.springdoc:springdoc-openapi-starter-webmvc-ui from 3.0.3 to 3.1.0

Release notes

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's releases.

springdoc-openapi v3,1,0 released!

What's Changed

Fix request-specific Swagger UI index transformations by @limehee in springdoc/springdoc-openapi#3279

Fix #3282: preserve nest() version predicate across all routes in nest by @seonwooj0810 in springdoc/springdoc-openapi#3296

Upgrade Spring Boot to version 4.1.0

Upgrade Spring AI to version 2.0.0

Upgrade swagger-core to version 2.2.52

Upgrade swagger-ui to version 5.32.11

#3307 – Act upon SonarQube warnings

#3306 – Act upon SonarQube warnings

Added

#3269 – Add mechanism to disable nullable for Kotlin properties

Allow request-specific Swagger UI index transformation

Fixed

#3304 – Kotlin parent class's field is not properly marked as nullable

#3294 – Duplicated path getting swagger-config

#3293 – Inconsistent OpenAPI schema naming with SNAKE_CASE: some Java record fields remain camelCase

#3292 – Make WebProperties and WebMvcProperties optional in SwaggerConfig

#3284 – Upgrade swagger-core from version 2.2.48 to 2.2.49

#3282 – Preserve version from nest() predicate across all routes in nest

#3281 – Stabilize Spring Data Page schema property order

#3274 – Description disappears from the generated json after upgrade to 3.0.3

#3270 – Validation annotation of ParameterObject property applied to PathVariable with the same name, even in unrelated endpoints

#3266 – Upgrade swagger-core from version 2.2.47 to 2.2.48

#3263 – Null key for a Map not allowed in JSON

Full Changelog: springdoc/springdoc-openapi@v3.0.3...v3.1.0

Changelog

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's changelog.

[3.1.0] - 2026-07-31

Added

#3269 – Add mechanism to disable nullable for Kotlin properties

Allow request-specific Swagger UI index transformation

Changed

Upgrade Spring Boot to version 4.1.0

Upgrade Spring AI to version 2.0.0

Upgrade swagger-core to version 2.2.52

Upgrade swagger-ui to version 5.32.11

#3307 – Act upon SonarQube warnings

#3306 – Act upon SonarQube warnings

Fixed

#3304 – Kotlin parent class's field is not properly marked as nullable

#3294 – Duplicated path getting swagger-config

#3293 – Inconsistent OpenAPI schema naming with SNAKE_CASE: some Java record fields remain camelCase

#3292 – Make WebProperties and WebMvcProperties optional in SwaggerConfig

#3284 – Upgrade swagger-core from version 2.2.48 to 2.2.49

#3282 – Preserve version from nest() predicate across all routes in nest

#3281 – Stabilize Spring Data Page schema property order

#3274 – Description disappears from the generated json after upgrade to 3.0.3

#3270 – Validation annotation of ParameterObject property applied to PathVariable with the same name, even in unrelated endpoints

#3266 – Upgrade swagger-core from version 2.2.47 to 2.2.48

#3263 – Null key for a Map not allowed in JSON

Commits

e04f91f [maven-release-plugin] prepare release v3.1.0
83551ce CHANGELOG.md update
4a2b5bd CHANGELOG.md update
ad0a5a5 swagger-ui upgrade to version 5.32.11
6e14cb4 Fix sonarqube errors
eae2056 Fix sonarqube errors
b09a77b chore: act upon SonarQube warnings
cc3d86d upgrade spring-ai to version 2.0.0
df1c2ba spring-boot upgrade to 4.1.0
b6e5212 Kotlin parent class's field is not properly marked as nullable. Fixes #3304
Additional commits viewable in compare view

Updates com.azure:azure-data-tables from 12.5.11 to 12.5.12

Release notes

Sourced from com.azure:azure-data-tables's releases.

com.azure+azure-data-tables_12.5.12

12.5.12 (2026-08-18)

Other Changes

Dependency Updates

Upgraded azure-core-http-netty from 1.16.5 to version 1.16.6.

Upgraded azure-core from 1.58.1 to version 1.59.0.

Commits

c923efa Prepare patch release 20260818 (#50173)
c6b40a1 Add WireMock dependency version 2.35.2 to external dependencies
8c93dca Increment package versions for commvaultcontentstore releases (#50171)
f3e1875 Configurations: 'specification/compute/resource-manager/Microsoft.Compute/Co...
d39ffca Prepare OTel AutoConfigure release v1.6.0 (#50167)
ac5a002 [AzureMonitorAutoConfigure] Validate ingestion and Live Metrics redirect targ...
53e6420 Increment versions for core releases (#50152)
168277b Update resources TypeSpec commit (#50164)
6cc7989 Migrate resource manager resources generation to TypeSpec (#50111)
645e30c Increment package versions for network auto-releases (#50162)
Additional commits viewable in compare view

Updates org.jsoup:jsoup from 1.22.2 to 1.23.1

Release notes

Sourced from org.jsoup:jsoup's releases.

jsoup 1.23.1

jsoup Java HTML Parser release 1.23.1

jsoup 1.23.1 is out now, with a faster and more memory-efficient HTML parser, improved alignment with the HTML standard across noscript, CDATA, SVG, and MathML parsing, and safer, specification-correct HTTP redirects. The release also adds a fast immutable Element#classList(), direct outer-HTML output to an Appendable, and fixes across RCDATA parsing, XML conversion, tag-name handling, and Cleaner link detection.

Performance optimization was a major focus for this release. In our OpenJDK 21 benchmarks, ordinary string parsing is now 18% faster on average, parsing from an InputStream is 11% faster, and parsing with source position tracking is 70% faster while allocating 64% fewer bytes per document.

Source-tracked DOMs retain 58-65% less memory on representative medium-to-large documents, and the improvements hold under concurrent parsing without introducing new contention. Exact gains will naturally vary with document shape, JVM, and hardware.

This release also fixes a security issue in the Cleaner that could expose markup when malformed HTML is cleaned with a custom Safelist permitting certain raw-text elements. The built-in Safelists are unaffected.

jsoup is a Java library for working with real-world HTML and XML. It provides a very convenient API for extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors.

Download jsoup now.

Improvements

Reduced retained memory when parsing with source position tracking enabled (Parser#setTrackPosition(true)). Source ranges are now stored in compact parser-owned span records instead of node and attribute user data, and Position objects are created lazily when source ranges are read. This cuts tracked DOM retained size by about 50-60% on representative benchmark documents, while keeping Node#sourceRange(), Element#endSourceRange(), and Attribute#sourceRange() behavior intact. #2498

Added Element#classList(), an immutable snapshot of an element's class names in attribute order. Use hasClass() when you just need to test for one class, classList() when you want to read or iterate classes without needing a mutable result, and classNames() when you want the existing mutable, deduplicated set that can be written back with classNames(Set). The class APIs now share an HTML-whitespace scanner, which also makes classNames() faster and lighter on allocation, especially when walking many elements without class names. #2500

Aligned HTML parser scope classification with the current HTML spec for select, foreignObject, and template. #2501

Simplified the HTML tree builder's scope, implied-end-tag, and special-element checks by caching parser-only options on Tag. That improves HTML parser throughput by about 10% on small inputs and up to about 30% on larger inputs in the benchmark fixtures. #2502

Improved HTML parser throughput stability by making hot tokeniser scan paths compile more predictably. #2507

<noscript> fallback markup is now parsed into an inspectable DOM subtree in both the document head and body. The fallback acts as a contained parsing island, so malformed markup cannot disrupt the surrounding document structure, while normal HTML tokenization still applies within it. This also improves round-trip serialization. #2537

Improved redirect credential handling as a defense-in-depth measure: explicit authorization headers and request cookies are no longer forwarded across origins, reducing exposure through open redirects and aligning with HTTP guidance. Cookies managed by a CookieStore continue to follow their configured scope. #2540

Elements can now append their outer HTML, including their own tags, directly to an Appendable with Node#outerHtml(Appendable), without first creating a String. This complements Element#html(Appendable), which appends inner HTML only. #2532

Aligned CDATA tokenization with the HTML spec: CDATA syntax in HTML content is parsed as a bogus comment, while it remains supported in SVG, MathML, and XML. Also improved namespace-aware fragment parsing so SVG and MathML contexts, HTML integration points, and context-sensitive tokenizer states are handled correctly. #2542

When using the optional re2j regular expression engine, stack overflows caused by complex selector patterns are now normalized to a ValidationException with a Pattern complexity error message. #2548

Bug Fixes

Fixed HTML parsing of mixed-case RCDATA end tags after tag-shaped text. For example, <title><p>Foo</TiTLE> and <textarea><img src=x></TeXtArEa> now keep the tag-shaped content as text instead of promoting it to markup. #2503

Fixed W3CDom XML conversion so plain XML elements don't serialize with the reserved XML namespace as the default namespace. Explicit XML namespaces and xml:* attributes are still preserved. #2504

Preserve control characters in parsed tag names #2538

Updated HTTP redirects to follow the specification: 307 and 308 preserve the request method and content, 301 and 302 only change POST to GET, and Location is followed only for 301, 302, 303, 307, and 308 responses. Streamed request bodies are not buffered; if an automatic redirect requires replaying one, execution fails, so the caller can resend with a fresh stream. #2540

Corrected the Cleaner's same-site link detection to compare hostnames rather than URL prefixes when applying rel=nofollow. #2543

Build Changes

Cleaned up the Maven build for the multi-release JAR so Java 8 and Java 11+ sources compile as separate source sets. This avoids spurious Java 8 compiler warnings from newer-language overlay sources, keeps long-running parser checks behind an explicit profile, and preserves the same published artifacts and runtime behavior.

Improved parallelism and tuned timing in our integration tests, so that a full mvn clean verify drops from ~ 1m18s to ~ 21 seconds.

My sincere thanks to everyone who contributed to this release! If you have any suggestions for the next release, I would love to hear them; please get in touch via jsoup discussions, or with me directly.

You can also follow me (@jhy@tilde.zone) on Mastodon / Fediverse to receive occasional notes about jsoup releases.

Changelog

Sourced from org.jsoup:jsoup's changelog.

1.23.1 (2026-Jul-30)

Improvements

Reduced retained memory when parsing with source position tracking enabled (Parser#setTrackPosition(true)). Source ranges are now stored in compact parser-owned span records instead of node and attribute user data, and Position objects are created lazily when source ranges are read. This cuts tracked DOM retained size by about 50-60% on representative benchmark documents, while keeping Node#sourceRange(), Element#endSourceRange(), and Attribute#sourceRange() behavior intact. #2498

Added Element#classList(), an immutable snapshot of an element's class names in attribute order. Use hasClass() when you just need to test for one class, classList() when you want to read or iterate classes without needing a mutable result, and classNames() when you want the existing mutable, deduplicated set that can be written back with classNames(Set). The class APIs now share an HTML-whitespace scanner, which also makes classNames() faster and lighter on allocation, especially when walking many elements without class names. #2500

Aligned HTML parser scope classification with the current HTML spec for select, foreignObject, and template. #2501

Simplified the HTML tree builder's scope, implied-end-tag, and special-element checks by caching parser-only options on Tag. That improves HTML parser throughput by about 10% on small inputs and up to about 30% on larger inputs in the benchmark fixtures. #2502

Improved HTML parser throughput stability by making hot tokeniser scan paths compile more predictably. #2507

<noscript> fallback markup is now parsed into an inspectable DOM subtree in both the document head and body. The fallback acts as a contained parsing island, so malformed markup cannot disrupt the surrounding document structure, while normal HTML tokenization still applies within it. This also improves round-trip serialization. #2537

Improved redirect credential handling as a defense-in-depth measure: explicit authorization headers and request cookies are no longer forwarded across origins, reducing exposure through open redirects and aligning with HTTP guidance. Cookies managed by a CookieStore continue to follow their configured scope. #2540

Elements can now append their outer HTML, including their own tags, directly to an Appendable with Node#outerHtml(Appendable), without first creating a String. This complements Element#html(Appendable), which appends inner HTML only. #2532

Aligned CDATA tokenization with the HTML spec: CDATA syntax in HTML content is parsed as a bogus comment, while it remains supported in SVG, MathML, and XML. Also improved namespace-aware fragment parsing so SVG and MathML contexts, HTML integration points, and context-sensitive tokenizer states are handled correctly. #2542

When using the optional re2j regular expression engine, stack overflows caused by complex selector patterns are now normalized to a ValidationException with a Pattern complexity error message. #2548

Bug Fixes

Fixed HTML parsing of mixed-case RCDATA end tags after tag-shaped text. For example, <title><p>Foo</TiTLE> and <textarea><img src=x></TeXtArEa> now keep the tag-shaped content as text instead of promoting it to markup. #2503

Fixed W3CDom XML conversion so plain XML elements don't serialize with the reserved XML namespace as the default namespace. Explicit XML namespaces and xml:* attributes are still preserved. #2504

Preserve control characters in parsed tag names #2538

Updated HTTP redirects to follow the specification: 307 and 308 preserve the request method and content, 301 and 302 only change POST to GET, and Location is followed only for 301, 302, 303, 307, and 308 responses. Streamed request bodies are not buffered; if an automatic redirect requires replaying one, execution fails, so the caller can resend with a fresh stream. #2540

Corrected the Cleaner's same-site link detection to compare hostnames rather than URL prefixes when applying rel=nofollow. #2543

Build Changes

Cleaned up the Maven build for the multi-release JAR so Java 8 and Java 11+ sources compile as separate source sets. This avoids spurious Java 8 compiler warnings from newer-language overlay sources, keeps long-running parser checks behind an explicit profile, and preserves the same published artifacts and runtime behavior.

Improved parallelism and tuned timing in our integration tests, so that a full mvn clean verify drops from ~ 1m18s to ~ 21 seconds.

Commits

bb077a8 [maven-release-plugin] prepare release jsoup-1.23.1
cdb5579 Harden the test some
b86b282 Normalize re2j complexity exceptions
0fcc369 Bump github/codeql-action from 4.37.0 to 4.37.1
aea4a1b Bump actions/setup-java from 5.5.0 to 5.6.0
ec9c879 Bump actions/checkout from 7.0.0 to 7.0.1
1fb2c97 Fix KeyVal.inputStream validation
3475afc Handle non-string internal attribute values; test for internal attribute data
be8c375 Parse CDATA according to the context namespace
8996fce Add appendable outer HTML output
Additional commits viewable in compare view

Updates gradle-wrapper from 9.6.1 to 9.7.1

Release notes

Sourced from gradle-wrapper's releases.

9.7.1

The Gradle team is excited to announce Gradle 9.7.1.

This is a patch release for 9.7.0. We recommend using 9.7.1 instead of 9.7.0.

Here are the highlights of 9.7.0 release:

Isolated Projects graduates to incubating

Broader Configuration Cache compatibility

Resilient Sync helps you fix broken builds

More source locations in problem reports

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Adam, Aman Gautam, Aman Kumar, Anton Dubrouski, Aurimas, gbhavya07, Josh Friend, nicklauslittle-gov, Pragati, project516, Qin Mi, Ravi, sk-reddy17, Suvrat Acharya, Yongshun Ye.

Upgrade instructions

Switch your build to use Gradle 9.7.1 by updating your wrapper:
./gradlew :wrapper --gradle-version=9.7.1 && ./gradlew :wrapper
See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

9.7.0

The Gradle team is excited to announce Gradle 9.7.0.

... (truncated)

Commits

92f0512 update fixed issues for 9.7.1 (#38892)
820ee75 update fixed issues for 9.7.1
82c23f9 Fix annotation parameter ordering problem in KTS (#38878)
ef11a72 Fix annotation parameter ordering issue
bb0d8a9 Make relevant tests polyglot (run for multiple DSLs)
336e129 Update signing configuration (#38874)
4bdf0da Update signing configuration
cd9b92c List issues resolved in 9.7.1 (#38839)
5f4e381 List issues resolved in 9.7.1
1e08ab5 Keep type-use annotations in extracted ABI classes (#38810)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any e...

Description has been truncated

Bumps the minor-and-patch group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [net.bytebuddy:byte-buddy](https://github.com/raphw/byte-buddy) | `1.18.11` | `1.18.12` | | [com.github.oshi:oshi-core](https://github.com/oshi/oshi) | `7.4.2` | `7.5.0` | | [org.springdoc:springdoc-openapi-starter-webmvc-ui](https://github.com/springdoc/springdoc-openapi) | `3.0.3` | `3.1.0` | | [com.azure:azure-data-tables](https://github.com/Azure/azure-sdk-for-java) | `12.5.11` | `12.5.12` | | [org.jsoup:jsoup](https://github.com/jhy/jsoup) | `1.22.2` | `1.23.1` | | [gradle-wrapper](https://github.com/gradle/gradle) | `9.6.1` | `9.7.1` | Updates `net.bytebuddy:byte-buddy` from 1.18.11 to 1.18.12 - [Release notes](https://github.com/raphw/byte-buddy/releases) - [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md) - [Commits](raphw/byte-buddy@byte-buddy-1.18.11...byte-buddy-1.18.12) Updates `net.bytebuddy:byte-buddy-agent` from 1.18.11 to 1.18.12 - [Release notes](https://github.com/raphw/byte-buddy/releases) - [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md) - [Commits](raphw/byte-buddy@byte-buddy-1.18.11...byte-buddy-1.18.12) Updates `com.github.oshi:oshi-core` from 7.4.2 to 7.5.0 - [Release notes](https://github.com/oshi/oshi/releases) - [Changelog](https://github.com/oshi/oshi/blob/master/CHANGELOG.md) - [Commits](oshi/oshi@oshi-parent-7.4.2...oshi-parent-7.5.0) Updates `org.springdoc:springdoc-openapi-starter-webmvc-ui` from 3.0.3 to 3.1.0 - [Release notes](https://github.com/springdoc/springdoc-openapi/releases) - [Changelog](https://github.com/springdoc/springdoc-openapi/blob/main/CHANGELOG.md) - [Commits](springdoc/springdoc-openapi@v3.0.3...v3.1.0) Updates `com.azure:azure-data-tables` from 12.5.11 to 12.5.12 - [Release notes](https://github.com/Azure/azure-sdk-for-java/releases) - [Commits](Azure/azure-sdk-for-java@com.azure+azure-data-tables_12.5.11...com.azure+azure-data-tables_12.5.12) Updates `org.jsoup:jsoup` from 1.22.2 to 1.23.1 - [Release notes](https://github.com/jhy/jsoup/releases) - [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES.md) - [Commits](jhy/jsoup@jsoup-1.22.2...jsoup-1.23.1) Updates `gradle-wrapper` from 9.6.1 to 9.7.1 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v9.6.1...v9.7.1) --- updated-dependencies: - dependency-name: net.bytebuddy:byte-buddy dependency-version: 1.18.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: net.bytebuddy:byte-buddy-agent dependency-version: 1.18.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: com.github.oshi:oshi-core dependency-version: 7.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: org.springdoc:springdoc-openapi-starter-webmvc-ui dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: com.azure:azure-data-tables dependency-version: 12.5.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: org.jsoup:jsoup dependency-version: 1.23.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: gradle-wrapper dependency-version: 9.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-24T11:11:53Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 22, 2026

dependabot Bot closed this Aug 24, 2026

dependabot Bot deleted the dependabot/gradle/minor-and-patch-ae7b84d829 branch August 24, 2026 11:11

Navigation Menu

Bump the minor-and-patch group across 1 directory with 7 updates - #1377

Bump the minor-and-patch group across 1 directory with 7 updates#1377
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/minor-and-patch-ae7b84d829

dependabot Bot commented on behalf of github Aug 22, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Byte Buddy 1.18.12

17. July 2026: version 1.18.12

Byte Buddy 1.18.12

17. July 2026: version 1.18.12

Release 7.5.0

New Features

Behavior Changes

Bug Fixes and Improvements

Release 7.4.4

Bug Fixes and Improvements

7.5.0 (2026-08-16)

New Features

Behavior Changes

springdoc-openapi v3,1,0 released!

What's Changed

Added

Fixed

[3.1.0] - 2026-07-31

Added

Changed

Fixed

com.azure+azure-data-tables_12.5.12

12.5.12 (2026-08-18)

Other Changes

Dependency Updates

jsoup 1.23.1

jsoup Java HTML Parser release 1.23.1

Improvements

Bug Fixes

Build Changes

1.23.1 (2026-Jul-30)

Improvements

Bug Fixes

Build Changes

9.7.1

Upgrade instructions

Reporting problems

9.7.0

Uh oh!

dependabot Bot commented on behalf of github Aug 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Aug 22, 2026 •

edited

Loading