Bump the backend-prod group across 1 directory with 9 updates by dependabot[bot] · Pull Request #17 · OpenConext/openconext-saml-java

dependabot · 2026-03-11T03:14:29Z

Bumps the backend-prod group with 9 updates in the / directory:

Package	From	To
org.opensaml:opensaml-core-api	`5.1.6`	`5.2.1`
org.opensaml:opensaml-core-impl	`5.1.6`	`5.2.1`
org.opensaml:opensaml-saml-impl	`5.1.6`	`5.2.1`
org.projectlombok:lombok	`1.18.42`	`1.18.44`
commons-codec:commons-codec	`1.20.0`	`1.21.0`
jakarta.xml.bind:jakarta.xml.bind-api	`4.0.4`	`4.0.5`
ch.qos.logback:logback-core	`1.5.21`	`1.5.32`
ch.qos.logback:logback-classic	`1.5.21`	`1.5.32`
org.apache.tomcat.embed:tomcat-embed-core	`11.0.15`	`11.0.18`

Updates org.opensaml:opensaml-core-api from 5.1.6 to 5.2.1

Updates org.opensaml:opensaml-core-impl from 5.1.6 to 5.2.1

Updates org.opensaml:opensaml-saml-impl from 5.1.6 to 5.2.1

Updates org.projectlombok:lombok from 1.18.42 to 1.18.44

Changelog

Sourced from org.projectlombok:lombok's changelog.

v1.18.44 (March 11th, 2026)

FEATURE: @Jacksonized now supports both Jackson2 and Jackson3; you'll get a warning until you configure which one (or even both!) you want lombok to generate. #3950.

BUGFIX: On JDK25, val and @ExtensionMethod could sometimes cause erroneous errors (in that you see errors but compilation succeeds anyway) using javac. #3947.

BUGFIX: @Jacksonized + fields marked transient would result in those transient fields being serialised which is surprising (and thus undesired) behaviour. #3936.

Commits

17c78fe [version] pre-release version bump
1edca70 [test][@Jacksonized] Test emission of warning when not choosing jackson ver...
e789e82 [test] Update the generation of eclipse test targets from JDK14 to JDK25.
a54cecd [trivial][changelog]
3db0a6c [bugfix][@Jacksonized] javac handler of jacksonized checked for existing ja...
12572fc [test] Adjusted tests to the new 'jackson version is a list' config key setup.
0e9699c [changelog] Document implementation of Jackson3 support: #3950.
d441be1 [jacksonized] infrastructure for previous merge resolution: Changed to the co...
d62b2d5 Merge branch 'master' into cachescrubber-gh-3950
f49f0fe [test] Remove tests for deprecated @Logger(access = MODULE). They're deprec...
Additional commits viewable in compare view

Updates commons-codec:commons-codec from 1.20.0 to 1.21.0

Changelog

Sourced from commons-codec:commons-codec's changelog.

Apache Commons Codec 1.21.0 Release Notes

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.21.0.

The Apache Commons Codec component contains encoders and decoders for formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

New features

CODEC-333: Add distinct Base64 decoding for standard and URL-safe formats. Thanks to Aleksandr Beliakov, Gary Gregory.

Fixed Bugs
        Fix oak leaf icon references in overview.html when running `mvn clean javadoc:javadoc`. Thanks to Gary Gregory.
        Fix Apache RAT plugin console warnings. Thanks to Gary Gregory.
        Fix malformed Javadoc comments. Thanks to Gary Gregory.
Changes
        Bump org.apache.commons:commons-parent from 91 to 96 [#415](https://github.com/apache/commons-codec/issues/415), [#418](https://github.com/apache/commons-codec/issues/418). Thanks to Gary Gregory, Dependabot.
        Bump commons-io:commons-io from 2.20.0 to 2.21.0. Thanks to Gary Gregory.
        Bump org.apache.commons:commons-lang3 from 3.19.0 to 3.20.0. Thanks to Gary Gregory, Dependabot.
For complete information on Apache Commons Codec, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Commons Codec website:

https://commons.apache.org/proper/commons-codec/

Download page: https://commons.apache.org/proper/commons-codec/download_codec.cgi

Commits

91c4404 Prepare for the release candidate 1.21.0 RC1
21fe1d7 Prepare for the next release candidate
d4ea4d0 Bump actions/checkout from 6.0.1 to 6.0.2
e30b1f6 Bump actions/setup-java from 5.1.0 to 5.2.0
2e4891c Bump org.apache.commons:commons-parent from 95 to 96
d02c003 Use a URL to a prettier page: https://www.ietf.org/rfc/rfc2045
3c961b8 Checkstyle
99cf6b7 Javadoc and exception messages: "base 32" -> "Base32".
2df7b9a Javadoc and exception messages: "base 64" -> "Base64".
0643fdd Javadoc 8 doesn't know how to find this link
Additional commits viewable in compare view

Updates jakarta.xml.bind:jakarta.xml.bind-api from 4.0.4 to 4.0.5

Release notes

Sourced from jakarta.xml.bind:jakarta.xml.bind-api's releases.

Jakarta XML Binding API 4.0.5

What's Changed

4.0.4 release by @lukasj in jakartaee/jaxb-api#324

#325 restore permissive base64 decoding by @laurentschoelens in jakartaee/jaxb-api#326

#330 fixes documentation by @laurentschoelens in jakartaee/jaxb-api#331

add dependabot by @lukasj in jakartaee/jaxb-api#332

move dependabot config to the right location by @lukasj in jakartaee/jaxb-api#333

Bump the actions-dependencies group with 2 updates by @dependabot[bot] in jakartaee/jaxb-api#334

Bump the dependencies group across 1 directory with 2 updates by @dependabot[bot] in jakartaee/jaxb-api#336

Bump the maven-plugins group across 2 directories with 15 updates by @dependabot[bot] in jakartaee/jaxb-api#335

Full Changelog: jakartaee/jaxb-api@4.0.4...4.0.5

Commits

33af600 Update API version of : to 4.0.5
e8bc066 Bump the maven-plugins group across 2 directories with 15 updates
5884465 Bump the dependencies group across 1 directory with 2 updates
a12f7b7 Bump the actions-dependencies group with 2 updates
1375104 move dependabot config to the right location
7680773 add dependabot
cd71d76 #330 fixes documentation
4d531bd #325 restore permissive base64 decoding
31505d0 Merge pull request #324 from jakartaee/4.0.4-RELEASE
c3f3109 Update API version of : to 4.0.5-SNAPSHOT
See full diff in compare view

Updates ch.qos.logback:logback-core from 1.5.21 to 1.5.32

Release notes

Sourced from ch.qos.logback:logback-core's releases.

Logback 1.5.32

2026-02-16 Release of logback version 1.5.32

• In DefaultProcessor, fixed incorrect check for dependencies contained within a parent model. Previous only the direct children were scanned. This fixes logback-access/issues/34.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e807335a67535b4eacce94e942c0bcb649665d93 associated with the tag v_1.5.32. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.31

2026-02-14 Release of logback version 1.5.31

• Fixed missing META-INF/services directory in logback-classic.jar. This issue rendered logback-classic version 1.5.30 unusable with SLF4J.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 168e42f9f9a18a3ffdf31eb2bfe80a71e33ecd8b associated with the tag v_1.5.31. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.30

2026-02-14 Release of logback version 1.5.30

• In this version, logback-classic.jar was missing the META-INF/services directory, making it unusable with SLF4J. Version 1.5.31 (released later on the same day) fixes this issue.

• Fix scanning issue when an included file becomes available at a later time. This problem was reported in issues/1021 by Sergey Nazarov.

• Standardized code for version checking across modules.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 44164f10ca3fb44ce0e68519f13564b87e3aca61 associated with the tag v_1.5.30. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.29

2026-02-09 Release of logback version 1.5.29

• In response to issues/1017, appender names and appender references are once again subject to variable substitution, reverting the change introduced in version 1.5.28.

Logback 1.5.28

2026-02-06 Release of logback version 1.5.28

• Appender names or appender references are no longer subject to variable substitution.

• Fixed issue with configurations with conditionals encompassing appenders. This was reported in issues/1016 reported by Sergey Sazonov.

• The element now admits a 'scan' attribute which can be used to override the 'scan' attribute in the element.

• Fixed NullPointerException thrown by VersionUtil.checkForVersionEquality method occurring with GraalVM Native Images. This issue was reported in issues/1014.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e7a1855ab562bb102333f754603ff89359bf3cfc associated with the tag v_1.5.28. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.27

2026-01-30 Release of logback version 1.5.27

• Updated license to Eclipse Public License version 2.0 from version 1.0, retaining the GPL 2.1 dual-license.

• Fixed missing MDC data transmitted by SocketAppender reported in issues/1010 by Lars Vogel.

... (truncated)

Commits

e807335 prepare release 1.5.32
dc35d55 fix logback-access/issues/34 by checking if dependency is a sub-model of the ...
8e32278 added simple test for appender definitiob via file inclusion
834dbed start work on 1.5.32-SNAPSHOT
168e42f add test to check that Logback SLF4J provider can be activated
ed45362 prepare release 1.5.31
609dae7 fix missing META-INF directory
7739739 start work on 1.5.31-SNAPSHOT
44164f1 prepare release 1.5.30
9874f06 test for top-file as a resource, introduced new module logback-classic-misc
Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.5.21 to 1.5.32

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.5.32

2026-02-16 Release of logback version 1.5.32

• In DefaultProcessor, fixed incorrect check for dependencies contained within a parent model. Previous only the direct children were scanned. This fixes logback-access/issues/34.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e807335a67535b4eacce94e942c0bcb649665d93 associated with the tag v_1.5.32. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.31

2026-02-14 Release of logback version 1.5.31

• Fixed missing META-INF/services directory in logback-classic.jar. This issue rendered logback-classic version 1.5.30 unusable with SLF4J.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 168e42f9f9a18a3ffdf31eb2bfe80a71e33ecd8b associated with the tag v_1.5.31. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.30

2026-02-14 Release of logback version 1.5.30

• In this version, logback-classic.jar was missing the META-INF/services directory, making it unusable with SLF4J. Version 1.5.31 (released later on the same day) fixes this issue.

• Fix scanning issue when an included file becomes available at a later time. This problem was reported in issues/1021 by Sergey Nazarov.

• Standardized code for version checking across modules.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 44164f10ca3fb44ce0e68519f13564b87e3aca61 associated with the tag v_1.5.30. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.29

2026-02-09 Release of logback version 1.5.29

• In response to issues/1017, appender names and appender references are once again subject to variable substitution, reverting the change introduced in version 1.5.28.

Logback 1.5.28

2026-02-06 Release of logback version 1.5.28

• Appender names or appender references are no longer subject to variable substitution.

• Fixed issue with configurations with conditionals encompassing appenders. This was reported in issues/1016 reported by Sergey Sazonov.

• The element now admits a 'scan' attribute which can be used to override the 'scan' attribute in the element.

• Fixed NullPointerException thrown by VersionUtil.checkForVersionEquality method occurring with GraalVM Native Images. This issue was reported in issues/1014.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e7a1855ab562bb102333f754603ff89359bf3cfc associated with the tag v_1.5.28. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.27

2026-01-30 Release of logback version 1.5.27

• Updated license to Eclipse Public License version 2.0 from version 1.0, retaining the GPL 2.1 dual-license.

• Fixed missing MDC data transmitted by SocketAppender reported in issues/1010 by Lars Vogel.

... (truncated)

Commits

e807335 prepare release 1.5.32
dc35d55 fix logback-access/issues/34 by checking if dependency is a sub-model of the ...
8e32278 added simple test for appender definitiob via file inclusion
834dbed start work on 1.5.32-SNAPSHOT
168e42f add test to check that Logback SLF4J provider can be activated
ed45362 prepare release 1.5.31
609dae7 fix missing META-INF directory
7739739 start work on 1.5.31-SNAPSHOT
44164f1 prepare release 1.5.30
9874f06 test for top-file as a resource, introduced new module logback-classic-misc
Additional commits viewable in compare view

Updates org.apache.tomcat.embed:tomcat-embed-core from 11.0.15 to 11.0.18

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the backend-prod group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | org.opensaml:opensaml-core-api | `5.1.6` | `5.2.1` | | org.opensaml:opensaml-core-impl | `5.1.6` | `5.2.1` | | org.opensaml:opensaml-saml-impl | `5.1.6` | `5.2.1` | | [org.projectlombok:lombok](https://github.com/projectlombok/lombok) | `1.18.42` | `1.18.44` | | [commons-codec:commons-codec](https://github.com/apache/commons-codec) | `1.20.0` | `1.21.0` | | [jakarta.xml.bind:jakarta.xml.bind-api](https://github.com/jakartaee/jaxb-api) | `4.0.4` | `4.0.5` | | [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) | `1.5.21` | `1.5.32` | | [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.5.21` | `1.5.32` | | org.apache.tomcat.embed:tomcat-embed-core | `11.0.15` | `11.0.18` | Updates `org.opensaml:opensaml-core-api` from 5.1.6 to 5.2.1 Updates `org.opensaml:opensaml-core-impl` from 5.1.6 to 5.2.1 Updates `org.opensaml:opensaml-saml-impl` from 5.1.6 to 5.2.1 Updates `org.projectlombok:lombok` from 1.18.42 to 1.18.44 - [Changelog](https://github.com/projectlombok/lombok/blob/master/doc/changelog.markdown) - [Commits](projectlombok/lombok@v1.18.42...v1.18.44) Updates `commons-codec:commons-codec` from 1.20.0 to 1.21.0 - [Changelog](https://github.com/apache/commons-codec/blob/master/RELEASE-NOTES.txt) - [Commits](apache/commons-codec@rel/commons-codec-1.20.0...rel/commons-codec-1.21.0) Updates `jakarta.xml.bind:jakarta.xml.bind-api` from 4.0.4 to 4.0.5 - [Release notes](https://github.com/jakartaee/jaxb-api/releases) - [Commits](jakartaee/jaxb-api@4.0.4...4.0.5) Updates `ch.qos.logback:logback-core` from 1.5.21 to 1.5.32 - [Release notes](https://github.com/qos-ch/logback/releases) - [Commits](qos-ch/logback@v_1.5.21...v_1.5.32) Updates `ch.qos.logback:logback-classic` from 1.5.21 to 1.5.32 - [Release notes](https://github.com/qos-ch/logback/releases) - [Commits](qos-ch/logback@v_1.5.21...v_1.5.32) Updates `org.apache.tomcat.embed:tomcat-embed-core` from 11.0.15 to 11.0.18 --- updated-dependencies: - dependency-name: org.opensaml:opensaml-core-api dependency-version: 5.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-prod - dependency-name: org.opensaml:opensaml-core-impl dependency-version: 5.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-prod - dependency-name: org.opensaml:opensaml-saml-impl dependency-version: 5.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-prod - dependency-name: org.projectlombok:lombok dependency-version: 1.18.44 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-prod - dependency-name: commons-codec:commons-codec dependency-version: 1.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-prod - dependency-name: jakarta.xml.bind:jakarta.xml.bind-api dependency-version: 4.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-prod - dependency-name: ch.qos.logback:logback-core dependency-version: 1.5.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-prod - dependency-name: ch.qos.logback:logback-classic dependency-version: 1.5.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-prod - dependency-name: org.apache.tomcat.embed:tomcat-embed-core dependency-version: 11.0.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-prod ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Mar 11, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the backend-prod group across 1 directory with 9 updates#17

Bump the backend-prod group across 1 directory with 9 updates#17
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/maven/backend-prod-0550519738

dependabot bot commented on behalf of github Mar 11, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.18.44 (March 11th, 2026)

Apache Commons Codec 1.21.0 Release Notes

New features

Fixed Bugs

Changes

Jakarta XML Binding API 4.0.5

What's Changed

Logback 1.5.32

Logback 1.5.31

Logback 1.5.30

Logback 1.5.29

Logback 1.5.28

Logback 1.5.27

Logback 1.5.32

Logback 1.5.31

Logback 1.5.30

Logback 1.5.29

Logback 1.5.28

Logback 1.5.27

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Mar 11, 2026 •

edited

Loading