)]}'
{
  "log": [
    {
      "commit": "7a5906de96ba03172f8ee8f71c2669b69069c118",
      "tree": "4d6c9582e1abbf5525abd12d85d716d6ccff19d9",
      "parents": [
        "ead84834c04e1481cc479daa22658da77b9318e1",
        "0fb12adb05ca4d9a8d9c06d302f64053d2e788a7"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Aug 17 09:01:04 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 17 09:01:04 2026 +0200"
      },
      "message": "Merge pull request #1273 from apache/dependabot/maven/production-dependencies-8c5f20ad2e\n\nbuild(deps): bump the production-dependencies group with 2 updates"
    },
    {
      "commit": "ead84834c04e1481cc479daa22658da77b9318e1",
      "tree": "9ff24bbcfaab466fd0ccdb9453ce525aefde1ffe",
      "parents": [
        "2f4e2d3e5ea2a6868a6711be0b6c327d652e643f"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Sat Aug 15 13:55:53 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Sat Aug 15 13:55:53 2026 -1000"
      },
      "message": "Bump the Swagger UI console to 5.32.13\n\nThe version is a string literal used to build a CDN URL, not a dependency, so\ndependabot never saw it and it sat at 4.15.5. Verified the three assets resolve\nat 5.32.13, and the emitted init script uses only API unchanged across 4.x to\n5.x.\n\nNeeds a manual look at the rendered page before release: nothing renders it in\nCI, and the tests only assert the version string appears in the HTML.\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "0fb12adb05ca4d9a8d9c06d302f64053d2e788a7",
      "tree": "e384cc51f20178d9a40616fd100ac894fdd8764d",
      "parents": [
        "2f4e2d3e5ea2a6868a6711be0b6c327d652e643f"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Aug 13 13:45:12 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 13 13:45:12 2026 +0000"
      },
      "message": "build(deps): bump the production-dependencies group with 2 updates\n\nBumps the production-dependencies group with 2 updates: [org.apache.httpcomponents.client5:httpclient5](https://github.com/apache/httpcomponents-client) and [org.junit.jupiter:junit-jupiter](https://github.com/junit-team/junit-framework).\n\n\nUpdates `org.apache.httpcomponents.client5:httpclient5` from 5.6.3 to 5.6.4\n- [Changelog](https://github.com/apache/httpcomponents-client/blob/rel/v5.6.4/RELEASE_NOTES.txt)\n- [Commits](https://github.com/apache/httpcomponents-client/compare/rel/v5.6.3...rel/v5.6.4)\n\nUpdates `org.junit.jupiter:junit-jupiter` from 6.1.2 to 6.1.3\n- [Release notes](https://github.com/junit-team/junit-framework/releases)\n- [Commits](https://github.com/junit-team/junit-framework/compare/r6.1.2...r6.1.3)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.httpcomponents.client5:httpclient5\n  dependency-version: 5.6.4\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: production-dependencies\n- dependency-name: org.junit.jupiter:junit-jupiter\n  dependency-version: 6.1.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: production-dependencies\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "2f4e2d3e5ea2a6868a6711be0b6c327d652e643f",
      "tree": "d0cc2ab83682bbe1a7618f674b1c82e01d7aaeb6",
      "parents": [
        "dccf15308405989b93b607bdbfd20102cc67a619"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 11 07:41:59 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 11 08:48:47 2026 -1000"
      },
      "message": "Cover IPv6 response endpoints and record how the body ceilings measure\n\nNeither gap that had to be fixed in the C implementation exists here, but for\nreasons worth writing down rather than rediscovering.\n\nThe body ceilings measure bytes actually read, not a declared Content-Length,\nso a chunked body is bounded on the same terms as a declared one. The\nform-urlencoded builder wraps the stream; the multipart path relies on\ncommons-fileupload2, which pairs its Content-Length fast path with a streaming\nguard. SECURITY.md now says so, because the reverse is the easy mistake to make\nwhen adding a limit: screening the header before the read leaves\nTransfer-Encoding: chunked unbounded, which declares no length.\n\nAddress classification is address-family agnostic because it defers to\nInetAddress rather than parsing hosts, and URI.getHost keeps the brackets in a\nform InetAddress accepts. The one part not inherited is fc00::/7, since\nisSiteLocalAddress answers only for the deprecated fec0::/10; isUniqueLocalIPv6\nalready covered it.\n\nWhat was missing was any test at all: seventeen cases, none of them IPv6, so\nthe behaviour was right and unverified and a regression would have been silent.\nThree tests now cover the always-refused set, the IPv4-mapped metadata address,\nand loopback and unique-local under the private-network switch, plus a global\naddress as the control so the suite cannot pass by refusing IPv6 wholesale.\nRemoving the isUniqueLocalIPv6 clause fails exactly one of them; 20 pass with\nit in place.\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "dccf15308405989b93b607bdbfd20102cc67a619",
      "tree": "83fe45f668b6a22d2203c87fde592a2a4c43c07f",
      "parents": [
        "0e02005f8b6557af7b91f8bee5e082d00fdeec24",
        "8aa4db5d61807072ddc5e924cb03564cd5371f54"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Fri Aug 07 10:49:48 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 07 10:49:48 2026 +0200"
      },
      "message": "Merge pull request #1269 from apache/dependabot/maven/production-dependencies-957f099693\n\nbuild(deps): bump the production-dependencies group with 4 updates"
    },
    {
      "commit": "8aa4db5d61807072ddc5e924cb03564cd5371f54",
      "tree": "83fe45f668b6a22d2203c87fde592a2a4c43c07f",
      "parents": [
        "0e02005f8b6557af7b91f8bee5e082d00fdeec24"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Aug 07 08:35:28 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 07 08:35:28 2026 +0000"
      },
      "message": "build(deps): bump the production-dependencies group with 4 updates\n\nBumps the production-dependencies group with 4 updates: [com.fasterxml.woodstox:woodstox-core](https://github.com/FasterXML/woodstox), org.eclipse.jetty.ee10:jetty-ee10-webapp, org.eclipse.jetty.ee10:jetty-ee10-maven-plugin and org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin.\n\n\nUpdates `com.fasterxml.woodstox:woodstox-core` from 7.2.1 to 7.2.2\n- [Commits](https://github.com/FasterXML/woodstox/compare/woodstox-core-7.2.1...woodstox-core-7.2.2)\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-webapp` from 12.1.11 to 12.1.12\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-maven-plugin` from 12.1.11 to 12.1.12\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin` from 12.1.11 to 12.1.12\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-maven-plugin` from 12.1.11 to 12.1.12\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin` from 12.1.11 to 12.1.12\n\n---\nupdated-dependencies:\n- dependency-name: com.fasterxml.woodstox:woodstox-core\n  dependency-version: 7.2.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: production-dependencies\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-webapp\n  dependency-version: 12.1.12\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: production-dependencies\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-maven-plugin\n  dependency-version: 12.1.12\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: production-dependencies\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin\n  dependency-version: 12.1.12\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: production-dependencies\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-maven-plugin\n  dependency-version: 12.1.12\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: production-dependencies\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin\n  dependency-version: 12.1.12\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n  dependency-group: production-dependencies\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "0e02005f8b6557af7b91f8bee5e082d00fdeec24",
      "tree": "5939abdbd38ee1c84d695707e67f6357032571e2",
      "parents": [
        "107b8d73d5270c7c9d11820e6969da57f30bb1c3",
        "bc1e4df01d26b61d2f88803744933352e6f04f84"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Fri Aug 07 10:25:48 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 07 10:25:48 2026 +0200"
      },
      "message": "Merge pull request #1268 from apache/cortlepp/group-dependabot-prs\n\ndependabot: enable groups, change frequency to weekly"
    },
    {
      "commit": "bc1e4df01d26b61d2f88803744933352e6f04f84",
      "tree": "4d90fb20fda7af82fddc60398cf2aacd85c5febd",
      "parents": [
        "91b9bb8d371b3313ba5aa2329ac78deb0e528442"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Fri Aug 07 10:24:54 2026 +0200"
      },
      "committer": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Fri Aug 07 10:24:54 2026 +0200"
      },
      "message": "dependabot: enable groups, change frequency to weekly\n"
    },
    {
      "commit": "107b8d73d5270c7c9d11820e6969da57f30bb1c3",
      "tree": "db02077a76f7fb6aa5a47c6f92f7c4e2cd92fba4",
      "parents": [
        "91b9bb8d371b3313ba5aa2329ac78deb0e528442",
        "c292ba83a61093f49b6c0e1b932cc623d8309a7e"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Fri Aug 07 10:13:57 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 07 10:13:57 2026 +0200"
      },
      "message": "Merge pull request #1267 from apache/dependabot/maven/swagger.version-2.2.53\n\nbuild(deps): bump swagger.version from 2.2.52 to 2.2.53"
    },
    {
      "commit": "c292ba83a61093f49b6c0e1b932cc623d8309a7e",
      "tree": "db02077a76f7fb6aa5a47c6f92f7c4e2cd92fba4",
      "parents": [
        "91b9bb8d371b3313ba5aa2329ac78deb0e528442"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Aug 06 13:46:45 2026 +0000"
      },
      "committer": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Fri Aug 07 09:52:28 2026 +0200"
      },
      "message": "build(deps): bump swagger.version from 2.2.52 to 2.2.53\n\nBumps `swagger.version` from 2.2.52 to 2.2.53.\n\nUpdates `io.swagger.core.v3:swagger-core` from 2.2.52 to 2.2.53\n- [Release notes](https://github.com/swagger-api/swagger-core/releases)\n- [Commits](https://github.com/swagger-api/swagger-core/compare/v2.2.52...v2.2.53)\n\nUpdates `io.swagger.core.v3:swagger-models` from 2.2.52 to 2.2.53\n\nUpdates `io.swagger.core.v3:swagger-annotations` from 2.2.52 to 2.2.53\n\n---\nupdated-dependencies:\n- dependency-name: io.swagger.core.v3:swagger-core\n  dependency-version: 2.2.53\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: io.swagger.core.v3:swagger-models\n  dependency-version: 2.2.53\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: io.swagger.core.v3:swagger-annotations\n  dependency-version: 2.2.53\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "91b9bb8d371b3313ba5aa2329ac78deb0e528442",
      "tree": "4089fae774cff4010040086b0a5727614ac7f807",
      "parents": [
        "83745f3a45b71ed27392af0563d58c2f1d5eed58",
        "a9fef79b26ebcea3869d7bedb33117b664196293"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Fri Aug 07 09:33:03 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 07 09:33:03 2026 +0200"
      },
      "message": "Merge pull request #1264 from apache/dependabot/github_actions/actions/setup-java-5.7.0\n\nbuild(deps): bump actions/setup-java from 5.6.0 to 5.7.0"
    },
    {
      "commit": "83745f3a45b71ed27392af0563d58c2f1d5eed58",
      "tree": "225f8359a9b2890721be369e266ae3d79e11ef48",
      "parents": [
        "f5431eaaadb40812ff70c1d7ca82dbea00b4b589",
        "84a5bad8d2f2583320097049ab0d76049cb568de"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Fri Aug 07 09:32:46 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 07 09:32:46 2026 +0200"
      },
      "message": "Merge pull request #1265 from apache/dependabot/maven/groovy.version-5.0.8\n\nbuild(deps): bump groovy.version from 5.0.7 to 5.0.8"
    },
    {
      "commit": "f5431eaaadb40812ff70c1d7ca82dbea00b4b589",
      "tree": "e1d2f648ac82360a6b2ca943066ab30f9b10b2b3",
      "parents": [
        "91bfe95c2463c105ca29b781b62934c9fa355ebc",
        "3c8227f1499309e85359625d4c49b44721768ae7"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Fri Aug 07 09:32:38 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 07 09:32:38 2026 +0200"
      },
      "message": "Merge pull request #1266 from apache/dependabot/maven/xmlunit.version-2.13.0\n\nbuild(deps): bump xmlunit.version from 2.12.0 to 2.13.0"
    },
    {
      "commit": "91bfe95c2463c105ca29b781b62934c9fa355ebc",
      "tree": "58a1eee2f757073fa9869fcf72c238e15c966037",
      "parents": [
        "1ba2b127412e9437a4b9b266bec09ca434ecdc95"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Thu Aug 06 06:43:13 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Thu Aug 06 06:43:13 2026 -1000"
      },
      "message": "Opt the JAX-WS integration repositories into decoupled responses\n\nThe async-with-addressing tests reply to a non-anonymous wsa:ReplyTo, so they\nneed the same two settings as the other decoupled-response suites. Caught by a\nfull reactor build; the jaxws module alone passes, because the affected tests\nlive in jaxws-integration.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "1ba2b127412e9437a4b9b266bec09ca434ecdc95",
      "tree": "e2614b5f204eea1aab1b982c09688c0d92c714ee",
      "parents": [
        "c201358271648def286e3619342de70b3af404c5"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Thu Aug 06 06:29:39 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Thu Aug 06 06:29:39 2026 -1000"
      },
      "message": "Opt the transport and sample repositories into decoupled responses\n\nCI caught what the module-by-module runs did not: transport/tcp failed on all\nthree JDKs and transport/udp hung the build outright at module 32 of 76, so 44\nmodules never ran. Both use setUseSeparateListener with a non-anonymous reply\naddress over their own transport, and UDPTest sets an infinite client timeout,\nwhich turns a refused reply into a hang rather than a failure.\n\nThey were refused twice over: decoupled responses are off by default, and the\npermitted scheme list is https alone, so tcp:// and udp:// would not have passed\neven with the gate open. Both settings are now made in the TCP transport\u0027s two\nconfig files and in the testkit\u0027s generated repository, which is what the UDP\ntests load. That pair of settings is the migration any deployment replying over\na non-HTTP transport has to make, so the configs double as its example.\n\nThe userguide Dual clients get the same treatment. They are the shipped\ndemonstration of separate-listener replies and would otherwise no longer work\nwhen run, with a note that a real deployment also wants httpFrontendHostUrl.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "c201358271648def286e3619342de70b3af404c5",
      "tree": "9bfe5105b9cdd962e08cd9a9b07db8286a381b0c",
      "parents": [
        "5ec4d1525eb830102168866727f7f5a5aebfb2ac"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Thu Aug 06 04:00:21 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Thu Aug 06 04:00:21 2026 -1000"
      },
      "message": "Document the 2.0.2 hardening in the threat model\n\nSECURITY.md described the state before this round of work, so a reader would\nhave taken the WS-Addressing egress path, the unbounded request builders and\nthe uneven metadata gating as still current.\n\nFour additions to the hardening list: the response-endpoint policy and why\ndecoupled responses are declined by default, the request-body ceilings and\ntemp-file lifecycle, the OpenAPI and Swagger UI output handling, and the now\nuniform enforcement of exposeServiceMetadata. The attack-surface and URL tables\nare updated to match -- the OpenAPI routes were listed as plain anonymous, and\nthe metadata row named only three of the routes that gate on the parameter.\n\nThe response-endpoint entry states its own limitation rather than leaving it\nimplied: the destination is resolved to check it and resolved again to connect,\nwhich pinning would close but the transport cannot currently do, so cloud\ndeployments still want egress controls alongside it.\n\nEvery parameter named here was checked against the code.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "5ec4d1525eb830102168866727f7f5a5aebfb2ac",
      "tree": "9aabd50f5ed78683904616518da5d4c78a5ae72f",
      "parents": [
        "75191f775288d0f068f3ffc1c6e337f7b889b2f7"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Wed Aug 05 14:47:30 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Wed Aug 05 14:47:30 2026 -1000"
      },
      "message": "Drop third-party references from test documentation\n\nThese comments explained themselves by pointing at who had said what, which is\nnot information the code needs and not appropriate to carry in the tree. Same\nrationale stated without it.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "75191f775288d0f068f3ffc1c6e337f7b889b2f7",
      "tree": "2feabbe77528983adcd04c0b05f2eed945dc756e",
      "parents": [
        "1d325f4deb20f2ee5d2be97e3c618339009d259f"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Wed Aug 05 09:05:06 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Wed Aug 05 09:05:06 2026 -1000"
      },
      "message": "Do not follow redirects when sending a decoupled response\n\nThe scheme allow-list and the address checks both run against the endpoint\nreference the caller supplied, and nothing re-examines where a redirect leads.\nHttpClientBuilder is used with defaults here, and RequestConfig.DEFAULT has\nredirects enabled with a limit of 50, so a caller whose own reply endpoint\nanswers 307 could name somewhere the policy had already refused -- the\nHTTP-only instance-metadata address being the obvious one. That is precisely\nthe protocol-downgrade route past an HTTPS-only allow-list.\n\nRedirects are now disabled for a server-side send to a non-anonymous\ndestination, which is exactly the decoupled-response case. The reply is\nfire-and-forget, so nothing legitimate depends on following one. Ordinary\nclient-side requests are untouched.\n\nThe test drives the real RequestImpl against a local server that answers 307,\nand asserts the rebound target is never reached. It carries a control that\nsends the same request client-side and asserts the target IS reached, so the\nmain assertion cannot pass by the request simply failing, plus an anonymous\nserver-side case to show the restriction is scoped and not blanket.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "1d325f4deb20f2ee5d2be97e3c618339009d259f",
      "tree": "d7d0f0f8018db11f076cc2e3350e1d988edbee57",
      "parents": [
        "52c7ba310fcaca1ff60d596d2b118d34851eb4b7"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Wed Aug 05 08:30:30 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Wed Aug 05 08:30:30 2026 -1000"
      },
      "message": "Permit only https as a reply scheme unless told otherwise\n\nThe previous default list -- http, https, jms, mailto, tcp -- was wider than\nany real deployment needs. Dropping to https alone matters most for the http\nexclusion, which is not merely tidying: the cloud instance-metadata services\nthis class of SSRF is aimed at are HTTP-only. AWS and Azure on 169.254.169.254\nand GCP on metadata.google.internal offer no HTTPS listener, so refusing the\nscheme removes that target without relying on the address checks at all.\n\njms, mailto and tcp keep their senders but become opt-in; a deployment naming\none of them, or genuinely replying over plain HTTP inside a trusted network,\nlists it in allowedResponseEndpointSchemes.\n\nWorth being clear about the size of the win: this list is only consulted once\nallowNonAnonymousResponseEndpoints is on, and that now defaults to false, so\nthis is defence in depth inside an already opt-in path rather than a\nfirst-line control.\n\nAlso renames the class to AddressingResponseEndpointPolicy. It is reached from\ntwo places, both WS-Addressing: the header parsing in AddressingInHandler, and\nMessageContextBuilder where a non-anonymous response endpoint acquires its\ntransport. Now that it sits in the kernel and is called from generic code, the\nbare name under-specified what it governs; the new one matches the\nAddressingHelper / AddressingFaultsHelper / AddressingConstants family beside\nit in the same package.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "52c7ba310fcaca1ff60d596d2b118d34851eb4b7",
      "tree": "5ea22ffa14f590c4c4afabafcbb8e74981aca213",
      "parents": [
        "1b6856b4d7903780786c79327bed1b53ea051a15"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Wed Aug 05 07:48:02 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Wed Aug 05 07:48:02 2026 -1000"
      },
      "message": "Also gate the response endpoint where the transport is acquired\n\nCorrects a claim I had made: CXF does not check at the inbound-parsing layer.\nIts check sits in DecoupledDestination.getBackChannel -- the method that hands\nback the conduit for a decoupled response -- so anything reaching for that\nback channel is screened however the endpoint reference arrived. Checking only\nin AddressingInHandler was weaker, and the report\u0027s proof-of-concept showed\nit: it builds\na MessageContext, calls setReplyTo directly and drives the transport sender,\nnever passing through header parsing, and the server still connected out.\n\nMessageContextBuilder.setupCorrectTransportOut is the Axis2 analogue. It runs\nonly for a server-side response to a non-anonymous, non-none destination, and\nit is where that destination\u0027s transport is resolved -- the same depth as CXF\u0027s\ncheck. The policy therefore moves to the kernel org.apache.axis2.addressing\npackage, beside EndpointReference and AddressingFaultsHelper, so both the\nhandler and the kernel can use it. The handler check stays: it faults early\nwith a proper wsa fault on the path a remote caller actually has.\n\nThe PoC now fails on both its positive cases. The resolver pool shutdown moves\nfrom the addressing module to AxisConfiguration.cleanup(), next to the\nmultipart reaper, since the policy is no longer module-scoped.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "1b6856b4d7903780786c79327bed1b53ea051a15",
      "tree": "84c79f52c233ef5e22fe10102ece999752deabbc",
      "parents": [
        "a483b5cdfdf544587583ba77855a9b91bcdbc420"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Wed Aug 05 07:08:56 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Wed Aug 05 07:08:56 2026 -1000"
      },
      "message": "Refuse decoupled WS-Addressing responses by default\n\nFollows Apache CXF, whose implementation of the same decision is now visible\nin full: org.apache.cxf.ws.addressing.decoupled.enabled defaults to false and\ngates non-anonymous wsa:ReplyTo/FaultTo outright, with a scheme allowlist\nenforced even for pre-approved exchanges. Notably CXF implements no IP-range\ncheck at all -- the on/off gate plus the scheme list is their whole answer.\n\nThat is the better primary control and it is now the Axis2 default too. The\nrange check alone was a partial defence: refusing RFC-1918 and loopback still\nleft the server able to deliver a response body to any public host the caller\nnamed, which is the exfiltration half of a non-blind SSRF. Refusing decoupled\nresponses outright closes both halves, is a single boolean to document, and\nfails loudly so a deployment that needs the feature finds out immediately.\nblockPrivateNetworkResponseEndpoints stays as a secondary control for\ndeployments that turn decoupled responses back on.\n\nCXF carved out WS-RM via a pre-approval property. Axis2 needs no equivalent:\nSandesha is dead and the only in-tree references to it are commented out.\n\nThe feature is exercised by 17 integration tests -- the async, two-channel,\nthird-party-callback and separate-listener MTOM cases -- which now opt in\nthrough their test repositories. That opt-in is the migration a real\ndeployment makes, so the tests double as its documentation. Such deployments\nshould also set httpFrontendHostUrl, since the generated reply address\notherwise defaults to the client machine\u0027s local IP.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "a483b5cdfdf544587583ba77855a9b91bcdbc420",
      "tree": "673cf760111107e578ed45b0f030db4773f73708",
      "parents": [
        "cbcccb33bc35ba9977fcd905158be44947df8bae"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 14:26:34 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 14:26:34 2026 -1000"
      },
      "message": "Publish a relative OpenAPI server URL instead of following the Host\n\nCloses F3 by default rather than leaving it to configuration. The earlier\nposition -- that a relative servers[].url risked breaking MCP clients that need\nan absolute one -- does not survive contact with the actual consumers.\n\nAxis2\u0027s own MCP catalog never emits servers[] or any absolute base URL;\ngenerateMcpCatalogJson publishes relative paths (\"POST /services/...\") and a\nrelative tokenEndpoint, so /openapi-mcp.json was never affected by this at all.\nThe claim in the report that MCP tool clients use servers[].url does not hold\nfor this implementation.\n\nNor do the JSON and OpenAPI clients this surface was designed against. Those\nsurveyed carry no MCP code, do not fetch the specification at runtime -- one\nbundles a snapshot of it -- and resolve their base URL from configuration.\nNone of them reads servers[].url.\n\nSo servers[].url is now the context path. OpenAPI 3 resolves that against\nwherever the document was fetched from, which is both safer -- the URL a\nconsumer sends credentials to is no longer chosen by whoever set the Host -- and\nmore accurate behind a proxy. openapi.serverBaseUrl still pins an absolute URL\nwhere one is wanted.\n\nThe HTTP/2 tests asserted the spec advertised an https:// server; a relative URL\ninherits the document\u0027s scheme, so that premise is obsolete and they now assert\nrelativity instead.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "cbcccb33bc35ba9977fcd905158be44947df8bae",
      "tree": "2444695631430e474ffe40cb06921bb827dc1d4b",
      "parents": [
        "0e256fd0c502dd67e5a7b966a8a0c4d47881c04b"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 11:04:53 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 11:04:53 2026 -1000"
      },
      "message": "Bound and shut down the response-endpoint resolver pool\n\nSecond pre-push review pass, both findings valid against the previous commit.\n\nThe cached pool was unbounded, so naming many distinct slow-resolving hosts\ncould spawn a thread per request -- one denial of service traded for another.\nIt is now capped at four threads with a 64-deep queue; a lookup refused because\nthe queue is full rejects the endpoint, which fails closed.\n\nThe pool was also never stopped, leaking the class loader across a\nredeployment. The addressing module already implements Module.shutdown, so the\npool is torn down there -- the same treatment MultipartTempFileTracker gets from\nAxisConfiguration.cleanup(), which this had not mirrored.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "0e256fd0c502dd67e5a7b966a8a0c4d47881c04b",
      "tree": "dc5a80382f3624ea7bd019b315d090f5765f7f01",
      "parents": [
        "bb87bdec6b15def86529e8aeca3c03e7ddf31ed9"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 08:40:40 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 08:40:40 2026 -1000"
      },
      "message": "Bound the response-endpoint name lookup\n\nPre-push Gemini review flagged the DNS lookup in resolvesToRestrictedAddress as\na blocking call on the request path, which is right: InetAddress offers no\ntimeout of its own, so a caller could pin threads just by naming hosts that\nresolve slowly.\n\nTwo changes. A literal address is now recognised syntactically and never sent\nto the resolver, which covers the direct-IP cases including the\ninstance-metadata address. A real host name is resolved on a daemon thread the\ncaller can give up on, bounded by responseEndpointResolveTimeoutMillis\n(default 2000); on timeout the endpoint is refused, since a name that will not\nresolve promptly here would stall or fail the send anyway.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "bb87bdec6b15def86529e8aeca3c03e7ddf31ed9",
      "tree": "7a8e29d9a27e07b883d2deb2ddbeeedd5b02ab86",
      "parents": [
        "8c783edfdbcd5490a0eb2bedbc3c6a797239b767",
        "fd9364499cf8adedff7bb48c8a823f8a18381b34"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 08:27:49 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 08:27:49 2026 -1000"
      },
      "message": "Merge remote-tracking branch \u0027origin/master\u0027\n"
    },
    {
      "commit": "8c783edfdbcd5490a0eb2bedbc3c6a797239b767",
      "tree": "2bc3321e9931c969a993d7d258bb175702d1118e",
      "parents": [
        "173bad188265168bd8ac898aa68f4bbb3d16b7d1",
        "cfbaf6a6484f634d4937477f2e1391c57f733635"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 08:27:21 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 08:27:21 2026 -1000"
      },
      "message": "Harden five anonymous-reachable surfaces from a private security report\n\nReported privately via security@apache.org on 2026-07-30 against\n54de37f455. All five reproduce; four are fixed here, one (F3) is\nhardened with an opt-in rather than treated as a vulnerability.\n\nF1 CWE-918  WS-Addressing ReplyTo/FaultTo drive a server-initiated connection\n            to a caller-chosen address. Screened in AddressingInHandler, at the\n            inbound trust boundary, rather than in the transport sender, which\n            also carries legitimate client calls. Link-local, wildcard and\n            multicast refused always; loopback and private ranges behind\n            blockPrivateNetworkResponseEndpoints.\nF2 CWE-79   The Host reached an inline script unescaped in the Swagger UI page.\n            URI.create did not neutralise it. Host validated, output encoded for\n            the script context, inline block nonced under a CSP.\nF3 CWE-644  servers[].url followed the request Host. Added openapi.serverBaseUrl\n            to pin it; the request-derived default still follows the Host, as it\n            does in comparable OpenAPI implementations.\nF4 CWE-770  The multipart and form-urlencoded builders read the transport stream\n            directly, so the container\u0027s post limit never applied. Both bounded,\n            configurable per service. Multipart temp files are now deleted\n            rather than accumulating.\nF5 CWE-862  The .xsd/.wsdl file routes, HTTPWorker\u0027s named-WSDL route and the\n            whole OpenAPI/MCP generator ignored exposeServiceMetadata.\n\nCVEs to be requested after release, per the process followed for\nCVE-2026-66713.\n"
    },
    {
      "commit": "cfbaf6a6484f634d4937477f2e1391c57f733635",
      "tree": "2bc3321e9931c969a993d7d258bb175702d1118e",
      "parents": [
        "9ad5b471acc7719c208785a95dbae1328d6c1a95"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 08:27:04 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 08:27:04 2026 -1000"
      },
      "message": "Cover the attack path an inbound wsa:ReplyTo actually takes\n\nThe proof-of-concept supplied with the report drives the transport sender\nafter setting ReplyTo\nprogrammatically, which no remote caller can do, and the policy unit tests call\nthe check directly. Neither exercises the only route in from outside: a\nwsa:ReplyTo or wsa:FaultTo header on an inbound message, parsed by\nAddressingInHandler.\n\nThese tests send that header and assert the handler faults on a link-local\naddress, accepts an ordinary external one, and follows\nblockPrivateNetworkResponseEndpoints for a private one.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "9ad5b471acc7719c208785a95dbae1328d6c1a95",
      "tree": "9a2f1c8b1956dd17f3dc3248340c77ae6f959a5e",
      "parents": [
        "f98c5d49436fd92bb3c20ccc2fd4a30935225108"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 08:00:01 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 08:00:01 2026 -1000"
      },
      "message": "Only refuse never-legitimate reply destinations by default\n\nBlocking every private destination broke decoupled responses. Axis2\u0027s own\nThirdPartyResponseRawXMLTest replies to http://127.0.0.1:\u003cport\u003e/... and it\npassed on master but failed with the policy in place -- and that test is\nrepresentative, since both ends of an intranet dual-channel exchange are\nusually on RFC 1918.\n\nSplit the check. Link-local, wildcard and multicast are refused unconditionally:\nnone is ever a legitimate reply target, and link-local is what covers the cloud\ninstance-metadata address that gives this class of SSRF most of its impact.\nLoopback and the private ranges move behind blockPrivateNetworkResponseEndpoints,\nnow defaulting to false, for deployments whose callers are outside the trusted\nnetwork.\n\nAlso renames MultipartTempFileCleanupTest to MultipartFormDataBuilderTest and\nadds the end-to-end size assertions it was missing: the supplied\nproof-of-concept proves\nthe ceiling by reconstructing its own upload object rather than calling\nprocessDocument, so nothing until now showed the real builder refusing an\noversized body.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "f98c5d49436fd92bb3c20ccc2fd4a30935225108",
      "tree": "a8e53411dd0e82d6dcdf5f0cf6556651e6f0941e",
      "parents": [
        "1b5b2fcac5336568e51dc893d24543c6c47d6d78"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 06:39:32 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 06:39:32 2026 -1000"
      },
      "message": "Mirror the new tuning parameters into the webapp axis2.xml\n\nmodules/webapp/conf/axis2.xml is the copy that ships inside the WAR, so a\ndeployment editing that file would not otherwise have discovered the request\nsize ceilings or the WS-Addressing response endpoint policy. The code defaults\napplied either way; this is so the knobs are documented where operators look\nfor them.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "1b5b2fcac5336568e51dc893d24543c6c47d6d78",
      "tree": "9f33450e4870ab7eab49dad50a09999992b03ff5",
      "parents": [
        "2b98e5a31c793589915711f5e29fb4ffb697de70"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 06:38:37 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 06:38:37 2026 -1000"
      },
      "message": "Do not restrict WS-Addressing reply endpoints to HTTP\n\nThe egress policy added in 1671a68660 allowed only http and https schemes,\nwhich was wrong. MessageContextBuilder.setupCorrectTransportOut resolves the\nresponse transport from the endpoint reference\u0027s scheme against whatever is\nregistered, so a decoupled reply over JMS, mail or TCP is a legitimate Axis2\nconfiguration and the policy would have faulted it.\n\nDefault the scheme list to http,https,jms,mailto,tcp and make it configurable\nvia allowedResponseEndpointSchemes. The pivot-only schemes -- file, gopher,\njar, ftp -- stay out, and the private-range check still applies to any address\nthat names a host, so tcp://127.0.0.1 is refused the same as http://127.0.0.1.\nSchemes that name a destination rather than a network host, such as mailto: and\nJNDI-style jms:, have no address to range-check and pass.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "2b98e5a31c793589915711f5e29fb4ffb697de70",
      "tree": "05d6f428f2517d3041dc644dd06265390965155c",
      "parents": [
        "1671a68660df39459bf22f7b00309e2a8e782117"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 05:59:11 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 05:59:11 2026 -1000"
      },
      "message": "Delete multipart temporary files instead of accumulating them\n\nSecond half of the F4 fix from the private 2026-07-30 report. The size ceilings\nbounded what one request could write; nothing deleted it afterwards, so temp\nfiles accumulated for the lifetime of the JVM.\n\nThe two kinds of part have different lifetimes, so they are handled separately.\nA form field is fully materialised into the parameter map during the build, so\nthe builder deletes its temp file on the way out. A file part stays readable\nthrough the DataHandler the service is about to be handed, so it cannot be\ndeleted during the build; those register with a commons-io FileCleaningTracker\nand are deleted once the owning DiskFileItem is unreachable.\n\nThe reaper is a daemon thread created on the first multipart request, so a\ndeployment that never receives one never starts it, and AxisConfiguration\n.cleanup() stops it so it cannot outlive a redeployment and pin the web\napplication class loader. A tracker that has been shut down is replaced rather\nthan reused, since exitWhenFinished is permanent.\n\nAbstractFileUpload.parseRequest already deletes partially-written items when a\nparse fails, so a request rejected by the new ceilings still cleans up after\nitself -- verified, because otherwise the limit would have been a cheaper way to\nlitter the temp directory than a successful upload.\n\nThe 100 MB multipart default stands: far above any plausible legitimate form\npost, with a per-service override and -1 to restore the old behaviour.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "1671a68660df39459bf22f7b00309e2a8e782117",
      "tree": "a5a2824ec4b43676fc4512b924b11da9c47631e8",
      "parents": [
        "173bad188265168bd8ac898aa68f4bbb3d16b7d1"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 05:17:16 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Tue Aug 04 05:17:16 2026 -1000"
      },
      "message": "Harden five anonymous-reachable surfaces reported privately on 2026-07-30\n\nPrivate security report against 54de37f455. Not for push until the PMC has\nruled on CVE assignment and the embargo lifts.\n\nWS-Addressing ReplyTo/FaultTo egress (report F1): screen inbound non-anonymous\nresponse endpoints in AddressingInHandler rather than in the transport sender,\nwhich also carries legitimate client-initiated calls. Default policy refuses\nloopback, link-local, and private destinations; allowNonAnonymousResponseEndpoints\n\u003dfalse gives the stricter posture CXF made its default in PR #3279.\n\nSwagger UI XSS (F2): the Host reached an inline script unescaped. URI.create,\nadded in 212440b614, does not neutralise it -- the breakout payload is a legal\nauthority and round-trips unchanged. Validate the host, encode for the script\ncontext, and nonce the inline block under a CSP.\n\nOpenAPI servers[].url (F3): add openapi.serverBaseUrl so an operator can pin the\npublished URL, and validate the host when falling back to the request.\n\nRequest-body ceilings (F4): the multipart and form-urlencoded builders read the\ntransport stream directly, so the container\u0027s post limit never applies. Bound\nboth, configurable per service; -1 restores the old behaviour.\n\nexposeServiceMetadata (F5): the .xsd/.wsdl file routes, HTTPWorker\u0027s named-WSDL\nroute, and the whole OpenAPI/MCP generator ignored the gate their siblings apply.\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "3c8227f1499309e85359625d4c49b44721768ae7",
      "tree": "d0f667df557d4fa3e76a3ebaa8d28eb5c7cbea35",
      "parents": [
        "fd9364499cf8adedff7bb48c8a823f8a18381b34"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Aug 03 15:20:27 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 03 15:20:27 2026 +0000"
      },
      "message": "build(deps): bump xmlunit.version from 2.12.0 to 2.13.0\n\nBumps `xmlunit.version` from 2.12.0 to 2.13.0.\n\nUpdates `org.xmlunit:xmlunit-legacy` from 2.12.0 to 2.13.0\n- [Release notes](https://github.com/xmlunit/xmlunit/releases)\n- [Changelog](https://github.com/xmlunit/xmlunit/blob/main/RELEASE_NOTES.md)\n- [Commits](https://github.com/xmlunit/xmlunit/compare/v2.12.0...v2.13.0)\n\nUpdates `org.xmlunit:xmlunit-assertj3` from 2.12.0 to 2.13.0\n- [Release notes](https://github.com/xmlunit/xmlunit/releases)\n- [Changelog](https://github.com/xmlunit/xmlunit/blob/main/RELEASE_NOTES.md)\n- [Commits](https://github.com/xmlunit/xmlunit/compare/v2.12.0...v2.13.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.xmlunit:xmlunit-legacy\n  dependency-version: 2.13.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n- dependency-name: org.xmlunit:xmlunit-assertj3\n  dependency-version: 2.13.0\n  dependency-type: direct:development\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "84a5bad8d2f2583320097049ab0d76049cb568de",
      "tree": "61be2710bdb2299294ead5b3e91c7aa6ca944150",
      "parents": [
        "fd9364499cf8adedff7bb48c8a823f8a18381b34"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Aug 03 15:18:52 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 03 15:18:52 2026 +0000"
      },
      "message": "build(deps): bump groovy.version from 5.0.7 to 5.0.8\n\nBumps `groovy.version` from 5.0.7 to 5.0.8.\n\nUpdates `org.apache.groovy:groovy` from 5.0.7 to 5.0.8\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.apache.groovy:groovy-ant` from 5.0.7 to 5.0.8\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.apache.groovy:groovy-xml` from 5.0.7 to 5.0.8\n- [Commits](https://github.com/apache/groovy/commits)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.groovy:groovy\n  dependency-version: 5.0.8\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.apache.groovy:groovy-ant\n  dependency-version: 5.0.8\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.apache.groovy:groovy-xml\n  dependency-version: 5.0.8\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "a9fef79b26ebcea3869d7bedb33117b664196293",
      "tree": "8ccef03af52cae4d64a22ce62b59de1152b85286",
      "parents": [
        "fd9364499cf8adedff7bb48c8a823f8a18381b34"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Aug 03 15:18:49 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 03 15:18:49 2026 +0000"
      },
      "message": "build(deps): bump actions/setup-java from 5.6.0 to 5.7.0\n\nBumps [actions/setup-java](https://github.com/actions/setup-java) from 5.6.0 to 5.7.0.\n- [Release notes](https://github.com/actions/setup-java/releases)\n- [Commits](https://github.com/actions/setup-java/compare/03ad4de0992f5dab5e18fcb136590ce7c4a0ac95...b6effb05e454b25005698d916606bdc6ffcbf961)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-java\n  dependency-version: 5.7.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "fd9364499cf8adedff7bb48c8a823f8a18381b34",
      "tree": "c6f3030e8462badb1f05a900fff24fc2a81cf449",
      "parents": [
        "ba64212f088d63555e0b7cd4f99109c0d15658cd",
        "5fe80fb49e6953a94acf94028e5975dffdeb477c"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Aug 03 11:45:37 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 03 11:45:37 2026 +0200"
      },
      "message": "Merge pull request #1258 from apache/dependabot/maven/org.apache.neethi-neethi-3.2.3\n\nbuild(deps): bump org.apache.neethi:neethi from 3.2.2 to 3.2.3"
    },
    {
      "commit": "ba64212f088d63555e0b7cd4f99109c0d15658cd",
      "tree": "805c76822af7c2256d4799a58c127a15715c9cba",
      "parents": [
        "5ade3e4e6b8be6302a7ea532ed452137b36ff250",
        "c626471a1c2f9b80575c0376da46e246764bccd0"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Aug 03 11:45:25 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 03 11:45:25 2026 +0200"
      },
      "message": "Merge pull request #1255 from apache/dependabot/github_actions/actions/checkout-7.0.1\n\nbuild(deps): bump actions/checkout from 7.0.0 to 7.0.1"
    },
    {
      "commit": "5ade3e4e6b8be6302a7ea532ed452137b36ff250",
      "tree": "fb265de856247c0bd0652e773625807c794954df",
      "parents": [
        "18a31851ed016b2272e2570e53c5905b6c051d0b",
        "83ccb54e8a1134629696489c202ead4f6701133d"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Aug 03 11:45:16 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 03 11:45:16 2026 +0200"
      },
      "message": "Merge pull request #1257 from apache/dependabot/maven/org.apache.maven.plugins-maven-jar-plugin-3.5.1\n\nbuild(deps): bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1"
    },
    {
      "commit": "18a31851ed016b2272e2570e53c5905b6c051d0b",
      "tree": "2cfba91a23132fffd62f495c0e768409011e7daa",
      "parents": [
        "8d9404851c76e05b48281f3d864436bba5cdea57",
        "74adf1eac88b49774b57b9159831001ea6bb8e87"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Aug 03 11:45:03 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 03 11:45:03 2026 +0200"
      },
      "message": "Merge pull request #1259 from apache/dependabot/maven/org.codehaus.jettison-jettison-1.5.7\n\nbuild(deps): bump org.codehaus.jettison:jettison from 1.5.6 to 1.5.7"
    },
    {
      "commit": "8d9404851c76e05b48281f3d864436bba5cdea57",
      "tree": "c0e993a6e7341e81c0fae2cca6d22b91519ba209",
      "parents": [
        "7668b9630e1b5aab48c51b2aa554758611907d7f",
        "1938e0da63a05cf349b09d83d3f6eaa49dacaee3"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Aug 03 11:44:54 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 03 11:44:54 2026 +0200"
      },
      "message": "Merge pull request #1260 from apache/dependabot/maven/activemq.version-6.3.0\n\nbuild(deps-dev): bump activemq.version from 6.2.7 to 6.3.0"
    },
    {
      "commit": "7668b9630e1b5aab48c51b2aa554758611907d7f",
      "tree": "0b70ad485f5047ee9d52f7328baaaa90c111deb6",
      "parents": [
        "88ffba3cc5739b2963a93ed645a717fc2c6ece8e",
        "b02e5dc3de0e12aa2077af345312feeaf38e7a82"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Aug 03 11:44:45 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 03 11:44:45 2026 +0200"
      },
      "message": "Merge pull request #1261 from apache/dependabot/maven/com.squareup.okio-okio-3.18.1\n\nbuild(deps): bump com.squareup.okio:okio from 3.17.0 to 3.18.1"
    },
    {
      "commit": "88ffba3cc5739b2963a93ed645a717fc2c6ece8e",
      "tree": "b2fe649fa6b75d69270a04e9c6fba7cd4cdf9a9c",
      "parents": [
        "2b6a83f99c0d30c8a4616fe6f3af7e98303ae8a6",
        "ed0de1e88b55bbd08c221ad3b8289de7f7e40db5"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Aug 03 11:44:20 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 03 11:44:20 2026 +0200"
      },
      "message": "Merge pull request #1262 from apache/dependabot/maven/org.apache.felix-maven-bundle-plugin-6.1.0\n\nbuild(deps-dev): bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.0"
    },
    {
      "commit": "2b6a83f99c0d30c8a4616fe6f3af7e98303ae8a6",
      "tree": "7b1447979300e8a12adb8485f69a0205d8b176cf",
      "parents": [
        "54de37f455367a9328ceeff59df9c8bc5035a8e0",
        "dfcdf81084e4a002c81e8a721b2f8db20da8d7b1"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Aug 03 11:44:09 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Aug 03 11:44:09 2026 +0200"
      },
      "message": "Merge pull request #1263 from apache/dependabot/maven/org.apache.httpcomponents.client5-httpclient5-5.6.3\n\nbuild(deps): bump org.apache.httpcomponents.client5:httpclient5 from 5.6.2 to 5.6.3"
    },
    {
      "commit": "dfcdf81084e4a002c81e8a721b2f8db20da8d7b1",
      "tree": "7b1447979300e8a12adb8485f69a0205d8b176cf",
      "parents": [
        "54de37f455367a9328ceeff59df9c8bc5035a8e0"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Jul 31 13:45:34 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 31 13:45:34 2026 +0000"
      },
      "message": "build(deps): bump org.apache.httpcomponents.client5:httpclient5\n\nBumps [org.apache.httpcomponents.client5:httpclient5](https://github.com/apache/httpcomponents-client) from 5.6.2 to 5.6.3.\n- [Changelog](https://github.com/apache/httpcomponents-client/blob/rel/v5.6.3/RELEASE_NOTES.txt)\n- [Commits](https://github.com/apache/httpcomponents-client/compare/rel/v5.6.2...rel/v5.6.3)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.httpcomponents.client5:httpclient5\n  dependency-version: 5.6.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "ed0de1e88b55bbd08c221ad3b8289de7f7e40db5",
      "tree": "e8729c2bede5027226b838e50cfcab84b1352614",
      "parents": [
        "54de37f455367a9328ceeff59df9c8bc5035a8e0"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Jul 30 14:07:38 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 30 14:07:38 2026 +0000"
      },
      "message": "build(deps-dev): bump org.apache.felix:maven-bundle-plugin\n\nBumps org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.0.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.felix:maven-bundle-plugin\n  dependency-version: 6.1.0\n  dependency-type: direct:development\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "b02e5dc3de0e12aa2077af345312feeaf38e7a82",
      "tree": "2a807dce23d6826e5ad3c5bca24b267b5fc58554",
      "parents": [
        "54de37f455367a9328ceeff59df9c8bc5035a8e0"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jul 29 14:12:37 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 29 14:12:37 2026 +0000"
      },
      "message": "build(deps): bump com.squareup.okio:okio from 3.17.0 to 3.18.1\n\nBumps [com.squareup.okio:okio](https://github.com/lysine-dev/okio) from 3.17.0 to 3.18.1.\n- [Changelog](https://github.com/lysine-dev/okio/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/lysine-dev/okio/compare/parent-3.17.0...parent-3.18.1)\n\n---\nupdated-dependencies:\n- dependency-name: com.squareup.okio:okio\n  dependency-version: 3.18.1\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "1938e0da63a05cf349b09d83d3f6eaa49dacaee3",
      "tree": "7015e3a8c658c14519671a96cf1739c430be175f",
      "parents": [
        "54de37f455367a9328ceeff59df9c8bc5035a8e0"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Jul 28 14:47:50 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 28 14:47:50 2026 +0000"
      },
      "message": "build(deps-dev): bump activemq.version from 6.2.7 to 6.3.0\n\nBumps `activemq.version` from 6.2.7 to 6.3.0.\n\nUpdates `org.apache.activemq:activemq-broker` from 6.2.7 to 6.3.0\n- [Release notes](https://github.com/apache/activemq/releases)\n- [Commits](https://github.com/apache/activemq/compare/activemq-6.2.7...activemq-6.3.0)\n\nUpdates `org.apache.activemq.tooling:activemq-maven-plugin` from 6.2.7 to 6.3.0\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.activemq:activemq-broker\n  dependency-version: 6.3.0\n  dependency-type: direct:development\n  update-type: version-update:semver-minor\n- dependency-name: org.apache.activemq.tooling:activemq-maven-plugin\n  dependency-version: 6.3.0\n  dependency-type: direct:development\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "173bad188265168bd8ac898aa68f4bbb3d16b7d1",
      "tree": "1e1647dc587c786fc199455c0f28645b964d6fcd",
      "parents": [
        "54de37f455367a9328ceeff59df9c8bc5035a8e0"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Mon Jul 27 08:26:03 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Mon Jul 27 08:26:03 2026 -1000"
      },
      "message": "Document CVE-2026-66713 for the removed clustering deserialization issue\n\nReference the assigned CVE ID and affected-version scope (all releases\nthrough 2.0.0 on Tomcat, only with Tribes clustering manually enabled,\nfixed in 2.0.1) in the clustering entry of the security threat model.\n\nCo-Authored-By: Claude Opus 4.8 \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "74adf1eac88b49774b57b9159831001ea6bb8e87",
      "tree": "e99235b51b6f9126109aece32c9eb02dc55d38ac",
      "parents": [
        "54de37f455367a9328ceeff59df9c8bc5035a8e0"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Jul 24 14:09:49 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 24 14:09:49 2026 +0000"
      },
      "message": "build(deps): bump org.codehaus.jettison:jettison from 1.5.6 to 1.5.7\n\nBumps [org.codehaus.jettison:jettison](https://github.com/jettison-json/jettison) from 1.5.6 to 1.5.7.\n- [Release notes](https://github.com/jettison-json/jettison/releases)\n- [Commits](https://github.com/jettison-json/jettison/compare/jettison-1.5.6...jettison-1.5.7)\n\n---\nupdated-dependencies:\n- dependency-name: org.codehaus.jettison:jettison\n  dependency-version: 1.5.7\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "5fe80fb49e6953a94acf94028e5975dffdeb477c",
      "tree": "4ed0036fc043fcb54c29bf980313819108030a04",
      "parents": [
        "54de37f455367a9328ceeff59df9c8bc5035a8e0"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Jul 24 14:07:53 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 24 14:07:53 2026 +0000"
      },
      "message": "build(deps): bump org.apache.neethi:neethi from 3.2.2 to 3.2.3\n\nBumps org.apache.neethi:neethi from 3.2.2 to 3.2.3.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.neethi:neethi\n  dependency-version: 3.2.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "83ccb54e8a1134629696489c202ead4f6701133d",
      "tree": "a8ef7fe1ca36bdb0e88d4fab1953a09c305ead24",
      "parents": [
        "54de37f455367a9328ceeff59df9c8bc5035a8e0"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Jul 23 13:45:42 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 13:45:42 2026 +0000"
      },
      "message": "build(deps): bump org.apache.maven.plugins:maven-jar-plugin\n\nBumps [org.apache.maven.plugins:maven-jar-plugin](https://github.com/apache/maven-jar-plugin) from 3.5.0 to 3.5.1.\n- [Release notes](https://github.com/apache/maven-jar-plugin/releases)\n- [Commits](https://github.com/apache/maven-jar-plugin/compare/maven-jar-plugin-3.5.0...maven-jar-plugin-3.5.1)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven.plugins:maven-jar-plugin\n  dependency-version: 3.5.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "54de37f455367a9328ceeff59df9c8bc5035a8e0",
      "tree": "b67c3c38185717387d739d02b47b724430867c47",
      "parents": [
        "76923dce668c5e489d73daf52cc094baae84157b"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Wed Jul 22 09:16:53 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Wed Jul 22 09:16:53 2026 -1000"
      },
      "message": "Document HTTP/2 client production hardening; add the defenses to the sample\n\nExpand the HTTP/2 Java client guide (http2-java-client.xml) with a Production\nHardening section covering the connection-pool defenses a long-lived HTTP/2 client\nneeds to survive upstream restarts and dropped network paths: stale-connection\nvalidation + TTL + idle/expired eviction, TCP keepalive tuning (with the network\nidle-timeout and Java/OS caveats), bounded retry for stale pooled connections\n(idempotency + no-partial-output rules), and fail-fast on the response status via\nAbstractBinResponseConsumer.\n\nUpdate the Http2JsonClient sample to apply all four: validateAfterInactivity + TTL,\nevictExpired/evictIdle, the TCP keepalive triplet, and a retryable-connection\nclassifier with a zero-bytes-written retry gate. Align httpcore5-h2 to 5.4.3.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "c626471a1c2f9b80575c0376da46e246764bccd0",
      "tree": "879ba853a7fcf91de3d58c6a677e032684f7c4d0",
      "parents": [
        "76923dce668c5e489d73daf52cc094baae84157b"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Jul 21 13:42:31 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 21 13:42:31 2026 +0000"
      },
      "message": "build(deps): bump actions/checkout from 7.0.0 to 7.0.1\n\nBumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1)\n\n---\nupdated-dependencies:\n- dependency-name: actions/checkout\n  dependency-version: 7.0.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "76923dce668c5e489d73daf52cc094baae84157b",
      "tree": "edc09b285849a6276bc7443d074c781e96741ec4",
      "parents": [
        "e532f86550b874b2f1f849e7ad20fd31edf98078",
        "088e3ff3139755eef38916e0508246ce8bb76f86"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Fri Jul 17 19:15:23 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 19:15:23 2026 +0200"
      },
      "message": "Merge pull request #1254 from apache/dependabot/github_actions/actions/setup-java-5.6.0\n\nbuild(deps): bump actions/setup-java from 5.5.0 to 5.6.0"
    },
    {
      "commit": "088e3ff3139755eef38916e0508246ce8bb76f86",
      "tree": "edc09b285849a6276bc7443d074c781e96741ec4",
      "parents": [
        "e532f86550b874b2f1f849e7ad20fd31edf98078"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Jul 17 13:42:32 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 13:42:32 2026 +0000"
      },
      "message": "build(deps): bump actions/setup-java from 5.5.0 to 5.6.0\n\nBumps [actions/setup-java](https://github.com/actions/setup-java) from 5.5.0 to 5.6.0.\n- [Release notes](https://github.com/actions/setup-java/releases)\n- [Commits](https://github.com/actions/setup-java/compare/0f481fcb613427c0f801b606911222b5b6f3083a...03ad4de0992f5dab5e18fcb136590ce7c4a0ac95)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-java\n  dependency-version: 5.6.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "e532f86550b874b2f1f849e7ad20fd31edf98078",
      "tree": "2a17a8092e1d47173898b27cff1f7c5ad4a4500f",
      "parents": [
        "93e8e93415c27e005fc17f25f85c7e69c4e7ac2c",
        "2b0e17c3672006560a90fccc8e198d2aee1166cd"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Fri Jul 17 15:31:30 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 15:31:30 2026 +0200"
      },
      "message": "Merge pull request #1253 from apache/dependabot/maven/com.icegreen-greenmail-2.1.11\n\nbuild(deps-dev): bump com.icegreen:greenmail from 2.1.9 to 2.1.11"
    },
    {
      "commit": "2b0e17c3672006560a90fccc8e198d2aee1166cd",
      "tree": "2a17a8092e1d47173898b27cff1f7c5ad4a4500f",
      "parents": [
        "93e8e93415c27e005fc17f25f85c7e69c4e7ac2c"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Jul 16 13:48:57 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 16 13:48:57 2026 +0000"
      },
      "message": "build(deps-dev): bump com.icegreen:greenmail from 2.1.9 to 2.1.11\n\nBumps [com.icegreen:greenmail](https://github.com/greenmail-mail-test/greenmail) from 2.1.9 to 2.1.11.\n- [Release notes](https://github.com/greenmail-mail-test/greenmail/releases)\n- [Commits](https://github.com/greenmail-mail-test/greenmail/compare/release-2.1.9...release-2.1.11)\n\n---\nupdated-dependencies:\n- dependency-name: com.icegreen:greenmail\n  dependency-version: 2.1.11\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "93e8e93415c27e005fc17f25f85c7e69c4e7ac2c",
      "tree": "10fe9850a64c73be7996cc10af26e89ebd378eea",
      "parents": [
        "7464e62b938651e8e20b928cf0f088fc46537e8a",
        "c754c3171fa1329dbf76d74d3580ac7a2ae60f92"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Tue Jul 14 12:28:51 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 14 12:28:51 2026 +0200"
      },
      "message": "Merge pull request #1250 from apache/dependabot/maven/org.junit.jupiter-junit-jupiter-6.1.2\n\nbuild(deps): bump org.junit.jupiter:junit-jupiter from 6.1.1 to 6.1.2"
    },
    {
      "commit": "7464e62b938651e8e20b928cf0f088fc46537e8a",
      "tree": "4f0c32acce393c6dcf925e0a8209ac455022c1d9",
      "parents": [
        "ecc8c9193b348c7dbf5bc7f39796b87b9f0eeaea",
        "4d36a91bb076c14bc2e442da72559d0e45a84e7e"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Tue Jul 14 12:28:41 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 14 12:28:41 2026 +0200"
      },
      "message": "Merge pull request #1251 from apache/dependabot/maven/org.bouncycastle-bcpkix-jdk18on-1.85\n\nbuild(deps): bump org.bouncycastle:bcpkix-jdk18on from 1.84 to 1.85"
    },
    {
      "commit": "4d36a91bb076c14bc2e442da72559d0e45a84e7e",
      "tree": "4f0c32acce393c6dcf925e0a8209ac455022c1d9",
      "parents": [
        "ecc8c9193b348c7dbf5bc7f39796b87b9f0eeaea"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 13 13:44:26 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 13:44:26 2026 +0000"
      },
      "message": "build(deps): bump org.bouncycastle:bcpkix-jdk18on from 1.84 to 1.85\n\nBumps [org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java) from 1.84 to 1.85.\n- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)\n- [Commits](https://github.com/bcgit/bc-java/commits)\n\n---\nupdated-dependencies:\n- dependency-name: org.bouncycastle:bcpkix-jdk18on\n  dependency-version: \u00271.85\u0027\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "c754c3171fa1329dbf76d74d3580ac7a2ae60f92",
      "tree": "31bb84b14b6bf0f561489bb08bb94f4bda008050",
      "parents": [
        "ecc8c9193b348c7dbf5bc7f39796b87b9f0eeaea"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 13 13:43:37 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 13:43:37 2026 +0000"
      },
      "message": "build(deps): bump org.junit.jupiter:junit-jupiter from 6.1.1 to 6.1.2\n\nBumps [org.junit.jupiter:junit-jupiter](https://github.com/junit-team/junit-framework) from 6.1.1 to 6.1.2.\n- [Release notes](https://github.com/junit-team/junit-framework/releases)\n- [Commits](https://github.com/junit-team/junit-framework/compare/r6.1.1...r6.1.2)\n\n---\nupdated-dependencies:\n- dependency-name: org.junit.jupiter:junit-jupiter\n  dependency-version: 6.1.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "ecc8c9193b348c7dbf5bc7f39796b87b9f0eeaea",
      "tree": "b3d7d0e72695c0b0f589e31bbfc84d0bd674ea0d",
      "parents": [
        "dbd46cc0de2ffa2aa73887415be17f3aadd23e58",
        "956108eadde4d4a0daebf1107a32a1a6c3ab24a7"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Jul 13 09:24:47 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 09:24:47 2026 +0200"
      },
      "message": "Merge pull request #1247 from apache/dependabot/github_actions/actions/setup-java-5.5.0\n\nbuild(deps): bump actions/setup-java from 5.4.0 to 5.5.0"
    },
    {
      "commit": "dbd46cc0de2ffa2aa73887415be17f3aadd23e58",
      "tree": "1cfb9db66bb113b57995027c86b3e6db0e94d69b",
      "parents": [
        "7d341f96f77fa160fdf326a4a4a6f54000342004",
        "cdfb027b5f3fe738c6c127624ec113725b109046"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Jul 13 09:24:30 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 09:24:30 2026 +0200"
      },
      "message": "Merge pull request #1248 from apache/dependabot/maven/jetty.version-12.1.11\n\nbuild(deps): bump jetty.version from 12.1.10 to 12.1.11"
    },
    {
      "commit": "7d341f96f77fa160fdf326a4a4a6f54000342004",
      "tree": "eabdd0d033439985ec7b94860f6780abca9cbd3f",
      "parents": [
        "580ebc850982ea8fcd3964492dff1177a8343580",
        "f45e6a28b7cf0f4311d171575a8e408e380451cb"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Jul 13 09:24:15 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 09:24:15 2026 +0200"
      },
      "message": "Merge pull request #1249 from apache/dependabot/maven/com.fasterxml.jackson.core-jackson-databind-2.22.1\n\nbuild(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.22.0 to 2.22.1"
    },
    {
      "commit": "f45e6a28b7cf0f4311d171575a8e408e380451cb",
      "tree": "eabdd0d033439985ec7b94860f6780abca9cbd3f",
      "parents": [
        "580ebc850982ea8fcd3964492dff1177a8343580"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jul 08 13:43:05 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 08 13:43:05 2026 +0000"
      },
      "message": "build(deps): bump com.fasterxml.jackson.core:jackson-databind\n\nBumps [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson) from 2.22.0 to 2.22.1.\n- [Commits](https://github.com/FasterXML/jackson/commits)\n\n---\nupdated-dependencies:\n- dependency-name: com.fasterxml.jackson.core:jackson-databind\n  dependency-version: 2.22.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "cdfb027b5f3fe738c6c127624ec113725b109046",
      "tree": "72eb918eadab991129256be28b09ef05650f95fd",
      "parents": [
        "580ebc850982ea8fcd3964492dff1177a8343580"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jul 08 13:42:53 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 08 13:42:53 2026 +0000"
      },
      "message": "build(deps): bump jetty.version from 12.1.10 to 12.1.11\n\nBumps `jetty.version` from 12.1.10 to 12.1.11.\n\nUpdates `org.eclipse.jetty:jetty-server` from 12.1.10 to 12.1.11\n\nUpdates `org.eclipse.jetty.ee9:jetty-ee9-nested` from 12.1.10 to 12.1.11\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-webapp` from 12.1.10 to 12.1.11\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-maven-plugin` from 12.1.10 to 12.1.11\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin` from 12.1.10 to 12.1.11\n\n---\nupdated-dependencies:\n- dependency-name: org.eclipse.jetty:jetty-server\n  dependency-version: 12.1.11\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n- dependency-name: org.eclipse.jetty.ee9:jetty-ee9-nested\n  dependency-version: 12.1.11\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-webapp\n  dependency-version: 12.1.11\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-maven-plugin\n  dependency-version: 12.1.11\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin\n  dependency-version: 12.1.11\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "956108eadde4d4a0daebf1107a32a1a6c3ab24a7",
      "tree": "10d13487731a6d1a2777a92ef5d76e189c1281fb",
      "parents": [
        "580ebc850982ea8fcd3964492dff1177a8343580"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jul 08 13:42:29 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 08 13:42:29 2026 +0000"
      },
      "message": "build(deps): bump actions/setup-java from 5.4.0 to 5.5.0\n\nBumps [actions/setup-java](https://github.com/actions/setup-java) from 5.4.0 to 5.5.0.\n- [Release notes](https://github.com/actions/setup-java/releases)\n- [Commits](https://github.com/actions/setup-java/compare/1bcf9fb12cf4aa7d266a90ae39939e61372fe520...0f481fcb613427c0f801b606911222b5b6f3083a)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-java\n  dependency-version: 5.5.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "580ebc850982ea8fcd3964492dff1177a8343580",
      "tree": "dfff7b660fcb87657b7842a8c8dd3d0540cb2085",
      "parents": [
        "8468a1d49a111ede22abd07847e0c8d40f638c7a",
        "212440b6146eb7cbbfc7ad4bbea16ee90f14d182"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Tue Jul 07 18:32:38 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 07 18:32:38 2026 +0200"
      },
      "message": "Merge pull request #1242 from rootvector2/swagger-ui-url-escape\n\nmake buildOpenApiUrl return a URI"
    },
    {
      "commit": "212440b6146eb7cbbfc7ad4bbea16ee90f14d182",
      "tree": "a1bfa77a3a321a5735690f48016ed42a145353a2",
      "parents": [
        "2963c23a36d45fefd9f5355ff2504cc82729c00e"
      ],
      "author": {
        "name": "Naveed Khan",
        "email": "dxbnaveed.k@gmail.com",
        "time": "Thu Jul 02 15:13:32 2026 +0530"
      },
      "committer": {
        "name": "Naveed Khan",
        "email": "dxbnaveed.k@gmail.com",
        "time": "Tue Jul 07 12:55:59 2026 +0530"
      },
      "message": "make buildOpenApiUrl return a URI\n"
    },
    {
      "commit": "8468a1d49a111ede22abd07847e0c8d40f638c7a",
      "tree": "639f490bd585c37b811b3f355385e37c0d77e511",
      "parents": [
        "7ed16db3c6093463d6fc0fa05193cd770cff5607",
        "eaf2f4e43330f8677faf7555bf8fc666f57a7448"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Tue Jul 07 08:43:50 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 07 08:43:50 2026 +0200"
      },
      "message": "Merge pull request #1238 from apache/dependabot/maven/activemq.version-6.2.7\n\nbuild(deps-dev): bump activemq.version from 6.2.6 to 6.2.7"
    },
    {
      "commit": "7ed16db3c6093463d6fc0fa05193cd770cff5607",
      "tree": "90076213eb1777aee34866ed1e0fc70e77b4cafe",
      "parents": [
        "0be596eb60dfc5f3eea450dea967f725469aa75d",
        "b5ce339a2b5c7b532b1800bb1ad38db1e61feba0"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Tue Jul 07 08:43:44 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 07 08:43:44 2026 +0200"
      },
      "message": "Merge pull request #1239 from apache/dependabot/maven/org.apache-apache-39\n\nbuild(deps): bump org.apache:apache from 38 to 39"
    },
    {
      "commit": "0be596eb60dfc5f3eea450dea967f725469aa75d",
      "tree": "d9c988eaa020ce16867b8324a566ef6be31c1e2f",
      "parents": [
        "858eb376c09e533aa1a7380eea2ad4230f128723",
        "0aca798002e650bf0a490b3362b98e348d5b5f59"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Tue Jul 07 08:43:31 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 07 08:43:31 2026 +0200"
      },
      "message": "Merge pull request #1240 from apache/dependabot/maven/org.junit.jupiter-junit-jupiter-6.1.1\n\nbuild(deps): bump org.junit.jupiter:junit-jupiter from 6.1.0 to 6.1.1"
    },
    {
      "commit": "858eb376c09e533aa1a7380eea2ad4230f128723",
      "tree": "618f96760a306baa7d641fba1489820ea1f8c17a",
      "parents": [
        "6c977b821f1dfb2634a1bb6f6e4a3e06313ebd92",
        "f1ad36066cd30483fd61914ad1a412091e1c12bc"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Tue Jul 07 08:43:00 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 07 08:43:00 2026 +0200"
      },
      "message": "Merge pull request #1241 from apache/dependabot/maven/org.apache.httpcomponents.client5-httpclient5-5.6.2\n\nbuild(deps): bump org.apache.httpcomponents.client5:httpclient5 from 5.6.1 to 5.6.2"
    },
    {
      "commit": "6c977b821f1dfb2634a1bb6f6e4a3e06313ebd92",
      "tree": "188a3bb117684771492e26d92e26ff8159aa1425",
      "parents": [
        "54fd2c1f573e1f5456f64cf8f43a189202b8937c",
        "9f27fee38a4f4369ce77f033805717ab0a9efc10"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Tue Jul 07 08:42:48 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 07 08:42:48 2026 +0200"
      },
      "message": "Merge pull request #1243 from apache/dependabot/maven/org.apache.logging.log4j-log4j-bom-2.26.1\n\nbuild(deps): bump org.apache.logging.log4j:log4j-bom from 2.26.0 to 2.26.1"
    },
    {
      "commit": "54fd2c1f573e1f5456f64cf8f43a189202b8937c",
      "tree": "a4065489485fd925ef6b4a4f0c275e807a9e4f9a",
      "parents": [
        "7a4ee930d866440e425a966226acc4dc37f321b2",
        "f891149edbaaad450ffda5f399647b39cd09fe49"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Tue Jul 07 08:42:39 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 07 08:42:39 2026 +0200"
      },
      "message": "Merge pull request #1244 from apache/dependabot/maven/org.codehaus.gmavenplus-gmavenplus-plugin-5.1.0\n\nbuild(deps): bump org.codehaus.gmavenplus:gmavenplus-plugin from 5.0.0 to 5.1.0"
    },
    {
      "commit": "7a4ee930d866440e425a966226acc4dc37f321b2",
      "tree": "241bfdae025aa61f19b63dad2de42c1f18d9d4d7",
      "parents": [
        "d8c9652928ffe82f2e9b338516786f0e1303701d",
        "d57f760dbd7f3b724161458624bc234f13bf69f0"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Tue Jul 07 08:42:29 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 07 08:42:29 2026 +0200"
      },
      "message": "Merge pull request #1245 from apache/dependabot/maven/net.bytebuddy-byte-buddy-1.18.11\n\nbuild(deps): bump net.bytebuddy:byte-buddy from 1.18.10 to 1.18.11"
    },
    {
      "commit": "d8c9652928ffe82f2e9b338516786f0e1303701d",
      "tree": "bf33f95fb664114acd1fdd01e1fbb858e8822c47",
      "parents": [
        "2b2888bdda722f41515f7f526d2907eba5757f76",
        "00d1912b3f17c7a0e1e0cc832f2241cfebcf1958"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Tue Jul 07 08:42:05 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 07 08:42:05 2026 +0200"
      },
      "message": "Merge pull request #1246 from apache/dependabot/maven/groovy.version-5.0.7\n\nbuild(deps): bump groovy.version from 5.0.6 to 5.0.7"
    },
    {
      "commit": "00d1912b3f17c7a0e1e0cc832f2241cfebcf1958",
      "tree": "bf33f95fb664114acd1fdd01e1fbb858e8822c47",
      "parents": [
        "2b2888bdda722f41515f7f526d2907eba5757f76"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 06 13:42:50 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 13:42:50 2026 +0000"
      },
      "message": "build(deps): bump groovy.version from 5.0.6 to 5.0.7\n\nBumps `groovy.version` from 5.0.6 to 5.0.7.\n\nUpdates `org.apache.groovy:groovy` from 5.0.6 to 5.0.7\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.apache.groovy:groovy-ant` from 5.0.6 to 5.0.7\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.apache.groovy:groovy-xml` from 5.0.6 to 5.0.7\n- [Commits](https://github.com/apache/groovy/commits)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.groovy:groovy\n  dependency-version: 5.0.7\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.apache.groovy:groovy-ant\n  dependency-version: 5.0.7\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.apache.groovy:groovy-xml\n  dependency-version: 5.0.7\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "2b2888bdda722f41515f7f526d2907eba5757f76",
      "tree": "ad771f0c735e06cb300090757c4a774334ab3ad1",
      "parents": [
        "2963c23a36d45fefd9f5355ff2504cc82729c00e",
        "30f084ba12b0901ba81cab9fcaf821ec0f38dbfb"
      ],
      "author": {
        "name": "robertlazarski",
        "email": "58150512+robertlazarski@users.noreply.github.com",
        "time": "Sun Jul 05 07:31:17 2026 -1000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Jul 05 07:31:17 2026 -1000"
      },
      "message": "Merge pull request #1221 from digi-scrypt/saaj-soappart-xxe\n\nharden SOAPPart.setContent xml parser against xxe"
    },
    {
      "commit": "d57f760dbd7f3b724161458624bc234f13bf69f0",
      "tree": "acb221d8c910d533b3079a706251419820fb6862",
      "parents": [
        "2963c23a36d45fefd9f5355ff2504cc82729c00e"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Jul 03 13:44:18 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 03 13:44:18 2026 +0000"
      },
      "message": "build(deps): bump net.bytebuddy:byte-buddy from 1.18.10 to 1.18.11\n\nBumps [net.bytebuddy:byte-buddy](https://github.com/raphw/byte-buddy) from 1.18.10 to 1.18.11.\n- [Release notes](https://github.com/raphw/byte-buddy/releases)\n- [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md)\n- [Commits](https://github.com/raphw/byte-buddy/compare/byte-buddy-1.18.10...byte-buddy-1.18.11)\n\n---\nupdated-dependencies:\n- dependency-name: net.bytebuddy:byte-buddy\n  dependency-version: 1.18.11\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "f891149edbaaad450ffda5f399647b39cd09fe49",
      "tree": "cb4f961f0db841c1ccbf9619e8319ab29d27c514",
      "parents": [
        "2963c23a36d45fefd9f5355ff2504cc82729c00e"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Jul 03 13:42:41 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 03 13:42:41 2026 +0000"
      },
      "message": "build(deps): bump org.codehaus.gmavenplus:gmavenplus-plugin\n\nBumps [org.codehaus.gmavenplus:gmavenplus-plugin](https://github.com/groovy/GMavenPlus) from 5.0.0 to 5.1.0.\n- [Release notes](https://github.com/groovy/GMavenPlus/releases)\n- [Commits](https://github.com/groovy/GMavenPlus/compare/5.0.0...5.1.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.codehaus.gmavenplus:gmavenplus-plugin\n  dependency-version: 5.1.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "9f27fee38a4f4369ce77f033805717ab0a9efc10",
      "tree": "de35f0d54b7258dfc3ad3bfba9a56a5dc2f7ee65",
      "parents": [
        "2963c23a36d45fefd9f5355ff2504cc82729c00e"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Jul 02 13:51:33 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 02 13:51:33 2026 +0000"
      },
      "message": "build(deps): bump org.apache.logging.log4j:log4j-bom\n\nBumps [org.apache.logging.log4j:log4j-bom](https://github.com/apache/logging-log4j2) from 2.26.0 to 2.26.1.\n- [Release notes](https://github.com/apache/logging-log4j2/releases)\n- [Changelog](https://github.com/apache/logging-log4j2/blob/2.x/RELEASE-NOTES.adoc)\n- [Commits](https://github.com/apache/logging-log4j2/compare/rel/2.26.0...rel/2.26.1)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.logging.log4j:log4j-bom\n  dependency-version: 2.26.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "2963c23a36d45fefd9f5355ff2504cc82729c00e",
      "tree": "6eab6828048fc1dbf98f98fe1c118a83b7e507cf",
      "parents": [
        "f15d3c31e20f3295e4d0b5dd05f6df91851ad849"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Wed Jul 01 08:48:08 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Wed Jul 01 08:48:08 2026 -1000"
      },
      "message": "ci: harden Remove Snapshots step against silent failure\n\nFrom a Gemini CI review: `find ... | xargs rm -rf` masks a find failure\n(xargs exits 0 on empty stdin), and GNU xargs also runs `rm` once with no\noperands on empty input. Add `set -o pipefail` so a find failure fails the\nstep, and `xargs -r` so rm is skipped when there is nothing to remove.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "f15d3c31e20f3295e4d0b5dd05f6df91851ad849",
      "tree": "e968d7627ad797fa8ebb9f614a727ec55f352527",
      "parents": [
        "c2f5d68ffa9c71527e30068043a8ddb08efb7e73"
      ],
      "author": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Wed Jul 01 08:37:42 2026 -1000"
      },
      "committer": {
        "name": "Robert Lazarski",
        "email": "robertlazarski@gmail.com",
        "time": "Wed Jul 01 08:37:42 2026 -1000"
      },
      "message": "ci: least-privilege permissions + SHA-pin actions\n\nSecurity hardening brought over from axis-axis2-c-core\u0027s CI review:\n\n- Add top-level `permissions: contents: read`. The workflow had no\n  permissions block, so it inherited the default GITHUB_TOKEN scope. All\n  three jobs only read the repo and build with Maven; the deploy job\u0027s Nexus\n  credentials come from secrets, not GITHUB_TOKEN (verified: no github.token\n  usage anywhere), so read is sufficient.\n- Pin actions to immutable commit SHAs (checkout v7.0.0, cache v6.1.0,\n  setup-java v5.4.0) so a hijacked tag can\u0027t inject code into CI. The\n  existing daily github-actions Dependabot keeps the SHAs (and their # vX.Y.Z\n  comments) current.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\n"
    },
    {
      "commit": "c2f5d68ffa9c71527e30068043a8ddb08efb7e73",
      "tree": "5e7d2a7b7a2b321ecd89df5e369a60e3e8764f37",
      "parents": [
        "aaf1489fabd4599e54039a27f605081f301b3123",
        "33812615f17f859c7e2b5c3e5575e6a7b57e1cde"
      ],
      "author": {
        "name": "robertlazarski",
        "email": "58150512+robertlazarski@users.noreply.github.com",
        "time": "Wed Jul 01 06:14:20 2026 -1000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 01 06:14:20 2026 -1000"
      },
      "message": "Merge pull request #1227 from rootvector2/addaswebresources-zip-slip\n\nprevent zip-slip in DeploymentEngine.addAsWebResources"
    },
    {
      "commit": "f1ad36066cd30483fd61914ad1a412091e1c12bc",
      "tree": "abb0497a35b0b89e16e879017544a4c2341151b9",
      "parents": [
        "aaf1489fabd4599e54039a27f605081f301b3123"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Jun 30 13:47:46 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 30 13:47:46 2026 +0000"
      },
      "message": "build(deps): bump org.apache.httpcomponents.client5:httpclient5\n\nBumps [org.apache.httpcomponents.client5:httpclient5](https://github.com/apache/httpcomponents-client) from 5.6.1 to 5.6.2.\n- [Changelog](https://github.com/apache/httpcomponents-client/blob/rel/v5.6.2/RELEASE_NOTES.txt)\n- [Commits](https://github.com/apache/httpcomponents-client/compare/rel/v5.6.1...rel/v5.6.2)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.httpcomponents.client5:httpclient5\n  dependency-version: 5.6.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "0aca798002e650bf0a490b3362b98e348d5b5f59",
      "tree": "4ad4be7e68165a150a4b716b8211b7e0180ff1b7",
      "parents": [
        "aaf1489fabd4599e54039a27f605081f301b3123"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 29 13:50:36 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 13:50:36 2026 +0000"
      },
      "message": "build(deps): bump org.junit.jupiter:junit-jupiter from 6.1.0 to 6.1.1\n\nBumps [org.junit.jupiter:junit-jupiter](https://github.com/junit-team/junit-framework) from 6.1.0 to 6.1.1.\n- [Release notes](https://github.com/junit-team/junit-framework/releases)\n- [Commits](https://github.com/junit-team/junit-framework/compare/r6.1.0...r6.1.1)\n\n---\nupdated-dependencies:\n- dependency-name: org.junit.jupiter:junit-jupiter\n  dependency-version: 6.1.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "b5ce339a2b5c7b532b1800bb1ad38db1e61feba0",
      "tree": "9fb35a121c9243efbb865e9621deee125f9afc1c",
      "parents": [
        "aaf1489fabd4599e54039a27f605081f301b3123"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 29 13:50:32 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 13:50:32 2026 +0000"
      },
      "message": "build(deps): bump org.apache:apache from 38 to 39\n\nBumps [org.apache:apache](https://github.com/apache/maven-apache-parent) from 38 to 39.\n- [Release notes](https://github.com/apache/maven-apache-parent/releases)\n- [Commits](https://github.com/apache/maven-apache-parent/commits)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache:apache\n  dependency-version: \u002739\u0027\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "eaf2f4e43330f8677faf7555bf8fc666f57a7448",
      "tree": "8881a6fc91c4cad184686df03e893925b7c7eb74",
      "parents": [
        "aaf1489fabd4599e54039a27f605081f301b3123"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 29 13:49:13 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 13:49:13 2026 +0000"
      },
      "message": "build(deps-dev): bump activemq.version from 6.2.6 to 6.2.7\n\nBumps `activemq.version` from 6.2.6 to 6.2.7.\n\nUpdates `org.apache.activemq:activemq-broker` from 6.2.6 to 6.2.7\n- [Release notes](https://github.com/apache/activemq/releases)\n- [Commits](https://github.com/apache/activemq/compare/activemq-6.2.6...activemq-6.2.7)\n\nUpdates `org.apache.activemq.tooling:activemq-maven-plugin` from 6.2.6 to 6.2.7\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.activemq:activemq-broker\n  dependency-version: 6.2.7\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n- dependency-name: org.apache.activemq.tooling:activemq-maven-plugin\n  dependency-version: 6.2.7\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "aaf1489fabd4599e54039a27f605081f301b3123",
      "tree": "db871da397da5606f1079c035d03c5338afc3d1e",
      "parents": [
        "df3d446329c4b29a3dad2e2095c70c2e8b514b92",
        "33a3801f61c6c2a351f5bab28e1225b650704b91"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Jun 29 07:56:15 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 07:56:15 2026 +0200"
      },
      "message": "Merge pull request #1237 from apache/dependabot/maven/httpcore.version-5.4.3\n\nbuild(deps): bump httpcore.version from 5.4.2 to 5.4.3"
    },
    {
      "commit": "df3d446329c4b29a3dad2e2095c70c2e8b514b92",
      "tree": "c13b21251d91ed5249cd2705c228c241fad57d1a",
      "parents": [
        "5f8d49c63d32b2f6b38b78392d7f12392f0c0d52",
        "fa8f5eea6fc3fdf6f0e861fa8990da361e2cacb4"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Jun 29 07:56:05 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 07:56:05 2026 +0200"
      },
      "message": "Merge pull request #1232 from apache/dependabot/maven/commons-logging-commons-logging-1.4.0\n\nbuild(deps): bump commons-logging:commons-logging from 1.3.6 to 1.4.0"
    },
    {
      "commit": "5f8d49c63d32b2f6b38b78392d7f12392f0c0d52",
      "tree": "9bc5578517762527ff544c345e4e2f030397a90c",
      "parents": [
        "8421c1411fd91619a30321b041954d8af642772e",
        "b1b7a662a1f6c28c321d6ba90500b50f75c9057d"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Jun 29 07:55:55 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 07:55:55 2026 +0200"
      },
      "message": "Merge pull request #1233 from apache/dependabot/maven/org.codehaus.jettison-jettison-1.5.6\n\nbuild(deps): bump org.codehaus.jettison:jettison from 1.5.5 to 1.5.6"
    },
    {
      "commit": "8421c1411fd91619a30321b041954d8af642772e",
      "tree": "bb50c0a868c1815d3bd3e275d085e6d5a720b2ae",
      "parents": [
        "b32ef44cfc8ece8171cc1948a37e4d3399d9d80f",
        "e32a6fea115bb172efed23c6c97094fff5c3d51a"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Jun 29 07:55:40 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 07:55:40 2026 +0200"
      },
      "message": "Merge pull request #1234 from apache/dependabot/github_actions/actions/checkout-7\n\nbuild(deps): bump actions/checkout from 6 to 7"
    },
    {
      "commit": "b32ef44cfc8ece8171cc1948a37e4d3399d9d80f",
      "tree": "c161fe0e4501535f46b94870be65d43e4c09d072",
      "parents": [
        "9205f2392b8e5f81d7e2d83e5f37e86e1013a6c1",
        "ec9ce010489f1c95b877d78cde1628b39c9bbf2b"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Jun 29 07:54:54 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 07:54:54 2026 +0200"
      },
      "message": "Merge pull request #1235 from apache/dependabot/maven/swagger.version-2.2.52\n\nbuild(deps): bump swagger.version from 2.2.51 to 2.2.52"
    },
    {
      "commit": "9205f2392b8e5f81d7e2d83e5f37e86e1013a6c1",
      "tree": "bee4fa9375263f0417845a88cb170af67ec8da61",
      "parents": [
        "385e846e9fdd604a405b8e6089522bf2226ac889",
        "824dbe5aab8b5f4f5c192b41b1b0acffed6765d3"
      ],
      "author": {
        "name": "Christian Ortlepp",
        "email": "christian.ortlepp@hypergene.com",
        "time": "Mon Jun 29 07:54:42 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 07:54:42 2026 +0200"
      },
      "message": "Merge pull request #1236 from apache/dependabot/github_actions/actions/cache-6\n\nbuild(deps): bump actions/cache from 5 to 6"
    },
    {
      "commit": "33a3801f61c6c2a351f5bab28e1225b650704b91",
      "tree": "e634ea5923ee81322f71b2c7c671840ccbc3fe90",
      "parents": [
        "385e846e9fdd604a405b8e6089522bf2226ac889"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Jun 25 13:53:42 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jun 25 13:53:42 2026 +0000"
      },
      "message": "build(deps): bump httpcore.version from 5.4.2 to 5.4.3\n\nBumps `httpcore.version` from 5.4.2 to 5.4.3.\n\nUpdates `org.apache.httpcomponents.core5:httpcore5` from 5.4.2 to 5.4.3\n- [Changelog](https://github.com/apache/httpcomponents-core/blob/rel/v5.4.3/RELEASE_NOTES.txt)\n- [Commits](https://github.com/apache/httpcomponents-core/compare/rel/v5.4.2...rel/v5.4.3)\n\nUpdates `org.apache.httpcomponents.core5:httpcore5-h2` from 5.4.2 to 5.4.3\n- [Changelog](https://github.com/apache/httpcomponents-core/blob/rel/v5.4.3/RELEASE_NOTES.txt)\n- [Commits](https://github.com/apache/httpcomponents-core/compare/rel/v5.4.2...rel/v5.4.3)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.httpcomponents.core5:httpcore5\n  dependency-version: 5.4.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.apache.httpcomponents.core5:httpcore5-h2\n  dependency-version: 5.4.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "824dbe5aab8b5f4f5c192b41b1b0acffed6765d3",
      "tree": "bee4fa9375263f0417845a88cb170af67ec8da61",
      "parents": [
        "385e846e9fdd604a405b8e6089522bf2226ac889"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jun 24 13:42:27 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 24 13:42:27 2026 +0000"
      },
      "message": "build(deps): bump actions/cache from 5 to 6\n\nBumps [actions/cache](https://github.com/actions/cache) from 5 to 6.\n- [Release notes](https://github.com/actions/cache/releases)\n- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)\n- [Commits](https://github.com/actions/cache/compare/v5...v6)\n\n---\nupdated-dependencies:\n- dependency-name: actions/cache\n  dependency-version: \u00276\u0027\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "ec9ce010489f1c95b877d78cde1628b39c9bbf2b",
      "tree": "da93120ff0fa452eaa246cd38c9bb7ddd46fce4c",
      "parents": [
        "385e846e9fdd604a405b8e6089522bf2226ac889"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 22 13:46:26 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 22 13:46:26 2026 +0000"
      },
      "message": "build(deps): bump swagger.version from 2.2.51 to 2.2.52\n\nBumps `swagger.version` from 2.2.51 to 2.2.52.\n\nUpdates `io.swagger.core.v3:swagger-core` from 2.2.51 to 2.2.52\n- [Release notes](https://github.com/swagger-api/swagger-core/releases)\n- [Commits](https://github.com/swagger-api/swagger-core/commits)\n\nUpdates `io.swagger.core.v3:swagger-models` from 2.2.51 to 2.2.52\n\nUpdates `io.swagger.core.v3:swagger-annotations` from 2.2.51 to 2.2.52\n\n---\nupdated-dependencies:\n- dependency-name: io.swagger.core.v3:swagger-core\n  dependency-version: 2.2.52\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: io.swagger.core.v3:swagger-models\n  dependency-version: 2.2.52\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: io.swagger.core.v3:swagger-annotations\n  dependency-version: 2.2.52\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "e32a6fea115bb172efed23c6c97094fff5c3d51a",
      "tree": "f694020820fe586dacf28363999eaa589f007a2c",
      "parents": [
        "385e846e9fdd604a405b8e6089522bf2226ac889"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Jun 19 13:42:14 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 19 13:42:14 2026 +0000"
      },
      "message": "build(deps): bump actions/checkout from 6 to 7\n\nBumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v6...v7)\n\n---\nupdated-dependencies:\n- dependency-name: actions/checkout\n  dependency-version: \u00277\u0027\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    },
    {
      "commit": "b1b7a662a1f6c28c321d6ba90500b50f75c9057d",
      "tree": "48089f6a729a68076ef510868b2082c74ab99574",
      "parents": [
        "385e846e9fdd604a405b8e6089522bf2226ac889"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Jun 18 13:47:55 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jun 18 13:47:55 2026 +0000"
      },
      "message": "build(deps): bump org.codehaus.jettison:jettison from 1.5.5 to 1.5.6\n\nBumps [org.codehaus.jettison:jettison](https://github.com/jettison-json/jettison) from 1.5.5 to 1.5.6.\n- [Release notes](https://github.com/jettison-json/jettison/releases)\n- [Commits](https://github.com/jettison-json/jettison/compare/jettison-1.5.5...jettison-1.5.6)\n\n---\nupdated-dependencies:\n- dependency-name: org.codehaus.jettison:jettison\n  dependency-version: 1.5.6\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e"
    }
  ],
  "next": "fa8f5eea6fc3fdf6f0e861fa8990da361e2cacb4"
}