)]}' { "log": [ { "commit": "4b2a126429a02d23d706db5705c6b9c12dbdb49d", "tree": "fd191f9d7fad205b027d290586dc98dc7024a46b", "parents": [ "615952f71f56527846163402b93cd278bfd9fbcb" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Oct 13 09:22:30 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Oct 13 09:22:30 2026 -1000" }, "message": "[maven-release-plugin] prepare for next development iteration\n" }, { "commit": "615952f71f56527846163402b93cd278bfd9fbcb", "tree": "80ed02b0028e0ad4f91b552db8b7c32249c4883e", "parents": [ "3d97cc0f123b0d36a53aae03ef1a28ddbc5f6161" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Oct 13 09:19:20 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Oct 13 09:19:20 2026 -1000" }, "message": "[maven-release-plugin] prepare release v2.0.2\n" }, { "commit": "3d97cc0f123b0d36a53aae03ef1a28ddbc5f6161", "tree": "44d698674c93c13b64778dd16ea018e3c7eb252e", "parents": [ "899689dc5a5ac32e270f42183f213e3a29f68c6d" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Oct 13 02:12:43 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Oct 13 02:12:43 2026 -1000" }, "message": "update 2.0.2 release notes with fixed Jira issues\n" }, { "commit": "899689dc5a5ac32e270f42183f213e3a29f68c6d", "tree": "33f2eaf96bb09daa965aeb7206fd953d5a702ebe", "parents": [ "0ec78e8e46bd268f21d76ca1232fcd3d1651e54c" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Oct 12 08:40:15 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Oct 12 08:40:15 2026 -1000" }, "message": "Bring the modernization plan up to date with 2.0.1 and 2.0.2\n\nRecords the 2.0.1 release, tested containers, the Maven Central-only\npackaging of the newer modules, and HTTP/2 publication as partly done.\nExample names in the JPA, pagination and end-state sections are now\ngeneric.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "0ec78e8e46bd268f21d76ca1232fcd3d1651e54c", "tree": "e9a13acb5219e595a705a59bfe647b086ad39d9b", "parents": [ "845c1e4f18340884acdd2e717a8f20e321a79355" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Oct 12 08:39:17 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Oct 12 08:39:17 2026 -1000" }, "message": "Use a generic library domain for the jpa-schema test mappings\n\nThe HBM fixtures, the custom write-exclude annotation in the tests and the\nexamples in the javadoc and docs now use Library, Branch and Book entities\nand an @AuditField marker. Coverage is unchanged: same mapping features,\nsame 40 tests.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "845c1e4f18340884acdd2e717a8f20e321a79355", "tree": "b5afb699e0c3857baffae034c1457d8b4ff89231", "parents": [ "ce4cb39c14fd567ab734ca6fbe1ad01228283efa" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Oct 12 08:33:06 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Oct 12 08:33:06 2026 -1000" }, "message": "Remove the https, jms and java_first_jaxws samples\n\nNone of them could be run as documented: the https sample used the Jetty 6\nplugin, java_first_jaxws a javax-based Cargo container, and the jms sample\nhad no client.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "ce4cb39c14fd567ab734ca6fbe1ad01228283efa", "tree": "868857acdba0a3c977266d07f3e7b710b11efd0d", "parents": [ "996a415ef065f0d161399c33a6095626264730fa" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Oct 12 08:28:49 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Oct 12 08:28:49 2026 -1000" }, "message": "Sweep the docs for stale content ahead of 2.0.2\n\nFixes settings and APIs the code no longer has (HTTP/2, OpenAPI, Moshi H2,\nTomcat 11 HTTP/2 config), uncompilable snippets, old Java/Maven/container\nrequirements, removed features, SVN-era instructions, sample paths, plugin\ncoordinates and broken links, including the sitewide Mailing Lists link.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "996a415ef065f0d161399c33a6095626264730fa", "tree": "73af39b8d5d7a4cb910822b89cb96e092164e766", "parents": [ "d79a1f99ab286ad167c1f0ba5279e76b88ea789e" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Oct 12 08:28:49 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Oct 12 08:28:49 2026 -1000" }, "message": "Drop WSDL 2.0 and -Ejavaversion from wsdl2java help text\n\nWSDL 2.0 code generation was removed in 2.0.1 and nothing reads\n-Ejavaversion; the usage text still offered both.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "d79a1f99ab286ad167c1f0ba5279e76b88ea789e", "tree": "87294db20c144015d4a193641db0212417dae36f", "parents": [ "88857ee165318d8e300d04fc5dad00677daaf6b8" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Oct 12 08:28:49 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Oct 12 08:28:49 2026 -1000" }, "message": "Point the fuzz module at the current snapshot instead of 2.0.0\n\nThe module sits outside the reactor and was fuzzing the 2.0.0 jars, so none\nof the 2.0.x hardening was covered. It now builds at the root pom\u0027s version\nwith Java 17 and current Gson, and the jar has a fixed name for the docs.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "88857ee165318d8e300d04fc5dad00677daaf6b8", "tree": "bae9dedf50922b4feb037674aa0db383347ff97b", "parents": [ "3084977ac9ab7914ed2d4fbe003855ce9a77bc2e" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Oct 12 08:28:49 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Oct 12 08:28:49 2026 -1000" }, "message": "Fix ant samples in the binary distribution; remove dead samples\n\nSamples ship under modules/samples, but most build.xml files still located\nAXIS2_HOME two levels up, so ant failed. pojoguidespring now fetches Spring\n7.0.9 from Maven Central and servicelifecycle builds against Axiom 2.0. The\nyahoo*, googlespellcheck, jaxws-dynamic and book samples are removed.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "3084977ac9ab7914ed2d4fbe003855ce9a77bc2e", "tree": "6c043601987b3b82ba775775e56816f72a7dcce8", "parents": [ "6922c33cc3b4ab08e7ccbcf7849dea46ab441f94" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Oct 12 07:58:04 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Oct 12 07:58:04 2026 -1000" }, "message": "Update docs for WildFly 41 testing and current Spring Boot versions\n\nReferences to WildFly 39 now name WildFly 41.0.1, which was tested with\nOpenJDK 21 and 25. The samples\u0027 tested Spring Boot version is 3.5.16, and the\nstarter page notes that the starter itself builds against Spring Boot 4.1.1.\nAlso fixes the stale toc.xml anchor for the MCP examples\u0027 live section.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "6922c33cc3b4ab08e7ccbcf7849dea46ab441f94", "tree": "40b741cc97de8a590033537fdb82a405c89eac95", "parents": [ "ca29c705d885fdbbd2c27c9f9ae3ec213c63797d" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Oct 11 10:25:25 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Oct 11 10:25:25 2026 -1000" }, "message": "Remove the unbuildable dynamicclient sample\n\nNever in the reactor, and its modules\u0027 parent version did not match the aggregator, so it could not be built. Noted under Distribution Changes in the 2.0.2 release notes.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "ca29c705d885fdbbd2c27c9f9ae3ec213c63797d", "tree": "9db9c0f88040268af1a34f0e090d4598dbf28caf", "parents": [ "ed3d5de85c420e4a7f305994b3f4a2104b5c7373" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Oct 11 10:04:38 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Oct 11 10:04:38 2026 -1000" }, "message": "Remove jacoco-report-maven-plugin, which breaks the source distribution build\n\nIt refuses to run outside a Git clone, so building the unpacked src zip fails on the last module. It only fed the Codecov upload, which CI no longer does; the JaCoCo agent stays for local reports.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "ed3d5de85c420e4a7f305994b3f4a2104b5c7373", "tree": "03ee874ba0947cb6d2c413fb008319dd9d5d6c64", "parents": [ "1b43f48c24d85a92e60936312d00a1753b9659bf" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Oct 11 06:15:33 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Oct 11 06:15:33 2026 -1000" }, "message": "Note json field filtering fix in 2.0.2 release notes\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "1b43f48c24d85a92e60936312d00a1753b9659bf", "tree": "c8e7e595dc624fc00aafebe3de325dd0815d0d59", "parents": [ "9888878c872fc94a2a8c790c7e9f6e7c85b213e2" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Oct 11 06:14:00 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Oct 11 06:14:00 2026 -1000" }, "message": "Test that json field filter dot paths cannot reach excluded fields\n\nThe nested walker selects fields separately from the top-level prune, so\ncover this$0 and @Json(ignore \u003d true) fields reached through dot notation\n(items.this$0, this$0.dbPassword, creds.apiToken) as well.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "9888878c872fc94a2a8c790c7e9f6e7c85b213e2", "tree": "aebee78fde12a3dc29cca730478daba4c1855861", "parents": [ "967788e43a0b637d985c5e25d46b6ea206b95ca1", "e7f34c2e73eb5e6fb2ae19cc04cc779f47578942" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Oct 11 06:13:41 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Oct 11 06:13:41 2026 -1000" }, "message": "Merge pull request #1308 from kali834x/field-filter-synthetic-ignored\n\nexclude synthetic and ignored fields from json field filtering\n" }, { "commit": "967788e43a0b637d985c5e25d46b6ea206b95ca1", "tree": "2eb2a90bcf72500aa7397811f3ff58595d351d33", "parents": [ "2262b0526068bf870ae4f417ee17ebec1732634b" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Oct 11 05:33:54 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Oct 11 05:33:54 2026 -1000" }, "message": "Remove legal files for jars no longer distributed\n\nswagger-annotations, swagger-core, swagger-models, undertow-core,\nundertow-servlet, xnio-api and commons-codec have no jar in lib/ of the\nbinary distribution or WEB-INF/lib of axis2.war; their license files were\nbeing copied into both regardless.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "2262b0526068bf870ae4f417ee17ebec1732634b", "tree": "d9e73fdcfb1b9f2d098a016bbe087089253390a7", "parents": [ "dcbe19c03d606374a20bbe3d90ff03258bae88c8" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Oct 08 18:19:13 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Oct 09 13:55:56 2026 -1000" }, "message": "Note in 2.0.2 release notes that guava is no longer bundled\n\nModules that relied on Axis2\u0027s copy must ship their own; Rampart 2.0.0 does.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "e7f34c2e73eb5e6fb2ae19cc04cc779f47578942", "tree": "47e0bf7d4958c67dcb01bf7051ef51e38560fb82", "parents": [ "dcbe19c03d606374a20bbe3d90ff03258bae88c8" ], "author": { "name": "Zibran Khan", "email": "kali834x@gmail.com", "time": "Sat Oct 10 01:32:04 2026 +0530" }, "committer": { "name": "Zibran Khan", "email": "kali834x@gmail.com", "time": "Sat Oct 10 01:32:04 2026 +0530" }, "message": "exclude synthetic and ignored fields from json field filtering\n" }, { "commit": "dcbe19c03d606374a20bbe3d90ff03258bae88c8", "tree": "02cf9bb8503964177eb729c55f7d326cddf90b53", "parents": [ "7834bcbd5e58b098471d090e1d4638e10e8b4af1", "9f42307f8e1638a9b754f63f26224ac20e419c9c" ], "author": { "name": "Christian Ortlepp", "email": "christian.ortlepp@hypergene.com", "time": "Fri Oct 09 13:52:13 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 13:52:13 2026 +0200" }, "message": "Merge pull request #1307 from kali834x/admin-login-constant-time\n\ncompare admin console credentials in constant time" }, { "commit": "7834bcbd5e58b098471d090e1d4638e10e8b4af1", "tree": "0f81192eb551017013824cf9fabef76a51ffdad0", "parents": [ "b699becc0fc80765bff6456c3e85d7fc62e4b2b6", "5a1a78fe97e8474f64f59e5a63417ee9273dc1ce" ], "author": { "name": "Christian Ortlepp", "email": "christian.ortlepp@hypergene.com", "time": "Fri Oct 09 13:50:01 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 13:50:01 2026 +0200" }, "message": "Merge pull request #1305 from apache/dependabot/maven/development-dependencies-9c2dfd6992\n\nbuild(deps-dev): bump the development-dependencies group across 1 directory with 6 updates" }, { "commit": "b699becc0fc80765bff6456c3e85d7fc62e4b2b6", "tree": "eb3d51aa7a772f632d8635e755c74a426f5e9fa6", "parents": [ "237ecbfd62ea5fb9ac1baf3dd7d31d993cc24548", "3c040b008089f997a5db834b10a54fde0bb59f66" ], "author": { "name": "Christian Ortlepp", "email": "christian.ortlepp@hypergene.com", "time": "Fri Oct 09 09:28:42 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 09:28:42 2026 +0200" }, "message": "Merge pull request #1303 from apache/dependabot/maven/modules/jpa-schema/com.fasterxml.jackson.core-jackson-databind-2.22.3\n\nbuild(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.3 in /modules/jpa-schema" }, { "commit": "237ecbfd62ea5fb9ac1baf3dd7d31d993cc24548", "tree": "eb3d51aa7a772f632d8635e755c74a426f5e9fa6", "parents": [ "ac5fa0f85540e0b3ce43e4814e6d180da0df9e0e", "4862e0c4ec75f7bcdcbf45e66a9d0ac6052d2760" ], "author": { "name": "Christian Ortlepp", "email": "christian.ortlepp@hypergene.com", "time": "Fri Oct 09 09:28:37 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 09:28:37 2026 +0200" }, "message": "Merge pull request #1304 from apache/dependabot/maven/modules/mcp-bridge/com.fasterxml.jackson.core-jackson-databind-2.22.3\n\nbuild(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.3 in /modules/mcp-bridge" }, { "commit": "5a1a78fe97e8474f64f59e5a63417ee9273dc1ce", "tree": "0f81192eb551017013824cf9fabef76a51ffdad0", "parents": [ "be0a3ed1c037bef3fad812bf5420035a416ae160", "ac5fa0f85540e0b3ce43e4814e6d180da0df9e0e" ], "author": { "name": "Christian Ortlepp", "email": "christian.ortlepp@hypergene.com", "time": "Fri Oct 09 09:28:21 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 09:28:21 2026 +0200" }, "message": "Merge branch \u0027master\u0027 into dependabot/maven/development-dependencies-9c2dfd6992" }, { "commit": "ac5fa0f85540e0b3ce43e4814e6d180da0df9e0e", "tree": "eb3d51aa7a772f632d8635e755c74a426f5e9fa6", "parents": [ "cf132dee663e4a0714deb053cfab720a18ce320f", "dfffd5db8f8141cf63f2f7f86e4e970bf1ce5593" ], "author": { "name": "Christian Ortlepp", "email": "christian.ortlepp@hypergene.com", "time": "Fri Oct 09 09:27:19 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 09:27:19 2026 +0200" }, "message": "Merge pull request #1306 from apache/dependabot/maven/production-dependencies-f793d7056e\n\nbuild(deps): bump the production-dependencies group across 1 directory with 26 updates" }, { "commit": "9f42307f8e1638a9b754f63f26224ac20e419c9c", "tree": "0989bdd4a9cd381916dbbc59f235390dd2618874", "parents": [ "cf132dee663e4a0714deb053cfab720a18ce320f" ], "author": { "name": "Zibran Khan", "email": "kali834x@gmail.com", "time": "Fri Oct 09 00:24:44 2026 +0530" }, "committer": { "name": "Zibran Khan", "email": "kali834x@gmail.com", "time": "Fri Oct 09 00:24:44 2026 +0530" }, "message": "compare admin console credentials in constant time\n" }, { "commit": "dfffd5db8f8141cf63f2f7f86e4e970bf1ce5593", "tree": "eb3d51aa7a772f632d8635e755c74a426f5e9fa6", "parents": [ "cf132dee663e4a0714deb053cfab720a18ce320f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 08 14:14:03 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 08 14:14:03 2026 +0000" }, "message": "build(deps): bump the production-dependencies group across 1 directory with 26 updates\n\nBumps the production-dependencies group with 26 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [org.apache:apache](https://github.com/apache/maven-apache-parent) | `39` | `40` |\n| [org.mockito:mockito-core](https://github.com/mockito/mockito) | `5.23.0` | `5.24.0` |\n| org.apache.ws.xmlschema:xmlschema-core | `2.3.2` | `2.3.3` |\n| org.apache.neethi:neethi | `3.2.3` | `3.2.4` |\n| org.slf4j:slf4j-api | `2.0.19` | `2.0.20` |\n| org.slf4j:jcl-over-slf4j | `2.0.19` | `2.0.20` |\n| org.slf4j:jcl-over-slf4j | `2.0.19` | `2.0.20` |\n| [org.apache.httpcomponents.core5:httpcore5](https://github.com/apache/httpcomponents-core) | `5.4.3` | `5.4.4` |\n| [org.apache.httpcomponents.core5:httpcore5-h2](https://github.com/apache/httpcomponents-core) | `5.4.3` | `5.4.4` |\n| [org.apache.httpcomponents.core5:httpcore5-h2](https://github.com/apache/httpcomponents-core) | `5.4.3` | `5.4.4` |\n| [org.xmlunit:xmlunit-legacy](https://github.com/xmlunit/xmlunit) | `2.13.0` | `2.14.0` |\n| org.apache.xmlbeans:xmlbeans | `5.4.0` | `5.4.1` |\n| [org.apache.maven:maven-plugin-api](https://github.com/apache/maven) | `3.9.16` | `3.10.0` |\n| org.apache.maven:maven-core | `3.9.16` | `3.10.0` |\n| org.apache.maven:maven-artifact | `3.9.16` | `3.10.0` |\n| [org.apache.maven:maven-compat](https://github.com/apache/maven) | `3.9.16` | `3.10.0` |\n| org.apache.maven:maven-core | `3.9.16` | `3.10.0` |\n| org.apache.maven:maven-artifact | `3.9.16` | `3.10.0` |\n| [org.apache.maven:maven-compat](https://github.com/apache/maven) | `3.9.16` | `3.10.0` |\n| org.apache.commons:commons-lang3 | `3.20.0` | `3.21.0` |\n| [com.google.guava:guava](https://github.com/google/guava) | `33.7.1-jre` | `33.7.2-jre` |\n| [com.fasterxml.woodstox:woodstox-core](https://github.com/FasterXML/woodstox) | `7.2.2` | `7.3.0` |\n| org.eclipse.jetty.ee10:jetty-ee10-webapp | `12.1.13` | `12.1.14` |\n| org.eclipse.jetty.ee10:jetty-ee10-maven-plugin | `12.1.13` | `12.1.14` |\n| org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin | `12.1.13` | `12.1.14` |\n| [net.bytebuddy:byte-buddy](https://github.com/raphw/byte-buddy) | `1.18.13` | `1.18.14` |\n| [org.apache.groovy:groovy](https://github.com/apache/groovy) | `5.1.2` | `6.0.0` |\n| [org.apache.groovy:groovy-ant](https://github.com/apache/groovy) | `5.1.2` | `6.0.0` |\n| [org.apache.groovy:groovy-xml](https://github.com/apache/groovy) | `5.1.2` | `6.0.0` |\n| [org.apache.groovy:groovy-ant](https://github.com/apache/groovy) | `5.1.2` | `6.0.0` |\n| [org.apache.groovy:groovy-xml](https://github.com/apache/groovy) | `5.1.2` | `6.0.0` |\n| org.eclipse.jetty.ee10:jetty-ee10-maven-plugin | `12.1.13` | `12.1.14` |\n| org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin | `12.1.13` | `12.1.14` |\n| [org.owasp.encoder:encoder](https://github.com/OWASP/owasp-java-encoder) | `1.4.0` | `1.5.0` |\n| [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) | `2.22.2` | `2.22.3` |\n\n\n\nUpdates `org.apache:apache` from 39 to 40\n- [Release notes](https://github.com/apache/maven-apache-parent/releases)\n- [Commits](https://github.com/apache/maven-apache-parent/commits)\n\nUpdates `org.mockito:mockito-core` from 5.23.0 to 5.24.0\n- [Release notes](https://github.com/mockito/mockito/releases)\n- [Commits](https://github.com/mockito/mockito/compare/v5.23.0...v5.24.0)\n\nUpdates `org.apache.ws.xmlschema:xmlschema-core` from 2.3.2 to 2.3.3\n\nUpdates `org.apache.neethi:neethi` from 3.2.3 to 3.2.4\n\nUpdates `org.slf4j:slf4j-api` from 2.0.19 to 2.0.20\n\nUpdates `org.slf4j:jcl-over-slf4j` from 2.0.19 to 2.0.20\n\nUpdates `org.slf4j:jcl-over-slf4j` from 2.0.19 to 2.0.20\n\nUpdates `org.apache.httpcomponents.core5:httpcore5` from 5.4.3 to 5.4.4\n- [Changelog](https://github.com/apache/httpcomponents-core/blob/rel/v5.4.4/RELEASE_NOTES.txt)\n- [Commits](https://github.com/apache/httpcomponents-core/compare/rel/v5.4.3...rel/v5.4.4)\n\nUpdates `org.apache.httpcomponents.core5:httpcore5-h2` from 5.4.3 to 5.4.4\n- [Changelog](https://github.com/apache/httpcomponents-core/blob/rel/v5.4.4/RELEASE_NOTES.txt)\n- [Commits](https://github.com/apache/httpcomponents-core/compare/rel/v5.4.3...rel/v5.4.4)\n\nUpdates `org.apache.httpcomponents.core5:httpcore5-h2` from 5.4.3 to 5.4.4\n- [Changelog](https://github.com/apache/httpcomponents-core/blob/rel/v5.4.4/RELEASE_NOTES.txt)\n- [Commits](https://github.com/apache/httpcomponents-core/compare/rel/v5.4.3...rel/v5.4.4)\n\nUpdates `org.xmlunit:xmlunit-legacy` from 2.13.0 to 2.14.0\n- [Release notes](https://github.com/xmlunit/xmlunit/releases)\n- [Changelog](https://github.com/xmlunit/xmlunit/blob/main/RELEASE_NOTES.md)\n- [Commits](https://github.com/xmlunit/xmlunit/compare/v2.13.0...v2.14.0)\n\nUpdates `org.apache.xmlbeans:xmlbeans` from 5.4.0 to 5.4.1\n\nUpdates `org.apache.maven:maven-plugin-api` from 3.9.16 to 3.10.0\n- [Release notes](https://github.com/apache/maven/releases)\n- [Commits](https://github.com/apache/maven/compare/maven-3.9.16...maven-3.10.0)\n\nUpdates `org.apache.maven:maven-core` from 3.9.16 to 3.10.0\n\nUpdates `org.apache.maven:maven-artifact` from 3.9.16 to 3.10.0\n\nUpdates `org.apache.maven:maven-compat` from 3.9.16 to 3.10.0\n- [Release notes](https://github.com/apache/maven/releases)\n- [Commits](https://github.com/apache/maven/compare/maven-3.9.16...maven-3.10.0)\n\nUpdates `org.apache.maven:maven-core` from 3.9.16 to 3.10.0\n\nUpdates `org.apache.maven:maven-artifact` from 3.9.16 to 3.10.0\n\nUpdates `org.apache.maven:maven-compat` from 3.9.16 to 3.10.0\n- [Release notes](https://github.com/apache/maven/releases)\n- [Commits](https://github.com/apache/maven/compare/maven-3.9.16...maven-3.10.0)\n\nUpdates `org.apache.commons:commons-lang3` from 3.20.0 to 3.21.0\n\nUpdates `com.google.guava:guava` from 33.7.1-jre to 33.7.2-jre\n- [Release notes](https://github.com/google/guava/releases)\n- [Commits](https://github.com/google/guava/commits)\n\nUpdates `com.fasterxml.woodstox:woodstox-core` from 7.2.2 to 7.3.0\n- [Commits](https://github.com/FasterXML/woodstox/compare/woodstox-core-7.2.2...woodstox-core-7.3.0)\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-webapp` from 12.1.13 to 12.1.14\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-maven-plugin` from 12.1.13 to 12.1.14\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin` from 12.1.13 to 12.1.14\n\nUpdates `net.bytebuddy:byte-buddy` from 1.18.13 to 1.18.14\n- [Release notes](https://github.com/raphw/byte-buddy/releases)\n- [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md)\n- [Commits](https://github.com/raphw/byte-buddy/compare/byte-buddy-1.18.13...byte-buddy-1.18.14)\n\nUpdates `org.apache.groovy:groovy` from 5.1.2 to 6.0.0\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.apache.groovy:groovy-ant` from 5.1.2 to 6.0.0\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.apache.groovy:groovy-xml` from 5.1.2 to 6.0.0\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.apache.groovy:groovy-ant` from 5.1.2 to 6.0.0\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.apache.groovy:groovy-xml` from 5.1.2 to 6.0.0\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-maven-plugin` from 12.1.13 to 12.1.14\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin` from 12.1.13 to 12.1.14\n\nUpdates `org.owasp.encoder:encoder` from 1.4.0 to 1.5.0\n- [Release notes](https://github.com/OWASP/owasp-java-encoder/releases)\n- [Changelog](https://github.com/OWASP/owasp-java-encoder/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/OWASP/owasp-java-encoder/compare/v1.4.0...v1.5.0)\n\nUpdates `com.fasterxml.jackson.core:jackson-databind` from 2.22.2 to 2.22.3\n- [Commits](https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.22.2...jackson-databind-2.22.3)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache:apache\n dependency-version: \u002740\u0027\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: production-dependencies\n- dependency-name: org.mockito:mockito-core\n dependency-version: 5.24.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.apache.ws.xmlschema:xmlschema-core\n dependency-version: 2.3.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.neethi:neethi\n dependency-version: 3.2.4\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.slf4j:slf4j-api\n dependency-version: 2.0.20\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.slf4j:jcl-over-slf4j\n dependency-version: 2.0.20\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.slf4j:jcl-over-slf4j\n dependency-version: 2.0.20\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.httpcomponents.core5:httpcore5\n dependency-version: 5.4.4\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.httpcomponents.core5:httpcore5-h2\n dependency-version: 5.4.4\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.httpcomponents.core5:httpcore5-h2\n dependency-version: 5.4.4\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.xmlunit:xmlunit-legacy\n dependency-version: 2.14.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.apache.xmlbeans:xmlbeans\n dependency-version: 5.4.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.maven:maven-plugin-api\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.apache.maven:maven-core\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.apache.maven:maven-artifact\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.apache.maven:maven-compat\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.apache.maven:maven-core\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.apache.maven:maven-artifact\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.apache.maven:maven-compat\n dependency-version: 3.10.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.apache.commons:commons-lang3\n dependency-version: 3.21.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: com.google.guava:guava\n dependency-version: 33.7.2-jre\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: com.fasterxml.woodstox:woodstox-core\n dependency-version: 7.3.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-webapp\n dependency-version: 12.1.14\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-maven-plugin\n dependency-version: 12.1.14\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin\n dependency-version: 12.1.14\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: net.bytebuddy:byte-buddy\n dependency-version: 1.18.14\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.groovy:groovy\n dependency-version: 6.0.0\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: production-dependencies\n- dependency-name: org.apache.groovy:groovy-ant\n dependency-version: 6.0.0\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: production-dependencies\n- dependency-name: org.apache.groovy:groovy-xml\n dependency-version: 6.0.0\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: production-dependencies\n- dependency-name: org.apache.groovy:groovy-ant\n dependency-version: 6.0.0\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: production-dependencies\n- dependency-name: org.apache.groovy:groovy-xml\n dependency-version: 6.0.0\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: production-dependencies\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-maven-plugin\n dependency-version: 12.1.14\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin\n dependency-version: 12.1.14\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.owasp.encoder:encoder\n dependency-version: 1.5.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: com.fasterxml.jackson.core:jackson-databind\n dependency-version: 2.22.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "be0a3ed1c037bef3fad812bf5420035a416ae160", "tree": "d227915a60860bcb9ad89a54b7b38d7da1f7028e", "parents": [ "cf132dee663e4a0714deb053cfab720a18ce320f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 08 14:10:52 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 08 14:10:52 2026 +0000" }, "message": "build(deps-dev): bump the development-dependencies group across 1 directory with 6 updates\n\nBumps the development-dependencies group with 6 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| org.slf4j:slf4j-jdk14 | `2.0.19` | `2.0.20` |\n| [org.xmlunit:xmlunit-assertj3](https://github.com/xmlunit/xmlunit) | `2.13.0` | `2.14.0` |\n| org.eclipse.jetty:jetty-server | `12.1.13` | `12.1.14` |\n| org.eclipse.jetty.ee9:jetty-ee9-nested | `12.1.13` | `12.1.14` |\n| org.eclipse.jetty.ee9:jetty-ee9-nested | `12.1.13` | `12.1.14` |\n| org.apache.felix:maven-bundle-plugin | `6.1.2` | `6.2.0` |\n| [com.icegreen:greenmail](https://github.com/greenmail-mail-test/greenmail) | `2.1.13` | `2.1.14` |\n\n\n\nUpdates `org.slf4j:slf4j-jdk14` from 2.0.19 to 2.0.20\n\nUpdates `org.xmlunit:xmlunit-assertj3` from 2.13.0 to 2.14.0\n- [Release notes](https://github.com/xmlunit/xmlunit/releases)\n- [Changelog](https://github.com/xmlunit/xmlunit/blob/main/RELEASE_NOTES.md)\n- [Commits](https://github.com/xmlunit/xmlunit/compare/v2.13.0...v2.14.0)\n\nUpdates `org.eclipse.jetty:jetty-server` from 12.1.13 to 12.1.14\n\nUpdates `org.eclipse.jetty.ee9:jetty-ee9-nested` from 12.1.13 to 12.1.14\n\nUpdates `org.eclipse.jetty.ee9:jetty-ee9-nested` from 12.1.13 to 12.1.14\n\nUpdates `org.apache.felix:maven-bundle-plugin` from 6.1.2 to 6.2.0\n\nUpdates `com.icegreen:greenmail` from 2.1.13 to 2.1.14\n- [Release notes](https://github.com/greenmail-mail-test/greenmail/releases)\n- [Commits](https://github.com/greenmail-mail-test/greenmail/compare/release-2.1.13...release-2.1.14)\n\n---\nupdated-dependencies:\n- dependency-name: org.slf4j:slf4j-jdk14\n dependency-version: 2.0.20\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: development-dependencies\n- dependency-name: org.xmlunit:xmlunit-assertj3\n dependency-version: 2.14.0\n dependency-type: direct:development\n update-type: version-update:semver-minor\n dependency-group: development-dependencies\n- dependency-name: org.eclipse.jetty:jetty-server\n dependency-version: 12.1.14\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: development-dependencies\n- dependency-name: org.eclipse.jetty.ee9:jetty-ee9-nested\n dependency-version: 12.1.14\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: development-dependencies\n- dependency-name: org.eclipse.jetty.ee9:jetty-ee9-nested\n dependency-version: 12.1.14\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: development-dependencies\n- dependency-name: org.apache.felix:maven-bundle-plugin\n dependency-version: 6.2.0\n dependency-type: direct:development\n update-type: version-update:semver-minor\n dependency-group: development-dependencies\n- dependency-name: com.icegreen:greenmail\n dependency-version: 2.1.14\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: development-dependencies\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "4862e0c4ec75f7bcdcbf45e66a9d0ac6052d2760", "tree": "0269dac0ccca27c92e381f3c8d821fb871fff46c", "parents": [ "aea2671e3c5ebd8638d37db30d69639223366d5d" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 07 10:59:26 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 07 10:59:26 2026 +0000" }, "message": "build(deps): bump com.fasterxml.jackson.core:jackson-databind\n\nBumps [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) from 2.22.2 to 2.22.3.\n- [Commits](https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.22.2...jackson-databind-2.22.3)\n\n---\nupdated-dependencies:\n- dependency-name: com.fasterxml.jackson.core:jackson-databind\n dependency-version: 2.22.3\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "3c040b008089f997a5db834b10a54fde0bb59f66", "tree": "1b0edf3cbf56f175ec5a2a6318afe0481c7b783d", "parents": [ "aea2671e3c5ebd8638d37db30d69639223366d5d" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 07 10:56:24 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 07 10:56:24 2026 +0000" }, "message": "build(deps): bump com.fasterxml.jackson.core:jackson-databind\n\nBumps [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) from 2.22.2 to 2.22.3.\n- [Commits](https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.22.2...jackson-databind-2.22.3)\n\n---\nupdated-dependencies:\n- dependency-name: com.fasterxml.jackson.core:jackson-databind\n dependency-version: 2.22.3\n dependency-type: direct:production\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "cf132dee663e4a0714deb053cfab720a18ce320f", "tree": "c06701be651490deec2cb8c991908d7a04f841f6", "parents": [ "aea2671e3c5ebd8638d37db30d69639223366d5d" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Oct 06 13:53:56 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Oct 06 13:53:56 2026 -1000" }, "message": "Use L64X128MixRandom in the financial benchmark Monte Carlo sample\n\nmonteCarlo() drew its normals from java.util.Random.nextGaussian(), whose\natomic seed update and StrictMath polar method dominated the inner loop.\nThe JDK 17+ L64X128MixRandom makes the method about 3x faster on JDK 21;\nseeded runs remain reproducible, but produce different paths than before.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "aea2671e3c5ebd8638d37db30d69639223366d5d", "tree": "4427038b227db506b57d9dea81b13900520aec78", "parents": [ "bdb1250fe57730cb9dd3e1fe6e1573cdcee5557b" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Sep 29 12:08:45 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Sep 29 12:08:45 2026 -1000" }, "message": "Bound the JSON request body in every JSON builder\n\nThe request-body ceilings never reached axis2-json, so an application/json\nPOST was read without limit. Add jsonMaxRequestSize (100 MB, -1 to opt out)\nand apply it in the legacy, Gson, Moshi and HTTP/2 JSON builders alike: a\nstreaming reader still materialises a single string token whole.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "bdb1250fe57730cb9dd3e1fe6e1573cdcee5557b", "tree": "3a8ba500507c9876513523e0bb23da01ea3e6e7e", "parents": [ "ae66a77b07278966a7244bead06566ba1cd34ef0" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Sep 22 13:07:46 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Sep 22 13:07:46 2026 -1000" }, "message": "remove woden license file since all deps are removed\n" }, { "commit": "ae66a77b07278966a7244bead06566ba1cd34ef0", "tree": "46b222636c850040f9549bde1c23ab4bbe769aeb", "parents": [ "bd74ee5949e18a86a9a6b60465f804fc84d74297" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Sep 22 11:21:02 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Sep 22 11:21:02 2026 -1000" }, "message": "Drop the last Woden references from the build\n\nThe 2.0.1 removal (AXIS2-6102) took out the WSDL 2.0 code but left the\nversion property, the dependencyManagement entry, an unused dependency in\nthe integration module and two sample poms still naming woden-core. No\nJava source imports Woden, so this is build cruft only. Also drops the\norphaned wsdl20 integration test resource.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "bd74ee5949e18a86a9a6b60465f804fc84d74297", "tree": "d7b160bad91854860854d098b338b534455b9fa3", "parents": [ "6be868fd3a4bbe91167d8e4b8111c19f503e7b20", "03c3576dc441495b9a9e0a2ff14ee64d2ff5b64d" ], "author": { "name": "Christian Ortlepp", "email": "christian.ortlepp@hypergene.com", "time": "Mon Sep 21 16:24:40 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 21 16:24:40 2026 +0200" }, "message": "Merge pull request #1296 from apache/dependabot/github_actions/production-actions-4cf73e6ad1\n\nbuild(deps): bump actions/setup-java from 6.0.0 to 6.0.1 in the production-actions group" }, { "commit": "6be868fd3a4bbe91167d8e4b8111c19f503e7b20", "tree": "970e3bb64f975b8b979941393f84b7c9ffb94c9b", "parents": [ "27197cc4fce33dc8684db879592085cef94c3667", "0eed523d5e920b5afeb5cad17c3cafaf5a2e2cdc" ], "author": { "name": "Christian Ortlepp", "email": "christian.ortlepp@hypergene.com", "time": "Mon Sep 21 16:23:27 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 21 16:23:27 2026 +0200" }, "message": "Merge pull request #1297 from apache/dependabot/maven/development-dependencies-69bea09e45\n\nbuild(deps-dev): bump the development-dependencies group across 1 directory with 7 updates" }, { "commit": "27197cc4fce33dc8684db879592085cef94c3667", "tree": "9283125f1bdf4084ccdca305e5422cd2113a9fe5", "parents": [ "d3bc95176b757920cde82b562b4a5857ee549419", "7875db899a314c895c39cca6bdbb922f9b6b915c" ], "author": { "name": "Christian Ortlepp", "email": "christian.ortlepp@hypergene.com", "time": "Mon Sep 21 16:22:43 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Sep 21 16:22:43 2026 +0200" }, "message": "Merge pull request #1298 from apache/dependabot/maven/production-dependencies-e2780706c4\n\nbuild(deps): bump the production-dependencies group across 1 directory with 17 updates" }, { "commit": "7875db899a314c895c39cca6bdbb922f9b6b915c", "tree": "9283125f1bdf4084ccdca305e5422cd2113a9fe5", "parents": [ "d3bc95176b757920cde82b562b4a5857ee549419" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Sep 17 13:46:01 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 17 13:46:01 2026 +0000" }, "message": "build(deps): bump the production-dependencies group across 1 directory with 17 updates\n\nBumps the production-dependencies group with 17 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| org.slf4j:slf4j-api | `2.0.18` | `2.0.19` |\n| org.slf4j:jcl-over-slf4j | `2.0.18` | `2.0.19` |\n| org.slf4j:jcl-over-slf4j | `2.0.18` | `2.0.19` |\n| [org.apache.maven.plugin-tools:maven-plugin-annotations](https://github.com/apache/maven-plugin-tools) | `3.15.2` | `3.16.0` |\n| [org.apache.maven.plugins:maven-plugin-plugin](https://github.com/apache/maven-plugin-tools) | `3.15.2` | `3.16.0` |\n| [org.apache.maven.plugins:maven-plugin-report-plugin](https://github.com/apache/maven-plugin-tools) | `3.15.2` | `3.16.0` |\n| org.eclipse.jetty.ee10:jetty-ee10-webapp | `12.1.12` | `12.1.13` |\n| org.eclipse.jetty.ee10:jetty-ee10-maven-plugin | `12.1.12` | `12.1.13` |\n| org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin | `12.1.12` | `12.1.13` |\n| [org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java) | `1.85` | `1.86` |\n| [net.bytebuddy:byte-buddy](https://github.com/raphw/byte-buddy) | `1.18.12` | `1.18.13` |\n| [org.apache.groovy:groovy](https://github.com/apache/groovy) | `5.1.1` | `5.1.2` |\n| [org.apache.groovy:groovy-ant](https://github.com/apache/groovy) | `5.1.1` | `5.1.2` |\n| [org.apache.groovy:groovy-xml](https://github.com/apache/groovy) | `5.1.1` | `5.1.2` |\n| [org.apache.groovy:groovy-ant](https://github.com/apache/groovy) | `5.1.1` | `5.1.2` |\n| [org.apache.groovy:groovy-xml](https://github.com/apache/groovy) | `5.1.1` | `5.1.2` |\n| [org.apache.maven.plugins:maven-plugin-plugin](https://github.com/apache/maven-plugin-tools) | `3.15.2` | `3.16.0` |\n| [org.apache.maven.plugins:maven-plugin-report-plugin](https://github.com/apache/maven-plugin-tools) | `3.15.2` | `3.16.0` |\n| [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.5.6` | `3.6.0` |\n| [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire) | `3.5.6` | `3.6.0` |\n| [org.apache.maven.plugins:maven-failsafe-plugin](https://github.com/apache/maven-surefire) | `3.5.6` | `3.6.0` |\n| [org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin) | `3.6.1` | `3.6.2` |\n| org.eclipse.jetty.ee10:jetty-ee10-maven-plugin | `12.1.12` | `12.1.13` |\n| org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin | `12.1.12` | `12.1.13` |\n| [com.squareup.okio:okio](https://github.com/lysine-dev/okio) | `3.18.1` | `3.18.2` |\n\n\n\nUpdates `org.slf4j:slf4j-api` from 2.0.18 to 2.0.19\n\nUpdates `org.slf4j:jcl-over-slf4j` from 2.0.18 to 2.0.19\n\nUpdates `org.slf4j:jcl-over-slf4j` from 2.0.18 to 2.0.19\n\nUpdates `org.apache.maven.plugin-tools:maven-plugin-annotations` from 3.15.2 to 3.16.0\n- [Release notes](https://github.com/apache/maven-plugin-tools/releases)\n- [Commits](https://github.com/apache/maven-plugin-tools/compare/maven-plugin-tools-3.15.2...maven-plugin-tools-3.16.0)\n\nUpdates `org.apache.maven.plugins:maven-plugin-plugin` from 3.15.2 to 3.16.0\n- [Release notes](https://github.com/apache/maven-plugin-tools/releases)\n- [Commits](https://github.com/apache/maven-plugin-tools/compare/maven-plugin-tools-3.15.2...maven-plugin-tools-3.16.0)\n\nUpdates `org.apache.maven.plugins:maven-plugin-report-plugin` from 3.15.2 to 3.16.0\n- [Release notes](https://github.com/apache/maven-plugin-tools/releases)\n- [Commits](https://github.com/apache/maven-plugin-tools/compare/maven-plugin-tools-3.15.2...maven-plugin-tools-3.16.0)\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-webapp` from 12.1.12 to 12.1.13\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-maven-plugin` from 12.1.12 to 12.1.13\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin` from 12.1.12 to 12.1.13\n\nUpdates `org.bouncycastle:bcpkix-jdk18on` from 1.85 to 1.86\n- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)\n- [Commits](https://github.com/bcgit/bc-java/commits)\n\nUpdates `net.bytebuddy:byte-buddy` from 1.18.12 to 1.18.13\n- [Release notes](https://github.com/raphw/byte-buddy/releases)\n- [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md)\n- [Commits](https://github.com/raphw/byte-buddy/compare/byte-buddy-1.18.12...byte-buddy-1.18.13)\n\nUpdates `org.apache.groovy:groovy` from 5.1.1 to 5.1.2\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.apache.groovy:groovy-ant` from 5.1.1 to 5.1.2\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.apache.groovy:groovy-xml` from 5.1.1 to 5.1.2\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.apache.groovy:groovy-ant` from 5.1.1 to 5.1.2\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.apache.groovy:groovy-xml` from 5.1.1 to 5.1.2\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.apache.maven.plugins:maven-plugin-plugin` from 3.15.2 to 3.16.0\n- [Release notes](https://github.com/apache/maven-plugin-tools/releases)\n- [Commits](https://github.com/apache/maven-plugin-tools/compare/maven-plugin-tools-3.15.2...maven-plugin-tools-3.16.0)\n\nUpdates `org.apache.maven.plugins:maven-plugin-report-plugin` from 3.15.2 to 3.16.0\n- [Release notes](https://github.com/apache/maven-plugin-tools/releases)\n- [Commits](https://github.com/apache/maven-plugin-tools/compare/maven-plugin-tools-3.15.2...maven-plugin-tools-3.16.0)\n\nUpdates `org.apache.maven.plugins:maven-surefire-plugin` from 3.5.6 to 3.6.0\n- [Release notes](https://github.com/apache/maven-surefire/releases)\n- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.6...surefire-3.6.0)\n\nUpdates `org.apache.maven.plugins:maven-failsafe-plugin` from 3.5.6 to 3.6.0\n- [Release notes](https://github.com/apache/maven-surefire/releases)\n- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.6...surefire-3.6.0)\n\nUpdates `org.apache.maven.plugins:maven-failsafe-plugin` from 3.5.6 to 3.6.0\n- [Release notes](https://github.com/apache/maven-surefire/releases)\n- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.6...surefire-3.6.0)\n\nUpdates `org.codehaus.mojo:build-helper-maven-plugin` from 3.6.1 to 3.6.2\n- [Release notes](https://github.com/mojohaus/build-helper-maven-plugin/releases)\n- [Commits](https://github.com/mojohaus/build-helper-maven-plugin/compare/3.6.1...3.6.2)\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-maven-plugin` from 12.1.12 to 12.1.13\n\nUpdates `org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin` from 12.1.12 to 12.1.13\n\nUpdates `com.squareup.okio:okio` from 3.18.1 to 3.18.2\n- [Changelog](https://github.com/lysine-dev/okio/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/lysine-dev/okio/compare/parent-3.18.1...parent-3.18.2)\n\n---\nupdated-dependencies:\n- dependency-name: org.slf4j:slf4j-api\n dependency-version: 2.0.19\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.slf4j:jcl-over-slf4j\n dependency-version: 2.0.19\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.slf4j:jcl-over-slf4j\n dependency-version: 2.0.19\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.maven.plugin-tools:maven-plugin-annotations\n dependency-version: 3.16.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.apache.maven.plugins:maven-plugin-plugin\n dependency-version: 3.16.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.apache.maven.plugins:maven-plugin-report-plugin\n dependency-version: 3.16.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-webapp\n dependency-version: 12.1.13\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-maven-plugin\n dependency-version: 12.1.13\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin\n dependency-version: 12.1.13\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.bouncycastle:bcpkix-jdk18on\n dependency-version: \u00271.86\u0027\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: net.bytebuddy:byte-buddy\n dependency-version: 1.18.13\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.groovy:groovy\n dependency-version: 5.1.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.groovy:groovy-ant\n dependency-version: 5.1.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.groovy:groovy-xml\n dependency-version: 5.1.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.groovy:groovy-ant\n dependency-version: 5.1.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.groovy:groovy-xml\n dependency-version: 5.1.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.maven.plugins:maven-plugin-plugin\n dependency-version: 3.16.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.apache.maven.plugins:maven-plugin-report-plugin\n dependency-version: 3.16.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.apache.maven.plugins:maven-surefire-plugin\n dependency-version: 3.6.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.apache.maven.plugins:maven-failsafe-plugin\n dependency-version: 3.6.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.apache.maven.plugins:maven-failsafe-plugin\n dependency-version: 3.6.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.codehaus.mojo:build-helper-maven-plugin\n dependency-version: 3.6.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-maven-plugin\n dependency-version: 12.1.13\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-jspc-maven-plugin\n dependency-version: 12.1.13\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: com.squareup.okio:okio\n dependency-version: 3.18.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "0eed523d5e920b5afeb5cad17c3cafaf5a2e2cdc", "tree": "096158466014d791229b3e52fd58aa366a5f02f4", "parents": [ "d3bc95176b757920cde82b562b4a5857ee549419" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Sep 17 13:44:06 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 17 13:44:06 2026 +0000" }, "message": "build(deps-dev): bump the development-dependencies group across 1 directory with 7 updates\n\nBumps the development-dependencies group with 7 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| org.apache.ant:ant-launcher | `1.10.17` | `1.10.18` |\n| org.apache.ant:ant | `1.10.17` | `1.10.18` |\n| org.apache.ant:ant | `1.10.17` | `1.10.18` |\n| org.slf4j:slf4j-jdk14 | `2.0.18` | `2.0.19` |\n| org.eclipse.jetty:jetty-server | `12.1.12` | `12.1.13` |\n| org.eclipse.jetty.ee9:jetty-ee9-nested | `12.1.12` | `12.1.13` |\n| org.eclipse.jetty.ee9:jetty-ee9-nested | `12.1.12` | `12.1.13` |\n| [org.apache.maven.plugins:maven-install-plugin](https://github.com/apache/maven-install-plugin) | `3.1.4` | `3.2.0` |\n| [org.codehaus.mojo:tidy-maven-plugin](https://github.com/mojohaus/tidy-maven-plugin) | `1.4.0` | `1.4.1` |\n\n\n\nUpdates `org.apache.ant:ant-launcher` from 1.10.17 to 1.10.18\n\nUpdates `org.apache.ant:ant` from 1.10.17 to 1.10.18\n\nUpdates `org.apache.ant:ant` from 1.10.17 to 1.10.18\n\nUpdates `org.slf4j:slf4j-jdk14` from 2.0.18 to 2.0.19\n\nUpdates `org.eclipse.jetty:jetty-server` from 12.1.12 to 12.1.13\n\nUpdates `org.eclipse.jetty.ee9:jetty-ee9-nested` from 12.1.12 to 12.1.13\n\nUpdates `org.eclipse.jetty.ee9:jetty-ee9-nested` from 12.1.12 to 12.1.13\n\nUpdates `org.apache.maven.plugins:maven-install-plugin` from 3.1.4 to 3.2.0\n- [Release notes](https://github.com/apache/maven-install-plugin/releases)\n- [Commits](https://github.com/apache/maven-install-plugin/compare/maven-install-plugin-3.1.4...maven-install-plugin-3.2.0)\n\nUpdates `org.codehaus.mojo:tidy-maven-plugin` from 1.4.0 to 1.4.1\n- [Release notes](https://github.com/mojohaus/tidy-maven-plugin/releases)\n- [Commits](https://github.com/mojohaus/tidy-maven-plugin/compare/1.4.0...1.4.1)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.ant:ant-launcher\n dependency-version: 1.10.18\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: development-dependencies\n- dependency-name: org.apache.ant:ant\n dependency-version: 1.10.18\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: development-dependencies\n- dependency-name: org.apache.ant:ant\n dependency-version: 1.10.18\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: development-dependencies\n- dependency-name: org.slf4j:slf4j-jdk14\n dependency-version: 2.0.19\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: development-dependencies\n- dependency-name: org.eclipse.jetty:jetty-server\n dependency-version: 12.1.13\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: development-dependencies\n- dependency-name: org.eclipse.jetty.ee9:jetty-ee9-nested\n dependency-version: 12.1.13\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: development-dependencies\n- dependency-name: org.eclipse.jetty.ee9:jetty-ee9-nested\n dependency-version: 12.1.13\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: development-dependencies\n- dependency-name: org.apache.maven.plugins:maven-install-plugin\n dependency-version: 3.2.0\n dependency-type: direct:development\n update-type: version-update:semver-minor\n dependency-group: development-dependencies\n- dependency-name: org.codehaus.mojo:tidy-maven-plugin\n dependency-version: 1.4.1\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: development-dependencies\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "03c3576dc441495b9a9e0a2ff14ee64d2ff5b64d", "tree": "2d951aa11257f5ac8a7f4ac5d93db9ef4a69494c", "parents": [ "d3bc95176b757920cde82b562b4a5857ee549419" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Sep 17 13:42:42 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 17 13:42:42 2026 +0000" }, "message": "build(deps): bump actions/setup-java in the production-actions group\n\nBumps the production-actions group with 1 update: [actions/setup-java](https://github.com/actions/setup-java).\n\n\nUpdates `actions/setup-java` from 6.0.0 to 6.0.1\n- [Release notes](https://github.com/actions/setup-java/releases)\n- [Commits](https://github.com/actions/setup-java/compare/dd06d9cba3e5552c54d9f8ea23572deb30010f7c...de7274f081f381c8f8158605e0321c36c376e2e6)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-java\n dependency-version: 6.0.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-actions\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "d3bc95176b757920cde82b562b4a5857ee549419", "tree": "c17c9b3e65566161e73549a389b8e5290ab83d68", "parents": [ "15a4caf3779ca03b2b1278a1e3df090c6b279f90" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Sep 07 16:44:03 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Sep 09 05:44:47 2026 -1000" }, "message": "Target the mail transport removal at 2.0.3\n\nThe next release is 2.0.3, not 2.1.0, so the deprecation notice, the WAR\nexclusion comment and the upgrade guidance all name it. Removal stays a\nrelease-note commitment with no Jira behind it. Also records that AXIS2-6107 is\nclosed as Won\u0027t Do rather than merely not done, since the point of that note is\nto answer a scan finding without re-arguing it.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "15a4caf3779ca03b2b1278a1e3df090c6b279f90", "tree": "4961cca0f1251229b0c7166d171b4e9b17a0f60b", "parents": [ "4e853962abb9ddb4f22d1c4d47d591aeafa09784" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Sep 07 16:34:06 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Sep 09 05:44:47 2026 -1000" }, "message": "Drop the (Unreleased) placeholder from the 2.0.2 release notes\n\nNo date line, matching 2.0.1 and 2.0.0, which carry none. DOAP is left alone:\nrelease-process.md lists that as post-release action 1, not a pre-vote step.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "4e853962abb9ddb4f22d1c4d47d591aeafa09784", "tree": "10666eb4875016d3924967c60f17416b00d6e5a9", "parents": [ "95bb8d120df37e5d89e64b87f50192b65dd29ad8" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Sep 07 16:08:45 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Sep 09 05:44:47 2026 -1000" }, "message": "Say on the home page that 2.0.2 is a security release\n\nAlso records why the context externalization machinery stays. AXIS2-6107 scoped\nits removal and it should not be done: SessionContext is an HttpSession\nattribute that containers serialize when persisting sessions, EndpointReference\nround trips only because its custom externalization handles Axiom values that\nare not serializable, and persisting a paused MessageContext is a capability\nrather than dead code. SECURITY.md item 4 now carries those three reasons so a\nscan finding here has a citable answer instead of being re-argued. The Rampart\nparagraph also still promised to ship after 2.0.1.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "95bb8d120df37e5d89e64b87f50192b65dd29ad8", "tree": "792c66ad8cc5b3bc457393027925250b5dc2ac70", "parents": [ "dad1f88698cd97b051ac5567497295b8540b9f4b", "64461a12d4345f3ebb61a08e7e4313b1c9c93304" ], "author": { "name": "Christian Ortlepp", "email": "christian.ortlepp@hypergene.com", "time": "Tue Sep 08 12:48:56 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 12:48:56 2026 +0200" }, "message": "Merge pull request #1292 from apache/dependabot/maven/production-dependencies-aeee2bdfcf\n\nbuild(deps): bump the production-dependencies group with 4 updates" }, { "commit": "dad1f88698cd97b051ac5567497295b8540b9f4b", "tree": "191dc1ac6479c7ef1235fec1f97d56d8be4f8c62", "parents": [ "f30a53da91955c2692934967bc0916da2f66983e", "edb4586261219898ced68894273d1a6e0f53da7c" ], "author": { "name": "Christian Ortlepp", "email": "christian.ortlepp@hypergene.com", "time": "Tue Sep 08 12:48:42 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 08 12:48:42 2026 +0200" }, "message": "Merge pull request #1293 from apache/dependabot/maven/development-dependencies-89ccaa1f51\n\nbuild(deps-dev): bump the development-dependencies group with 2 updates" }, { "commit": "f30a53da91955c2692934967bc0916da2f66983e", "tree": "0ef60c4dbcd05a427100fa26560f5cff40bf068b", "parents": [ "79458ae667e582deacb4c8b3adc9054db259a25b" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Sep 07 10:54:12 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Sep 07 10:54:12 2026 -1000" }, "message": "Skip the sample-pom sync unless a release version is being built\n\nDropping completionGoals left the samples pinned to the last released version\nbetween releases, which made a dry run destructive: it sees the untransformed\nSNAPSHOT, rewrites the samples off that pin and stages them, and nothing reverts\na dry run. The target now runs only when project.version is not a SNAPSHOT.\nRehearsed all three paths on a throwaway clone: a dry run in the post-release\nstate leaves the samples untouched and nothing staged, and a real prepare still\ntags 2.0.2 in all three.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "79458ae667e582deacb4c8b3adc9054db259a25b", "tree": "2f7a0f795b55194002259a35372400ef816a6d46", "parents": [ "f2f3ebf70fcd9626493e2af8687b9cdea90915ab" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Sep 07 09:40:23 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Sep 07 09:40:23 2026 -1000" }, "message": "Make the sample-pom sync actually reach the release commit\n\nRehearsing release:prepare on a throwaway clone showed the sync was writing the\nright values and losing them: maven-release-plugin transforms only reactor poms,\nso the rewrite stayed an unstaged working-tree change and the tag shipped\n2.0.2-SNAPSHOT. The target now stages the poms itself, and the commit phase takes\nwhat is staged. completionGoals is gone as well -- it ran after the bump to the\nnext SNAPSHOT and needed artifacts that do not exist yet, aborting the release\nafter tagging. Samples therefore keep the released version between releases,\nwhich beats pointing at a SNAPSHOT. Verified end to end: exit 0, tag carries\n2.0.2 in all three, development commit lands.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "f2f3ebf70fcd9626493e2af8687b9cdea90915ab", "tree": "243ec825e77003e3ef293118aa31696f60830920", "parents": [ "d1129482fdeb6a7bd6b831d69e9d9a677daf86fa" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Sep 07 05:49:52 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Sep 07 05:49:52 2026 -1000" }, "message": "Stop the version sync running in every child module\n\npreparationGoals runs across the whole reactor, so the inherited execution\nresolved ${basedir} to each child and release:prepare died on\nmodules/resource-bundle/modules/samples/userguide/src/userguide not existing.\nMarked not inherited: children get the goal with no target and do nothing, and\nthe rewrite happens once at the root. The release guide also now records that a\ndry run cannot exercise this -- it never replaces pom.xml, so the goal sees the\nSNAPSHOT version and writes it straight back.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "d1129482fdeb6a7bd6b831d69e9d9a677daf86fa", "tree": "a316d2b5545e345b0c09f9ac6fc8c7b0e216731a", "parents": [ "ee2c45639f7f40a5f54683ee28aab9c430249f1f" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Sep 07 04:04:01 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Sep 07 04:04:01 2026 -1000" }, "message": "Correct the mail deprecation note after unbundling\n\nThe note still said the module ships in the WAR to every deployment regardless,\nwhich stopped being true when it was dropped from axis2.war in this release.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "ee2c45639f7f40a5f54683ee28aab9c430249f1f", "tree": "3595944aa8a39817b28d8b6056f4b9398aa2ff8a", "parents": [ "08f5f605f21afcf5423e504cad69fdd0b4e94237" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Sep 07 03:53:48 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Sep 07 03:53:48 2026 -1000" }, "message": "Add an upgrade checklist to the 2.0.2 release notes\n\nThe notes described each changed default where it was made, which is the right\nplace for the reasoning but not for someone upgrading a working 2.0.1 install.\nCollects every behaviour change up front with its one-line opt-out: the three\nrefusing defaults (AXIS2-6108 for the WS-Addressing one), the new request-size\nceilings, the Spring/JMS/mail packaging changes, the withdrawn jibx codegen\noption, and the wider exposeServiceMetadata enforcement.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "08f5f605f21afcf5423e504cad69fdd0b4e94237", "tree": "e8e0f10eb799228a244a133a971b5e59afbf8818", "parents": [ "1c19806ff30e9242910394c76ddd38fa409463ce" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Sep 06 14:03:20 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Sep 06 14:03:20 2026 -1000" }, "message": "Fix a brace-counting drift and remove the last JiBX code\n\nThe re-indenter dropped the brace delta on lines it emitted unchanged, so a line\nclosing a block comment or text block with code after the delimiter -- \"*/ }\" --\nlost those braces and shifted every later line for the rest of the file. All\nbranches now fold the delta in. The userguide version sync also passed when its\nfileset matched nothing, both counts being zero; it now fails on that too.\nSeparately, jibx has not been a selectable databinding since 2.0.1, so the\nunreachable branch in loadWsdl (which would have thrown NPE on a null type), the\ndead XSL template and two misleading comments are gone.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "1c19806ff30e9242910394c76ddd38fa409463ce", "tree": "a323af45a7fd2097503213f19f41f9b044fdb156", "parents": [ "08884a006375e1309829302123dad2dfcacb4c25" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Sep 06 12:55:14 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Sep 06 12:55:14 2026 -1000" }, "message": "Stop documenting modules removed in 2.0.1\n\nJiBX and the SOAP Monitor went in AXIS2-6105, but the site still carried a full\nJiBX client how-to, two JiBX sections in the quickstart guide, and links to\npages that no longer exist. wsdl2java also still offered jibx as a -d value in\nits own help while codegen.databinding.frameworks lists only adb, xmlbeans,\njaxbri and none, so the option could not work. Migration-guide references stay:\nthey describe Axis 1.x, not this release. Note that printUsage loops over\nwsdl2code.arg2..arg53 by number, so arg30 is kept empty rather than deleted --\na gap throws MissingResourceException and breaks -help.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "08884a006375e1309829302123dad2dfcacb4c25", "tree": "c145fd53815a865a43f4be668691613c4d56fb26", "parents": [ "037eea0bce812fdb44eda5fee6078660042f5e73" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Sep 06 09:17:38 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Sep 06 09:17:38 2026 -1000" }, "message": "Replace google-java-format with a local re-indenter\n\nCodegen pulled guava and a shaded javac -- about 6 MB in every axis2.war -- to\ntidy generated Java that a template had already laid out. PrettyPrinter now\nrewrites leading whitespace and nothing else: no reflow, no import reordering,\nno character the compiler can see, so the worst a bug here does is indent badly.\nBraces in literals and comments are skipped and text blocks are copied verbatim,\nsince their leading whitespace is string content. A failure now leaves the file\nas generated; the old code deleted the source before renaming over it. Guava\nstays pinned in dependencyManagement -- it still arrives test-scoped via truth.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "037eea0bce812fdb44eda5fee6078660042f5e73", "tree": "ec99e9641c020f10e7caf3e4d6d4c617d747e96c", "parents": [ "4be16e2285961e3b6f4a9ca30d507fc864a1cf9e" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Sep 06 08:45:55 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Sep 06 08:45:55 2026 -1000" }, "message": "Stop bundling the mail transport in axis2.war\n\nSame case as JMS: no default axis2.xml enables a mailto listener or sender, and\nthe module is deprecated for removal in 2.1.0. It stays in the binary\ndistribution\u0027s lib/. angus-mail and jakarta.mail-api deliberately stay in the\nWAR and are not transport baggage -- the API jar carries the MimeBodyPart and\nByteArrayDataSource classes JAX-WS attachments use, and angus supplies the\nStreamProvider service they resolve at runtime. Dropping either breaks MTOM.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "4be16e2285961e3b6f4a9ca30d507fc864a1cf9e", "tree": "12102803ef6b0c66c6a2bb96bdd96bbff40822d3", "parents": [ "6a648745852b39b17b0e410e3682ec422df20c9b" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Sep 06 07:53:33 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Sep 06 07:53:33 2026 -1000" }, "message": "Fail the version sync when it matches nothing\n\nreplaceregexp reports nothing when it matches nothing, so a renamed or dropped\naxis2.version property would leave a userguide sample pinned to a stale version\nand the release would carry on quietly -- the failure mode the sync exists to\nprevent. Count the poms, count the ones carrying the version being released, and\nfail on a mismatch naming the counts.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "6a648745852b39b17b0e410e3682ec422df20c9b", "tree": "8b1e0742900acbd9b867a8b08c69421bc2adf11e", "parents": [ "383bde9483402265affe34f5a3d5def0aa4acc93" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Sep 06 07:42:14 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Sep 06 07:42:14 2026 -1000" }, "message": "Keep sample poms on the released version automatically\n\nswagger-server sat at parent 2.0.1-SNAPSHOT for the whole 2.0.1 cycle and\nshipped that way, because release:prepare only rewrites reactor modules. It is a\nreactor module now, which also subjected it to tidy:pom for the first time. The\nthree Spring Boot userguide samples cannot join the reactor -- they inherit\nspring-boot-starter-parent -- so an antrun execution rewrites their single\naxis2.version property, invoked by id from the release plugin\u0027s preparation and\ncompletion goals. It is bound to no phase, so ordinary builds leave the checked-in\npoms alone.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "383bde9483402265affe34f5a3d5def0aa4acc93", "tree": "953453b29da267e5ea9e36108784f39cf1f0fea0", "parents": [ "662e687c2e592451121abfc1c27b5b7381214b49" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Sep 06 06:31:29 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Sep 06 06:31:29 2026 -1000" }, "message": "Restore javadoc aggregation after the axis2-spring scope change, refresh DOAP\n\napidocs aggregates axis2-spring\u0027s own sources (includeDependencySources over\norg.apache.axis2:*), so javadoc compiles its org.springframework imports. Those\nbecame provided and therefore non-transitive, which broke the Site job while the\nJava 17/21/25 jobs stayed green -- only the aggregation needs them. Declared\nprovided here too. DOAP also gains 1.8.1, 1.8.2, 2.0.0 and 2.0.1, and points at\ngit rather than the retired SVN trunk.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "662e687c2e592451121abfc1c27b5b7381214b49", "tree": "96e124b271ea09b18da2598f4e44cad10d1eff11", "parents": [ "4c949a758f13a23351f970de9ff1229c2fd86cfb" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Sep 06 06:16:07 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Sep 06 06:16:07 2026 -1000" }, "message": "Keep built sample output out of the source distribution\n\nThe target/ exclusion regex deliberately spares any path containing an \"src\"\ncomponent, which is why two modules/tool paths are already listed explicitly.\nThe springbootdemo samples live under samples/userguide/src/userguide/, so they\nhit the same hole: once anyone builds them, three WARs and their unpacked\ndependency jars land in the source zip -- 469 MB, and binaries do not belong in\na source release at all. Also adds 2.0.2 to the release-notes sidebar, which the\nrelease checklist requires.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "4c949a758f13a23351f970de9ff1229c2fd86cfb", "tree": "bf4594819961295044a1ee6298fe220bb1c237c9", "parents": [ "ca4f27877f86bec374c39951803db3aadd6b9f62" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 13:07:02 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 13:07:02 2026 -1000" }, "message": "Remove the exploded WAR left in springbootdemo-tomcat11\n\nThe earlier artifact removal in a8f79972fa took the classes and archives\nbut left the XML and properties behind. Four of them duplicated\nsrc/main/resources and resources-axis2 exactly; beans.xml and the jboss\ndescriptors belong to springbootdemo-wildfly, which holds the maintained\ncopies, and both the README and the Tomcat 11 user guide already describe\nthem as absent here. WEB-INF/ and META-INF/ at the module root are now\nignored wholesale.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "ca4f27877f86bec374c39951803db3aadd6b9f62", "tree": "46b73dfbe4a63d9bca955ab9c3460a590daf7774", "parents": [ "5f65c3542f277fef90962316d5e13fb4b0ae5bbe" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 13:06:52 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 13:06:52 2026 -1000" }, "message": "Fix the springbootdemo build and align the three sample poms\n\nspringbootdemo\u0027s antrun step unzipped the packaged WAR at prepare-package,\nbefore package had produced it; war:exploded is now the only producer of\nthe deployable directory. All three samples move to Spring Boot 3.5.16 and\nAxis2 2.0.2-SNAPSHOT and take BOM-managed versions from properties. The\nwildfly pom was the repo\u0027s only CRLF pom and is now LF, so review it with\n--ignore-cr-at-eol.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "5f65c3542f277fef90962316d5e13fb4b0ae5bbe", "tree": "35f2e5770dbcee930ab0270cabdde90208bb1634", "parents": [ "5799b2c3f88d1bc06d1e91b3dc9f8b5d5981ced2" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 06:25:47 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 08:19:37 2026 -1000" }, "message": "Stop axis2-spring exporting Spring to its consumers\n\nThe module is an integration layer: the application already has Spring and picks\nits version. At compile scope the four Spring dependencies were transitive, so a\nconsumer on an older Spring who did not import the Spring Boot BOM silently got\nthis build\u0027s Spring beside their own. Marked provided. modules/integration\ndeclares spring-context and spring-web at test scope, since SpringServiceTest\ndrives axis2-spring and no longer inherits them.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "5799b2c3f88d1bc06d1e91b3dc9f8b5d5981ced2", "tree": "b111ac0937ec0dc4a86a63cd308eef99b2037bbd", "parents": [ "e028b2072d688db59b81087ca5138b02465d36bf" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 05:29:32 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 05:29:32 2026 -1000" }, "message": "Complete the Spring exclusion list the WAR already had\n\nspring-beans, spring-context, spring-core and spring-web are excluded on\npurpose: a deployment using the Spring integration brings its own Spring. When\nSpring 7 moved spring-aop, spring-expression, micrometer-observation,\nmicrometer-commons and jspecify behind spring-context and spring-core, the three\nlists that encode this were not updated, so ~870 KB shipped that cannot work\nwithout the four jars left out. The lists must agree or check-webapp-content\nfails, so both the WAR packaging and the binary assembly are updated.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "e028b2072d688db59b81087ca5138b02465d36bf", "tree": "7351d6c7d4e047060836445279de2bf020f0d5b2", "parents": [ "e170a13bdedd92880db2b2d6fdac5f67665840ff" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 04:44:44 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 04:44:44 2026 -1000" }, "message": "Release the redirect probe\u0027s connection in codegen\n\nThe probe reads the status line and one header, so the body is never consumed\nand the socket cannot return to the keep-alive pool by itself. wsdl2java also\nruns from the ant task and the wsdl2code maven plugin, generating for many\nWSDLs in one build JVM, so disconnect() in a finally block rather than waiting\non finalization.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "e170a13bdedd92880db2b2d6fdac5f67665840ff", "tree": "6823d47f3de8a1a14424f5e5b7307234b09565e2", "parents": [ "5e93c08cf1ba1fab92f3f91f71ef400761d0dfca" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 04:32:25 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 04:32:25 2026 -1000" }, "message": "Stop bundling the JMS transport in axis2.war\n\nNo default axis2.xml enables a JMS listener or sender, yet every WAR carried the\ntransport and its JNDI lookup code. It was not usable as shipped in any case:\njakarta.jms-api is an API with no provider, so a WAR wanting JMS always had to\nadd a broker client. The module is unchanged and still ships in the binary\ndistribution\u0027s lib/, so a standalone server is unaffected; the distribution\nbuilds its WAR from that directory, which is why the exclude belongs there too.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "5e93c08cf1ba1fab92f3f91f71ef400761d0dfca", "tree": "00740cafbf595f473d5ac3f5530fdcfe2edd23c8", "parents": [ "b5a2474b8c97ff4b50f0062693f6eb6597728a7c" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 03:58:18 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 03:58:18 2026 -1000" }, "message": "Drop the unused testkit dependency from transport-h2\n\nNo source in the module references axis2-transport-testkit; the declaration\nwas carried over from the transports that do use it. All 84 tests still run.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "b5a2474b8c97ff4b50f0062693f6eb6597728a7c", "tree": "a3843986ed7fbcb276367eeca2ad19c3227af245", "parents": [ "0795c50df145f2b65f7b50c750e383c84db2b404" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 03:51:39 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 03:51:39 2026 -1000" }, "message": "Deprecate the mail transport for removal in 2.1.0\n\nSOAP over SMTP was specified and profiled, but a request/response that blocks a\ncaller thread on a mailbox poll saw very little use even at SOAP\u0027s peak. No\nfunctional change has landed in the module in over a decade; every commit\ntouching it since 2015 is a project-wide sweep or a test-dependency bump. It is\nenabled by no default axis2.xml, yet axis2-webapp depends on it, so it ships to\neveryone regardless. Release note only -- nothing is removed in 2.0.2.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "0795c50df145f2b65f7b50c750e383c84db2b404", "tree": "4740802bf87dfe27b288c59c9bbc34e9dbbd9375", "parents": [ "3cc039d01296910585086f0471fd9250c3148d71" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 03:47:36 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 03:47:36 2026 -1000" }, "message": "Stop a remote server retargeting WSDL2Java\u0027s own WSDL fetch\n\nThe tool probes an http location for a redirect before parsing, and took the\nLocation header from any response: a stray header on a 200 redirected it, a\nrelative target was used unresolved, and Location: file:///etc/passwd aimed the\nparse at the developer\u0027s filesystem. The redirect is the hostile document\u0027s\nserver talking, not the developer. It is now followed only from a 3xx, only to\nhttp or https, resolved against the document requested; anything else stops\ncodegen rather than quietly parsing something else. Timeouts added.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "3cc039d01296910585086f0471fd9250c3148d71", "tree": "f2264e77ae9db24a9f2ce4dcaef97a92aee60819", "parents": [ "3ff914a61448b50c620e8e41a2c48980f23158b4" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 03:22:45 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Sep 05 03:22:45 2026 -1000" }, "message": "Confine packaged-metadata lookup and fix a fail-open schema guard\n\nThe ?xsd\u003d and ?wsdl2\u003d queries resolved a requested name with\ngetResourceAsStream, which delegates parent-first, so they served META-INF\nschemas from any jar on the classpath while the file routes -- fixed for this\nonce as AXIS2-5846 -- did not. Both rules now live in one kernel helper,\nMetaInfResources, so the two routes cannot drift apart again. Separately, the\ndefault schema resolver classified schemaLocation with java.net.URI and ignored\nURISyntaxException, so a location URI rejects but URL accepts was resolved as\nrelative and fetched; classification is textual now.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "3ff914a61448b50c620e8e41a2c48980f23158b4", "tree": "8aa45d04cc04cd140d2821cfb9e7bd52c352e905", "parents": [ "00274eedfaf5e20b0160f4267271182646884170" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Sep 04 16:12:01 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Sep 04 16:14:53 2026 -1000" }, "message": "Make two threat-model claims true, and scope what they do not cover\n\nSECURITY.md said every parser factory the framework creates disables DTDs and\nexternal entities, and that the deployment resolvers block file:. Neither held.\nThe SAAJ and JAX-WS conversions now use the hardened factory, and file: is\nrefused by the resolvers -- reachable in one of the four, where an absolute\nfile: import passed the guard. The document now names what stays uncovered:\nbuild-time codegen factories, the deliberate hbm.xml DTD exception, and the\nTransformerFactory instances.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "00274eedfaf5e20b0160f4267271182646884170", "tree": "76f277d2d99b4e091ff6f67650986923b534f700", "parents": [ "6bdd6a07eaba04496730b95bb6c34bcb9434e496" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Sep 04 15:39:41 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Sep 04 15:39:41 2026 -1000" }, "message": "Pin the Swagger UI scripts, and stop naming exception classes in faults\n\nTwo low-severity leaks on the JSON surface. The Swagger UI page loads its\nscripts from a CDN at a pinned version, which says which release to request but\nnot that what arrived is that release, on a page built to drive authenticated\nAPI calls; the tags now carry SHA-384 integrity hashes, taken from two\nindependent CDNs and confirmed identical. They are version-specific, so a\ndeployment pinning another version supplies its own and is warned when it has\nnot. Separately, an unhandled Throwable produced a fault reason of\nfully.qualified.Class: message regardless of sendStacktraceDetailsWithFaults,\non JSON and REST responses as much as SOAP faults, since that catch-all serves\nevery request the servlet handles; it is generic now, and still logged in full.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "6bdd6a07eaba04496730b95bb6c34bcb9434e496", "tree": "28e42d7bbbd743126ba0e193044f1827ba1321d0", "parents": [ "25db09b07bc206049717e52126009af2a7dfe597" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Sep 04 13:09:41 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Sep 04 13:09:41 2026 -1000" }, "message": "Screen every WSDL-loading path, not just the client-side one\n\nwsdl4j parses with its own unhardened parser and fetches the import chain\nitself, so a DOCTYPE anywhere in a WSDL was an XXE in whichever JVM read it.\nSecureWSDLLocator screened only createClientSideAxisService, and it fetches\nover http/https alone, so it cannot serve the paths that load from a file, an\narchive, the classpath or a catalog. HardenedWSDLLocator separates screening\nfrom resolution: a delegate locator keeps its own catalog or archive behaviour\nand only its bytes are screened, and a bare relative path still loads, which is\nwhat wsdl4j accepts and what codegen passes. Wired into the JAX-WS loader, the\nruntime reload wrapper, the deployment builder\u0027s resolver path and WSDL2Java.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "25db09b07bc206049717e52126009af2a7dfe597", "tree": "0a34b31bbc669a823435260f77e45a3fef6db013", "parents": [ "94c935d1406bc0875daebd36994595efa2f48ae0" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Sep 04 11:51:51 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Sep 04 11:51:51 2026 -1000" }, "message": "update same dep on httpcomponents\n" }, { "commit": "94c935d1406bc0875daebd36994595efa2f48ae0", "tree": "c84e51d324869143ab817dc8bdbb09ea805dd5a8", "parents": [ "583e78e68341f50735d27a23c58b197a04737535" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Sep 04 11:23:55 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Sep 04 11:23:55 2026 -1000" }, "message": "Bound the MTOM, SwA and SOAP bodies too\n\nThe ceilings added for the form builders left the other stream-reading builders\nunbounded, which bounds nothing: the caller picks the builder by choosing the\nContent-Type, so sending multipart/related avoided them entirely. Bound the\nwhole multipart body in MIMEBuilder, before the parts are buffered to heap or\ndisk, and a plain SOAP or POX body in SOAPBuilder. Its MIME path takes its root\npart from the now-bounded multipart body and needs no ceiling of its own. Item\n10 of the threat model scoped itself to the form builders, which is what let\nthis stand; it now says every stream-reading builder.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "583e78e68341f50735d27a23c58b197a04737535", "tree": "c99a2adcdbdf325246da1825f3b6e36cc33f1347", "parents": [ "84811c7c87192cd4aa96b3443f195cba2384617f" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Sep 04 11:04:39 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Sep 04 11:04:39 2026 -1000" }, "message": "Bound multiref resolution against cycles and expansion\n\nResolution had no cycle check and no budget, on the anonymous RPC/POJO path: a\nreference leading back on itself recursed until the stack ended, and a graph\nwith no cycle could still double per level and end in OutOfMemoryError. Element\ncycles are refused, nesting and total work are bounded, and copying a referenced\nelement is charged before the copy, since at depth it is the copy that exhausts\nthe heap and only direct children are moved, so counting those stays flat while\nthe subtrees double. The bean path is bounded by depth rather than refused: a\nself-referencing object graph is legitimate SOAP encoding, which MultirefTest\nsends, and rejecting re-entry there broke it.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "84811c7c87192cd4aa96b3443f195cba2384617f", "tree": "5c849eea27713119d709e4fa3e2593b32db60f2d", "parents": [ "8be5bb57231e7c36745d3ae897a7376b22949af1" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Sep 04 10:26:57 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Sep 04 10:26:57 2026 -1000" }, "message": "Say what context deserialization actually enforces, and enforce that\n\nSECURITY.md promised three times that SafeObjectInputStream restricts\ndeserialization to known Axis2 context classes. It never did, and it cannot:\nthe feature carries application objects on purpose -- self-managed data, and\nParameter values of any serializable type -- so a list of Axis2\u0027s own classes\nwould refuse what it exists to carry. The streams Axis2 creates now refuse\ndynamic proxies, which it never writes and which front the classic gadget\nchains, and accept a JEP 290 pattern for an integrator who does know their\ntypes. The object-form path reads from the caller\u0027s own stream, which cannot\ntake a filter by then; the docs now say so rather than implying otherwise.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "8be5bb57231e7c36745d3ae897a7376b22949af1", "tree": "66fa45f2da18757c3972a934295a8827b6829b38", "parents": [ "c06f6ef5517f81f503fef085ae27b0df27a651c9" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Sep 04 08:59:11 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Sep 04 08:59:11 2026 -1000" }, "message": "Filter the service listing in the model, not only in the view\n\nThe servlet listing did exclude hiddenService services, but in listServices.jsp\nrather than before the model reached the request, so anything else rendering\nthat model would name them. Apply both controls where the model is built, as\nHTTPTransportReceiver does for the standalone transport, and drop a null\nservice instead of carrying one: isHiddenService would throw on it, and the\nprevious putAll had the same hazard.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "c06f6ef5517f81f503fef085ae27b0df27a651c9", "tree": "b7a9843b350ec6fb2fc42066ce3ae23207750f2c", "parents": [ "fd6366326d5d2fd662353bb16bf6cb4c658505d1" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Sep 03 05:48:37 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Sep 03 05:48:37 2026 -1000" }, "message": "Keep generated output inside the output directory\n\nCodegen names its files after the document it was handed: a wsdl:service name\nreaches the shared sink verbatim, and a QName localPart need not be an NCName,\nso separators and \"..\" survive. A WSDL naming its service\n../../../src/main/resources/api had the tool write its re-serialized WSDL over\nthe project\u0027s real contract file, which later builds then consume. The sink now\nrefuses a name resolving outside the root, which covers every codegen writer\nrather than the one that was reported.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "fd6366326d5d2fd662353bb16bf6cb4c658505d1", "tree": "b80a6fdd939b5c5947435ac4116fc13cd9886d5a", "parents": [ "42fdc81734aa1059eeef8c35c72ac9958feef773" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Sep 03 05:24:55 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Sep 03 05:24:55 2026 -1000" }, "message": "Escape schema values before they reach generated source\n\nDefaults, fixed values, enumeration facets and the numeric range facets were\ncopied out of the schema into generated Java and C inside string literals with\nno escaping, so a value carrying a quote closed its literal and the rest became\ncode in a class-level initializer -- running when the bean class loads, on the\nbuild machine and in the shipped application. Escape them where they enter the\ntemplate model, as the neighbouring pattern facet already was. The quote-comma-\nquote the compiler splices into a QName enumeration on purpose is preserved by\nescaping the halves either side of it.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "42fdc81734aa1059eeef8c35c72ac9958feef773", "tree": "f9fa93be46fc2358a246506c502d3094c1168741", "parents": [ "515c4bc76e0f74ab484100d56e0d07290c3983c9" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Sep 03 05:14:11 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Sep 03 05:14:11 2026 -1000" }, "message": "Do not trust the schema the schema compiler is compiling\n\nXSD2Java and its maven plugin exist to consume contracts written elsewhere, yet\nparsed them with a bare DocumentBuilderFactory and let xs:include/xs:import\ndereference whatever scheme the location named: a schema handed to a developer\ncould read local files, exfiltrate them through an external entity, or make the\nbuild fetch internal URLs. DOCTYPE and external entities are refused now, and\nlocations resolve from the filesystem only unless -asl says otherwise. The check\nis on the location after resolution against the base, since a relative include\nunder a remote base is remote too.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "515c4bc76e0f74ab484100d56e0d07290c3983c9", "tree": "28202978e4bbc1903b0de2d33e627cafd5c545ed", "parents": [ "8a81216b1b723e98a3c801de939201ad68f59b23" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Sep 03 05:02:56 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Sep 03 05:02:56 2026 -1000" }, "message": "Answer a hidden service as though it were not deployed\n\nThe query routes sent 403 where an absent service gets 404, so probing ?wsdl\nacross candidate names told an anonymous caller which ones exist -- the thing\nhiding a service is meant to withhold. Gate at the dispatch instead, in both\nHTTP paths, so a hidden service takes the same fall-through and the same body\nas an unknown one; the per-handler refusals this makes unreachable are removed\nrather than left to suggest they still do something. RFC 9110 15.5.4 sanctions\n404 for a forbidden resource.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "8a81216b1b723e98a3c801de939201ad68f59b23", "tree": "ebbf6fbd0e749040fa71d96773b93279f5fcf6a4", "parents": [ "1c092af17f5fe7529f3d97d8cce6a7a58025b11b" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Sep 03 04:47:07 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Sep 03 04:47:07 2026 -1000" }, "message": "Honour exposeServiceMetadata on the listing, WS-MEX and ping\n\nThe check was a private method in each HTTP transport, so the modules that also\nanswer anonymous metadata requests could not reach it and did not apply it: the\n/services/ listing named hidden services with their EPRs and operations, WS-MEX\nGetMetadata returned their WSDL, schema and policy, and a bodyless ping returned\nevery operation with its live status. The gate is now AxisService, which all of\nthem can consult. Separately the ?xsd\u003d route reached any packaged META-INF\nresource, services.xml among them, so the shared stream helper now serves only\nschema and WSDL names that stay inside META-INF.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "1c092af17f5fe7529f3d97d8cce6a7a58025b11b", "tree": "edc0f488bca5723100020d6b3377de4159674316", "parents": [ "dc51d36ed2867d1c527f12f72dea814cd9a311b6" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Sep 03 04:08:41 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Sep 03 04:08:41 2026 -1000" }, "message": "AXIS2-6062: screen JMS addresses by JNDI scheme, not by substring\n\nThe guard searched the whole target address for LDAP, RMI, JMX, JRMP, DNS, IIOP\nand CORBANAME, so a queue named alarming was refused for containing \"RMI\" while\na hostile provider URL naming none of those words passed. The schemes matter in\nthe scheme position of the three fields JNDI actually resolves: the destination\nname, the reply destination and the provider URL. Screen those instead; every\naddress the old guard refused for a real reason is still refused.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "edb4586261219898ced68894273d1a6e0f53da7c", "tree": "a8f47454a42c91280a4cef8a1d758fba70e57f17", "parents": [ "dfacb5c702ead7a460d344aceeaa0ed0f1c2f4ef" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Sep 03 13:55:38 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 03 13:55:38 2026 +0000" }, "message": "build(deps-dev): bump the development-dependencies group with 2 updates\n\nBumps the development-dependencies group with 2 updates: org.apache.felix:maven-bundle-plugin and [org.apache.activemq:activemq-broker](https://github.com/apache/activemq).\n\n\nUpdates `org.apache.felix:maven-bundle-plugin` from 6.1.0 to 6.1.2\n\nUpdates `org.apache.activemq:activemq-broker` from 6.3.1 to 6.3.2\n- [Release notes](https://github.com/apache/activemq/releases)\n- [Commits](https://github.com/apache/activemq/compare/activemq-6.3.1...activemq-6.3.2)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.felix:maven-bundle-plugin\n dependency-version: 6.1.2\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: development-dependencies\n- dependency-name: org.apache.activemq:activemq-broker\n dependency-version: 6.3.2\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: development-dependencies\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "64461a12d4345f3ebb61a08e7e4313b1c9c93304", "tree": "5dce80dfcea49a01c17d3ee02b22ff8836975eb2", "parents": [ "dfacb5c702ead7a460d344aceeaa0ed0f1c2f4ef" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Sep 03 13:54:58 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Sep 03 13:54:58 2026 +0000" }, "message": "build(deps): bump the production-dependencies group with 4 updates\n\nBumps the production-dependencies group with 4 updates: [io.swagger.core.v3:swagger-core](https://github.com/swagger-api/swagger-core), io.swagger.core.v3:swagger-models, io.swagger.core.v3:swagger-annotations and [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin).\n\n\nUpdates `io.swagger.core.v3:swagger-core` from 2.2.54 to 2.2.55\n- [Release notes](https://github.com/swagger-api/swagger-core/releases)\n- [Changelog](https://github.com/swagger-api/swagger-core/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/swagger-api/swagger-core/compare/v2.2.54...v2.2.55)\n\nUpdates `io.swagger.core.v3:swagger-models` from 2.2.54 to 2.2.55\n\nUpdates `io.swagger.core.v3:swagger-annotations` from 2.2.54 to 2.2.55\n\nUpdates `io.swagger.core.v3:swagger-models` from 2.2.54 to 2.2.55\n\nUpdates `io.swagger.core.v3:swagger-annotations` from 2.2.54 to 2.2.55\n\nUpdates `org.apache.maven.plugins:maven-compiler-plugin` from 3.15.0 to 3.16.0\n- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)\n- [Commits](https://github.com/apache/maven-compiler-plugin/compare/maven-compiler-plugin-3.15.0...maven-compiler-plugin-3.16.0)\n\n---\nupdated-dependencies:\n- dependency-name: io.swagger.core.v3:swagger-core\n dependency-version: 2.2.55\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: io.swagger.core.v3:swagger-models\n dependency-version: 2.2.55\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: io.swagger.core.v3:swagger-annotations\n dependency-version: 2.2.55\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: io.swagger.core.v3:swagger-models\n dependency-version: 2.2.55\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: io.swagger.core.v3:swagger-annotations\n dependency-version: 2.2.55\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.maven.plugins:maven-compiler-plugin\n dependency-version: 3.16.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "dc51d36ed2867d1c527f12f72dea814cd9a311b6", "tree": "0ea6d5a6f39ce6cca54fd6e5e3b7305a711f1bee", "parents": [ "fe5e5eebeebc71404182fbb570b53c4d33e4feb4" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Sep 03 02:23:15 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Sep 03 02:23:15 2026 -1000" }, "message": "Refuse a caller-supplied JNDI environment on a JMS reply\n\nJMSOutTransportInfo hands a jms: endpoint reference\u0027s whole query string to new\nInitialContext(...), so on a decoupled response -- where that address came from\nthe caller -- a java.naming.* parameter chose which broker the server connected\nto and what it did once connected. Refuse those parameters for that case only;\na client-side send still addresses whatever provider the application asked for.\nThe existing substring blocklist is left alone deliberately: it screens the\nwrong thing, and widening it is not the fix.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "fe5e5eebeebc71404182fbb570b53c4d33e4feb4", "tree": "fdad64535cafd77453d1921eba3dfe48438a44b6", "parents": [ "b5071b4fb55896b135f9d74df01a8308a04d55db" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Sep 02 18:41:24 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Sep 02 18:41:24 2026 -1000" }, "message": "Do not follow redirects on a decoupled response over HTTP/2\n\nThe HTTP sender stopped following them in 75191f7752, but the HTTP/2 sender\nnever had the check and its async client follows redirects by default too, so\na reply endpoint answering 307 could still send the server to an address the\nscheme and range checks had refused. The predicate both senders now share\nlives next to those checks, as AddressingResponseEndpointPolicy is what a\nredirect would otherwise walk past.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "b5071b4fb55896b135f9d74df01a8308a04d55db", "tree": "31fb77779184ebb345ad8f0630fb519dd2e7bde2", "parents": [ "056750c5c3198f10b3de1fd758f03d7233743b36" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Sep 02 18:26:59 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Sep 02 18:26:59 2026 -1000" }, "message": "Write up the 2.0.2 hardening for upgraders\n\nCollect the changed defaults in the release notes with what to set to restore\nthe previous behaviour, and record content-based dispatch in the threat model.\nThe existing service-dispatcher row claimed dispatchers only validate service\nexistence, which understated what late binding allowed.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "056750c5c3198f10b3de1fd758f03d7233743b36", "tree": "d53ab03b5d2ec3d4e51e4eae9c7cfe35df169733", "parents": [ "5e8ee0f31fcbfc4afa9d72ac246f773323319c3c" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Sep 02 18:26:59 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Sep 02 18:26:59 2026 -1000" }, "message": "Require opt-in to select a service from the message body\n\nThe Dispatch phase runs after Security, and DispatchPhase installs only the\nphases that follow it, so a service bound from the SOAP body namespace is bound\nafter Security has run against no service and Security is never revisited: a\nrequest naming no service in its URI could reach a service whose engaged\nsecurity modules never ran for it. allowContentBasedServiceDispatch gates both\nbody-namespace dispatchers and defaults to false; dispatch by request URI,\nSOAPAction and WS-Addressing binds before Security and is untouched.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "5e8ee0f31fcbfc4afa9d72ac246f773323319c3c", "tree": "e7115402c576d9a8ef9b601e994aa92fba4533ac", "parents": [ "dfacb5c702ead7a460d344aceeaa0ed0f1c2f4ef" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Sep 02 17:19:44 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Sep 02 17:19:44 2026 -1000" }, "message": "Stop publishing default admin console credentials\n\nAXIS2-6069 emptied the credentials in the configs the binary distribution\nuses, but two published files kept admin/axis2: conf/axis2.xml inside the\naxis2-webapp WAR, and axis2_default.xml inside axis2-kernel.jar, which is the\nclasspath fallback every configurator uses when no axis2.xml is found. Both\ngave /axis2-admin a known login, and that console can upload services. Empty\nboth; the admin console tests now inject credentials into their unpacked copy\nof the WAR instead.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "dfacb5c702ead7a460d344aceeaa0ed0f1c2f4ef", "tree": "49ab45d77e626599186573291c7c70f7eb82f870", "parents": [ "843626de8c64c26ded5272063c51773479ae7014" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Sep 02 16:22:16 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Sep 02 16:22:16 2026 -1000" }, "message": "Pin the ant builds to a Java 17 release\n\nThe javac tasks set no release, so classes took whatever the build JDK emitted\nand then outlived it in target/, where a later JDK too old to load them fails\non a class-version error that looks nothing like its cause. Pin all 37 tasks to\nmaven.compiler.release, as the jaxrs test resources already did; the samples\nalso default it to 17, since those are run standalone with plain ant.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "843626de8c64c26ded5272063c51773479ae7014", "tree": "1dd81a29c0e7d7243a0ac92b53b4a45fc7da5dfc", "parents": [ "522466b8415d234b75a7165a8de207b9dd544e64" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Sep 02 10:23:10 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Sep 02 10:23:10 2026 -1000" }, "message": "Pin the scheme predicate the AAR and WAR SSRF guards rely on\n\nThe guards only inspect and block schemes once isAbsolute() calls a location\nabsolute, so widening that predicate reroutes file: and jar: locations to the\nparent resolver instead of the classloader. Cover the boundary so an XmlSchema\nupgrade cannot move it silently.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "522466b8415d234b75a7165a8de207b9dd544e64", "tree": "b4f9511c76403b8bbacb932d512484aa0b3f8cb5", "parents": [ "9c2e5365741da6260f6a7d085b1d415027a5340e" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Sep 02 10:23:10 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Sep 02 10:23:10 2026 -1000" }, "message": "Declare isAbsolute locally in the AAR and WAR schema resolvers\n\nXmlSchema 2.3.3 makes DefaultURIResolver.isAbsolute private, so the three\nresolvers that call it to gate their remote-scheme block stop inheriting it.\nDeclare it in each, as AARBasedWSDLLocator already does. It keeps the 2.3.2\nprefix semantics rather than the URI.isAbsolute() test that replaced them,\nand stays protected so this still compiles against the pinned 2.3.2.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "9c2e5365741da6260f6a7d085b1d415027a5340e", "tree": "7717f776923591a24cc150ecb5273edc19bde3cd", "parents": [ "5ce39dba9b4af723f4b7351548341e8e5b8e7523", "1e866b90d3a736f59ea1ec1c88fc8b68c7014ae0" ], "author": { "name": "Christian Ortlepp", "email": "christian.ortlepp@hypergene.com", "time": "Mon Aug 31 16:17:22 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 16:17:22 2026 +0200" }, "message": "Merge pull request #1291 from apache/dependabot/maven/development-dependencies-097c1ff2cb\n\nbuild(deps-dev): bump the development-dependencies group with 2 updates" }, { "commit": "5ce39dba9b4af723f4b7351548341e8e5b8e7523", "tree": "37430f243ca806dda7e4263c02331029d8a29068", "parents": [ "c53e980f61cc8c2dbc21fee9b26b510985467d70", "7f28ee844b8781f2425178afe4219adfbb6b66f4" ], "author": { "name": "Christian Ortlepp", "email": "christian.ortlepp@hypergene.com", "time": "Mon Aug 31 16:15:18 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 16:15:18 2026 +0200" }, "message": "Merge pull request #1290 from apache/dependabot/maven/production-dependencies-902b8a662f\n\nbuild(deps): bump the production-dependencies group with 13 updates" }, { "commit": "c53e980f61cc8c2dbc21fee9b26b510985467d70", "tree": "333ccdc91ac84ea09c5f604d4e40eaeffde94f7d", "parents": [ "ea0b8e6076b0cf7f75cac9e710ee3dd604e9f44f", "8201beaa00dc612e79c6f03b46008a604efbf0c0" ], "author": { "name": "Christian Ortlepp", "email": "christian.ortlepp@hypergene.com", "time": "Mon Aug 31 16:14:39 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 16:14:39 2026 +0200" }, "message": "Merge pull request #1289 from apache/dependabot/github_actions/production-actions-62c522be73\n\nbuild(deps): bump actions/setup-java from 5.7.0 to 6.0.0 in the production-actions group" }, { "commit": "ea0b8e6076b0cf7f75cac9e710ee3dd604e9f44f", "tree": "9ba6cf22e6b9fb1bc22bb183c0e2090492ec53f5", "parents": [ "d6034ac92bc56d2c217a233723d152f619ad6708", "eec90a9ddb139c4ab52756d40534b8f23476075f" ], "author": { "name": "Christian Ortlepp", "email": "christian.ortlepp@hypergene.com", "time": "Mon Aug 31 16:14:14 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 16:14:14 2026 +0200" }, "message": "Merge pull request #1287 from apache/dependabot/maven/modules/samples/userguide/src/userguide/springbootdemo-tomcat11/META-INF/maven/userguide.springboot/axis2-json-api/org.apache.httpcomponents.client5-httpclient5-5.6.3\n\nbuild(deps): bump org.apache.httpcomponents.client5:httpclient5 from 5.4.3 to 5.6.3 in /modules/samples/userguide/src/userguide/springbootdemo-tomcat11/META-INF/maven/userguide.springboot/axis2-json-api" }, { "commit": "1e866b90d3a736f59ea1ec1c88fc8b68c7014ae0", "tree": "135361b9bad8acbab60f82694b56979fcc8fb54f", "parents": [ "d6034ac92bc56d2c217a233723d152f619ad6708" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Aug 27 14:12:49 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 14:12:49 2026 +0000" }, "message": "build(deps-dev): bump the development-dependencies group with 2 updates\n\nBumps the development-dependencies group with 2 updates: [org.springframework:spring-test](https://github.com/spring-projects/spring-framework) and [com.icegreen:greenmail](https://github.com/greenmail-mail-test/greenmail).\n\n\nUpdates `org.springframework:spring-test` from 7.0.8 to 7.0.9\n- [Release notes](https://github.com/spring-projects/spring-framework/releases)\n- [Commits](https://github.com/spring-projects/spring-framework/compare/v7.0.8...v7.0.9)\n\nUpdates `com.icegreen:greenmail` from 2.1.12 to 2.1.13\n- [Release notes](https://github.com/greenmail-mail-test/greenmail/releases)\n- [Commits](https://github.com/greenmail-mail-test/greenmail/compare/release-2.1.12...release-2.1.13)\n\n---\nupdated-dependencies:\n- dependency-name: org.springframework:spring-test\n dependency-version: 7.0.9\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: development-dependencies\n- dependency-name: com.icegreen:greenmail\n dependency-version: 2.1.13\n dependency-type: direct:development\n update-type: version-update:semver-patch\n dependency-group: development-dependencies\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "7f28ee844b8781f2425178afe4219adfbb6b66f4", "tree": "53faf1cf0d90b4f0917bc5a1801709e39f05939d", "parents": [ "d6034ac92bc56d2c217a233723d152f619ad6708" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Aug 27 14:12:03 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 14:12:03 2026 +0000" }, "message": "build(deps): bump the production-dependencies group with 13 updates\n\nBumps the production-dependencies group with 13 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [org.springframework:spring-core](https://github.com/spring-projects/spring-framework) | `7.0.8` | `7.0.9` |\n| [org.springframework:spring-beans](https://github.com/spring-projects/spring-framework) | `7.0.8` | `7.0.9` |\n| [org.springframework:spring-context](https://github.com/spring-projects/spring-framework) | `7.0.8` | `7.0.9` |\n| [org.springframework:spring-web](https://github.com/spring-projects/spring-framework) | `7.0.8` | `7.0.9` |\n| org.apache.xmlbeans:xmlbeans | `5.3.0` | `5.4.0` |\n| [org.codehaus.plexus:plexus-utils](https://github.com/codehaus-plexus/plexus-utils) | `4.0.3` | `4.1.0` |\n| [com.google.guava:guava](https://github.com/google/guava) | `33.6.0-jre` | `33.7.1-jre` |\n| [io.swagger.core.v3:swagger-core](https://github.com/swagger-api/swagger-core) | `2.2.53` | `2.2.54` |\n| io.swagger.core.v3:swagger-models | `2.2.53` | `2.2.54` |\n| io.swagger.core.v3:swagger-annotations | `2.2.53` | `2.2.54` |\n| [org.apache.groovy:groovy](https://github.com/apache/groovy) | `5.1.0` | `5.1.1` |\n| [org.apache.groovy:groovy-ant](https://github.com/apache/groovy) | `5.1.0` | `5.1.1` |\n| [org.apache.groovy:groovy-xml](https://github.com/apache/groovy) | `5.1.0` | `5.1.1` |\n\n\nUpdates `org.springframework:spring-core` from 7.0.8 to 7.0.9\n- [Release notes](https://github.com/spring-projects/spring-framework/releases)\n- [Commits](https://github.com/spring-projects/spring-framework/compare/v7.0.8...v7.0.9)\n\nUpdates `org.springframework:spring-beans` from 7.0.8 to 7.0.9\n- [Release notes](https://github.com/spring-projects/spring-framework/releases)\n- [Commits](https://github.com/spring-projects/spring-framework/compare/v7.0.8...v7.0.9)\n\nUpdates `org.springframework:spring-context` from 7.0.8 to 7.0.9\n- [Release notes](https://github.com/spring-projects/spring-framework/releases)\n- [Commits](https://github.com/spring-projects/spring-framework/compare/v7.0.8...v7.0.9)\n\nUpdates `org.springframework:spring-web` from 7.0.8 to 7.0.9\n- [Release notes](https://github.com/spring-projects/spring-framework/releases)\n- [Commits](https://github.com/spring-projects/spring-framework/compare/v7.0.8...v7.0.9)\n\nUpdates `org.springframework:spring-beans` from 7.0.8 to 7.0.9\n- [Release notes](https://github.com/spring-projects/spring-framework/releases)\n- [Commits](https://github.com/spring-projects/spring-framework/compare/v7.0.8...v7.0.9)\n\nUpdates `org.springframework:spring-context` from 7.0.8 to 7.0.9\n- [Release notes](https://github.com/spring-projects/spring-framework/releases)\n- [Commits](https://github.com/spring-projects/spring-framework/compare/v7.0.8...v7.0.9)\n\nUpdates `org.springframework:spring-web` from 7.0.8 to 7.0.9\n- [Release notes](https://github.com/spring-projects/spring-framework/releases)\n- [Commits](https://github.com/spring-projects/spring-framework/compare/v7.0.8...v7.0.9)\n\nUpdates `org.apache.xmlbeans:xmlbeans` from 5.3.0 to 5.4.0\n\nUpdates `org.codehaus.plexus:plexus-utils` from 4.0.3 to 4.1.0\n- [Release notes](https://github.com/codehaus-plexus/plexus-utils/releases)\n- [Commits](https://github.com/codehaus-plexus/plexus-utils/compare/plexus-utils-4.0.3...plexus-utils-4.1.0)\n\nUpdates `com.google.guava:guava` from 33.6.0-jre to 33.7.1-jre\n- [Release notes](https://github.com/google/guava/releases)\n- [Commits](https://github.com/google/guava/commits)\n\nUpdates `io.swagger.core.v3:swagger-core` from 2.2.53 to 2.2.54\n- [Release notes](https://github.com/swagger-api/swagger-core/releases)\n- [Changelog](https://github.com/swagger-api/swagger-core/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/swagger-api/swagger-core/compare/v2.2.53...v2.2.54)\n\nUpdates `io.swagger.core.v3:swagger-models` from 2.2.53 to 2.2.54\n\nUpdates `io.swagger.core.v3:swagger-annotations` from 2.2.53 to 2.2.54\n\nUpdates `io.swagger.core.v3:swagger-models` from 2.2.53 to 2.2.54\n\nUpdates `io.swagger.core.v3:swagger-annotations` from 2.2.53 to 2.2.54\n\nUpdates `org.apache.groovy:groovy` from 5.1.0 to 5.1.1\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.apache.groovy:groovy-ant` from 5.1.0 to 5.1.1\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.apache.groovy:groovy-xml` from 5.1.0 to 5.1.1\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.apache.groovy:groovy-ant` from 5.1.0 to 5.1.1\n- [Commits](https://github.com/apache/groovy/commits)\n\nUpdates `org.apache.groovy:groovy-xml` from 5.1.0 to 5.1.1\n- [Commits](https://github.com/apache/groovy/commits)\n\n---\nupdated-dependencies:\n- dependency-name: org.springframework:spring-core\n dependency-version: 7.0.9\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.springframework:spring-beans\n dependency-version: 7.0.9\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.springframework:spring-context\n dependency-version: 7.0.9\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.springframework:spring-web\n dependency-version: 7.0.9\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.springframework:spring-beans\n dependency-version: 7.0.9\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.springframework:spring-context\n dependency-version: 7.0.9\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.springframework:spring-web\n dependency-version: 7.0.9\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.xmlbeans:xmlbeans\n dependency-version: 5.4.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: org.codehaus.plexus:plexus-utils\n dependency-version: 4.1.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: com.google.guava:guava\n dependency-version: 33.7.1-jre\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: production-dependencies\n- dependency-name: io.swagger.core.v3:swagger-core\n dependency-version: 2.2.54\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: io.swagger.core.v3:swagger-models\n dependency-version: 2.2.54\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: io.swagger.core.v3:swagger-annotations\n dependency-version: 2.2.54\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: io.swagger.core.v3:swagger-models\n dependency-version: 2.2.54\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: io.swagger.core.v3:swagger-annotations\n dependency-version: 2.2.54\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.groovy:groovy\n dependency-version: 5.1.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.groovy:groovy-ant\n dependency-version: 5.1.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.groovy:groovy-xml\n dependency-version: 5.1.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.groovy:groovy-ant\n dependency-version: 5.1.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n- dependency-name: org.apache.groovy:groovy-xml\n dependency-version: 5.1.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: production-dependencies\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "8201beaa00dc612e79c6f03b46008a604efbf0c0", "tree": "a4723de23f1ca7717e41bf71e87df74f4969f0d7", "parents": [ "d6034ac92bc56d2c217a233723d152f619ad6708" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Aug 27 14:08:54 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 14:08:54 2026 +0000" }, "message": "build(deps): bump actions/setup-java in the production-actions group\n\nBumps the production-actions group with 1 update: [actions/setup-java](https://github.com/actions/setup-java).\n\n\nUpdates `actions/setup-java` from 5.7.0 to 6.0.0\n- [Release notes](https://github.com/actions/setup-java/releases)\n- [Commits](https://github.com/actions/setup-java/compare/b6effb05e454b25005698d916606bdc6ffcbf961...dd06d9cba3e5552c54d9f8ea23572deb30010f7c)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-java\n dependency-version: 6.0.0\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: production-actions\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e" }, { "commit": "d6034ac92bc56d2c217a233723d152f619ad6708", "tree": "5046d31f72b11e6533d576d4cf08295be9aa0be6", "parents": [ "ca25fcf6763a3f1100e29945947907d41ab1f6a6", "e33c941899bec16b9a41f6a84329c18688ca4612" ], "author": { "name": "Christian Ortlepp", "email": "christian.ortlepp@hypergene.com", "time": "Tue Aug 25 10:02:20 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 25 10:02:20 2026 +0200" }, "message": "Merge pull request #1288 from apache/dependabot/maven/modules/samples/userguide/src/userguide/springbootdemo-tomcat11/org.apache.httpcomponents.core5-httpcore5-h2-5.4.3\n\nbuild(deps): bump org.apache.httpcomponents.core5:httpcore5-h2 from 5.4.1 to 5.4.3 in /modules/samples/userguide/src/userguide/springbootdemo-tomcat11" } ], "next": "e33c941899bec16b9a41f6a84329c18688ca4612" }