)]}' { "log": [ { "commit": "b83776bba97ceec2fe390b7d7b0f340ffaa81c30", "tree": "44341a5cc90d6d8115fcf40de144d514870c30ff", "parents": [ "9bc385512e14d6f3a91fd08487a8fd95f2e90a94" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 28 07:34:01 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 07:34:01 2026 -0400" }, "message": "Bump org.apache.maven.plugins:maven-surefire-report-plugin (#3642)\n\nBumps [org.apache.maven.plugins:maven-surefire-report-plugin](https://github.com/apache/maven-surefire) from 3.6.0 to 3.6.1.\n- [Release notes](https://github.com/apache/maven-surefire/releases)\n- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.6.0...surefire-3.6.1)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven.plugins:maven-surefire-report-plugin\n dependency-version: 3.6.1\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "9bc385512e14d6f3a91fd08487a8fd95f2e90a94", "tree": "7d7a6716436bdefabc455ebfb02f776f59ba56e6", "parents": [ "2d52ef38134cd9ba08ee0b353f1c69f52a1625f0" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 28 07:33:39 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 07:33:39 2026 -0400" }, "message": "Bump the codeql-action group with 3 updates (#3643)\n\nBumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).\n\n\nUpdates `github/codeql-action/init` from 4.39.0 to 4.39.1\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee...9b3254085494b55a0f7c4c2b3d2d52cc712ce370)\n\nUpdates `github/codeql-action/analyze` from 4.39.0 to 4.39.1\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee...9b3254085494b55a0f7c4c2b3d2d52cc712ce370)\n\nUpdates `github/codeql-action/upload-sarif` from 4.39.0 to 4.39.1\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee...9b3254085494b55a0f7c4c2b3d2d52cc712ce370)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action/init\n dependency-version: 4.39.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: codeql-action\n- dependency-name: github/codeql-action/analyze\n dependency-version: 4.39.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: codeql-action\n- dependency-name: github/codeql-action/upload-sarif\n dependency-version: 4.39.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: codeql-action\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "2d52ef38134cd9ba08ee0b353f1c69f52a1625f0", "tree": "b2f7d952854b121411db5ba08635cf7112aa694b", "parents": [ "8f0f8cdfd099b1fb5196a532b1a83139b77ce5b4" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 28 07:33:12 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 07:33:12 2026 -0400" }, "message": "Bump org.apache.maven.plugins:maven-surefire-plugin from 3.6.0 to 3.6.1 (#3644)\n\nBumps [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) from 3.6.0 to 3.6.1.\n- [Release notes](https://github.com/apache/maven-surefire/releases)\n- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.6.0...surefire-3.6.1)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven.plugins:maven-surefire-plugin\n dependency-version: 3.6.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "8f0f8cdfd099b1fb5196a532b1a83139b77ce5b4", "tree": "20049dc6458f4e642feee9ddf6a056692e4d680e", "parents": [ "d4335d43189fa278f7645dbee49e7c16c0cc142a" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Wed Oct 28 11:14:54 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 11:14:54 2026 +0000" }, "message": "Support detecting the replay of SAML2 bearer assertions at the OAuth token endpoint (#3637)" }, { "commit": "d4335d43189fa278f7645dbee49e7c16c0cc142a", "tree": "7882b5abd895e7678babfe62c618b591fda7ab03", "parents": [ "952b990a897fdf4f60157bb43cd6efd2ee21a831" ], "author": { "name": "Naveed Khan", "email": "164054284+rootvector2@users.noreply.github.com", "time": "Wed Oct 28 15:45:46 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 10:15:46 2026 +0000" }, "message": "validate claims on jwe-only tokens in JoseJwtConsumer (#3639)" }, { "commit": "952b990a897fdf4f60157bb43cd6efd2ee21a831", "tree": "de36eef139cfefaec3f35ed47ecb196c2b5ff75c", "parents": [ "da21f3655cc36206418c8274e35660f12a7d3282" ], "author": { "name": "Naveed Khan", "email": "164054284+rootvector2@users.noreply.github.com", "time": "Wed Oct 28 15:44:59 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 28 10:14:59 2026 +0000" }, "message": "ignore x5c and x5t key headers in JWTTokenValidator (#3636)\n\n* ignore x5c and x5t key headers in JWTTokenValidator\n\n* make x5c and x5t key headers opt-in via allowX509KeyHeaders in JWTTokenValidator" }, { "commit": "da21f3655cc36206418c8274e35660f12a7d3282", "tree": "d2960ca8b4ea0c10ad18d116393a6d2557d9434f", "parents": [ "fc281cdaaabd0081aef154d7b1c62920fd2aa5f6" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Oct 27 19:44:03 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 27 19:44:03 2026 -0400" }, "message": "Bump org.webjars:swagger-ui from 5.33.2 to 5.34.0 (#3634)\n\nBumps [org.webjars:swagger-ui](https://github.com/swagger-api/swagger-ui) from 5.33.2 to 5.34.0.\n- [Release notes](https://github.com/swagger-api/swagger-ui/releases)\n- [Commits](https://github.com/swagger-api/swagger-ui/compare/v5.33.2...v5.34.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.webjars:swagger-ui\n dependency-version: 5.34.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "fc281cdaaabd0081aef154d7b1c62920fd2aa5f6", "tree": "60cd1a3fc569d478595e5242e63645e8c5d5a170", "parents": [ "b1a1811e611cdc706dcca988a16939aeac08452b" ], "author": { "name": "Freeman(Yue) Fang", "email": "freeman.fang@gmail.com", "time": "Tue Oct 27 19:20:55 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 27 19:20:55 2026 -0400" }, "message": "CXF-8228: Log the headers added to the HttpServletResponse (#3620)\n\n* CXF-8228: Log effective HTTP response headers through a transport-owned view\n\nExpose a lazy, read-only response-header map through Message.RESPONSE_HEADERS.\nThe HTTP destination combines servlet headers with pending protocol headers\nusing the same value formatting as copyToResponse, without changing the\nresponse or feeding servlet headers back into PROTOCOL_HEADERS. Reading the\nview after header copying returns the servlet response headers directly.\n\nHave logging copy this transport-neutral view before masking sensitive\nheaders, falling back to PROTOCOL_HEADERS when no view is provided. This\ncaptures application and servlet headers on both normal and bodyless\nresponses without a Servlet API dependency in the logging module.\n\nKeep header masking case-insensitive and fall back to protocol headers when\nservlet header inspection fails. Cover lazy evaluation, immutable snapshots,\nheader precedence, appended values, transport formatting, fault masking,\nand HTTP responses with and without a body.\n\n* CXF-8228: Address review feedback" }, { "commit": "b1a1811e611cdc706dcca988a16939aeac08452b", "tree": "dc0abccad355065dfb9f32d506a2be575930d88e", "parents": [ "5647d0648194622d6fd67bb7b942813f2ad731db" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Tue Oct 27 06:33:51 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 27 06:33:51 2026 -0400" }, "message": "Bump cxf.aspectj.version from 1.9.25.1 to 1.9.26 (#3633)\n\nBumps `cxf.aspectj.version` from 1.9.25.1 to 1.9.26.\n\nUpdates `org.aspectj:aspectjweaver` from 1.9.25.1 to 1.9.26\n- [Release notes](https://github.com/eclipse/org.aspectj/releases)\n- [Commits](https://github.com/eclipse/org.aspectj/commits)\n\nUpdates `org.aspectj:aspectjrt` from 1.9.25.1 to 1.9.26\n- [Release notes](https://github.com/eclipse/org.aspectj/releases)\n- [Commits](https://github.com/eclipse/org.aspectj/commits)\n\n---\nupdated-dependencies:\n- dependency-name: org.aspectj:aspectjweaver\n dependency-version: 1.9.26\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.aspectj:aspectjrt\n dependency-version: 1.9.26\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "5647d0648194622d6fd67bb7b942813f2ad731db", "tree": "de6afc602586e0168136cf861f37f8cb116aed4c", "parents": [ "6308498b8d94cbbb3b282c2e83010a434e7b5edd" ], "author": { "name": "Naveed Khan", "email": "164054284+rootvector2@users.noreply.github.com", "time": "Tue Oct 27 04:41:23 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 19:11:23 2026 -0400" }, "message": "reject WEB-INF and META-INF paths in AbstractHTTPServlet (#3626)\n\n* reject WEB-INF and META-INF paths in AbstractHTTPServlet\n\n* make protected static paths configurable via static-resources-protected-path-list\n\n* Add integration tests\n\n---------\n\nCo-authored-by: Andriy Redko \u003cdrreta@gmail.com\u003e" }, { "commit": "6308498b8d94cbbb3b282c2e83010a434e7b5edd", "tree": "13be9633ebe9c0acd2ad3e95191b078f5a36c1d3", "parents": [ "e604ed547309c3200b7c44bfa92db13ab483b940" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Mon Oct 26 17:01:57 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 17:01:57 2026 +0000" }, "message": "Apply SAML SSO bearer assertion replay detection to all bindings (#3631)" }, { "commit": "e604ed547309c3200b7c44bfa92db13ab483b940", "tree": "1223e3afbf16b93b602c9dd15f4172b295dc8e21", "parents": [ "c44be07fcb03003c0e39c5107dfa8082322e236a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 26 06:14:52 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 06:14:52 2026 -0400" }, "message": "Bump org.graalvm.buildtools:native-maven-plugin from 1.1.14 to 1.1.16 (#3629)\n\nBumps [org.graalvm.buildtools:native-maven-plugin](https://github.com/graalvm/native-build-tools) from 1.1.14 to 1.1.16.\n- [Release notes](https://github.com/graalvm/native-build-tools/releases)\n- [Commits](https://github.com/graalvm/native-build-tools/compare/1.1.14...1.1.16)\n\n---\nupdated-dependencies:\n- dependency-name: org.graalvm.buildtools:native-maven-plugin\n dependency-version: 1.1.16\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "c44be07fcb03003c0e39c5107dfa8082322e236a", "tree": "32befef3f6c12e18a49260e94c77df847b219a94", "parents": [ "d27cfb07780e19478887d7ebbac4fddb9f346814" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 26 06:14:30 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 06:14:30 2026 -0400" }, "message": "Bump org.codehaus.plexus:plexus-archiver from 4.14.0 to 4.15.0 (#3630)\n\nBumps [org.codehaus.plexus:plexus-archiver](https://github.com/codehaus-plexus/plexus-archiver) from 4.14.0 to 4.15.0.\n- [Release notes](https://github.com/codehaus-plexus/plexus-archiver/releases)\n- [Changelog](https://github.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md)\n- [Commits](https://github.com/codehaus-plexus/plexus-archiver/compare/plexus-archiver-4.14.0...plexus-archiver-4.15.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.codehaus.plexus:plexus-archiver\n dependency-version: 4.15.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "d27cfb07780e19478887d7ebbac4fddb9f346814", "tree": "9055bc3a5043a5bc7cd224878a40ea3d1ba5e41a", "parents": [ "832021f8e623721ec9e17e522f173fc915a366ee" ], "author": { "name": "Naveed Khan", "email": "164054284+rootvector2@users.noreply.github.com", "time": "Mon Oct 26 13:33:54 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 08:03:54 2026 +0000" }, "message": "make the SAMLSSOResponseValidator replay check atomic (#3625)\n\n* make the SAMLSSOResponseValidator replay check atomic\n\nSAMLSSOResponseValidator.validateSubjectConfirmation guarded a POST\nbinding assertion against replay with contains() followed by putId() on\nthe TokenReplayCache, so concurrent submissions of the same captured\nresponse all passed the lookup before any of them was cached, and were\nall accepted.\n\nAdd TokenReplayCache.putIdIfAbsent, backed by the atomic putIfAbsent of\nEhcache and JCache (with a synchronized default for custom caches), and\nuse it in the validator. This is the JAX-RS SAML SSO counterpart of the\nWS-Security JCacheReplayCache change in #3622.\n\n* reject null and empty ids in the default putIdIfAbsent, add timeouts to the cache concurrency test" }, { "commit": "832021f8e623721ec9e17e522f173fc915a366ee", "tree": "97424efe0499b13e3f28a279e8ad263b6ffd5081", "parents": [ "5a6d72e138ea46cdad13705573c7a3547d45ec05" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Mon Oct 26 08:03:03 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 26 08:03:03 2026 +0000" }, "message": "Resolve OAuthScopesFilter annotation scopes by method signature (#3627)\n\n* Resolve OAuthScopesFilter annotation scopes by method signature\n\n* Review comments" }, { "commit": "5a6d72e138ea46cdad13705573c7a3547d45ec05", "tree": "e0ff401b5faf318fc85e860a8273b836843b2c1a", "parents": [ "08a45d78aea2ad73d8875d5dbf1f64ba4fa04333" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Sun Oct 25 10:49:48 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 25 10:49:48 2026 +0000" }, "message": "Make SimpleAuthorizingInterceptor signature keys whitespace-insensitive (#3623)" }, { "commit": "08a45d78aea2ad73d8875d5dbf1f64ba4fa04333", "tree": "16be268e369f497c8ad2f56aee719faf9e8e7d4f", "parents": [ "59a7d394503a53eee945a43e2dcbdc2e08e764ce" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Fri Oct 23 09:03:13 2026 -0400" }, "committer": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Fri Oct 23 09:03:13 2026 -0400" }, "message": "Update Micrometer to 1.17.2\n" }, { "commit": "59a7d394503a53eee945a43e2dcbdc2e08e764ce", "tree": "561d63f1e2103e750f740c1a4e02697e8ed8491e", "parents": [ "7beb5eb2c5ce523a52b8bc84b914c7274fb09270" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Fri Oct 23 09:02:51 2026 -0400" }, "committer": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Fri Oct 23 09:02:51 2026 -0400" }, "message": "Update Micrometer Tracing to 1.7.2\n" }, { "commit": "7beb5eb2c5ce523a52b8bc84b914c7274fb09270", "tree": "8962d65c91e4b5b9107ce16b56182e26e22bc2db", "parents": [ "7ca981f7e640a10c6bbe4e15e0d6e3cb93c79042" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Fri Oct 23 09:01:55 2026 -0400" }, "committer": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Fri Oct 23 09:01:55 2026 -0400" }, "message": "Update Project Reactor to 3.8.8\n" }, { "commit": "7ca981f7e640a10c6bbe4e15e0d6e3cb93c79042", "tree": "a98a6b7b9087172b36ff49f5d79040db756e4fae", "parents": [ "89758caeb0823fa1c47b6801f61a3971deac040c" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Fri Oct 23 13:47:21 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 23 13:47:21 2026 +0100" }, "message": "Make JCacheReplayCache replay checks atomic (#3622)" }, { "commit": "89758caeb0823fa1c47b6801f61a3971deac040c", "tree": "ef51c07781367d29ba1c0caf1eaaeec0db5814f7", "parents": [ "bba43d24b66d5f7912e6d3f16eb43d810aa6ceb5" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Fri Oct 23 07:38:22 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 23 07:38:22 2026 -0400" }, "message": "CXF-7986: WebClient.path method overwrites base URL when given absolute URL as input (#3596)\n\n* CXF-7986: WebClient.path method overwrites base URL when given absolute URL as input\n\n* Address code review comments\n\n* Address code review comments\n\n* Address code review comments\n\n* Add tests for UriBuilder::toTemplate()\n\n* Address review comments\n\n* Address code review comments\n\n* Address review comments\n\n* Add more test cases" }, { "commit": "bba43d24b66d5f7912e6d3f16eb43d810aa6ceb5", "tree": "823c2f5d8aafc2f8f9c07d1cd9b6772c3f507dd5", "parents": [ "81ea0239f8aa160c0ce101e0f43f8e26e9de7392" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Thu Oct 22 21:23:40 2026 -0400" }, "committer": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Thu Oct 22 21:23:40 2026 -0400" }, "message": "Update Spring Frawework to 7.0.10\n" }, { "commit": "81ea0239f8aa160c0ce101e0f43f8e26e9de7392", "tree": "d03d9f1e39c9a326037408b5fccc592a94a95e7b", "parents": [ "4bbcb84d30bda125cf060d0ab20aa18642667df7" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Thu Oct 22 21:21:31 2026 -0400" }, "committer": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Thu Oct 22 21:21:31 2026 -0400" }, "message": "Update Spring Cloud Eureka to 5.0.3\n" }, { "commit": "4bbcb84d30bda125cf060d0ab20aa18642667df7", "tree": "0ae729da1a55056d8558fc912c5c229bb350348e", "parents": [ "f4c3c3912b818c1e0ca0f60fb82a5c9b0715870e" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Thu Oct 22 21:15:20 2026 -0400" }, "committer": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Thu Oct 22 21:15:20 2026 -0400" }, "message": "Update Spring LDAP to 4.1.2\n" }, { "commit": "f4c3c3912b818c1e0ca0f60fb82a5c9b0715870e", "tree": "4c72459dcc705875918cf39a92c6f3b65de372cc", "parents": [ "d0ae77dba74d467b199d2dc49ed46d38481dca24" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Thu Oct 22 21:14:51 2026 -0400" }, "committer": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Thu Oct 22 21:14:51 2026 -0400" }, "message": "Update Spring Security to 7.1.2\n" }, { "commit": "d0ae77dba74d467b199d2dc49ed46d38481dca24", "tree": "da56984d2891fd4faab31896c55b812b14e10173", "parents": [ "663cf11aa042c68bf693b4724dd27a05225ea6f8" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Thu Oct 22 21:13:45 2026 -0400" }, "committer": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Thu Oct 22 21:13:45 2026 -0400" }, "message": "Update Spring Boot to 4.1.2\n" }, { "commit": "663cf11aa042c68bf693b4724dd27a05225ea6f8", "tree": "e8880bcbbdadf35e9f3c1e42c42005e032f858cc", "parents": [ "b5cf336721289aaf7ea87834d92dd2f50b8af9c0" ], "author": { "name": "Sharang Gupta", "email": "sharang@sharanggupta.dev", "time": "Thu Oct 22 22:08:11 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 17:08:11 2026 -0400" }, "message": "CXF-9072: Support the SameSite attribute in NewCookieHeaderProvider (#3616)\n\n* CXF-9072: Support the SameSite attribute in NewCookieHeaderProvider\n\nfromString treated any attribute it did not recognize, such as SameSite,\nas the cookie\u0027s name\u003dvalue pair, so \"foo\u003dbar;SameSite\u003dLax\" was parsed as a\ncookie named \"SameSite\". The cookie\u0027s own name\u003dvalue pair now comes first\nand later unrecognized attributes are ignored. SameSite is parsed\ncase-insensitively into NewCookie.SameSite, an unrecognized SameSite value\nis ignored, and toString writes the attribute so it survives a round trip\nthrough Response.getCookies().\n\n* CXF-9072: Skip empty Set-Cookie segments\n\nWith the first name\u003dvalue pair now taken as the cookie, an empty leading segment such as \" ; foo\u003dbar\" would have become a cookie with an empty name.\n\n* CXF-9072: Always take the first Set-Cookie segment as the cookie\n\nPer RFC 6265 section 5.2 the first segment is the cookie\u0027s name\u003dvalue\npair whatever its name, and only the segments after it are attributes.\nA cookie named after an attribute (path\u003dabc; Path\u003d/) or named SameSite\nwas parsed as attributes and rejected as malformed. A first segment\nwithout \u0027\u003d\u0027 is still rejected.\n\n* CXF-9072: Write the SameSite value with StringUtils.capitalize\n\nReplace the switch with StringUtils.capitalize on the lower-cased enum\nname. Lower-case with Locale.ROOT: under a Turkish default locale,\nSTRICT would otherwise become \"Strıct\" with a dotless i." }, { "commit": "b5cf336721289aaf7ea87834d92dd2f50b8af9c0", "tree": "a1450cb98d43cc76587b18fc1ca02a24745c0963", "parents": [ "5085d2090b3dfbd37ea35ec74f34a5dd4a51a21d" ], "author": { "name": "Javid Khan", "email": "dxbjavid@gmail.com", "time": "Fri Oct 23 01:43:43 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 16:13:43 2026 -0400" }, "message": "add missing parameter separator in createMethodSig (#3619)" }, { "commit": "5085d2090b3dfbd37ea35ec74f34a5dd4a51a21d", "tree": "86657552d096702a2c42cbb67388eb22d46de07e", "parents": [ "dbc1edb4e300fc03f0d57aec9a9814d5a5d5b86f" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Thu Oct 22 16:44:36 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 16:44:36 2026 +0100" }, "message": "CXF-7647: Don\u0027t register duplicate endpoints for compiler-generated bridge methods (#3618)" }, { "commit": "dbc1edb4e300fc03f0d57aec9a9814d5a5d5b86f", "tree": "00631696c7556f1c417519df9074e591c1184b6d", "parents": [ "d3b9fdc9e0474519062fcb65f88b6aa13853e550" ], "author": { "name": "Freeman(Yue) Fang", "email": "freeman.fang@gmail.com", "time": "Thu Oct 22 08:55:57 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 22 08:55:57 2026 -0400" }, "message": "CXF-6955: Fix WS-RM retransmission of secured attachments (#3609)\n\n* CXF-6955: Fix WS-RM retransmission of secured attachments\n\nSave original attachments before WS-Security replaces them with single-use secured streams, and restore them for each retransmission. Persist the originals alongside the unsecured SOAP content so security is reapplied consistently after recovery.\n\nHold recovered attachment caches across retries and release them when the message is acknowledged or discarded, including cleanup after partial recovery failures. Order StAX security after attachment setup so the serializer can access the output stream.\n\nCover DOM and StAX signing and encryption, both action orders, secured MTOM, persistent stores, repeated retries, and disk-backed recovery.\n\n* CXF-6955: Address secured attachment review feedback\n\nReport unchecked persisted-message decoding failures as IOExceptions so recovery continues with valid messages and starts both queues. Verify recovery after attachment-limit failures and cleanup of partial attachment caches.\n\nKeep AttachmentSaveInterceptor inside the WS-RM capture interceptor and preserve distinct null-ID attachments without duplicating captured originals. Document the requirement for repeatable attachment streams in the release notes." }, { "commit": "d3b9fdc9e0474519062fcb65f88b6aa13853e550", "tree": "7576f38837219aa652e1203b67b879233a38b9cc", "parents": [ "42fc903a5b5ebb7013ac5987ce68405b0cd5596f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 21 13:41:56 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 13:41:56 2026 -0400" }, "message": "Bump actions/setup-java from 6.0.1 to 6.1.0 (#3613)\n\nBumps [actions/setup-java](https://github.com/actions/setup-java) from 6.0.1 to 6.1.0.\n- [Release notes](https://github.com/actions/setup-java/releases)\n- [Commits](https://github.com/actions/setup-java/compare/de7274f081f381c8f8158605e0321c36c376e2e6...b843ebf9b913146b38da2eaa7aeddf76074ae1ad)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-java\n dependency-version: 6.1.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "42fc903a5b5ebb7013ac5987ce68405b0cd5596f", "tree": "0730b59dfced6fbb91ec57b0f2fca0bb659d6735", "parents": [ "32340a137c64920e8ce20533745edb73f30dfc0a" ], "author": { "name": "Freeman(Yue) Fang", "email": "freeman.fang@gmail.com", "time": "Wed Oct 21 10:36:48 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 10:36:48 2026 -0400" }, "message": "CXF-7404: Always set Vary: Accept-Encoding on responses of the GZIP f… (#3615)\n\n* CXF-7404: Always set Vary: Accept-Encoding on responses of the GZIP feature\n\nGZIPOutInterceptor only added Vary: Accept-Encoding when it actually\ncompressed a response. A response to a client that did not accept gzip\nwas sent uncompressed without Vary, although the content coding was\nselected based on the Accept-Encoding request header. RFC 9110 (section\n12.5.5) recommends sending Vary in that case. Without it, a shared\ncache may store the uncompressed response and serve it to clients that\naccept gzip.\n\nVary is now also added to responses that are not compressed because\nthe client does not accept gzip, or because they are below the\ncompression threshold. Like Content-Encoding, the header is added when\nthe body is written, so that it is not lost if the protocol headers are\nreplaced later (e.g. by the JAX-RS response headers). If gzip is not\npermitted, the output stream is wrapped without buffering, so flushed\nstreaming responses are not delayed. Responses with a content type that\nis never compressed (supportedPayloadContentTypes) and client requests\nare unchanged.\n\n* CXF-7404: Document Vary header behavior in GZIP interceptor" }, { "commit": "32340a137c64920e8ce20533745edb73f30dfc0a", "tree": "109e056e9936680bb4b80b1858daaa5f89303b88", "parents": [ "fd873e730378d5751b103eabe37cad6940ab70f8" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Wed Oct 21 10:12:06 2026 -0400" }, "committer": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Wed Oct 21 10:12:06 2026 -0400" }, "message": "Update Jackson to 3.2.4\n" }, { "commit": "fd873e730378d5751b103eabe37cad6940ab70f8", "tree": "26d5ee9546e12dabce268e2ab3affaf1d7ab1864", "parents": [ "c380322d70021b707e8c0f9422cb53f975703f0b" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 21 10:11:29 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 10:11:29 2026 -0400" }, "message": "Bump org.jboss.ws.cxf:jbossws-cxf-client from 7.4.1.Final to 8.0.0.Final (#3606)\n\nBumps org.jboss.ws.cxf:jbossws-cxf-client from 7.4.1.Final to 8.0.0.Final.\n\n---\nupdated-dependencies:\n- dependency-name: org.jboss.ws.cxf:jbossws-cxf-client\n dependency-version: 8.0.0.Final\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "c380322d70021b707e8c0f9422cb53f975703f0b", "tree": "efacbef24cd01fdf466eb64b6299cb9625cb17bd", "parents": [ "a49a8e67b00a5dc4d0deb08fdc255c48ada40433" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Wed Oct 21 13:31:36 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 13:31:36 2026 +0100" }, "message": "CXF-8769 - Support fromString/valueOf inherited from a non-public class (#3614)" }, { "commit": "a49a8e67b00a5dc4d0deb08fdc255c48ada40433", "tree": "be321d50a40e5298d3ae4624cb18073ffb72d5ef", "parents": [ "df22a0ff291a4b5de8e9eb73988f543f37fc1717" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 21 07:32:02 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 07:32:02 2026 -0400" }, "message": "Bump ossf/scorecard-action from 2.4.4 to 2.5.0 (#3612)\n\nBumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.4 to 2.5.0.\n- [Release notes](https://github.com/ossf/scorecard-action/releases)\n- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)\n- [Commits](https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e)\n\n---\nupdated-dependencies:\n- dependency-name: ossf/scorecard-action\n dependency-version: 2.5.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "df22a0ff291a4b5de8e9eb73988f543f37fc1717", "tree": "3ba8c8b4d081a289fb430769edc3eab797c7e5e3", "parents": [ "a55953c188074ce94b3b61132a1a1bd5d360b1fa" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 21 07:31:37 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 07:31:37 2026 -0400" }, "message": "Bump the codeql-action group with 3 updates (#3611)\n\nBumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).\n\n\nUpdates `github/codeql-action/init` from 4.38.3 to 4.39.0\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee)\n\nUpdates `github/codeql-action/analyze` from 4.38.3 to 4.39.0\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee)\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.3 to 4.39.0\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action/init\n dependency-version: 4.39.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: codeql-action\n- dependency-name: github/codeql-action/analyze\n dependency-version: 4.39.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: codeql-action\n- dependency-name: github/codeql-action/upload-sarif\n dependency-version: 4.39.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n dependency-group: codeql-action\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "a55953c188074ce94b3b61132a1a1bd5d360b1fa", "tree": "2a9d529a1e05c2395bf0a7801450ec771da78798", "parents": [ "1d4b3b27a171c05dbea2e4c905c715a72edbd943" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 21 07:31:09 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 07:31:09 2026 -0400" }, "message": "Bump org.apache.commons:commons-jexl3 from 3.7.0 to 3.7.1 (#3610)\n\nBumps org.apache.commons:commons-jexl3 from 3.7.0 to 3.7.1.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.commons:commons-jexl3\n dependency-version: 3.7.1\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "1d4b3b27a171c05dbea2e4c905c715a72edbd943", "tree": "ce33432969cc062b5ea9c4e8e2836fc14123ca66", "parents": [ "63ebc1415a9aff06a2bce36073fcee225345d177" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@apache.org", "time": "Wed Oct 21 06:36:36 2026 +0100" }, "committer": { "name": "Colm O hEigeartaigh", "email": "coheigea@apache.org", "time": "Wed Oct 21 06:36:36 2026 +0100" }, "message": "Switching scorecard to run twice weekly instead and not on every push\n" }, { "commit": "63ebc1415a9aff06a2bce36073fcee225345d177", "tree": "8b2dc3516184a562b8a77f50621ec2aedb5b2997", "parents": [ "ba77b1da77a4461d32f93269efebb6be2e3d5aec" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Wed Oct 21 06:26:24 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 21 06:26:24 2026 +0100" }, "message": "CXF-8156 - Include the matched JAX-RS resource operation in fault log messages (#3608)" }, { "commit": "ba77b1da77a4461d32f93269efebb6be2e3d5aec", "tree": "ede0b4590f3635213701553c22276433608a1634", "parents": [ "f9c37340a8070761e36d92047cf087ef827d50e1" ], "author": { "name": "Javid Khan", "email": "dxbjavid@gmail.com", "time": "Tue Oct 20 18:13:31 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 13:43:31 2026 +0100" }, "message": "require every configured scope in OAuthRequestFilter (#3603)\n\n* require every configured scope in OAuthRequestFilter\n\n* make hasAllRequiredScopes protected for subclass override\n\n* add getRequiredScopes and javadoc for hasAllRequiredScopes" }, { "commit": "f9c37340a8070761e36d92047cf087ef827d50e1", "tree": "c7d80a47297e74dc6c4672cf2f958f79984187a9", "parents": [ "c935e9d98e402e84e35d61586f60957f493d187a" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Tue Oct 20 13:43:13 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 20 13:43:13 2026 +0100" }, "message": "Consolidate the resource operation name exchange key into Message (#3607)" }, { "commit": "c935e9d98e402e84e35d61586f60957f493d187a", "tree": "fd4713b034e4a06c973e0245247298d95ed8df00", "parents": [ "c46e0db582c5bb6b56bd83adb3c7b09688483fb6" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Tue Oct 20 07:52:33 2026 -0400" }, "committer": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Tue Oct 20 07:52:33 2026 -0400" }, "message": "Update ASM to 9.11.1\n" }, { "commit": "c46e0db582c5bb6b56bd83adb3c7b09688483fb6", "tree": "4305881bd72af98bfa90731d32210f7a1a82324f", "parents": [ "479c809826280804227edc744205fcdcfa9e74d2" ], "author": { "name": "Freeman Fang", "email": "freeman.fang@gmail.com", "time": "Mon Oct 19 15:31:10 2026 -0400" }, "committer": { "name": "Freeman Fang", "email": "freeman.fang@gmail.com", "time": "Mon Oct 19 15:31:10 2026 -0400" }, "message": "CXF-9258: refine log to address github bot concern\n" }, { "commit": "479c809826280804227edc744205fcdcfa9e74d2", "tree": "3d58a1e975cd15e2ede4eb2c001888e46982066b", "parents": [ "4278d63990d1a53cd60fc3e44039be00c5083a75" ], "author": { "name": "Freeman(Yue) Fang", "email": "freeman.fang@gmail.com", "time": "Mon Oct 19 12:29:27 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 12:29:27 2026 -0400" }, "message": "CXF-9258: Fix WS-RM retransmission of messages with attachments (#3598)\n\n* CXF-9258: Fix WS-RM retransmission of messages with attachments\n\nAttachmentOutInterceptor replaces the SOAP Content-Type with the multipart\nwrapper and marks the message as already processed, so a retransmitted\nmessage was sent without its attachments, or with a nested multipart, both\nwhen it was resent from memory and when it was recovered from the RMStore.\n\nIn-memory path:\n- Save the bare SOAP Content-Type (SAVED_CONTENT_TYPE) before\n AttachmentOutInterceptor replaces it\n- On resend, clear ATTACHMENT_OUT_CHECKED and the AttachmentSerializer content\n and restore the saved Content-Type, so the multipart is rebuilt correctly\n\nPersisted path (PersistenceUtils):\n- encodeRMContent writes the root part with the SOAP Content-Type instead of\n the multipart one, keeps the root part encoding, and treats an empty\n attachment collection as no attachments\n- decodeRMContent restores the root Content-Type from the stored message\n- For inbound (destination) messages the root type is taken from\n ATTACHMENT_PART_HEADERS, with the charset stripped\n- The root type is never a multipart type: if it cannot be determined, fall\n back to text/xml with a warning so a multipart is never nested\n- The root part of a captured MTOM message is stored as an XOP part, and\n decodeRMContent unwraps the SOAP type from an XOP root part and enables\n MTOM, so a recovered MTOM message is retransmitted as an XOP package\n\nTests:\n- PersistenceUtilsTest: round trips, SOAP 1.2 action and charset handling,\n inbound path, missing root type, encoding, MTOM/XOP round trips\n- RetransmissionAttachmentTest: SwA and MTOM retransmission, and retransmission\n of SwA and MTOM messages recovered from the client store after a restart\n- ServerAttachmentRecoveryTest: an inbound message with an attachment that\n could not be delivered is persisted by the destination and redelivered with\n its attachment after a server restart\n- The recovery tests use their own in-memory database per test, as an\n in-memory HSQLDB database lives as long as the JVM\n\n* CXF-9258: Address review comments\n\n- Parse the Content-Type parameters with jakarta.activation.MimeType\n instead of regular expressions, so a charset in a quoted type value\n is no longer removed with the closing quote, and only the first\n Content-Type of the root part is used\n- Take the root type of a multipart type, like one stored as the type\n of the root part, from its start-info and type parameters, so a\n SOAP 1.2 message keeps its type and action and an XOP package is\n restored with MTOM, instead of falling back to text/xml\n- Store a message as an XOP package if it is outbound with MTOM, not if\n it has a saved Content-Type\n- Encode the inbound messages without attachments with encodeRMContent\n too, so the destination stores the normalised root type\n- Remove a redundant removal of the AttachmentSerializer content on resend" }, { "commit": "4278d63990d1a53cd60fc3e44039be00c5083a75", "tree": "ad951863ce365acf1d34f749c5a0e31c721a8525", "parents": [ "6b0dd0dc8a68345988079bc087b29685f0a9b756" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Mon Oct 19 13:56:14 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 13:56:14 2026 +0100" }, "message": "CXF-8142 - Fix WSDLManager.removeDefinition leaving stale entries (#3604)" }, { "commit": "6b0dd0dc8a68345988079bc087b29685f0a9b756", "tree": "88d60e940cd13f926bf6e5cb5ea03256bc241625", "parents": [ "bd6ce9f3e0c0da7676ef962ca0e60402ed30e876" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 06:24:21 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 06:24:21 2026 -0400" }, "message": "Bump org.apache.camel.springboot:camel-spring-boot-dependencies (#3599)\n\nBumps org.apache.camel.springboot:camel-spring-boot-dependencies from 4.22.1 to 4.23.0.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.camel.springboot:camel-spring-boot-dependencies\n dependency-version: 4.23.0\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "bd6ce9f3e0c0da7676ef962ca0e60402ed30e876", "tree": "971bc99f952dbe64b16e1014fda3b6b7f503d298", "parents": [ "ef468469169438c1d74d7c15c5248b94c14e51ce" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 06:23:54 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 06:23:54 2026 -0400" }, "message": "Bump org.webjars:swagger-ui from 5.33.1 to 5.33.2 (#3600)\n\nBumps [org.webjars:swagger-ui](https://github.com/swagger-api/swagger-ui) from 5.33.1 to 5.33.2.\n- [Release notes](https://github.com/swagger-api/swagger-ui/releases)\n- [Commits](https://github.com/swagger-api/swagger-ui/compare/v5.33.1...v5.33.2)\n\n---\nupdated-dependencies:\n- dependency-name: org.webjars:swagger-ui\n dependency-version: 5.33.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "ef468469169438c1d74d7c15c5248b94c14e51ce", "tree": "886a57ac79d0c49262a02c4f983290b3cc72de50", "parents": [ "6579de5d45340730f3aeb18b818ce6dd0b0c2bca" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 06:23:30 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 06:23:30 2026 -0400" }, "message": "Bump org.hibernate.validator:hibernate-validator (#3601)\n\nBumps [org.hibernate.validator:hibernate-validator](https://github.com/hibernate/hibernate-validator) from 9.1.4.Final to 9.1.5.Final.\n- [Release notes](https://github.com/hibernate/hibernate-validator/releases)\n- [Changelog](https://github.com/hibernate/hibernate-validator/blob/9.1.5.Final/changelog.md)\n- [Commits](https://github.com/hibernate/hibernate-validator/compare/9.1.4.Final...9.1.5.Final)\n\n---\nupdated-dependencies:\n- dependency-name: org.hibernate.validator:hibernate-validator\n dependency-version: 9.1.5.Final\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "6579de5d45340730f3aeb18b818ce6dd0b0c2bca", "tree": "efd304b6c31d99e90820096b4d962286a2ce98da", "parents": [ "6d0d519ea9164eb06aecad1538eab09454338b99" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 19 06:22:59 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 19 06:22:59 2026 -0400" }, "message": "Bump jakarta.json.bind:jakarta.json.bind-api from 3.0.3 to 3.0.4 (#3602)\n\nBumps [jakarta.json.bind:jakarta.json.bind-api](https://github.com/jakartaee/jsonb-api) from 3.0.3 to 3.0.4.\n- [Release notes](https://github.com/jakartaee/jsonb-api/releases)\n- [Commits](https://github.com/jakartaee/jsonb-api/compare/3.0.3...3.0.4)\n\n---\nupdated-dependencies:\n- dependency-name: jakarta.json.bind:jakarta.json.bind-api\n dependency-version: 3.0.4\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "6d0d519ea9164eb06aecad1538eab09454338b99", "tree": "e70bfdc463a325cd6cc90a649adb1fe9f3dae7ae", "parents": [ "7995e767abd3288d5099f7de8692450b831ee257" ], "author": { "name": "Javid Khan", "email": "dxbjavid@gmail.com", "time": "Sun Oct 18 20:32:15 2026 +0530" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 18 11:02:15 2026 -0400" }, "message": "strip path components from content-disposition filename (#3572)\n\n* strip path components from content-disposition filename\n\n* sanitise inbound attachment filename at the consumer via FileUtils.safeFileName\n\n* neutralise unsafe filename chars and key file parts off the raw filename\n\nreplace NUL and \u0027:\u0027 with \u0027_\u0027 in FileUtils.safeFileName rather than dropping an\notherwise valid name like Meeting 10:30.pdf, and decide whether an EntityPart is\na file from the raw cd.getFilename() so a value such as reports/ or .. stays a\nfile part while safeFileName only cleans the reported name. adds a jaxrs\nEntityPart test covering the traversal, plain and trailing-separator cases and a\njavadoc note on ContentDisposition.getFilename().\n\n* keep an empty filename a form field, not a file part\n\nan empty filename\u003d (what browsers send for an unfilled HTML file input) was\ncounting as a file part once the file check moved to the raw value, so it went\ndown the file branch and lost its form-field name. decide on\n!StringUtils.isEmpty(rawFileName) instead, including the createFromAttachment\ncheck, so filename\u003d stays a form field while reports/ and .. still stay file\nparts.\n\n* add ContentDisposition.getFilenameSanitized and use it in the entity part code\n\n* keep the entity part filename raw for pass-through re-serialisation" }, { "commit": "7995e767abd3288d5099f7de8692450b831ee257", "tree": "57e8d9963cbf6947431a6799515f1f67bfb54c01", "parents": [ "c98bf47da805da1f7704b957591af6887591deeb" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Sat Oct 17 19:39:53 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sat Oct 17 19:39:53 2026 -0400" }, "message": "Add a few test cases with records serialization / deserialization (#3595)" }, { "commit": "c98bf47da805da1f7704b957591af6887591deeb", "tree": "a98567cd3c80d6a9ff6239fa533a01fc23d43482", "parents": [ "3b8d8d360524d1ca72e2fa4d3ec54cc8de892a9e" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Sat Oct 17 18:37:25 2026 -0400" }, "committer": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Sat Oct 17 18:37:25 2026 -0400" }, "message": "Update Apache Mina to 2.2.10\n" }, { "commit": "3b8d8d360524d1ca72e2fa4d3ec54cc8de892a9e", "tree": "e9679bfc1b178b9ae229ce8efeeda76de05aba9a", "parents": [ "5354732d878ecae81391e049701e518084b0873d" ], "author": { "name": "Freeman(Yue) Fang", "email": "freeman.fang@gmail.com", "time": "Fri Oct 16 16:17:25 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 16:17:25 2026 -0400" }, "message": "CXF-9083: Redact form parameter values in conduit debug log (#3594)\n\n* CXF-9083: Redact form parameter values in conduit debug log\n\nHTTPConduit was logging the full cached request body at FINE level\nduring redirect and retransmit handling, exposing sensitive form\nparameters (e.g. client_secret) in debug logs. The standard\nLoggingFeature cannot filter this since it bypasses the interceptor\nchain.\n\nFor form-urlencoded content, redact parameter values while preserving\nkeys (e.g. \"client_secret\u003d***\"). For other content types, log only\nthe message size.\n\n* CXF-9083: Simplify to log message size only instead of redacting form params\n\nRemove FORM_PARAM_VALUE_PATTERN, redactMessageBody method, and associated\ntests. The retransmit/redirect log now shows only the byte count, avoiding\nany risk of leaking sensitive content regardless of content type. Users who\nneed body-level logging can use LoggingFeature on the interceptor chain." }, { "commit": "5354732d878ecae81391e049701e518084b0873d", "tree": "050a61cbbf69bdb16b94cb143d8d3c039039178c", "parents": [ "4852a8d42278bb434043020d1d594550940b9239" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Fri Oct 16 16:52:55 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 16:52:55 2026 +0100" }, "message": "CXF-7641: Reduce allocations in CachingXmlEventWriter (#3592)" }, { "commit": "4852a8d42278bb434043020d1d594550940b9239", "tree": "d21f989ce416f279fe88031a891fd83a0871a580", "parents": [ "47dd3136f8a9afd4fdda5fd2ecf717caa5b497d0" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 16 11:08:46 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 11:08:46 2026 -0400" }, "message": "Bump cxf.tomcat.version from 11.0.26 to 11.0.27 (#3585)\n\nBumps `cxf.tomcat.version` from 11.0.26 to 11.0.27.\n\nUpdates `org.apache.tomcat.embed:tomcat-embed-core` from 11.0.26 to 11.0.27\n\nUpdates `org.apache.tomcat:tomcat-jasper` from 11.0.26 to 11.0.27\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.tomcat.embed:tomcat-embed-core\n dependency-version: 11.0.27\n dependency-type: direct:development\n update-type: version-update:semver-patch\n- dependency-name: org.apache.tomcat:tomcat-jasper\n dependency-version: 11.0.27\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "47dd3136f8a9afd4fdda5fd2ecf717caa5b497d0", "tree": "9ed0030b52a58daaa0d0c420f6049c75870d22aa", "parents": [ "df01f78e0bae55026647835c1d8ceaf6bcbcd296" ], "author": { "name": "Freeman(Yue) Fang", "email": "freeman.fang@gmail.com", "time": "Fri Oct 16 11:05:36 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 11:05:36 2026 -0400" }, "message": "CXF-8542: Add a regression test for MTOM attachment stream failures (#3593)\n\nIf the InputStream of an MTOM attachment\u0027s DataHandler throws an\nIOException while the server is writing the response, the client must\nnot receive the truncated data as if it were complete. This has been\nfixed by CXF-9057, which aborts the response in that case.\n\nThe new test fails the attachment stream after 1 KB (response not yet\ncommitted) and after 1 MB (response committed), with both the default\nHttpClient conduit and the URLConnection conduit, and checks that the\nclient either gets an exception from the invocation or an IOException\nwhile reading the attachment. Unlike the CXF-9057 tests, it uses an\nIOException (as in the report) at a deterministic position. It fails\nwithout the CXF-9057 changes." }, { "commit": "df01f78e0bae55026647835c1d8ceaf6bcbcd296", "tree": "90956ba045f4dfeb1ce8a14f4feca47890ec5d7d", "parents": [ "5d3ce9f7983e3167fbaf300236b1fce9af51cd22" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Fri Oct 16 12:22:11 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 12:22:11 2026 +0100" }, "message": "CXF-6301: Deliver faults marked as partial responses to async callbacks (#3591)" }, { "commit": "5d3ce9f7983e3167fbaf300236b1fce9af51cd22", "tree": "608d16245ba2879ff484d018cf986cd7e1a62c5d", "parents": [ "97b71be98b3acc169217de3d9305873e02a74297" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Fri Oct 16 12:21:59 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 12:21:59 2026 +0100" }, "message": "CXF-8184 - Use the thread default bus in AbstractToolContainer.getBus() (#3590)" }, { "commit": "97b71be98b3acc169217de3d9305873e02a74297", "tree": "63c5c819601df120b104233effc588fab49fb531", "parents": [ "b09da5d02ba7436aac2a907633a74cc56179a729" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 16 06:22:15 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 06:22:15 2026 -0400" }, "message": "Bump cxf.hibernate.em.version from 7.4.12.Final to 7.4.13.Final (#3589)\n\nBumps `cxf.hibernate.em.version` from 7.4.12.Final to 7.4.13.Final.\n\nUpdates `org.hibernate.orm:hibernate-core` from 7.4.12.Final to 7.4.13.Final\n- [Release notes](https://github.com/hibernate/hibernate-orm/releases)\n- [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.13/changelog.txt)\n- [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.12...7.4.13)\n\nUpdates `org.hibernate.orm:hibernate-jcache` from 7.4.12.Final to 7.4.13.Final\n- [Release notes](https://github.com/hibernate/hibernate-orm/releases)\n- [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.13/changelog.txt)\n- [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.12...7.4.13)\n\n---\nupdated-dependencies:\n- dependency-name: org.hibernate.orm:hibernate-core\n dependency-version: 7.4.13.Final\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.hibernate.orm:hibernate-jcache\n dependency-version: 7.4.13.Final\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "b09da5d02ba7436aac2a907633a74cc56179a729", "tree": "398bededbc859c2d8beff6460515af56b4348b79", "parents": [ "6526e3787adcc15b0bc54b517d6a352019bca9e7" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Fri Oct 16 08:10:07 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 08:10:07 2026 +0100" }, "message": "CXF-7903: Preserve reason phrase in ResponseContext.setStatusInfo (#3588)" }, { "commit": "6526e3787adcc15b0bc54b517d6a352019bca9e7", "tree": "e2db8af43aac94836ce29c1beb2bd2f63688aec1", "parents": [ "2e16926ff8b76389261e0d754ab20a4de7a3b225" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Fri Oct 16 07:51:24 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 16 07:51:24 2026 +0100" }, "message": "CXF-6737: Fix binding of void operations when simple frontend client uses a WSDL (#3587)" }, { "commit": "2e16926ff8b76389261e0d754ab20a4de7a3b225", "tree": "897970ce91dac90ccb01b7c1936cfad4fd7debc2", "parents": [ "4e60057e8ba36a6525cb30e3e80b1cd67d3e67c0" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Thu Oct 15 15:57:16 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 15:57:16 2026 +0100" }, "message": "CXF-8272: Don\u0027t fail a one-way invocation if the response stream can\u0027t be drained (#3586)" }, { "commit": "4e60057e8ba36a6525cb30e3e80b1cd67d3e67c0", "tree": "65f64833503b151a2a71f2a0e88fd7dea6e70a7a", "parents": [ "14ceb7c13ac7b8076f0b282d49adccb83e221d51" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Thu Oct 15 09:30:36 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 09:30:36 2026 +0100" }, "message": "CXF-4586: Look up bean definitions in parent contexts in SpringBeanLocator (#3581)" }, { "commit": "14ceb7c13ac7b8076f0b282d49adccb83e221d51", "tree": "890c6699043a10b7fc22ac25b18f8a917437a181", "parents": [ "e75dd014fc580781f46df41c2ce60efb555d7f93" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Thu Oct 15 09:29:41 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 15 09:29:41 2026 +0100" }, "message": "Removing unused version (#3582)" }, { "commit": "e75dd014fc580781f46df41c2ce60efb555d7f93", "tree": "c336ff50b279c08f7ef2323d77d6f0aabf6e5b2d", "parents": [ "812044933a0f3cca017964ec7ff077bab46376ac" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 14 20:50:05 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 20:50:05 2026 -0400" }, "message": "Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#3583)\n\nBumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.1 to 7.0.2.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9)\n\n---\nupdated-dependencies:\n- dependency-name: actions/upload-artifact\n dependency-version: 7.0.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "812044933a0f3cca017964ec7ff077bab46376ac", "tree": "37f97d2d588965631ad19ddbdd07de0a036f158b", "parents": [ "f9345b926dd1a9293341bce2e3d41324c419d895" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 14 20:49:47 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 20:49:47 2026 -0400" }, "message": "Bump the codeql-action group with 3 updates (#3584)\n\nBumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).\n\n\nUpdates `github/codeql-action/init` from 4.38.2 to 4.38.3\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d)\n\nUpdates `github/codeql-action/analyze` from 4.38.2 to 4.38.3\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d)\n\nUpdates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d)\n\n---\nupdated-dependencies:\n- dependency-name: github/codeql-action/init\n dependency-version: 4.38.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: codeql-action\n- dependency-name: github/codeql-action/analyze\n dependency-version: 4.38.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: codeql-action\n- dependency-name: github/codeql-action/upload-sarif\n dependency-version: 4.38.3\n dependency-type: direct:production\n update-type: version-update:semver-patch\n dependency-group: codeql-action\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "f9345b926dd1a9293341bce2e3d41324c419d895", "tree": "73c8af3e4fe34e8fd51d00e8e93eec39cff6c3ba", "parents": [ "93edb1243a65cde4f1274026ca193bf591c155ed" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 14 18:20:30 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 18:20:30 2026 -0400" }, "message": "Bump org.jboss.arquillian.container:arquillian-weld-embedded (#3580)\n\nBumps org.jboss.arquillian.container:arquillian-weld-embedded from 4.0.0.Final to 4.0.1.Final.\n\n---\nupdated-dependencies:\n- dependency-name: org.jboss.arquillian.container:arquillian-weld-embedded\n dependency-version: 4.0.1.Final\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "93edb1243a65cde4f1274026ca193bf591c155ed", "tree": "dfe726133866306c846556763de1e98f03dfc680", "parents": [ "1270427bb5a0eef16e45edad62252192b490b7e0" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 14 17:05:59 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 17:05:59 2026 -0400" }, "message": "Bump cxf.tomcat.version from 11.0.26 to 11.0.27 (#3578)\n\nBumps `cxf.tomcat.version` from 11.0.26 to 11.0.27.\n\nUpdates `org.apache.tomcat.embed:tomcat-embed-core` from 11.0.26 to 11.0.27\n\nUpdates `org.apache.tomcat:tomcat-jasper` from 11.0.26 to 11.0.27\n\nUpdates `org.apache.tomcat.embed:tomcat-embed-jasper` from 11.0.26 to 11.0.27\n\nUpdates `org.apache.tomcat:tomcat-jasper-el` from 11.0.26 to 11.0.27\n\nUpdates `org.apache.tomcat:tomcat-jsp-api` from 11.0.26 to 11.0.27\n\nUpdates `org.apache.tomcat.embed:tomcat-embed-websocket` from 11.0.26 to 11.0.27\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.tomcat.embed:tomcat-embed-core\n dependency-version: 11.0.27\n dependency-type: direct:development\n update-type: version-update:semver-patch\n- dependency-name: org.apache.tomcat:tomcat-jasper\n dependency-version: 11.0.27\n dependency-type: direct:development\n update-type: version-update:semver-patch\n- dependency-name: org.apache.tomcat.embed:tomcat-embed-jasper\n dependency-version: 11.0.27\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.tomcat:tomcat-jasper-el\n dependency-version: 11.0.27\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.tomcat:tomcat-jsp-api\n dependency-version: 11.0.27\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.tomcat.embed:tomcat-embed-websocket\n dependency-version: 11.0.27\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "1270427bb5a0eef16e45edad62252192b490b7e0", "tree": "f80ababcd238127a5e8e533fc867784228ea895c", "parents": [ "f987c6d38c314dc8dfdb7578971f9b2d28e6209a" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 14 17:05:37 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 17:05:37 2026 -0400" }, "message": "Bump cxf.openfeign.version from 13.16 to 13.17 (#3579)\n\nBumps `cxf.openfeign.version` from 13.16 to 13.17.\n\nUpdates `io.github.openfeign:feign-core` from 13.16 to 13.17\n- [Release notes](https://github.com/openfeign/feign/releases)\n- [Changelog](https://github.com/OpenFeign/feign/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/openfeign/feign/compare/13.16...13.17)\n\nUpdates `io.github.openfeign:feign-httpclient` from 13.16 to 13.17\n- [Release notes](https://github.com/openfeign/feign/releases)\n- [Changelog](https://github.com/OpenFeign/feign/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/openfeign/feign/compare/13.16...13.17)\n\nUpdates `io.github.openfeign:feign-micrometer` from 13.16 to 13.17\n- [Release notes](https://github.com/openfeign/feign/releases)\n- [Changelog](https://github.com/OpenFeign/feign/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/openfeign/feign/compare/13.16...13.17)\n\n---\nupdated-dependencies:\n- dependency-name: io.github.openfeign:feign-core\n dependency-version: \u002713.17\u0027\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: io.github.openfeign:feign-httpclient\n dependency-version: \u002713.17\u0027\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: io.github.openfeign:feign-micrometer\n dependency-version: \u002713.17\u0027\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "f987c6d38c314dc8dfdb7578971f9b2d28e6209a", "tree": "738d11b2130a5dd30b1b9b9cc703ad83bc8556e0", "parents": [ "1913add0edc2de7bdba764ee8bc7823ca93905c0" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Wed Oct 14 17:04:43 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 17:04:43 2026 -0400" }, "message": "Bump org.bouncycastle:bctls-jdk18on from 1.86.1 to 1.86.2 (#3577)\n\nBumps [org.bouncycastle:bctls-jdk18on](https://github.com/bcgit/bc-java) from 1.86.1 to 1.86.2.\n- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md)\n- [Commits](https://github.com/bcgit/bc-java/commits)\n\n---\nupdated-dependencies:\n- dependency-name: org.bouncycastle:bctls-jdk18on\n dependency-version: 1.86.2\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "1913add0edc2de7bdba764ee8bc7823ca93905c0", "tree": "1f3bee7a1da7850e9d34c167b0363e0cac8777c2", "parents": [ "aaf62b79ff7e6bb7cf193ea94d8c7031a3aa5b81" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Wed Oct 14 16:45:59 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 16:45:59 2026 +0100" }, "message": "CXF-7214: Throw a Fault instead of an NPE when no conduit is available (#3576)" }, { "commit": "aaf62b79ff7e6bb7cf193ea94d8c7031a3aa5b81", "tree": "2812d2d732c28b81bffeaef7f7c3328cde38cde4", "parents": [ "7fb40bdd92fa24758254d370360ecb54af040a75" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Wed Oct 14 13:31:14 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 13:31:14 2026 +0100" }, "message": "CXF-7330: Require all type variable bounds to match when selecting providers (#3575)" }, { "commit": "7fb40bdd92fa24758254d370360ecb54af040a75", "tree": "a9b724fae197ddd9b4601161c23be21f19b55769", "parents": [ "1933b4b6640066f06ca4f20ffa91e9aac39221f1" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Wed Oct 14 11:48:58 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 14 11:48:58 2026 +0100" }, "message": "CXF-8297 - Fix NPE in Aegis for generic array properties (e.g. T[]) (#3574)" }, { "commit": "1933b4b6640066f06ca4f20ffa91e9aac39221f1", "tree": "09eaec84716efec07e40148dbfdbd4adc6d19344", "parents": [ "3348a09d89e5e2b8e3de41132d9b9cd5d68b3b50" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Tue Oct 13 09:58:55 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 09:58:55 2026 -0400" }, "message": "Improve logging in case of forceable stream closure (#3557)" }, { "commit": "3348a09d89e5e2b8e3de41132d9b9cd5d68b3b50", "tree": "0f9f85ab2980a9491566f006e176591918d07068", "parents": [ "5e5862019d01d6e545fe165a62ae42a6e4c8e8b2" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Tue Oct 13 13:38:15 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 13:38:15 2026 +0100" }, "message": "CXF-6821: Apply @XmlJavaTypeAdapter to list/array members of exceptions (#3573)" }, { "commit": "5e5862019d01d6e545fe165a62ae42a6e4c8e8b2", "tree": "3416d403feae36509409e8ed7e5cea562e6239ae", "parents": [ "f23386005410ae1a51962da209633ef517129473" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Tue Oct 13 07:59:30 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Oct 13 07:59:30 2026 +0100" }, "message": "CXF-6880 - Resolve generic property types in search condition parsers (#3571)\n\n* CXF-6880 - Resolve generic property types in search condition parsers\n\n* Addressing review comment" }, { "commit": "f23386005410ae1a51962da209633ef517129473", "tree": "ead343da2675f6e5699ae164b76d7581b4ed86d1", "parents": [ "1866ccc5c998c32d3bb5109f91f4cee6ce3ef497" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Mon Oct 12 16:19:10 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 16:19:10 2026 +0100" }, "message": "CXF-8922: Default form-data parts without Content-Type to text/plain (#3563)\n\n* CXF-8922: Default form-data parts without Content-Type to text/plain\n\n* Addressing review comments" }, { "commit": "1866ccc5c998c32d3bb5109f91f4cee6ce3ef497", "tree": "b7798c09a6ed98a8903c75a46dea8d3e8a76eee4", "parents": [ "4d774b55aa81d198faba7f2f8c2985dfdd69e572" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Mon Oct 12 09:59:49 2026 -0400" }, "committer": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Mon Oct 12 09:59:49 2026 -0400" }, "message": "Update OpenTelemetry to 1.67.0\n" }, { "commit": "4d774b55aa81d198faba7f2f8c2985dfdd69e572", "tree": "bd0adea70209e20944fd5d73a6a9e8845ddd7ecb", "parents": [ "34f00d9a8744709cc096b2b5a96a8988fa2a8a2f" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 12 09:10:38 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 09:10:38 2026 -0400" }, "message": "Bump commons-codec:commons-codec from 1.22.1 to 1.23.0 (#3567)\n\nBumps [commons-codec:commons-codec](https://github.com/apache/commons-codec) from 1.22.1 to 1.23.0.\n- [Changelog](https://github.com/apache/commons-codec/blob/master/RELEASE-NOTES.txt)\n- [Commits](https://github.com/apache/commons-codec/compare/rel/commons-codec-1.22.1...rel/commons-codec-1.23.0)\n\n---\nupdated-dependencies:\n- dependency-name: commons-codec:commons-codec\n dependency-version: 1.23.0\n dependency-type: direct:development\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "34f00d9a8744709cc096b2b5a96a8988fa2a8a2f", "tree": "5ac77ac9add39a0630d20242b0642e5d65d7e5c7", "parents": [ "9563ac742ac55ebdde9ca850536c07b47ce8c96e" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 12 09:10:14 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 09:10:14 2026 -0400" }, "message": "Bump cxf.openfeign.version from 13.15 to 13.16 (#3568)\n\nBumps `cxf.openfeign.version` from 13.15 to 13.16.\n\nUpdates `io.github.openfeign:feign-core` from 13.15 to 13.16\n- [Release notes](https://github.com/openfeign/feign/releases)\n- [Changelog](https://github.com/OpenFeign/feign/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/openfeign/feign/compare/13.15...13.16)\n\nUpdates `io.github.openfeign:feign-httpclient` from 13.15 to 13.16\n- [Release notes](https://github.com/openfeign/feign/releases)\n- [Changelog](https://github.com/OpenFeign/feign/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/openfeign/feign/compare/13.15...13.16)\n\nUpdates `io.github.openfeign:feign-micrometer` from 13.15 to 13.16\n- [Release notes](https://github.com/openfeign/feign/releases)\n- [Changelog](https://github.com/OpenFeign/feign/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/openfeign/feign/compare/13.15...13.16)\n\n---\nupdated-dependencies:\n- dependency-name: io.github.openfeign:feign-core\n dependency-version: \u002713.16\u0027\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: io.github.openfeign:feign-httpclient\n dependency-version: \u002713.16\u0027\n dependency-type: direct:production\n update-type: version-update:semver-minor\n- dependency-name: io.github.openfeign:feign-micrometer\n dependency-version: \u002713.16\u0027\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "9563ac742ac55ebdde9ca850536c07b47ce8c96e", "tree": "f2e9f03859fb2b52f56213ec155815060b7ac582", "parents": [ "aa3f97da787527ea1bb86169d6696599e6fbf670" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 12 09:09:54 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 09:09:54 2026 -0400" }, "message": "Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.4 to 5.6.5 (#3570)\n\nBumps [org.apache.httpcomponents.client5:httpclient5](https://github.com/apache/httpcomponents-client) from 5.6.4 to 5.6.5.\n- [Changelog](https://github.com/apache/httpcomponents-client/blob/rel/v5.6.5/RELEASE_NOTES.txt)\n- [Commits](https://github.com/apache/httpcomponents-client/compare/rel/v5.6.4...rel/v5.6.5)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.httpcomponents.client5:httpclient5\n dependency-version: 5.6.5\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "aa3f97da787527ea1bb86169d6696599e6fbf670", "tree": "f0b47619bd6c97aba7befd00aab0df0878c11a36", "parents": [ "bb008bc2232f48fea2e28e1c8cc4a0065c6d4d11" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Mon Oct 12 09:09:33 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 09:09:33 2026 -0400" }, "message": "Bump cxf.lucene.version from 10.5.1 to 10.5.2 (#3566)\n\nBumps `cxf.lucene.version` from 10.5.1 to 10.5.2.\n\nUpdates `org.apache.lucene:lucene-core` from 10.5.1 to 10.5.2\n\nUpdates `org.apache.lucene:lucene-analysis-common` from 10.5.1 to 10.5.2\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.lucene:lucene-core\n dependency-version: 10.5.2\n dependency-type: direct:development\n update-type: version-update:semver-patch\n- dependency-name: org.apache.lucene:lucene-analysis-common\n dependency-version: 10.5.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "bb008bc2232f48fea2e28e1c8cc4a0065c6d4d11", "tree": "3101034767dbde758cac0b0eb6afda935f38c984", "parents": [ "cca9715fb00577b31a74a85f2fabbc8feff08bb5" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Mon Oct 12 09:25:40 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 09:25:40 2026 +0100" }, "message": "Migrate site descriptor to the Maven site model 2.0.0 (#3564)" }, { "commit": "cca9715fb00577b31a74a85f2fabbc8feff08bb5", "tree": "bcff7d019b5919890c7bab0ab5d48045d1f4a9f3", "parents": [ "1c26767cc60aeaba2c265d31abd01f1897e5d6ea" ], "author": { "name": "Markus Heiden", "email": "markus@markusheiden.de", "time": "Sun Oct 11 20:00:00 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Oct 11 14:00:00 2026 -0400" }, "message": "CXF-9257: Complete client futures if the async callback throws (#3565)\n\n* Complete client futures if the async callback throws\n\nJaxrsClientCallback and JaxwsClientCallback invoke the user\u0027s callback\nbefore completing their future. If the callback throws, the exception\nescapes and the future is never completed, so threads blocked in\nFuture.get() hang forever. In the JAX-WS case ClientImpl additionally\ncatches the exception and invokes the same callback a second time.\n\nGuard every callback invocation:\n- If the callback throws while handling a successful response, the\n future completes exceptionally with that exception, like the JAX-WS\n reference implementation does.\n- If the callback throws while handling a failure, cancellation or\n interruption, the original exception is kept and the callback\u0027s\n exception is attached as a suppressed exception.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_0149ipFQyLFL9z5WdmhCRg3r\n\n* Follow the callback contract instead of guarding handleResponse\n\nCXF callers invoke ClientCallback.handleException() if handleResponse()\nthrows, so the callbacks don\u0027t need to guard the success path. Revert\nthose guards and fix the call sites that don\u0027t follow the contract:\nClientImpl\u0027s fault observer wrapper and WebClient\u0027s\nClientAsyncResponseInterceptor.\n\nThe failure paths stay guarded in the callbacks, because callers can\u0027t\ncomplete the future if handleException() throws. Don\u0027t add a callback\nexception as suppressed to itself, which would throw\nIllegalArgumentException if the callback rethrows the exception it was\ngiven.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_01Ka6VjhpAcDrSERoiLP2Cxx\n\n---------\n\nCo-authored-by: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e" }, { "commit": "1c26767cc60aeaba2c265d31abd01f1897e5d6ea", "tree": "696c7f790b9484269d5c3ce7190d3f3857a50641", "parents": [ "c155360d4543f129dedb18818d0cefcc61dd343e" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Fri Oct 09 10:00:38 2026 -0400" }, "committer": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Fri Oct 09 10:00:38 2026 -0400" }, "message": "Update ASM to 9.11\n" }, { "commit": "c155360d4543f129dedb18818d0cefcc61dd343e", "tree": "57a5ef46c4c9eaa325639177068240e0e83c6ca6", "parents": [ "c6be0ba580008bab15a3f1103d73af12abe42b88" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Fri Oct 09 11:54:36 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 06:54:36 2026 -0400" }, "message": "CXF-7455 - Don\u0027t fail in HolderInInterceptor when a response omits an out part (#3562)" }, { "commit": "c6be0ba580008bab15a3f1103d73af12abe42b88", "tree": "3c68b45442b32d48163cf484fc310facf5670aa8", "parents": [ "3ee6bbb8cbc1760e7e25be40e63e6a8fd2a8d1fb" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 09 06:15:16 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 06:15:16 2026 -0400" }, "message": "Bump cxf.lucene.version from 10.5.1 to 10.5.2 (#3558)\n\nBumps `cxf.lucene.version` from 10.5.1 to 10.5.2.\n\nUpdates `org.apache.lucene:lucene-core` from 10.5.1 to 10.5.2\n\nUpdates `org.apache.lucene:lucene-analysis-common` from 10.5.1 to 10.5.2\n\nUpdates `org.apache.lucene:lucene-queryparser` from 10.5.1 to 10.5.2\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.lucene:lucene-core\n dependency-version: 10.5.2\n dependency-type: direct:development\n update-type: version-update:semver-patch\n- dependency-name: org.apache.lucene:lucene-analysis-common\n dependency-version: 10.5.2\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.apache.lucene:lucene-queryparser\n dependency-version: 10.5.2\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "3ee6bbb8cbc1760e7e25be40e63e6a8fd2a8d1fb", "tree": "bb6f3d0c64a758322390a4636746d8e46e76f293", "parents": [ "5cf280ff008e17c3ef4b60927a79e83ae75a6643" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 09 06:14:56 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 06:14:56 2026 -0400" }, "message": "Bump org.webjars:swagger-ui from 5.32.15 to 5.33.1 (#3559)\n\nBumps [org.webjars:swagger-ui](https://github.com/swagger-api/swagger-ui) from 5.32.15 to 5.33.1.\n- [Release notes](https://github.com/swagger-api/swagger-ui/releases)\n- [Commits](https://github.com/swagger-api/swagger-ui/compare/v5.32.15...v5.33.1)\n\n---\nupdated-dependencies:\n- dependency-name: org.webjars:swagger-ui\n dependency-version: 5.33.1\n dependency-type: direct:production\n update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "5cf280ff008e17c3ef4b60927a79e83ae75a6643", "tree": "624ab81dba56309d2ee9204e7f8cba48dcfcc652", "parents": [ "a8ff134ae9302f538cea9eda9ebce6b902637d78" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 09 06:14:40 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 06:14:40 2026 -0400" }, "message": "Bump io.undertow.ee:undertow-servlet from 2.0.2.Final to 2.0.3.Final (#3560)\n\nBumps [io.undertow.ee:undertow-servlet](https://github.com/undertow-io/undertow-ee) from 2.0.2.Final to 2.0.3.Final.\n- [Release notes](https://github.com/undertow-io/undertow-ee/releases)\n- [Commits](https://github.com/undertow-io/undertow-ee/compare/2.0.2.Final...2.0.3.Final)\n\n---\nupdated-dependencies:\n- dependency-name: io.undertow.ee:undertow-servlet\n dependency-version: 2.0.3.Final\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "a8ff134ae9302f538cea9eda9ebce6b902637d78", "tree": "6122cdd918650ff2c4bcdb9e94beb329d0126bf8", "parents": [ "09c8edc6fce0208ae523d44612ac4b603a027738" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Fri Oct 09 06:14:23 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Fri Oct 09 06:14:23 2026 -0400" }, "message": "Bump cxf.hibernate.em.version from 7.4.11.Final to 7.4.12.Final (#3561)\n\nBumps `cxf.hibernate.em.version` from 7.4.11.Final to 7.4.12.Final.\n\nUpdates `org.hibernate.orm:hibernate-core` from 7.4.11.Final to 7.4.12.Final\n- [Release notes](https://github.com/hibernate/hibernate-orm/releases)\n- [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.12/changelog.txt)\n- [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.11...7.4.12)\n\nUpdates `org.hibernate.orm:hibernate-jcache` from 7.4.11.Final to 7.4.12.Final\n- [Release notes](https://github.com/hibernate/hibernate-orm/releases)\n- [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.12/changelog.txt)\n- [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.11...7.4.12)\n\n---\nupdated-dependencies:\n- dependency-name: org.hibernate.orm:hibernate-core\n dependency-version: 7.4.12.Final\n dependency-type: direct:production\n update-type: version-update:semver-patch\n- dependency-name: org.hibernate.orm:hibernate-jcache\n dependency-version: 7.4.12.Final\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "09c8edc6fce0208ae523d44612ac4b603a027738", "tree": "f87ea875b11dfd810270779fc2df456bfb5c1a41", "parents": [ "cb99c360800551a5594ea9de2a4f159a16c62734" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Thu Oct 08 21:03:21 2026 -0400" }, "committer": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Thu Oct 08 21:03:21 2026 -0400" }, "message": "Update Jetty to 12.1.14\n" }, { "commit": "cb99c360800551a5594ea9de2a4f159a16c62734", "tree": "4849c935d8249a6abff24173b3756609a92a9916", "parents": [ "1e3987fbf1d783063ab9eabb70741306b62f3109" ], "author": { "name": "Andriy Redko", "email": "drreta@gmail.com", "time": "Thu Oct 08 11:37:16 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 08 11:37:16 2026 -0400" }, "message": "CXF-9251: Thrown exception trying to write into closed stream (#3555)\n\n* CXF-9251: Thrown exception trying to write into closed stream\n\n* Address code review comments" }, { "commit": "1e3987fbf1d783063ab9eabb70741306b62f3109", "tree": "bfd15bc6a2927501bdc139324073f2d9f0f86801", "parents": [ "4f63f8f499c13b8c802a80e60cc9e1d0578eba37" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@apache.org", "time": "Thu Oct 08 14:07:46 2026 +0100" }, "committer": { "name": "Colm O hEigeartaigh", "email": "coheigea@apache.org", "time": "Thu Oct 08 14:10:10 2026 +0100" }, "message": "Bumping build utils to 4.2.0-SNAPSHOT\n" }, { "commit": "4f63f8f499c13b8c802a80e60cc9e1d0578eba37", "tree": "6bf839d81767cf44415ffc5152d1075c64bf8c09", "parents": [ "d5097cf4a845578c83021d7062900c5e35194100" ], "author": { "name": "dependabot[bot]", "email": "49699333+dependabot[bot]@users.noreply.github.com", "time": "Thu Oct 08 08:52:42 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 08 08:52:42 2026 -0400" }, "message": "Bump io.undertow:undertow-core from 2.4.3.Final to 2.4.4.Final (#3556)\n\nBumps [io.undertow:undertow-core](https://github.com/undertow-io/undertow) from 2.4.3.Final to 2.4.4.Final.\n- [Release notes](https://github.com/undertow-io/undertow/releases)\n- [Commits](https://github.com/undertow-io/undertow/compare/2.4.3.Final...2.4.4.Final)\n\n---\nupdated-dependencies:\n- dependency-name: io.undertow:undertow-core\n dependency-version: 2.4.4.Final\n dependency-type: direct:development\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e" }, { "commit": "d5097cf4a845578c83021d7062900c5e35194100", "tree": "a86fedb6c5d4b2990577a90e1e60a77992c08fbc", "parents": [ "42209052fe58a036a7afbab15dd65373902d1fcb" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Thu Oct 08 13:31:51 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 08 13:31:51 2026 +0100" }, "message": "CXF-5502: Register the client endpoint with its Service in ClientImpl (#3552)" }, { "commit": "42209052fe58a036a7afbab15dd65373902d1fcb", "tree": "687c1c3234e71d420f1f9647ecc4c2a814fb560f", "parents": [ "b5ba52bd7b6dea4cf9ad23e5bf028389258cb8c0" ], "author": { "name": "François de Parscau", "email": "116000379+f2par0@users.noreply.github.com", "time": "Thu Oct 08 09:20:32 2026 +0200" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Oct 08 08:20:32 2026 +0100" }, "message": "Add bundleresource to URIResolver default allowed URL schemes (#3551)\n\nOSGi containers such as Apache Felix and Karaf expose bundle entries\nthrough bundleresource:// URLs. These were rejected by the URIResolver\nscheme allowlist, even though getLocalSchemes() already treats them\nas local. Allow them by default and add a unit test.\n\nCo-authored-by: Claude Sonnet 5.5 \u003cnoreply@anthropic.com\u003e" }, { "commit": "b5ba52bd7b6dea4cf9ad23e5bf028389258cb8c0", "tree": "bc0eda2a153c1c189ab70eeee6049128fbcb33f3", "parents": [ "6c072f66868f97ac560ca1adcfabe05c679c3d6c" ], "author": { "name": "Freeman(Yue) Fang", "email": "freeman.fang@gmail.com", "time": "Wed Oct 07 14:32:40 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 07 14:32:40 2026 -0400" }, "message": "[CXF-9251]Logging: don\u0027t cache writes after LoggingOutputStream is closed (#3553)\n\nSince #3541, LoggingOutputStream closes itself (and logs) when a write\nfails, and any later close() is a no-op. If something writes to the\nstream after that, and the underlying stream silently accepts writes\nafter close (as Tomcat 10.1 does), CacheAndWriteOutputStream caches\nthose bytes again. Because totalLength is never reset, they spill into\na new temp file and the stream is registered with the\nDelayedCachedOutputStreamCleaner again. When the cleaner fires, its\nclose() is a no-op, so the temp file is never deleted, not even by\nthe cleanup thread.\n\nThis happens on a client connection reset during a large response:\nthe write fails, the stream closes itself, and the fault chain\n(SoapOutEndingInterceptor) then writes the closing tags to the same\nstream.\n\nOnce closed, the write methods now only pass the bytes through to the\nflow-through stream and no longer cache them, so nothing is spilled to\ndisk after the payload has been logged.\n\nAdd 2 tests to LoggingOutInterceptorTest (write after close, write\nafter a failed write) that check the temp file is deleted after\nforceClean(); both fail without this change." }, { "commit": "6c072f66868f97ac560ca1adcfabe05c679c3d6c", "tree": "f4b241ce9270c9d67eedcb30e0855b829d12b0cb", "parents": [ "09d44eeb8b59b078a3ebd18cd846898a7fbefc51" ], "author": { "name": "Freeman(Yue) Fang", "email": "freeman.fang@gmail.com", "time": "Wed Oct 07 12:09:59 2026 -0400" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 07 12:09:59 2026 -0400" }, "message": "[CXF-9255]WS-RM: resend due messages of a sequence in message number order (#3546)\n\njava.util.Timer does not run tasks scheduled for the same time in\nscheduling order. When two messages of a sequence are cached within the\nsame millisecond, the resend of the later one could run first. With\nin-order delivery the destination holds that message back until the\nearlier one arrives, so the resend blocks the resend thread (the timer\nthread with the SynchronousExecutor) until the receive timeout, and the\nearlier message is not resent in the meantime.\n\nWhen a resend task fires, first resend any earlier message of the same\nsequence that is due no later than it and not pending or suspended, in\nmessage number order, cancelling its own scheduled task. Resend times\nare unchanged.\n\nThis made the in-order one-way tests in systests/ws-rm\n(DeliveryAssuranceOnewayTest, MessageCallbackOnewayTest) time out on\nfast machines." }, { "commit": "09d44eeb8b59b078a3ebd18cd846898a7fbefc51", "tree": "0e76e95c9a1d2a17bd35deb6f2b35bd3850ca1fa", "parents": [ "58e7d7fc7fffc66445c92667db4fd17780db5b1d" ], "author": { "name": "Colm O hEigeartaigh", "email": "coheigea@users.noreply.github.com", "time": "Wed Oct 07 13:43:08 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Oct 07 13:43:08 2026 +0100" }, "message": "CXF-7538: Don\u0027t silently drop soap:header bindings when no serviceName is configured (#3550)" } ], "next": "58e7d7fc7fffc66445c92667db4fd17780db5b1d" }