)]}'
{
  "log": [
    {
      "commit": "2aabe517acc5b6e92c02ba4377c2e2922e4a475c",
      "tree": "e2f66145e7e09c4284571b889141d6cfd477ba48",
      "parents": [
        "97b0404d0991ff8078bec3e40005f4569c6deb68"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat Oct 17 17:51:42 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Oct 17 17:51:42 2026 +0200"
      },
      "message": "build(deps): bump org.hibernate:hibernate-validator (#3008)\n\nBumps [org.hibernate:hibernate-validator](https://github.com/hibernate/hibernate-validator) from 8.0.5.Final to 8.0.6.Final.\n- [Release notes](https://github.com/hibernate/hibernate-validator/releases)\n- [Changelog](https://github.com/hibernate/hibernate-validator/blob/8.0.6.Final/changelog.txt)\n- [Commits](https://github.com/hibernate/hibernate-validator/compare/8.0.5.Final...8.0.6.Final)\n\n---\nupdated-dependencies:\n- dependency-name: org.hibernate:hibernate-validator\n  dependency-version: 8.0.6.Final\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "97b0404d0991ff8078bec3e40005f4569c6deb68",
      "tree": "86e292b89ece856c56179ffdcccc3e21e5506553",
      "parents": [
        "e306108e642005047afdfffdbfb6c64455218b45"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 16 10:22:15 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 16 10:22:15 2026 +0200"
      },
      "message": "build(deps): bump org.hibernate.orm:hibernate-core (#2999)\n\nBumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm) from 7.4.12.Final to 7.4.13.Final.\n- [Release notes](https://github.com/hibernate/hibernate-orm/releases)\n- [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.13/changelog.txt)\n- [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.12...7.4.13)\n\n---\nupdated-dependencies:\n- dependency-name: org.hibernate.orm:hibernate-core\n  dependency-version: 7.4.13.Final\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "e306108e642005047afdfffdbfb6c64455218b45",
      "tree": "2c996691f2b19db3b79015b1234245d538cc77f8",
      "parents": [
        "a8ff4fb93f6caa5e32db60246e88a50af2f85c6b"
      ],
      "author": {
        "name": "Andre Schlegel-Tylla",
        "email": "andre.schlegel-tylla@virtimo.de",
        "time": "Fri Oct 16 06:00:44 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 16 06:00:44 2026 +0200"
      },
      "message": "Fix Java version check for java.security.manager\u003dallow in karaf.bat (#3004)\n\nOnly the left operand of the comparison was quoted, so cmd compared\nstrings instead of numbers (\"21\" GTR 11 is false). As a result,\n-Djava.security.manager\u003dallow was never set on Windows, unlike bin/inc\non Unix. Use an unquoted numeric comparison like the GTR 8 check above.\n\nCo-authored-by: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "a8ff4fb93f6caa5e32db60246e88a50af2f85c6b",
      "tree": "425bd59727369a94d1d1535f191854d43f1e5f99",
      "parents": [
        "3d00b33d595a9da755bf3d3213f07772c415a0c5"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Fri Oct 16 04:57:54 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 16 05:57:54 2026 +0200"
      },
      "message": "[itests] Fix flaky LogTest (#3006)\n\nlog:set updates the pax-logging configuration asynchronously, so reading it right after can fail with \u0027Unrecognized configuration\u0027 or return the previous level. Wait for the new level to be applied instead of failing right away.\n\nlog:list and ld are aliases, not command services: don\u0027t wait 30 seconds for a service that is never registered on each call."
    },
    {
      "commit": "3d00b33d595a9da755bf3d3213f07772c415a0c5",
      "tree": "e948c32cc1aea8fe3ddfe2bfa60cb23cb5ce89c0",
      "parents": [
        "2bdd8cf7aa9682a4a8d4ad2bec54ff588e284248"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Thu Oct 15 13:30:03 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 15 14:30:03 2026 +0200"
      },
      "message": "[itests] Fix flaky WebTest (#2981)\n\n* [itests] Fix flaky WebTest by waiting for the web MBean and deployment\n\n* [itests] Retry HTTP GET in WebTest.installViaMBean until the web context is published\n\nCo-Authored-By: Claude Sonnet 5.5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Sonnet 5.5 \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "2bdd8cf7aa9682a4a8d4ad2bec54ff588e284248",
      "tree": "9831ea4fc22970780fc94f1edde4b3695e2c1e0f",
      "parents": [
        "ea2bb7a27b1f47aa066810797ce8cdc0675f02e4"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Oct 15 14:29:36 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 15 14:29:36 2026 +0200"
      },
      "message": "build(deps-dev): bump org.jline:jline from 4.4.7 to 4.4.8 (#3002)\n\nBumps [org.jline:jline](https://github.com/jline/jline3) from 4.4.7 to 4.4.8.\n- [Release notes](https://github.com/jline/jline3/releases)\n- [Commits](https://github.com/jline/jline3/compare/4.4.7...4.4.8)\n\n---\nupdated-dependencies:\n- dependency-name: org.jline:jline\n  dependency-version: 4.4.8\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "ea2bb7a27b1f47aa066810797ce8cdc0675f02e4",
      "tree": "f6242c7b7b8ccf3d11b716779d1906f8e08d68fa",
      "parents": [
        "faad2e19292022eca212b5e9f65474b009e05ef4"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Oct 14 09:26:21 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Oct 14 09:26:21 2026 +0100"
      },
      "message": "build(deps): bump redis.clients:jedis from 8.0.1 to 8.0.2 (#2996)\n\nBumps [redis.clients:jedis](https://github.com/redis/jedis) from 8.0.1 to 8.0.2.\n- [Release notes](https://github.com/redis/jedis/releases)\n- [Changelog](https://github.com/redis/jedis/blob/master/docs/release-process.md)\n- [Commits](https://github.com/redis/jedis/compare/v8.0.1...v8.0.2)\n\n---\nupdated-dependencies:\n- dependency-name: redis.clients:jedis\n  dependency-version: 8.0.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "faad2e19292022eca212b5e9f65474b009e05ef4",
      "tree": "b963c543c3fe2777d764ed607a61e9a9a3519e3a",
      "parents": [
        "c6cbfe0a976f2899bc3ddcf3f86509304e703d2f"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat Oct 10 07:44:19 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Oct 10 07:44:19 2026 +0100"
      },
      "message": "build(deps): bump org.apache.cxf:cxf-rt-frontend-jaxrs (#2985)\n\nBumps org.apache.cxf:cxf-rt-frontend-jaxrs from 4.2.3 to 4.2.4.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.cxf:cxf-rt-frontend-jaxrs\n  dependency-version: 4.2.4\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "c6cbfe0a976f2899bc3ddcf3f86509304e703d2f",
      "tree": "d63bb41f17cf940228245e505217be8dfa2ab5fc",
      "parents": [
        "ee488c36f21065a21128905a2d0c0d3c9cf9a683"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat Oct 10 07:42:54 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Oct 10 07:42:54 2026 +0100"
      },
      "message": "build(deps): bump org.apache.cxf:cxf-rt-rs-client from 4.2.3 to 4.2.4 (#2986)\n\nBumps org.apache.cxf:cxf-rt-rs-client from 4.2.3 to 4.2.4.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.cxf:cxf-rt-rs-client\n  dependency-version: 4.2.4\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "ee488c36f21065a21128905a2d0c0d3c9cf9a683",
      "tree": "88bebca6f6a923140d6e0ef91304f26633431857",
      "parents": [
        "4edbd201ad94a91c3c726007420abaa6b44444b2"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat Oct 10 07:42:22 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Oct 10 07:42:22 2026 +0100"
      },
      "message": "build(deps): bump jetty.version from 12.1.12 to 12.1.14 (#2987)\n\nBumps `jetty.version` from 12.1.12 to 12.1.14.\n\nUpdates `org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server` from 12.1.12 to 12.1.14\n\nUpdates `org.eclipse.jetty.websocket:jetty-websocket-jetty-api` from 12.1.12 to 12.1.14\n\nUpdates `org.eclipse.jetty.websocket:jetty-websocket-jetty-client` from 12.1.12 to 12.1.14\n\nUpdates `org.eclipse.jetty:jetty-server` from 12.1.12 to 12.1.14\n\n---\nupdated-dependencies:\n- dependency-name: org.eclipse.jetty.ee10.websocket:jetty-ee10-websocket-jetty-server\n  dependency-version: 12.1.14\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.eclipse.jetty.websocket:jetty-websocket-jetty-api\n  dependency-version: 12.1.14\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.eclipse.jetty.websocket:jetty-websocket-jetty-client\n  dependency-version: 12.1.14\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n- dependency-name: org.eclipse.jetty:jetty-server\n  dependency-version: 12.1.14\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "4edbd201ad94a91c3c726007420abaa6b44444b2",
      "tree": "e962ebc3f637434c50e5ae69de1cbc531aa7ef16",
      "parents": [
        "d05873d368b6f98c8f90f73af8797cf608ef0709"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat Oct 10 06:25:06 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Oct 10 06:25:06 2026 +0100"
      },
      "message": "build(deps): bump org.apache.cxf:cxf-rt-frontend-jaxws (#2988)\n\nBumps org.apache.cxf:cxf-rt-frontend-jaxws from 4.2.3 to 4.2.4.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.cxf:cxf-rt-frontend-jaxws\n  dependency-version: 4.2.4\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "d05873d368b6f98c8f90f73af8797cf608ef0709",
      "tree": "cf7b0e91164ee803f58ca2bbe5dcb167720a0ba5",
      "parents": [
        "472fa75c15bf7ad30e07e586302a9eed61e8db78"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat Oct 10 06:23:34 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Oct 10 06:23:34 2026 +0100"
      },
      "message": "build(deps): bump asm.version from 9.10.1 to 9.11 (#2990)\n\nBumps `asm.version` from 9.10.1 to 9.11.\n\nUpdates `org.ow2.asm:asm` from 9.10.1 to 9.11\n\nUpdates `org.ow2.asm:asm-util` from 9.10.1 to 9.11\n\nUpdates `org.ow2.asm:asm-tree` from 9.10.1 to 9.11\n\nUpdates `org.ow2.asm:asm-analysis` from 9.10.1 to 9.11\n\nUpdates `org.ow2.asm:asm-commons` from 9.10.1 to 9.11\n\n---\nupdated-dependencies:\n- dependency-name: org.ow2.asm:asm\n  dependency-version: \u00279.11\u0027\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n- dependency-name: org.ow2.asm:asm-util\n  dependency-version: \u00279.11\u0027\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n- dependency-name: org.ow2.asm:asm-tree\n  dependency-version: \u00279.11\u0027\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n- dependency-name: org.ow2.asm:asm-analysis\n  dependency-version: \u00279.11\u0027\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n- dependency-name: org.ow2.asm:asm-commons\n  dependency-version: \u00279.11\u0027\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "472fa75c15bf7ad30e07e586302a9eed61e8db78",
      "tree": "7ee725ce71d7f9933f764ba6eb23ea4bbda40069",
      "parents": [
        "19ef7a44dc2c51b99e661fcf5ada3b0f82a4ab7e"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat Oct 10 06:23:10 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Oct 10 06:23:10 2026 +0100"
      },
      "message": "build(deps-dev): bump org.jline:jline from 4.4.6 to 4.4.7 (#2992)\n\nBumps [org.jline:jline](https://github.com/jline/jline3) from 4.4.6 to 4.4.7.\n- [Release notes](https://github.com/jline/jline3/releases)\n- [Commits](https://github.com/jline/jline3/compare/4.4.6...4.4.7)\n\n---\nupdated-dependencies:\n- dependency-name: org.jline:jline\n  dependency-version: 4.4.7\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "19ef7a44dc2c51b99e661fcf5ada3b0f82a4ab7e",
      "tree": "f11863b7f50958638d2d370bb5db6b8fa4735d3a",
      "parents": [
        "e453bdc0ae5ec8d29da2232d966c534372dedcfc"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Oct 08 06:25:27 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 08 06:25:27 2026 +0200"
      },
      "message": "build(deps): bump org.hibernate.orm:hibernate-core (#2984)\n\nBumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm) from 7.4.11.Final to 7.4.12.Final.\n- [Release notes](https://github.com/hibernate/hibernate-orm/releases)\n- [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.12/changelog.txt)\n- [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.11...7.4.12)\n\n---\nupdated-dependencies:\n- dependency-name: org.hibernate.orm:hibernate-core\n  dependency-version: 7.4.12.Final\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "e453bdc0ae5ec8d29da2232d966c534372dedcfc",
      "tree": "a524447291daba3608da79fc3b01444c02a50f8e",
      "parents": [
        "21fc61f838d4498a389599e58de8f32a114a0c70"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Tue Oct 06 15:47:55 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 15:47:55 2026 +0200"
      },
      "message": "Fix flaky ServletExampleTest by bounding the servlet wait (#2980)\n\nThe test polled web:servlet-list in unbounded loops, so a servlet that was\nnever registered (seen with testWithScr on macOS) hung the CI job until the\n180 minute timeout. Use a bounded Awaitility wait that fails with the last\nweb:servlet-list output."
    },
    {
      "commit": "21fc61f838d4498a389599e58de8f32a114a0c70",
      "tree": "2cb3047ded12c18a99fc5824e4afa15cae7e472d",
      "parents": [
        "f7d9d4a7012e523c1825b4412e512fd7df6e9cb9"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Oct 06 14:58:29 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 14:58:29 2026 +0200"
      },
      "message": "build(deps): bump maven.resolver.version from 2.0.23 to 2.0.24 (#2964)\n\nBumps `maven.resolver.version` from 2.0.23 to 2.0.24.\n\nUpdates `org.apache.maven.resolver:maven-resolver-api` from 2.0.23 to 2.0.24\n- [Release notes](https://github.com/apache/maven-resolver/releases)\n- [Commits](https://github.com/apache/maven-resolver/compare/maven-resolver-2.0.23...maven-resolver-2.0.24)\n\nUpdates `org.apache.maven.resolver:maven-resolver-util` from 2.0.23 to 2.0.24\n- [Release notes](https://github.com/apache/maven-resolver/releases)\n- [Commits](https://github.com/apache/maven-resolver/compare/maven-resolver-2.0.23...maven-resolver-2.0.24)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven.resolver:maven-resolver-api\n  dependency-version: 2.0.24\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.apache.maven.resolver:maven-resolver-util\n  dependency-version: 2.0.24\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "f7d9d4a7012e523c1825b4412e512fd7df6e9cb9",
      "tree": "91e508b0163c62d5c33f44bf2e58c9e808ce06e7",
      "parents": [
        "479fcf3a52d073ade15a8acc0878f1f505ff8924"
      ],
      "author": {
        "name": "Holger Friedrich",
        "email": "mail@holger-friedrich.de",
        "time": "Tue Oct 06 12:04:09 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 12:04:09 2026 +0200"
      },
      "message": "[ssh] Support ed25519 keys using bouncycastle (#2927)\n\n* [ssh] Support ed25519 keys using bouncycastle\n\nEnable ssh-ed25519 in the default signature algorithms, match ed25519\nkeys in the publickey login module, and add the bouncycastle jars from\nthe distribution to the bin/client classpath.\n\nCo-Authored-By: Claude Opus 5 \u003cnoreply@anthropic.com\u003e\n\n* review comments\n\n* review comments\n\n---------\n\nCo-authored-by: Claude Opus 5 \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "479fcf3a52d073ade15a8acc0878f1f505ff8924",
      "tree": "bb7e18c872158f4576bfe3493b1d84a627c84774",
      "parents": [
        "df2b9e06c16d328c0ad831eb00c4c83c82216946"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Oct 06 10:38:15 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 10:38:15 2026 +0200"
      },
      "message": "build(deps): bump org.apache.felix:org.apache.felix.http.jetty12 (#2970)\n\nBumps org.apache.felix:org.apache.felix.http.jetty12 from 2.0.6 to 2.0.8.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.felix:org.apache.felix.http.jetty12\n  dependency-version: 2.0.8\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "df2b9e06c16d328c0ad831eb00c4c83c82216946",
      "tree": "c69f9dcf1d5e5672272522d4478a2281836127d2",
      "parents": [
        "65769559439fbe548e19efd3e378e73c60076725"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Oct 06 10:38:01 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 10:38:01 2026 +0200"
      },
      "message": "build(deps): bump dawidd6/action-download-artifact from 26 to 27 (#2968)\n\nBumps [dawidd6/action-download-artifact](https://github.com/dawidd6/action-download-artifact) from 26 to 27.\n- [Release notes](https://github.com/dawidd6/action-download-artifact/releases)\n- [Commits](https://github.com/dawidd6/action-download-artifact/compare/v26...v27)\n\n---\nupdated-dependencies:\n- dependency-name: dawidd6/action-download-artifact\n  dependency-version: \u002727\u0027\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "65769559439fbe548e19efd3e378e73c60076725",
      "tree": "789713656a4dfbbc812587a669630f695e5c0dcb",
      "parents": [
        "383adcba3a1c4ed1eb5bb4bd15e9682c5ce320e0"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Oct 06 09:00:45 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Oct 06 09:00:45 2026 +0200"
      },
      "message": "build(deps): bump maven.version from 3.9.16 to 3.10.0 (#2962)\n\n* build(deps): bump maven.version from 3.9.16 to 3.10.0\n\nBumps `maven.version` from 3.9.16 to 3.10.0.\n\nUpdates `org.apache.maven:maven-plugin-api` from 3.9.16 to 3.10.0\n- [Release notes](https://github.com/apache/maven/releases)\n- [Commits](https://github.com/apache/maven/compare/maven-3.9.16...maven-3.10.0)\n\nUpdates `org.apache.maven:maven-compat` from 3.9.16 to 3.10.0\n- [Release notes](https://github.com/apache/maven/releases)\n- [Commits](https://github.com/apache/maven/compare/maven-3.9.16...maven-3.10.0)\n\nUpdates `org.apache.maven:maven-core` from 3.9.16 to 3.10.0\n\nUpdates `org.apache.maven:maven-artifact` from 3.9.16 to 3.10.0\n\nUpdates `org.apache.maven:maven-settings` from 3.9.16 to 3.10.0\n\nUpdates `org.apache.maven:maven-settings-builder` from 3.9.16 to 3.10.0\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven:maven-plugin-api\n  dependency-version: 3.10.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n- dependency-name: org.apache.maven:maven-compat\n  dependency-version: 3.10.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n- dependency-name: org.apache.maven:maven-core\n  dependency-version: 3.10.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n- dependency-name: org.apache.maven:maven-artifact\n  dependency-version: 3.10.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n- dependency-name: org.apache.maven:maven-settings\n  dependency-version: 3.10.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n- dependency-name: org.apache.maven:maven-settings-builder\n  dependency-version: 3.10.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\n\n* Adapt BundleToArtifactTest to Maven 3.10.0\n\nDefaultArtifactHandlerManager no longer has a no-arg constructor in Maven\n3.10.0, the artifact handlers are now passed to the constructor.\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: JB Onofré \u003cjb.onofre@dremio.com\u003e"
    },
    {
      "commit": "383adcba3a1c4ed1eb5bb4bd15e9682c5ce320e0",
      "tree": "5860cb302ed56d47fed30364c12cfeca20e6a11c",
      "parents": [
        "f1294d5f57aaf10ca54a4551ed625c63a87c3f33"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Sun Oct 04 18:19:31 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Oct 04 18:19:31 2026 +0200"
      },
      "message": "Fix flaky GraphQLExampleTest (#2976)"
    },
    {
      "commit": "f1294d5f57aaf10ca54a4551ed625c63a87c3f33",
      "tree": "03d4732e5b784845c55784c1981354a447276d35",
      "parents": [
        "1f081a77192647286519b47eed3f47bef80e402e"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Sun Oct 04 17:38:18 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Oct 04 17:38:18 2026 +0200"
      },
      "message": "Fix flaky ConfigExampleTest by waiting for asynchronous configuration updates (#2971)"
    },
    {
      "commit": "1f081a77192647286519b47eed3f47bef80e402e",
      "tree": "930dff615aead293034af8cd3ac5b495f1476af8",
      "parents": [
        "97aa78763d3dc1c9a9f814d381c3a9f9665ee5d4"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Sun Oct 04 17:37:59 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Oct 04 17:37:59 2026 +0200"
      },
      "message": "Do not restart an activator when nothing changed since it started (#2973)"
    },
    {
      "commit": "97aa78763d3dc1c9a9f814d381c3a9f9665ee5d4",
      "tree": "a66d34cf1c82b7570f8963975769502f9fc28f5f",
      "parents": [
        "11282ca51c2c3de2a31d75dfe784e7a03ac617b6"
      ],
      "author": {
        "name": "CptBartender",
        "email": "fryderyk.wysocki@gmail.com",
        "time": "Sat Oct 03 07:23:04 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Oct 03 07:23:04 2026 +0200"
      },
      "message": "Fix typo in Javadoc for delegate flag description (#2967)"
    },
    {
      "commit": "11282ca51c2c3de2a31d75dfe784e7a03ac617b6",
      "tree": "eb17c61edde4cb43ebcd21145060b8f8e8b335d8",
      "parents": [
        "fc65fed77b9b25718c6bff6ff8730c65471effac"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Oct 02 05:51:34 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Oct 02 05:51:34 2026 +0200"
      },
      "message": "build(deps): bump dawidd6/action-download-artifact from 25 to 26 (#2965)\n\nBumps [dawidd6/action-download-artifact](https://github.com/dawidd6/action-download-artifact) from 25 to 26.\n- [Release notes](https://github.com/dawidd6/action-download-artifact/releases)\n- [Commits](https://github.com/dawidd6/action-download-artifact/compare/v25...v26)\n\n---\nupdated-dependencies:\n- dependency-name: dawidd6/action-download-artifact\n  dependency-version: \u002726\u0027\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "fc65fed77b9b25718c6bff6ff8730c65471effac",
      "tree": "2910ab9fffeffa251bfbdb68cbff9a47adc415fa",
      "parents": [
        "90baa9a5fbb649fcafa1546c5ba2dea6897a8889"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Oct 01 13:16:16 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 01 13:16:16 2026 +0200"
      },
      "message": "build(deps): bump sshd.version from 2.19.0 to 2.20.0 (#2952)\n\nBumps `sshd.version` from 2.19.0 to 2.20.0.\n\nUpdates `org.apache.sshd:sshd-osgi` from 2.19.0 to 2.20.0\n- [Release notes](https://github.com/apache/mina-sshd/releases)\n- [Changelog](https://github.com/apache/mina-sshd/blob/master/CHANGES.md)\n- [Commits](https://github.com/apache/mina-sshd/compare/sshd-2.19.0...sshd-2.20.0)\n\nUpdates `org.apache.sshd:sshd-scp` from 2.19.0 to 2.20.0\n- [Release notes](https://github.com/apache/mina-sshd/releases)\n- [Changelog](https://github.com/apache/mina-sshd/blob/master/CHANGES.md)\n- [Commits](https://github.com/apache/mina-sshd/compare/sshd-2.19.0...sshd-2.20.0)\n\nUpdates `org.apache.sshd:sshd-sftp` from 2.19.0 to 2.20.0\n- [Release notes](https://github.com/apache/mina-sshd/releases)\n- [Changelog](https://github.com/apache/mina-sshd/blob/master/CHANGES.md)\n- [Commits](https://github.com/apache/mina-sshd/compare/sshd-2.19.0...sshd-2.20.0)\n\nUpdates `org.apache.sshd:sshd-mina` from 2.19.0 to 2.20.0\n- [Release notes](https://github.com/apache/mina-sshd/releases)\n- [Changelog](https://github.com/apache/mina-sshd/blob/master/CHANGES.md)\n- [Commits](https://github.com/apache/mina-sshd/compare/sshd-2.19.0...sshd-2.20.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.sshd:sshd-osgi\n  dependency-version: 2.20.0\n  dependency-type: direct:development\n  update-type: version-update:semver-minor\n- dependency-name: org.apache.sshd:sshd-scp\n  dependency-version: 2.20.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n- dependency-name: org.apache.sshd:sshd-sftp\n  dependency-version: 2.20.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n- dependency-name: org.apache.sshd:sshd-mina\n  dependency-version: 2.20.0\n  dependency-type: direct:development\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: JB Onofré \u003cjbonofre@apache.org\u003e"
    },
    {
      "commit": "90baa9a5fbb649fcafa1546c5ba2dea6897a8889",
      "tree": "349775305c24a18cb954b8d04ec7559ea7277902",
      "parents": [
        "6e6f9ae0c009eb0e0bc935acc5869d952c24b109"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Oct 01 13:15:55 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 01 13:15:55 2026 +0200"
      },
      "message": "build(deps): bump org.hibernate.orm:hibernate-core (#2960)\n\nBumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm) from 7.4.10.Final to 7.4.11.Final.\n- [Release notes](https://github.com/hibernate/hibernate-orm/releases)\n- [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.11/changelog.txt)\n- [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.10...7.4.11)\n\n---\nupdated-dependencies:\n- dependency-name: org.hibernate.orm:hibernate-core\n  dependency-version: 7.4.11.Final\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "6e6f9ae0c009eb0e0bc935acc5869d952c24b109",
      "tree": "07f52b66ec7c0b48d9337f5ee8761d0c54063c4d",
      "parents": [
        "6e158273c9bce7e09b86f927ea2c46dbaf51d45a"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Oct 01 05:46:51 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 01 05:46:51 2026 +0200"
      },
      "message": "build(deps-dev): bump com.h2database:h2 from 2.5.250 to 2.5.252 (#2950)\n\nBumps [com.h2database:h2](https://github.com/h2database/h2database) from 2.5.250 to 2.5.252.\n- [Release notes](https://github.com/h2database/h2database/releases)\n- [Commits](https://github.com/h2database/h2database/compare/version-2.5.250...version-2.5.252)\n\n---\nupdated-dependencies:\n- dependency-name: com.h2database:h2\n  dependency-version: 2.5.252\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "6e158273c9bce7e09b86f927ea2c46dbaf51d45a",
      "tree": "f8ca7b8bb42dcfe572a1f61e1ebf7645f995629e",
      "parents": [
        "3a4d8434fe51ce891b869efc55ba108fdf2c5d36"
      ],
      "author": {
        "name": "Holger Friedrich",
        "email": "mail@holger-friedrich.de",
        "time": "Thu Oct 01 05:46:31 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 01 05:46:31 2026 +0200"
      },
      "message": "Clean up hibernate dependencies (#2958)\n\n* Remove jandex, as no longer required\n* Upgrade hibernate-models from 1.1.0 to 1.1.2 to align with\n  hibernate release\n\nSigned-off-by: Holger Friedrich \u003cmail@holger-friedrich.de\u003e"
    },
    {
      "commit": "3a4d8434fe51ce891b869efc55ba108fdf2c5d36",
      "tree": "cac84c3cf89a598602d7e5fe6e31ff19c5c74812",
      "parents": [
        "dfdbc66d42b0e2ab490cce063a25494127d15b13"
      ],
      "author": {
        "name": "Holger Friedrich",
        "email": "mail@holger-friedrich.de",
        "time": "Thu Oct 01 05:45:37 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Oct 01 05:45:37 2026 +0200"
      },
      "message": "Align stax2 and woodstox versions (#2957)\n\n* Upgrade stax2 to 4.3.1\n* Upgrade woodstox to 7.3.0\n\nSigned-off-by: Holger Friedrich \u003cmail@holger-friedrich.de\u003e"
    },
    {
      "commit": "dfdbc66d42b0e2ab490cce063a25494127d15b13",
      "tree": "e857917e9ca4051059a206cc5393a87b9f2aa70e",
      "parents": [
        "40303c87a7a76cb4a6adb9a51cf42b36ef7b2ccf"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Sep 30 11:17:26 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 30 11:17:26 2026 +0200"
      },
      "message": "build(deps): bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0 (#2953)\n\nBumps org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.commons:commons-lang3\n  dependency-version: 3.21.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "40303c87a7a76cb4a6adb9a51cf42b36ef7b2ccf",
      "tree": "83ba2d201ec1d461def8040fc077a0a38f0ea59e",
      "parents": [
        "2c2ed40a7c5ddd89a4993e73de9fb8baae2e425f"
      ],
      "author": {
        "name": "Дилян Палаузов",
        "email": "dpa-github@aegee.org",
        "time": "Tue Sep 29 08:07:38 2026 +0300"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 29 07:07:38 2026 +0200"
      },
      "message": "Make karaf-maven-example-kar working (#2948)"
    },
    {
      "commit": "2c2ed40a7c5ddd89a4993e73de9fb8baae2e425f",
      "tree": "cd2385291cd0c7cfa201a14871a827936a301aa8",
      "parents": [
        "fc08cac0373a875673a26dca0fe2cf98e623ad56"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Sep 29 07:07:23 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 29 07:07:23 2026 +0200"
      },
      "message": "build(deps-dev): bump org.jline:jline from 4.4.5 to 4.4.6 (#2947)\n\nBumps [org.jline:jline](https://github.com/jline/jline3) from 4.4.5 to 4.4.6.\n- [Release notes](https://github.com/jline/jline3/releases)\n- [Commits](https://github.com/jline/jline3/compare/4.4.5...4.4.6)\n\n---\nupdated-dependencies:\n- dependency-name: org.jline:jline\n  dependency-version: 4.4.6\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "fc08cac0373a875673a26dca0fe2cf98e623ad56",
      "tree": "8ad2d8f93ab2c8ba94b639cb5bde8fce284bfe4d",
      "parents": [
        "063978b4a6dad4d523c34f07ccf69dc1c672b4cc"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Sep 29 06:00:22 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 29 06:00:22 2026 +0200"
      },
      "message": "build(deps): bump dawidd6/action-download-artifact from 24 to 25 (#2945)\n\nBumps [dawidd6/action-download-artifact](https://github.com/dawidd6/action-download-artifact) from 24 to 25.\n- [Release notes](https://github.com/dawidd6/action-download-artifact/releases)\n- [Commits](https://github.com/dawidd6/action-download-artifact/compare/v24...v25)\n\n---\nupdated-dependencies:\n- dependency-name: dawidd6/action-download-artifact\n  dependency-version: \u002725\u0027\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "063978b4a6dad4d523c34f07ccf69dc1c672b4cc",
      "tree": "c24dad9d35b60944bb8ebdc97bcf752e95ed349a",
      "parents": [
        "d7f463e532fdd98ff115a7bc12fad0ff99fd364d"
      ],
      "author": {
        "name": "James Roome",
        "email": "refuxx@gmail.com",
        "time": "Mon Sep 28 09:04:56 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 28 05:34:56 2026 +0200"
      },
      "message": "Fixed json feature file conditionals (#2943)"
    },
    {
      "commit": "d7f463e532fdd98ff115a7bc12fad0ff99fd364d",
      "tree": "dfdc7085b23bb6cd203b25ecc9e211277f9dda73",
      "parents": [
        "ac1be01f214fc8be5e578446e9a902c6f9fae1fc"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Sep 27 18:31:16 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 27 18:31:16 2026 +0200"
      },
      "message": "build(deps): bump slf4j.version from 2.0.19 to 2.0.20 (#2940)\n\nBumps `slf4j.version` from 2.0.19 to 2.0.20.\n\nUpdates `org.slf4j:slf4j-api` from 2.0.19 to 2.0.20\n\nUpdates `org.slf4j:slf4j-jdk14` from 2.0.19 to 2.0.20\n\nUpdates `org.slf4j:slf4j-nop` from 2.0.19 to 2.0.20\n\nUpdates `org.slf4j:slf4j-simple` from 2.0.19 to 2.0.20\n\nUpdates `org.slf4j:jcl-over-slf4j` from 2.0.19 to 2.0.20\n\nUpdates `org.slf4j:slf4j-reload4j` from 2.0.19 to 2.0.20\n\n---\nupdated-dependencies:\n- dependency-name: org.slf4j:slf4j-api\n  dependency-version: 2.0.20\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.slf4j:slf4j-jdk14\n  dependency-version: 2.0.20\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.slf4j:slf4j-nop\n  dependency-version: 2.0.20\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n- dependency-name: org.slf4j:slf4j-simple\n  dependency-version: 2.0.20\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.slf4j:jcl-over-slf4j\n  dependency-version: 2.0.20\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.slf4j:slf4j-reload4j\n  dependency-version: 2.0.20\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "ac1be01f214fc8be5e578446e9a902c6f9fae1fc",
      "tree": "f3cc80eed061eff86bd25c50e448400aa59d5fd1",
      "parents": [
        "caf6683e839f36bfea03a17156d9abd32234020e"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat Sep 26 05:08:28 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 26 05:08:28 2026 +0200"
      },
      "message": "build(deps): bump jackson.version from 2.22.2 to 2.22.3 (#2941)\n\nBumps `jackson.version` from 2.22.2 to 2.22.3.\n\nUpdates `com.fasterxml.jackson.core:jackson-databind` from 2.22.2 to 2.22.3\n- [Commits](https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.22.2...jackson-databind-2.22.3)\n\nUpdates `com.fasterxml.jackson.jakarta.rs:jackson-jakarta-rs-json-provider` from 2.22.2 to 2.22.3\n\nUpdates `com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider` from 2.22.2 to 2.22.3\n\n---\nupdated-dependencies:\n- dependency-name: com.fasterxml.jackson.core:jackson-databind\n  dependency-version: 2.22.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: com.fasterxml.jackson.jakarta.rs:jackson-jakarta-rs-json-provider\n  dependency-version: 2.22.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider\n  dependency-version: 2.22.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "caf6683e839f36bfea03a17156d9abd32234020e",
      "tree": "e37e44cb6e4162dc211c7105b9ef751014fd02dc",
      "parents": [
        "ad3339e103447f8e68612c4bd5cda6b038624471"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Sep 25 06:01:04 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 25 06:01:04 2026 +0200"
      },
      "message": "build(deps): bump com.github.eirslett:frontend-maven-plugin (#2938)\n\nBumps [com.github.eirslett:frontend-maven-plugin](https://github.com/eirslett/frontend-maven-plugin) from 1.15.1 to 2.0.2.\n- [Changelog](https://github.com/eirslett/frontend-maven-plugin/blob/master/CHANGELOG.md)\n- [Commits](https://github.com/eirslett/frontend-maven-plugin/compare/frontend-plugins-1.15.1...frontend-plugins-2.0.2)\n\n---\nupdated-dependencies:\n- dependency-name: com.github.eirslett:frontend-maven-plugin\n  dependency-version: 2.0.2\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "ad3339e103447f8e68612c4bd5cda6b038624471",
      "tree": "68e677540e2fa78aba9c5ab55f422e180529f5a9",
      "parents": [
        "e549ee8bd7b15927d7cf92d9de60c4be80e1ad30"
      ],
      "author": {
        "name": "Romain Manni-Bucau",
        "email": "rmannibucau@gmail.com",
        "time": "Thu Sep 24 06:35:52 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 24 06:35:52 2026 +0200"
      },
      "message": "[manual] enhance theme based on karaf-site proposal (#2905)"
    },
    {
      "commit": "e549ee8bd7b15927d7cf92d9de60c4be80e1ad30",
      "tree": "0d7837b9605a2f8eb4ee1117323e390715a16706",
      "parents": [
        "8e416c566198e869e73571509a5cee0e88cb224f"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Sep 24 06:35:20 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 24 06:35:20 2026 +0200"
      },
      "message": "build(deps): bump org.hibernate.orm:hibernate-core (#2936)\n\nBumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm) from 7.4.9.Final to 7.4.10.Final.\n- [Release notes](https://github.com/hibernate/hibernate-orm/releases)\n- [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.10/changelog.txt)\n- [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.9...7.4.10)\n\n---\nupdated-dependencies:\n- dependency-name: org.hibernate.orm:hibernate-core\n  dependency-version: 7.4.10.Final\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "8e416c566198e869e73571509a5cee0e88cb224f",
      "tree": "a2492d9167d449cd169975789acbd0e8fd276158",
      "parents": [
        "badfe9ddfc39896af9058baac62e471474432d41"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Sep 24 06:34:58 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 24 06:34:58 2026 +0200"
      },
      "message": "build(deps): bump org.apache:apache from 39 to 40 (#2935)\n\nBumps [org.apache:apache](https://github.com/apache/maven-apache-parent) from 39 to 40.\n- [Release notes](https://github.com/apache/maven-apache-parent/releases)\n- [Commits](https://github.com/apache/maven-apache-parent/commits)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache:apache\n  dependency-version: \u002740\u0027\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "badfe9ddfc39896af9058baac62e471474432d41",
      "tree": "f21485d0fb57e990d76f7ad7ec478405c7406638",
      "parents": [
        "dc5f6152f6dcee6ed0e61f745da0316dc33666c0"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Sep 22 10:11:31 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 22 10:11:31 2026 +0200"
      },
      "message": "build(deps): bump org.hibernate.orm:hibernate-core (#2932)\n\nBumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm) from 7.4.8.Final to 7.4.9.Final.\n- [Release notes](https://github.com/hibernate/hibernate-orm/releases)\n- [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.9/changelog.txt)\n- [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.8...7.4.9)\n\n---\nupdated-dependencies:\n- dependency-name: org.hibernate.orm:hibernate-core\n  dependency-version: 7.4.9.Final\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "dc5f6152f6dcee6ed0e61f745da0316dc33666c0",
      "tree": "da7dd4453c594123a12132a940a3ae0ed0fbb77a",
      "parents": [
        "a41e3513e655a0a2cc5f107da5d3c9657bab6878"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Sep 22 08:23:59 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 22 08:23:59 2026 +0200"
      },
      "message": "build(deps): bump org.apache.aries.spifly:org.apache.aries.spifly.dynamic.bundle (#2931)\n\nBumps [org.apache.aries.spifly:org.apache.aries.spifly.dynamic.bundle](https://github.com/apache/aries) from 1.3.7 to 1.3.8.\n- [Release notes](https://github.com/apache/aries/releases)\n- [Commits](https://github.com/apache/aries/compare/spifly-1.3.7...spifly-1.3.8)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.aries.spifly:org.apache.aries.spifly.dynamic.bundle\n  dependency-version: 1.3.8\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "a41e3513e655a0a2cc5f107da5d3c9657bab6878",
      "tree": "f2c2216efbfe23dcf49d31e7cc14f634ef19b96f",
      "parents": [
        "a110f751036541f2e4abca25a11f00a971b706da"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Sep 22 05:40:35 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 22 05:40:35 2026 +0200"
      },
      "message": "build(deps-dev): bump org.jline:jline from 4.4.3 to 4.4.5 (#2933)\n\nBumps [org.jline:jline](https://github.com/jline/jline3) from 4.4.3 to 4.4.5.\n- [Release notes](https://github.com/jline/jline3/releases)\n- [Commits](https://github.com/jline/jline3/compare/4.4.3...4.4.5)\n\n---\nupdated-dependencies:\n- dependency-name: org.jline:jline\n  dependency-version: 4.4.5\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "a110f751036541f2e4abca25a11f00a971b706da",
      "tree": "bb5e134198b6beb1499a427a76fd2037fdbfc746",
      "parents": [
        "ac4bc3ea401d3ea980795bf8cd5376ed5134d114"
      ],
      "author": {
        "name": "Holger Friedrich",
        "email": "mail@holger-friedrich.de",
        "time": "Sun Sep 20 07:57:33 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 20 07:57:33 2026 +0200"
      },
      "message": "[test] Stop using SSH keys from .ssh folder (#2922)"
    },
    {
      "commit": "ac4bc3ea401d3ea980795bf8cd5376ed5134d114",
      "tree": "32bdb8a27087e92087eed64ce9a625ed39e2da5b",
      "parents": [
        "c039d152eb47c68c74c646f7d6f49b4d15274f63"
      ],
      "author": {
        "name": "Holger Friedrich",
        "email": "mail@holger-friedrich.de",
        "time": "Sun Sep 20 07:10:05 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 20 07:10:05 2026 +0200"
      },
      "message": "[dependabot] Pin bytebuddy and jandex to minor version (#2923)"
    },
    {
      "commit": "c039d152eb47c68c74c646f7d6f49b4d15274f63",
      "tree": "a35c25a0eec33bcfa67261616cc235841f6643f9",
      "parents": [
        "c94ffea5b7557c204a43d3332ca872f875298fd2"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Fri Sep 18 07:38:16 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 07:38:16 2026 +0200"
      },
      "message": "Update copyright year to 2026 in NOTICE files (#2917)\n\nStandardize all NOTICE files to Copyright 2007-2026 The Apache\nSoftware Foundation."
    },
    {
      "commit": "c94ffea5b7557c204a43d3332ca872f875298fd2",
      "tree": "c71b4dae7ee4ccd81a7dd825098b33597a7516a4",
      "parents": [
        "61d82017122f0b502c8c6235f03a4d01979f0d1d"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Sep 18 06:02:56 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 18 06:02:56 2026 +0200"
      },
      "message": "build(deps): bump maven.resolver.version from 2.0.22 to 2.0.23 (#2916)\n\nBumps `maven.resolver.version` from 2.0.22 to 2.0.23.\n\nUpdates `org.apache.maven.resolver:maven-resolver-api` from 2.0.22 to 2.0.23\n- [Release notes](https://github.com/apache/maven-resolver/releases)\n- [Commits](https://github.com/apache/maven-resolver/compare/maven-resolver-2.0.22...maven-resolver-2.0.23)\n\nUpdates `org.apache.maven.resolver:maven-resolver-util` from 2.0.22 to 2.0.23\n- [Release notes](https://github.com/apache/maven-resolver/releases)\n- [Commits](https://github.com/apache/maven-resolver/compare/maven-resolver-2.0.22...maven-resolver-2.0.23)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven.resolver:maven-resolver-api\n  dependency-version: 2.0.23\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.apache.maven.resolver:maven-resolver-util\n  dependency-version: 2.0.23\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "61d82017122f0b502c8c6235f03a4d01979f0d1d",
      "tree": "5cfde561985ed2c6f5bee9e5e0a57d05c65a8980",
      "parents": [
        "60c2c8452499b7090f51ea9150af88ee11aa0635"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Thu Sep 17 09:37:38 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 17 09:37:38 2026 +0200"
      },
      "message": "Restrict WebConsole plugin getResource() to /res/ paths (#2892)\n\n* Restrict WebConsole plugin getResource() to /res/ paths\n\nFeaturesPlugin, GogoPlugin, HttpPlugin and InstancePlugin override\ngetResource() and pass the request path straight to\nclassLoader.getResource() with no restriction, unlike Felix\u0027s own\nAbstractServlet.getResource() which only spools paths starting with\n/res/. Restore that check in all four plugins so only the plugins\u0027\nown static resources can be served.\n\n* Normalize path and fix dead null-check in WebConsole getResource()\n\nFeaturesPlugin, GogoPlugin, HttpPlugin and InstancePlugin checked\n`path \u003d\u003d null` after already calling `path.substring(...)` on it,\nso the check could never run (a null path throws NPE from substring\nfirst). Move the null guard before the substring call so it is\nactually effective (GogoPlugin, FeaturesPlugin, InstancePlugin had\nthis dead check; HttpPlugin gets the same guard for consistency).\n\nAlso close a residual path-traversal gap in the /res/ prefix check\nadded earlier in this branch: a request like\n/res/../forbidden_directory/secret could still satisfy\n`startsWith(\"/res/\")` before being handed to classLoader.getResource().\nNormalize the path with URI.normalize() before the prefix check, so\n\"..\" segments are resolved first and traversal attempts no longer\nstart with /res/ after normalization; a path that fails to parse as\na URI is rejected rather than passed through.\n\nAddresses PR review feedback from CptBartender and holgerfriedrich.\n\nCo-Authored-By: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\n\n---------\n\nCo-authored-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "60c2c8452499b7090f51ea9150af88ee11aa0635",
      "tree": "dc9496d3c820027fa4e81f3c18d9a4435b80d3fd",
      "parents": [
        "54c6fb156e528b3f3631c26a96121ed8a38f2458"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Sep 16 23:38:48 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 16 23:38:48 2026 +0200"
      },
      "message": "build(deps): bump org.hibernate.orm:hibernate-core (#2913)\n\nBumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm) from 7.4.7.Final to 7.4.8.Final.\n- [Release notes](https://github.com/hibernate/hibernate-orm/releases)\n- [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.8/changelog.txt)\n- [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.7...7.4.8)\n\n---\nupdated-dependencies:\n- dependency-name: org.hibernate.orm:hibernate-core\n  dependency-version: 7.4.8.Final\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "54c6fb156e528b3f3631c26a96121ed8a38f2458",
      "tree": "effe04b95ca889714bfdb62473e96a6248984cc3",
      "parents": [
        "b4831ef9798acff36c601298476120942f97aa3a"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Wed Sep 16 16:02:16 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 16 16:02:16 2026 +0200"
      },
      "message": "Update security scope (#2912)"
    },
    {
      "commit": "b4831ef9798acff36c601298476120942f97aa3a",
      "tree": "3d94aa6691d7fbf10b71f0fcf73ce792d3558ba3",
      "parents": [
        "2b6096baed8ad91653dd80208b24a0014c285d8a"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Sep 15 20:30:53 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 15 20:30:53 2026 +0200"
      },
      "message": "build(deps): bump org.codehaus.mojo:exec-maven-plugin (#2907)"
    },
    {
      "commit": "2b6096baed8ad91653dd80208b24a0014c285d8a",
      "tree": "edb3ab315f78c6d1527edeef9d6a86c4af9a090c",
      "parents": [
        "f1370291731882ed7c040c3d4c72acdfc33b30bc"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Sep 15 07:38:47 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 15 07:38:47 2026 +0200"
      },
      "message": "build(deps): bump org.codehaus.mojo:build-helper-maven-plugin (#2902)\n\nBumps [org.codehaus.mojo:build-helper-maven-plugin](https://github.com/mojohaus/build-helper-maven-plugin) from 3.6.1 to 3.6.2.\n- [Release notes](https://github.com/mojohaus/build-helper-maven-plugin/releases)\n- [Commits](https://github.com/mojohaus/build-helper-maven-plugin/compare/3.6.1...3.6.2)\n\n---\nupdated-dependencies:\n- dependency-name: org.codehaus.mojo:build-helper-maven-plugin\n  dependency-version: 3.6.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "f1370291731882ed7c040c3d4c72acdfc33b30bc",
      "tree": "2b3e73c04d547d8cefae3ff7bf62155e052c10b3",
      "parents": [
        "772fcec2d72bcad44328435c804a8e47f45c5f28"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Sep 15 07:38:22 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 15 07:38:22 2026 +0200"
      },
      "message": "build(deps): bump camel.version from 4.18.2 to 4.18.4 (#2903)\n\nBumps `camel.version` from 4.18.2 to 4.18.4.\n\nUpdates `org.apache.camel.karaf:apache-camel` from 4.18.2 to 4.18.4\n\nUpdates `org.apache.camel:camel-core` from 4.18.2 to 4.18.4\n\nUpdates `org.apache.camel.karaf:camel-core-osgi` from 4.18.2 to 4.18.4\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.camel.karaf:apache-camel\n  dependency-version: 4.18.4\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.apache.camel:camel-core\n  dependency-version: 4.18.4\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.apache.camel.karaf:camel-core-osgi\n  dependency-version: 4.18.4\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "772fcec2d72bcad44328435c804a8e47f45c5f28",
      "tree": "0ae9447dc5b7404b578f84df6a611d3f0d3ea257",
      "parents": [
        "751700e01ea7099877e05edccfb7a3afb7fe84f4"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Mon Sep 14 15:20:03 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 14 15:20:03 2026 +0200"
      },
      "message": "Fix race condition corrupting cfg files when updating an existing configuration (#2897)\n\n* Fix race condition corrupting cfg files when updating an existing configuration\n\nFeatureConfigInstaller.updateExistingConfig() wrote directly to the target\ncfg file when appending to / overriding an existing configuration. Since\ncfg.update() also triggers fileinstall to persist the same configuration\non the CM Event Dispatcher thread, two unsynchronized writers could hit the\nsame file at once, producing torn/corrupted content. The \"new file\" path\nalready avoided this by writing to a temp file and renaming it atomically\ninto place (KARAF-7389); this applies the same pattern to the\nexisting-file path.\n\nFixes #2805\n\n* GH-2805: Use Files.move with REPLACE_EXISTING instead of File.renameTo\n\nFile.renameTo() silently fails (returns false, no exception) on Windows\nwhen the destination already exists, leaving the cfg file stale and the\ntemp file orphaned. This broke updateExistingConfig() since it is only\ncalled when the target file already exists, causing the Windows CI job\nto fail (AppendTest).\n\n* Add fallback for atomic file move\n\nCo-authored-by: Copilot Autofix powered by AI \u003c175728472+Copilot@users.noreply.github.com\u003e\n\n---------\n\nCo-authored-by: Copilot Autofix powered by AI \u003c175728472+Copilot@users.noreply.github.com\u003e"
    },
    {
      "commit": "751700e01ea7099877e05edccfb7a3afb7fe84f4",
      "tree": "49aa37e387c4db2a398c4c0e9c0c22bc88ac6e1e",
      "parents": [
        "11a24a18d408571d5ae061a1632f335a4c2e621b"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Mon Sep 14 15:18:54 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Sep 14 15:18:54 2026 +0200"
      },
      "message": "GH-2741: Clean the OSGi bundle cache on JDK version change (#2898)\n\nThe bundle cache under data/cache can persist a bundle wiring that was\nresolved against a different JDK. After a JDK major version\nupgrade/downgrade, reusing that stale wiring can silently leave core\nbundles (e.g. Configuration Admin, File Install) without expected\nwires, so filesystem/config changes stop being detected with no error\nreported.\n\nKaraf now records the JDK specification version used on the previous\nstart in data/jdk_version. On startup, if the recorded version differs\nfrom the current one, the bundle cache is cleaned before the framework\nis created, forcing a full re-resolution. This can be disabled with\n-Dkaraf.clean.cache.on.jdk.change\u003dfalse."
    },
    {
      "commit": "11a24a18d408571d5ae061a1632f335a4c2e621b",
      "tree": "a7363aa214c8f8aa50271d84497bc0dac5ba7326",
      "parents": [
        "e637cf523263542619a84ac56f0d4a505226e6cb"
      ],
      "author": {
        "name": "Holger Friedrich",
        "email": "mail@holger-friedrich.de",
        "time": "Sun Sep 13 07:06:41 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 13 07:06:41 2026 +0200"
      },
      "message": "Upgrade bouncycastle from 1.85 to 1.86 (#2896)\n\nChangelog:\nhttps://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md"
    },
    {
      "commit": "e637cf523263542619a84ac56f0d4a505226e6cb",
      "tree": "5346d91b5dee0226f922d5465da337268dd39ec1",
      "parents": [
        "511df4e0fcdc66139dbcf2b00586801a2fece7ac"
      ],
      "author": {
        "name": "gaurav kumar pandey",
        "email": "173074125+Alwaysgaurav1@users.noreply.github.com",
        "time": "Sat Sep 12 23:01:54 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 12 19:31:54 2026 +0200"
      },
      "message": "Allow configuring base docker image in DockerfileMojo (#2785) (#2839)\n\n* Allow configuring base docker image in DockerfileMojo (#2785)\n\n- Add configurable \u0027image\u0027 parameter to DockerfileMojo defaulting to eclipse-temurin:11-jre\n- Validate \u0027image\u0027 and \u0027command\u0027 parameters, falling back to defaults on blank values and rejecting newlines\n- Add DockerfileMojoTest covering default, custom, blank fallback, and validation scenarios\n- Strengthen test-dockerfile IT verification\n- Update developer documentation with image and command parameters and fix XML typo\n\n* Address review feedback: bind command property and update docker example"
    },
    {
      "commit": "511df4e0fcdc66139dbcf2b00586801a2fece7ac",
      "tree": "48d3b9a2019b59a7cb191185259d781b4b9b4001",
      "parents": [
        "df21d0d8e3d52c5a760bf0d0641048b875e91d3f"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Sat Sep 12 13:07:01 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 12 13:07:01 2026 +0200"
      },
      "message": "Restrict feature:repo-add -i and feature:repo-remove -u to admin role (#2883)\n\n* Restrict feature:repo-add -i and feature:repo-remove -u to admin role\n\nfeature:repo-add -i and feature:repo-remove -u call\nFeaturesServiceImpl.addRepository()/removeRepository() with the\ninstall/uninstall flag set, which installs or uninstalls every\nfeature in the repository. Neither command had an ACL entry, so\nany SSH user with just the viewer role could reach this and have\nKaraf install and start an arbitrary attacker-supplied feature\nrepository, bypassing the admin-only ACL on feature:install and\nfeature:uninstall.\n\nAdd option-specific ACL rules (same pattern already used for\nbundle:refresh -f and friends) so only -i/-u require admin, while\nplain repo-add/repo-remove stay open as before.\n\n* Fix CI: add open fallback ACL rule for plain feature:repo-add/repo-remove\n\nThe regex-conditioned ACL rules (repo-add[/.*[-][i].*/], repo-remove[/.*[-][u].*/])\nhad no fallback entry for the plain command. Karaf\u0027s ACL guard treats a command\nname that has at least one ACL entry but no rule matching the current invocation\nas \"no roles allowed\" (empty role list), which denies everyone -- including\nadmin -- rather than leaving it unrestricted. This broke feature:repo-add/\nfeature:repo-remove without -i/-u for all callers, causing FeatureTest and the\nnew FeatureSshCommandSecurityTest to fail in CI with CommandNotFoundException.\n\nAdd an explicit \"repo-add \u003d viewer\" / \"repo-remove \u003d viewer\" fallback, mirroring\nthe existing pattern used for bundle:refresh -f, so the plain commands remain\nopen while -i/-u stay admin-only.\n\n* Revert incorrect open fallback for feature:repo-add/repo-remove\n\nThe previous \"Fix CI\" commit added a bare `repo-add \u003d viewer` /\n`repo-remove \u003d viewer` entry, on the theory that a command with a\nregex-specific ACL rule but no matching entry falls back to \"deny\nall, including admin\". That\u0027s not what happens: ACLConfigurationParser\nreturns Specificity.NO_MATCH for a non-matching invocation, and\ncheckSecurity() treats NO_MATCH as unrestricted access.\n\nWhat the bare `\u003d viewer` entry actually did was make the *plain*\ncommand name itself require the viewer role for visibility\n(SecuredSessionFactoryImpl.isVisible(), which checks the bare command\nname regardless of arguments). Callers with no roles at all -- like\nthe pax-exam-based FeatureTest itests, which invoke commands directly\nvia executeCommand() without any RolePrincipal -- were no longer able\nto even see feature:repo-add/repo-remove, failing with\nCommandNotFoundException instead of running the command.\n\nDropping the bare fallback restores the pre-existing behavior: the\nplain commands stay open to everyone (no ACL entry at all for the\nnon-`-i`/`-u` case), while the regex-specific rules keep requiring\nadmin only when `-i`/`-u` is present.\n\n* Restore viewer access to plain feature:repo-add/repo-remove\n\nThe regex-conditioned ACL rules added for -i/-u (repo-add[/.*[-][i].*/],\nrepo-remove[/.*[-][u].*/]) had no plain fallback entry. Karaf\u0027s shell\nguard decides command *visibility* before it knows the actual arguments\n(SecuredSessionFactoryImpl.isVisible() calls getRolesForInvocation with\nparams\u003dnull), and a command with only a regex/exact-arg ACL entry is\ntreated as requiring that entry\u0027s role for every invocation at that\nstage - so feature:repo-add/feature:repo-remove became invisible\n(\"Command not found\") to any non-admin session, even without -i/-u.\nThis broke the PR\u0027s own FeatureSshCommandSecurityTest (which expects a\nviewer to run the plain command) and the pre-existing FeatureTest cases.\n\nAdd a \"\u003d viewer\" fallback for both commands, mirroring the existing\nbundle:refresh/-f pattern in org.apache.karaf.command.acl.bundle.cfg,\nso the plain form stays open to viewer/manager/admin while -i/-u keeps\nrequiring admin.\n\nThe three pre-existing FeatureTest cases that called repo-add/repo-remove\nwith no role at all (previously fine since the commands had no ACL entry)\nnow pass an explicit viewer RolePrincipal, since introducing any ACL entry\nfor a command means invoking it requires holding a role."
    },
    {
      "commit": "df21d0d8e3d52c5a760bf0d0641048b875e91d3f",
      "tree": "bf07bf4ce7552d0abc78d545160946f82141593a",
      "parents": [
        "a3d1c631e3be618489affdf4c3e5ea8e7f03a1f6"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Sat Sep 12 07:56:04 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 12 07:56:04 2026 +0200"
      },
      "message": "fix(jdbc,jms): add command ACLs for the jdbc and jms scopes (#2864)\n\n* fix(jdbc,jms): add command ACLs for the jdbc and jms scopes\n\nThe jdbc and jms command scopes had no org.apache.karaf.command.acl.*\nconfiguration. The command guard treats an unmatched command as allowed,\nso any authenticated shell user (viewer role included) could run every\njdbc:* and jms:* command.\n\njdbc:ds-create and jms:create store a user-supplied URL into a\npax-jdbc-config / pax-jms-config factory configuration that is turned\ninto a live DataSource / ConnectionFactory. Several JDBC drivers run\ncode at connection time based on URL parameters (for instance H2\nINIT\u003dRUNSCRIPT), so creating a datasource is equivalent to arbitrary\ncode execution. jdbc:execute / jdbc:query run arbitrary SQL, and\njms:send / jms:consume / jms:move write to or destructively drain\nbroker destinations.\n\nAdd an ACL for each scope, provided by the jdbc / jms feature via a\n\u003cconfig\u003e element under a shell conditional (same mechanism as the kar\nand maven scopes):\n\n  jdbc: ds-create, ds-delete, execute, query \u003d admin;\n        ds-list, ds-info, ds-factories, tables \u003d viewer\n  jms:  create, delete, send, consume, move \u003d admin;\n        connectionfactories, info, queues, topics, count, browse \u003d viewer\n\nThis is consistent with shell:exec and config:install, which are\nalready restricted to admin. Add SSH command security itests for both\nscopes.\n\n* fix(jdbc,jms): grant admin/viewer roles in XATest for jdbc/jms shell commands\n\nKarafTestSupport.executeCommand() runs without a Subject when no Principal\nis passed, so XATest was being denied by the new jdbc/jms command ACLs with\na misleading CommandNotFoundException. XATest is currently @Ignore\u0027d, but\nfix it too so it does not regress once it is re-enabled."
    },
    {
      "commit": "a3d1c631e3be618489affdf4c3e5ea8e7f03a1f6",
      "tree": "2922aca47cc448976ed852a35992e0dfd595f5b6",
      "parents": [
        "1b889e04124d78627a2cb85a58241a949b64b0f3"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Sat Sep 12 07:55:03 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 12 07:55:03 2026 +0200"
      },
      "message": "Ensure configuration files are always written within ${karaf.etc} (#2867)\n\nConfigRepositoryImpl derived the target file from caller-supplied input\n(the felix.fileinstall.filename property and the PID / factory alias used\nto build the file name) without checking that the result stayed inside\n${karaf.etc}. Add a canonical-path containment check, shared through a new\norg.apache.karaf.util.PathUtils helper, and reuse it in\nConfigMBeanImpl.install() and the config:install command in place of the\nweaker finalname.contains(\"..\") string check."
    },
    {
      "commit": "1b889e04124d78627a2cb85a58241a949b64b0f3",
      "tree": "08d3c2f008303fcbf9c3bc6e082af50928815165",
      "parents": [
        "01d37060b9b227a75ab6e16e3e4535ea9f2ec9cd"
      ],
      "author": {
        "name": "Holger Friedrich",
        "email": "mail@holger-friedrich.de",
        "time": "Sat Sep 12 07:26:54 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 12 07:26:54 2026 +0200"
      },
      "message": "Avoid the non-varargs call warning in AsmProxyFactory (#2870)\n\n* Avoid the non-varargs call warning in AsmProxyFactory\n\nObject.class.getConstructor(null) is a non-varargs call of a varargs\nmethod, which javac reports in every CI summary. The lookup could not\nreturn anything but the no-arg constructor of Object, so its descriptor\nwas always the \"()V\" the variable was already initialized with, and the\nNoSuchMethodException was never thrown. Drop the whole construct.\n\nThe constant descriptor means the proxied class must have a no-arg\nconstructor, which nothing verified: the generated INVOKESPECIAL only\nfailed once the proxy was instantiated. Check it upfront and report it\nas an IllegalArgumentException instead.\n\nThis PR was created with help of Claude Code.\n\n* Address review findings\n\n* Improve behavior for special cases, extend tests\n\n* Reject final classes and check every proxied interface, not just the first\n\ncheckProxyable() validated classesToProxy[0] only, and the interface branch\nof createConstructor() skipped it entirely. A public final class with an\naccessible no-arg constructor therefore still passed validation and failed\nlater with a raw VerifyError when the proxy tried to extend it; a non-public\ninterface passed directly, or as a secondary entry alongside a proxyable\nclass, likewise still failed later with a raw IllegalAccessError.\n\nMove the call to checkProxyable() up into generateProxy() so it runs for\nevery entry of classesToProxy, and make it reject final classes and return\nearly (after the visibility check) for interfaces, which have no\nconstructor to validate.\n\n---------\n\nCo-authored-by: JB Onofré \u003cjb.onofre@dremio.com\u003e"
    },
    {
      "commit": "01d37060b9b227a75ab6e16e3e4535ea9f2ec9cd",
      "tree": "4c3557b33d591c466bdc42841f22eecb771b5bc3",
      "parents": [
        "2e1737886500be7628a250805d7f43fcae91ab7f"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Sat Sep 12 05:58:07 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 12 05:58:07 2026 +0200"
      },
      "message": "Reject shell metacharacters in instance javaOpts and add missing instance ACL (#2878)\n\n* Reject shell metacharacters in instance javaOpts and add missing instance ACL\n\nInstanceServiceImpl builds the child-instance launch command by concatenating\nthe caller-supplied javaOpts unquoted into a string that is ultimately handed\nto /bin/sh (via ScriptUtils/ProcessImpl), so a javaOpts value containing shell\nmetacharacters was executed as an OS command rather than passed to the JVM.\nThis was reachable through instance:create, instance:start, instance:restart\nand instance:change-opts (and the corresponding JMX operations).\n\nReject any javaOpts value that isn\u0027t valid JVM-option syntax before it is\nused to build the launch command, in both doStart() and the self-restart\nbranch of restartInstance().\n\nAlso ship org.apache.karaf.command.acl.instance.cfg, since the instance\nsubshell had no ACL config at all and therefore failed open: any\nauthenticated shell user could invoke instance:* commands regardless of\nrole. The new ACL restricts state-changing operations to admin and\nread-only ones (list/status) to viewer, matching the pattern used by the\nother command ACLs.\n\n* Fix InstanceTest to authenticate with admin/viewer roles for new instance ACL\n\nThe new org.apache.karaf.command.acl.instance.cfg restricts instance:*\ncommands to the admin (and list/status to viewer) role. InstanceTest was\ninvoking these commands without any role principal, so the secured shell\nrejected them as CommandNotFoundException, failing CI."
    },
    {
      "commit": "2e1737886500be7628a250805d7f43fcae91ab7f",
      "tree": "39e4a2591673092683d0076a8c9f78c2b7fad5cc",
      "parents": [
        "80b6182540c70b5402e1886cf628b675217d6771"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sat Sep 12 05:57:31 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 12 05:57:31 2026 +0200"
      },
      "message": "build(deps-dev): bump org.jline:jline from 4.4.2 to 4.4.3 (#2888)\n\nBumps [org.jline:jline](https://github.com/jline/jline3) from 4.4.2 to 4.4.3.\n- [Release notes](https://github.com/jline/jline3/releases)\n- [Commits](https://github.com/jline/jline3/compare/4.4.2...4.4.3)\n\n---\nupdated-dependencies:\n- dependency-name: org.jline:jline\n  dependency-version: 4.4.3\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "80b6182540c70b5402e1886cf628b675217d6771",
      "tree": "7b6ac627264cac340923b2fde8f2132e13a77816",
      "parents": [
        "2bf5992d23d59fcd75a796242a89993ec6669b4f"
      ],
      "author": {
        "name": "Holger Friedrich",
        "email": "mail@holger-friedrich.de",
        "time": "Sat Sep 12 05:57:05 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Sep 12 05:57:05 2026 +0200"
      },
      "message": "Drop guava 23 (#2889)\n\nRemove outdated guava version from Karaf. The only use was in itests and could\nbe replaced by JDK methods."
    },
    {
      "commit": "2bf5992d23d59fcd75a796242a89993ec6669b4f",
      "tree": "bd9cde230fb66c4dae90ee1897f57f2d754a97bf",
      "parents": [
        "d2cff4af220e23cbc9066b393bdb0f03931d0b68"
      ],
      "author": {
        "name": "CptBartender",
        "email": "fryderyk.wysocki@gmail.com",
        "time": "Fri Sep 11 16:48:31 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 11 16:48:31 2026 +0200"
      },
      "message": "Refactored usage of Optional\u003c\u003e as method parameters (#2720)\n\n* Refactored usage of Optional\u003c\u003e as method parameters\n\n* Fixed potential NPE"
    },
    {
      "commit": "d2cff4af220e23cbc9066b393bdb0f03931d0b68",
      "tree": "f1272fac3ccddc6556a6a6adaac6784d2b584c50",
      "parents": [
        "f14236a6ee774bc613d93a6957ddbbef3e4c4096"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Fri Sep 11 16:07:54 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 11 16:07:54 2026 +0200"
      },
      "message": "Escape %u/%dn/%fqdn substitutions in LDAP search filters (CWE-90) (#2880)\n\nLDAPCache and LDAPBackingEngine.lookupUser built search filters by\nsubstituting %u/%dn/%fqdn and only doubling backslashes, which does not\nescape *, (, ), or NUL. LDAPLoginModule and LDAPPubkeyLoginModule masked\nthis by pre-escaping the username themselves, but GSSAPILdapLoginModule\nand LDAPBackingEngine.lookupUser did not, so filter metacharacters in a\nlogin name could widen a search (e.g. a username of \"*\" matches any\nentry) and potentially over-grant roles.\n\nCentralize proper RFC 4515 filter escaping in LDAPCache/LDAPBackingEngine\nusing the existing Util.doRFC2254Encoding helper, and drop the redundant\npre-escaping in LDAPLoginModule/LDAPPubkeyLoginModule so escaping happens\nexactly once, at the point filters are built."
    },
    {
      "commit": "f14236a6ee774bc613d93a6957ddbbef3e4c4096",
      "tree": "1af2a2962fe6525c0518af8530d42297acac4dda",
      "parents": [
        "54dd45ad059168f22f83754abeea5adaa2fc5253"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Fri Sep 11 14:53:26 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 11 14:53:26 2026 +0200"
      },
      "message": "Apply the JMX RBAC guard to MBean lifecycle operations (#2865)\n\n* fix(management): apply the JMX RBAC guard to MBean lifecycle operations\n\nThe KarafMBeanServerGuard only intercepted invoke, getAttribute(s) and\nsetAttribute(s). createMBean, registerMBean and unregisterMBean went\nstraight to the delegate MBeanServer, so they were not subject to any\nrole check and behaved inconsistently with the rest of the guarded API.\n\nRoute these three operations through the guard as well:\n\n* MBeanInvocationHandler adds them to the guarded operation list.\n* KarafMBeanServerGuard resolves the required roles from the jmx.acl*\n  configuration by ObjectName and operation name (the target MBean is\n  not, or not yet, registered so no MBeanInfo introspection is done).\n  For createMBean/registerMBean the class name is passed as the\n  operation argument so ACL rules can match on it, e.g.\n  createMBean(java.lang.String)[/javax\\.management\\.loading\\..*/] \u003d admin\n* A null ObjectName falls back to the generic jmx.acl configuration.\n* The default jmx.acl.cfg maps createMBean/registerMBean/unregisterMBean\n  to the admin role (the existing \"* \u003d admin\" already covered them).\n\n* Fix Javadoc comment prematurely terminated by regex example\n\nThe ACL regex example in the handleRegistration Javadoc contained the\nliteral sequence */ (from \\..*/]), which closed the block comment early\nand broke compilation of org.apache.karaf.management.server. Escape the\ntrailing slash as \u0026#47; so the comment terminates where intended.\n\nCo-Authored-By: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nClaude-Session: https://claude.ai/code/session_017MZQYyrYzSQHdHeD6AEGXT\n\n---------\n\nCo-authored-by: Jean-Baptiste Onofré \u003cjbonofre@MacBookAir.local\u003e\nCo-authored-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e"
    },
    {
      "commit": "54dd45ad059168f22f83754abeea5adaa2fc5253",
      "tree": "9ea9f4e621a09d2b05bd398ddbd90dc72cdd6f1f",
      "parents": [
        "fdd7b11b5b5174875264613d53745349f27f0a44"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Fri Sep 11 14:48:03 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 11 14:48:03 2026 +0200"
      },
      "message": "fix(config): restrict config:install to the admin role (#2861)\n\nconfig:install writes a file fetched from an arbitrary URL into\n${karaf.etc}, which also holds users.properties, keys.properties and the\n*.acl.* files. The command had no entry in the org.apache.karaf.command.acl.config\nACL, and the command guard treats an unmatched command as allowed, so any\nauthenticated shell user could run it.\n\nAdd \"install \u003d admin\" to the config command ACL, consistent with\nconfig:delete and with bundle:install / feature:install / kar:install."
    },
    {
      "commit": "fdd7b11b5b5174875264613d53745349f27f0a44",
      "tree": "3a23c6bf70da3053dd06bf74d54ef8159d4cf474",
      "parents": [
        "d226d4502167602868791832291d2b301f4db0b1"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Sep 11 05:57:17 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Sep 11 05:57:17 2026 +0200"
      },
      "message": "build(deps-dev): bump org.eclipse.platform:org.eclipse.osgi (#2886)\n\nBumps [org.eclipse.platform:org.eclipse.osgi](https://github.com/eclipse-equinox/equinox) from 3.24.200 to 3.24.300.\n- [Commits](https://github.com/eclipse-equinox/equinox/commits)\n\n---\nupdated-dependencies:\n- dependency-name: org.eclipse.platform:org.eclipse.osgi\n  dependency-version: 3.24.300\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "d226d4502167602868791832291d2b301f4db0b1",
      "tree": "b6267c11f1874e22757662c3d79e02bd71eba974",
      "parents": [
        "39b9149ff02e2d64e87bbb0042aceef6d95d80d8"
      ],
      "author": {
        "name": "Holger Friedrich",
        "email": "mail@holger-friedrich.de",
        "time": "Thu Sep 10 16:55:06 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 10 16:55:06 2026 +0200"
      },
      "message": "Replace activation-api-1.2.1 by jakarta variant (#2621)"
    },
    {
      "commit": "39b9149ff02e2d64e87bbb0042aceef6d95d80d8",
      "tree": "be80d3ef45d2d4741313e2ec0db999d866f25ad0",
      "parents": [
        "3d60f0e7378986011e00e516d0a6001ca90918c4"
      ],
      "author": {
        "name": "Aditya Nikam",
        "email": "118399608+adityaanikam@users.noreply.github.com",
        "time": "Thu Sep 10 20:21:20 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 10 16:51:20 2026 +0200"
      },
      "message": "Use atomic move instead of delete-then-rename in SimpleDownloadTask (#2841)\n\nSimpleDownloadTask.download() staged wrap:/blueprint:/spring: bundle\nURLs into a temp file, then did:\n\n  if (file.exists() \u0026\u0026 !file.delete()) { throw ...; }\n  tmpFile.renameTo(file);\n\nTwo overlapping resolutions of the same URL (e.g. two feature\ninstalls, each with their own DownloadManager -- dedup only happens\nwithin one instance) can race: the second one\u0027s delete() removes the\nfirst one\u0027s just-written file right as a third reader opens it,\nproducing an intermittent FileNotFoundException. This shows up as\nneeding multiple restarts before a container boots cleanly.\n\nReplace the delete-then-rename with a single Files.move(...,\nATOMIC_MOVE), falling back to a plain move if the filesystem doesn\u0027t\nsupport atomic moves. A concurrent reader then always sees either the\nold or the new file, never a momentarily missing one.\n\nAdded SimpleDownloadTaskTest, which runs 200 rounds of 6 concurrent\ndownloads racing on the same destination while a reader thread polls\nfor the file transiently disappearing after having existed. On the\nold delete-then-rename code this fails with hundreds of thousands of\nmissing-file observations; with the fix it\u0027s zero.\n\nFixes #2808\n\nSigned-off-by: adityaanikam \u003cadityanikam9502@gmail.com\u003e"
    },
    {
      "commit": "3d60f0e7378986011e00e516d0a6001ca90918c4",
      "tree": "ad8b733078e36d11ac5075d1aad2838cac6d8a76",
      "parents": [
        "bd3efa68f360bfda6f9ac8b51de526d366f323f0"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Sep 10 16:38:35 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 10 16:38:35 2026 +0200"
      },
      "message": "build(deps): bump org.apache.aries:org.apache.aries.util (#2780)\n\nBumps [org.apache.aries:org.apache.aries.util](https://github.com/apache/aries) from 1.1.3 to 2.0.0.\n- [Release notes](https://github.com/apache/aries/releases)\n- [Commits](https://github.com/apache/aries/compare/org.apache.aries.util-1.1.3...util-2.0.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.aries:org.apache.aries.util\n  dependency-version: 2.0.0\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "bd3efa68f360bfda6f9ac8b51de526d366f323f0",
      "tree": "ab1e4c6f9de1c6f769a950a583169f1a145ca69e",
      "parents": [
        "b8d5faf5acd3122cd62c9f77fe26b195acb4c614"
      ],
      "author": {
        "name": "Holger Friedrich",
        "email": "mail@holger-friedrich.de",
        "time": "Thu Sep 10 16:38:00 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 10 16:38:00 2026 +0200"
      },
      "message": "feat(jakarta): Upgrade Pax Web to 11.1.3 (#2725)\n\n* Upgrade Pax Web from 11.1.1 to 11.1.3\n* Upgrade Pax Logging from 2.3.4 to 2.3.5\n* Upgrade Jetty to 12.1.12\n* Upgrade javassist to 3.32.0-GA\n* Upgrade byte-buddy to 1.18.11\n* Upgrade commons-codec to 1.22.1\n\nSigned-off-by: Holger Friedrich \u003cmail@holger-friedrich.de\u003e"
    },
    {
      "commit": "b8d5faf5acd3122cd62c9f77fe26b195acb4c614",
      "tree": "f31d4bffe1ee5c160880948656a358e99eab4ef7",
      "parents": [
        "25b80adbbf028893640aec887722072009dfaff4"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Sep 10 16:14:27 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 10 16:14:27 2026 +0200"
      },
      "message": "build(deps): bump org.apache.maven.plugin-tools:maven-plugin-annotations (#2873)\n\nBumps [org.apache.maven.plugin-tools:maven-plugin-annotations](https://github.com/apache/maven-plugin-tools) from 3.15.2 to 3.16.0.\n- [Release notes](https://github.com/apache/maven-plugin-tools/releases)\n- [Commits](https://github.com/apache/maven-plugin-tools/compare/maven-plugin-tools-3.15.2...maven-plugin-tools-3.16.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven.plugin-tools:maven-plugin-annotations\n  dependency-version: 3.16.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "25b80adbbf028893640aec887722072009dfaff4",
      "tree": "b72c084ccb83711c6232ef79cb90e1bfeb2915f1",
      "parents": [
        "515d1ceb64cfd1c879789766c0ae97bb8390e3ed"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Sep 10 16:14:04 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 10 16:14:04 2026 +0200"
      },
      "message": "build(deps): bump org.apache.maven.plugins:maven-plugin-plugin (#2875)\n\nBumps [org.apache.maven.plugins:maven-plugin-plugin](https://github.com/apache/maven-plugin-tools) from 3.15.2 to 3.16.0.\n- [Release notes](https://github.com/apache/maven-plugin-tools/releases)\n- [Commits](https://github.com/apache/maven-plugin-tools/compare/maven-plugin-tools-3.15.2...maven-plugin-tools-3.16.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.maven.plugins:maven-plugin-plugin\n  dependency-version: 3.16.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "515d1ceb64cfd1c879789766c0ae97bb8390e3ed",
      "tree": "36f9ebcb39212f51a96cb4042e2dd92b443e22e0",
      "parents": [
        "327ea0d85a36cf4b5b0cd888f0eeee870e632228"
      ],
      "author": {
        "name": "Holger Friedrich",
        "email": "mail@holger-friedrich.de",
        "time": "Thu Sep 10 07:18:30 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Sep 10 07:18:30 2026 +0200"
      },
      "message": "Pin maven-plugin versions in karaf-maven-plugin (#2872)\n\nPlugin versions on this folder are not inherited from apache pom.\nFixes mvn4-rc6 build."
    },
    {
      "commit": "327ea0d85a36cf4b5b0cd888f0eeee870e632228",
      "tree": "11c64749683d6205bfbf1d7f0d74f50378552131",
      "parents": [
        "6e404756ada0b6fd3cfc867599ca7fe5dea13156"
      ],
      "author": {
        "name": "Holger Friedrich",
        "email": "mail@holger-friedrich.de",
        "time": "Wed Sep 09 07:43:55 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Sep 09 07:43:55 2026 +0200"
      },
      "message": "Install the SIGHUP dump handler reflectively (#2852)\n\n* Install the SIGHUP dump handler reflectively\n\nThis avoids warnings during compilation which are printed in every CI\nsummary.\nsun.misc.Signal and SignalHandler are internal proprietary APIs.\nThe approach is taken over from Main.java.\n\n* Address review findings"
    },
    {
      "commit": "6e404756ada0b6fd3cfc867599ca7fe5dea13156",
      "tree": "8efe6d9c967fa0943df42aa52b77a63b1472e266",
      "parents": [
        "681f0cc3e9f44e38de6fd5c2dc6a1f63379e79af"
      ],
      "author": {
        "name": "Holger Friedrich",
        "email": "mail@holger-friedrich.de",
        "time": "Tue Sep 08 18:20:50 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 08 18:20:50 2026 +0200"
      },
      "message": "Remove deprecated Cookie calls in ProxyServlet (#2851)\n\nCookie.setComment(String) and Cookie.setVersion(int) are deprecated for\nremoval in Jakarta Servlet 6.1 and specified as no-ops: setComment is\nignored and getComment() returns null, setVersion is ignored and\ngetVersion() returns 0."
    },
    {
      "commit": "681f0cc3e9f44e38de6fd5c2dc6a1f63379e79af",
      "tree": "41755236ef79efe2c8e689ee294a7ba650a47ca7",
      "parents": [
        "30fab73eac362814ec90d2088b7467d896d55d40"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Tue Sep 08 16:38:02 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 08 16:38:02 2026 +0200"
      },
      "message": "feat(assemblies): add karaf-light distribution using the simple feature resolver (#2860)\n\nAdd a new apache-karaf-light assembly, matching the default distribution\u0027s\nfeature set, but with resolver\u003dsimple set by default in\netc/org.apache.karaf.features.cfg so features and bundles are installed in\ndeclaration order without the OSGi resolver."
    },
    {
      "commit": "30fab73eac362814ec90d2088b7467d896d55d40",
      "tree": "c650c4207f78c9a035bdd3b799a1610e59099969",
      "parents": [
        "6b8255d4e15ee27e8ab028c43c78fdcaf4cc174a"
      ],
      "author": {
        "name": "JB Onofré",
        "email": "jbonofre@apache.org",
        "time": "Tue Sep 08 15:01:42 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 08 15:01:42 2026 +0200"
      },
      "message": "feat(features): add simple feature resolver bypassing OSGi capabilities resolution (#2308)\n\n* feat(features): add simple feature resolver bypassing OSGi capabilities resolution\n\nAdd SimpleFeaturesServiceImpl that installs features and bundles in\ndeclaration order without using the Felix OSGi resolver. This is useful\nwhen OSGi capabilities/requirements resolution overhead is not needed\nand deterministic installation order is desired.\n\n- Add SimpleDeployer for sequential feature/bundle deployment\n- Add SimpleFeaturesServiceImpl implementing FeaturesService\n- Add BootManaged interface to decouple BootFeaturesInstaller from impl\n- Update Activator to support resolverSimple\u003dtrue configuration toggle\n- Extract shared tests into AbstractFeaturesServiceTest to validate\n  both FeaturesServiceImpl and SimpleFeaturesServiceImpl\n\n* fix(features): use jakarta.xml.bind.JAXBException in SimpleFeaturesServiceImpl\n\nThe new simple feature resolver imported the pre-Jakarta\njavax.xml.bind.JAXBException, which is no longer on the compile\nclasspath, breaking the build of org.apache.karaf.features.core.\n\n* feat(features): replace resolverSimple flag with resolver property\n\nUse resolver\u003ddefault|simple instead of the resolverSimple boolean, in\nline with the other string valued properties of the features service\n(such as serviceRequirements), and document it.\n\n- Add DEFAULT_RESOLVER and SIMPLE_RESOLVER constants in FeaturesService\n- Read the resolver property in the Activator, warning and falling back\n  to the default resolver on an unknown value\n- Document resolver in etc/org.apache.karaf.features.cfg and in the\n  provisioning section of the user guide\n\n* fix(features): honor conditional feature ownership in simple resolver\n\nFold a \u003cconditional\u003e block into the install set only when its owning\nfeature is itself being installed (or already installed), not merely\nwhen its condition token matches a feature name. Otherwise a\nconditional bundle could be installed without the owner\u0027s bundles that\nexport the packages it needs, e.g. webconsole.features, scr.management/\nscr.state, and bundle.blueprintstate failing to resolve at boot."
    },
    {
      "commit": "6b8255d4e15ee27e8ab028c43c78fdcaf4cc174a",
      "tree": "9563a37a4fca1050f1acac4e82579c6c4f2a5e41",
      "parents": [
        "b0c8ed67e6c1008d2e1f32cbf25ec0e497962c5d"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Sep 08 07:29:41 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 08 07:29:41 2026 +0200"
      },
      "message": "build(deps): bump slf4j.version from 2.0.18 to 2.0.19 (#2855)\n\nBumps `slf4j.version` from 2.0.18 to 2.0.19.\n\nUpdates `org.slf4j:slf4j-api` from 2.0.18 to 2.0.19\n\nUpdates `org.slf4j:slf4j-jdk14` from 2.0.18 to 2.0.19\n\nUpdates `org.slf4j:slf4j-nop` from 2.0.18 to 2.0.19\n\nUpdates `org.slf4j:slf4j-simple` from 2.0.18 to 2.0.19\n\nUpdates `org.slf4j:jcl-over-slf4j` from 2.0.18 to 2.0.19\n\nUpdates `org.slf4j:slf4j-reload4j` from 2.0.18 to 2.0.19\n\n---\nupdated-dependencies:\n- dependency-name: org.slf4j:slf4j-api\n  dependency-version: 2.0.19\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.slf4j:slf4j-jdk14\n  dependency-version: 2.0.19\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.slf4j:slf4j-nop\n  dependency-version: 2.0.19\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n- dependency-name: org.slf4j:slf4j-simple\n  dependency-version: 2.0.19\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.slf4j:jcl-over-slf4j\n  dependency-version: 2.0.19\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.slf4j:slf4j-reload4j\n  dependency-version: 2.0.19\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "b0c8ed67e6c1008d2e1f32cbf25ec0e497962c5d",
      "tree": "4836f463bff0ee23c42aa9fd9b3e5c8a01c4d728",
      "parents": [
        "1af50a1082112107d7b3ca68dc8259b40a880338"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Sep 08 07:26:12 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 08 07:26:12 2026 +0200"
      },
      "message": "build(deps-dev): bump org.jline:jline from 4.4.1 to 4.4.2 (#2857)\n\nBumps [org.jline:jline](https://github.com/jline/jline3) from 4.4.1 to 4.4.2.\n- [Release notes](https://github.com/jline/jline3/releases)\n- [Commits](https://github.com/jline/jline3/compare/4.4.1...4.4.2)\n\n---\nupdated-dependencies:\n- dependency-name: org.jline:jline\n  dependency-version: 4.4.2\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "1af50a1082112107d7b3ca68dc8259b40a880338",
      "tree": "4b3bf23a9779079d0dc17aa34825b98839c2c6a5",
      "parents": [
        "ed4d306bc2fedb30b5963009b0db86f29f4accaa"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Sep 08 06:47:17 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Sep 08 06:47:17 2026 +0200"
      },
      "message": "build(deps-dev): bump com.h2database:h2 from 2.4.240 to 2.5.250 (#2859)\n\nBumps [com.h2database:h2](https://github.com/h2database/h2database) from 2.4.240 to 2.5.250.\n- [Release notes](https://github.com/h2database/h2database/releases)\n- [Commits](https://github.com/h2database/h2database/compare/version-2.4.240...version-2.5.250)\n\n---\nupdated-dependencies:\n- dependency-name: com.h2database:h2\n  dependency-version: 2.5.250\n  dependency-type: direct:development\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "ed4d306bc2fedb30b5963009b0db86f29f4accaa",
      "tree": "619a3350c9ed27c8a16cc754f5fb5f966f8ae12e",
      "parents": [
        "6ed63848a3bf9ef5bbcb0ed2748149fed65651c8"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Sep 06 08:12:28 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 06 08:12:28 2026 +0200"
      },
      "message": "build(deps): bump org.codehaus.plexus:plexus-archiver (#2832)\n\nBumps [org.codehaus.plexus:plexus-archiver](https://github.com/codehaus-plexus/plexus-archiver) from 4.13.0 to 4.14.0.\n- [Release notes](https://github.com/codehaus-plexus/plexus-archiver/releases)\n- [Changelog](https://github.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md)\n- [Commits](https://github.com/codehaus-plexus/plexus-archiver/compare/plexus-archiver-4.13.0...plexus-archiver-4.14.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.codehaus.plexus:plexus-archiver\n  dependency-version: 4.14.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "6ed63848a3bf9ef5bbcb0ed2748149fed65651c8",
      "tree": "00136e48ead695350ebba5015f0dcd3e17b7ba5d",
      "parents": [
        "7d263f90622e5a1bd20a2cbb4d595e4c3a1829a8"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Sep 06 08:11:58 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 06 08:11:58 2026 +0200"
      },
      "message": "build(deps-dev): bump org.easymock:easymock from 5.6.0 to 5.7.0 (#2829)\n\nBumps [org.easymock:easymock](https://github.com/easymock/easymock) from 5.6.0 to 5.7.0.\n- [Release notes](https://github.com/easymock/easymock/releases)\n- [Changelog](https://github.com/easymock/easymock/blob/master/ReleaseNotes.md)\n- [Commits](https://github.com/easymock/easymock/compare/easymock-5.6.0...easymock-5.7.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.easymock:easymock\n  dependency-version: 5.7.0\n  dependency-type: direct:development\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "7d263f90622e5a1bd20a2cbb4d595e4c3a1829a8",
      "tree": "ed4d36002c46c2532f13223f00e2c0a1b95437a7",
      "parents": [
        "eae4ab12dea6687326b6912ebc95e5d75a9f0426"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Sep 06 08:11:18 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 06 08:11:18 2026 +0200"
      },
      "message": "build(deps): bump redis.clients:jedis from 8.0.0 to 8.0.1 (#2843)\n\nBumps [redis.clients:jedis](https://github.com/redis/jedis) from 8.0.0 to 8.0.1.\n- [Release notes](https://github.com/redis/jedis/releases)\n- [Commits](https://github.com/redis/jedis/compare/v8.0.0...v8.0.1)\n\n---\nupdated-dependencies:\n- dependency-name: redis.clients:jedis\n  dependency-version: 8.0.1\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "eae4ab12dea6687326b6912ebc95e5d75a9f0426",
      "tree": "b880740e7b058e8d2a6d58eb88da978b15bc1c91",
      "parents": [
        "a87353f0b78b13ceeeb514637c4025a2d8ed41ef"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Sep 06 08:10:55 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 06 08:10:55 2026 +0200"
      },
      "message": "build(deps): bump org.apache.felix:org.apache.felix.http.jetty12 (#2844)\n\nBumps org.apache.felix:org.apache.felix.http.jetty12 from 2.0.4 to 2.0.6.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.felix:org.apache.felix.http.jetty12\n  dependency-version: 2.0.6\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "a87353f0b78b13ceeeb514637c4025a2d8ed41ef",
      "tree": "e01e552bfea07e305afc5249db41339759d5e8a0",
      "parents": [
        "f3628ea20a2f225ddebcf0bf23fc95988ceb976e"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Sep 06 08:10:30 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 06 08:10:30 2026 +0200"
      },
      "message": "build(deps): bump activemq.version from 6.3.1 to 6.3.2 (#2845)\n\nBumps `activemq.version` from 6.3.1 to 6.3.2.\n\nUpdates `org.apache.activemq:activemq-pool` from 6.3.1 to 6.3.2\n- [Release notes](https://github.com/apache/activemq/releases)\n- [Commits](https://github.com/apache/activemq/compare/activemq-6.3.1...activemq-6.3.2)\n\nUpdates `org.apache.activemq:activemq-karaf` from 6.3.1 to 6.3.2\n- [Release notes](https://github.com/apache/activemq/releases)\n- [Commits](https://github.com/apache/activemq/compare/activemq-6.3.1...activemq-6.3.2)\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.activemq:activemq-pool\n  dependency-version: 6.3.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n- dependency-name: org.apache.activemq:activemq-karaf\n  dependency-version: 6.3.2\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "f3628ea20a2f225ddebcf0bf23fc95988ceb976e",
      "tree": "20e2be4b2589004a17a086b842ecd850595a2dfa",
      "parents": [
        "eb30a868e2fd7e29da670d2dffb5e545f4942a33"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Sep 06 08:10:08 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 06 08:10:08 2026 +0200"
      },
      "message": "build(deps): bump org.hibernate.orm:hibernate-core (#2846)\n\nBumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm) from 7.4.5.Final to 7.4.7.Final.\n- [Release notes](https://github.com/hibernate/hibernate-orm/releases)\n- [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.7/changelog.txt)\n- [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.5...7.4.7)\n\n---\nupdated-dependencies:\n- dependency-name: org.hibernate.orm:hibernate-core\n  dependency-version: 7.4.7.Final\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "eb30a868e2fd7e29da670d2dffb5e545f4942a33",
      "tree": "764f9128ade72d513f69bbd7e0f74942525debee",
      "parents": [
        "d46b78307c8f57b582b4c9857620351bfd7911e3"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Sep 06 08:09:46 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 06 08:09:46 2026 +0200"
      },
      "message": "build(deps-dev): bump org.jline:jline from 4.3.1 to 4.4.1 (#2848)\n\nBumps [org.jline:jline](https://github.com/jline/jline3) from 4.3.1 to 4.4.1.\n- [Release notes](https://github.com/jline/jline3/releases)\n- [Commits](https://github.com/jline/jline3/compare/4.3.1...4.4.1)\n\n---\nupdated-dependencies:\n- dependency-name: org.jline:jline\n  dependency-version: 4.4.1\n  dependency-type: direct:development\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "d46b78307c8f57b582b4c9857620351bfd7911e3",
      "tree": "2037ce591d90ce896611705eb54dfeb598d6f0f7",
      "parents": [
        "9e8d6e1dc845ce81be8ab3e068c5f483958e3548"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Sun Sep 06 08:09:23 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Sep 06 08:09:23 2026 +0200"
      },
      "message": "build(deps-dev): bump org.codehaus.modello:modello-maven-plugin (#2849)\n\nBumps [org.codehaus.modello:modello-maven-plugin](https://github.com/codehaus-plexus/modello) from 2.8.0 to 2.8.1.\n- [Release notes](https://github.com/codehaus-plexus/modello/releases)\n- [Commits](https://github.com/codehaus-plexus/modello/compare/modello-2.8.0...modello-2.8.1)\n\n---\nupdated-dependencies:\n- dependency-name: org.codehaus.modello:modello-maven-plugin\n  dependency-version: 2.8.1\n  dependency-type: direct:development\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "9e8d6e1dc845ce81be8ab3e068c5f483958e3548",
      "tree": "6a1cad7453f99261ac49b84edae4b83733c9e66e",
      "parents": [
        "fab67cb95db6a1eaacc4897da20927943c09f443"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Aug 28 14:36:47 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 28 14:36:47 2026 +0200"
      },
      "message": "build(deps): bump org.hibernate.orm:hibernate-core from 7.4.4.Final to 7.4.5.Final (#2773)\n\n* build(deps): bump org.hibernate.orm:hibernate-core\n\nBumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm) from 7.4.4.Final to 7.4.5.Final.\n- [Release notes](https://github.com/hibernate/hibernate-orm/releases)\n- [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.5/changelog.txt)\n- [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.4...7.4.5)\n\n---\nupdated-dependencies:\n- dependency-name: org.hibernate.orm:hibernate-core\n  dependency-version: 7.4.5.Final\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\n\n* Add jakarta.annotation-api to hibernate feature\n\nNew import is required due to a new import in hibernate-core 7.4.5.Final.\n\nSigned-off-by: Holger Friedrich \u003cmail@holger-friedrich.de\u003e\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nSigned-off-by: Holger Friedrich \u003cmail@holger-friedrich.de\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: Holger Friedrich \u003cmail@holger-friedrich.de\u003e"
    },
    {
      "commit": "fab67cb95db6a1eaacc4897da20927943c09f443",
      "tree": "5ce3358b0425619e5155b612817146838c8a534f",
      "parents": [
        "8a012a3112014b69bd3671f9fada58c092e93f2a"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Aug 28 14:36:12 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 28 14:36:12 2026 +0200"
      },
      "message": "build(deps): bump org.apache.cxf:cxf-rt-frontend-jaxws (#2793)\n\nBumps org.apache.cxf:cxf-rt-frontend-jaxws from 3.6.12 to 4.2.3.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.cxf:cxf-rt-frontend-jaxws\n  dependency-version: 4.2.3\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "8a012a3112014b69bd3671f9fada58c092e93f2a",
      "tree": "387ec3142681b001ff5bca4f2628864287febe03",
      "parents": [
        "c9e5b4e714b2fb6e121959526fa596f44eddf48f"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Aug 28 06:37:23 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 28 06:37:23 2026 +0200"
      },
      "message": "build(deps): bump actions/setup-java from 5 to 6 (#2834)\n\nBumps [actions/setup-java](https://github.com/actions/setup-java) from 5 to 6.\n- [Release notes](https://github.com/actions/setup-java/releases)\n- [Commits](https://github.com/actions/setup-java/compare/v5...v6)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-java\n  dependency-version: \u00276\u0027\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "c9e5b4e714b2fb6e121959526fa596f44eddf48f",
      "tree": "0240c1812417b83e03df81d5ac0bf077bdf5890f",
      "parents": [
        "8947d82c4c55cc68adcd6e2b21c631b4abdaa0f4"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Fri Aug 28 06:37:05 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Aug 28 06:37:05 2026 +0200"
      },
      "message": "build(deps): bump com.graphql-java:graphql-java from 26.0 to 26.1 (#2835)\n\nBumps [com.graphql-java:graphql-java](https://github.com/graphql-java/graphql-java) from 26.0 to 26.1.\n- [Release notes](https://github.com/graphql-java/graphql-java/releases)\n- [Commits](https://github.com/graphql-java/graphql-java/compare/v26.0...v26.1)\n\n---\nupdated-dependencies:\n- dependency-name: com.graphql-java:graphql-java\n  dependency-version: \u002726.1\u0027\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "8947d82c4c55cc68adcd6e2b21c631b4abdaa0f4",
      "tree": "416dcaeb1ae938839d47e1a5654d93ddebe9bc45",
      "parents": [
        "c02ef39505b19f0e11652d13b5be90b869bdccc4"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Aug 27 14:08:27 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 27 14:08:27 2026 +0200"
      },
      "message": "build(deps): bump org.apache.cxf:cxf-rt-frontend-jaxrs (#2794)\n\nBumps org.apache.cxf:cxf-rt-frontend-jaxrs from 4.2.1 to 4.2.3.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.cxf:cxf-rt-frontend-jaxrs\n  dependency-version: 4.2.3\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "c02ef39505b19f0e11652d13b5be90b869bdccc4",
      "tree": "a9ef8553edd8a79eb2ee407b6fd81964f92829e9",
      "parents": [
        "3e2eeece44d573da48a758fb9e4c361667eaa2f1"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Thu Aug 27 14:07:53 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Aug 27 14:07:53 2026 +0200"
      },
      "message": "build(deps): bump org.apache.cxf:cxf-rt-rs-client from 4.1.2 to 4.2.3 (#2796)\n\nBumps org.apache.cxf:cxf-rt-rs-client from 4.1.2 to 4.2.3.\n\n---\nupdated-dependencies:\n- dependency-name: org.apache.cxf:cxf-rt-rs-client\n  dependency-version: 4.2.3\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "3e2eeece44d573da48a758fb9e4c361667eaa2f1",
      "tree": "2da5253f282bce4d0b83c8bb340700dbec320754",
      "parents": [
        "d20a53d3f2f7ddc50de0e3a317bd7579aed62ac3"
      ],
      "author": {
        "name": "Holger Friedrich",
        "email": "mail@holger-friedrich.de",
        "time": "Tue Aug 25 16:27:21 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 25 16:27:21 2026 +0200"
      },
      "message": "build(deps): bump org.awaitility:awaitility from 3.1.6 to 4.3.0 (#2814)\n\n* Upgrade awaitility to 4.3.0\n* Use hamcrest 2.2 with awaitility\n\nSigned-off-by: Holger Friedrich \u003cmail@holger-friedrich.de\u003e"
    },
    {
      "commit": "d20a53d3f2f7ddc50de0e3a317bd7579aed62ac3",
      "tree": "248274876ac87ba8f6a57fddb5c08a96560104cc",
      "parents": [
        "4dcdfe19ce2810d60c6c214553596ea504a43cf1"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Tue Aug 25 15:00:10 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Aug 25 15:00:10 2026 +0200"
      },
      "message": "build(deps): bump org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0 (#2817)\n\nBumps [org.codehaus.plexus:plexus-utils](https://github.com/codehaus-plexus/plexus-utils) from 4.0.3 to 4.1.0.\n- [Release notes](https://github.com/codehaus-plexus/plexus-utils/releases)\n- [Commits](https://github.com/codehaus-plexus/plexus-utils/compare/plexus-utils-4.0.3...plexus-utils-4.1.0)\n\n---\nupdated-dependencies:\n- dependency-name: org.codehaus.plexus:plexus-utils\n  dependency-version: 4.1.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    }
  ],
  "next": "4dcdfe19ce2810d60c6c214553596ea504a43cf1"
}