Update all dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/checkout	action	major	v6 → v7
org.postgresql:postgresql (source)	build	patch	42.7.10 → 42.7.12
org.mockito:mockito-core	test	minor	5.22.0 → 5.23.0
org.springdoc:springdoc-openapi-starter-webmvc-ui (source)	compile	minor	3.0.2 → 3.1.0
com.nimbusds:oauth2-oidc-sdk	compile	minor	11.34 → 11.38.2
org.flywaydb:flyway-maven-plugin	build	major	12.0.3 → 13.3.0
com.github.gantsign.maven:ktlint-maven-plugin	build	minor	3.5.0 → 3.7.1
org.apache.maven.plugins:maven-enforcer-plugin (source)	build	patch	3.6.2 → 3.6.3
org.openapitools:openapi-generator-maven-plugin	build	minor	7.20.0 → 7.24.0
org.springframework.boot:spring-boot-starter-parent (source)	parent	minor	4.0.3 → 4.1.1

---

pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

CVE-2026-42198 / GHSA-98qh-xjc8-98pq

More information

Details

Summary

pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication.

Impact

A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count.
With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail.
A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools.

In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation.

This issue affects availability. It does not provide authentication bypass, privilege escalation, or direct password disclosure.

A user is vulnerable when all of the following are true:

1. The connection uses SCRAM-SHA-256 authentication.
2. The client reaches a malicious, compromised, or attacker-controlled PostgreSQL endpoint.
3. That endpoint sends a very large SCRAM PBKDF2 iteration count in the server-first-message.

In practice, that can happen in these situations:

• the application lets end users or tenants supply their own database connection details (as in many BI, reporting, analytics, ETL, and low-code platforms), so a user can point the shared client host at a server they control
• the application accepts connection strings, hostnames, or JDBC URLs from user input, configuration uploaded by users, or other untrusted sources
• the application is configured to connect to a PostgreSQL server that is itself malicious or later becomes compromised
• the application connects through an untrusted proxy, relay, tunnel, bastion, or connection-pooling service that can act as the PostgreSQL server
• an attacker can redirect the client to a fake PostgreSQL endpoint by manipulating DNS, service discovery, Kubernetes service resolution, /etc/hosts, environment variables, or similar indirection
• an active network attacker on the path can impersonate the server because the connection does not strongly verify server identity (for example, sslmode lower than verify-full, or trusting a CA that signs hosts outside the operator's control)

The issue is more damaging when the application uses connection retries, many parallel connection attempts, or loginTimeout and assumes the timeout fully stops the work.

Patches

The patch introduces a new connection property, scramMaxIterations, with a default of 100K. The client now rejects SCRAM server messages that advertise more PBKDF2 iterations than the configured cap before starting the PBKDF2 computation begins.

Workarounds

Until a patched version of pgjdbc is deployed, the following measures reduce exposure:

1. Only connect to trusted PostgreSQL servers whose identity is verified.
   Connect only to trusted PostgreSQL servers, and verify server identity with TLS using sslmode=verify-full and a trusted CA.
   TLS without certificate and hostname verification is not sufficient as an active network attacker can still impersonate the server.

2. Do not rely on loginTimeout as a complete mitigation on unpatched versions.
   On affected versions, loginTimeout can stop the waiting caller while the worker thread continues spending CPU.

3. Avoid SCRAM on untrusted or interceptable connection paths.
   For those paths, use an authentication method that does not let the server choose a SCRAM PBKDF2 iteration count.

4. Reduce blast radius operationally.
   Limit parallel connection attempts, add retry backoff, isolate connection establishment in a separate worker or process when possible, and apply CPU or container limits where appropriate.

5. On trusted servers you control, keep SCRAM iteration counts at ordinary values.
   This does not defend against an attacker-controlled server, but it avoids unnecessary client cost when talking to legitimate servers.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq
• https://nvd.nist.gov/vuln/detail/CVE-2026-42198
• https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11
• https://github.com/advisories/GHSA-98qh-xjc8-98pq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms

CVE-2026-54291 / GHSA-j92g-9f8w-j867

More information

Details

Impact

channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS (with channel binding) to plain SCRAM-SHA-256 (without it), losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection triggers the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash. Examples are Ed25519, Ed448, and post-quantum algorithms.

Two issues combine in releases 42.7.4 through 42.7.11:

1. The bundled com.ongres.scram:scram-client (3.1 or 3.2) returns an empty byte array instead of failing when it cannot derive the binding hash for such a certificate. This is the library issue tracked as GHSA-p9jg-fcr6-3mhf.
2. pgJDBC does not enforce channelBinding=require where it matters. ScramAuthenticator checks only that the server advertised a -PLUS mechanism; it neither rejects the empty binding nor checks that the negotiated mechanism uses channel binding. The connection therefore downgrades silently, and would do so even against a fixed scram-client, because the missing enforcement is in pgJDBC's own code.

Only connections that set channelBinding=require are affected. Under the default prefer policy, and under allow or disable, falling back to plain SCRAM is the documented behaviour. Releases before 42.7.4 are unaffected, because they do not support channel binding.

Patches

Fixed in pgJDBC 42.7.12. pgJDBC now enforces channel binding in its own code, independently of the scram-client version:

• Under channelBinding=require, it fails the connection when no channel-binding data can be extracted from the server certificate, instead of passing an empty value to the SCRAM client. The error names the certificate signature algorithm.
• After negotiation, it requires the selected mechanism to use channel binding (a -PLUS mechanism) whenever channelBinding=require is set, regardless of how negotiation resolved.

Upgrade to 42.7.12 or later.

Workarounds

No pgJDBC setting restores channel-binding enforcement on an affected release; upgrading is the fix.

If you cannot upgrade immediately, verify the server certificate at the TLS layer so that a man-in-the-middle cannot present a substitute certificate. Set sslmode=verify-full with a truststore that contains only your server's CA. This defence is independent of channel binding and blocks the same attacker. Connections that rely on channelBinding=require in place of certificate verification have no equivalent workaround and should upgrade.

References

• GHSA-p9jg-fcr6-3mhf — the related com.ongres.scram:scram-client issue (root cause of the empty channel-binding value).
• scram-client 3.3 release (library fix): https://github.com/ongres/scram/releases/tag/3.3
• pgJDBC fix in 42.7.12: commit

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N

References

• https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867
• https://nvd.nist.gov/vuln/detail/CVE-2026-54291
• https://github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99
• https://github.com/ongres/scram/releases/tag/3.3
• https://github.com/advisories/GHSA-j92g-9f8w-j867

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v7

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v6.1.0

Compare Source

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v6.0.1

Compare Source

• Add worktree support for persist-credentials includeIf by @​ericsciple in #​2327

pgjdbc/pgjdbc (org.postgresql:postgresql)

v42.7.12

Security

• fix: Enforce SCRAM channel-binding policy and prevent silent downgrade.
  Under channelBinding=require, the driver silently downgraded from SCRAM-SHA-256-PLUS (with channel binding) to plain SCRAM-SHA-256 (without it) when the server presented a certificate whose signature algorithm has no tls-server-end-point channel-binding hash (e.g. Ed25519, Ed448, or post-quantum algorithms). An attacker who can intercept the TLS connection could exploit this to strip channel-binding protection.
  The fix enforces channel binding in the driver's own code: it now fails the connection when no binding data can be extracted, and verifies the negotiated mechanism uses channel binding (-PLUS) when require is set.
  Only connections that set channelBinding=require are affected. The default prefer policy and releases before 42.7.4 (which introduced channel-binding support) are unaffected.
  See the Security Advisory for more detail.
  The following CVE-2026-54291 has been issued.

v42.7.11

Security

• fix: Limit SCRAM PBKDF2 iterations accepted from the server.
  pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins.
  See the Security Advisory for more detail.
  The following CVE-2026-42198 has been issued.

Added

• feat: implement require_auth connection property, aligning with libpq behavior PR #​3895

Changed

• chore: replace Appveyor CI with ikalnytskyi/action-setup-postgres PR #​3966
• chore: upgrade Gradle to v9 PR #​3978

Fixed

• fix: ensure extended protocol messages end with Sync message PR #​3728
• fix: enable cursor-based fetching in extended protocol when transaction started via SQL command PR #​3996
• fix: retry with SSL on IOException when sslMode=ALLOW PR #​3973
• fix: make sure the driver honours connectTimeout when retrying the connection PR #​3968
• fix: allow fallback to non-SSL connection when sslMode=prefer and sslResponseTimeout kicks in PR #​3968
• fix: catch SecurityException from setContextClassLoader on ForkJoinPool workers PR #​3962
• fix: use compareTo for LogSequenceNumber comparison to handle unsigned values correctly PR #​3961
• fix: release COPY lock on IOException to prevent connection hang PR #​3957
• fix: return jsonb as PGObject instead of String PR #​3956
• fix: align SSL key file permission check with libpq PR #​3952
• fix: guard connection closed flag with a reentrant lock to protect against concurrent close PR #​3905

mockito/mockito (org.mockito:mockito-core)

v5.23.0

Compare Source

NOTE: Breaking change for Android

The mockito-android artifact has a breaking change: tests now require a device or emulator based on API 28+ (Android P). This is to enable new support for mocking Kotlin classes. See #​3788 for more details.

---

^{Changelog generated by Shipkit Changelog Gradle Plugin}

5.23.0

• 2026-03-11 - 6 commit(s) by Brice Dutheil, Joshua Selbo, Philippe Kernevez
• Replace mockito-android mock maker implementation with dexmaker-mockito-inline (#​3792)
• Fix StackOverflowError with AbstractList after using mockSingleton (#​3790)
• Mark parameters of Mockito.when @Nullable (#​3503)

springdoc/springdoc-openapi (org.springdoc:springdoc-openapi-starter-webmvc-ui)

v3.1.0

Compare Source

Added

• #​3269 – Add mechanism to disable nullable for Kotlin properties
• Allow request-specific Swagger UI index transformation

Changed

• Upgrade Spring Boot to version 4.1.0
• Upgrade Spring AI to version 2.0.0
• Upgrade swagger-core to version 2.2.52
• Upgrade swagger-ui to version 5.32.11
• #​3307 – Act upon SonarQube warnings
• #​3306 – Act upon SonarQube warnings

Fixed

• #​3304 – Kotlin parent class's field is not properly marked as nullable
• #​3294 – Duplicated path getting swagger-config
• #​3293 – Inconsistent OpenAPI schema naming with SNAKE_CASE: some Java record fields remain camelCase
• #​3292 – Make WebProperties and WebMvcProperties optional in SwaggerConfig
• #​3284 – Upgrade swagger-core from version 2.2.48 to 2.2.49
• #​3282 – Preserve version from nest() predicate across all routes in nest
• #​3281 – Stabilize Spring Data Page schema property order
• #​3274 – Description disappears from the generated json after upgrade to 3.0.3
• #​3270 – Validation annotation of ParameterObject property applied to PathVariable with the same name, even in unrelated endpoints
• #​3266 – Upgrade swagger-core from version 2.2.47 to 2.2.48
• #​3263 – Null key for a Map not allowed in JSON

v3.0.3: springdoc-openapi v3.0.3 released!

Compare Source

Added

• #​3246 – Add Springdoc OpenAPI MCP (Model Context Protocol) support
• #​3256 – Auto-set nullable: true for Kotlin nullable types in schema properties
• #​3239 – Add support for the @Range constraint validation annotation
• #​3244 – Handle default values for LocalDate

Changed

• Upgrade Spring Boot to version 4.0.5
• Upgrade swagger-core to version 2.2.47
• Upgrade swagger-ui to version 5.32.2
• #​3260 – @ConditionalOnClass(HateoasProperties.class) in SpringDocHateoasConfiguration
• Forwards all MCP non-transport headers to downstream methods
• Dynamically resolve the base path from window.location.pathname for MCP UI

Fixed

• #​3258 – Setting API Version Required when using WebFlux breaks the Swagger UI
• #​3259 – Annotated Generic properties getting applied to sibling properties
• #​3255 – Direction enum: fixed visibility scope of group order so that setGroupsOrder method can be used
• #​3247 – Preserve YAML group URLs in Swagger UI
• #​3245 – Upgrade swagger-core from version 2.2.43 to 2.2.45
• #​3235 – PropertyResolverUtils retains a JsonNode when reading an ExtensionProperty annotation
• #​3226 – Propagate JsonView context when resolving Page<T> schema

New Contributors

• @​seregamorph made their first contribution in #​3260

Full Changelog: springdoc/springdoc-openapi@v3.0.2...v3.0.3

connect2id/oauth-2.0-sdk-with-openid-connect-extensions (com.nimbusds:oauth2-oidc-sdk)

v11.38.2

Compare Source

v11.38.1

Compare Source

v11.38

Compare Source

v11.37.2

Compare Source

v11.37.1

Compare Source

v11.37

Compare Source

v11.36

Compare Source

v11.35

Compare Source

gantsign/ktlint-maven-plugin (com.github.gantsign.maven:ktlint-maven-plugin)

v3.7.1

Compare Source

Changes:

• #​718: Fix deploy timeout

v3.7.0

Compare Source

Enhancement:

• #​717: Update ktlint to 1.8.0 and kotlin to 2.2.21

v3.6.0

Compare Source

Enhancement:

• #​681: Update to ktlint 1.7.1 and kotlin 2.2.0
  • Thanks to @​JonathanLennox for the PR

Other changes:

• #​662: Upgraded commons-codec:commons-codec from 1.17.2 to 1.18.0
• #​671: Updated GitHub Actions runner
• #​663: Upgraded commons-logging:commons-logging from 1.3.4 to 1.3.5
• #​664: Upgraded commons-beanutils:commons-beanutils from 1.10.0 to 1.10.1
• #​685: Fix devcontainer
• #​686: Fix devcontainer
• #​687: Migrate deployment to Sonatype Central Portal
• #​688: Fix Maven deploy
• #​688: Fix formatting (fix-deploy)
• #​666: Bump org.codehaus.plexus:plexus-classworlds from 2.8.0 to 2.9.0
• #​669: Bump org.codehaus.plexus:plexus-interpolation from 1.27 to 1.28
• #​673: Bump commons-beanutils:commons-beanutils from 1.10.1 to 1.11.0
• #​675: Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.18.0
• #​676: Bump commons-io:commons-io from 2.18.0 to 2.20.0
• #​679: Bump actions/setup-java from 4 to 5
• #​680: Bump codecov/codecov-action from 5.3.1 to 5.5.1
• #​682: Bump org.apache.commons:commons-lang3 from 3.17.0 to 3.19.0
• #​683: Bump actions/checkout from 4 to 6
• #​689: Bump org.codehaus.plexus:plexus-utils from 4.0.2 to 4.0.3
• #​690: Update Dependabot to allow newer Maven versions
• #​693: Bump org.apache.maven:maven-core from 3.5.4 to 3.8.1
• #​691: Bump codecov/codecov-action from 5.5.1 to 6.0.0
• #​694: Bump org.jetbrains.dokka:dokka-maven-plugin from 2.0.0 to 2.2.0
• #​695: Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.24 to 1.27
• #​696: Bump commons-codec:commons-codec from 1.18.0 to 1.21.0
• #​692: Bump maven.version from 3.8.1 to 3.8.9
• #​698: Add org.dom4j:dom4j dependency to dependabot configuration
• #​703: Bump org.dom4j:dom4j from 2.1.4 to 2.1.5
• #​704: Add org.codehaus.plexus:plexus-xml dependency to dependabot configuration
• #​699: Bump org.codehaus.plexus:plexus-interpolation from 1.28 to 1.29
• #​700: Bump commons-logging:commons-logging from 1.3.5 to 1.3.6
• #​701: Bump org.apache.maven.plugin-tools:maven-plugin-annotations
• #​706: Bump commons-io:commons-io from 2.20.0 to 2.21.0
• #​707: Add maven-reporting-impl dependency to dependabot configuration
• #​708: Add plexus-classworlds dependency to dependabot config
• #​710: Add maven-plugin-testing-harness to dependabot config
• #​711: Add Guice to dependabot config
• #​712: Bump com.google.inject:guice from 4.2.2 to 4.2.3
• #​713: Add doxia-sink-api-ktx to dependabot config
• #​714: Bump doxia-sink-api-ktx version to 1.6.1
• #​715: Update build Maven version to 3.9.14
• #​716: Update Maven Central badge to use img.shields.io

openapitools/openapi-generator (org.openapitools:openapi-generator-maven-plugin)

v7.24.0: released

Compare Source

v7.24.0 stable release (breaking changes with fallbacks) comes with 170+ enhancements and bug fixes.

Below are the highlights of the changes. For a full list of changes, please refer to the "Pull Request" tab.

General

• fix(docker): update base image to eclipse-temurin 17.0.19 on Ubuntu 24.04 (noble) #​24230
• fix(InlineModelResolver): do not merge untitled inline schemas differing only by description #​24192
• Fix vulnerable dependency CVE-2026-54512 #​24166
• [core] Add introspection support for discovering the discriminator type in a oneOf allOf polymorphic structure #​24158
• refactor: introduce DiscriminatorUtils to separate handling of discriminator discoverability #​24143
• fix: normalize OAS 3.1 schemas with type:[object,"null"] to set nullable:true correctly #​24140
• feat(spec-merge): add alternative DEEP merge mode with by-method path merging and configurable conflict resolution strategy #​24100
• [core] Restore sibling example for allOf with a single $ref (#​23335) #​24081
• [core] Fix UnsupportedOperationException for oneOf members declaring x-implements (#​23577) #​24076
• [CORE] - Feature: forcedGenerateSchemas — Force generation of schema-mapped or import-mapped schemas #​24066
• [Core] bug - fix OAS 3.1 nullable validation when using older "nullable: true" syntax instead of type: [null, ...] #​24026
• fix(online): thread-safe fileMap with TTL cleanup, SLF4J logging, and Content-Length header #​24011
• [BUG][core] Normalize OAS 3.1 type: null map value (additionalProperties) under NORMALIZE_31SPEC #​23967
• Add validate Mojo to Maven Plugin #​23911
• feat: add quiet mode to suppress verbose generation output #​23831

asciidoc

• fix(asciidoc): escape table cell pipes in generated docs #​24184

avro

• fix(avro): order "null" first in union when default is null #​24135

C++

• fix(cpp-httplib-server): serialize enums using spec values #​24187
• C++ Boost.Beast client generator with OpenAPI 3.1 support #​24335

C#

• fix(aspnetcore): remove obsolete wwwroot README #​24283
• [csharp][generichost] Refactor duplicate apis #​24273
• [csharp][generichost] Revert to DropWrite #​24080
• [csharp][generichost] Add OnCreated to JsonConverter #​24079

Crystal

• [Crystal] Add request-signing seam (Configuration#sign_request) #​24221
• [Crystal] idiomatic api redesign #​24070

Dart

• Dart2 class and enum improvements #​24286
• [dart-dio][built_value] Register BuilderFactory for nested additionalProperties shapes #​24154
• [dart-dio][built_value] Honor optional non-nullable properties in deserialize_properties.mustache #​23661
• [dart-dio] Fix webhook imports generating Map-style strings #​22611

Go

• fix(golang): make object values nullable when specified #​24265
• fix(go-server): allow zero values for required request body fields #​24262
• fix(go-server): skip readOnly fields in AssertXxxRequired #​24257
• fix(go-server): use operationId consistently to fix uncompilable output for duplicate operationIds #​24169
• [Go] Honor generateUnmarshalJSON=false for oneOf models #​24062

Java

• [Java][apache-httpclient] Apply connect timeout to requests, add read timeout support #​24284
• [java][microprofile] Extend useSealedOneOfInterfaces support to the microprofile library #​24267
• [java][microprofile] Extend support for useOneOfInterfaces to the microprofile library when Jackson serialisation is enabled #​24190
• [java][jaxrs-spec] - Add support for sealed classes and interfaces with useSealed flag #​24189
• [KOTLIN-SPRING;JAVA-SPRING] bugfix: update JsonInclude annotations for optional+nullable fields to handle serialization correctly when openApiNullable = true #​24185
• [java][jaxrs-spec][quarkus] - Add support for OneOfInterfaces & fix JsonTypeName value resolution #​24174
• Convert maintained JAX-RS samples to JUnit 5 #​24173
• fix: normalize Java annotation vendor extension lists #​24171
• [jaxrs-spec] Add @​JsonIgnoreProperties on the discriminator to avoid duplicated keys during serialisation #​24132
• [java] honor useJspecify in restclient/webclient ApiClient support class #​24055
• [Java][vertx] Apply Vert.x pool defaults in buildWebClient for useVertx5 #​24017
• [Java] Render object default for composed ($ref + default) schemas (#​23795) #​23971

Julia

• [julia-server] Use req.headers for HTTP.jl 2.x compatibility #​24102

Kotlin

• [KOTLIN-SPRING;JAVA-SPRING] bugfix: update JsonInclude annotations for optional+nullable fields to handle serialization correctly when openApiNullable = true #​24185
• [Kotlin][Spring] fix option useSpringBuiltInValidation not implemented #​24115
• [KOTLIN-SPRING/KOTLIN-CLIENT] BUG - fix json deserialization when kotlin attribute name differs from json attribute name #​24036
• [kotlin] Fix boolean const enum literal generation #​24022
• [kotlin-spring, java-spring] - gate @​JsonSetter on openApiNullable for optional non-nullable fields #​23993

openapi, openapi-yaml

• [openapi, openapi-yaml] feature - add sortOutput option to deterministically sort paths and schemas, http methods, etc... #​24037

PHP

• [PHP] Skip length validation for DateTime model properties #​24254
• Update php-laravel to newer versions #​24196
• [php-nextgen] Fix undefined variable $queryParams #​24136
• [php-nextgen] Code improvements #​23986
• [php-nextgen] oneof polymorphism #​23985
• [php-nextgen] Fix for enum allowed values #​23814

Python

• [python] support legacy model dictionaries #​24290
• fix(python-fastapi): map binary response type file to bytes #​24285
• [python] bump generated client dependency floors above vulnerable ranges #​24186
• feat(python-flask): add opt-in Connexion 3 support #​24181
• [python] Set API key cookie as key-value pair #​24149
• [python] centralize the Python constraint rules #​24141
• [python] preserve public model field names #​24131
• [python] isolate implicit API clients #​24129
• [python] add supportHttpxSync option for sync httpx methods #​24128
• [python] separate property and parameter mappings #​24121
• [python] escape model wire names #​24120
• [python] serialize structured YAML bodies #​24084
• [python] honor proxy environment settings #​24082
• [python] Run regex pattern validators in mode="before" so they see the wire value #​24072
• fix(p

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

This change is 

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/ktlint.yml

Package	Version	License	Issue Type
actions/checkout	7.*.*	Null	Unknown License

pom.xml

Package	Version	License	Issue Type
org.flywaydb:flyway-maven-plugin	13.3.0	Null	Unknown License

Allowed Licenses:

CC0-1.0, CC-BY-4.0, Unlicense, WTFPL, 0BSD, MIT, Apache-2.0, ISC, BSD-2-Clause, BSD-3-Clause, Zlib, MPL-1.1, MPL-2.0, CDDL-1.0, EPL-1.0, EPL-2.0, CECILL-2.1, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, EUPL-1.0, EUPL-1.1, EUPL-1.2, AAL, AFL-3.0, Apache-1.1, APL-1.0, APSL-2.0, Artistic-1.0-Perl, Artistic-2.0, BlueOak-1.0.0, BSL-1.0, CATOSL-1.1, CPAL-1.0, CUA-OPL-1.0, ECL-2.0, EFL-2.0, Entessa, EUDatagrid, Fair, LPPL-1.3c, LPL-1.02, MirOS, Motosoto, Multics, NASA-1.3, NCSA, NTP, Naumen, Nokia, PostgreSQL, PSF-2.0, RPSL-1.0, RSCPL, SimPL-2.0, Sleepycat, SPL-1.0, VSL-1.0, W3C, W3C-20150513, Xnet, ZPL-2.0

Excluded from license check:

pkg:githubactions/trufflesecurity/trufflehog, pkg:npm/knex, pkg:npm/mapbox-gl

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	7.*.*	🟢 7	Details Check Score Reason Maintained 🟢 10 24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
maven/com.github.gantsign.maven:ktlint-maven-plugin	3.7.1	🟢 3.1	Details Check Score Reason Code-Review ⚠️ 0 Found 1/14 approved changesets -- score normalized to 0 Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Packaging ⚠️ -1 packaging workflow not detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
maven/com.nimbusds:oauth2-oidc-sdk	11.38.2	Unknown	Unknown
maven/org.apache.maven.plugins:maven-enforcer-plugin	3.6.3	🟢 5.6	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 5 Found 9/17 approved changesets -- score normalized to 5 Maintained 🟢 10 18 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
maven/org.flywaydb:flyway-maven-plugin	13.3.0	🟢 4.7	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 9 11 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 9 Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected SAST ⚠️ 0 no SAST tool detected Binary-Artifacts 🟢 9 binaries present in source code Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0
maven/org.mockito:mockito-core	5.23.0	🟢 7.3	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 9 Found 17/18 approved changesets -- score normalized to 9 Security-Policy 🟢 9 security policy file detected Maintained 🟢 10 16 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Packaging 🟢 10 packaging workflow detected Binary-Artifacts 🟢 10 no binaries found in the repo SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
maven/org.openapitools:openapi-generator-maven-plugin	7.24.0	🟢 5.7	Details Check Score Reason Code-Review 🟢 9 GitHub code reviews found for 28 commits out of the last 30 -- score normalized to 9 Maintained 🟢 10 30 commit(s) out of 30 and 4 issue activity out of 30 found in the last 90 days -- score normalized to 10 CII-Best-Practices ⚠️ 0 no badge detected Vulnerabilities 🟢 10 no vulnerabilities detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Dependency-Update-Tool 🟢 10 update tool detected Packaging ⚠️ -1 no published package detected License 🟢 10 license file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 non read-only tokens detected in GitHub workflows Security-Policy ⚠️ 0 security policy file not detected Pinned-Dependencies ⚠️ -1 internal error: error parsing shell code: modules/openapi-generator/src/main/resources/bash/Dockerfile.mustache:1:9: reached EOF without closing quote ' Fuzzing ⚠️ 0 project is not fuzzed Binary-Artifacts ⚠️ 0 binaries present in source code
maven/org.postgresql:postgresql	42.7.12	🟢 7.7	Details Check Score Reason Code-Review 🟢 7 Found 23/30 approved changesets -- score normalized to 7 Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Dependency-Update-Tool 🟢 10 update tool detected Maintained 🟢 10 30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 9 dependency not pinned by hash detected -- score normalized to 9 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected License 🟢 10 license file detected Signed-Releases ⚠️ 1 1 out of the last 5 releases have a total of 1 signed artifacts. Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 10 SAST tool is run on all commits Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 29 out of 29 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 35 contributing companies or organizations
maven/org.springdoc:springdoc-openapi-starter-webmvc-ui	3.1.0	Unknown	Unknown

Scanned Files

• .github/workflows/ktlint.yml
• pom.xml