[dependabot]

Bumps dnsjava:dnsjava from 3.6.5 to 3.7.0.

Release notes

Sourced from dnsjava:dnsjava's releases.

v3.7.0

News

Please pay attention to #426 - Dropping support for legacy Java versions

Changes

• GHSA-m23c-5x5g-5ff6: Missing response validation in DoH Resolver
• GHSA-rwxq-7vpj-2rm5: Unbounded Pre-allocation via DNS Header Count Fields Leads to Amplified Memory Allocation (DoS)
• GHSA-hg22-jxmg-ppq9: Message normalization fails on invalid CNAME entries
• GHSA-whp4-9hfm-h8xr: X25Record accepts Unicode digits and silently converts them into non-digit DNS wire bytes
• GHSA-m779-jq28-q7v7: TSIG: MAC comparison is not constant-time
• TSIG: BADTIME responses fail verification because the MAC does not cover the Other Data (@​kakooch, #424)
• Extend unit test coverage (@​sean-g-rae, #412)
• New config option dnsjava.secure_random_algorithm property to select SecureRandom algorithm (@​ChrisJr404, #368, #419)
• Validate SSHFP fingerprint lengths (@​andrew-boutin and @​Mahmoodifar, #414, #415)
• Handle canceled keys in TCP client (@​techee, #411)
• hosts: resolve PTR queries from the local hosts database (@​ChrisJr404, #350, #413)
• TSIG verification fails if id of message is not identical to originalId in TSIG record (@​sfeigl, #409)
• TSIG record does not parse after Message.toWire(maxLength) truncates records owned by the key name (#417)
• Full support for GOST R 34.11-2012 (@​alexmit, #422, #423)
• nio: fix selector thread from self-joining (#180)
• New flags and codes registered at IANA
• Various issues as part of an automated search with Hegel (#417)
  • LOC prints a negative altitude with a fraction as -99999.-99m
  • WKS with no services, or unsorted ports in text, throws ArrayIndexOutOfBounds
  • A6 with an IPv4-mapped suffix throws in toWire; its text cannot be re-read
  • base64.fromString accepts characters outside the alphabet and decodes garbage
  • DNSOutput.writeU8/U16/U32 accept 2^8/2^16/2^32 and write zero
  • AAAARecord(Name, int, long, InetAddress) accepts an IPv4 address (4-byte rdata)
  • type bitmaps with out-of-order window blocks are accepted and re-sorted
  • LOC seconds lose their milliseconds in text parsing
  • absent base64 fields (empty OPENPGPKEY, RRSIG without signature) NPE in toString/toWire
  • NSAP text 0 throws StringIndexOutOfBounds
  • SVCB port= is not range-checked (65536 becomes 0, -1 accepted)
  • HIP rvservers ignore the origin; relative names stay relative and toWire fails
  • RRSIG/SIG times before 1970 are accepted in text and fail in toWire
  • CAA tags are printed unquoted/unescaped
  • LOC sizes beyond 9e9 m overflow the exponent nibble into unreadable wire data
  • OPTRecord.equals throws ClassCastException for an EmptyRecord of type OPT
  • CERT certificate-type mnemonics are shifted
  • SVCB alpn values are unescaped once instead of twice
  • SVCB values with spaces are printed unescaped; empty alpn ids are accepted
  • SVCB rdata from the wire is not validated (key order, duplicates, mandatory)

... (truncated)

Changelog

Sourced from dnsjava:dnsjava's changelog.

10/26/2026

• 3.7.0 released
• GHSA-m23c-5x5g-5ff6: Missing response validation in DoH Resolver
• GHSA-rwxq-7vpj-2rm5: Unbounded Pre-allocation via DNS Header Count Fields Leads to Amplified Memory Allocation (DoS)
• GHSA-hg22-jxmg-ppq9: Message normalization fails on invalid CNAME entries
• GHSA-whp4-9hfm-h8xr: X25Record accepts Unicode digits and silently converts them into non-digit DNS wire bytes
• GHSA-m779-jq28-q7v7: TSIG: MAC comparison is not constant-time
• TSIG: BADTIME responses fail verification because the MAC does not cover the Other Data (@​kakooch, #424)
• Extend unit test coverage (@​sean-g-rae, #412)
• New config option dnsjava.secure_random_algorithm property to select SecureRandom algorithm (@​ChrisJr404, #368, #419)
• Validate SSHFP fingerprint lengths (@​andrew-boutin and @​Mahmoodifar, #414, #415)
• Handle canceled keys in TCP client (@​techee, #411)
• hosts: resolve PTR queries from the local hosts database (@​ChrisJr404, #350, #413)
• TSIG verification fails if id of message is not identical to originalId in TSIG record (@​sfeigl, #409)
• TSIG record does not parse after Message.toWire(maxLength) truncates records owned by the key name (#417)
• Full support for GOST R 34.11-2012 (@​alexmit, #422, #423)
• nio: fix selector thread from self-joining (#180)
• New flags and codes registered at IANA
• Various issues as part of an automated search with Hegel (#417)
  • LOC prints a negative altitude with a fraction as -99999.-99m
  • WKS with no services, or unsorted ports in text, throws ArrayIndexOutOfBounds
  • A6 with an IPv4-mapped suffix throws in toWire; its text cannot be re-read
  • base64.fromString accepts characters outside the alphabet and decodes garbage
  • DNSOutput.writeU8/U16/U32 accept 2^8/2^16/2^32 and write zero
  • AAAARecord(Name, int, long, InetAddress) accepts an IPv4 address (4-byte rdata)
  • type bitmaps with out-of-order window blocks are accepted and re-sorted
  • LOC seconds lose their milliseconds in text parsing
  • absent base64 fields (empty OPENPGPKEY, RRSIG without signature) NPE in toString/toWire

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)