Bump the "dependencies" group with 20 updates across multiple ecosystems

[dependabot]

Bumps the dependencies group with 3 updates in the / directory: com.gradleup.shadow, com.gradle:develocity-gradle-plugin and com.gradle:common-custom-user-data-gradle-plugin.

Updates com.gradleup.shadow from 8.3.9 to 8.3.11

Updates com.gradle:develocity-gradle-plugin from 4.4.1 to 4.6.0

Updates com.gradle:common-custom-user-data-gradle-plugin from 2.6.0 to 2.8.0

Release notes

Sourced from com.gradle:common-custom-user-data-gradle-plugin's releases.

2.8.0

• [NEW] Detect Copilot via the COPILOT_CLI and COPILOT_AGENT environment variables, capturing the AI tag and AI agent value Copilot

2.7.0

• [NEW] Capture Cursor as an AI agent via the CURSOR_AGENT environment variable
• [NEW] Capture Gemini in Android Studio as an AI agent via the ANDROID_STUDIO_AGENT environment variable
• [FIX] Changes to AI agent metadata invalidate the configuration cache

Commits

• 94f998b Merge pull request #533 from gradle/cj/copilot-vscode-detection
• d25afee Update release note for Copilot
• 4d1ead2 Detect GitHub Copilot as an AI agent
• 2c096a6 Merge pull request #531 from gradle/chore/renovate-track-gradle-plugin-javadoc
• 5a49a5c Merge pull request #532 from ryandens/copilot-cli-detection
• 85dcaa5 Link Develocity Gradle plugin API reference instead of pinned Javadoc
• b250480 [Renovate Bot] Update plugin com.gradleup.shadow to v9.6.1 (#530)
• 620e932 Detect GitHub Copilot CLI as an AI agent
• 8b6f6e8 Merge pull request #528 from gradle/rebrand/gradle-com-to-develocity-ai
• d579eda Drop trailing slash on bare develocity.ai URLs
• Additional commits viewable in compare view

Bumps the dependencies group with 7 updates in the /core directory:

Package	From	To
com.fasterxml.jackson.core:jackson-databind	2.18.4	2.22.2
com.google.guava:guava	33.3.1-jre	33.7.2-jre
org.yaml:snakeyaml	2.6	2.7
org.junit.platform:junit-platform-launcher	1.14.3	1.14.4
org.junit.jupiter:junit-jupiter	5.13.4	5.14.4
redis.clients:jedis	7.4.1	8.0.2
com.rabbitmq:amqp-client	5.35.0	5.37.0

Updates com.fasterxml.jackson.core:jackson-databind from 2.18.4 to 2.22.2

Commits

• 25b2a22 [maven-release-plugin] prepare release jackson-databind-2.22.2
• bab1c1a Prep for 2.22.2 release
• bc03cf8 Merge branch '2.21' into 2.22
• 83379fb Merge branch '2.20' into 2.21
• 0d400c9 Merge branch '2.19' into 2.20
• ce36a27 Merge branch '2.18' into 2.19
• 7a209e1 Post-release dep version bump
• a432707 [maven-release-plugin] prepare for next development iteration
• 176df1d [maven-release-plugin] prepare release jackson-databind-2.18.10
• 7785f5f Prep for 2.18.10 release
• Additional commits viewable in compare view

Updates com.google.guava:guava from 33.3.1-jre to 33.7.2-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.2

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.2-jre</version>
  <!-- or, for Android: -->
  <version>33.7.2-android</version>
</dependency>

Jar files

• 33.7.2-jre.jar
• 33.7.2-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.2-jre
• 33.7.2-android

JDiff

• 33.7.2-jre vs. 33.7.1-jre
• 33.7.2-android vs. 33.7.1-android
• 33.7.2-android vs. 33.7.2-jre

Changelog

• collect: Changed MapMaker, CompactHashMap, and CompactHashSet deserialization to avoid eagerly allocating as much memory as a serialization payload requests (CVE-2026-102554). (a0d0c36432)

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

... (truncated)

Commits

• See full diff in compare view

Updates org.yaml:snakeyaml from 2.6 to 2.7

Updates org.junit.platform:junit-platform-launcher from 1.14.3 to 1.14.4

Commits

• See full diff in compare view

Updates org.junit.jupiter:junit-jupiter from 5.13.4 to 5.14.4

Release notes

Sourced from org.junit.jupiter:junit-jupiter's releases.

JUnit 5.14.4 = Platform 1.14.4 + Jupiter 5.14.4 + Vintage 5.14.4

See Release Notes.

Full Changelog: junit-team/junit-framework@r5.14.3...r5.14.4

JUnit 5.14.3 = Platform 1.14.3 + Jupiter 5.14.3 + Vintage 5.14.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r5.14.2...r5.14.3

JUnit 5.14.2 = Platform 1.14.2 + Jupiter 5.14.2 + Vintage 5.14.2

See Release Notes.

New Contributors

• @​uglide made their first contribution in junit-team/junit-framework#5245

Full Changelog: junit-team/junit-framework@r5.14.1...r5.14.2

JUnit 5.14.1 = Platform 1.14.1 + Jupiter 5.14.1 + Vintage 5.14.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r5.14.0...r5.14.1

JUnit 5.14.0 = Platform 1.14.0 + Jupiter 5.14.0 + Vintage 5.14.0

See Release Notes.

Full Changelog: junit-team/junit-framework@r5.13.4...r5.14.0

JUnit 5.14.0-RC1 = Platform 1.14.0-RC1 + Jupiter 5.14.0-RC1 + Vintage 5.14.0-RC1

See Release Notes.

Full Changelog: junit-team/junit-framework@r5.13.4...r5.14.0-RC1

Commits

• 096fd69 Release 5.14.4
• 11fd02b Remove JDK 24 (EOL)
• 5b7f023 Fix integration tests on JDK 27
• 18f842a Test against JDK 26 (GA) and JDK 27 (EA)
• a5bf336 Polish 5.14.4 release notes
• 7667c14 Fix race condition in NodeTestTask (#5427)
• ac01f2d Include full display name in legacy XML reports (#5524)
• fbd4a8e Include class template invocation index in legacy reporting names
• 7d6f0c0 Only check PDF for GA releases
• 14f534d Test 5.14.x against JDK 25 ga (#5623)
• Additional commits viewable in compare view

Updates redis.clients:jedis from 7.4.1 to 8.0.2

Release notes

Sourced from redis.clients:jedis's releases.

8.0.2

Jedis 8.0.2 is a maintenance release for the 8.0 line, fixing MultiDbClient failover so it recovers to a healed database and keeps health checks running when no failover candidate is available.

Changes

🐛 Bug Fixes

• Fail over to a recovered database when the active one is inoperable (#4774)
• Keep MultiDbClient health checks alive when failover has no candidate (#4759)

🧰 Maintenance

• Document that automatic recovery is not guaranteed after the permanent failure (#4776)
• Update failover.md and some javadoc (#4772)

Contributors

We'd like to thank all the contributors who worked on this release!

@​ggivo

Full Changelog: redis/jedis@v8.0.1...v8.0.2

8.0.1

Jedis 8.0.1 is a maintenance release for the 8.0 line, fixing stale cluster topology after failover in JedisCluster.

Changes

🐛 Bug Fixes

• Refresh primaryNodesCache in JedisClusterInfoCache.discoverClusterSlots (#4692, backported in #4694)

Contributors

We'd like to thank all the contributors who worked on this release!

@​insaf021

Full Changelog: redis/jedis@v8.0.0...v8.0.1

8.0.0

Jedis 8.0.0 completes the client class consolidation started in 7.0.0, modernizes protocol defaults, tightens security defaults, and adds command coverage for Redis 8.8 and the Redis 8.10 preview.

• RESP3 auto-negotiation on by default for all UnifiedJedis-based clients (with graceful RESP2 fallback)
• Final removal of legacy JedisPooled / JedisSentineled classes in favor of the RedisClient family introduced in 7.0.0
• Removal of deprecated UnifiedJedis public constructors
• Internal refactoring that affects users of low-level extension points (custom CommandExecutor, Transaction subclasses, ClusterPipeline, CommandObjects) — protocol and connection wiring is now explicit at construction time
• Search modernization — the low-level cursor APIs are superseded by ftAggregateIterator(), and the manual broadcast API is removed (Redis 8.0+ broadcasts FT.CREATE server-side)
• TLS hostname verification enforced by default in DefaultJedisSocketFactory
• New Redis 8.8 command coverage — XNACK, JSON.SET FPHA, Array commands, INCREX, COUNT aggregator on ZINTER / ZUNION(STORE) and their *STORE variants, multi-aggregator TS.RANGE / TS.MRANGE, plus an experimental COLLECT parameter for FT.AGGREGATE
• Redis 8.10 command coverage — HIMPORT (Hinted Hash Templates), FT.ALIASLIST, MAXCOUNT / MAXSIZE on XREAD and XREADGROUP, SUNIONCARD / SDIFFCARD, LMOVEM / BLMOVEM, TS.READ, TS.NRANGE / TS.NREVRANGE, TS.QUERYLABELS, and EXCLUDEEMPTY on TS.MRANGE / TS.MREVRANGE

... (truncated)

Changelog

Sourced from redis.clients:jedis's changelog.

Release Process

Releases are drafted automatically by Release Drafter and deployed by the Release workflow when a draft is published.

Branches

Branch	Hosts	Example
master	next minor or major	8.1.0-SNAPSHOT
MAJOR.x	MAJOR.0.PATCH	7.x, 8.x
MAJOR.MINOR.x	MAJOR.MINOR.PATCH	7.5.x, 8.1.x

• Minor and major releases, including betas, are tagged on master.
• Patch releases are tagged on their maintenance branch, never on master.
• A maintenance branch is cut from the GA tag commit (8.1.x from v8.1.0).
• Fixes land on master first and are backported with a PR titled Backport #<pr> to <line>: <original title>, carrying the original labels.

How the draft is produced

On every push to master or a maintenance branch, Release Drafter updates one draft per branch:

• Version is derived from the nearest GA tag reachable from the branch, ignoring prerelease tags: patch bump on maintenance branches, minor bump on master. Example: 8.x at v8.0.1 drafts 8.0.2; master at v8.0.0 drafts 8.1.0.
• Changes are the pull requests merged to the branch since the latest GA release published from that branch. For the first patch after a branch is cut, the GA tag's commit date is used as the cutoff instead.
• Betas are prereleases and are not used as a base, so GA notes are cumulative since the previous GA.
• PRs labeled skip-changelog or churn are excluded. Unlabeled PRs appear uncategorized, so label backports.

Publishing

1. Review the draft on the Releases page and edit the notes if needed.
2. Publish from the draft. This keeps the release target on the right branch, which the next draft on that branch depends on. Do not create releases from the tag page.
3. For a patch of an older line, untick Set as the latest release.
4. Publishing creates the tag and triggers the Release workflow, which sets the Maven version from the tag and deploys to Maven Central.

Major releases and betas are not derived automatically. Run the workflow

... (truncated)

Commits

• eb8cd65 Backport #4777 to 8.0.x: Draft releases from maintenance branches (#4778)
• d18e256 Backport #4771 to 8.0.x: Document that automatic recovery is not guaranteed a...
• 53fecac Backport #4765 to 8.0.x: Fail over to a recovered database when the active on...
• b7f5067 Backport #4745 to 8.0.x: Update failover.md and some javadoc (#4772)
• af815c5 Backport #4756 to 8.0.x: Keep MultiDbClient health checks alive when failover...
• 96450d3 Bump snapshot version to 8.0.2 (#4715)
• 50ec1c8 Backport #4692 to 8.0.x: refresh primaryNodesCache in JedisClusterInfoCache.d...
• 36135a0 Point snapshot example at 8.0.1-SNAPSHOT on the 8.x branch
• 2de1a6d List Redis 8.6, 8.8 and 8.10 as supported in README
• fcf59cd Update version references in README and docs for 8.0.0
• Additional commits viewable in compare view

Updates com.rabbitmq:amqp-client from 5.35.0 to 5.37.0

Release notes

Sourced from com.rabbitmq:amqp-client's releases.

5.37.0

Changes between 5.36.0 and 5.37.0

This is a maintenance release with a bug fix, a usability improvement, and dependency upgrades. It is compatible with 5.36.0. All users are encouraged to upgrade.

Harden (deprecated) JSON reader

GitHub PR: #2100

Set preferred TLS protocol to version 1.3

GitHub issue: #2098

Bump dependencies

GitHub issue: #2093

Dependency

Maven

<dependency>
  <groupId>com.rabbitmq</groupId>
  <artifactId>amqp-client</artifactId>
  <version>5.37.0</version>
</dependency>

Gradle

compile 'com.rabbitmq:amqp-client:5.37.0'

5.36.0

Changes between 5.35.0 and 5.36.0

This is a maintenance release with bug fixes and dependency upgrades. It is compatible with 5.35.0. All users are encouraged to upgrade.

Do not enable hostname verification in useTlsWithNoVerification

GitHub PR: #2081

Be more defensive when parsing shortstr values in tables

GitHub PR: #2065

Bump dependencies

... (truncated)

Commits

• 0027775 [maven-release-plugin] prepare release v5.37.0
• 0f40842 Set release version to 5.37.0
• a93de83 Merge pull request #2107 from rabbitmq/dependabot/maven/v5.x/com.diffplug.spo...
• a544309 Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.2 to 3.10.3
• b47f881 Merge pull request #2104 from rabbitmq/dependabot/maven/v5.x/org.mockito-mock...
• 50b27c5 Bump org.mockito:mockito-core from 5.23.0 to 5.24.0
• 2a374aa Merge pull request #2102 from rabbitmq/dependabot/maven/v5.x/com.fasterxml.ja...
• 2d7a009 Bump com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.3
• a1f294a ci: use Erlang 28 alphas for 4.4
• b5572cf ci: test on Ubuntu 26.04
• Additional commits viewable in compare view

Bumps the dependencies group with 2 updates in the /modules/activemq directory: org.apache.activemq:activemq-client and org.apache.activemq:artemis-jakarta-client.
Bumps the dependencies group with 3 updates in the /modules/azure directory: com.squareup.okhttp3:okhttp, com.azure:azure-sdk-bom and com.microsoft.sqlserver:mssql-jdbc.
Bumps the dependencies group with 3 updates in the /modules/clickhouse directory: com.clickhouse:client-v2, com.clickhouse:clickhouse-r2dbc and com.clickhouse:clickhouse-jdbc.
Bumps the dependencies group with 1 update in the /modules/cockroachdb directory: org.postgresql:postgresql.
Bumps the dependencies group with 1 update in the /modules/couchbase directory: com.couchbase.client:java-client.
Bumps the dependencies group with 1 update in the /modules/cratedb directory: org.postgresql:postgresql.
Bumps the dependencies group with 1 update in the /modules/databend directory: com.databend:databend-jdbc.
Bumps the dependencies group with 1 update in the /modules/elasticsearch directory: org.elasticsearch.client:elasticsearch-rest-client.
Bumps the dependencies group with 1 update in the /modules/gcloud directory: com.google.cloud:libraries-bom.
Bumps the dependencies group with 8 updates in the /modules/hivemq directory:

Package	From	To
org.apache.commons:commons-lang3	3.20.0	3.21.0
commons-io:commons-io	2.21.0	2.22.0
org.javassist:javassist	3.32.0-GA	3.33.0-GA
org.jboss.shrinkwrap:shrinkwrap-api	1.2.6	2.0.0.Final
org.jboss.shrinkwrap:shrinkwrap-impl-base	1.2.6	2.0.0.Final
com.hivemq:hivemq-extension-sdk	4.50.0	4.56.0
com.hivemq:hivemq-mqtt-client	1.3.15	1.4.0
ch.qos.logback:logback-classic	1.5.37	1.6.5

Bumps the dependencies group with 1 update in the /modules/localstack directory: software.amazon.awssdk:bom.
Bumps the dependencies group with 1 update in the /modules/milvus directory: io.milvus:milvus-sdk-java.
Bumps the dependencies group with 1 update in the /modules/mongodb directory: org.mongodb:mongodb-driver-sync.
Bumps the dependencies group with 2 updates in the /modules/mssqlserver directory: com.microsoft.sqlserver:mssql-jdbc and io.r2dbc:r2dbc-mssql.
Bumps the dependencies group with 2 updates in the /modules/mysql directory: io.asyncer:r2dbc-mysql and com.mysql:mysql-connector-j.
Bumps the dependencies group with 1 update in the /modules/oceanbase directory: com.mysql:mysql-connector-j.
Bumps the dependencies group with 1 update in the /modules/openfga directory: dev.openfga:openfga-sdk.
Bumps the dependencies group with 1 update in the /modules/oracle-free directory: com.oracle.database.jdbc:ojdbc11.
Bumps the dependencies group with 1 update in the /modules/oracle-xe directory: com.oracle.database.jdbc:ojdbc11.
Bumps the dependencies group with 3 updates in the /modules/orientdb directory: com.orientechnologies:orientdb-client, org.apache.tinkerpop:gremlin-driver and com.orientechnologies:orientdb-gremlin.
Bumps the dependencies group with 1 update in the /modules/postgresql directory: org.postgresql:postgresql.
Bumps the dependencies group with 2 updates in the /modules/qdrant directory: io.qdrant:client and io.grpc:grpc-bom.
Bumps the dependencies group with 2 updates in the /modules/questdb directory: org.postgresql:postgresql and org.questdb:questdb.
Bumps the dependencies group with 1 update in the /modules/rabbitmq directory: com.rabbitmq:amqp-client.
Bumps the dependencies group with 2 updates in the /modules/scylladb directory: com.scylladb:java-driver-core and software.amazon.awssdk:dynamodb.
Bumps the dependencies group with 1 update in the /modules/tidb directory: com.mysql:mysql-connector-j.
Bumps the dependencies group with 1 update in the /modules/toxiproxy directory: redis.clients:jedis.
Bumps the dependencies group with 1 update in the /modules/weaviate directory: io.weaviate:client6.

Updates org.apache.activemq:activemq-client from 6.2.4 to 6.3.2

Release notes

Sourced from org.apache.activemq:activemq-client's releases.

Apache ActiveMQ 6.3.2

What's Changed

Performance

• [6.3.x] #2431 Skip topic sendLock for non-persistent sends by @​mattrpav in apache/activemq#2476

Fixes

• [6.3.x] [#] Update TopicRegion removeSubscription to use connection clientId by @​mattrpav in apache/activemq#2478
• [6.3.x] Harden soTimeout vs InactivityMonitor (#2474) by @​cshannon in apache/activemq#2480
• [6.3.x] #2446 Add missing jetty dependency to assembly for websockets by @​mattrpav in apache/activemq#2483
• [6.3.x] Fix network bridge local-side close (#2475) by @​mattrpav in apache/activemq#2503
• [6.3.x] Fix: Assembly startup logs harmless WARN about schemas (#2501) by @​mattrpav in apache/activemq#2504

Dependencies

• [6.3.x] bump netty-version from 4.2.16.Final to 4.2.17.Final by @​dependabot[bot] in apache/activemq#2442
• [6.3.x] bump org.apache.qpid:qpid-jms-client from 2.10.0 to 2.11.0 by @​dependabot[bot] in apache/activemq#2451
• [6.3.x] bump jolokia-version from 2.6.0 to 2.6.1 by @​dependabot[bot] in apache/activemq#2463
• [6.3.x] bump org.apache.groovy:groovy-ant from 5.0.8 to 5.1.0 by @​dependabot[bot] in apache/activemq#2466
• [6.3.x] bump org.apache.groovy:groovy from 5.0.8 to 5.1.0 by @​dependabot[bot] in apache/activemq#2467
• [6.3.x] bump io.fabric8:docker-maven-plugin from 0.48.1 to 0.49.0 by @​dependabot[bot] in apache/activemq#2456
• [6.3.x] bump camel-version from 4.21.0 to 4.22.0 by @​dependabot[bot] in apache/activemq#2448
• [6.3.x] bump jackson-version from 2.22.1 to 2.22.2 by @​dependabot[bot] in apache/activemq#2472
• [6.3.x] Update to Jetty 12.1.12 (#2470) by @​cshannon in apache/activemq#2473
• [6.3.x] bump actions/stale from 10.4.0 to 11.0.0 by @​dependabot[bot] in apache/activemq#2294
• [6.3.x] bump spring-version from 7.0.8 to 7.0.9 by @​dependabot[bot] in apache/activemq#2484
• [6.3.x] bump actions/setup-java from 5 to 6 by @​dependabot[bot] in apache/activemq#2492
• [6.3.x] bump org.javassist:javassist from 3.32.0-GA to 3.33.0-GA by @​dependabot[bot] in apache/activemq#2490
• [6.3.x] bump org.apache.groovy:groovy-ant from 5.1.0 to 5.1.1 by @​dependabot[bot] in apache/activemq#2488
• [6.3.x] bump org.apache.groovy:groovy from 5.1.0 to 5.1.1 by @​dependabot[bot] in apache/activemq#2489

Tasks

• KEYS: Add mattrpav@apache.org GPG release key (#2497) by @​mattrpav in apache/activemq#2498

Full Changelog: apache/activemq@activemq-6.3.1...activemq-6.3.2

Apache ActiveMQ 6.3.1

What's Changed

• [6.3.x] Bootstrap activemq-6.3.x branch (#2245) by @​cshannon in apache/activemq#2262
• [6.3.x] Fix AMQP Object message decompression (#2256) by @​cshannon in apache/activemq#2260
• [6.3.x] Upgrade to Eclipse Temurin 25 for docker image by @​jbonofre in apache/activemq#2258
• [6.3.x] Fix dependabot yml typo (#2284) by @​cshannon in apache/activemq#2285
• [6.3.x] bump jakarta.el:jakarta.el-api from 6.0.0 to 6.0.1 by @​dependabot[bot] in apache/activemq#2345
• [6.3.x] bump commons-codec:commons-codec from 1.22.0 to 1.22.1 by @​dependabot[bot] in apache/activemq#2324
• [6.3.x] bump org.apache.groovy:groovy-ant from 5.0.7 to 5.0.8 by @​dependabot[bot] in apache/activemq#2318
• [6.3.x] bump org.apache.groovy:groovy from 5.0.7 to 5.0.8 by @​dependabot[bot] in apache/activemq#2314
• [6.3.x] bump org.codehaus.jettison:jettison from 1.5.6 to 1.5.7 by @​dependabot[bot] in apache/activemq#2333
• [6.3.x] bump org.apache.qpid:proton-j from 0.34.1 to 0.35.0 by @​dependabot[bot] in apache/activemq#2327
• [6.3.x] bump org.codehaus.mojo:flatten-maven-plugin from 1.7.3 to 1.8.0 by @​dependabot[bot] in apache/activemq#2302
• [6.3.x] bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.0 by @​dependabot[bot] in apache/activemq#2308
• #2271 Update Producer getDeliveryDelay() to always return zero (0) … by @​mattrpav in apache/activemq#2403

... (truncated)

Commits

• e4e8a6c [maven-release-plugin] prepare release activemq-6.3.2
• 97b6ca8 Fix: Assembly startup logs harmless WARN about schemas (#2501) (#2504)
• 3762e08 Fix network bridge local-side close (#2475) (#2503)
• afdc6e2 KEYS: Add mattrpav@apache.org GPG release key (#2497) (#2498)
• 2686f33 [6.3.x] bump org.apache.groovy:groovy from 5.1.0 to 5.1.1 (#2489)
• f0bf570 [6.3.x] bump org.apache.groovy:groovy-ant from 5.1.0 to 5.1.1 (#2488)
• 62820ea [6.3.x] bump org.javassist:javassist from 3.32.0-GA to 3.33.0-GA (#2490)
• 26e47fb [6.3.x] bump actions/setup-java from 5 to 6 (#2492)
• 0485ffc #2446 Add missing jetty dependency to assembly for websockets (#2483)
• 3dc960b [6.3.x] bump spring-version from 7.0.8 to 7.0.9 (#2484)
• Additional commits viewable in compare view

Updates org.apache.activemq:artemis-jakarta-client from 2.55.0 to 2.57.0

Updates com.squareup.okhttp3:okhttp from 5.4.0 to 5.5.0

Changelog

Sourced from com.squareup.okhttp3:okhttp's changelog.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()

• New: OkHttp artifacts are now signed with our [new signing key]. This project and three sibling projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
• Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
• Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
• Fix: Closing a multipart part's sink no longer closes the entire request body.
• Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts

... (truncated)

Commits

• a94bdf1 Prepare for release 5.5.0.
• ecc3b05 Use a fixed size for DoH request body (#9687)
• 9926082 Revert "Use a fixed size for DoH request body" (#9686)
• 0070c2e Use a fixed size for DoH request body
• 1576453 Order ServiceMetadata records per the spec (#9683)
• fb582e9 Flip wiring of Dns.SYSTEM (#9682)
• 4e884ab retryOnConnectionFailure doesn't impact ECH retries (#9681)
• 0433cee Only one contributing.md doc (#9678)
• a2cf5aa Don't recover after an ECH public_name fails to verify (#9680)
• 5410de9 Test ECH + HTTP proxy (#9671)
• Additional commits viewable in compare view

Updates com.azure:azure-sdk-bom from 1.2.32 to 1.3.8

Release notes

Sourced from com.azure:azure-sdk-bom's releases.

com.azure.resourcemanager+azure-resourcemanager-storagecache_1.3.0

1.3.0 (2026-09-02)

• Azure Resource Manager StorageCache client library for Java. This package contains Microsoft Azure SDK for StorageCache Management SDK. A Storage Cache provides scalable caching service for NAS clients, serving data from either NFSv3 or Blob at-rest storage (referred to as "Storage Targets"). These operations allow you to manage Caches. Package api-version 2026-08-01. For documentation on how to use this package, please see Azure Management Libraries for Java.

Features Added

• models.RebalanceJob was added

• models.RebalanceJobs was added

• models.RebalanceJobPropertiesStatus was added

• models.RebalanceJobUpdate was added

• models.RebalanceJobProperties was added

• models.RebalanceJobUpdateProperties was added

• models.RebalanceJobPropertiesProvisioningState was added

• models.RebalanceJobAdminStatus was added

• models.RebalanceJobStatusType was added

models.ExpansionJob$Definition was modified

• withRunRebalanceJob(java.lang.Boolean) was added

StorageCacheManager was modified

• rebalanceJobs() was added

models.ExpansionJob was modified

• runRebalanceJob() was added
• rebalanceJobId() was added

com.azure.resourcemanager+azure-resourcemanager-elasticsan_1.3.0-beta.1

1.3.0-beta.1 (2026-10-02)

• Azure Resource Manager ElasticSan client library for Java. This package contains Microsoft Azure SDK for ElasticSan Management SDK. Elastic SAN is a fully integrated solution that simplifies deploying, scaling, managing, and configuring a storage area network (SAN). It also offers built-in cloud capabilities like high availability. Elastic SAN works with many types of compute resources, such as Azure Virtual Machines, Azure VMware Solution, and Azure Kubernetes Service. Package api-version 2026-05-01-preview. For documentation on how to use this package, please see Azure Management Libraries for Java.

Breaking Changes

models.ManagedByInfo was removed

models.VolumeUpdate was modified

• withManagedBy(models.ManagedByInfo) was removed

... (truncated)

Commits

• c443b1e Update changelog, prepare for release (#34539)
• ec9f1fb Increment package versions for iothub releases (#34532)
• 61a14e0 [Automation] Generate Fluent Lite from postgresql#package-flexibleserver-2022...
• bf7ae0d Java: 'Release for iothub 2022-11-15-preivew' #3974 by lihong at 20230418 124...
• 9178513 Increment package versions for newrelicobservability releases (#34528)
• ff27e9e [Automation] Generate Fluent Lite from newrelic#package-2022-07-01 (#34524)
• ff5ef52 Increment package versions for elastic releases (#34523)
• 8225dfc Increment package versions for qumulo releases (#34522)
• d99baaf Increment package versions for security releases (#34521)
• 059967c Increment package versions for confidentialledger releases (#34520)
• Additional commits viewable in compare view

Updates com.microsoft.sqlserver:mssql-jdbc from 13.4.0.jre11 to 13.6.0.jre11

Release notes

Sourced from com.microsoft.sqlserver:mssql-jdbc's releases.

13.5.1 [Preview Release]

Added

• Add tls-unique Channel Binding Support for Kerberos and NTLM #2977

  • What was added: tls-unique channel binding support for Kerberos and NTLM authentication flows.
  • Who benefits: Applications using integrated Kerberos or NTLM authentication that require channel binding for enhanced protection against relay attacks.
  • Impact: Strengthens authentication security by binding the authentication exchange to the underlying TLS channel.
  • Note: This feature depends on a JDK API to retrieve the TLS channel binding token that is not yet available in current OpenJDK builds. It will become functional on a future OpenJDK build once that API ships — a change our team is actively contributing upstream to OpenJDK.

• Introduce Parameter Length Hints via defineParameterType and setObject #2960

  • What was added: New parameter length hints that can be supplied through defineParameterType and setObject to inform the driver of expected parameter sizes.
  • Who benefits: Applications executing parameterized varchar/nvarchar statements against the server, particularly under high concurrency or large result sets.
  • Impact: Improves performance by reducing server-side memory grants. Without a length hint the driver defaults string parameters to the maximum declared size (4000 for nvarchar, 8000 for varchar), which inflates the query's memory grant; specifying a sensible length via the new APIs lets the server size the grant to the actual data, reducing memory pressure and improving throughput. Default behavior is unchanged when no length is specified.

• Add Nanosecond Granularity Option to PerformanceLogCallback #2944

  • What was added: An option to report timing in the PerformanceLogCallback with nanosecond granularity.
  • Who benefits: Applications and tools performing fine-grained performance instrumentation of driver operations.
  • Impact: Enables higher-resolution performance measurements while preserving existing millisecond behavior by default.

• Introduce getCurrentUserSql and getCurrentStatementType in PerformanceLogCallback #2965

  • What was added: New getCurrentUserSql() and getCurrentStatementType() accessors on the PerformanceLogCallback.
  • Who benefits: Applications correlating performance telemetry with the executing SQL text and statement type.
  • Impact: Provides richer context for performance logging without affecting runtime behavior.

• Add Copilot Prompts and AI Agent Guidelines for Developer Workflows #2942

  • What was added: Reusable Copilot prompts and AI agent guidelines for common maintainer and contributor workflows.
  • Who benefits: Contributors and maintainers working in the repository.
  • Impact: Improves developer productivity and consistency; no runtime impact.

• FX-to-JUnit Migration Tests with Parallelization Tags #2938

  • What was added: Migrated FX test scenarios to JUnit 5 with parallelization tags.
  • Who benefits: Contributors and CI validation pipelines.
  • Impact: Advances FX test retirement and improves test parallelization.

• Enable Vector float16 Tests to Run on AzureDB #2985

  • What was added: Enabled vector(float16) tests to run on Azure SQL Database.
  • Who benefits: Contributors and CI validation pipelines.
  • Impact: Extends test coverage for vector(float16) scenarios on AzureDB.

Behavior Changes

• setObject parameter-length validation now throws instead of truncating silently #2960
  • What changed: The setObject overload that accepts a parameter length now validates the specified length against the actual parameter length.
  • Impact: If the value exceeds the specified length, the driver now throws an exception instead of silently truncating data.
  • Action required: Applications that relied on implicit truncation must provide a parameter length that is large enough for the actual value.

Changed

• Enhance Always Encrypted VSM/HGS Enclave Attestation Validation #2993
  • What was changed: Strengthened attestation validation for VSM/HGS enclaves in the Always Encrypted with secure enclaves flow.

...

Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: bec2d173-495d-4d46-8d39-9c080364c743

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Superseded by #12119.