Skip to content

Bump the dependencies group across 1 directory with 14 updates#487

Draft
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/maven/main/dependencies-4f52c1f276
Draft

Bump the dependencies group across 1 directory with 14 updates#487
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/maven/main/dependencies-4f52c1f276

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 14 updates in the / directory:

Package From To
org.apache:apache 37 39
org.apache.groovy:groovy 5.0.5 5.0.6
org.apache.groovy:groovy-ant 5.0.5 5.0.6
com.google.errorprone:error_prone_core 2.49.0 2.50.0
com.palantir.javaformat:palantir-java-format 2.90.0 2.94.0
org.eclipse.jgit:org.eclipse.jgit 7.6.0.202603022253-r 7.7.0.202606012155-r
biz.aQute.bnd:bnd-baseline-maven-plugin 7.2.3 7.3.0
biz.aQute.bnd:bnd-maven-plugin 7.2.3 7.3.0
org.cyclonedx:cyclonedx-maven-plugin 2.9.1 2.9.2
org.codehaus.gmavenplus:gmavenplus-plugin 4.3.1 5.0.0
org.jacoco:jacoco-maven-plugin 0.8.14 0.8.15
com.github.spotbugs:spotbugs-maven-plugin 4.9.8.3 4.10.2.0
com.diffplug.spotless:spotless-maven-plugin 3.4.0 3.8.0
com.github.eirslett:frontend-maven-plugin 2.0.0 2.0.1

Updates org.apache:apache from 37 to 39

Release notes

Sourced from org.apache:apache's releases.

Apache Parent POM version 39

see push-to-atr profile integration documentation for more details: https://maven.apache.org/pom/asf/#the-push-to-atr-profile

🚀 New features and improvements

👻 Maintenance

📦 Dependency updates

Apache Parent POM version 38

👻 Maintenance

📦 Dependency updates

  • Bump org.apache.maven.plugins:maven-invoker-plugin from 3.10.0 to 3.10.1 (#578) @dependabot[bot]
  • Bump org.apache.maven.plugins:maven-invoker-plugin from 3.9.1 to 3.10.0 (#575) @dependabot[bot]
  • Bump org.apache.maven.plugins:maven-resources-plugin from 3.4.0 to 3.5.0 (#572) @dependabot[bot]
  • Bump org.apache.maven.plugins:maven-shade-plugin from 3.6.1 to 3.6.2 (#573) @dependabot[bot]
  • Bump org.apache.apache.resources:apache-source-release-assembly-descriptor from 1.7 to 1.8 (#571) @dependabot[bot]
  • Bump version.maven-surefire from 3.5.4 to 3.5.5 (#570) @dependabot[bot]
  • Bump org.apache.maven.plugins:maven-dependency-plugin from 3.9.0 to 3.10.0 (#568) @dependabot[bot]
  • Bump org.apache.maven.plugins:maven-compiler-plugin from 3.14.1 to 3.15.0 (#567) @dependabot[bot]
Commits

Updates org.apache.groovy:groovy from 5.0.5 to 5.0.6

Commits

Updates org.apache.groovy:groovy-ant from 5.0.5 to 5.0.6

Commits

Updates org.apache.groovy:groovy-ant from 5.0.5 to 5.0.6

Commits

Updates com.google.errorprone:error_prone_core from 2.49.0 to 2.50.0

Release notes

Sourced from com.google.errorprone:error_prone_core's releases.

Error Prone 2.50.0

New checks:

Closed issues: #5553, #5649, #5778

Full changelog: google/error-prone@v2.49.0...v2.50.0

Commits
  • d802cff Release Error Prone 2.50.0
  • b12b5f2 In StringCharset, move the description from explanation to summary.
  • a7ca02a Update AssertThrowsUtils to emit var thrown = assertThrows(...) instead o...
  • 6b56517 Fix handling of nested tags in UnrecognisedJavadocTag
  • d36e74f Remove translation of the fail() message into assertThrows(). We already ...
  • c3581e9 Fix JavacFileManager compiler crash during speculative recompiles in modular ...
  • da1f32b Remove assignments from assertThrows() lambdas. A large percentage of remai...
  • dee62f7 Update AssertThrowsBlockToExpression to re-write single VariableTrees int...
  • 4939448 Only hoist the last statement into the assertThrows() lambda.
  • 30fd05a refactor: Rename JavaLangClash bug pattern to AvoidCommonTypeNames
  • Additional commits viewable in compare view

Updates com.palantir.javaformat:palantir-java-format from 2.90.0 to 2.94.0

Release notes

Sourced from com.palantir.javaformat:palantir-java-format's releases.

2.94.0

🐛 Fixes

  • Fix Spotless targetExclude patterns being overridden (#1690)

Full Changelog: 2.93.0...2.94.0

2.93.0

No documented user-facing changes

Full Changelog: 2.92.0...2.93.0

2.92.0

🐛 Fixes

  • Only run the formatter on trusted projects (#1681)

Full Changelog: 2.91.0...2.92.0

2.91.0

🐛 Fixes

  • Fix issue when wrapping markdown docstrings resulted in 2 slashes instead of 3 (#1672)

Full Changelog: 2.90.0...2.91.0

Commits
  • df34ef1 Release 2.94.0
  • 10a95e0 Fix Spotless targetExclude patterns being overridden (#1690)
  • dd4a4f3 Excavator: Update open-source publishing plugins (#1698)
  • 76230af [High Priority] Excavator: Update gradle-jdks infrastructure plugins (#1697)
  • dbb7b0f Excavator: Upgrade failure-reports plugin (#1696)
  • 2b13c9d Excavator: Upgrade Java dependency com.palantir.gradle.consistentversions:gr...
  • db154ea [High Priority] Excavator: Upgrade gradle-consistent-versions (#1694)
  • 43cbc69 [High Priority] Excavator: Update gradle-jdks infrastructure plugins (#1693)
  • a0637ea Excavator: Upgrade Java dependency com.diffplug.spotless:spotless-plugin-gra...
  • e3c0362 [High Priority] Excavator: Upgrade buildscript dependencies (#1691)
  • Additional commits viewable in compare view

Updates org.eclipse.jgit:org.eclipse.jgit from 7.6.0.202603022253-r to 7.7.0.202606012155-r

Commits
  • e15d659 JGit v7.7.0.202606012155-r
  • 16df208 Merge branch 'master' into stable-7.7
  • a6a41b9 Merge branch 'stable-7.6'
  • 84486f7 Merge branch 'stable-7.5' into stable-7.6
  • ee07d2b Merge branch 'stable-7.4' into stable-7.5
  • b6ab654 Merge branch 'stable-7.3' into stable-7.4
  • 305fbee Merge branch 'stable-7.2' into stable-7.3
  • dd1d7b0 Merge branch 'stable-7.1' into stable-7.2
  • 49b2a10 Merge branch 'stable-7.0' into stable-7.1
  • 957ef28 Merge branch 'stable-6.10' into stable-7.0
  • Additional commits viewable in compare view

Updates biz.aQute.bnd:bnd-baseline-maven-plugin from 7.2.3 to 7.3.0

Release notes

Sourced from biz.aQute.bnd:bnd-baseline-maven-plugin's releases.

Bnd/Bndtools 7.3.0

See Release Notes

Commits
  • bf5b578 build: Build Release 7.3.0
  • 86529ea docs: auto-generated content
  • 02de52f Docs: Add HTTP headers override section
  • 002a72e Set explicit headers before defaults and refine logging
  • caa5827 Do not overwrite existing request properties
  • d9e8e96 fix build and Sonatype upload issues
  • 90e8d8b Merge pull request #7216 from kwin/patch-8
  • 0c7dfa4 Fix heading level
  • 72b494a Merge pull request #7212 from bndtools/dependabot/github_actions/ruby/setup-r...
  • 77fe017 Merge pull request #7213 from bndtools/dependabot/maven/maven-plugins/org.apa...
  • Additional commits viewable in compare view

Updates biz.aQute.bnd:bnd-maven-plugin from 7.2.3 to 7.3.0

Release notes

Sourced from biz.aQute.bnd:bnd-maven-plugin's releases.

Bnd/Bndtools 7.3.0

See Release Notes

Commits
  • bf5b578 build: Build Release 7.3.0
  • 86529ea docs: auto-generated content
  • 02de52f Docs: Add HTTP headers override section
  • 002a72e Set explicit headers before defaults and refine logging
  • caa5827 Do not overwrite existing request properties
  • d9e8e96 fix build and Sonatype upload issues
  • 90e8d8b Merge pull request #7216 from kwin/patch-8
  • 0c7dfa4 Fix heading level
  • 72b494a Merge pull request #7212 from bndtools/dependabot/github_actions/ruby/setup-r...
  • 77fe017 Merge pull request #7213 from bndtools/dependabot/maven/maven-plugins/org.apa...
  • Additional commits viewable in compare view

Updates org.cyclonedx:cyclonedx-maven-plugin from 2.9.1 to 2.9.2

Release notes

Sourced from org.cyclonedx:cyclonedx-maven-plugin's releases.

2.9.2

🚀 New features and improvements

  • chore: upgrade maven-dependency-analyzer/asm, support Java 25 (#630) @​shihyuho

📦 Dependency updates

🔧 Build

Commits
  • 0fe189d [maven-release-plugin] prepare release cyclonedx-maven-plugin-2.9.2
  • 96c218c update scm urls
  • 0fe08b4 Revert "Bump JamesIves/github-pages-deploy-action from 4.7.3 to 4.8.0"
  • 6779e48 Revert "Bump release-drafter/release-drafter from 6 to 7"
  • 955fead switch to Central Publishing Portal
  • 50dbac7 Bump release-drafter/release-drafter from 6 to 7
  • d50bc58 Bump org.apache.maven.plugins:maven-project-info-reports-plugin
  • 1034644 Bump plugin-tools.version from 3.15.0 to 3.15.2
  • 018ab8e Bump commons-codec:commons-codec from 1.17.1 to 1.22.0
  • e359705 Bump JamesIves/github-pages-deploy-action from 4.7.3 to 4.8.0
  • Additional commits viewable in compare view

Updates org.codehaus.gmavenplus:gmavenplus-plugin from 4.3.1 to 5.0.0

Release notes

Sourced from org.codehaus.gmavenplus:gmavenplus-plugin's releases.

5.0.0

Bugs

  • Fix Javadoc mismatch in ReflectionUtils.getDeclaredMethods (#365)
  • Remove unneeded fork parameter (#361)
  • Fix Groovy 5 shell support (closes #367) (#380)

Enhancements

  • Support Groovy 6 changes to GroovyDoc (closes #381) (#382)

Potentially breaking changes

  • Removed the fork parameter
  • GMavenPlus no longer includes JLine, Jansi, Ant, or Ivy dependencies

Notes

  • GMavenPlus used to include the Jansi 2.4 and JLine 2.14.6 so that Groovy 2.2.0-beta-1 and newer would have colors work in Groovysh out of the box. However, JLine 2 is EOL, Groovy 5.x uses Jline 3, and Groovy 6.x uses JLine 4. Additionally, Maven 3.9 introduces a JLine 2.x into the classpath. This meant that Groovy 5.x and 6.x would never have their colors work with Maven 3.9.
  • GMavenPlus used to include Ant and Ivy, to make it easy to use @Grab and AntBuilder in scripts, Groovysh, and Groovy Console. The need to remove JLine/Jansi gave a reason to revisit this philosophy. Here are the reasons why this was abandoned.
    • The plugin version can win over the version in the project (unless you make sure to use an <exclusion>
    • To avoid downloading dependencies you may or may not need
    • If future Groovy versions use other versions of Ant/Ivy (like we ran into with JLine/Jansi), we'll have a similar breaking change needed
  • Here are examples of how to add back the dependencies you need 
    <plugin>
  <groupId>org.codehaus.gmavenplus</groupId>
  <artifactId>gmavenplus-plugin</artifactId>
  <version>5.0.0</version>
  <executions>
    <execution>
      <goals>
        <goal>execute</goal>
      </goals>
    </execution>
  </executions>
  <dependencies>
    <!-- Add Apache Ant if using AntBuilder -->
    <dependency>
      <groupId>org.apache.ant</groupId>
      <artifactId>ant</artifactId>
      <version>1.10.15</version>
    </dependency>
    <!-- Add Apache Ivy if using @Grab -->
    <dependency>
      <groupId>org.apache.ivy</groupId>
      <artifactId>ivy</artifactId>
      <version>2.5.3</version>
    </dependency>
    <!-- Add JLine 2 if using shell with Groovy 2.x/3.x/4.x -->
    <dependency>
      <groupId>jline</groupId>
      <artifactId>jline</artifactId>
      <version>2.14.6</version>

... (truncated)

Commits
  • 52163dc [maven-release-plugin] prepare release 5.0.0
  • 959772b [maven-release-plugin] rollback the release of 5.0.0
  • f80ff7f [maven-release-plugin] prepare for next development iteration
  • 36c703f [maven-release-plugin] prepare release 5.0.0
  • d075861 build: Upgrade Maven wrapper to 3.9.16
  • 1a93e6a Merge pull request #382 from groovy/381
  • 7283058 feat: Add version check and warning for all Groovy 6 GroovyDoc properties whe...
  • e2b0566 feat: Add version check and warning when preLanguage is used with older Groov...
  • fab97d2 feat: Support Groovy 6 changes to GroovyDoc (closes #381)
  • ddc14ad fix: Fix Groovy 5 shell support (closes #367) (#380)
  • Additional commits viewable in compare view

Updates org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15

Release notes

Sourced from org.jacoco:jacoco-maven-plugin's releases.

0.8.15

New Features

  • JaCoCo now officially supports Java 26 (GitHub #2076).
  • Experimental support for Java 27 class files (GitHub #2004).
  • Compatibility methods generated by Kotlin compiler for functions defined in interfaces are filtered out during generation of report (GitHub #1905).
  • Compatibility methods generated by Kotlin compiler for exposed boxed inline value classes (JvmExposeBoxed annotation) are filtered out during generation of report (GitHub #1944).
  • Methods generated by the Kotlin compiler for functions with JvmStatic annotation are filtered out during generation of report (GitHub #2097).
  • Improved filtering of bytecode generated by Kotlin compiler for when expressions and statements with kotlin.String subject where first branch condition contains string with largest hash (GitHub #2098).
  • Part of bytecode that javac versions from 24 to 26 generate for switch statements and expressions with selector expression of type java.lang.String inside lambdas is filtered out during generation of report (GitHub #2023).
  • Improved performance of Kotlin files analysis by parsing SMAPs only once per class (GitHub #2114).
  • For better performance agent output methods tcpclient and tcpserver use BufferedOutputStream to write execution data to socket. Maven plugin, Ant tasks, CLI, API usage examples, and ExecDumpClient API use BufferedInputStream to read execution data from socket. Third-party integrations should do the same to benefit from this change in agent (GitHub #2089).

Fixed bugs

  • Fixed processing of Kotlin SMAP in synthetic classes (GitHub #1985).
  • Multiple JaCoCo runtimes within one JVM writing to the same output file should not cause data corruption when running on JDK versions from 6 to 10 affected by JDK-8166253 (GitHub #2065, #2074).
  • For better performance agent writes to output file via BufferedOutputStream, this fixes regression introduced in version 0.6.2 (GitHub #2073).
  • Fixed NullPointerException when JaCoCo agent is loaded by non system class loader, for example when loaded by JBoss Modules (GitHub #1651).

Non-functional Changes

  • JaCoCo now depends on ASM 9.10.1 (GitHub #2134).
Commits
  • 6c5260a Prepare release v0.8.15
  • 5c05141 Transfer of execution data through socket should use buffered stream (#2089)
  • ab5efa9 Remove from Azure Pipelines all builds except with JDK 5 and JDK EA (#2148)
  • 5f6ea38 Use Windows 2025 image in GitHub Actions (#2130)
  • 35a8af2 Use Renovate instead of Dependabot for updates of ASM (#2137)
  • 85b8ddf Upgrade ASM to 9.10.1 (#2134)
  • 2988647 AgentModule should use ClassLoader of agent instead of SystemClassLoader (#1651)
  • 75a4e31 Add filter for Kotlin @JvmExposeBoxed (#1944)
  • 691fa1d Use Renovate instead of Dependabot for updates of GitHub Actions (#2132)
  • 3e18f17 Require at least JDK 21 for build (#2128)
  • Additional commits viewable in compare view

Updates com.github.spotbugs:spotbugs-maven-plugin from 4.9.8.3 to 4.10.2.0

Release notes

Sourced from com.github.spotbugs:spotbugs-maven-plugin's releases.

Spotbugs Maven Plugin 4.10.2.0

  • Support spotbugs 4.10.2

What's Changed

Full Changelog: spotbugs/spotbugs-maven-plugin@spotbugs-maven-plugin-4.9.8.5...spotbugs-maven-plugin-4.10.2.0

Spotbugs Maven Plugin 4.9.8.5

What's Changed

Full Changelog: spotbugs/spotbugs-maven-plugin@spotbugs-maven-plugin-4.9.8.4...spotbugs-maven-plugin-4.9.8.5

Spotbugs Maven Plugin 4.9.8.4

  • build support for maven 4 with maven 4 plugins
  • spotbugs extensions jars now moved to target/spotbugs instead of root
  • new spotbugs-aggregate mojo for multi module
  • support maven toolchains
  • block gui when environment is headless
  • all spotbug extensions as regular dependencies
  • learn to map spotbug extensions to their source project documentation
  • in auxiliary class path exclude java.* packages
  • improve code coverage

note: This release was done on older spotbugs (not the new 4.10.1) on purpose to keep these changes separate from that of spotbugs. The spotbugs 4.10.1 support release will be available in a day or two and users can otherwise override the core module as there are no changes to be done internally.

Commits
  • 2d39b75 [maven-release-plugin] prepare release spotbugs-maven-plugin-4.10.2.0
  • 6c300e6 [pom] Bump internal spotbugs to 4.9.8.5
  • 250d685 Merge pull request #1425 from spotbugs/renovate/spotbugs.version
  • 12f6fb3 Merge pull request #1429 from spotbugs/hazendaz-patch-1
  • aaf0a09 Update ci.yaml
  • 8b5dff4 Merge branch 'master' into renovate/spotbugs.version
  • c83698d Update pom.xml
  • b8788fd [maven-release-plugin] prepare for next development iteration
  • f758cb5 [maven-release-plugin] prepare release spotbugs-maven-plugin-4.9.8.5
  • cec6af5 Update pom.xml
  • Additional commits viewable in compare view

Updates com.diffplug.spotless:spotless-maven-plugin from 3.4.0 to 3.8.0

Release notes

Sourced from com.diffplug.spotless:spotless-maven-plugin's releases.

Maven Plugin v3.8.0

Added

  • Add support for custom string format for license header copyright year via yearStringFormat(). (#2965)

Fixed

  • <expandWildcardImports> no longer triggers a full transitive dependency resolution on every build. Dependency resolution is now deferred until the step actually runs, so projects that do not use <expandWildcardImports> (or that use version ranges) are no longer penalized. (#2983)

Maven Plugin v3.7.0

Fixed

  • Parse standard git year output in LicenseHeaderStep. (#2940)
  • <toggleOffOn> no longer disables lint-only steps such as <forbidWildcardImports>. (#2962)
  • Fix StringIndexOutOfBoundsException in scenarios where copyright year is surrounded by whitespace. (#2973)

Added

  • Add support for AsciiDoc formatting via adocfmt. (#2960)
  • <flexmark> step now supports arbitrary formatter options via <formatterOptions>. (#2968)

Maven Plugin v3.6.0

Added

  • Add <cacheDirectory> to <eclipse>, <greclipse>, and <eclipseCdt> for the Equo/Solstice P2 cache. (#2944)
  • EclipseJdtFormtterStep now can conditionally set compiler source/compliance options. Allows for better parsing of AST Node for newer language features and more correct sorting; e.g. records or seal classes. (#2942)

Fixed

  • <versionCatalog> no longer splits long inline tables across multiple lines — Gradle's TOML 1.0 parser cannot read multi-line inline tables. The maxLineLength option has been removed. (#2948)
  • spotless:apply no longer aborts on the first file with lints; it now formats all files and reports a single aggregated lint failure across every file, matching the Gradle plugin's behavior. (#2937)
  • <greclipse> and <eclipseCdt> now default P2 data to the Maven local repository. (#2944)
  • forbidWildcardImports and forbidModuleImports now detect imports that have leading whitespace (indentation/tabs). (#2939)

Changes

  • Improved formatting performance by eliminating redundant per-step line-ending normalization in the core formatter loop. (#2934)

Maven Plugin v3.5.1

Fixed

  • <licenseHeader> with <yearMode>SET_FROM_GIT</yearMode> no longer runs git log through a shell, eliminating a shell-injection vector when formatting files whose names contain shell metacharacters.
  • Bump transitive plexus-utils 4.0.2 -> 4.0.3 to address CVE-2025-67030. (#2919)

Maven Plugin v3.5.0

Added

  • <scalafmt> now reads the version from the version field in the scalafmt config file when no <version> is explicitly set, falling back to the built-in default only if neither is available. (#2922)
  • Add <toml> format type with <versionCatalog> step for formatting and sorting Gradle version catalog files. (#2916)
  • Add <javaparserVersion> option to <cleanthat>, allowing users to override the JavaParser version pulled in transitively by Cleanthat. (#2903)
  • Add a expandWildcardImports API for java (#2829)

Fixed

  • Preserve case of JDBI named bind params that collide with SQL keywords (e.g. :limit, :offset) in the DBeaver SQL formatter. (#2899)
  • The -Dspotless.ratchetFrom=... user property now takes priority over <ratchetFrom> configured in the plugin or in individual formatters, instead of being overridden by them. (#2896, fixes #2842)
  • Fix non-idempotent formatting when importOrder() is combined with greclipse(): a single catch-all group no longer strips blank lines that greclipse() independently inserted between import groups. (#2914)

Changes

  • Fix expandWildcardImports failing on JDK XML types such as org.xml.sax.InputSource. (#2921)
  • Use Eclipse JDT's collator-based comparison when sorting Java members to better match Eclipse save actions. (#2920)
  • Bump default cleanthat version 2.24 -> 2.25. (#2903)
  • Bump default eclipse-jdt version from 4.35 to 4.39. (#2912)
Changelog

Sourced from com.diffplug.spotless:spotless-maven-plugin's changelog.

spotless-lib and spotless-lib-extra releases

If you are a Spotless user (as opposed to developer), then you are probably looking for:

This document is intended for Spotless developers.

We adhere to the keepachangelog format (starting after version 1.27.0).

[Unreleased]

[4.8.0] - 2026-06-29

Added

  • Add support for custom string format for license header copyright year via yearStringFormat(). (#2965)

[4.7.0] - 2026-06-16

Added

  • Add support for AsciiDoc formatting via adocfmt. (#2960)
  • flexmark step now supports arbitrary formatter options via a formatterOptions map. (#2968)

Fixed

  • FenceStep.preserveWithin now forwards lints from nested steps while still suppressing lints inside preserved blocks. (#2962)
  • Support ktfmt 0.63 and use its new builder API for formatting options to better avoid future breaking changes.
  • Parse standard git year output in LicenseHeaderStep. (#2940)
  • Fix StringIndexOutOfBoundsException in scenarios where copyright year is surrounded by whitespace. (#2973)

Changes

  • Bump default greclipse version to latest 4.35 -> 4.39. (#2924)

[4.6.2] - 2026-05-27

Fixed

  • P2Provisioner now passes cache directory overrides directly to Solstice. (#2944)
  • forbidWildcardImports and forbidModuleImports now detect imports that have leading whitespace (indentation/tabs). (#2939)
  • versionCatalog step no longer splits long inline tables across multiple lines — Gradle's TOML 1.0 parser cannot read multi-line inline tables. The maxLineLength option has been removed. (#2948)

Changes

  • EclipseJdtFormtterStep now can conditionally set compiler source/compliance options. Allows for better parsing of AST Node for newer language features and more correct sorting; e.g. records or seal classes. (#2942)
  • Formatter no longer recomputes line-ending normalization (LineEnding.toUnix) a second time for every formatter step that changes content, removing redundant O(n) work from the core formatting loop. (#2934)
  • expandWildcardImports support pom type dependency. (#2839)

[4.6.1] - 2026-05-15

Fixed

  • LicenseHeaderStep in SET_FROM_GIT year mode no longer invokes git log through bash -c / cmd /c, eliminating a shell-injection vector when processing repositories that contain files whose names include shell metacharacters.

[4.6.0] - 2026-05-14

Added

  • scalafmt() now reads the version from the version field in the scalafmt config file when no version is explicitly set in the plugin config, falling back to the built-in default only if neither is available. (#2922)
  • Add versionCatalog step for formatting and sorting Gradle version catalog (.toml) files. (#2916)
  • Add javaparserVersion option to the Cleanthat step, allowing callers to override the JavaParser version pulled in transitively by Cleanthat. (#2903)

Fixed

... (truncated)

Commits
  • 03d43ba Published maven/3.8.0
  • 8b80c13 Published gradle/8.8.0
  • 8ee6cf9 Published lib/4.8.0
  • 6c02c0b Add missing changelog entry.
  • 264f4cc Add regression test for forbidWildcardImports inside toggleOffOn (#2982)
  • 6abb064 fix #2983, expandWildcardImports triggers a full transitive reso… (#2984)
  • f4536d4 Update plugin spotbugs to v6.5.8 (#2987)
  • 873454a Update plugin spotbugs to v6.5.8
  • 000b8a8 Update dependency org.junit.jupiter:junit-jupiter to v6.1.1 (#2985)
  • 84ebcab Update dependency org.junit.jupiter:junit-jupiter to v6.1.1
  • Additional commits viewable in compare view

Updates com.github.eirslett:frontend-maven-plugin from 2.0.0 to 2.0.1

Changelog

Sourced from com.github.eirslett:frontend-maven-plugin's changelog.

2.0.1

  • Use pnpm .mjs file if it exists to support 11+ (#1224)
Commits
  • 2206c89 [maven-release-plugin] prepare release frontend-plugins-2.0.1
  • 58bc233 Bump qs in /frontend-maven-plugin/src/it/example project
  • aa448f6 Bump postcss in /frontend-maven-plugin/src/it/example project
  • e424336 Bump ip-address in /frontend-maven-plugin/src/it/example project
  • ae16551 adding changelog
  • 47eb8bb for pnpm 11+ returning the .mjs file instead of the .cjs which is not executable
  • 1e5741f Bump vite in /frontend-maven-plugin/src/it/example project
  • 12da4f1 Bump basic-ftp in /frontend-maven-plugin/src/it/example project
  • aca9d8b Fix assertion
  • c5c7571 Reduce number of IT dependencies
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • `@dependabot recr...

Description has been truncated

@dependabot
Bump the dependencies group across 1 directory with 14 updates
3e1d48b 
Bumps the dependencies group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [org.apache:apache](https://github.com/apache/maven-apache-parent) | `37` | `39` |
| [org.apache.groovy:groovy](https://github.com/apache/groovy) | `5.0.5` | `5.0.6` |
| [org.apache.groovy:groovy-ant](https://github.com/apache/groovy) | `5.0.5` | `5.0.6` |
| [com.google.errorprone:error_prone_core](https://github.com/google/error-prone) | `2.49.0` | `2.50.0` |
| [com.palantir.javaformat:palantir-java-format](https://github.com/palantir/palantir-java-format) | `2.90.0` | `2.94.0` |
| [org.eclipse.jgit:org.eclipse.jgit](https://github.com/eclipse-jgit/jgit) | `7.6.0.202603022253-r` | `7.7.0.202606012155-r` |
| [biz.aQute.bnd:bnd-baseline-maven-plugin](https://github.com/bndtools/bnd) | `7.2.3` | `7.3.0` |
| [biz.aQute.bnd:bnd-maven-plugin](https://github.com/bndtools/bnd) | `7.2.3` | `7.3.0` |
| [org.cyclonedx:cyclonedx-maven-plugin](https://github.com/CycloneDX/cyclonedx-maven-plugin) | `2.9.1` | `2.9.2` |
| [org.codehaus.gmavenplus:gmavenplus-plugin](https://github.com/groovy/GMavenPlus) | `4.3.1` | `5.0.0` |
| [org.jacoco:jacoco-maven-plugin](https://github.com/jacoco/jacoco) | `0.8.14` | `0.8.15` |
| [com.github.spotbugs:spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) | `4.9.8.3` | `4.10.2.0` |
| [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) | `3.4.0` | `3.8.0` |
| [com.github.eirslett:frontend-maven-plugin](https://github.com/eirslett/frontend-maven-plugin) | `2.0.0` | `2.0.1` |



Updates `org.apache:apache` from 37 to 39
- [Release notes](https://github.com/apache/maven-apache-parent/releases)
- [Commits](https://github.com/apache/maven-apache-parent/commits)

Updates `org.apache.groovy:groovy` from 5.0.5 to 5.0.6
- [Commits](https://github.com/apache/groovy/commits)

Updates `org.apache.groovy:groovy-ant` from 5.0.5 to 5.0.6
- [Commits](https://github.com/apache/groovy/commits)

Updates `org.apache.groovy:groovy-ant` from 5.0.5 to 5.0.6
- [Commits](https://github.com/apache/groovy/commits)

Updates `com.google.errorprone:error_prone_core` from 2.49.0 to 2.50.0
- [Release notes](https://github.com/google/error-prone/releases)
- [Commits](google/error-prone@v2.49.0...v2.50.0)

Updates `com.palantir.javaformat:palantir-java-format` from 2.90.0 to 2.94.0
- [Release notes](https://github.com/palantir/palantir-java-format/releases)
- [Commits](palantir/palantir-java-format@2.90.0...2.94.0)

Updates `org.eclipse.jgit:org.eclipse.jgit` from 7.6.0.202603022253-r to 7.7.0.202606012155-r
- [Commits](eclipse-jgit/jgit@v7.6.0.202603022253-r...v7.7.0.202606012155-r)

Updates `biz.aQute.bnd:bnd-baseline-maven-plugin` from 7.2.3 to 7.3.0
- [Release notes](https://github.com/bndtools/bnd/releases)
- [Commits](bndtools/bnd@7.2.3...7.3.0)

Updates `biz.aQute.bnd:bnd-maven-plugin` from 7.2.3 to 7.3.0
- [Release notes](https://github.com/bndtools/bnd/releases)
- [Commits](bndtools/bnd@7.2.3...7.3.0)

Updates `org.cyclonedx:cyclonedx-maven-plugin` from 2.9.1 to 2.9.2
- [Release notes](https://github.com/CycloneDX/cyclonedx-maven-plugin/releases)
- [Commits](CycloneDX/cyclonedx-maven-plugin@cyclonedx-maven-plugin-2.9.1...cyclonedx-maven-plugin-2.9.2)

Updates `org.codehaus.gmavenplus:gmavenplus-plugin` from 4.3.1 to 5.0.0
- [Release notes](https://github.com/groovy/GMavenPlus/releases)
- [Commits](groovy/GMavenPlus@4.3.1...5.0.0)

Updates `org.jacoco:jacoco-maven-plugin` from 0.8.14 to 0.8.15
- [Release notes](https://github.com/jacoco/jacoco/releases)
- [Commits](jacoco/jacoco@v0.8.14...v0.8.15)

Updates `com.github.spotbugs:spotbugs-maven-plugin` from 4.9.8.3 to 4.10.2.0
- [Release notes](https://github.com/spotbugs/spotbugs-maven-plugin/releases)
- [Commits](spotbugs/spotbugs-maven-plugin@spotbugs-maven-plugin-4.9.8.3...spotbugs-maven-plugin-4.10.2.0)

Updates `com.diffplug.spotless:spotless-maven-plugin` from 3.4.0 to 3.8.0
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](diffplug/spotless@maven/3.4.0...maven/3.8.0)

Updates `com.github.eirslett:frontend-maven-plugin` from 2.0.0 to 2.0.1
- [Changelog](https://github.com/eirslett/frontend-maven-plugin/blob/master/CHANGELOG.md)
- [Commits](eirslett/frontend-maven-plugin@frontend-plugins-2.0.0...frontend-plugins-2.0.1)

---
updated-dependencies:
- dependency-name: org.apache:apache
  dependency-version: '39'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: org.apache.groovy:groovy
  dependency-version: 5.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.apache.groovy:groovy-ant
  dependency-version: 5.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.apache.groovy:groovy-ant
  dependency-version: 5.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: com.google.errorprone:error_prone_core
  dependency-version: 2.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.palantir.javaformat:palantir-java-format
  dependency-version: 2.94.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: org.eclipse.jgit:org.eclipse.jgit
  dependency-version: 7.7.0.202606012155-r
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: biz.aQute.bnd:bnd-baseline-maven-plugin
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: biz.aQute.bnd:bnd-maven-plugin
  dependency-version: 7.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: org.cyclonedx:cyclonedx-maven-plugin
  dependency-version: 2.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.codehaus.gmavenplus:gmavenplus-plugin
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: org.jacoco:jacoco-maven-plugin
  dependency-version: 0.8.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: com.github.spotbugs:spotbugs-maven-plugin
  dependency-version: 4.10.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-version: 3.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: com.github.eirslett:frontend-maven-plugin
  dependency-version: 2.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Jul 1, 2026
@github-actions
github-actions Bot marked this pull request as draft July 1, 2026 10:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants