[dependabot]

Bumps the maven-maintenance group with 14 updates:

Package	From	To
org.springdoc:springdoc-openapi-starter-webmvc-ui	3.1.0	3.1.1
net.dreamlu:mica-ip2region	4.1.0	4.1.1
org.apache.poi:poi	5.4.0	5.5.1
org.apache.poi:poi-ooxml	5.4.0	5.5.1
com.alibaba.fastjson2:fastjson2	2.0.61	2.0.65
com.alibaba.fastjson2:fastjson2-extension-spring6	2.0.61	2.0.65
org.apache.commons:commons-text	1.13.0	1.15.0
cn.hutool:hutool-all	5.8.35	5.8.47
com.google.guava:guava	33.4.8-jre	33.7.1-jre
com.github.oshi:oshi-core	6.6.5	7.6.1
com.icegreen:greenmail-junit5	2.1.13	2.1.14
com.alipay.sdk:alipay-sdk-java	4.22.57.ALL	4.40.1026.ALL
org.bouncycastle:bcprov-jdk18on	1.85.2	1.86
software.amazon.awssdk:s3	2.30.13	2.55.7

Updates org.springdoc:springdoc-openapi-starter-webmvc-ui from 3.1.0 to 3.1.1

Release notes

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's releases.

springdoc-openapi v3.1.1 released!

Security

• GHSA-6f5m-mhjg-qwxq – MCP tool callbacks do not encode path parameters, allowing request retargeting
• GHSA-4v2q-56v7-2cpw – MCP transport, admin and dashboard endpoints are exposed by default
• GHSA-m4cg-mhpg-rh2r – MCP audit events record credentials and request/response bodies without redaction
• GHSA-5f9r-4mc4-qh3c – Unbounded MCP pending-confirmation store allows memory exhaustion
• GHSA-jcgg-59c8-w4wh – MCP request context in a ThreadLocal can leak headers between concurrent WebFlux requests
• GHSA-rhhx-6j8h-8cvw – Unbounded per-locale OpenAPI cache allows memory exhaustion via Accept-Language
• GHSA-c925-vm88-mpp9 – Scalar starters trust client-supplied forwarded headers and render from a shared mutable bean
• CVE-2026-75838 – Cross-site scripting in the DOMPurify bundled with swagger-ui, addressed by upgrading swagger-ui to 5.32.14

Added

• #3340 – Describe JsonNullable values without their Java wrapper
• #3325 – Manage the swagger artifacts in springdoc-openapi-bom, so that modules holding only the annotations stay in lockstep
• #3321 – Add springdoc.login-endpoint.username-example and springdoc.login-endpoint.password-example to document the Spring Security login endpoint

Changed

• MCP is now opt-in. Set springdoc.ai.mcp.enabled=true, and springdoc.ai.mcp.dashboard-enabled=true for the dashboard
• The Scalar starters no longer register forwarded-header handling. Set server.forward-headers-strategy=framework (or native) behind a trusted proxy
• Add springdoc.cache.max-entries (default 100) to bound the per-locale OpenAPI cache
• Add springdoc.ai.mcp.audit.redact (default true) to mask secrets in MCP audit events
• Document that the MCP approval flow is a confirmation step, not an authorization control
• Document the security policy and the release versioning scheme
• #3351 – java.time.Duration, LocalTime and OffsetTime are now resolved by swagger-core instead of being forced to a bare string, so they carry a format (duration and partial-time respectively for the first two)
• A property whose type only implements Set indirectly (LinkedHashSet, TreeSet, …) is now described with uniqueItems: true, following swagger-api/swagger-core#5265
• Upgrade swagger-core to version 2.2.55
• Upgrade swagger-ui to version 5.32.14

Fixed

• #3328, #3337 – /v3/api-docs fails with a NullPointerException when spring-hateoas is on the classpath without HateoasProperties
• #3314 – Json Processing Exception occurred is logged for every constrained parameter whose schema is not a JsonSchema
• #3317 – An injected HttpHeaders parameter is described as a schema
• #3332 – The properties a Kotlin entity inherits from an @Embeddable are missing from the Spring Data REST schemas
• #3320 – @Order and Ordered ignored when applying customizers
• #3319 – A Page nested in another schema is not replaced by PagedModel
• #3313 – Springdoc auto-configurations rely on unspecified auto-configuration ordering
• #3331 – Validation annotations declared inside Optional parameters are dropped
• #3322 – Validation annotations on a container's type argument leak between parameters
• #3315 – An OAS 3.1 JsonSchema cannot be cloned through JSON
• #3300 – TYPE_USE annotations on @ParameterObject fields are not passed along
• #3341 – Stabilize Spring Data Sort and Pageable schema property order
• #3338 – Kotlin nullability interpretation of the Any? type
• #3136 – A Spring Data REST association to a non-exported entity expands its @EmbeddedId and @MapsId fields recursively in the response schemas
• The Spring Data REST response post-processing rewrote an association property in place, so the …Response refs could leak into the schema shared with the request body representation

New Contributors

... (truncated)

Changelog

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's changelog.

[3.1.1] - 2026-09-06

Security

• GHSA-6f5m-mhjg-qwxq – MCP tool callbacks do not encode path parameters, allowing request retargeting
• GHSA-4v2q-56v7-2cpw – MCP transport, admin and dashboard endpoints are exposed by default
• GHSA-m4cg-mhpg-rh2r – MCP audit events record credentials and request/response bodies without redaction
• GHSA-5f9r-4mc4-qh3c – Unbounded MCP pending-confirmation store allows memory exhaustion
• GHSA-jcgg-59c8-w4wh – MCP request context in a ThreadLocal can leak headers between concurrent WebFlux requests
• GHSA-rhhx-6j8h-8cvw – Unbounded per-locale OpenAPI cache allows memory exhaustion via Accept-Language
• GHSA-c925-vm88-mpp9 – Scalar starters trust client-supplied forwarded headers and render from a shared mutable bean
• CVE-2026-75838 – Cross-site scripting in the DOMPurify bundled with swagger-ui, addressed by upgrading swagger-ui to 5.32.14

Added

• #3340 – Describe JsonNullable values without their Java wrapper
• #3325 – Manage the swagger artifacts in springdoc-openapi-bom, so that modules holding only the annotations stay in lockstep
• #3321 – Add springdoc.login-endpoint.username-example and springdoc.login-endpoint.password-example to document the Spring Security login endpoint

Changed

• MCP is now opt-in. Set springdoc.ai.mcp.enabled=true, and springdoc.ai.mcp.dashboard-enabled=true for the dashboard
• The Scalar starters no longer register forwarded-header handling. Set server.forward-headers-strategy=framework (or native) behind a trusted proxy
• Add springdoc.cache.max-entries (default 100) to bound the per-locale OpenAPI cache
• Add springdoc.ai.mcp.audit.redact (default true) to mask secrets in MCP audit events
• Document that the MCP approval flow is a confirmation step, not an authorization control
• Document the security policy and the release versioning scheme
• #3351 – java.time.Duration, LocalTime and OffsetTime are now resolved by swagger-core instead of being forced to a bare string, so they carry a format (duration and partial-time respectively for the first two)
• A property whose type only implements Set indirectly (LinkedHashSet, TreeSet, …) is now described with uniqueItems: true, following swagger-api/swagger-core#5265
• Upgrade swagger-core to version 2.2.55
• Upgrade swagger-ui to version 5.32.14

Fixed

• #3328, #3337 – /v3/api-docs fails with a NullPointerException when spring-hateoas is on the classpath without HateoasProperties
• #3314 – Json Processing Exception occurred is logged for every constrained parameter whose schema is not a JsonSchema
• #3317 – An injected HttpHeaders parameter is described as a schema
• #3332 – The properties a Kotlin entity inherits from an @Embeddable are missing from the Spring Data REST schemas
• #3320 – @Order and Ordered ignored when applying customizers
• #3319 – A Page nested in another schema is not replaced by PagedModel
• #3313 – Springdoc auto-configurations rely on unspecified auto-configuration ordering
• #3331 – Validation annotations declared inside Optional parameters are dropped
• #3322 – Validation annotations on a container's type argument leak between parameters
• #3315 – An OAS 3.1 JsonSchema cannot be cloned through JSON
• #3300 – TYPE_USE annotations on @ParameterObject fields are not passed along
• #3341 – Stabilize Spring Data Sort and Pageable schema property order
• #3338 – Kotlin nullability interpretation of the Any? type
• #3136 – A Spring Data REST association to a non-exported entity expands its @EmbeddedId and @MapsId fields recursively in the response schemas
• The Spring Data REST response post-processing rewrote an association property in place, so the …Response refs could leak into the schema shared with the request body representation

Commits

• 1cc87a7 [maven-release-plugin] prepare release v3.1.1
• 4e8ac26 docs: record the swagger-ui 5.32.14 upgrade as a security fix for 3.1.1
• 958c79a Merge swagger-core 2.2.55 upgrade
• cf7d7c7 Upgrade swagger-core to 2.2.55
• 186adb3 Record the swagger-core 2.2.54 upgrade in the changelog
• 2498ffb Merge pull request #3351 from Mattias-Sehlstedt/update-swagger-core
• d78abd9 upgrade swagger-core from 2.2.53 to 2.2.54
• 9f7f099 Rewrite a copy of a Spring Data REST association property
• f47060e Record #3321 in the changelog and align the buildRequestBody indent
• ccb2fc0 Merge pull request #3323 from Mattias-Sehlstedt/feature/3321-login-example-va...
• Additional commits viewable in compare view

Updates net.dreamlu:mica-ip2region from 4.1.0 to 4.1.1

Updates org.apache.poi:poi from 5.4.0 to 5.5.1

Updates org.apache.poi:poi-ooxml from 5.4.0 to 5.5.1

Updates com.alibaba.fastjson2:fastjson2 from 2.0.61 to 2.0.65

Release notes

Sourced from com.alibaba.fastjson2:fastjson2's releases.

fastjson 2.0.65版本发布

FASTJSON 2.0.65 Release Notes

Release Date: 2 Sep 2026 Tag: 2.0.65 (879183e94)

Overview

This is a security fix release. It closes an AutoType authorization bypass reachable when JSONReader.Feature.SupportAutoType is enabled, and includes parser/writer robustness fixes. All users are strongly recommended to upgrade, especially applications that parse untrusted JSON or JSONB with AutoType enabled.

This release also restores fastjson2-extension-spring6 on Maven Central. It was missing for 2.0.62–2.0.64 because those releases were deployed with a JDK that did not activate the enable-for-17+ build profile, so the module never entered the build reactor #7840.

The Android variants 2.0.65.android5 and 2.0.65.android8 carry the same AutoType security fix #7843 #7844.

Security Fixes

1. Unified AutoType authorization on the real type name: a reader-cache hit on the FNV-1a-64 hash of @type is no longer treated as authorization. All untrusted-input paths (JSON and JSONB readers, and the object readers for beans, interfaces, exceptions, adapters, typed maps, arrays, collections and no-default-constructor types) now resolve @type through the full provider security checks — SafeMode, deny lists, type-name validation, and any user-supplied AutoTypeBeforeHandler. Compatibility is preserved for explicit local mappings declared with @JSONType(seeAlso = ...) and for readers annotated with @JSONType(... SupportAutoType) #7753

Bug Fixes

2. Fixed ArrayIndexOutOfBoundsException in JSONReaderASCII field-name decoding, triggered by a field name that combines an escape sequence with latin1 bytes >= 0x80 #7808 #7836
3. Fixed getter methods being silently discarded when serializing char/Character fields, which caused NPEs or lost field values #7719
4. (kotlin) Fixed NullPointerException when serializing a Kotlin class without kotlin-reflect on the classpath #7835

Documentation

5. Switched the star-history charts to star-history.dera.page #7780

Maven Dependency Configuration

Standard Version

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.65</version>
</dependency>

Spring 6 Extension

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2-extension-spring6</artifactId>
    <version>2.0.65</version>
</dependency>

Android 5 Optimized Version

</tr></table> 

... (truncated)

Commits

• 879183e Merge pull request #7841 from alibaba/release/2.0.65
• abbcc7e 2.0.65 release
• 141dbe9 Merge pull request #7836 from adityaanikam/fix-jsonreaderascii-fieldname-oob-...
• 86a8c1a Merge pull request #7835 from obabichevjb/obabichev/fix-kotlin-npe-missing-re...
• f11c2ee fix: ArrayIndexOutOfBoundsException in JSONReaderASCII field-name decoding, f...
• 36bc80a fix: guard against null paramNames when kotlin-reflect is not on classpath
• 30dd009 Merge pull request #7719 from TigerZCoder/discard-getter-when-writing-charact...
• ae13900 Merge pull request #7780 from SimonFoobar648/fix/star-history-chart
• 5439463 fix: use star-history.dera.page for star history charts
• af56f06 Merge pull request #7753 from alibaba/fix/autotype-hash-cache-unified
• Additional commits viewable in compare view

Updates com.alibaba.fastjson2:fastjson2-extension-spring6 from 2.0.61 to 2.0.65

Release notes

Sourced from com.alibaba.fastjson2:fastjson2-extension-spring6's releases.

fastjson 2.0.65版本发布

FASTJSON 2.0.65 Release Notes

Release Date: 2 Sep 2026 Tag: 2.0.65 (879183e94)

Overview

This is a security fix release. It closes an AutoType authorization bypass reachable when JSONReader.Feature.SupportAutoType is enabled, and includes parser/writer robustness fixes. All users are strongly recommended to upgrade, especially applications that parse untrusted JSON or JSONB with AutoType enabled.

This release also restores fastjson2-extension-spring6 on Maven Central. It was missing for 2.0.62–2.0.64 because those releases were deployed with a JDK that did not activate the enable-for-17+ build profile, so the module never entered the build reactor #7840.

The Android variants 2.0.65.android5 and 2.0.65.android8 carry the same AutoType security fix #7843 #7844.

Security Fixes

1. Unified AutoType authorization on the real type name: a reader-cache hit on the FNV-1a-64 hash of @type is no longer treated as authorization. All untrusted-input paths (JSON and JSONB readers, and the object readers for beans, interfaces, exceptions, adapters, typed maps, arrays, collections and no-default-constructor types) now resolve @type through the full provider security checks — SafeMode, deny lists, type-name validation, and any user-supplied AutoTypeBeforeHandler. Compatibility is preserved for explicit local mappings declared with @JSONType(seeAlso = ...) and for readers annotated with @JSONType(... SupportAutoType) #7753

Bug Fixes

2. Fixed ArrayIndexOutOfBoundsException in JSONReaderASCII field-name decoding, triggered by a field name that combines an escape sequence with latin1 bytes >= 0x80 #7808 #7836
3. Fixed getter methods being silently discarded when serializing char/Character fields, which caused NPEs or lost field values #7719
4. (kotlin) Fixed NullPointerException when serializing a Kotlin class without kotlin-reflect on the classpath #7835

Documentation

5. Switched the star-history charts to star-history.dera.page #7780

Maven Dependency Configuration

Standard Version

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.65</version>
</dependency>

Spring 6 Extension

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2-extension-spring6</artifactId>
    <version>2.0.65</version>
</dependency>

Android 5 Optimized Version

</tr></table> 

... (truncated)

Commits

• 879183e Merge pull request #7841 from alibaba/release/2.0.65
• abbcc7e 2.0.65 release
• 141dbe9 Merge pull request #7836 from adityaanikam/fix-jsonreaderascii-fieldname-oob-...
• 86a8c1a Merge pull request #7835 from obabichevjb/obabichev/fix-kotlin-npe-missing-re...
• f11c2ee fix: ArrayIndexOutOfBoundsException in JSONReaderASCII field-name decoding, f...
• 36bc80a fix: guard against null paramNames when kotlin-reflect is not on classpath
• 30dd009 Merge pull request #7719 from TigerZCoder/discard-getter-when-writing-charact...
• ae13900 Merge pull request #7780 from SimonFoobar648/fix/star-history-chart
• 5439463 fix: use star-history.dera.page for star history charts
• af56f06 Merge pull request #7753 from alibaba/fix/autotype-hash-cache-unified
• Additional commits viewable in compare view

Updates com.alibaba.fastjson2:fastjson2-extension-spring6 from 2.0.61 to 2.0.65

Release notes

Sourced from com.alibaba.fastjson2:fastjson2-extension-spring6's releases.

fastjson 2.0.65版本发布

FASTJSON 2.0.65 Release Notes

Release Date: 2 Sep 2026 Tag: 2.0.65 (879183e94)

Overview

This is a security fix release. It closes an AutoType authorization bypass reachable when JSONReader.Feature.SupportAutoType is enabled, and includes parser/writer robustness fixes. All users are strongly recommended to upgrade, especially applications that parse untrusted JSON or JSONB with AutoType enabled.

This release also restores fastjson2-extension-spring6 on Maven Central. It was missing for 2.0.62–2.0.64 because those releases were deployed with a JDK that did not activate the enable-for-17+ build profile, so the module never entered the build reactor #7840.

The Android variants 2.0.65.android5 and 2.0.65.android8 carry the same AutoType security fix #7843 #7844.

Security Fixes

1. Unified AutoType authorization on the real type name: a reader-cache hit on the FNV-1a-64 hash of @type is no longer treated as authorization. All untrusted-input paths (JSON and JSONB readers, and the object readers for beans, interfaces, exceptions, adapters, typed maps, arrays, collections and no-default-constructor types) now resolve @type through the full provider security checks — SafeMode, deny lists, type-name validation, and any user-supplied AutoTypeBeforeHandler. Compatibility is preserved for explicit local mappings declared with @JSONType(seeAlso = ...) and for readers annotated with @JSONType(... SupportAutoType) #7753

Bug Fixes

2. Fixed ArrayIndexOutOfBoundsException in JSONReaderASCII field-name decoding, triggered by a field name that combines an escape sequence with latin1 bytes >= 0x80 #7808 #7836
3. Fixed getter methods being silently discarded when serializing char/Character fields, which caused NPEs or lost field values #7719
4. (kotlin) Fixed NullPointerException when serializing a Kotlin class without kotlin-reflect on the classpath #7835

Documentation

5. Switched the star-history charts to star-history.dera.page #7780

Maven Dependency Configuration

Standard Version

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.65</version>
</dependency>

Spring 6 Extension

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2-extension-spring6</artifactId>
    <version>2.0.65</version>
</dependency>

Android 5 Optimized Version

</tr></table> 

... (truncated)

Commits

• 879183e Merge pull request #7841 from alibaba/release/2.0.65
• abbcc7e 2.0.65 release
• 141dbe9 Merge pull request #7836 from adityaanikam/fix-jsonreaderascii-fieldname-oob-...
• 86a8c1a Merge pull request #7835 from obabichevjb/obabichev/fix-kotlin-npe-missing-re...
• f11c2ee fix: ArrayIndexOutOfBoundsException in JSONReaderASCII field-name decoding, f...
• 36bc80a fix: guard against null paramNames when kotlin-reflect is not on classpath
• 30dd009 Merge pull request #7719 from TigerZCoder/discard-getter-when-writing-charact...
• ae13900 Merge pull request #7780 from SimonFoobar648/fix/star-history-chart
• 5439463 fix: use star-history.dera.page for star history charts
• af56f06 Merge pull request #7753 from alibaba/fix/autotype-hash-cache-unified
• Additional commits viewable in compare view

Updates org.apache.commons:commons-text from 1.13.0 to 1.15.0

Changelog

Sourced from org.apache.commons:commons-text's changelog.

Apache Commons Text 1.15.0 Release Notes

The Apache Commons Text team is pleased to announce the release of Apache Commons Text 1.15.0.

Apache Commons Text is a set of utility functions and reusable components for processing and manipulating text in a Java environment.

Release 1.15.0. This is a feature and maintenance release. Java 8 or later is required.

New features

•        Add experimental CycloneDX VEX file [#683](https://github.com/apache/commons-text/issues/683). Thanks to Piotr P. Karwasz, Gary Gregory.
  

• TEXT-235: Add Damerau-Levenshtein distance #687. Thanks to LorgeN, Gary Gregory.

•        Add unit tests to increase coverage [#719](https://github.com/apache/commons-text/issues/719). Thanks to Michael Hausegger, Gary Gregory.
  

•        Add new test for CharSequenceTranslator#with() [#725](https://github.com/apache/commons-text/issues/725). Thanks to Michael Hausegger, Gary Gregory.
  

•        Add tests and assertions to org.apache.commons.text.similarity to get to 100% code coverage [#727](https://github.com/apache/commons-text/issues/727), [#728](https://github.com/apache/commons-text/issues/728). Thanks to Michael Hausegger.
  

Fixed Bugs

•        Fix exception message typo in XmlStringLookup.XmlStringLookup(Map, Path...). Thanks to Gary Gregory.
  

• TEXT-236: Inserting at the end of a TextStringBuilder throws a StringIndexOutOfBoundsException. Thanks to Pierre Post, Sumit Bera, Alex Herbert, Gary Gregory.

•        Fix TextStringBuilderTest.testAppendToCharBuffer() to use proper argument type [#724](https://github.com/apache/commons-text/issues/724). Thanks to Michael Hausegger.
  

•        Fix Apache RAT plugin console warnings. Thanks to Gary Gregory.
  

•        Fix site XML to use version 2.0.0 XML schema. Thanks to Gary Gregory.
  

•        Removed unreachable threshold verification code in src/main/java/org/apache/commons/text/similarity [#730](https://github.com/apache/commons-text/issues/730). Thanks to Michael Hausegger.
  

•        Enable secure processing for the XML parser in XmlStringLookup in case the underlying JAXP implementation doesn't [#729](https://github.com/apache/commons-text/issues/729). Thanks to 김민재 (minjas0507), Gary Gregory, Piotr Karwasz.
  

Changes

•        Bump org.apache.commons:commons-parent from 85 to 93 [#704](https://github.com/apache/commons-text/issues/704), [#723](https://github.com/apache/commons-text/issues/723), [#726](https://github.com/apache/commons-text/issues/726). Thanks to Gary Gregory.
  

•        Bump commons.bytebuddy.version from 1.17.6 to 1.18.2 [#696](https://github.com/apache/commons-text/issues/696), [#722](https://github.com/apache/commons-text/issues/722). Thanks to Gary Gregory.
  

•        Bump graalvm.version from 24.2.2 to 25.0.1 [#703](https://github.com/apache/commons-text/issues/703), [#716](https://github.com/apache/commons-text/issues/716). Thanks to Gary Gregory, Dependabot.
  

•        Bump org.apache.commons:commons-lang3 from 3.18.0 to 3.20.0. Thanks to Gary Gregory.
  

•        Bump commons-io:commons-io from 2.20.0 to 2.21.0. Thanks to Gary Gregory.
  

Historical list of changes: https://commons.apache.org/proper/commons-text/changes.html

For complete information on Apache Commons Text, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Commons Text website:

https://commons.apache.org/proper/commons-text

Download page: https://commons.apache.org/proper/commons-text/download_text.cgi

... (truncated)

Commits

• 04e9374 Prepare for the release candidate 1.15.0 RC1
• 502c4c4 Prepare for the next release candidate
• c6e17ec Use direct access
• 58e1e12 Simplify XML FSP (#731)
• b5052c9 Bump actions/setup-java from 5.0.0 to 5.1.0
• 2e2d4bc Revert "Bump actions/setup-java from 5.0.0 to 5.1.0"
• b0ddbd1 Bump actions/setup-java from 5.0.0 to 5.1.0
• 1c2d382 Add tests with external DTD
• ed3df4b Internal clean up
• bb508f3 Bump actions/checkout from 6.0.0 to 6.0.1
• Additional commits viewable in compare view

Updates cn.hutool:hutool-all from 5.8.35 to 5.8.47

Release notes

Sourced from cn.hutool:hutool-all's releases.

5.8.47(2026-07-06) 🐣新特性 【core 】 EnumConverter变更规则，当用户自定义方法返回null时，调用默认valueOf（pr#4258@Github） 【core 】 DateUtilparseISO8601增加检查范围（pr#4275@Github） 【core 】 Guard FileMagicNumber AAC/M4A/AMR matchers against short byte arrays（pr#4278@Github） 【crypto 】 Reject empty cipherKey in Vigenere with a clear exception（pr#4279@Github） 【core 】 Return null from CsvRow.get for a negative index（pr#4280@Github） 【crypto 】 Reject too-short salt in BCrypt.hashpw with IllegalArgumentException（pr#4282@Github） 【crypto 】 Validate md5HexTo16 input length to avoid StringIndexOutOfBoundsException（pr#4283@Github） 🐞Bug修复 【core 】 修复HexUtil.format奇数位数输出错误问题（issue#4263@Github） 【core 】 修复CamelCaseLinkedMap顺序错乱问题（issue#IJV845@Gitee） 【core 】 修复AntPathMatchersubstring问题（pr#4276@Github） 【poi 】 修复Excel03SaxReader读取xls时最后一行数据丢失问题（pr#1442@Gitee） 【core 】 修复根据新版外国人永久居留身份证（18位）身份编号获取户籍省份编码的问题（pr#4288@Github） 【core 】 修复Record反序列化时字段null导致报错问题（issue#4269@Github）

v5.8.46

5.8.46(2026-05-25) 🐣新特性 【core 】 AnnotationUtil新增两级缓存架构，提升高频注解解析性能（pr#1434@Gitee） 【core 】 RegexPool.PLATE_NUMBER新增粤AP号段支持（issue#IJNDJR@Gitee） 🐞Bug修复 【db 】 修复Page和PageResult首页调用问题（issue#IH7A18@Gitee） 【ai 】 修复AI SPI classloader找不到实现问题（issue#4241@Github） 【extra 】 修复ExpressionEngine中SpELEngine、MVEL白名单无效问题（issue#4249@Github） 【core 】 修复JNDIUtil远程加载漏洞（issue#4249@Github） 【core 】 修复ValidateObjectInputStream白名单规则问题（issue#4249@Github） 【core 】 修复VersionUtil比对null时结果异常问题（issue#IJNFQZ@Gitee） 【core 】 修复BeanConverter和MapConverter源Bean判断问题（pr#4252@Github）

5.8.44

---

5.8.44(2026-03-11)

🐣新特性

• 【core 】 NumberUtil.parseNumber增加支持科学计数法（pr#4211@Github）
• 【captcha】 AbstractCaptcha增加setStroke方法支持线条粗细（issue#IDJQ15@Gitee）
• 【core 】 BooleanUtil新增 exactlyOneTrue 方法用于互斥条件校验（issue#IDJQ15@Gitee）
• 【core 】 DateUtil.normalize方法中正则预编译提升效率（pr#4221@Gitee）
• 【core 】 AppendableWriter增加checkNotClosed（issue#IDMZ5K@Gitee）
• 【core 】 FastDateParser改进在JDK25下三字母时区警告（issue#4100@Github）
• 【core 】 ReflectUtil增加二级缓存（pr#1433@Gitee）

🐞Bug修复

• 【json 】 修复JSONUtil.wrap忽略错误问题（issue#4210@Github）
• 【http 】 修复HttpUtil.normalizeParams 在极端输入下抛 StringIndexOutOfBoundsException（pr#4216@Github）
• 【extra 】 修复MailAccount.setAuth参数与field不一致问题（issue#4217@Github）
• 【core 】 修复TransMap.computeIfAbsentmappingFunction处理不一致问题（issue#IDM6UR@Gitee）
• 【core 】 修复MultiResource游标歧义问题（issue#IDNAOY@Gitee）
• 【core 】 修复BufferUtilcopy歧义问题（issue#IDN097@Gitee）

... (truncated)

Changelog

Sourced from cn.hutool:hutool-all's changelog.

5.8.47(2026-07-06)

🐣新特性

• 【core 】 EnumConverter变更规则，当用户自定义方法返回null时，调用默认valueOf（pr#4258@Github）
• 【core 】 DateUtilparseISO8601增加检查范围（pr#4275@Github）
• 【core 】 Guard FileMagicNumber AAC/M4A/AMR matchers against short byte arrays（pr#4278@Github）
• 【crypto 】 Reject empty cipherKey in Vigenere with a clear exception（pr#4279@Github）
• 【core 】 Return null from CsvRow.get for a negative index（pr#4280@Github）
• 【crypto 】 Reject too-short salt in BCrypt.hashpw with IllegalArgumentException（pr#4282@Github）
• 【crypto 】 Validate md5HexTo16 input length to avoid StringIndexOutOfBoundsException（pr#4283@Github）

🐞Bug修复

• 【core 】 修复HexUtil.format奇数位数输出错误问题（issue#4263@Github）
• 【core 】 修复CamelCaseLinkedMap顺序错乱问题（issue#IJV845@Gitee）
• 【core 】 修复AntPathMatchersubstring问题（pr#4276@Github）
• 【poi 】 修复Excel03SaxReader读取xls时最后一行数据丢失问题（pr#1442@Gitee）
• 【core 】 修复根据新版外国人永久居留身份证（18位）身份编号获取户籍省份编码的问题（pr#4288@Github）
• 【core 】 修复Record反序列化时字段null导致报错问题（issue#4269@Github）

5.8.46(2026-05-25)

🐣新特性

• 【core 】 AnnotationUtil新增两级缓存架构，提升高频注解解析性能（pr#1434@Gitee）
• 【core 】 RegexPool.PLATE_NUMBER新增粤AP号段支持（issue#IJNDJR@Gitee）

🐞Bug修复

• 【db 】 修复Page和PageResult首页调用问题（issue#IH7A18@Gitee）
• 【ai 】 修复AI SPI classloader找不到实现问题（issue#4241@Github）
• 【extra 】 修复ExpressionEngine中SpELEngine、MVEL白名单无效问题（issue#4249@Github）
• 【core 】 修复JNDIUtil远程加载漏洞（issue#4249@Github）
• 【core 】 修复ValidateObjectInputStream白名单规则问题（issue#4249@Github）
• 【core 】 修复VersionUtil比对null时结果异常问题（issue#IJNFQZ@Gitee）
• 【core 】 修复BeanConverter和MapConverter源Bean判断问题（pr#4252@Github）

5.8.45(2026-05-19)

🐣新特性

• 此版本发布出现问题，跳过！

🐞Bug修复

---

5.8.44(2026-03-11)

🐣新特性

• 【core 】 NumberUtil.parseNumber增加支持科学计数法（pr#4211@Github）
• 【captcha】 AbstractCaptcha增加setStroke方法支持线条粗细（issue#IDJQ15@Gitee）
• 【core 】 BooleanUtil新增 exactlyOneTrue 方法用于互斥条件校验（issue#IDJQ15@Gitee）
• 【core 】 DateUtil.normalize方法中正则预编译提升效率（pr#4221@Gitee）
• 【core 】 AppendableWriter增加checkNotClosed（issue#IDMZ5K@Gitee）
• 【core 】 FastDateParser改进在JDK25下三字母时区警告（issue#4100@Github）
• 【core 】 ReflectUtil增加二级缓存（pr#1433@Gitee）

🐞Bug修复

• 【json 】 修复JSONUtil.wrap忽略错误问题（issue#4210@Github）

... (truncated)

Commits

• 8870454 Prepare release
• 853c29f 🚀release5.8.47
• eaa0641 fix test
• 90fae33 fix test
• c57da4d 修复Record反序列化时字段null导致报错问题（issue#4269@Github）
• 212c796 修复根据新版外国人永久居留身份证（18位）身份编号获取户籍省份编码的问题（pr#4288@Github）
• faa08a8 Merge pull request #4288 from YamMangoTea/v5-dev
• 8290d30 Merge pull request #4284 from vasiliy-mikhailov/fix-condition-unwrapquote-whi...
• 71e7957 Validate md5HexTo16 input length to avoid StringIndexOutOfBoundsException
• 6cbc8f8 Merge pull request #4283 from vasiliy-mikhailov/fix-md5hexto16-short-input
• Additional commits viewable in compare view

Updates com.google.guava:guava from 33.4.8-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

• 33.7.1-jre.jar
• 33.7.1-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.1-jre
• 33.7.1-android

JDiff

• 33.7.1-jre vs. 33.7.0-jre
• 33.7.1-android vs. 33.7.0-android
• 33.7.1-android vs. 33.7.1-jre

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
</tr></table> 

... (truncated)

Commits

• See full diff in compare view

Updates com.github.oshi:oshi-core from 6.6.5 to 7.6.1

Release notes

Sourced from com.github.oshi:oshi-core's releases.

Release 7.6.1

Bug Fixes and Improvements

• #3710: Fix the bnd imports for oshi-core and oshi-core-ffm to make the JSpecify annotations optional, so both bundles resolve in an OSGi container without JSpecify - @​dbwiddis.

Full change log

Release 7.6.0

Maven Central Publication Change

The oshi-dist zip is no longer published to Maven Central; download it from the GitHub release instead.

New Features

• #3652: oshi-metrics reports the OpenTelemetry reserved state for system.filesystem.usage and system.filesystem.utilization, alongside the existing used and free. The three states partition the filesystem, so the usage gauges sum to system.filesystem.limit and the utilization gauges sum to 1.0 - @​dbwiddis.
• #3660, #3678: Display.getDevicePort() reports the port a display is attached to, and on systems with X RandR, Display.getOutputName() gives the name xrandr --output accepts for it - @​ayonization, @​dbwiddis.

Behavior Changes

• #3705: OSDesktopWindow.getLocAndSize() returns a copy of the window's Rectangle and the constructor copies the one it is given, so the class honors the immutability its documentation promises. ApplicationInfo.getAdditionalInfo() returns an unmodifiable map. Code that wrote through either return value silently mutated OSHI's own state; it now has no effect, or throws UnsupportedOperationException for the map - @​dbwiddis.
• #3705: UsbDevice.compareTo() breaks ties on the unique device ID, vendor ID, product ID and serial number after comparing names, and AbstractUsbDevice implements equals() and hashCode() over the same fields. Two distinct devices sharing a name previously compared equal, so a TreeSet or SortedSet of them kept only one. The ordering is now a default method on UsbDevice, so every implementation shares it - @​dbwiddis.

Bug Fixes and Improvements

• #3651: OSFileStore now guarantees 0 <= getUsableSpace() <= getFreeSpace() <= getTotalSpace() on every platform. The three values are read by separate queries, so on a ZFS dataset or a swap-backed tmpfs they could previously contradict each other; they are now clamped downward to restore the ordering - @​dbwiddis.
• #3657: Fix the TcpState for the FFM implementation of InternetProtocolStats.getConnections() on macOS and set the process cap from the kernel - @​dbwiddis.
• #3661: Setting oshi.os.windows.hkeyperfdata to false now also skips the registry when fetching thread counters, matching its documented behavior and the existing handling for processes - @​dbwiddis.
• #3662: Reading the processor description from the registry no longer throws when a value is missing. CentralProcessor.getFeatureFlags() on Windows now reports every processor feature IsProcessorFeaturePresent() accepts, matching the PF_ defines in winnt.h - @​dbwiddis.
• #3665: NetworkParams.getRoutes() reads the routing table from the kernel through a NET_RT_DUMP sysctl on macOS, FreeBSD, DragonFly BSD and OpenBSD, rather than by running netstat twice - @​dbwiddis.
• #3670: NetworkParams.getHostName() on Linux reads the kernel host name from /proc/sys/kernel/hostname in every backend, fixing the native-free implementation, which truncated a fully qualified name at the first dot and reported localhost when the name did not resolve - @​dbwiddis.
• #3671: NetworkParams.getHostName() and getDomainName() report the empty-string sentinel when the local host name does not resolve, rather than the loopback address's localhost. NetBSD is the most affected platform, having no native host name query of its own - @​dbwiddis.
• #3672, #3674: CentralProcessor frequencies and PhysicalProcessor.getEfficiency() on Apple Silicon are correct regardless of call order and on the M4 and M5 generations. Frequencies previously fell back to a 2.4 GHz placeholder unless getProcessorIdentifier() happened to be called first, were reported a thousand times too low on the M4 and later, and a chip with more or fewer than two kinds of core was misclassified - @​dbwiddis.
• #3675: CentralProcessor.getCurrentFreq() on Apple Silicon can report the frequency the hardware actually ran at, rather than a nominal maximum that never changes. Set oshi.os.mac.cpu.frequency.ioreport to true; it is opt-in because it holds a subscription to a private framework for the lifetime of the process - @​dbwiddis.
• #3680: oshi-metrics reads a disk or network interface once per memoizer expiration window rather than once per meter, so a scrape makes one query where it previously made five or seven, and the meters of one device report the same reading. A rate computed across two of them, such as errors per packet, is now comparable - @​dbwiddis.
• #3681: GpuStats.getGpuUtilization() on Linux reads NVIDIA GPU utilization from NVML. It previously read only the amdgpu/i915/xe sysfs paths, none of which the NVIDIA driver exposes, so an NVIDIA card always returned the -1 sentinel - @​Krillsson.
• #3686: GpuStats.getGpuUtilization() on Windows reads NVIDIA utilization from NVML and AMD utilization from ADL, matching the source order of every other metric on the class. It previously ran only LibreHardwareMonitor and a PDH engine-tick delta, which needs two samples, so the first call returned the -1 senti...

  Description has been truncated