Skip to content

Bump the gradle-dependencies group across 1 directory with 19 updates - #7

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/gradle-dependencies-d46b9bb539
Open

Bump the gradle-dependencies group across 1 directory with 19 updates#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/gradle-dependencies-d46b9bb539

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 5, 2026

Copy link
Copy Markdown

Bumps the gradle-dependencies group with 19 updates in the / directory:

Package From To
com.puppycrawl.tools:checkstyle 9.0 9.3
com.google.errorprone:error_prone_core 2.43.0 2.51.0
junit:junit 4.11 4.13.2
net.ltgt.errorprone 4.2.0 4.4.0
org.openjdk.jmh:jmh-core 1.33 1.37
org.openjdk.jmh:jmh-generator-annprocess 1.33 1.37
biz.aQute.bnd.builder 7.1.0 7.4.0
com.yubico.yubikit:openpgp 3.1.0 3.3.0
com.yubico.yubikit:desktop 3.1.0 3.3.0
javax.mail:mail 1.4 1.4.7
jakarta.mail:jakarta.mail-api 2.0.1 2.1.5
jakarta.activation:jakarta.activation-api 2.0.0 2.1.4
io.grpc:grpc-protobuf 1.83.1 1.85.1
io.grpc:grpc-stub 1.83.1 1.85.1
io.grpc:grpc-services 1.83.1 1.85.1
io.grpc:grpc-netty-shaded 1.83.1 1.85.1
io.grpc:protoc-gen-grpc-java 1.83.1 1.85.1
io.grpc:grpc-stub 1.83.1 1.85.1
io.grpc:grpc-services 1.83.1 1.85.1
io.grpc:grpc-netty-shaded 1.83.1 1.85.1
io.grpc:protoc-gen-grpc-java 1.83.1 1.85.1
com.google.protobuf 0.9.4 0.10.0
gradle-wrapper 9.1.0 9.8.2

Updates com.puppycrawl.tools:checkstyle from 9.0 to 9.3

Release notes

Sourced from com.puppycrawl.tools:checkstyle's releases.

checkstyle-9.3

https://checkstyle.org/releasenotes.html#Release_9.3

checkstyle-9.2.1

https://checkstyle.org/releasenotes.html#Release_9.2.1

checkstyle-9.2

https://checkstyle.org/releasenotes.html#Release_9.2

checkstyle-9.1

https://checkstyle.org/releasenotes.html#Release_9.1

checkstyle-9.0.1

https://checkstyle.org/releasenotes.html#Release_9.0.1

Commits
  • 5c19037 [maven-release-plugin] prepare release checkstyle-9.3
  • c4b2862 doc: release notes 9.3
  • ef2ac6c dependency: bump taglist-maven-plugin from 2.4 to 3.0.0
  • e12eee4 minor: Specified violation messages in SeparatorWrapCheck
  • 645262f Issue #11091: Fail test execution when input file hasn't specified violation ...
  • 2372df1 infra: disable equalsverifier until https://github.com/jqno/equalsverifier/is...
  • b37ec9c Issue #6320: Kill surviving mutations for REMOVE_CONDITIONALS in UnusedLocalV...
  • 7cd807c Issue #11220: False positive in MissingSwitchDefault with pattern in switch l...
  • 7124ab9 Issue #11187: OperatorWrapCheck throws NPE on guarded patterns
  • 8a93900 infra: use master branch for no-error-xwiki execution
  • Additional commits viewable in compare view

Updates com.google.errorprone:error_prone_core from 2.43.0 to 2.51.0

Release notes

Sourced from com.google.errorprone:error_prone_core's releases.

Error Prone 2.51.0

New checks:

  • HashCodeInObjectsHash: Detect redundant hashCode() or Objects.hash() calls inside Objects.hash(...), and simplify single-argument Objects.hash(x) calls to Objects.hashCode(x).
  • LoopToTestParameter: Suggest migrating loops in unit tests to TestParameterInjector.
  • MissingJavadoc: Flag public types that are missing Javadoc comments (disabled by default).
  • PreferCharsetOverload: Prefer calling method and constructor overloads that accept a Charset over those that accept a String encoding name.
  • PreferPreconditions: Suggest using Guava's Preconditions instead of explicit if-throw statements for parameter validation (disabled by default).
  • RequireNonNullRefactoring: Refactor explicit if (x == null) { throw new NullPointerException(...); } checks to Objects.requireNonNull (disabled by default).
  • SimplifyTestParameter: Remove redundant explicit value lists on @TestParameter annotations for boolean and Enum types when all values are specified (disabled by default).
  • TraditionalJavadocToMarkdown: Convert traditional /** ... */ Javadoc comments into /// Markdown Javadoc comments (disabled by default).
  • ValueClassIdentity: Flag reliance on identity semantics (such as synchronization, WeakReference, IdentityHashMap, or System.identityHashCode) of value-based classes (disabled by default).

Other changes:

  • CompareToZero: Upgraded from warning to error, and expanded to flag non-relational operations, unary negation, and switch statements/expressions on compareTo and compare results without Integer.signum.
  • IfChainToSwitch: Enabled by default as a warning.
  • UndefinedEquals: Merged ArrayAsKeyOfSetOrMap and CollectionUndefinedEquality into UndefinedEquals (retaining their names as altNames), and generalized detection of types without well-defined equals or hashCode across direct equality, collection containment, and hash-based containers.
  • EqualsIncompatibleType / TruthIncompatibleType: Flag equality comparisons between distinct record types (#6107).
  • ReferenceEquality: Allow == comparisons on private classes whose type hierarchy does not override Object.equals (#5865), private static final sentinel fields, Thread (#5900), and com.sun.source.tree.Tree.
  • PatternMatchingInstanceof: Support while and for loops, parenthesized expressions (#5843), and replacing additional redundant casts when the instanceof already introduces a pattern variable.
  • DistinctVarargsChecker: Expanded to check Objects.hash, CompletableFuture.allOf/anyOf, EnumSet.of, Sets.union/intersection/difference, Stream.concat, Math.min/max, and additional JDK, Guava, Protobuf, Truth, and Mockito methods.
  • MustBeClosedChecker: Require java.lang.foreign.Arena.ofConfined and Arena.ofShared to be closed.
  • ImpossibleNullComparison: Flag null checks on the return value of Class.forName.
  • RestrictedApi / RestrictedInheritance: Added an allowedPaths attribute to allow calls or inheritance from matching file paths without a regular expression.
  • InlineMeInliner: Support substituting type arguments at call sites when inlining generic @InlineMe methods.
  • WellKnownKeep: Recognize Apache Beam DoFn annotations and retain open-source library annotations (Gson, Mockito, Guice, Objectify, TestParameterInjector, AutoFactory).
  • Per-check timing collection is now disabled by default, reducing Error Prone compile-time overhead by ~3–5%; pass -XepPrintTimings to print a timing report after compilation or -XepRecordTimings to record timings programmatically (#6079).
  • CompilationTestHelper now reports all lines with mismatched diagnostic expectations in a single test run rather than failing on the first mismatch (#6116).
  • Replaced the RE2/J dependency with SafeRE.

Closed issues: #4914, #5182, #5843, #5857, #5865, #5878, #5900, #6029, #6079, #6107, #6116, #6133

Full changelog: google/error-prone@v2.50.0...v2.51.0

Error Prone 2.50.0

New checks:

Closed issues: #5553, #5649, #5778

... (truncated)

Commits
  • 3e9c316 Release Error Prone 2.51.0
  • 4f83ec3 Add Maven 3.9.16 setup to release workflow
  • 47eb5be Exempt Apache Beam DoFn method annotations in WellKnownKeep
  • 7e2efea [IfChainToSwitch] Lower the minimum if-chain length from 5 to 4
  • 0a97086 [IfChainToSwitch] address issue where deleting trailing code can cause compil...
  • f61d405 [Reachability] drop skipLabel from visitContinue
  • 854665b Collapse duplicated package prefixes in _javac source jar paths.
  • 3588433 Introduce -XepOpt:Nullness:LikelyPublicApiOnly=true for annotating only API...
  • b8a8390 Merge CollectionUndefinedEquality and ArrayAsKeyOfSetOrMap into UndefinedEquals.
  • 59f98c3 Allow == comparisons on Tree instances.
  • Additional commits viewable in compare view

Updates junit:junit from 4.11 to 4.13.2

Release notes

Sourced from junit:junit's releases.

JUnit 4.13.2

Please refer to the release notes for details.

JUnit 4.13.1

Please refer to the release notes for details.

JUnit 4.13

Please refer to the release notes for details.

JUnit 4.13 RC 2

Please refer to the release notes for details.

JUnit 4.13 RC 1

Please refer to the release notes for details.

JUnit 4.13 Beta 3

Please refer to the release notes for details.

JUnit 4.13 Beta 2

Please refer to the release notes for details.

JUnit 4.13 Beta 1

Please refer to the release notes for details.

JUnit 4.12

Please refer to the release notes for details.

JUnit 4.12 Beta 3

Please refer to the release notes for details.

JUnit 4.12 Beta 2

No release notes provided.

JUnit 4.12 Beta 1

No release notes provided.

Commits
  • 05fe2a6 [maven-release-plugin] prepare release r4.13.2
  • ff57344 Add build for JDK 17-ea
  • 02aaa01 Improve check that thread is stopped
  • e9a75f4 Merge test for exception type and message
  • d27ad52 Rename DelegateStatement to DelegatingStatement
  • b83dc2e Better name for test that stops statement
  • 527f3a3 Replace InfiniteLoop with RunForASecond
  • 2db6394 Tidy up FailOnTimeoutTest
  • 64634e1 Update 4.13.2 release notes to document pull 1654
  • f8ee412 Fix serialization of AssumptionViolatedException (#1654)
  • Additional commits viewable in compare view

Updates net.ltgt.errorprone from 4.2.0 to 4.4.0

Updates org.openjdk.jmh:jmh-core from 1.33 to 1.37

Commits
  • 2effa2c JMH v1.37.
  • 09c78d5 7903508: JMH: Remove the Unicode dot prefix from secondary results
  • 843f641 7903510: JMH: Add core performance checking tests
  • 8bc325b 7903511: JMH: Add score stability performance tests
  • 6b09724 7903450: JMH: Improve -prof perfnorm accuracy with robust estimations
  • d88f901 7903504: JMH: Fix new Sonar warnings
  • 47f651b 7903498: JMH: Reset worker interrupt status after iteration
  • 482561a 7903492: JMH: Infrastructure code should yield occasionally for virtual execu...
  • 9a97557 7903490: JMH: The interrupt to time-outing benchmark can be delivered to work...
  • bf8db38 7903487: JMH: Make sure JMH profilers work on all tested configurations
  • Additional commits viewable in compare view

Updates org.openjdk.jmh:jmh-generator-annprocess from 1.33 to 1.37

Commits
  • 2effa2c JMH v1.37.
  • 09c78d5 7903508: JMH: Remove the Unicode dot prefix from secondary results
  • 843f641 7903510: JMH: Add core performance checking tests
  • 8bc325b 7903511: JMH: Add score stability performance tests
  • 6b09724 7903450: JMH: Improve -prof perfnorm accuracy with robust estimations
  • d88f901 7903504: JMH: Fix new Sonar warnings
  • 47f651b 7903498: JMH: Reset worker interrupt status after iteration
  • 482561a 7903492: JMH: Infrastructure code should yield occasionally for virtual execu...
  • 9a97557 7903490: JMH: The interrupt to time-outing benchmark can be delivered to work...
  • bf8db38 7903487: JMH: Make sure JMH profilers work on all tested configurations
  • Additional commits viewable in compare view

Updates biz.aQute.bnd.builder from 7.1.0 to 7.4.0

Release notes

Sourced from biz.aQute.bnd.builder's releases.

Bnd/Bndtools 7.4.0

See Release Notes

What's Changed

... (truncated)

Commits
  • 2046c36 build: Build Release 7.4.0
  • aab8519 build: Build Release 7.4.0.RC3
  • 606a199 build: Build Release 7.4.0.RC2
  • afdf547 missing files
  • 9074a7a build: Build Release 7.4.0.RC1
  • b5c4c58 Revert "Eclipse feature support for buildpath"
  • 4fd8e4a Eclipse feature support for buildpath
  • a6ba530 Merge pull request #7336 from chrisrueger/7214-fix-deadlock-junit-tee
  • 0fda33a Fix thread-safety in Tee class
  • 061b7fd Merge pull request #7325 from bndtools/dependabot/github_actions/actions/chec...
  • Additional commits viewable in compare view

Updates com.yubico.yubikit:openpgp from 3.1.0 to 3.3.0

Release notes

Sourced from com.yubico.yubikit:openpgp's releases.

YubiKit 3.3.0

A feature release with support for TPDU-level USB readers, larger APDUs and additional PIV key types, plus a broad set of robustness and security fixes.

New in this release:

  • android module:
    • Support for TPDU-level USB readers, with host-side T=1 framing (#381)
    • CCID command chaining and response reassembly for large APDUs (#380)
  • core module:
    • Larger extended length APDUs on devices which support them; larger data is sent with command chaining instead of failing (#405)
    • PublicKeyValues and PrivateKeyValues variants for the additional key types (#405)
  • fido module:
    • Ctap2Session.setPollingEnabled(false) turns off NFC polling, fixing OPERATION_DENIED when APDUs are relayed over a slow network (#386)
  • piv module:
    • Support for additional key types, a signature algorithm and a key-encapsulation mechanism on devices which support them, see PivSession.FEATURE_* (#405)
    • RSA1024 keys and TDES management keys are rejected on devices that do not support them (#405)
  • management module:
    • Added Capability.FIDO_CCID (0x1000), reported by firmware 5.8+ (#379)
    • DeviceInfo.getName() returns the device name reported by the firmware (#405)

Fixes:

  • core module:
    • Under SCP03/SCP11 a response without a valid R-MAC is refused; before, a bare 9000 was accepted (#404)
    • Reassemble FIDO HID messages longer than 7609 bytes (#395)
  • fido module:
    • makeCredential returns fmt none with an empty attStmt unless attestation was requested, as WebAuthn requires (#403)
    • Ctap1Client.getAssertion rejects userVerification "required" (#403)
    • Unsigned 64-bit integers in Cbor, vendorPrototype and InfoData; vendorPrototype(Integer) and getVendorPrototypeConfigCommands() are deprecated (#401)
    • Accept COSE algorithm identifiers sent as floating point numbers (#398)
    • NFCCTAP_GETRESPONSE polls no longer re-send the request (#386)
    • getAssertions passes the caller's CommandState to follow-up assertions (#403)
    • Send config subcommand 0xFF as 255
  • openpgp module:
    • An invalid KDF iteration count is rejected with IllegalArgumentException, and the whole salt and PIN is always hashed (#403)
    • Initialize a session with a card that advertises no extended capabilities or general features (#403)
  • piv module:
    • Certificate decompression is bounded; gzip certificates over 64 KiB are rejected (#403)
    • KeyType.fromValue() finds key types above 0x7F, such as ED25519
  • core, fido, oath modules:
    • Malformed or endless card and key responses now fail with an exception instead of an unchecked error or an endless read (#403)
  • fido, openpgp modules:
    • No longer use API 24 methods, which caused NoSuchMethodError on API 21-23 (#403)
  • test infrastructure:
    • fido-ui instrumented tests run on Android 16
  • build system:
    • Updated dependencies, GitHub Actions and the Gradle wrapper (9.7.1) (#382)

Full Changelog: 3.2.1...3.3.0

YubiKit 3.2.1

A patch release with correctness and robustness fixes across fido, core and piv.

... (truncated)

Changelog

Sourced from com.yubico.yubikit:openpgp's changelog.

  • Version 3.3.0 (released 2026-10-29) ** new:
    • core: PublicKeyValues and PrivateKeyValues variants for the additional key types
    • core: larger extended length APDUs on supporting devices; larger data is sent with command chaining instead of failing
    • android: support for TPDU-level USB readers (host-side T=1 framing)
    • android: CCID command chaining and response reassembly for large APDUs
    • fido: Ctap2Session.setPollingEnabled(false) turns off NFC polling, fixing OPERATION_DENIED when APDUs are relayed over a slow network
    • piv: support for additional key types, a signature algorithm and a key-encapsulation mechanism on devices which support them (see PivSession.FEATURE_*)
    • piv: RSA1024 and TDES management keys are rejected on devices that do not support them
    • management: added Capability.FIDO_CCID (0x1000), reported by firmware 5.8+
    • management: DeviceInfo.getName() returns the device name reported by the firmware ** fixes & improvements:
    • core: under SCP03/SCP11 a response without a valid R-MAC is refused (a bare 9000 was accepted before)
    • core, fido, oath: malformed or endless card and key responses now fail with an exception instead of an unchecked error or an endless read
    • core: reassemble FIDO HID messages longer than 7609 bytes
    • fido: makeCredential returns fmt "none" with an empty attStmt unless attestation was requested, as WebAuthn requires
    • fido: Ctap1Client.getAssertion rejects userVerification "required"
    • fido: unsigned 64-bit integers in Cbor, vendorPrototype and InfoData; vendorPrototype(Integer) and getVendorPrototypeConfigCommands() are deprecated
    • fido, openpgp: no longer use API 24 methods (NoSuchMethodError on API 21-23)
    • fido: getAssertions passes the caller's CommandState to follow-up assertions
    • fido: accept COSE algorithm identifiers sent as floats; send config subcommand 0xFF as 255
    • fido: NFCCTAP_GETRESPONSE polls no longer re-send the request
    • piv: certificate decompression is bounded (gzip certificates over 64 KiB are rejected)
    • piv: KeyType.fromValue() finds key types above 0x7F, such as ED25519
    • openpgp: an invalid KDF iteration count is rejected with IllegalArgumentException, and the whole salt and PIN is always hashed
    • openpgp: initialize a session with a card that advertises no extended capabilities or general features, instead of failing with IllegalArgumentException
    • testing: fido-ui instrumented tests run on Android 16
    • build: updated dependencies, GitHub Actions and the Gradle wrapper (9.7.1)
  • Version 3.2.1 (released 2026-09-08) ** fixes & improvements:
    • fido: decode COSE EC2 coordinates as unsigned
    • fido: made Ctap2Session.InfoData.getFirmwareVersion() public
    • core: bound TLV and CBOR parsing before allocating
    • core: replaced the SLF4J fluent API with isXEnabled()-guarded calls
    • piv: fix key params on Java 24+
    • fido-ui: reuse isFormValid in the PIN submit guard
    • testing: instrumented test APK installs on API 21 again
    • build: updated dependencies and pinned GitHub Actions to full commit SHAs
  • Version 3.2.0 (released 2026-07-07) ** new:

... (truncated)

Commits
  • 855b188 docs: tighten 3.3.0 NEWS and set date
  • 62a10e3 docs: fix version file in publish guide
  • e238100 Merge branch 'main' into release/3.3.0
  • ccc040e Merge PR #405
  • 5696d1b Merge main into adapt-to-device-capabilities
  • a119551 chore: update copyright years
  • 87d3dc4 refactor: give new key types no bit length
  • ebf6eab Merge PR #404
  • 9b51e5f feat(piv): support additional key types
  • ad736d4 feat(core): add key values for new key types
  • Additional commits viewable in compare view

Updates com.yubico.yubikit:desktop from 3.1.0 to 3.3.0

Release notes

Sourced from com.yubico.yubikit:desktop's releases.

YubiKit 3.3.0

A feature release with support for TPDU-level USB readers, larger APDUs and additional PIV key types, plus a broad set of robustness and security fixes.

New in this release:

  • android module:
    • Support for TPDU-level USB readers, with host-side T=1 framing (#381)
    • CCID command chaining and response reassembly for large APDUs (#380)
  • core module:
    • Larger extended length APDUs on devices which support them; larger data is sent with command chaining instead of failing (#405)
    • PublicKeyValues and PrivateKeyValues variants for the additional key types (#405)
  • fido module:
    • Ctap2Session.setPollingEnabled(false) turns off NFC polling, fixing OPERATION_DENIED when APDUs are relayed over a slow network (#386)
  • piv module:
    • Support for additional key types, a signature algorithm and a key-encapsulation mechanism on devices which support them, see PivSession.FEATURE_* (#405)
    • RSA1024 keys and TDES management keys are rejected on devices that do not support them (#405)
  • management module:
    • Added Capability.FIDO_CCID (0x1000), reported by firmware 5.8+ (#379)
    • DeviceInfo.getName() returns the device name reported by the firmware (#405)

Fixes:

  • core module:
    • Under SCP03/SCP11 a response without a valid R-MAC is refused; before, a bare 9000 was accepted (#404)
    • Reassemble FIDO HID messages longer than 7609 bytes (#395)
  • fido module:
    • makeCredential returns fmt none with an empty attStmt unless attestation was requested, as WebAuthn requires (#403)
    • Ctap1Client.getAssertion rejects userVerification "required" (#403)
    • Unsigned 64-bit integers in Cbor, vendorPrototype and InfoData; vendorPrototype(Integer) and getVendorPrototypeConfigCommands() are deprecated (#401)
    • Accept COSE algorithm identifiers sent as floating point numbers (#398)
    • NFCCTAP_GETRESPONSE polls no longer re-send the request (#386)
    • getAssertions passes the caller's CommandState to follow-up assertions (#403)
    • Send config subcommand 0xFF as 255
  • openpgp module:
    • An invalid KDF iteration count is rejected with IllegalArgumentException, and the whole salt and PIN is always hashed (#403)
    • Initialize a session with a card that advertises no extended capabilities or general features (#403)
  • piv module:
    • Certificate decompression is bounded; gzip certificates over 64 KiB are rejected (#403)
    • KeyType.fromValue() finds key types above 0x7F, such as ED25519
  • core, fido, oath modules:
    • Malformed or endless card and key responses now fail with an exception instead of an unchecked error or an endless read (#403)
  • fido, openpgp modules:
    • No longer use API 24 methods, which caused NoSuchMethodError on API 21-23 (#403)
  • test infrastructure:
    • fido-ui instrumented tests run on Android 16
  • build system:
    • Updated dependencies, GitHub Actions and the Gradle wrapper (9.7.1) (#382)

Full Changelog: 3.2.1...3.3.0

YubiKit 3.2.1

A patch release with correctness and robustness fixes across fido, core and piv.

... (truncated)

Changelog

Sourced from com.yubico.yubikit:desktop's changelog.

  • Version 3.3.0 (released 2026-10-29) ** new:
    • core: PublicKeyValues and PrivateKeyValues variants for the additional key types
    • core: larger extended length APDUs on supporting devices; larger data is sent with command chaining instead of failing
    • android: support for TPDU-level USB readers (host-side T=1 framing)
    • android: CCID command chaining and response reassembly for large APDUs
    • fido: Ctap2Session.setPollingEnabled(false) turns off NFC polling, fixing OPERATION_DENIED when APDUs are relayed over a slow network
    • piv: support for additional key types, a signature algorithm and a key-encapsulation mechanism on devices which support them (see PivSession.FEATURE_*)
    • piv: RSA1024 and TDES management keys are rejected on devices that do not support them
    • management: added Capability.FIDO_CCID (0x1000), reported by firmware 5.8+
    • management: DeviceInfo.getName() returns the device name reported by the firmware ** fixes & improvements:
    • core: under SCP03/SCP11 a response without a valid R-MAC is refused (a bare 9000 was accepted before)
    • core, fido, oath: malformed or endless card and key responses now fail with an exception instead of an unchecked error or an endless read
    • core: reassemble FIDO HID messages longer than 7609 bytes
    • fido: makeCredential returns fmt "none" with an empty attStmt unless attestation was requested, as WebAuthn requires
    • fido: Ctap1Client.getAssertion rejects userVerification "required"
    • fido: unsigned 64-bit integers in Cbor, vendorPrototype and InfoData; vendorPrototype(Integer) and getVendorPrototypeConfigCommands() are deprecated
    • fido, openpgp: no longer use API 24 methods (NoSuchMethodError on API 21-23)
    • fido: getAssertions passes the caller's CommandState to follow-up assertions
    • fido: accept COSE algorithm identifiers sent as floats; send config subcommand 0xFF as 255
    • fido: NFCCTAP_GETRESPONSE polls no longer re-send the request
    • piv: certificate decompression is bounded (gzip certificates over 64 KiB are rejected)
    • piv: KeyType.fromValue() finds key types above 0x7F, such as ED25519
    • openpgp: an invalid KDF iteration count is rejected with IllegalArgumentException, and the whole salt and PIN is always hashed
    • openpgp: initialize a session with a card that advertises no extended capabilities or general features, instead of failing with IllegalArgumentException
    • testing: fido-ui instrumented tests run on Android 16
    • build: updated dependencies, GitHub Actions and the Gradle wrapper (9.7.1)
  • Version 3.2.1 (released 2026-09-08) ** fixes & improvements:
    • fido: decode COSE EC2 coordinates as unsigned
    • fido: made Ctap2Session.InfoData.getFirmwareVersion() public
    • core: bound TLV and CBOR parsing before allocating
    • core: replaced the SLF4J fluent API with isXEnabled()-guarded calls
    • piv: fix key params on Java 24+
    • fido-ui: reuse isFormValid in the PIN submit guard
    • testing: instrumented test APK installs on API 21 again
    • build: updated dependencies and pinned GitHub Actions to full commit SHAs
  • Version 3.2.0 (released 2026-07-07) ** new:

... (truncated)

Commits
  • 855b188 docs: tighten 3.3.0 NEWS and set date
  • 62a10e3 docs: fix version file in publish guide
  • e238100 Merge branch 'main' into release/3.3.0
  • ccc040e Merge PR #405
  • 5696d1b Merge main into adapt-to-device-capabilities
  • a119551 chore: update copyright years
  • 87d3dc4 refactor: give new key types no bit length
  • ebf6eab Merge PR #404
  • 9b51e5f feat(piv): support additional key types
  • ad736d4 feat(core): add key values for new key types
  • Additional commits viewable in compare view

Updates javax.mail:mail from 1.4 to 1.4.7

Updates jakarta.mail:jakarta.mail-api from 2.0.1 to 2.1.5

Release notes

Sourced from jakarta.mail:jakarta.mail-api's releases.

Jakarta Mail 2.1.5 Final Release

The 2.1.5 release is a bug fix release of 2.1.x (Jakarta EE 10).

Following changes are included:

Full Changelog: jakartaee/mail-api@2.1.4...2.1.5

Jakarta Mail 2.1.4 Final Release

The 2.1.4 release is a bug fix release of 2.1.x (Jakarta EE 10).

Following changes are included:

Full Changelog: jakartaee/mail-api@2.1.3...2.1.4

Jakarta Mail 2.1.3 Final Release

The 2.1.3 release is a bug fix release of 2.1.x (Jakarta EE 10).

Following changes are included:

@dependabot
Bump the gradle-dependencies group across 1 directory with 19 updates
f60475f 
Bumps the gradle-dependencies group with 19 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [com.puppycrawl.tools:checkstyle](https://github.com/checkstyle/checkstyle) | `9.0` | `9.3` |
| [com.google.errorprone:error_prone_core](https://github.com/google/error-prone) | `2.43.0` | `2.51.0` |
| [junit:junit](https://github.com/junit-team/junit4) | `4.11` | `4.13.2` |
| net.ltgt.errorprone | `4.2.0` | `4.4.0` |
| [org.openjdk.jmh:jmh-core](https://github.com/openjdk/jmh) | `1.33` | `1.37` |
| [org.openjdk.jmh:jmh-generator-annprocess](https://github.com/openjdk/jmh) | `1.33` | `1.37` |
| [biz.aQute.bnd.builder](https://github.com/bndtools/bnd) | `7.1.0` | `7.4.0` |
| [com.yubico.yubikit:openpgp](https://github.com/Yubico/yubikit-android) | `3.1.0` | `3.3.0` |
| [com.yubico.yubikit:desktop](https://github.com/Yubico/yubikit-android) | `3.1.0` | `3.3.0` |
| javax.mail:mail | `1.4` | `1.4.7` |
| [jakarta.mail:jakarta.mail-api](https://github.com/jakartaee/mail-api) | `2.0.1` | `2.1.5` |
| [jakarta.activation:jakarta.activation-api](https://github.com/jakartaee/jaf-api) | `2.0.0` | `2.1.4` |
| [io.grpc:grpc-protobuf](https://github.com/grpc/grpc-java) | `1.83.1` | `1.85.1` |
| [io.grpc:grpc-stub](https://github.com/grpc/grpc-java) | `1.83.1` | `1.85.1` |
| [io.grpc:grpc-services](https://github.com/grpc/grpc-java) | `1.83.1` | `1.85.1` |
| [io.grpc:grpc-netty-shaded](https://github.com/grpc/grpc-java) | `1.83.1` | `1.85.1` |
| [io.grpc:protoc-gen-grpc-java](https://github.com/grpc/grpc-java) | `1.83.1` | `1.85.1` |
| [io.grpc:grpc-stub](https://github.com/grpc/grpc-java) | `1.83.1` | `1.85.1` |
| [io.grpc:grpc-services](https://github.com/grpc/grpc-java) | `1.83.1` | `1.85.1` |
| [io.grpc:grpc-netty-shaded](https://github.com/grpc/grpc-java) | `1.83.1` | `1.85.1` |
| [io.grpc:protoc-gen-grpc-java](https://github.com/grpc/grpc-java) | `1.83.1` | `1.85.1` |
| com.google.protobuf | `0.9.4` | `0.10.0` |
| [gradle-wrapper](https://github.com/gradle/gradle) | `9.1.0` | `9.8.2` |



Updates `com.puppycrawl.tools:checkstyle` from 9.0 to 9.3
- [Release notes](https://github.com/checkstyle/checkstyle/releases)
- [Commits](checkstyle/checkstyle@checkstyle-9.0...checkstyle-9.3)

Updates `com.google.errorprone:error_prone_core` from 2.43.0 to 2.51.0
- [Release notes](https://github.com/google/error-prone/releases)
- [Commits](google/error-prone@v2.43.0...v2.51.0)

Updates `junit:junit` from 4.11 to 4.13.2
- [Release notes](https://github.com/junit-team/junit4/releases)
- [Changelog](https://github.com/junit-team/junit4/blob/main/doc/ReleaseNotes4.11.md)
- [Commits](junit-team/junit4@r4.11...r4.13.2)

Updates `net.ltgt.errorprone` from 4.2.0 to 4.4.0

Updates `org.openjdk.jmh:jmh-core` from 1.33 to 1.37
- [Commits](openjdk/jmh@1.33...1.37)

Updates `org.openjdk.jmh:jmh-generator-annprocess` from 1.33 to 1.37
- [Commits](openjdk/jmh@1.33...1.37)

Updates `biz.aQute.bnd.builder` from 7.1.0 to 7.4.0
- [Release notes](https://github.com/bndtools/bnd/releases)
- [Commits](bndtools/bnd@7.1.0...7.4.0)

Updates `com.yubico.yubikit:openpgp` from 3.1.0 to 3.3.0
- [Release notes](https://github.com/Yubico/yubikit-android/releases)
- [Changelog](https://github.com/Yubico/yubikit-android/blob/main/NEWS)
- [Commits](Yubico/yubikit-android@3.1.0...3.3.0)

Updates `com.yubico.yubikit:desktop` from 3.1.0 to 3.3.0
- [Release notes](https://github.com/Yubico/yubikit-android/releases)
- [Changelog](https://github.com/Yubico/yubikit-android/blob/main/NEWS)
- [Commits](Yubico/yubikit-android@3.1.0...3.3.0)

Updates `javax.mail:mail` from 1.4 to 1.4.7

Updates `jakarta.mail:jakarta.mail-api` from 2.0.1 to 2.1.5
- [Release notes](https://github.com/jakartaee/mail-api/releases)
- [Commits](jakartaee/mail-api@2.0.1...2.1.5)

Updates `jakarta.activation:jakarta.activation-api` from 2.0.0 to 2.1.4
- [Release notes](https://github.com/jakartaee/jaf-api/releases)
- [Commits](jakartaee/jaf-api@2.0.0...2.1.4)

Updates `io.grpc:grpc-protobuf` from 1.83.1 to 1.85.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.85.1)

Updates `io.grpc:grpc-stub` from 1.83.1 to 1.85.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.85.1)

Updates `io.grpc:grpc-services` from 1.83.1 to 1.85.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.85.1)

Updates `io.grpc:grpc-netty-shaded` from 1.83.1 to 1.85.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.85.1)

Updates `io.grpc:protoc-gen-grpc-java` from 1.83.1 to 1.85.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.85.1)

Updates `io.grpc:grpc-stub` from 1.83.1 to 1.85.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.85.1)

Updates `io.grpc:grpc-services` from 1.83.1 to 1.85.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.85.1)

Updates `io.grpc:grpc-netty-shaded` from 1.83.1 to 1.85.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.85.1)

Updates `io.grpc:protoc-gen-grpc-java` from 1.83.1 to 1.85.1
- [Release notes](https://github.com/grpc/grpc-java/releases)
- [Commits](grpc/grpc-java@v1.83.1...v1.85.1)

Updates `com.google.protobuf` from 0.9.4 to 0.10.0

Updates `gradle-wrapper` from 9.1.0 to 9.8.2
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](gradle/gradle@v9.1.0...v9.8.2)

---
updated-dependencies:
- dependency-name: com.puppycrawl.tools:checkstyle
  dependency-version: '9.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: com.google.errorprone:error_prone_core
  dependency-version: 2.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: junit:junit
  dependency-version: 4.13.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: net.ltgt.errorprone
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: org.openjdk.jmh:jmh-core
  dependency-version: '1.37'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: org.openjdk.jmh:jmh-generator-annprocess
  dependency-version: '1.37'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: biz.aQute.bnd.builder
  dependency-version: 7.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: com.yubico.yubikit:openpgp
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: com.yubico.yubikit:desktop
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: javax.mail:mail
  dependency-version: 1.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle-dependencies
- dependency-name: jakarta.mail:jakarta.mail-api
  dependency-version: 2.1.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: jakarta.activation:jakarta.activation-api
  dependency-version: 2.1.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: io.grpc:grpc-protobuf
  dependency-version: 1.85.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: io.grpc:grpc-stub
  dependency-version: 1.85.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: io.grpc:grpc-services
  dependency-version: 1.85.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: io.grpc:grpc-netty-shaded
  dependency-version: 1.85.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: io.grpc:protoc-gen-grpc-java
  dependency-version: 1.85.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: io.grpc:grpc-stub
  dependency-version: 1.85.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: io.grpc:grpc-services
  dependency-version: 1.85.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: io.grpc:grpc-netty-shaded
  dependency-version: 1.85.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: io.grpc:protoc-gen-grpc-java
  dependency-version: 1.85.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: com.google.protobuf
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: gradle-wrapper
  dependency-version: 9.8.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Nov 5, 2026
@dependabot dependabot Bot mentioned this pull request Nov 5, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants