[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
io.micronaut:micronaut-core-bom (source)	4.10.8 → 4.10.36

---

Release Notes

micronaut-projects/micronaut-core (io.micronaut:micronaut-core-bom)

v4.10.36: Micronaut Core 4.10.36

What's Changed

• Update Netty to 4.2.20.Final (#​14253)

Other Changes 💡

• Keep lookups from failing while the environment starts by @​radovanradic in #​14195

Full Changelog: micronaut-projects/micronaut-core@v4.10.35...v4.10.36

v4.10.35: Micronaut Core 4.10.35

What's Changed

Other Changes 💡

• Process a property source added just before a refresh reads only once, in its order by @​radovanradic in #​14163
• Keep lookups from failing while a property source is added to the running environment by @​radovanradic in #​14178

Full Changelog: micronaut-projects/micronaut-core@v4.10.34...v4.10.35

v4.10.34: Micronaut Core 4.10.34

What's Changed

Bug Fixes 🐞

• Keep ${random.*} values of mixed texts and lists stable, a regression since 4.10.32 by @​radovanradic in #​14108

Full Changelog: micronaut-projects/micronaut-core@v4.10.33...v4.10.34

v4.10.33: Micronaut Core 4.10.33

🚨Security

• GHSA-hc6g-27v9-95gw
• GHSA-wqcr-3grc-r66q
• GHSA-3qcg-c622-qmr7
• GHSA-9cqj-4442-98m4
• GHSA-38pj-464p-88jf
• GHSA-54gp-563g-92f3
• GHSA-75c9-c2hm-hjqg

Full Changelog: micronaut-projects/micronaut-core@v4.10.32...v4.10.33

v4.10.32: Micronaut Core 4.10.32

What's Changed

Other Changes 💡

• Publish a refreshed property catalog atomically by @​radovanradic in #​13896

Full Changelog: micronaut-projects/micronaut-core@v4.10.31...v4.10.32

v4.10.31: Micronaut Core 4.10.31

• Update to Jackson 2.21.7
• Update managed-netty version to 4.2.19.Final

Full Changelog: micronaut-projects/micronaut-core@v4.10.30...v4.10.31

v4.10.30: Micronaut Core 4.10.30

What's Changed

Bug Fixes 🐞

• [4.10.x] Keep draining a request body the server has already rejected by @​dstepanov in #​13524
• [4.10.x] Write body bytes that arrive before the response is up for writing by @​dstepanov in #​13526
• [4.10.x] Release buffered HTTP/2 request data when the stream closes before read complete by @​dstepanov in #​13528

Full Changelog: micronaut-projects/micronaut-core@v4.10.29...v4.10.30

v4.10.29: Micronaut Core 4.10.29

What's Changed

• [4.10.x] Preserve IPv6 hosts in UriBuilder by @​yawkat in #​13314
• [4.10.x] Handle malformed Forwarded host ports by @​yawkat in #​13313

Full Changelog: micronaut-projects/micronaut-core@v4.10.28...v4.10.29

v4.10.28: Micronaut Core 4.10.28

Update managed-netty version to 4.2.18.Final (#​13097)

Full Changelog: micronaut-projects/micronaut-core@v4.10.27...v4.10.28

v4.10.27: Micronaut Core 4.10.27

What's Changed

Security 🚨

• GHSA-9c73-4fch-jrwv Unbounded memory growth from fragmented WebSocket messages (DoS)
• GHSA-gxcm-8fhf-v7x9 Default error response always includes raw exception message with no suppression option
• GHSA-2j79-mgc9-v76r HTTP request decompression-bomb DoS via unbounded gzip/deflate decoding

Bug Fixes 🐞

• Backport fix for NPE when SSE events are received with no data field by @​kevin-wise in #​12868
• Backport: Handle null instances in QueryValueArgumentBinder by @​kevin-wise in #​12902

Full Changelog: micronaut-projects/micronaut-core@v4.10.26...v4.10.27

v4.10.26: Micronaut Core 4.10.26

What's Changed

Dependency Upgrades

• Jackson databind 2.21.5
• Update logback to 1.5.37
• Netty 4.2.16.Final

Full Changelog: micronaut-projects/micronaut-core@v4.10.25...v4.10.26

v4.10.25: Micronaut Core 4.10.25

What's Changed

Dependency updates 🚀

• Update Micronaut 4 to netty to v4.2.15.Final by @​sdelamo in #​12704

Full Changelog: micronaut-projects/micronaut-core@v4.10.24...v4.10.25

v4.10.24: Micronaut Core 4.10.24

What's Changed

🚨 Security

Fixes for security advisories:

• GHSA-387m-935m-c4vw
• GHSA-q6gh-6v2r-hjv3

Bug Fixes 🐞

• Fix IllegalArgumentException synthesizing bootstrap-loaded annotations (e.g. @​Deprecated) by @​szabelin in #​12692

New Contributors

• @​szabelin made their first contribution in #​12692

Full Changelog: micronaut-projects/micronaut-core@v4.10.23...v4.10.24

v4.10.23: Micronaut Core 4.10.23

What's Changed

Bug Fixes 🐞

• Fix HTTP server TCK on 4.10.x by @​yawkat in #​12645
• Fix full body subscribers on 4.10.x by @​yawkat in #​12646

Other Changes 💡

• Update Netty to 4.2.13.Final by @​yawkat in #​12662

Full Changelog: micronaut-projects/micronaut-core@v4.10.22...v4.10.23

v4.10.22: Micronaut Core 4.10.22

What's Changed

Security 👮🏻‍♂️🚨

This release contains fixes for these two security advisories:
*Unbounded formattersCache in TimeConverterRegistrar Allows Memory Exhaustion via Accept-Language Header
*Unbounded bundleCache in ResourceBundleMessageSource Allows Memory Exhaustion via Accept-Language Header

Other Changes 💡

• Fix locale converter throwing IllegalArgumentException for invalid input by @​asmaaknidar33 in #​12609

New Contributors

• @​asmaaknidar33 made their first contribution in #​12609

Full Changelog: micronaut-projects/micronaut-core@v4.10.21...v4.10.22

v4.10.21: Micronaut Core 4.10.21

What's Changed

Other Changes 💡

• Access log support for %U by @​n0tl3ss in #​12595

Full Changelog: micronaut-projects/micronaut-core@v4.10.20...v4.10.21

v4.10.20: Micronaut Core 4.10.20

What's Changed

Dependency updates 🚀

• Jackson upgrade to 2.21.2 by @​sdelamo in #​12587

Full Changelog: micronaut-projects/micronaut-core@v4.10.19...v4.10.20

v4.10.19: Micronaut Core 4.10.19

What's Changed

Dependency updates 🚀

• update to Jackson 2.21.1 by @​sdelamo in #​12510
• fix(deps): update netty monorepo to v4.2.12.final by @​sdelamo in #​12568

Other Changes 💡

• fix: MediaType can decode quoted charset by @​valtercorreia in #​12385
• Fix parsing of fully qualified type identifiers in ctx[...] expressions by @​yawkat in #​12523
• Correct this "|" to "||". by @​sdelamo in #​12573
• Conversion service already in abstract argument binder by @​sdelamo in #​12575
• rename fields to avoid sonar issues by @​sdelamo in #​12572

New Contributors

• @​valtercorreia made their first contribution in #​12385

Full Changelog: micronaut-projects/micronaut-core@v4.10.18...v4.10.19

v4.10.18: Micronaut Core 4.10.18

What's Changed

Bug Fixes 🐞

• fix: preserve SSL configuration when refreshing netty HTTP client by @​yawkat in #​12434

Other Changes 💡

• Fix: Relative redirects not resolved against request URI by @​ArtemLikhitskiy in #​12395

New Contributors

• @​ArtemLikhitskiy made their first contribution in #​12395

Full Changelog: micronaut-projects/micronaut-core@v4.10.17...v4.10.18

v4.10.17: Micronaut Core 4.10.17

What's Changed

Bug Fixes 🐞

• Fix GraalVM 25 loom-carrier native image initialization by @​yawkat in #​12418
• fix: avoid Path @​QueryValue StackOverflow in declarative clients by @​yawkat in #​12421
• align deprecated managed jackson version
• Replace ConcurrentHashMap with ConcurrentLinkedHashMap
  Full Changelog: micronaut-projects/micronaut-core@v4.10.16...v4.10.17

v4.10.16: Micronaut Core 4.10.16

What's Changed

Bug Fixes 🐞

• fix: prevent denial of service submitting form-url-encoded payload by @​sdelamo in #​12410

Other Changes 💡

• Add FunctionInitilizerTest by @​sdelamo in #​12396

Full Changelog: micronaut-projects/micronaut-core@v4.10.15...v4.10.16

v4.10.15: Micronaut Core 4.10.15

What's Changed

Bug Fixes 🐞

• add null check for environment by @​graemerocher in #​12380
• Fix duplicate content-type header bug, add test by @​wfhartford-wordly in #​12376

Dependency updates 🚀

• upgrade logback to 1.5.25 by @​graemerocher in #​12379

Other Changes 💡

• Return error on QueryValue conversion failures by @​iamsb97 in #​12321
• feat(12135): Adding support for list access using env variables by @​davidgammon-mettle in #​12136

New Contributors

• @​davidgammon-mettle made their first contribution in #​12136
• @​wfhartford-wordly made their first contribution in #​12376

Full Changelog: micronaut-projects/micronaut-core@v4.10.14...v4.10.15

v4.10.14: Micronaut Core 4.10.14

What's Changed

Bug Fixes 🐞

• Don't dispose request body on HTTP/2 RST by @​yawkat in #​12332

Improvements ⭐

• Apply request-decompression-enabled config to HTTP/2 by @​yawkat in #​12334

Dependency updates 🚀

• Upgrade log4j to version 2.25.3 by @​sdelamo in #​12327

Full Changelog: micronaut-projects/micronaut-core@v4.10.13...v4.10.14

v4.10.13: Micronaut Core 4.10.13

What's Changed

Other Changes 💡

• Create a fix for native image build with ContextConfigurer on GraalVM 22+ by @​andriy-dmytruk in #​12310

Full Changelog: micronaut-projects/micronaut-core@v4.10.12...v4.10.13

v4.10.12: Micronaut Core 4.10.12

What's Changed

Bug Fixes 🐞

• Preserving Body Related Headers When Following 307 or 308 Redirects by @​everett-hayes in #​12271
• In CORS Filter add GET as available method for static resources by @​sdelamo in #​12279

New Contributors

• @​everett-hayes made their first contribution in #​12271

Full Changelog: micronaut-projects/micronaut-core@v4.10.11...v4.10.12

v4.10.11: Micronaut Core 4.10.11

What's Changed

Improvements ⭐

• New leak detection for tests by @​yawkat in #​12139

Dependency updates 🚀

• [CVE-2025-67735] Update managed-netty version to 4.2.9.Final by @​alvarosanchez in #​12275

Full Changelog: micronaut-projects/micronaut-core@v4.10.10...v4.10.11

v4.10.10: Micronaut Core 4.10.10

What's Changed

Other Changes 💡

• Make http header list size configurable in HTTP client for HTTP2 by @​Pavlov7 in #​12172
• Fix BeanIntrospection to handle primitive types in property lookup by @​yashdoshi in #​12142

New Contributors

• @​Pavlov7 made their first contribution in #​12172
• @​yashdoshi made their first contribution in #​12142

Full Changelog: micronaut-projects/micronaut-core@v4.10.9...v4.10.10

v4.10.9: Micronaut Core 4.10.9

What's Changed

Bug Fixes 🐞

• Add support for less buggy multipart decoder by @​yawkat in #​12202

Full Changelog: micronaut-projects/micronaut-core@v4.10.8...v4.10.9

---

Configuration

📅 Schedule: (in timezone Europe/Prague)

• Branch creation
  • "after 10pm"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.