Skip to content

fix(deps): bump the prod-deps group across 1 directory with 12 updates#630

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/prod-deps-0f20f26f4c
Closed

fix(deps): bump the prod-deps group across 1 directory with 12 updates#630
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/prod-deps-0f20f26f4c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the prod-deps group with 12 updates in the / directory:

Package From To
org.folio:mod-configuration-client 5.12.1 5.13.0
org.apache.sshd:sshd-sftp 2.17.1 2.18.0
org.apache.sshd:sshd-spring-sftp 2.17.1 2.18.0
io.vertx:vertx-rx-java 4.5.25 4.5.28
commons-net:commons-net 3.12.0 3.13.0
org.folio:mod-di-converter-storage-client 2.4.3 2.5.0
com.github.ben-manes.caffeine:caffeine 3.2.3 3.2.4
org.junit:junit-bom 6.0.3 6.1.0
org.apache.logging.log4j:log4j-bom 2.25.3 2.26.0
org.springframework:spring-framework-bom 7.0.6 7.0.8
io.vertx:vertx-stack-depchain 5.0.12 5.1.2
org.testcontainers:testcontainers-bom 2.0.3 2.0.5

Updates org.folio:mod-configuration-client from 5.12.1 to 5.13.0

Release notes

Sourced from org.folio:mod-configuration-client's releases.

v5.13.0

Trillium (R1-2026) release with dependency upgrades only:

Changelog

Sourced from org.folio:mod-configuration-client's changelog.

5.13.0 2026-04-22

Trillium (R1-2026) release with dependency upgrades only:

5.12.0 2025-03-15

Sunflower release with dependency upgrades only:

  • MODCONF-146 Add folio-module-descriptor-validator to pom.xml
  • FOLREL-615 Update to mod-configuration Java 21
  • MODCONF-149 Upgrade all dependencies for Sunflower (R1-2025)

5.11.0 2024-10-23

Ramsons release with dependency upgrades only:

  • MODCONF-148: Ramsons deps: RMB 35.3.0, Vert.x 4.5.10, …

5.10.0 2024-03-12

  • MODCONF-144 Quesnelia deps: RMB 35.2.0, Vert.x 4.5.4, log4j 2.23.0, …

5.9.2 2023-10-06

Poppy release with dependency upgrades only:

5.9.1 2023-02-09

5.9.0 2022-10-27

5.8.0 2022-06-20

5.7.9 2022-06-20

  • MODCONF-113 Revert RMB 34, allow PostgreSQL 10 for Lotus and Kiwi

5.7.8 2022-06-08

... (truncated)

Commits
  • 3041b03 [maven-release-plugin] prepare release v5.13.0
  • 5dfabfb Add NEWS for 5.13.0 Trillium R1-2026
  • e45384e Delete Jenkinsfile-disabled
  • bc94769 Merge pull request #172 from folio-org/MODCONF-160
  • e7c1d2e MODCONF-160: Bump dependencies for Trillium: Vertx 5.0.11, log4j 2.25.4, …
  • a0d76de Merge pull request #169 from folio-org/FOLIO-4126-initial-maven-workflows
  • ceb5086 Enable workflow trigger conditions MODCONF-157
  • fad75ff Use maven Workflows MODCONF-157
  • c0b52e0 Merge pull request #166 from folio-org/MODCONF-151
  • 41af434 MODCONF-151: Upgrade module to Vert.x 5.0
  • Additional commits viewable in compare view

Updates org.apache.sshd:sshd-sftp from 2.17.1 to 2.18.0

Release notes

Sourced from org.apache.sshd:sshd-sftp's releases.

Apache MINA SSHD 2.18.0

Bug Fixes

  • GH-743 Ensure the Java ServiceLoader use a singleton SftpFileSystemProvider
  • GH-879 Close SSH channel gracefully on exception in port forwarding
  • Security: Improve handling of repository paths in sshd-git. Resolves CVE-2026-48827, announced 2026-05-30.

New Features

  • GH-892 Align handling certificates without principals with OpenSSH 10.3

Wildcard principals in host certificates are handled now.

  • Putty keys with non-ASCII passphrases

The passphrase needs to be converted to a byte sequence to compute a decryption key for an encrypted private key. This conversion depends on the character encoding. Putty on Windows uses the ANSI codepage set when the key was generated. Apache MINA SSHD now tries multiple encodings in sequence: UTF-8, then the OS encoding, and finally ISO-8859-1 as a last-chance fallback.

Potential Compatibility Issues

  • GH-892 Align handling certificates without principals with OpenSSH 10.3

OpenSSH 10.3 changed the way such certificates are handled; see the OpenSSH 10.3 release notes. In Apache MINA SSHD, there is a new flag CoreModuleProperties.ALLOW_EMPTY_CERTIFICATE_PRINCIPALS (by default false) that can be set on an SshClient or SshServer or also on a Session directly. If the value is false, certificates without principals are rejected as in OpenSSH 10.3; if it is true, such certificates are considered to match any user or host name as in OpenSSH < 10.3.

Set the flag on an SshClient or ClientSession to determine the handling of host certificates. Set it on an SshServer or ServerSession to govern the handling of user certificates.

Changelog

Sourced from org.apache.sshd:sshd-sftp's changelog.

Previous Versions

Latest Version

Planned for Next Version

Bug Fixes

New Features

Potential Compatibility Issues

Major Code Re-factoring

Commits
  • c2d7b7a [maven-release-plugin] prepare release sshd-2.18.0
  • 084cee8 Prepare release documentation
  • db0567b Improve git access
  • 1285419 GH-743: Use a singleton SftpFileSystemProvider for the ServiceLoader
  • 4e820c9 Add test cases to AuthorizedKeysCertificateTest
  • a85a3b1 Better handling of Putty keys with non-ASCII passphrases
  • 6c215e8 Bump BCFIPS bundles used in a test
  • 9def203 Fix annotation to ignore an unstable test
  • a0ef7a5 Host certificates: check both public keys for not being revoked
  • b11c159 GH-892: Host certificate principals may contain wildcards
  • Additional commits viewable in compare view

Updates org.apache.sshd:sshd-spring-sftp from 2.17.1 to 2.18.0

Release notes

Sourced from org.apache.sshd:sshd-spring-sftp's releases.

Apache MINA SSHD 2.18.0

Bug Fixes

  • GH-743 Ensure the Java ServiceLoader use a singleton SftpFileSystemProvider
  • GH-879 Close SSH channel gracefully on exception in port forwarding
  • Security: Improve handling of repository paths in sshd-git. Resolves CVE-2026-48827, announced 2026-05-30.

New Features

  • GH-892 Align handling certificates without principals with OpenSSH 10.3

Wildcard principals in host certificates are handled now.

  • Putty keys with non-ASCII passphrases

The passphrase needs to be converted to a byte sequence to compute a decryption key for an encrypted private key. This conversion depends on the character encoding. Putty on Windows uses the ANSI codepage set when the key was generated. Apache MINA SSHD now tries multiple encodings in sequence: UTF-8, then the OS encoding, and finally ISO-8859-1 as a last-chance fallback.

Potential Compatibility Issues

  • GH-892 Align handling certificates without principals with OpenSSH 10.3

OpenSSH 10.3 changed the way such certificates are handled; see the OpenSSH 10.3 release notes. In Apache MINA SSHD, there is a new flag CoreModuleProperties.ALLOW_EMPTY_CERTIFICATE_PRINCIPALS (by default false) that can be set on an SshClient or SshServer or also on a Session directly. If the value is false, certificates without principals are rejected as in OpenSSH 10.3; if it is true, such certificates are considered to match any user or host name as in OpenSSH < 10.3.

Set the flag on an SshClient or ClientSession to determine the handling of host certificates. Set it on an SshServer or ServerSession to govern the handling of user certificates.

Changelog

Sourced from org.apache.sshd:sshd-spring-sftp's changelog.

Previous Versions

Latest Version

Planned for Next Version

Bug Fixes

New Features

Potential Compatibility Issues

Major Code Re-factoring

Commits
  • c2d7b7a [maven-release-plugin] prepare release sshd-2.18.0
  • 084cee8 Prepare release documentation
  • db0567b Improve git access
  • 1285419 GH-743: Use a singleton SftpFileSystemProvider for the ServiceLoader
  • 4e820c9 Add test cases to AuthorizedKeysCertificateTest
  • a85a3b1 Better handling of Putty keys with non-ASCII passphrases
  • 6c215e8 Bump BCFIPS bundles used in a test
  • 9def203 Fix annotation to ignore an unstable test
  • a0ef7a5 Host certificates: check both public keys for not being revoked
  • b11c159 GH-892: Host certificate principals may contain wildcards
  • Additional commits viewable in compare view

Updates org.apache.sshd:sshd-spring-sftp from 2.17.1 to 2.18.0

Release notes

Sourced from org.apache.sshd:sshd-spring-sftp's releases.

Apache MINA SSHD 2.18.0

Bug Fixes

  • GH-743 Ensure the Java ServiceLoader use a singleton SftpFileSystemProvider
  • GH-879 Close SSH channel gracefully on exception in port forwarding
  • Security: Improve handling of repository paths in sshd-git. Resolves CVE-2026-48827, announced 2026-05-30.

New Features

  • GH-892 Align handling certificates without principals with OpenSSH 10.3

Wildcard principals in host certificates are handled now.

  • Putty keys with non-ASCII passphrases

The passphrase needs to be converted to a byte sequence to compute a decryption key for an encrypted private key. This conversion depends on the character encoding. Putty on Windows uses the ANSI codepage set when the key was generated. Apache MINA SSHD now tries multiple encodings in sequence: UTF-8, then the OS encoding, and finally ISO-8859-1 as a last-chance fallback.

Potential Compatibility Issues

  • GH-892 Align handling certificates without principals with OpenSSH 10.3

OpenSSH 10.3 changed the way such certificates are handled; see the OpenSSH 10.3 release notes. In Apache MINA SSHD, there is a new flag CoreModuleProperties.ALLOW_EMPTY_CERTIFICATE_PRINCIPALS (by default false) that can be set on an SshClient or SshServer or also on a Session directly. If the value is false, certificates without principals are rejected as in OpenSSH 10.3; if it is true, such certificates are considered to match any user or host name as in OpenSSH < 10.3.

Set the flag on an SshClient or ClientSession to determine the handling of host certificates. Set it on an SshServer or ServerSession to govern the handling of user certificates.

Changelog

Sourced from org.apache.sshd:sshd-spring-sftp's changelog.

Previous Versions

Latest Version

Planned for Next Version

Bug Fixes

New Features

Potential Compatibility Issues

Major Code Re-factoring

Commits
  • c2d7b7a [maven-release-plugin] prepare release sshd-2.18.0
  • 084cee8 Prepare release documentation
  • db0567b Improve git access
  • 1285419 GH-743: Use a singleton SftpFileSystemProvider for the ServiceLoader
  • 4e820c9 Add test cases to AuthorizedKeysCertificateTest
  • a85a3b1 Better handling of Putty keys with non-ASCII passphrases
  • 6c215e8 Bump BCFIPS bundles used in a test
  • 9def203 Fix annotation to ignore an unstable test
  • a0ef7a5 Host certificates: check both public keys for not being revoked
  • b11c159 GH-892: Host certificate principals may contain wildcards
  • Additional commits viewable in compare view

Updates io.vertx:vertx-rx-java from 4.5.25 to 4.5.28

Updates commons-net:commons-net from 3.12.0 to 3.13.0

Changelog

Sourced from commons-net:commons-net's changelog.

Apache Commons Net 3.13.0 Release Notes

The Apache Commons Net team is pleased to announce the release of Apache Commons Net 3.13.0.

Apache Commons Net library contains a collection of network utilities and protocol implementations. Supported protocols include Echo, Finger, FTP, NNTP, NTP, POP3(S), SMTP(S), Telnet, and Whois.

This is a feature and maintenance release. Java 8 or later is required.

For complete information on Apache Commons Net, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Commons Net website:

https://commons.apache.org/proper/commons-net/

Download page: https://commons.apache.org/proper/commons-net/download_net.cgi

New features

o Add DatagramSocketClient.getDefaultTimeoutDuration() and deprecate getDefaultTimeout(). Thanks to Gary Gregory. o NET-741: Add subnet IPv6 handling with SubnetUtils6 #391. Thanks to Maros Orsak, Gary Gregory.

Fixed Bugs

o DaytimeTCPClientTest now should now pass inside most VPNs. Thanks to Henri Biestro, Gary Gregory. o Migrate tests to JUnit5 #358, #359. Thanks to Jakub Kupczyk, Gary Gregory. o Fix malformed Javadoc comments. Thanks to Gary Gregory. o IMAPExportMbox now restores the current thread's interrupt flag when catching InterruptedException. Thanks to Gary Gregory. o IOUtil.readWrite() now restores the current thread's interrupt flag when catching InterruptedException. Thanks to Gary Gregory. o TelnetInputStream now restores the current thread's interrupt flag when catching InterruptedException. Thanks to Gary Gregory. o NET-740: FTP fails to parse listings for Linux vsftpd in Chinese or Japanese #393. Thanks to Jianwei Guo, Gary Gregory. o TelnetInputStream.read() doesn't preserve the original InterruptedException as the cause of its InterruptedIOException. Thanks to Gary Gregory. o FTPClient._storeFile(String, String, InputStream) doesn't always close it's internal socket when an exception is thrown early in processing. Thanks to Gary Gregory. o ListenerList.removeListener(T) now ignores null input to avoid a NullPointerException. Thanks to Gary Gregory. o ListenerList.addListener(T) now ignores null input. Thanks to Gary Gregory. o Fix typo in FTPConnectionClosedException message from FTP.getReply(boolean). Thanks to Gary Gregory. o Reimplement Util.copyReader() with IOUtils.copyLarge(). Thanks to Gary Gregory. o Reimplement Util.copyStream() with IOUtils.copyLarge(). Thanks to Gary Gregory. o Reimplement Util.copyStream() with IOUtils.copyLarge(). Thanks to Gary Gregory. o Deprecate Util.copyReader(Reader, Writer) in favor of IOUtils.copyLarge(Reader, Writer). Thanks to Gary Gregory.

Changes

o Bump org.apache.commons:commons-parent from 85 to 97 #371, #388, #389. Thanks to Gary Gregory, Dependabot. o Bump org.apache.commons:commons-lang3 from 3.18.0 to 3.19.0. Thanks to Gary Gregory, Dependabot.

... (truncated)

Commits
  • 35fa0df Prepare for the release candidate 3.13.0 RC1
  • 1cc5b6e Prepare for the next release candidate
  • a4b246e Reuse IOUtils.copyLarge()
  • e5ca262 Javadoc
  • 3cb18ec Deprecate Util.copyReader(Reader, Writer) in favor of
  • 3373d77 Reimplement Util.copyReader() with IOUtils.copyLarge()
  • 3be2077 Reimplement Util.copyStream() with IOUtils.copyLarge()
  • 7b41144 Javadoc
  • 1b584b4 Fix typo in FTPConnectionClosedException message from
  • 3792023 Javadoc
  • Additional commits viewable in compare view

Updates org.folio:mod-di-converter-storage-client from 2.4.3 to 2.5.0

Release notes

Sourced from org.folio:mod-di-converter-storage-client's releases.

2.5.0

2025-04-14 2.5.0

Changelog

Sourced from org.folio:mod-di-converter-storage-client's changelog.

2025-04-14 2.5.0

2025-03-13 2.4.0

  • MODDATAIMP-1102 Empty contributor and vendor reference properties created in order when no values in incoming record
  • MODDICONV-409 Update to Java 21 mod-di-converter-storage Sunflower R1 2025

2024-10-29 2.3.0

2024-03-20 2.2.0

  • MODDICORE-398 Upgrade mod-di-converter-storage to RMB 35.2.0, Vert.x 4.5.4
  • MODDICONV-334 Disallow linking MARC Update action to a MARC Modify
  • MODDICONV-367 Disallow action profile creation for MARCbib record with 'Create' action type
  • MODDICONV-294 Disallow creation of JobProfile containing Update without Match
  • MODDICONV-305 Remove "permissions" interface dependency
  • MODDICONV-364 Adjust default QM Authority Create profile to new format
  • MODDICONV-363 Add migration script to provide mapping data for "accountNo" field
  • MODDICONV-353 Create new default profile for create Authority record

2023-10-12 2.1.0

  • MODDICONV-345 Set wrapper ids at jsonb for migrated relations
  • MODDICONV-313 Upgrade mod-di-converter-storage to Java 17
  • MODDICONV-300 Match and action profiles cannot be re-used in an import job profile - short term fix
  • MODDICONV-310 Add wrappers around profiles to build associations.
  • MODDICONV-297 Add migration script for profiles with mapping for required subfields.
  • MODDICONV-307 Populate "value" with empty string if this field is absent in match profile incoming records.

2022-02-14 v2.0.0

  • MODDICONV-259 Rename mod-data-import-converter-storage module to mod-di-converter-storage
  • MODDICONV-271 Logging improvement - Configuration
  • MODDATAIMP-736 Adjust logging configuration in all DI modules to display datetime in a proper format
  • MODDICONV-292 Add validation of Folio Record Type upon linking of Action and Mapping profile
  • MODDICONV-281 Enable ability to edit Job profile: Default - Create SRS MARC Authority
  • MODDICONV-282 Change Job profile: Default - Create SRS MARC Authority description

... (truncated)

Commits
  • 7701d18 [maven-release-plugin] prepare release v2.5.0
  • ced68ff Update news
  • 11bbc53 Merge pull request #88 from folio-org/dept-upd
  • 8e56eec Update dependencies
  • 7d9cd15 MODDICONV-427 - Removed tables (#87)
  • 37ca77c MODDICONV-429: Upgrade module to Vert.x 5.0 (#84)
  • 14860c6 Merge pull request #83 from folio-org/MODDICONV-425
  • 9166b91 MODDICONV-425: Remove accepted values
  • 311ddf2 MODDICONV-425: Create new Default Mapping profile for Mosaic invoices
  • e9afcde MODDICONV-418 - Field mapping profile corruption for orders in Ramsons Test e...
  • Additional commits viewable in compare view

Updates com.github.ben-manes.caffeine:caffeine from 3.2.3 to 3.2.4

Release notes

Sourced from com.github.ben-manes.caffeine:caffeine's releases.

3.2.4

  • Improved access expiration's read performance by avoiding false sharing effects caused by the timestamp update
  • Fixed head-of-line blocking of expiration queues caused by in-flight async entries (#1954)
  • Fixed various minor issues found using AI audits
  • Added ObjectInputFilter support to JCache
Commits
  • 836b65c use a consistent expiration tolerance calculation
  • 0dc7daf resurrect in-flight async entries on expiration
  • 0bac8b5 handle head-of-line blocking of expiration queues (fixes #1954)
  • ff25836 test polish
  • f3a6176 Fix JCache close/createCache races and recursive teardown
  • 622fbe7 Fix removal in identity views and widen hill-climber counters
  • 8da5a7a defer weighing the entry until after the putIfAbsent hit fast-path
  • 94ad0ff Record eviction stats before notifying the removal listener consistently
  • f94c011 Auto-assert eviction stats alongside notifications.withCause.exclusively
  • 2e945e0 Skip timestamp writes within tolerance on the read path.
  • Additional commits viewable in compare view

Updates org.junit:junit-bom from 6.0.3 to 6.1.0

Release notes

Sourced from org.junit:junit-bom's releases.

JUnit 6.1.0 = Platform 6.1.0 + Jupiter 6.1.0 + Vintage 6.1.0

See Release Notes.

New Contributors

Full Changelog: junit-team/junit-framework@r6.0.3...r6.1.0

JUnit 6.1.0-RC1 = Platform 6.1.0-RC1 + Jupiter 6.1.0-RC1 + Vintage 6.1.0-RC1

See Release Notes.

New Contributors

Full Changelog: junit-team/junit-framework@r6.1.0-M1...r6.1.0-RC1

JUnit 6.1.0-M1 = Platform 6.1.0-M1 + Jupiter 6.1.0-M1 + Vintage 6.1.0-M1

See Release Notes.

New Contributors

Full Changelog: junit-team/junit-framework@r6.0.0...r6.1.0-M1

Commits

Updates org.apache.logging.log4j:log4j-bom from 2.25.3 to 2.26.0

Release notes

Sourced from org.apache.logging.log4j:log4j-bom's releases.

2.26.0

This minor release delivers all the fixes in the [2.25.0, 2.25.4] version range, plus some new fixes, and several other improvements and features.

Added

  • Add a new ConfigurationFactory::getConfiguration method accepting multiple URIs (#3775, #3921)
  • Add and export org.apache.logging.log4j.core.pattern.NamedInstantPattern enabling users to programmatically access named date & time patterns supported by Pattern Layout (#3789)
  • Add log4j.plugin.processor.minAllowedMessageKind annotation processor option to PluginProcessor to filter diagnostic messages by severity. This allows builds that treat compiler notes as errors (e.g. Maven with -Werror) to suppress informational notes emitted during normal plugin processing. (apache/logging-log4j2#3380, #4063)
  • Add missing setters to Rfc5424LayoutBuilder

Changed

  • Ensure scripts in the global Scripts element have explicit names by throwing a ConfigurationException for unnamed ones. (#3176)
  • Simplify file manager registry factory methods (#3968)

Deprecated

  • Deprecated withers in builder classes in favor of setters. This change improves API consistency with Log4j Core 3 and helps users adapt to the upcoming changes. (#3750)

Fixed

  • Fix script resolution failure when the Scripts element is placed after a ScriptRef in the configuration. (#3336)
  • Fix ArrayIndexOutOfBoundsException thrown by ThrowableStackTraceRenderer when the stack trace is modified concurrently (#3940, #3955)
  • Fix SLF4JLogger.atFatal() returning atLevel(Level.TRACE) instead of atLevel(Level.FATAL). This was causing FATAL-level log events to be silently discarded when using the fluent API through the log4j-to-slf4j bridge. (#4068, #4089)
  • Fix Javadoc references across module boundaries (i.e., cross-references) (#4099, #4100)
  • Fix header write in RollingRandomAccessFileManager that was being incorrectly skipped if append=true and the file didn't exist before
  • Fix a properties file configuration regression caused by not referenced loggers, appenders, and filters (#4036, #4069)

Removed

  • Remove the jvmrunargs lookup. (#3874)

Updated

  • Update org.junit:junit-bom to version 5.13.4 (#3850)
  • Update org.mongodb:bson to version 5.6.1 (#3961)
  • Update org.xerial.snappy:snappy-java to version 1.1.10.8 (#3841)

2.25.4

This patch release delivers fixes for configuration inconsistencies and formatting issues across several layouts.

  • Restores alignment between documented and actual configuration attributes.
  • Fixes formatting and sanitization issues in XML and RFC5424 layouts.
  • Improves handling of invalid characters and non-standard values.

The authoritative list of recognized configuration attributes is available in the PluginReference.

Fixed

  • Don't issue warnings if extra argument in parameterized logging is null. (#3975, #4014)

... (truncated)

Commits

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label May 29, 2026
@dependabot dependabot Bot requested a review from a team as a code owner May 29, 2026 12:42
@dependabot dependabot Bot added the java Pull requests that update java code label May 29, 2026
@dependabot dependabot Bot force-pushed the dependabot/maven/prod-deps-0f20f26f4c branch from af65066 to 5b1fc53 Compare June 9, 2026 22:53
@dependabot
fix(deps): bump the prod-deps group across 1 directory with 12 updates
c02488d 
Bumps the prod-deps group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [org.folio:mod-configuration-client](https://github.com/folio-org/mod-configuration) | `5.12.1` | `5.13.0` |
| [org.apache.sshd:sshd-sftp](https://github.com/apache/mina-sshd) | `2.17.1` | `2.18.0` |
| [org.apache.sshd:sshd-spring-sftp](https://github.com/apache/mina-sshd) | `2.17.1` | `2.18.0` |
| io.vertx:vertx-rx-java | `4.5.25` | `4.5.28` |
| [commons-net:commons-net](https://github.com/apache/commons-net) | `3.12.0` | `3.13.0` |
| [org.folio:mod-di-converter-storage-client](https://github.com/folio-org/mod-di-converter-storage) | `2.4.3` | `2.5.0` |
| [com.github.ben-manes.caffeine:caffeine](https://github.com/ben-manes/caffeine) | `3.2.3` | `3.2.4` |
| [org.junit:junit-bom](https://github.com/junit-team/junit-framework) | `6.0.3` | `6.1.0` |
| [org.apache.logging.log4j:log4j-bom](https://github.com/apache/logging-log4j2) | `2.25.3` | `2.26.0` |
| [org.springframework:spring-framework-bom](https://github.com/spring-projects/spring-framework) | `7.0.6` | `7.0.8` |
| io.vertx:vertx-stack-depchain | `5.0.12` | `5.1.2` |
| [org.testcontainers:testcontainers-bom](https://github.com/testcontainers/testcontainers-java) | `2.0.3` | `2.0.5` |



Updates `org.folio:mod-configuration-client` from 5.12.1 to 5.13.0
- [Release notes](https://github.com/folio-org/mod-configuration/releases)
- [Changelog](https://github.com/folio-org/mod-configuration/blob/master/NEWS.md)
- [Commits](folio-org/mod-configuration@v5.12.1...v5.13.0)

Updates `org.apache.sshd:sshd-sftp` from 2.17.1 to 2.18.0
- [Release notes](https://github.com/apache/mina-sshd/releases)
- [Changelog](https://github.com/apache/mina-sshd/blob/master/CHANGES.md)
- [Commits](apache/mina-sshd@sshd-2.17.1...sshd-2.18.0)

Updates `org.apache.sshd:sshd-spring-sftp` from 2.17.1 to 2.18.0
- [Release notes](https://github.com/apache/mina-sshd/releases)
- [Changelog](https://github.com/apache/mina-sshd/blob/master/CHANGES.md)
- [Commits](apache/mina-sshd@sshd-2.17.1...sshd-2.18.0)

Updates `org.apache.sshd:sshd-spring-sftp` from 2.17.1 to 2.18.0
- [Release notes](https://github.com/apache/mina-sshd/releases)
- [Changelog](https://github.com/apache/mina-sshd/blob/master/CHANGES.md)
- [Commits](apache/mina-sshd@sshd-2.17.1...sshd-2.18.0)

Updates `io.vertx:vertx-rx-java` from 4.5.25 to 4.5.28

Updates `commons-net:commons-net` from 3.12.0 to 3.13.0
- [Changelog](https://github.com/apache/commons-net/blob/master/RELEASE-NOTES.txt)
- [Commits](apache/commons-net@rel/commons-net-3.12.0...rel/commons-net-3.13.0)

Updates `org.folio:mod-di-converter-storage-client` from 2.4.3 to 2.5.0
- [Release notes](https://github.com/folio-org/mod-di-converter-storage/releases)
- [Changelog](https://github.com/folio-org/mod-di-converter-storage/blob/master/NEWS.md)
- [Commits](folio-org/mod-di-converter-storage@v2.4.3...v2.5.0)

Updates `com.github.ben-manes.caffeine:caffeine` from 3.2.3 to 3.2.4
- [Release notes](https://github.com/ben-manes/caffeine/releases)
- [Commits](ben-manes/caffeine@v3.2.3...v3.2.4)

Updates `org.junit:junit-bom` from 6.0.3 to 6.1.0
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](junit-team/junit-framework@r6.0.3...r6.1.0)

Updates `org.apache.logging.log4j:log4j-bom` from 2.25.3 to 2.26.0
- [Release notes](https://github.com/apache/logging-log4j2/releases)
- [Changelog](https://github.com/apache/logging-log4j2/blob/2.x/RELEASE-NOTES.adoc)
- [Commits](apache/logging-log4j2@rel/2.25.3...rel/2.26.0)

Updates `org.springframework:spring-framework-bom` from 7.0.6 to 7.0.8
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.6...v7.0.8)

Updates `io.vertx:vertx-stack-depchain` from 5.0.12 to 5.1.2

Updates `org.testcontainers:testcontainers-bom` from 2.0.3 to 2.0.5
- [Release notes](https://github.com/testcontainers/testcontainers-java/releases)
- [Changelog](https://github.com/testcontainers/testcontainers-java/blob/main/CHANGELOG.md)
- [Commits](testcontainers/testcontainers-java@2.0.3...2.0.5)

---
updated-dependencies:
- dependency-name: com.github.ben-manes.caffeine:caffeine
  dependency-version: 3.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps
- dependency-name: commons-net:commons-net
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps
- dependency-name: io.vertx:vertx-rx-java
  dependency-version: 4.5.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps
- dependency-name: io.vertx:vertx-stack-depchain
  dependency-version: 5.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps
- dependency-name: org.apache.logging.log4j:log4j-bom
  dependency-version: 2.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps
- dependency-name: org.apache.sshd:sshd-sftp
  dependency-version: 2.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps
- dependency-name: org.apache.sshd:sshd-spring-sftp
  dependency-version: 2.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps
- dependency-name: org.apache.sshd:sshd-spring-sftp
  dependency-version: 2.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps
- dependency-name: org.folio:mod-configuration-client
  dependency-version: 5.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps
- dependency-name: org.folio:mod-di-converter-storage-client
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps
- dependency-name: org.junit:junit-bom
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-deps
- dependency-name: org.springframework:spring-framework-bom
  dependency-version: 7.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps
- dependency-name: org.testcontainers:testcontainers-bom
  dependency-version: 2.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/maven/prod-deps-0f20f26f4c branch from 5b1fc53 to c02488d Compare June 16, 2026 14:41
@ykashtalian ykashtalian mentioned this pull request Jun 19, 2026
Merged
9 tasks
@dependabot @github

dependabot Bot commented on behalf of github Jun 19, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot Bot deleted the dependabot/maven/prod-deps-0f20f26f4c branch June 19, 2026 12:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ykashtalian