Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 1, 2025

Bumps the plugins group with 4 updates: com.puppycrawl.tools:checkstyle, org.apache.maven.plugins:maven-javadoc-plugin, org.apache.maven.plugins:maven-compiler-plugin and org.owasp:dependency-check-maven.

Updates com.puppycrawl.tools:checkstyle from 11.0.1 to 11.1.0

Release notes

Sourced from com.puppycrawl.tools:checkstyle's releases.

checkstyle-11.1.0

Checkstyle 11.1.0 - https://checkstyle.org/releasenotes.html#Release_11.1.0

New:

#17451 - false-negative: whitespace between type annotation and array declarator or ellipsis

Bug fixes:

#17540 - Annotation location rule is not enforced in package-info.java file #17507 - Google style: Missing support for multipart versioning format using underscores in method names #17778 - Add support to properly follow Rule 7.1.1 General Form in Google Style Guide Implementation #17825 - --generate-checks-and-files-suppression option generates invalid XML #13048 - JavadocTagContinuationIndentation: missing support to arbitrary indentation in <pre> tags #11867 - LineLength gets triggered on multi-line strings for Google Checks

Commits
  • aa944a0 [maven-release-plugin] prepare release checkstyle-11.1.0
  • 64a4b38 doc: release notes for 11.1.0
  • 17343cb Issue #17540: Enforce Annotation location rule in package-info.java
  • 5d52248 Issue #17507: Add support for multipart versioning format using underscores
  • c6c226c Issue #14631: Update SLASH token documentation to match new AST format
  • 62627bd Issue #17778: Added JavadocLeadingAsteriskAlign Check in google_checks.xml fo...
  • a7149ee Issue #17507: Add support for underscores in class name
  • 1c22f5b Issue #17834: Fix DTD in suppressions.xml example
  • 974bf37 Issue #14631: Fixed Token docs
  • 97d8d50 minor: Bump version to 11.1.0-SNAPSHOT
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-javadoc-plugin from 3.11.3 to 3.12.0

Release notes

Sourced from org.apache.maven.plugins:maven-javadoc-plugin's releases.

3.12.0

💥 Breaking changes

🐛 Bug Fixes

👻 Maintenance

📦 Dependency updates

Commits
  • 2a06bed [maven-release-plugin] prepare release maven-javadoc-plugin-3.12.0
  • a71ecf9 bump version 3.12.0-SNAPSHOT
  • 88f2b71 [maven-release-plugin] prepare for next development iteration
  • 7e18956 [maven-release-plugin] prepare release maven-javadoc-plugin-3.11.4
  • c11b76c In legacyMode, don't use -sourcepath, unless excludePackageNames is not empty...
  • bc9904b remove fix mojo (#1263)
  • f310135 Fix package {...} does not exist in legacyMode (#1243)
  • c8270f9 detectOfflineLinks is now false per default for all jar mojo issue #1258 ...
  • 953e609 Delete flaky test (#1260)
  • 2bba7a4 Bump org.codehaus.mojo:mrm-maven-plugin from 1.6.0 to 1.7.0
  • Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-compiler-plugin from 3.14.0 to 3.14.1

Release notes

Sourced from org.apache.maven.plugins:maven-compiler-plugin's releases.

3.14.1

🚀 New features and improvements

🐛 Bug Fixes

📦 Dependency updates

Commits
  • 0df6940 [maven-release-plugin] prepare release maven-compiler-plugin-3.14.1
  • 1bf9e5a Enforce asm version used here, to not depend on brittle transitive (#964)
  • f5161c4 Bump mavenVersion from 3.9.10 to 3.9.11 (#952)
  • 63846f1 Improve DeltaList behavior for large projects (#335)
  • ab3f845 Bump org.apache.maven.plugins:maven-plugins from 44 to 45
  • 164bad4 Allow to not use --module-version for the Java compiler
  • 0b76ccd Bump mavenVersion from 3.9.9 to 3.9.10
  • 5dbc9c3 Bump org.codehaus.plexus:plexus-java from 1.4.0 to 1.5.0
  • 17949d1 Bump org.apache.maven.plugins:maven-plugins from 43 to 44 (#316)
  • d44d1be Add generatedSourcesPath back to the maven project
  • Additional commits viewable in compare view

Updates org.owasp:dependency-check-maven from 12.1.3 to 12.1.6

Release notes

Sourced from org.owasp:dependency-check-maven's releases.

Version 12.1.6

Refer to the CHANGELOG.md for information about improvements and upgrade notes.

Version 12.1.5

Refer to the CHANGELOG.md for information about improvements and upgrade notes.

Changelog

Sourced from org.owasp:dependency-check-maven's changelog.

Version 12.1.6 (2025-09-24)

  • fix: Disable OSS Index if its credentials are missing (#7963)
  • fix: Correct CVSSv4 parsing for low precision OSSIndex values (#7935)
  • fix(fp): Fix false positives for Redis Server against NPM/JS client libs (#7942)
  • docs: Fix legacy GitHub links within docs and CHANGELOG (#7944)
  • chore: fix version typo in security policy (#7936)

See the full listing of changes

Version 12.1.5 (2025-09-20)

  • fix: Update to support OSS Index Authentication Requirements (#7920)
  • fix: add CVSSv4 to suppressed entries in JSON report (#7900)
  • fix: correctly utilize CVSSv4 from ossindex (#7899)
  • fix: npe when processing cve with empty configuration (#7888)
  • fix: Return unsorted vulnerabilities in new HashSet, avoiding CoMod (#7848)
  • fix: Return unsorted vulnerabilities in new HashSet, avoiding CoMod
  • fix: class loading problem with fat jars (#7786) (#7787)
  • fix: Improve Artifactory handler log message (#7838)
  • fix: classloading problem with fat jars (#7786)
  • fix: Add null checking when parsing the license json in AbstractNpmAnalyzer. (#7784)
  • fix(fp): resolves several false positives related to CVE-2021-41033 (#7736)
  • docs: Clarify format of exclude patterns (#7879)
  • docs: Document poetry-based analysis behaviour in Python analyzer (#7855)
  • docs: request FP reporters use the latest version of ODC. (#7820)
  • docs: update development pre-reqs (#7792)
  • docs: fix minor typos in false positive issue template (#7763)

See the full listing of changes

Commits
  • 0a9592c build: prepare release v12.1.6
  • c7e992c docs: release 12.1.6
  • 93b0d1b build(deps): bump netty-codec-http from 5.2.4-final to 5.2.5-final (#7965)
  • 22ecc0b fix: Disable OSS Index if its credentials are missing (#7963)
  • 93422d2 chore: Allow passing ossIndex credentials during false positive ops workflow ...
  • 34a1235 docs: Fix legacy GitHub links within docs and CHANGELOG (#7944)
  • c44ba32 fix(fp): Fix false positives for Redis Server against NPM/JS client libs (#7942)
  • 4af07cc docs: Implement #7808 to make changelog links clickable (#7945)
  • 6008202 test: Fix AssemblyAnalyzerTest to be robust to Grok availability (#7950)
  • b3aa3f2 build: replace deprecated jlink argument (#7953)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot will merge this PR once it's up-to-date and CI passes on it, as requested by @acoburn.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Oct 1, 2025
@dependabot dependabot bot requested a review from a team as a code owner October 1, 2025 04:27
@dependabot dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Oct 1, 2025
Copy link
Collaborator

@acoburn acoburn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dependabot merge

@dependabot dependabot bot force-pushed the dependabot/maven/plugins-f0adacc26c branch 2 times, most recently from 549e193 to 8bce6c1 Compare October 1, 2025 07:11
Bumps the plugins group with 4 updates: [com.puppycrawl.tools:checkstyle](https://github.com/checkstyle/checkstyle), [org.apache.maven.plugins:maven-javadoc-plugin](https://github.com/apache/maven-javadoc-plugin), [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) and [org.owasp:dependency-check-maven](https://github.com/dependency-check/DependencyCheck).


Updates `com.puppycrawl.tools:checkstyle` from 11.0.1 to 11.1.0
- [Release notes](https://github.com/checkstyle/checkstyle/releases)
- [Commits](checkstyle/checkstyle@checkstyle-11.0.1...checkstyle-11.1.0)

Updates `org.apache.maven.plugins:maven-javadoc-plugin` from 3.11.3 to 3.12.0
- [Release notes](https://github.com/apache/maven-javadoc-plugin/releases)
- [Commits](apache/maven-javadoc-plugin@maven-javadoc-plugin-3.11.3...maven-javadoc-plugin-3.12.0)

Updates `org.apache.maven.plugins:maven-compiler-plugin` from 3.14.0 to 3.14.1
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.14.0...maven-compiler-plugin-3.14.1)

Updates `org.owasp:dependency-check-maven` from 12.1.3 to 12.1.6
- [Release notes](https://github.com/dependency-check/DependencyCheck/releases)
- [Changelog](https://github.com/dependency-check/DependencyCheck/blob/main/CHANGELOG.md)
- [Commits](dependency-check/DependencyCheck@v12.1.3...v12.1.6)

---
updated-dependencies:
- dependency-name: com.puppycrawl.tools:checkstyle
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: plugins
- dependency-name: org.apache.maven.plugins:maven-javadoc-plugin
  dependency-version: 3.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: plugins
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-version: 3.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: plugins
- dependency-name: org.owasp:dependency-check-maven
  dependency-version: 12.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: plugins
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/maven/plugins-f0adacc26c branch from 8bce6c1 to 0822777 Compare October 1, 2025 07:19
@dependabot dependabot bot merged commit 2f5a126 into main Oct 1, 2025
7 checks passed
@dependabot dependabot bot deleted the dependabot/maven/plugins-f0adacc26c branch October 1, 2025 07:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants