FINERACT-2684: Update all non-major dependencies

[renovate-bot]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
apache/kafka		minor	4.2.0-rc2 → 4.3.1-rc2
gradle/actions	action	minor	v6.2.0 → v6.3.0
localstack/localstack		minor	2.1 → 2.3
mariadb (source)		minor	12.2 → 12.3
postgres (source)	service	minor	18.3 → 18.6
zizmorcore/zizmor-action	action	patch	v0.6.1 → v0.6.2
org.apache.tomcat.embed:tomcat-embed-websocket	devDependencies	patch	10.1.55 → 10.1.59
org.apache.tomcat.embed:tomcat-embed-el	devDependencies	patch	10.1.55 → 10.1.59
org.apache.tomcat.embed:tomcat-embed-core	devDependencies	patch	10.1.55 → 10.1.59
at.yawk.lz4:lz4-java	devDependencies	patch	1.11.0 → 1.11.2
io.netty:netty-transport-native-unix-common (source)	devDependencies	minor	4.1.135.Final → 4.2.17.Final
io.netty:netty-transport-classes-epoll (source)	devDependencies	minor	4.1.135.Final → 4.2.17.Final
io.netty:netty-transport (source)	devDependencies	minor	4.1.135.Final → 4.2.17.Final
io.netty:netty-resolver (source)	devDependencies	minor	4.1.135.Final → 4.2.17.Final
io.netty:netty-handler-proxy (source)	devDependencies	minor	4.1.135.Final → 4.2.17.Final
io.netty:netty-handler (source)	devDependencies	minor	4.1.135.Final → 4.2.17.Final
io.netty:netty-codec-socks (source)	devDependencies	minor	4.1.135.Final → 4.2.17.Final
io.netty:netty-codec-protobuf (source)	devDependencies	minor	4.1.135.Final → 4.2.17.Final
io.netty:netty-codec-marshalling (source)	devDependencies	minor	4.1.135.Final → 4.2.17.Final
io.netty:netty-codec-http2 (source)	devDependencies	minor	4.1.135.Final → 4.2.17.Final
io.netty:netty-codec-http (source)	devDependencies	minor	4.1.135.Final → 4.2.17.Final
io.netty:netty-codec-compression (source)	devDependencies	minor	4.1.135.Final → 4.2.17.Final
io.netty:netty-codec-base (source)	devDependencies	minor	4.1.135.Final → 4.2.17.Final
io.netty:netty-codec (source)	devDependencies	minor	4.1.135.Final → 4.2.17.Final
io.netty:netty-common (source)	devDependencies	minor	4.1.135.Final → 4.2.17.Final
io.netty:netty-buffer (source)	devDependencies	minor	4.1.135.Final → 4.2.17.Final
org.springframework.security:spring-security-core (source)	devDependencies	patch	6.5.10 → 6.5.11
org.springframework:spring-core	devDependencies	patch	6.2.18 → 6.2.19
com.nimbusds:nimbus-jose-jwt	devDependencies	patch	10.9 → 10.9.1
org.springframework.restdocs:spring-restdocs-restassured	devDependencies	patch	3.0.5 → 3.0.6
org.springframework.restdocs:spring-restdocs-webtestclient	devDependencies	patch	3.0.5 → 3.0.6
org.springframework.restdocs:spring-restdocs-mockmvc	devDependencies	patch	3.0.5 → 3.0.6
org.springframework.restdocs:spring-restdocs-asciidoctor	devDependencies	patch	3.0.5 → 3.0.6
io.cucumber:cucumber-spring (source)	devDependencies	patch	7.34.3 → 7.34.7
io.cucumber:cucumber-junit-platform-engine (source)	devDependencies	patch	7.34.3 → 7.34.7
io.cucumber:cucumber-java8 (source)	devDependencies	patch	7.34.3 → 7.34.7
io.cucumber:cucumber-java (source)	devDependencies	patch	7.34.3 → 7.34.7
org.apache.sshd:sshd-core (source)	devDependencies	minor	2.17.1 → 2.19.0
org.apache.sshd:sshd-common (source)	devDependencies	minor	2.17.1 → 2.19.0
org.postgresql:postgresql (source)	devDependencies	patch	42.7.11 → 42.7.13
org.mariadb.jdbc:mariadb-java-client (source)	devDependencies	patch	3.5.8 → 3.5.10
org.apache.avro:avro (source)	devDependencies	patch	1.12.1 → 1.12.2
org.apache.groovy:groovy-json (source)	devDependencies	minor	5.0.6 → 5.1.0
org.apache.groovy:groovy-xml (source)	devDependencies	minor	5.0.6 → 5.1.0
org.hibernate.validator:hibernate-validator (source)	devDependencies	patch	9.1.0.Final → 9.1.3.Final
io.swagger.core.v3:swagger-core-jakarta	devDependencies	patch	2.2.49 → 2.2.54
io.swagger.core.v3:swagger-jaxrs2-jakarta	devDependencies	patch	2.2.49 → 2.2.54
io.swagger.core.v3:swagger-annotations-jakarta	devDependencies	patch	2.2.49 → 2.2.54
org.apache.activemq:activemq-client (source)	devDependencies	minor	6.2.5 → 6.3.1
org.springdoc:springdoc-openapi-starter-webmvc-ui (source)	devDependencies	minor	2.8.17 → 2.9.0
org.eclipse.jgit:org.eclipse.jgit.ssh.apache	devDependencies	minor	7.6.0.202603022253-r → 7.7.1.202607240634-r
org.eclipse.jgit:org.eclipse.jgit.gpg.bc	devDependencies	minor	7.6.0.202603022253-r → 7.7.1.202607240634-r
org.eclipse.jgit:org.eclipse.jgit	devDependencies	minor	7.6.0.202603022253-r → 7.7.1.202607240634-r
org.bouncycastle:bcpg-jdk18on (source)	devDependencies	minor	1.84 → 1.85
org.bouncycastle:bcutil-jdk18on (source)	devDependencies	minor	1.84 → 1.85
org.bouncycastle:bcprov-jdk18on (source)	devDependencies	minor	1.84 → 1.85.2
org.bouncycastle:bcpkix-jdk18on (source)	devDependencies	minor	1.84 → 1.85
commons-codec:commons-codec (source)	devDependencies	patch	1.22.0 → 1.22.1
org.mock-server:mockserver-junit-jupiter (source)	devDependencies	minor	5.14.0 → 5.15.0
com.github.spotbugs:spotbugs-annotations (source)	devDependencies	minor	4.9.8 → 4.10.4
io.github.classgraph:classgraph	devDependencies	patch	4.8.184 → 4.8.193
joda-time:joda-time (source)	devDependencies	patch	2.14.2 → 2.14.3
org.apache.httpcomponents.core5:httpcore5-h2 (source)	devDependencies	patch	5.4 → 5.4.3
org.apache.httpcomponents.core5:httpcore5 (source)	devDependencies	patch	5.4 → 5.4.3
org.apache.tika:tika-parser-image-module (source)	devDependencies	patch	3.3.0 → 3.3.2
org.cyclonedx.bom	plugin	minor	3.2.4 → 3.4.1
com.gradleup.shadow	plugin	minor	9.4.1 → 9.6.1
org.openapi.generator	plugin	minor	7.22.0 → 7.24.0
com.github.spotbugs	plugin	patch	6.5.4 → 6.5.11
com.github.andygoossens.modernizer	plugin	minor	1.13.0 → 1.15.0
com.google.cloud.tools.jib	plugin	patch	3.5.3 → 3.5.4
org.apache.tika:tika-parser-microsoft-module (source)	devDependencies	patch	3.3.0 → 3.3.2
io.swagger.core.v3.swagger-gradle-plugin	plugin	patch	2.2.49 → 2.2.54
org.springframework.boot (source)	plugin	patch	3.5.15 → 3.5.16
org.apache.tika:tika-parser-miscoffice-module (source)	devDependencies	patch	3.3.0 → 3.3.2
org.apache.tika:tika-core (source)	devDependencies	patch	3.3.0 → 3.3.2
com.github.librepdf:openpdf	devDependencies	patch	3.0.4 → 3.0.5
software.amazon.msk:aws-msk-iam-auth (source)	devDependencies	patch	2.3.6 → 2.3.7
org.apache.commons:commons-collections4 (source)	devDependencies	minor	4.5.0 → 4.6.0
com.google.googlejavaformat:google-java-format	devDependencies	minor	1.35.0 → 1.36.1
com.google.guava:guava	devDependencies	minor	33.6.0-jre → 33.7.1-jre
ch.qos.logback:logback-classic (source, changelog)	devDependencies	minor	1.5.35 → 1.6.3
ch.qos.logback:logback-core (source, changelog)	devDependencies	minor	1.5.35 → 1.6.3
org.glassfish.jersey:jersey-bom (source)	devDependencies	patch	3.1.11 → 3.1.12
software.amazon.awssdk:bom	devDependencies	minor	2.44.4 → 2.54.2
io.cucumber:cucumber-bom (source)	devDependencies	patch	7.34.3 → 7.34.7
com.fasterxml.jackson:jackson-bom	devDependencies	patch	2.22.1 → 2.22.2
org.jetbrains.kotlin:kotlin-bom (source)	devDependencies	minor	2.3.21 → 2.4.10
io.opentelemetry:opentelemetry-bom	devDependencies	minor	1.62.0 → 1.65.0
io.awspring.cloud:spring-cloud-aws-dependencies (source)	devDependencies	minor	4.0.2 → 4.1.0
org.springframework.boot:spring-boot-dependencies (source)	devDependencies	patch	3.5.15 → 3.5.16
io.micrometer:micrometer-bom	devDependencies	minor	1.16.5 → 1.17.1
org.slf4j:slf4j-bom (source, changelog)	devDependencies	patch	2.0.17 → 2.0.18
com.gradle.common-custom-user-data-gradle-plugin	plugin	minor	2.6.0 → 2.8.0

---

Release Notes

apache/kafka (apache/kafka)

v4.3.1

Compare Source

v4.3.0

Compare Source

v4.2.1

Compare Source

gradle/actions (gradle/actions)

v6.3.0

Compare Source

Highlights

Enhanced Caching: Windows fixes and a cache-protocol bump

This release updates gradle-actions-caching to v1.0.0 (up from v0.7.0), which fixes two significant caching defects, both most visible on Windows:

• Cache entries failed to store at all on Windows.. Every entry failed
  with Path Validation Error: Path(s) specified in the action for caching do(es) not exist, even though the Gradle User Home was fully intact. Nothing was stored, so
  every downstream job ran against an empty Gradle User Home. The cause was a nested,
  unpatched copy of @actions/glob combined with a silently swallowed require() in
  the bundle, which left Windows path separators unnormalized.

• Cache cleanup deleted instrumented jars that were in use. A bug in key
  hashing for paths shorter than 64 characters made cleanup judge freshly created
  caches/jars-9 entries as unused and remove them, so the instrumented-jars entry
  was never saved and every job re-instrumented its classpaths.

  Also included: cache entry names are now consistent between the save and restore
  reports — restore previously fell back to showing the raw glob pattern (e.g.
  /home/runner/.gradle/caches/modules-*/files-*/*/*/*/*/) instead of dependencies.

[!IMPORTANT]
Existing cache entries are invalidated by this release. The cache protocol
version was bumped to v2, so the first run after upgrading will be a cache miss
and will repopulate the cache. No configuration changes are required.

Basic caching warns instead of failing silently

The basic (open-source) caching provider now emits a warning and reports
(Entry not saved: save failed) in the Job Summary when a cache save fails, rather
than reporting success (#​1028).

Dependency submission works with Isolated Projects

dependency-submission now disables Isolated Projects via a promoted property, so
dependency graph generation works on builds that enable it (#​1025). Thanks to @​reinsch82 for the contribution.

Updated defaults

• Injected Develocity Gradle plugin: 4.4.2 → 4.5.0
• 36 new known-good wrapper checksums added for wrapper-validation

What's Changed

• Render configuration-cache status in the caching Job Summary by @​bigdaz in #​989
• Update gradle-actions-caching library to v0.8.0 by @​bot-githubaction in #​993
• Support experimental project-entry caching (configuration-cache + build-logic) by @​bigdaz in #​994
• Update gradle-actions-caching library to v0.9.0 by @​bot-githubaction in #​996
• Disable Isolated Projects via promoted property in dependency-submission by @​reinsch82 in #​1025
• Add Windows coverage for caching via a new smoke-test suite by @​bigdaz in #​1027
• Fix basic caching smoke test on Windows, and warn on save failure by @​bigdaz in #​1028
• Move non-smoke restore-gradle-home tests back to the integ-test suite by @​bigdaz in #​1032
• Bump npm-dependencies group with TypeScript 6.0.3, @​types/node 24.x, and security fixes by @​bigdaz in #​1033
• Bump Gradle Wrapper to 9.6.1, wrapper checksums, and Develocity plugin to 4.5.0 by @​bigdaz in #​1034
• Update gradle-actions-caching library to v1.0.0 by @​bot-githubaction in #​1029
• Bump the npm-dependencies group across 1 directory with 2 updates by @​dependabot[bot] in #​1037
• Bump the github-actions group across 2 directories with 9 updates by @​dependabot[bot] in #​1024

New Contributors

• @​reinsch82 made their first contribution in #​1025

Full Changelog: gradle/actions@v6.2.0...v6.3.0

zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.6.2

Compare Source

zizmor 1.29.0 is now the default version.

yawkat/lz4-java (at.yawk.lz4:lz4-java)

v1.11.2: lz4-java v1.11.2

Security release for GHSA-6cx8-rjf8-pr8g and GHSA-4v53-57pg-c464.

What's Changed

• Update bnd.maven.plugin.version to v7.3.0 by @​renovate[bot] in #​59
• Update dependency me.qoomon:maven-git-versioning-extension to v9.12.1 by @​renovate[bot] in #​62
• Update dependency com.carrotsearch.randomizedtesting:randomizedtesting-runner to v2.9.1 by @​renovate[bot] in #​60
• Update dependency maven to v3.9.16 by @​renovate[bot] in #​57
• Update dependency com.code-intelligence:jazzer-junit to v0.30.0 by @​renovate[bot] in #​61
• Pin dependencies by @​renovate[bot] in #​56
• Update dependency org.codehaus.mojo:build-helper-maven-plugin to v3.6.1 by @​renovate[bot] in #​64
• Update dependency maven-wrapper to v3.3.4 by @​renovate[bot] in #​63
• Update dependency org.apache.maven.plugins:maven-source-plugin to v3.4.0 by @​renovate[bot] in #​69
• Update actions/checkout action to v7 by @​renovate[bot] in #​74
• Update junit-framework monorepo by @​renovate[bot] in #​72
• Update dependency org.apache.maven.plugins:maven-antrun-plugin to v3.2.0 by @​renovate[bot] in #​65
• Update dependency org.sonatype.central:central-publishing-maven-plugin to v0.11.0 by @​renovate[bot] in #​71
• Update dependency org.apache.maven.plugins:maven-compiler-plugin to v3.15.0 by @​renovate[bot] in #​66
• Update dependency org.apache.maven.plugins:maven-jar-plugin to v3.5.1 by @​renovate[bot] in #​67
• Update dependency org.apache.maven.plugins:maven-surefire-plugin to v3.5.6 by @​renovate[bot] in #​70
• Update dependency org.apache.maven.plugins:maven-gpg-plugin to v3 by @​renovate[bot] in #​77
• Update GitHub Artifact Actions (major) by @​renovate[bot] in #​78
• Update junit-framework monorepo to v6 by @​renovate[bot] in #​79
• Update cloudflare/wrangler-action action to v4 by @​renovate[bot] in #​76
• Update astral-sh/setup-uv action to v9 by @​renovate[bot] in #​75
• Update 8BitJonny/gh-get-current-pr action to v4 by @​renovate[bot] in #​73

New Contributors

• @​renovate[bot] made their first contribution in #​59

Full Changelog: yawkat/lz4-java@v1.11.1...v1.11.2

v1.11.1: lz4-java v1.11.1

Security release for CVE-2026-59949.

What's Changed

• Fix docs code block line breaks by @​yawkat in #​52

Full Changelog: yawkat/lz4-java@v1.11.0...v1.11.1

spring-projects/spring-security (org.springframework.security:spring-security-core)

v6.5.11

Compare Source

🪲 Bug Fixes

• FormPostRedirectStrategy should not emit percent-encoded values into hidden form inputs #​19136

🔨 Dependency Upgrades

• Bump antora from 3.2.0-alpha.11 to 3.2.0-alpha.12 in /docs #​19185
• Bump ch.qos.logback:logback-classic from 1.5.32 to 1.5.34 #​19299
• Bump com.fasterxml.jackson:jackson-bom from 2.18.6 to 2.18.7 #​19129
• Bump com.fasterxml.jackson:jackson-bom from 2.18.7 to 2.18.8 #​19297
• Bump gradle-wrapper from 8.14.4 to 8.14.5 #​19159
• Bump org-bouncycastle from 1.80 to 1.80.2 #​19204
• Bump org.apache.maven:maven-resolver-provider from 3.9.15 to 3.9.16 #​19205
• Bump org.hibernate.orm:hibernate-core from 6.6.49.Final to 6.6.50.Final #​19150
• Bump org.hibernate.orm:hibernate-core from 6.6.50.Final to 6.6.51.Final #​19213
• Bump org.hibernate.orm:hibernate-core from 6.6.51.Final to 6.6.53.Final #​19300
• Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18 #​19173
• Bump org.springframework:spring-framework-bom from 6.2.18 to 6.2.19 #​19293
• Bump spring-io/spring-gradle-build-action from 2.0.5 to 2.0.6 #​19124
• Bump spring-io/spring-release-actions from 0.0.4 to 0.0.5 #​19183
• Update micrometer-bom to 1.15.12 #​19302
• Update to Micrometer 1.15.11 #​19224
• Update to reactor-bom 2024.0.18 #​19301

🔩 Build Updates

• Release 6.5.11 #​19118

spring-projects/spring-framework (org.springframework:spring-core)

v6.2.19

⚠️ Security Fixes

This maintenance release fixes a high number of CVEs. You can learn more about this in the "Spring and Security In The Times Of AI" blog post. Here is the full list of 16 CVEs:

• CVE-2026-41838 "Spring Framework Predictable Session ID in WebSocket Module"
• CVE-2026-41839 "Spring Framework Escalation via Session Fixation in WebFlux"
• CVE-2026-41840 "Spring Framework Denial of Service via Multipart Requests in WebFlux"
• CVE-2026-41841 "Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux"
• CVE-2026-41842 "Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux"
• CVE-2026-41843 "Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux"
• CVE-2026-41844 "Spring Framework Open Redirect in Spring MVC and WebFlux"
• CVE-2026-41845 "Spring Framework Cross-site Scripting via JavaScriptUtils"
• CVE-2026-41846 "Spring Framework Cross-site Scripting via JSP Form Tags"
• CVE-2026-41848 "Spring Framework Denial of Service via AntPathMatcher"
• CVE-2026-41850 "Spring Framework Algorithmic Denial of Service via SpEL Expressions"
• CVE-2026-41851 "Spring Framework Denial of Service via Unbounded Cache in SpEL"
• CVE-2026-41852 "Spring Framework Arbitrary Method Invocation in SpEL Expressions"
• CVE-2026-41853 "Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux"
• CVE-2026-41854 "Spring Framework Server-Side Request Forgery via UriComponentsBuilder"
• CVE-2026-41855 "Spring Framework Unsafe Deserialization via Jackson JMS Converters"

⭐ New Features

• Avoid too many character access attempts in AntPathMatcher #​36886
• Track operations during SpEL expression evaluation #​36887
• Ensure getters have non-void r

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.