build(deps): Bump the monthly-batch group with 12 updates

[dependabot]

Bumps the monthly-batch group with 12 updates:

Package	From	To
ch.qos.logback:logback-classic	1.6.1	1.6.3
org.flywaydb:flyway-core	13.1.0	13.3.0
org.flywaydb:flyway-database-postgresql	13.1.0	13.3.0
org.freemarker:freemarker	2.3.34	2.3.35
org.apache.cxf:cxf-rt-frontend-jaxrs	4.2.2	4.2.3
org.apache.cxf:cxf-rt-rs-client	4.2.2	4.2.3
org.apache.johnzon:johnzon-core	2.1.0	2.2.0
org.apache.johnzon:johnzon-jsonb	2.1.0	2.2.0
org.junit:junit-bom	6.1.2	6.1.3
com.palantir.javaformat:palantir-java-format	2.96.0	2.97.0
com.diffplug.spotless:spotless-maven-plugin	3.9.0	3.10.0
io.openliberty.tools:liberty-maven-plugin	3.12.1	3.12.3

Updates ch.qos.logback:logback-classic from 1.6.1 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

• In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

• Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

• The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

• ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

• Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

• The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

-- Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

• Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

• Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

  <property name="logback.skipCallerContradictionAnalysis" value="true"/>

• SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

• Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

• Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

• Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits

• e8e824d prepare release 1.6.3
• 761821b MDCBasedDiscriminator has a gated warning mechanism
• 53ed122 update copyright year
• c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
• b5aa931 added BatchedSimpleInvocationGate
• 1f22af7 add javadocs to SimpleInvocationGate
• 638ffa7 prevent forward and backward slashes to escape to other directories
• 7d6b9a4 add missing ch.qos.logback.core.property package
• fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
• c73b43f deprecate the withJansi path
• Additional commits viewable in compare view

Updates org.flywaydb:flyway-core from 13.1.0 to 13.3.0

Updates org.flywaydb:flyway-database-postgresql from 13.1.0 to 13.3.0

Updates org.flywaydb:flyway-database-postgresql from 13.1.0 to 13.3.0

Updates org.freemarker:freemarker from 2.3.34 to 2.3.35

Updates org.apache.cxf:cxf-rt-frontend-jaxrs from 4.2.2 to 4.2.3

Updates org.apache.cxf:cxf-rt-rs-client from 4.2.2 to 4.2.3

Updates org.apache.cxf:cxf-rt-rs-client from 4.2.2 to 4.2.3

Updates org.apache.johnzon:johnzon-core from 2.1.0 to 2.2.0

Updates org.apache.johnzon:johnzon-jsonb from 2.1.0 to 2.2.0

Updates org.apache.johnzon:johnzon-jsonb from 2.1.0 to 2.2.0

Updates org.junit:junit-bom from 6.1.2 to 6.1.3

Release notes

Sourced from org.junit:junit-bom's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

Commits

• f59f60d Release 6.1.3
• cd8ec92 Finalize 6.1.3 release notes
• c8729f2 Restore compatibility with GraalVM 25 (#5901)
• ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
• fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
• 62afc02 Delay GraalVM plugin updates for 3 days
• 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
• f6bbfc5 Move GraalVM tests to separate test task (#5903)
• e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
• 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
• Additional commits viewable in compare view

Updates com.palantir.javaformat:palantir-java-format from 2.96.0 to 2.97.0

Release notes

Sourced from com.palantir.javaformat:palantir-java-format's releases.

2.97.0

No documented user-facing changes

Full Changelog: 2.96.0...2.97.0

Commits

• 7e76246 Release 2.97.0
• cba4c1b Excavator: Upgrade Jackson to the latest stable release (#1741)
• ef32922 Excavator: Add the gradle-idea-configuration plugin to the build (#1740)
• eeed1ff Excavator: Upgrade Java dependency com.palantir.gradle.utils:* (#1739)
• 31dd220 Excavator: Upgrade Java dependency com.palantir.baseline:gradle-baseline-jav...
• 710939f Excavator: Upgrade Java dependency com.palantir.gradle.jdkslatest:gradle-jdk...
• 72fbae1 [High Priority] Excavator: Update gradle-jdks infrastructure plugins (#1736)
• 0159640 Excavator: Upgrade Java dependency com.palantir.gradle.consistentversions:gr...
• 2a33af9 [High Priority] Excavator: Update gradle-jdks infrastructure plugins (#1734)
• ab226ab Excavator: Apply and update the com.palantir.idea-language-injector plugin...
• Additional commits viewable in compare view

Updates com.diffplug.spotless:spotless-maven-plugin from 3.9.0 to 3.10.0

Release notes

Sourced from com.diffplug.spotless:spotless-maven-plugin's releases.

Maven Plugin v3.10.0

Added

• New <shortenFullyQualifiedTypes> step for Java, which replaces fully-qualified type names with their simple names and adds the imports they need. Best combined with <importOrder> and <removeUnusedImports>. (#2945)
• Add embedded lockfiles to Eclipse JDT for every supported version (4.9 through 4.40), so eclipse() resolves from Maven Central instead of querying a P2 update site. Versions without an embedded lockfile still fall back to P2 provisioning. (#1996)
• Add support to apply alternate license header within same format (#872)
• Add support to skip license header application based on source file content pattern (#650).

Fixed

• removeUnusedImports no longer fails on Java import module declarations. (#2890)
• Concurrent P2 provisioning no longer races Solstice's on-disk cache (affects Eclipse-based formatters under parallel builds). (#3004)

Changes

• Default google-java-format remains 1.28.0 on JVM 17; bumps to 1.30.0 on JVM 21+; require at least 1.30.0 on JVM 25+ for import module support.
• Bump default eclipse version to latest 4.39 -> 4.40. (#1996)
• Document Maven skip properties spotless.skip, spotless.check.skip, and spotless.apply.skip. Goal-specific skips now live on their own mojos so they no longer leak across goals. (#3009)
• Bump default adocfmt version 0.2.0 -> 0.3.1, which adds table formatting support (<formatTables>, <tableLayout>, <tableMaxLineWidth>, <tableBlankLines>).

Commits

• 426b21d Published maven/3.10.0
• 2fd42ea Published gradle/8.10.0
• d71ed1a Published lib/4.10.0
• 8b57c01 Add shortenFullyQualifiedTypes step (fixes #2945) (#3005 closes #2945)
• 6b42c5e fix: make the FQN-collecting visitor a named static class
• 4430823 Better organization on the changelogs.
• 45bea6d Better place to put the shortenFullyQualifiedTypes docs
• 0c49e65 chore: spotlessApply
• 1c5bc0a docs: list the Java import steps in the plugin README tables of contents
• cd57b58 docs: document shortenFullyQualifiedTypes in the plugin READMEs
• Additional commits viewable in compare view

Updates io.openliberty.tools:liberty-maven-plugin from 3.12.1 to 3.12.3

Release notes

Sourced from io.openliberty.tools:liberty-maven-plugin's releases.

Liberty Maven Plug-in 3.12.3

Version 3.12.3 of the Liberty Maven Plugin is a minor release with a bug fix

What's Changed

• Add clickable server URL to dev mode port info output
• Fixed misleading expansion variable log message in ci.commonin OpenLiberty/ci.maven#2087

See the commit log for the full set of the changes since the previous release.

The Liberty Maven Plugin 3.12.3 release is available on the Maven Central repository.

Liberty Maven Plug-in 3.12.2

Version 3.12.2 of the Liberty Maven Plugin is a minor release with a bug fix

What's Changed

• When <mergeServerEnv>true</mergeServerEnv> was enabled, all backslashes () in server.env values were silently converted to forward slashes, breaking Windows paths like LIBERTY_INSTALL_DIR and JAVA_HOME. Values are now written verbatim by default.
• A new convertServerEnvPathSeparator parameter (default false) restores the old conversion for users who relied on it. Only applies when mergeServerEnv is true.

See the commit log for the full set of the changes since the previous release.

The Liberty Maven Plugin 3.12.2 release is available on the Maven Central repository.

Commits

• 4d42a49 [maven-release-plugin] prepare release liberty-maven-3.12.3
• 6ce2c76 Merge pull request #2087 from sajeerzeji/fix/GHMVN2076-Message_update
• 679cedc ci.common version updated
• 7fe286d Workflow reverted
• 424b1d9 Added one full line log to show which one got replaced with what
• 3151602 Updated the log assertion as per the ci.common changes https://github.com/Ope...
• 9325164 RUNTIME_VERSION upgraded to 26.0.0.6
• cda4e43 Merge branch '3.x' of https://github.com/OpenLiberty/ci.maven into fix/GHMVN2...
• 51c8292 Integration tests updated, ci.common version changed and github workflow poin...
• e3e2302 Merge pull request #2085 from venmanyarun/3.x
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.30%. Comparing base (44b9081) to head (451c262).

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #202   +/-   ##
=========================================
  Coverage     77.30%   77.30%           
  Complexity      187      187           
=========================================
  Files            40       40           
  Lines           608      608           
  Branches         53       53           
=========================================
  Hits            470      470           
  Misses          108      108           
  Partials         30       30           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.