fix(deps): bump the prod-deps group across 1 directory with 4 updates

[dependabot]

Bumps the prod-deps group with 3 updates in the / directory: org.springframework.boot:spring-boot-starter-parent, org.jsoup:jsoup and com.puppycrawl.tools:checkstyle.

Updates org.springframework.boot:spring-boot-starter-parent from 4.0.2 to 4.0.3

Release notes

Sourced from org.springframework.boot:spring-boot-starter-parent's releases.

v4.0.3

⭐ New Features

• Add TWENTY_SIX to JavaVersion enum #49193

🐞 Bug Fixes

• Jackson properties may not be applied correctly to RestClients #49223
• ClassNotFoundException when using Actuator without spring-boot-health #49196
• Using the OTel and Zipkin starters together creates invalid configuration #49183
• Whitespace can be incorrectly removed when spring-boot-configuration-processor runs on multi-line javadoc #49060
• Jackson2HttpMessageConvertersConfiguration uses ConditionOn Jackson3 XMLMapper class #49015
• server.jetty.threads.max is ignored when using virtual threads #48989
• Slice test includes fail to load when using spring-boot-starter-test-classic #48981
• Docker credential helpers with file extensions cannot be executed on Windows #48979
• Java version requirement check for native image is confusing if AOT didn't run #48963
• TestPropertyValues.Pair.fromMapEntry(Entry<String, String>) does not comply with its nullability contract #48948

📔 Documentation

• Couchbase and Kafka are incorrectly listed as supporting SSL with Docker Compose #49212
• Document that use of non idiomatic format for '@Value' still apply for environment variables #49109
• Document naming convention for custom test-scoped starters #49017
• Delay removal of Jackson 2 support until 4.3 at the earliest #49010
• LICENSE.txt and NOTICE.txt files have the wrong content in the latest releases #49003
• ApplicationContextAssert documents a non-existent assertion in getFailure() #48977
• Highlight the importance of the preStop hook when configuring Kubernetes probes #48946

🔨 Dependency Upgrades

• Upgrade to AssertJ 3.27.7 #49095
• Upgrade to Elasticsearch Client 9.2.5 #49184
• Upgrade to Groovy 5.0.4 #49097
• Upgrade to Hibernate 7.2.3.Final #49098
• Upgrade to Hibernate 7.2.4.Final #49167
• Upgrade to Jaybird 6.0.4 #49099
• Upgrade to JBoss Logging 3.6.2.Final #49100
• Upgrade to Jersey 4.0.2 #49101
• Upgrade to Jetty 12.1.6 #49102
• Upgrade to jOOQ 3.19.30 #49103
• Upgrade to JUnit Jupiter 6.0.3 #49233
• Upgrade to Logback 1.5.29 #49169
• Upgrade to Logback 1.5.32 #49245
• Upgrade to Micrometer 1.16.3 #49111
• Upgrade to Micrometer Tracing 1.6.3 #49112
• Upgrade to MongoDB 5.6.3 #49105
• Upgrade to MySQL 9.6.0 #49106
• Upgrade to Netty 4.2.10.Final #49107
• Upgrade to Postgresql 42.7.10 #49202
• Upgrade to Reactor Bom 2025.0.3 #49087

... (truncated)

Commits

• 1ab1436 Release v4.0.3
• 5cc488d Merge branch '3.5.x' into 4.0.x
• 9138ae2 Next development version (v3.5.12-SNAPSHOT)
• a7e63a7 Merge branch '3.5.x' into 4.0.x
• 54ab3c5 Align "noteworthy" issues in release notes with Spring Framework
• b3ae5b1 Merge branch '3.5.x' into 4.0.x
• 996664f Temporarily switch Docker to overlay2
• 1ce8743 Revert "Temporarily disable containerd snapshotter"
• 5ba88c6 Temporarily disable containerd snapshotter
• 1f1a88c Revert "Temporarily update system tests to use specific platform"
• Additional commits viewable in compare view

Updates org.hibernate.orm:hibernate-jpamodelgen from 7.2.1.Final to 7.2.4.Final

Release notes

Sourced from org.hibernate.orm:hibernate-jpamodelgen's releases.

Release 7.2.4

Hibernate ORM 7.2.4.Final released

Today, we published a new release of Hibernate ORM 7.2: 7.2.4.Final.

You can find the full list of 7.2.4.Final changes here.

What's new

• See the website for requirements and compatibilities.
• See the What's New guide for details about new features and capabilities.
• See the Migration Guide for details about migration.

Conclusion

For additional details, see:

• the release page
• the Migration Guide
• the Introduction Guide
• the User Guide
• the API docs

See also the following resources related to supported APIs:

• the compatibility policy
• the incubating API report (@Incubating)
• the deprecated API report (@Deprecated + @Remove)
• the internal API report (internal packages, @Internal)

Visit the website for details on getting in touch with us.

Release 7.2.3

Hibernate ORM 7.2.3.Final released

Today, we published a new release of Hibernate ORM 7.2: 7.2.3.Final.

You can find the full list of 7.2.3.Final changes here.

What's new

• See the website for requirements and compatibilities.
• See the What's New guide for details about new features and capabilities.
• See the Migration Guide for details about migration.

Conclusion

... (truncated)

Changelog

Sourced from org.hibernate.orm:hibernate-jpamodelgen's changelog.

Changes in 7.2.4.Final (February 08, 2026)

https://hibernate.atlassian.net/projects/HHH/versions/37571

** Bug * HHH-20119 Values return by Enum Converter are not escaped in CREATE TABLE query * HHH-20065 Subsequent StatelessSession#insertMultiple calls lead to pending batches

** Improvement * HHH-20115 Pass a ROOT locale to loggers to avoid unnecessary class lookups

Changes in 7.2.3.Final (February 01, 2026)

https://hibernate.atlassian.net/projects/HHH/versions/37504

** Bug * HHH-20121 NPE when logging loaded values in follow-on locking post action * HHH-20118 Vector operator SQL templates miss parenthesis around * HHH-20113 Round function broken in PostgreSQL for parameter expressions

Changes in 7.2.2.Final (January 27, 2026)

https://hibernate.atlassian.net/projects/HHH/versions/37206

** Bug * HHH-20095 New SchemaValidator nullability check should only consider explicitly declared nullability * HHH-20094 New SchemaValidator nullability check rejects Envers revtype column * HHH-20087 NPE with StatelessSession + Bean Validation * HHH-20069 DB2iDialect.rowId causes an error in merge queries * HHH-19999 Caching APIs use Comparator<?> for version comparison in Hibernate ORM 7.2.0.Final * HHH-19192 Bulk delete of owner with soft-delete element-collection physically deletes the collection rows * HHH-18835 AssertionError when executing insert-select

Commits

• 77d9f66 [Jenkins release job] Preparing release 7.2.4.Final
• aa41b23 [Jenkins release job] changelog.txt updated by release build 7.2.4.Final
• 0158a4e HHH-20065 Clear batch after stateless *Multiple operations
• 6db229a HHH-20065 Add test for issue
• 1b442e6 HHH-20109: Escape simple quotes in values returned by enum convertors
• 98e10a6 HHH-20115 Pass a ROOT locale to loggers to avoid unnecessary class lookups
• 4c96d17 Include downloaded JARs in GitHub cache for the Gradle Cache
• 5013021 [Jenkins release job] Preparing next development iteration
• 4021ef4 [Jenkins release job] Preparing release 7.2.3.Final
• 46fd0cc [Jenkins release job] changelog.txt updated by release build 7.2.3.Final
• Additional commits viewable in compare view

Updates org.jsoup:jsoup from 1.21.2 to 1.22.1

Release notes

Sourced from org.jsoup:jsoup's releases.

jsoup Java HTML Parser release 1.22.1

jsoup 1.22.1 is out now, adding support for the re2j regular expression engine for regex-based CSS selectors, a configurable maximum parser depth, and numerous bug fixes and improvements.

jsoup is a Java library for working with real-world HTML and XML. It provides a very convenient API for extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors.

Download jsoup now.

Improvements

• Added support for using the re2j regular expression engine for regex-based CSS selectors (e.g. [attr~=regex], :matches(regex)), which ensures linear-time performance for regex evaluation. This allows safer handling of arbitrary user-supplied query regexes. To enable, add the com.google.re2j dependency to your classpath, e.g.:

  <dependency>
    <groupId>com.google.re2j</groupId>
    <artifactId>re2j</artifactId>
    <version>1.8</version>
  </dependency>

(If you already have that dependency in your classpath, but you want to keep using the Java regex engine, you can disable re2j via System.setProperty("jsoup.useRe2j", "false").) You can confirm that the re2j engine has been enabled correctly by calling Regex.usingRe2j(). #2407

• Added an instance method Parser#unescape(String, boolean) that unescapes HTML entities using the parser's configuration (e.g. to support error tracking), complementing the existing static utility Parser.unescapeEntities(String, boolean). #2396
• Added a configurable maximum parser depth (to limit the number of open elements on stack) to both HTML and XML parsers. The HTML parser now defaults to a depth of 512 to match browser behavior, and protect against unbounded stack growth, while the XML parser keeps unlimited depth by default, but can opt into a limit via Parser.setMaxDepth(). #2421
• Build: added CI coverage for JDK 25 #2403
• Build: added a CI fuzzer for contextual fragment parsing (in addition to existing full body HTML and XML fuzzers). [oss-fuzz #14041](google/oss-fuzz#14041)

Changes

• Set a removal schedule of jsoup 1.24.1 for previously deprecated APIs.

Bug Fixes

• Previously cached child Elements of an Element were not correctly invalidated in Node#replaceWith(Node), which could lead to incorrect results when subsequently calling Element#children(). #2391
• Attribute selector values are now compared literally without trimming. Previously, jsoup trimmed whitespace from selector values and from element attribute values, which could cause mismatches with browser behavior (e.g. [attr=" foo "]). Now matches align with the CSS specification and browser engines. #2380
• When using the JDK HttpClient, any system default proxy (ProxySelector.getDefault()) was ignored. Now, the system proxy is used if a per-request proxy is not set. #2388, #2390
• A ValidationException could be thrown in the adoption agency algorithm with particularly broken input. Now logged as a parse error. #2393
• Null characters in the HTML body were not consistently removed; and in foreign content were not correctly replaced. #2395
• An IndexOutOfBoundsException could be thrown when parsing a body fragment with crafted input. Now logged as a parse error. #2397, #2406
• When using StructuralEvaluators (e.g., a parent child selector) across many retained threads, their memoized results could also be retained, increasing memory use. These results are now cleared immediately after use, reducing overall memory consumption. #2411
• Cloning a Parser now preserves any custom TagSet applied to the parser. #2422, #2423
• Custom tags marked as Tag.Void now parse and serialize like the built-in void elements: they no longer consume following content, and the XML serializer emits the expected self-closing form. #2425
• The <br> element is once again classified as an inline tag (Tag.isBlock() == false), matching common developer expectations and its role as phrasing content in HTML, while pretty-printing and text extraction continue to treat it as a line break in the rendered output. #2387, #2439
• Fixed an intermittent truncation issue when fetching and parsing remote documents via Jsoup.connect(url).get(). On responses without a charset header, the initial charset sniff could sometimes (depending on buffering / available() behavior) be mistaken for end-of-stream and a partial parse reused, dropping trailing content. #2448
• TagSet copies no longer mutate their template during lazy lookups, preventing cross-thread ConcurrentModificationException when parsing with shared sessions. #2453
• Fixed parsing of <svg> foreignObject content nested within a <p>, which could incorrectly move the HTML subtree outside the SVG. #2452

Internal Changes

• Deprecated internal helper org.jsoup.internal.Functions (for removal in v1.23.1). This was previously used to support older Android API levels without full java.util.function coverage; jsoup now requires core library desugaring so this indirection is no longer necessary. #2412

---

My sincere thanks to everyone who contributed to this release! If you have any suggestions for the next release, I would love to hear them; please get in touch via jsoup discussions, or with me directly.

You can also follow me (@jhy@tilde.zone) on Mastodon / Fediverse to receive occasional notes about jsoup releases.

Changelog

Sourced from org.jsoup:jsoup's changelog.

1.22.1 (2026-Jan-01)

Improvements

• Added support for using the re2j regular expression engine for regex-based CSS selectors (e.g. [attr~=regex], :matches(regex)), which ensures linear-time performance for regex evaluation. This allows safer handling of arbitrary user-supplied query regexes. To enable, add the com.google.re2j dependency to your classpath, e.g.:

  <dependency>
    <groupId>com.google.re2j</groupId>
    <artifactId>re2j</artifactId>
    <version>1.8</version>
  </dependency>

(If you already have that dependency in your classpath, but you want to keep using the Java regex engine, you can disable re2j via System.setProperty("jsoup.useRe2j", "false").) You can confirm that the re2j engine has been enabled correctly by calling org.jsoup.helper.Regex.usingRe2j(). #2407

• Added an instance method Parser#unescape(String, boolean) that unescapes HTML entities using the parser's configuration (e.g. to support error tracking), complementing the existing static utility Parser.unescapeEntities(String, boolean). #2396
• Added a configurable maximum parser depth (to limit the number of open elements on stack) to both HTML and XML parsers. The HTML parser now defaults to a depth of 512 to match browser behavior, and protect against unbounded stack growth, while the XML parser keeps unlimited depth by default, but can opt into a limit via org.jsoup.parser.Parser#setMaxDepth. #2421
• Build: added CI coverage for JDK 25 #2403
• Build: added a CI fuzzer for contextual fragment parsing (in addition to existing full body HTML and XML fuzzers). [oss-fuzz #14041](google/oss-fuzz#14041)

Changes

• Set a removal schedule of jsoup 1.24.1 for previously deprecated APIs.

Bug Fixes

• Previously cached child Elements of an Element were not correctly invalidated in Node#replaceWith(Node), which could lead to incorrect results when subsequently calling Element#children(). #2391
• Attribute selector values are now compared literally without trimming. Previously, jsoup trimmed whitespace from selector values and from element attribute values, which could cause mismatches with browser behavior (e.g. [attr=" foo "]). Now matches align with the CSS specification and browser engines. #2380
• When using the JDK HttpClient, any system default proxy (ProxySelector.getDefault()) was ignored. Now, the system proxy is used if a per-request proxy is not set. #2388, #2390
• A ValidationException could be thrown in the adoption agency algorithm with particularly broken input. Now logged as a parse error. #2393
• Null characters in the HTML body were not consistently removed; and in foreign content were not correctly replaced. #2395
• An IndexOutOfBoundsException could be thrown when parsing a body fragment with crafted input. Now logged as a parse error. #2397, #2406
• When using StructuralEvaluators (e.g., a parent child selector) across many retained threads, their memoized results could also be retained, increasing memory use. These results are now cleared immediately after use, reducing overall memory consumption. #2411
• Cloning a Parser now preserves any custom TagSet applied to the parser. #2422, #2423
• Custom tags marked as Tag.Void now parse and serialize like the built-in void elements: they no longer consume following content, and the XML serializer emits the expected self-closing form. #2425
• The <br> element is once again classified as an inline tag (Tag.isBlock() == false), matching common developer expectations and its role as phrasing content in HTML, while pretty-printing and text extraction continue to treat it as a line break in the rendered output. #2387, #2439
• Fixed an intermittent truncation issue when fetching and parsing remote documents via Jsoup.connect(url).get(). On responses without a charset header, the initial charset sniff could sometimes (depending on buffering / available() behavior) be mistaken for end-of-stream and a partial parse reused, dropping trailing content. #2448
• TagSet copies no longer mutate their template during lazy lookups, preventing cross-thread ConcurrentModificationException when parsing with shared sessions. #2453
• Fixed parsing of <svg> foreignObject content nested within a <p>, which could incorrectly move the HTML subtree outside the SVG. #2452

Internal Changes

• Deprecated internal helper org.jsoup.internal.Functions (for removal in v1.23.1). This was previously used to support older Android API levels without full java.util.function coverage; jsoup now requires core library desugaring so this indirection is no longer necessary. #2412

Commits

• 8dd66fe [maven-release-plugin] prepare release jsoup-1.22.1
• d924385 Changelog prep for v1.22.1
• 0f3100c Bump actions/upload-artifact from 5 to 6 (#2457)
• cf6ac20 Bump org.apache.maven.plugins:maven-release-plugin from 3.3.0 to 3.3.1 (#2455)
• 6bef938 Fix parsing of SVG foreignObject in paragraphs
• 9b1c0fc Bump org.apache.maven.plugins:maven-release-plugin from 3.2.0 to 3.3.0 (#2450)
• 1415e64 Bump actions/checkout from 5 to 6 (#2451)
• 0e99fd9 Isolate TagSet copies to prevent shared mutation (#2453)
• 90019cb Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.24.2 to 0.25.0 (#2...
• 9395269 Don't preemptively close
• Additional commits viewable in compare view

Updates com.puppycrawl.tools:checkstyle from 12.1.2 to 13.2.0

Release notes

Sourced from com.puppycrawl.tools:checkstyle's releases.

checkstyle-13.2.0

Checkstyle 13.2.0 - https://checkstyle.org/releasenotes.html#Release_13.2.0

New:

#16678 - new Check: NumericalPrefixesInfixesSuffixesCharacterCaseCheck numerical prefixes, infixes, and suffixes should be lowercase, except for "L"

Bug fixes:

#18653 - False-negative: HexLiteralCase does not throw violation on Hex float literals #18486 - False positive: JavadocParagraph reports violation when <`p`> is after tags

checkstyle-13.1.0

Checkstyle 13.1.0 - https://checkstyle.org/releasenotes.html#Release_13.1.0

Breaking backward compatibility:

#12556 - Remove deprecated method CheckstyleAntTask:createClasspath()

New:

#18329 - ImportControl: add module attribute to allow/disallow module imports #18368 - New check: MissingOverrideOnRecordAccessor to require Override on record component accessor methods

Bug fixes:

#16087 - false positive invalid tag JavadocType #18790 - IllegalTokenText reports false positives for Unicode whitespace characters without escape sequences #18118 - Inconsistent behaviour of Indentation check #13038 - VariableDeclarationUsageDistanceCheck doesn't handle method definition properly

... (truncated)

Commits

• 4dd3be8 [maven-release-plugin] prepare release checkstyle-13.2.0
• 84fa874 doc: release notes for 13.2.0
• 48dfde0 Issue #18809: removed xdocs section markers
• 8ffb662 Issue #17882: Add STRING_LITERAL token Javadoc with AST example
• d0dcddf Issue #18612: Remove redundant tokens property from CustomImportOrder in goog...
• a6594e0 Issue #18599: Disable InlineMeSuggester as Error Prone annotations are forbid...
• c1f7520 Issue #18843: Indentation Check Handlers should not have reference to check i...
• 6a0b1ed Issue #18856: Split openrewrite-refaster-rules ci job into two jobs
• 66b1f61 Issue #18836: Enable pitest EXPERIMENTAL_MEMBER_VARIABLE and exclude optimiza...
• c7da3ee dependency: Update Google Java Format version to 1.34.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud