Home » Oreps » Frost Server » All Pull Requests » #2441
fraunhoferiosb/frost-server
A Complete Server implementation of the OGC SensorThings API
Watch
1
Commit Activity
Pull Requests
Directory Browser
Velocity History
Releases

Bump the dependencies group across 1 directory with 17 updates #2441

Compare code on GitHub
Open
dependabot[bot] opened 10:37am on September 28, 2026 wants to merge 50 Δ into fraunhoferiosb/frost-server v2.8.x from
dependabot/maven/v2.8.x/dependencies-d2527c0710
dependabot[bot]
fraunhoferiosb/frost-server
dependabot/maven/v2.8.x/dependencies-d2527c0710
Diff Delta:
50
About 1500 Diff Delta/hour
Classified as:  General

dependabot-bot's Description of Work

Bumps the dependencies group with 17 updates in the / directory:

Package
From
To

ch.qos.logback:logback-classic
1.6.3
1.6.4

de.fraunhofer.iosb.ilt:FROST-Client-Dynamic
2.38
2.40

io.prometheus:prometheus-metrics-bom
1.8.0
1.9.0

org.eclipse.jetty.ee10:jetty-ee10-servlet
12.1.12
12.1.13

org.jooq:jooq
3.21.7
3.21.8

org.jooq:jooq-codegen
3.21.7
3.21.8

org.jooq:jooq-meta
3.21.7
3.21.8

org.jooq:jooq-codegen
3.21.7
3.21.8

org.jooq:jooq-meta
3.21.7
3.21.8

org.slf4j:jul-to-slf4j
2.0.18
2.0.20

org.slf4j:slf4j-api
2.0.18
2.0.20

org.slf4j:slf4j-api
2.0.18
2.0.20

tools.jackson:jackson-bom
3.2.2
3.2.3

org.codehaus.mojo:build-helper-maven-plugin
3.6.1
3.6.2

org.codehaus.mojo:exec-maven-plugin
3.6.3
3.6.4

org.sonarsource.scanner.maven:sonar-maven-plugin
5.7.0.6970
5.8.0.7211

com.diffplug.spotless:spotless-maven-plugin
3.10.1
3.10.2

org.bouncycastle:bcpkix-jdk18on
1.85
1.86

org.bouncycastle:bcprov-jdk18on
1.85
1.86

org.bouncycastle:bcutil-jdk18on
1.85
1.86

org.bouncycastle:bcprov-jdk18on
1.85
1.86

org.bouncycastle:bcutil-jdk18on
1.85
1.86

Updates ch.qos.logback:logback-classic from 1.6.3 to 1.6.4

Release notes

Sourced from ch.qos.logback:logback-classic's releases.



Logback 1.6.4


2026-09-24 Release of logback version 1.6.4


• Variable substitution is again applied to the scan attribute of the <configuration> element. The scanning refactoring in version 1.5.27 had dropped substitution, so values such as ${logback.scan.enabled:-true} were no longer resolved. As before version 1.5.27, an unrecognized non-empty value turns scanning on. The same substitution now applies to the scan attribute of <propertiesConfigurator>. This regression was reported in issues/1065 by vaibhavjain2.


• OutputStreamAppender and FileAppender now handle stateful encoders. The Encoder interface has a new default method called isStateful(), which returns false. An encoder that keeps state between calls to encode() can return true. For such encoders, the appender holds its write lock while encoding and while writing, so the output of concurrent appends cannot interleave. Stateless encoders still encode outside the lock, so their performance does not change. Existing encoders need no changes.


• Several race conditions in OutputStreamAppender and FileAppender were fixed. The appender is now marked started and the encoder header is written while the same lock is held, so a concurrent append can no longer write an event before the header. After acquiring the lock, the appender checks again whether it has been stopped, so no event is written after the footer. In prudent mode, FileAppender now encodes and writes each event while holding the lock.


• Fixed a data race on the logger count in LoggerContext. Loggers are created under the lock of their parent logger, so loggers with different parents could be created at the same time and increments of the shared counter could be lost. As a result, LoggerContext.size() could return a value lower than the actual number of loggers. The counter is now an AtomicInteger. This issue was reported in issues/1038 by hcantunc. The fix was contributed in PR #1055 by seonwoo_jung.


• TimeBasedRollingPolicy now supports half-day periods. Date patterns with the AM/PM marker, for example %d{yyyy-MM-dd-a}, used to be detected as daily and rolled over only at midnight. They now roll over at both 00:00 and 12:00. This issue was reported in issues/976 by shakthifuture. The fix was contributed in PR #1051 by seonwoo_jung. See TimeBasedRollingPolicy.


• If org.jline.jansi.AnsiConsole cannot be found on the class path, JansiConsoleAppender now emits warnings that explain how to add org.jline:jansi-core and then writes to the plain console stream. See codes.html#missingJlineJansi.


• The unused ch.qos.logback.classic.util.LogbackMDCAdapterSimple class was removed. LogbackMDCAdapter remains the default MDC adapter.


• A bit-wise identical binary of this version can be reproduced by building from source code at commit 07d291ca0d280bc5da934ec9ff5f1da634fd7937 associated with the tag v_1.6.4. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.


Full Changelog: https://github.com/qos-ch/logback/compare/v_1.6.3...v_1.6.4


Commits



  • 07d291c preapre release 1.6.4


  • 9627daf revert to Collections.unmodifiableMap instead of


  • aa42fb5 disabled RollingCalendarTest#testVaryingNumberOfHalfDailyPeriods to shave off...


  • ddc7459 Support HALF_DAY periodicity for AM/PM date patterns


  • 42d75d7 disable LoggerContextTest#concurrentGetLoggerKeepsSizeConsistent to shave exe...


  • bffd55e add warnings about missing jline.jansi classes


  • 8de0b9b Fix data race on LoggerContext.size (#1038)


  • 76c73d1 add MinimalUnmodifiableMap and return it in LogbackMDCAdapter#getPropertyMap


  • a2c416a Fix formatting of email instruction in README


  • 2c89727 mailing lists have been deactivated

  • Additional commits viewable in compare view


Updates de.fraunhofer.iosb.ilt:FROST-Client-Dynamic from 2.38 to 2.40

Changelog

Sourced from de.fraunhofer.iosb.ilt:FROST-Client-Dynamic's changelog.



Version 2.40


Updates



  • Added definition attribute to Actuator and TaskingCapability for STA V2.

  • Added methods to Entity for relation editing.


Version 2.39


Updates



  • Allowed Sensor.metadata to be any Object.

  • Added STA v1.1 DataArray support.

  • Changed PkValue to be Comparable.


Commits



  • 7c5c180 Release v2.40


  • 2ace4fc Added definition attribute to Actuator and TaskingCapability for STA V2


  • de84af5 Added methods to Entity for relation editing


  • 53445ff Prepare for next development iteration


  • 108e925 Release v2.39


  • 7ac72ea Bump the dependencies group across 1 directory with 10 updates (#237)


  • 8c87cc2 Cleaned up test class & method visibility


  • 6f0d3b8 Allowed Sensor.metadata to be any Object


  • f69dcaa Added STA v1.1 DataArray support


  • fc910eb Changed PkValue to be Comparable

  • Additional commits viewable in compare view


Updates io.prometheus:prometheus-metrics-bom from 1.8.0 to 1.9.0

Release notes

Sourced from io.prometheus:prometheus-metrics-bom's releases.



v1.9.0



1.9.0 (2026-09-16)


Features



  • support metric name filtering in OpenTelemetry exporter (#2344) (9b0ede8)


Bug Fixes



  • avoid protobuf debug reflection in native images (#2251) (7f899e7)

  • bound HTTPServer request resources (#2333) (33ec556)

  • bound observation buffering during collection (#2336) (43788f5)

  • bound scrape query parameters (#2334) (27e1912)


  • ci: skip benchmark report for skipped runs (#2422) (40eddb0)

  • clarify benchmark regression report verdicts (#2394) (e5fa067)


  • deps: update dependency com.google.guava:guava to v33.7.0-jre (#2387) (bf0db49)


  • deps: update dependency io.dropwizard.metrics:metrics-core to v4.2.40 (#2432) (dd88326)


  • deps: update dependency io.dropwizard.metrics5:metrics-core to v5.0.8 (#2433) (42f3c8a)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.29.0-alpha (#2235) (cf9f702)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.30.0-alpha (#2328) (1ca2716)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.30.0-alpha (#2330) (07623c1)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.31.0-alpha (#2401) (6c26619)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.31.0-alpha (#2402) (ac0d68a)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.31.1-alpha (#2409) (5eea652)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.31.1-alpha (#2410) (0bcef89)


  • deps: update dependency org.apache.tomcat.embed:tomcat-embed-core to v11.0.23 (#2241) (a017f80)


  • deps: update dependency org.apache.tomcat.embed:tomcat-embed-core to v11.0.24 (#2294) (63967bd)


  • deps: update dependency org.apache.tomcat.embed:tomcat-embed-core to v11.0.25 (#2389) (92f8344)


  • deps: update dependency org.apache.tomcat.embed:tomcat-embed-core to v11.0.26 (#2477) (05146c0)


  • deps: update dependency org.springframework.boot:spring-boot-starter-parent to v4.1.1 (#2399) (a0b0880)


  • deps: update jetty monorepo to v12.1.11 (#2279) (4dc54da)


  • deps: update jetty monorepo to v12.1.12 (#2371) (08967e0)


  • deps: update jetty monorepo to v12.1.13 (#2459) (b217f05)


  • deps: update junit-framework monorepo to v6.1.2 (#2300) (5966d1d)


  • deps: update junit-framework monorepo to v6.1.3 (#2374) (d1ade52)


  • deps: update otel.instrumentation.version (#2236) (158230d)


  • deps: update protobuf (#2400) (e2db1ed)


  • deps: update protobuf (#2438) (8ad6fa8)


  • deps: update protobuf to v4.35.1 (#2221) (cf17073)

  • disable micrometer compat build cache (#2457) (6a40eda)

  • drop +Inf bound from OpenTelemetry classic histogram boundaries (#2458) (a3bce9a)


  • exposition: export internal package for OSGi resolution (#2415) (28b503d)


  • httpserver: make scrape error responses secure and configurable (f6d9df5)

  • include counter names in negative value errors (#2315) (ea8f935)

  • include license files in release source jars (#2250) (08cf925), closes #2216

  • keep late observations out of subsequent collection buffers (#2471) (d78b149)

  • keep PR title check required after rebases (#2414) (e3d4c3b)

  • prevent buffer stripe index overflow (#2331) (b6cd000)


<!-- raw HTML omitted -->

... (truncated)

Changelog

Sourced from io.prometheus:prometheus-metrics-bom's changelog.




1.9.0 (2026-09-16)


Features



  • support metric name filtering in OpenTelemetry exporter (#2344) (9b0ede8)


Bug Fixes



  • avoid protobuf debug reflection in native images (#2251) (7f899e7)

  • bound HTTPServer request resources (#2333) (33ec556)

  • bound observation buffering during collection (#2336) (43788f5)

  • bound scrape query parameters (#2334) (27e1912)


  • ci: skip benchmark report for skipped runs (#2422) (40eddb0)

  • clarify benchmark regression report verdicts (#2394) (e5fa067)


  • deps: update dependency com.google.guava:guava to v33.7.0-jre (#2387) (bf0db49)


  • deps: update dependency io.dropwizard.metrics:metrics-core to v4.2.40 (#2432) (dd88326)


  • deps: update dependency io.dropwizard.metrics5:metrics-core to v5.0.8 (#2433) (42f3c8a)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.29.0-alpha (#2235) (cf9f702)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.30.0-alpha (#2328) (1ca2716)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.30.0-alpha (#2330) (07623c1)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.31.0-alpha (#2401) (6c26619)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.31.0-alpha (#2402) (ac0d68a)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.31.1-alpha (#2409) (5eea652)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.31.1-alpha (#2410) (0bcef89)


  • deps: update dependency org.apache.tomcat.embed:tomcat-embed-core to v11.0.23 (#2241) (a017f80)


  • deps: update dependency org.apache.tomcat.embed:tomcat-embed-core to v11.0.24 (#2294) (63967bd)


  • deps: update dependency org.apache.tomcat.embed:tomcat-embed-core to v11.0.25 (#2389) (92f8344)


  • deps: update dependency org.apache.tomcat.embed:tomcat-embed-core to v11.0.26 (#2477) (05146c0)


  • deps: update dependency org.springframework.boot:spring-boot-starter-parent to v4.1.1 (#2399) (a0b0880)


  • deps: update jetty monorepo to v12.1.11 (#2279) (4dc54da)


  • deps: update jetty monorepo to v12.1.12 (#2371) (08967e0)


  • deps: update jetty monorepo to v12.1.13 (#2459) (b217f05)


  • deps: update junit-framework monorepo to v6.1.2 (#2300) (5966d1d)


  • deps: update junit-framework monorepo to v6.1.3 (#2374) (d1ade52)


  • deps: update otel.instrumentation.version (#2236) (158230d)


  • deps: update protobuf (#2400) (e2db1ed)


  • deps: update protobuf (#2438) (8ad6fa8)


  • deps: update protobuf to v4.35.1 (#2221) (cf17073)

  • disable micrometer compat build cache (#2457) (6a40eda)

  • drop +Inf bound from OpenTelemetry classic histogram boundaries (#2458) (a3bce9a)


  • exposition: export internal package for OSGi resolution (#2415) (28b503d)


  • httpserver: make scrape error responses secure and configurable (f6d9df5)

  • include counter names in negative value errors (#2315) (ea8f935)

  • include license files in release source jars (#2250) (08cf925), closes #2216

  • keep late observations out of subsequent collection buffers (#2471) (d78b149)

  • keep PR title check required after rebases (#2414) (e3d4c3b)

  • prevent buffer stripe index overflow (#2331) (b6cd000)

  • redact invalid configuration values (#2335) (7e7e533)


<!-- raw HTML omitted -->

... (truncated)

Commits



  • 71e821c chore(main): release 1.9.0 (#2237)


  • d78b149 fix: keep late observations out of subsequent collection buffers (#2471)


  • 085263b perf: avoid allocating a mapping lambda on every labelValues() call (#2442)


  • 9ec38b7 chore(deps): update otel/opentelemetry-collector-contrib docker tag to v0.161...


  • 05146c0 fix(deps): update dependency org.apache.tomcat.embed:tomcat-embed-core to v11...


  • 59ca1f0 test: focus PR benchmarks on client_java and measure label lookups (#2468)


  • 398d087 fix: show uncertainty in benchmark comparisons (#2476)


  • 8722230 perf: skip snapshot rebuild in mergeDuplicates when names are unique (#2441)


  • ea8f935 fix: include counter names in negative value errors (#2315)


  • fba2007 test: verify buffer recovery after snapshot failures (#2446)

  • Additional commits viewable in compare view


Updates org.eclipse.jetty.ee10:jetty-ee10-servlet from 12.1.12 to 12.1.13

Updates org.jooq:jooq from 3.21.7 to 3.21.8

Updates org.jooq:jooq-codegen from 3.21.7 to 3.21.8

Updates org.jooq:jooq-meta from 3.21.7 to 3.21.8

Updates org.jooq:jooq-codegen from 3.21.7 to 3.21.8

Updates org.jooq:jooq-meta from 3.21.7 to 3.21.8

Updates org.slf4j:jul-to-slf4j from 2.0.18 to 2.0.20

Updates org.slf4j:slf4j-api from 2.0.18 to 2.0.20

Updates org.slf4j:slf4j-api from 2.0.18 to 2.0.20

Updates tools.jackson:jackson-bom from 3.2.2 to 3.2.3

Commits



  • 169de87 [maven-release-plugin] prepare release jackson-bom-3.2.3


  • c64410b Prep for 3.2.3 release


  • 1f23ca6 Merge branch '3.1' into 3.2


  • 432ca52 Post-release dep version bump


  • e0d3ccf [maven-release-plugin] prepare for next development iteration


  • 8abdaa6 [maven-release-plugin] prepare release jackson-bom-3.1.7


  • 2abd85b Prep for 3.1.7 release


  • c63b07a Post-release dep version bump


  • b0a5033 [maven-release-plugin] prepare for next development iteration

  • See full diff in compare view


Updates org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2

Release notes

Sourced from org.codehaus.mojo:build-helper-maven-plugin's releases.



3.6.2


<!-- raw HTML omitted -->

🐛 Bug Fixes



👻 Maintenance



  • Remove redundant maven-resolver-api dependency and ignore Resolver/SLF4J 2.x in Dependabot (#248) @​slachiewicz


📦 Dependency updates


<!-- raw HTML omitted -->

<!-- raw HTML omitted -->

Commits



  • 813bc7d [maven-release-plugin] prepare release 3.6.2


  • 07d9109 Remove redundant maven-resolver-api and ignore Resolver/SLF4J 2.x in Dependabot


  • 9abd552 Bump org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0


  • 3c15526 Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml


  • 3b1f104 Bump org.codehaus.mojo:mojo-parent from 96 to 97


  • 1749855 Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml


  • 5230041 Bump org.codehaus.plexus:plexus-utils from 4.0.2 to 4.0.3


  • c0e9375 Delete .github/release-drafter.yml


  • 84a839e Bump org.codehaus.mojo:mojo-parent from 95 to 96


  • a85c668 Replace raw NPEx with customized exception message

  • Additional commits viewable in compare view


Updates org.codehaus.mojo:exec-maven-plugin from 3.6.3 to 3.6.4

Release notes

Sourced from org.codehaus.mojo:exec-maven-plugin's releases.



3.6.4


<!-- raw HTML omitted -->

📝 Documentation updates



👻 Maintenance



📦 Dependency updates


<!-- raw HTML omitted -->

<!-- raw HTML omitted -->

Commits



  • 56083f0 [maven-release-plugin] prepare release 3.6.4


  • 57c594b Ignore Maven Resolver >= 2.0 and SLF4J >= 2.0 in Dependabot


  • c2f5d4e Update required module name in jigsaw IT to org.codehaus.plexus.util


  • d227ee6 Bump org.codehaus.plexus:plexus-utils in /src/it/projects/jigsaw


  • 388fd99 Bump org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0


  • 30106e8 Stop dependabot from updating test fixtures


  • b6d5eab Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml


  • aa98aba Bump org.codehaus.mojo:mojo-parent from 96 to 97


  • 79cfdcd Bump org.apache.maven.plugins:maven-toolchains-plugin


  • 8c58ad6 Fix typo in docs (#531)

  • Additional commits viewable in compare view


Updates org.sonarsource.scanner.maven:sonar-maven-plugin from 5.7.0.6970 to 5.8.0.7211

Release notes

Sourced from org.sonarsource.scanner.maven:sonar-maven-plugin's releases.



5.8.0.7211


Release notes - Sonar Scanner for Maven - 5.8


Maintenance


SCANMAVEN-382 Prepare next development iteration 5.8.0


SCANMAVEN-384 Fix QG broken by the new testing rules


SCANMAVEN-385 Code Quality reorganization from jvm to CI Experience Squad


SCANMAVEN-386 ToggleLockBranch: Add additional-message


SCANMAVEN-387 Code Quality Slack channel reorganization


SCANMAVEN-390 Upgrade orchestrator to version 6.3.0


SCANMAVEN-392 Upgrade jetty test dependencies to version 9.4.58.v20250814


SCANMAVEN-395 Remove scheduled invocation of sonar:sonar shorthand test


SCANMAVEN-397 Replace Maven 4.0.0-rc-5 in ITs with Maven 4.0.0-rc-6


SCANMAVEN-398 Upgrade orchestrator to version 6.4.0


SCANMAVEN-399 Update sonar-scanner-java-library to 4.1.2.1663


SCANMAVEN-401 Upgrade Jetty used by e2e tests


SCANMAVEN-402 Upgrade orchestrator to version 6.4.3.4676


Feature


SCANMAVEN-403 Releasability status fails on property-dump-plugin version


Commits



  • 7347a92 SCANMAVEN-403 Releasability status fails on property-dump-plugin version (#426)


  • 002f55c SCANMAVEN-402 Upgrade orchestrator to version 6.4.3.4676 (#425)


  • fc7515f SCANMAVEN-401 Upgrade Jetty used by e2e tests (#424)


  • 16dedb3 SCANMAVEN-399 Update sonar-scanner-java-library to 4.1.2.1663 (#421)


  • ad81956 SCANMAVEN-397 Upgrade Maven 4 to 4.0.0-rc-6 in tests (#420)


  • 86e9516 SCANMAVEN-398 Upgrade orchestrator to version 6.4.0 (#419)


  • c26335c SCANMAVEN-395 Remove scheduled invocation of sonar:sonar shorthand test (#417)


  • 6a79ca6 SCANMAVEN-392 Upgrade jetty test dependencies to version 9.4.58.v20250814 (#416)


  • 57bb131 SCANMAVEN-390 Upgrade orchestrator to version 6.3.0 (#414)


  • 9d50b6d GHA-355 Add statuses: write permission for release-lock feature (#412)

  • Additional commits viewable in compare view


Updates com.diffplug.spotless:spotless-maven-plugin from 3.10.1 to 3.10.2

Release notes

Sourced from com.diffplug.spotless:spotless-maven-plugin's releases.



Maven Plugin v3.10.2


Fixed




  • <shortenFullyQualifiedTypes> now shortens fully-qualified types used in expression contexts (such as static method calls, static fields, and enum constants) while avoiding imports that would change how existing unqualified type references resolve. (#3039)

  • Eclipse JDT formatter step no longer fails with NoClassDefFoundError when lombok is active as a JVM agent (e.g. -javaagent:lombok.jar in Eclipse/VS Code/Cursor). (#2795)


Commits



  • dc2a4cb Published maven/3.10.2


  • 876c8c4 Published gradle/8.10.2


  • ff28375 Published lib/4.10.2


  • e260aa7 shortenFullyQualifiedTypes: preserve unqualified type resolution (#3037)


  • 5a2cdca Update changelogs.


  • 98ca50e Merge remote-tracking branch 'origin/main' into 3033-unqualified-type-collision


  • 9591d7e Resolve interopability with spotless, lombok and VSCode (#3038)


  • 5842e1b shortenFullyQualifiedTypes: shorten FQTs in expression context (#3039)


  • e7f5b60 Add changelog entries


  • 79ff6c7 Resolve interopability with spotless, lombok and VSCode

  • Additional commits viewable in compare view


Updates org.bouncycastle:bcpkix-jdk18on from 1.85 to 1.86

Changelog

Sourced from org.bouncycastle:bcpkix-jdk18on's changelog.



Bouncy Castle Crypto Package - Release Notes


1.0 Introduction


The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. The package is organised so that it contains a light-weight API suitable for use in any environment (including the J2ME) with the additional infrastructure to conform the algorithms to the JCE framework.


2.0 Release History


<!-- raw HTML omitted --><!-- raw HTML omitted -->


2.1.1 Version


Release: 1.87

Date: 2026, TBD


2.1.2 Defects Fixed




  • A KeyAgreement asked for its shared secret before doPhase returned data rather than refusing. javax.crypto.KeyAgreement specifies IllegalStateException for that state, but nothing in the provider tracked it, so each SPI handed back whatever its result field held: for Diffie-Hellman that was the private value itself - engineInit seeded result with x, so generateSecret() returned the private exponent padded to the prime's length and generateSecret("AES") an all-zero key taken from that padding - while ECDH returned null and its named-algorithm overload raised NullPointerException. BaseAgreementSpi now records whether a doPhase has completed the agreement since the last init and refuses the request with an IllegalStateException naming the algorithm, so every family in the provider - DH, ECDH and ECMQV, the SM2 exchange, both ECGOST families, XDH, SM9 and NewHope - answers the same way, and the DH SPI no longer holds the private value in that field at all.




  • Mac.getInstance and KeyGenerator.getInstance by the HMAC SHA-512/224 and SHA-512/256 object identifiers (1.2.840.113549.2.12 and .13) failed, although the same algorithms resolved by name and the matching SecretKeyFactory aliases were registered: the SHA512 mappings called addHMACAlgorithm for the two truncated variants without the addHMACAlias that registers their OIDs against Mac and KeyGenerator. Both are now aliased, as every other HMAC in that class already was.




  • A KTSParameterSpec naming an HKDF key-derivation function with a parameters field - a form the provider does not service - was accepted at Cipher init and then failed out of wrap or unwrap with an unchecked IllegalStateException neither method declares. The KTS key-wrapping Ciphers (ML-KEM, Classic McEliece, FrodoKEM, the composite KEM and RSA-KEM) now validate the spec's KDF when they take it, reporting an unserviceable one as the InvalidAlgorithmParameterException engineInit declares, which is what the javax.crypto.KEM services already did through KdfUtil.resolveKemSpec.




  • A DTLS handshake deadlocked when a handshake message ahead of the peer's ChangeCipherSpec (a client's CertificateVerify, say) was lost while the ChangeCipherSpec and Finished behind it arrived: the record layer moved its read epoch on at the ChangeCipherSpec and then discarded every retransmission of the lost message as belonging to the old epoch, whose records are only accepted once the handshake has completed. Each side then waited on the other until a handshake timeout, if one was configured, ended it. Every client-authenticated handshake, and every handshake in which the server issues a NewSessionTicket, was exposed. Until the handshake completes, handshake records from the current epoch are now still accepted after the read epoch has moved on, and each message is checked against the epoch of the record that carried it. The DTLS loopback tests now run their handshakes at 10% datagram loss in each direction, with a client-authenticated handshake at 25%.




  • The lightweight SubjectPublicKeyInfoFactory and PrivateKeyInfoFactory encoded a GOST R 34.10-2012 key on one of the legacy CryptoPro curves under id-GostR3410-2001, although RFC 9215 sec. 4.2 permits those curves for 2012 keys. The digestParamSet now decides: a GOST R 34.11-94 parameter set means 2001 (RFC 4491 sec. 2.3.2), a GOST R 34.11-2012 digest or none means 2012 with 256/512 taken from the curve field size, and any other value is...

    Description has been truncated




2 total changed files
Loading changes...
Loading changes...
You’ve reached the end of the pull request
Please mind the merge button
GitClear uses cookies to ensure you get the best experience on our website. Learn more about our cookie policy