Sourced from org.springframework:spring-framework-bom's releases.

v6.2.11

:star: New Features

• Missing @Nullable on JsonPathAssertions.isEqualTo #35445
• Graceful fallback for non-default NIO.2 FileSystems #35443
• Avoid thread pinning in SseEmitter, ResponseBodyEmitter #35423
• Detect Informix error codes as DuplicateKeyException #35400
• Inconsistent nullability for String value arguments in ResponseCookie from*() factory methods #35377
• Revisit taskTerminationTimeout semantics on SimpleAsyncTaskExecutor/Scheduler #35372
• StandardEvaluationContext.setBeanResolver should allow @Nullable BeanResolver #35371

:lady_beetle: Bug Fixes

• "mainThreadPrefix = null " Causing multiple background bean locks to be blocked #35409
• Annotation not found on parameter in overridden method unless method is public #35349
• Annotations on overridden methods not found in type hierarchy with unresolved generics #35342
• Performance degradation when using singleton beans with Provider #35330
• JettyClientHttpConnector buffer leak in Spring Framework 6.2 #35319
• Spring application hangs on shutdown with @Scheduled(cron=…) when custom ScheduledExecutorService bean is defined (Java 19+) #35316

:notebook_with_decorative_cover: Documentation

• Document potential need to use Mockito.doXxx() to stub a @MockitoSpyBean #35410
• Fix links to Reactive Libraries and RestTemplate #35392
• Fix broken link in WebDriver docs #35374
• Document Web DataBinder support for RouterFunction #35367
• Improve documentation for ApplicationEvents to clarify recommended usage #35335
• Document terms and units in DataSize.parse() #35298
• Refine @Contract Javadoc #35285
• Correct the default value of nestedTransactionAllowed in JpaTransactionManager javadoc #35212

:hammer: Dependency Upgrades

• Upgrade to Micrometer 1.14.11 #35455
• Upgrade to Reactor 2024.0.10 #35454

:heart: Contributors

Thank you to all the contributors who worked on this release:

@​Dockerel, @​Kehrlann, @​acktsap, @​khj68, @​ngocnhan-tran1996, @​scordio, and @​sgflt

• 4c13425 Release v6.2.11
• d17601e Upgrade to Undertow 2.3.19, RxJava 3.1.11, Aalto 1.3.3
• 5b38761 Clarify intended nestedTransactionAllowed default in JpaTransactionManager
• 0e3e34b Find annotations on parameters in overridden non-public methods
• 4745c7c Name local variables consistently
• 275fb52 Upgrade to Reactor 2024.0.10 and Micrometer 1.14.11
• 7f9aa39 Polishing
• c788554 Avoid thread pinning in SseEmitter, ResponseBodyEmitter
• 9e8c640 Make JsonPathAssertions#isEqualTo parameter nullable
• ebb8e34 Upgrade to Jetty 12.0.26, Jetty Reactive HttpClient 4.0.11, Netty 4.1.127, Ht...
• Additional commits viewable in compare view

Sourced from com.sap.cloud.security:java-bom's releases.

3.6.4

Dependency upgrades

• Override nimbus dependency (#1845)
• Bump com.github.spotbugs:spotbugs-maven-plugin from 4.9.4.1 to 4.9.4.2 (#1844)
• Bump io.projectreactor:reactor-test from 3.7.7 to 3.7.9 (#1843)
• Bump com.github.spotbugs:spotbugs-maven-plugin from 4.9.3.2 to 4.9.4.1 (#1842)
• Bump spring.boot.version from 3.5.4 to 3.5.5 (#1840)
• Bump spring.security.oauth2.version from 6.5.2 to 6.5.3 (#1839)
• Bump spring.security.version from 6.5.2 to 6.5.3 (#1837)
• Bump org.mockito:mockito-core from 5.18.0 to 5.19.0 (#1836)
• Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.11.2 to 3.11.3 (#1835)
• Bump spring.core.version from 6.2.9 to 6.2.10 (#1834)
• Bump reactor.version from 3.7.8 to 3.7.9 (#1832)

Sourced from com.sap.cloud.security:java-bom's changelog.

3.6.4

Dependency upgrades

• Override nimbus dependency (#1845)
• Bump com.github.spotbugs:spotbugs-maven-plugin from 4.9.4.1 to 4.9.4.2 (#1844)
• Bump io.projectreactor:reactor-test from 3.7.7 to 3.7.9 (#1843)
• Bump com.github.spotbugs:spotbugs-maven-plugin from 4.9.3.2 to 4.9.4.1 (#1842)
• Bump spring.boot.version from 3.5.4 to 3.5.5 (#1840)
• Bump spring.security.oauth2.version from 6.5.2 to 6.5.3 (#1839)
• Bump spring.security.version from 6.5.2 to 6.5.3 (#1837)
• Bump org.mockito:mockito-core from 5.18.0 to 5.19.0 (#1836)
• Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.11.2 to 3.11.3 (#1835)
• Bump spring.core.version from 6.2.9 to 6.2.10 (#1834)
• Bump reactor.version from 3.7.8 to 3.7.9 (#1832)

• 48b5f05 Release 3.6.4 (#1847)
• 1e2872e Override nimbus dependency (#1845)
• 9aed337 Bump com.github.spotbugs:spotbugs-maven-plugin from 4.9.4.1 to 4.9.4.2 (#1844)
• 4e00bd2 Bump io.projectreactor:reactor-test from 3.7.7 to 3.7.9 (#1843)
• cc9256d Bump com.github.spotbugs:spotbugs-maven-plugin from 4.9.3.2 to 4.9.4.1 (#1842)
• ebd31cd Bump spring.boot.version from 3.5.4 to 3.5.5 (#1840)
• ca3a6f7 Bump spring.security.oauth2.version from 6.5.2 to 6.5.3 (#1839)
• d9f2c7b Bump spring.security.version from 6.5.2 to 6.5.3 (#1837)
• 0b85ae1 Bump org.mockito:mockito-core from 5.18.0 to 5.19.0 (#1836)
• 9c9cd06 Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.11.2 to 3.11.3 (#1835)
• Additional commits viewable in compare view

Sourced from com.google.code.gson:gson's releases.

Gson 2.13.2

The main changes in this release are just newer dependencies.

What's Changed

• Improved packaging of JPMS module declaration in Gson jar
  This fixes an issue where Eclipse and VS Code users could not refer to the Gson module name com.google.gson. See issue google/gson#2679.
• Remove internal class GsonPreconditions by @​Marcono1234 in google/gson#2879
• Switch to using central-publishing-maven-plugin by @​eamonnmcmanus in google/gson#2900

New Contributors

• @​MukjepScarlet made their first contribution in google/gson#2852
• @​ChrisCraik made their first contribution in google/gson#2856

Full Changelog: https://github.com/google/gson/compare/gson-parent-2.13.1...gson-parent-2.13.2

• 686fad7 [maven-release-plugin] prepare release gson-parent-2.13.2
• c2d252a Switch to using central-publishing-maven-plugin. (#2900)
• 69cb755 Bump the github-actions group with 5 updates (#2894)
• ea552c2 Bump the maven group across 1 directory with 3 updates (#2898)
• fdc616d Set top-level permissions for CodeQL workflow (#2889)
• 9334715 Create scorecard.yml (#2888)
• f7de5c2 Bump the maven group with 8 updates (#2885)
• 8c23cd3 Update sources to satisfy a new Error Prone check. (#2887)
• 5eab3ed Bump the github-actions group with 2 updates (#2886)
• 5f5c200 Bump the maven group across 1 directory with 10 updates (#2872)
• Additional commits viewable in compare view

Sourced from org.checkerframework:checker-qual's releases.

Checker Framework 3.51.0

Version 3.51.0 (2025-09-10)

User-visible changes:

If you supply --add-exports flags when you run the Checker Framework, you need to add: --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED.

Implementation details:

In CFGVisualizeOptions:

• renamed isPDF() to isPdfOutput()
• renamed isString() to isStringOutput()

Dataflow Framework:

• In playground package, renamed *Playground.java to *Pdf.java

Closed issues:

#7229, #7241, #7248, #7258.

Sourced from org.checkerframework:checker-qual's changelog.

Version 3.51.0 (2025-09-10)

Implementation details:

In CFGVisualizeOptions:

• renamed isPDF() to isPdfOutput()
• renamed isString() to isStringOutput()

Dataflow Framework:

• In playground package, renamed *Playground.java to *Pdf.java

Closed issues:

#7229, #7241, #7248, #7258.

• f78f6fa new release 3.51.0
• 0a9cceb Prep for release.
• 8556f47 Growonly checker tests
• 1d0d3cd Fix bug in CFG construction for preincrement
• bdd6fcb Update example of message key substrings
• 692afc1 Fix typos
• 33b8815 Better error message when user omits an --add-exports (#7249)
• 91d5473 Remove file .flake8
• 60bbfa5 Use tasks.register
• ebff228 Update dependency org.projectlombok:lombok to v1.18.40 (#7247)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions