Bump the minor-and-patch group across 1 directory with 4 updates

[dependabot]

Bumps the minor-and-patch group with 4 updates in the / directory: commons-codec:commons-codec, io.undertow:undertow-core, com.fasterxml.jackson.dataformat:jackson-dataformat-cbor and com.nimbusds:nimbus-jose-jwt.

Updates commons-codec:commons-codec from 1.22.0 to 1.22.1

Changelog

Sourced from commons-codec:commons-codec's changelog.

Apache Commons Codec 1.22.1 Release Notes

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.22.1.

The Apache Commons Codec component contains encoders and decoders for formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

Fixed Bugs

• CODEC-344: Base64.Builder.setEncodeTable(byte...) accepts invalid custom alphabets. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-340: Base58.Builder.setEncodeTable(byte...) is ignored when encoding and decoding. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-342: Base32.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-343: Base32.Builder.setHexDecodeTable(boolean) sets the encode table to a decode lookup table. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-341: Base16.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-339: URLCodec.encodeUrl(BitSet, byte[]) allows custom safe sets to emit URL encoding control characters. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-338: PercentCodec loses literal '+' when plusForSpace is enabled. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-337: Digest ALL reuses System.in, so only the first algorithm sees the real input (#431). Thanks to Ruiqi Dong, Gary Gregory.

•         Fix Base64.toIntegerBytes(BigInteger) for zero edge case ([#441](https://github.com/apache/commons-codec/issues/441)). Thanks to Gary Gregory.
  

•         Add messages when throwing NullPointerException. Thanks to Gary Gregory.
  

•         Add messages when throwing NullPointerException. Thanks to Gary Gregory.
  

•         StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails fast on null input. Thanks to Gary Gregory.
  

Changes

•         Bump org.apache.commons:commons-parent from 98 to 103. Thanks to Gary Gregory.
  

•         Bump commons-io:commons-io from 2.21.0 to 2.22.0. Thanks to Gary Gregory.
  

For complete information on Apache Commons Codec, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Commons Codec website:

https://commons.apache.org/proper/commons-codec/

Download page: https://commons.apache.org/proper/commons-codec/download_codec.cgi

---

Commits

• dc8f6c8 Prepare for the release candidate 1.22.1 RC1
• 8203c1c Prepare for the next release candidate
• 5647fe2 StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails
• 00c27a9 Reduce vertical whitespace
• 568f2d7 Remove unused method
• 316fb15 Remove unused method
• bf6b543 Bump actions/checkout from 7.0.0 to 7.0.1
• e14cdfe Extract redundant code.
• 3351e63 Add messages when throwing NullPointerException.
• f22dab7 Update SCM tag
• Additional commits viewable in compare view

Updates io.undertow:undertow-core from 2.3.24.Final to 2.4.2.Final

Release notes

Sourced from io.undertow:undertow-core's releases.

v.2.4.1.Final

Release 2.4.1.Final Full list of Jiras: view in Jira

    # Release notes - Undertow - 2.4.1.Final

Bug

UNDERTOW-2763 As per RFC9112 reason-phrase is optional in HTTP 1.1 responses

Enhancement

UNDERTOW-2759 Enable testing in JDK25

UNDERTOW-2767 [2.4.x] UndertowMessages at core uses the wrong message id for fixes in new parser

v.2.4.0.Final

Release 2.4.0.Final Fixes CVE-2026-28367 CVE-2026-28368 CVE-2026-28369 Full list of Jiras: view in Jira

Release notes - Undertow - 2.4.0.Final

Feature Request

UNDERTOW-1593 Track processing time of in flight requests

UNDERTOW-1748 provide a way to "comment" a line in predicate language

UNDERTOW-1870 Hard-coded timeout for asynchronous HTTP requests - add async context timeout undertow option

UNDERTOW-1880 Undertow should support HTTP/2 connection management, wrt GOAWAY frame

UNDERTOW-1881 Add a new exchange attribute for SSL/TLS protocol version

UNDERTOW-2010 Provide method to invalidate all paths in CachingResourceManager

UNDERTOW-2242 Add UndertowOptions.ALLOW_ID_LESS_MATRIX_PARAMETERS

UNDERTOW-2273 Exchange Attribute parser doesn't handle nested attributes

UNDERTOW-2301 HTTP/2 cannot be configured on a per-listener basis

UNDERTOW-2319 Move io.undertow.multipart.minsize property to UndertowOptions

UNDERTOW-2553 Add rewriteHostHeader to ModCluster

UNDERTOW-2580 Support SameSite and custom cookie attributes

UNDERTOW-2696 Allow PathHandler to check for registered prefixes

... (truncated)

Commits

• 92850b2 Prepare 2.4.2.Final
• 8643d98 Merge pull request #1976 from ropalka/2026-06-23-backports-2.4.x
• 5700856 [UNDERTOW-2709] UndertowOptions.ALLOWED_REQUEST_ATTRIBUTES_PATTERN is ignored...
• f5f85e7 [UNDERTOW-2771] Revisited delimiters and unescaped characters
• 7afc4df [UNDERTOW-2771] Decode query and path parameters if and only if parser is con...
• 464418e [UNDERTOW-1918] ComplexSSLTestCase fails sporadically with ConnectionClosedEx...
• 88734e1 Merge pull request #1973 from fl4via/backport-fixes_2.4.x
• 665ff7f [UNDERTOW-2761] return 413 status instead of 500 in case of RequestTooBigExce...
• e1daa7f [UNDERTOW-2759] Excluding new concurrency rules - they need further investiga...
• 41c665f [UNDERTOW-2759] Excluding false positive - it is safe to have unread field no...
• Additional commits viewable in compare view

Updates com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 2.22.0 to 2.22.1

Commits

• b5a7f19 [maven-release-plugin] prepare release jackson-dataformats-binary-2.22.1
• 424b091 Prep for 2.22.1 release
• 11f2b5b Merge branch '2.21' into 2.22
• f5239df Post-release dep version bump
• e08e775 [maven-release-plugin] prepare for next development iteration
• 81321a4 [maven-release-plugin] prepare release jackson-dataformats-binary-2.21.5
• 1f88c38 Prep for 2.21.5 release
• a509ea5 Merge branch '2.21' into 2.22
• 6a26748 Complete fix of #134 (#709)
• 20fc49a Merge branch '2.21' into 2.22
• Additional commits viewable in compare view

Updates com.nimbusds:nimbus-jose-jwt from 10.9 to 10.9.1

Commits

• 94f4387 [maven-release-plugin] prepare for next development iteration
• 5370446 Back-ports fix for iss #619
• 62d00fc [maven-release-plugin] prepare release 10.9.1
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud