• 9d0ec0f Updating version.json and repo version numbers to: 25.5
• 4a197e7 Merge pull request #18387 from protocolbuffers/cp-lp-25
• b5a7cf7 Remove RecursiveGroup test case which doesn't exist in 25.x pre-Editions
• f000b7e Fix merge conflict by adding optional label to proto2 unittest_lite.proto
• 4728531 Add recursion check when parsing unknown fields in Java.
• 850fcce Internal change
• b704498 Internal change
• e673479 Fix cord handling in DynamicMessage and oneofs. (#18375)
• 8a60b65 Merge pull request #17704 from protocolbuffers/cp-segv
• 94a2663 Fixed a SEGV when deep copying a non-reified sub-message.
• Additional commits viewable in compare view

• 2648b9e prepare release 1.2.13
• bb09515 fix CVE-2023-6378
• 4573294 start work on 1.2.13-SNAPSHOT
• a388193 Merge branch 'branch_1.2.x' of github.com:qos-ch/logback into branch_1.2.x
• de44dc4 prepare release 1.2.12
• ca0cf17 Merge pull request #532 from joakime/fix-jetty-requestlog
• e31609b removed unused files
• 21e29ef Merge pull request #567 from spliffone/LOGBACK-1633
• e869000 fix: published POM file contain the wrong scm URL
• 009ea46 version for next dev cycle
• Additional commits viewable in compare view

• 2648b9e prepare release 1.2.13
• bb09515 fix CVE-2023-6378
• 4573294 start work on 1.2.13-SNAPSHOT
• a388193 Merge branch 'branch_1.2.x' of github.com:qos-ch/logback into branch_1.2.x
• de44dc4 prepare release 1.2.12
• ca0cf17 Merge pull request #532 from joakime/fix-jetty-requestlog
• e31609b removed unused files
• 21e29ef Merge pull request #567 from spliffone/LOGBACK-1633
• e869000 fix: published POM file contain the wrong scm URL
• 009ea46 version for next dev cycle
• Additional commits viewable in compare view

• 2648b9e prepare release 1.2.13
• bb09515 fix CVE-2023-6378
• 4573294 start work on 1.2.13-SNAPSHOT
• a388193 Merge branch 'branch_1.2.x' of github.com:qos-ch/logback into branch_1.2.x
• de44dc4 prepare release 1.2.12
• ca0cf17 Merge pull request #532 from joakime/fix-jetty-requestlog
• e31609b removed unused files
• 21e29ef Merge pull request #567 from spliffone/LOGBACK-1633
• e869000 fix: published POM file contain the wrong scm URL
• 009ea46 version for next dev cycle
• Additional commits viewable in compare view

• 2648b9e prepare release 1.2.13
• bb09515 fix CVE-2023-6378
• 4573294 start work on 1.2.13-SNAPSHOT
• a388193 Merge branch 'branch_1.2.x' of github.com:qos-ch/logback into branch_1.2.x
• de44dc4 prepare release 1.2.12
• ca0cf17 Merge pull request #532 from joakime/fix-jetty-requestlog
• e31609b removed unused files
• 21e29ef Merge pull request #567 from spliffone/LOGBACK-1633
• e869000 fix: published POM file contain the wrong scm URL
• 009ea46 version for next dev cycle
• Additional commits viewable in compare view

Sourced from com.google.guava:guava's releases.

32.0.0

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>32.0.0-jre</version>
  <!-- or, for Android: -->
  <version>32.0.0-android</version>
</dependency>

Jar files

• 32.0.0-jre.jar
• 32.0.0-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.1.jar

Javadoc

• 32.0.0-jre
• 32.0.0-android

JDiff

• 32.0.0-jre vs. 31.1-jre
• 32.0.0-android vs. 31.1-android
• 32.0.0-android vs. 32.0.0-jre

Changelog

Security fixes

• Reimplemented Files.createTempDir and FileBackedOutputStream to further address CVE-2020-8908 (#4011) and CVE-2023-2976 (#2575). (feb83a1c8f)

While CVE-2020-8908 was officially closed when we deprecated Files.createTempDir in Guava 30.0, we've heard from users that even recent versions of Guava have been listed as vulnerable in other databases of security vulnerabilities. In response, we've reimplemented the method (and the very rarely used FileBackedOutputStream class, which had a similar issue) to eliminate the insecure behavior entirely. This change could technically affect users in a number of different ways (discussed under "Incompatible changes" below), but in practice, the only problem users are likely to encounter is with Windows. If you are using those APIs under Windows, you should skip 32.0.0 and go straight to 32.0.1 which fixes the problem. (Unfortunately, we didn't think of the Windows problem until after the release. And while we warn that common.io in particular may not work under Windows, we didn't intend to regress support.) Sorry for the trouble.

Incompatible changes

Although this release bumps Guava's major version number, it makes no binary-incompatible changes to the guava artifact.

One change could cause issues for Widows users, and a few other changes could cause issues for users in more usual situations:

• The new implementations of Files.createTempDir and FileBackedOutputStream throw an exception under Windows. This is fixed in 32.0.1. Sorry for the trouble.
• guava-gwt now requires GWT 2.10.0.
• This release makes a binary-incompatible change to a @Beta API in the separate artifact guava-testlib. Specifically, we changed the return type of TestingExecutors.sameThreadScheduledExecutor to ListeningScheduledExecutorService. The old return type was a package-private class, which caused the Kotlin compiler to produce warnings. (dafaa3e435)

... (truncated)

• See full diff in compare view

• 2648b9e prepare release 1.2.13
• bb09515 fix CVE-2023-6378
• 4573294 start work on 1.2.13-SNAPSHOT
• a388193 Merge branch 'branch_1.2.x' of github.com:qos-ch/logback into branch_1.2.x
• de44dc4 prepare release 1.2.12
• ca0cf17 Merge pull request #532 from joakime/fix-jetty-requestlog
• e31609b removed unused files
• 21e29ef Merge pull request #567 from spliffone/LOGBACK-1633
• e869000 fix: published POM file contain the wrong scm URL
• 009ea46 version for next dev cycle
• Additional commits viewable in compare view

Sourced from org.springframework:spring-web's releases.

v6.0.23

⭐ New Features

• Efficient handling of conditional HTTP requests #33379

🐞 Bug Fixes

• Fix incorrect weak ETag validation #33376
• SimpleEvaluationContext does not enforce read-only semantics #33321
• ConversionService cannot convert primitive array to Object[] #33313
• SpEL Indexer silently ignores failure to set property as index #33311
• Nested bean instance supplier invocation does not retain previous factory method #33185
• Mockito mock falsely initialized as CGLIB proxy with AspectJ aspect #33141
• "file:." cannot be resolved to java.nio.file.Path (and plain "." value resolves to classpath root) #33139
• Trace and Span IDs are no longer propagated RequestBodyAdvice beans #33128
• ConfigurationClassEnhancer does not use correct ClassLoader when called multiple times #33029

📔 Documentation

• Typo in Annotation-driven Listener Endpoints section of Spring Framework documentation #33054
• Container Extension Points section of Spring Framework documentation refers to the wrong property name #33038
• Incorrect constructor details in the javadoc for ApplicationContextEvent #33033

🔨 Dependency Upgrades

• Upgrade to Reactor 2022.0.22 #33324

v6.0.22

⭐ New Features

• AnnotationUtils performance degrades with deep stacks #32922

🐞 Bug Fixes

• Observation in ServerHttpObservationFilter is never stopped for asynchronous requests #32986
• AspectJ CTW aspects executed twice #32973
• SpEL compilation fails when indexing into a Map with a primitive #32912
• SpEL compilation fails when indexing into an array or list with an Integer #32910
• Application not starting with @EnableTransactionManagement(mode = AdviceMode.ASPECTJ) #32883

📔 Documentation

• Remove outdated copyright from index.adoc #32984

🔨 Dependency Upgrades

• Upgrade to Reactor 2022.0.20 #33008

v6.0.21

⭐ New Features

... (truncated)

• 22281d3 Release v6.0.23
• 8d16a50 Efficient ETag parsing
• ab161ca Upgrade to Netty 4.1.112 and Undertow 2.3.15
• b5377ee Polishing
• eff1ca9 Upgrade to Reactor 2022.0.22
• 79c7bfd Introduce withAssignmentDisabled() option for SimpleEvaluationContext
• f78b09f Fix incorrect weak ETag assertion
• b7ca746 Sync GHA setup
• 6c06239 Start building against Reactor 2022.0.22 snapshots
• e1ab306 Enforce read-only semantics in SpEL's SimpleEvaluationContext
• Additional commits viewable in compare view

Sourced from org.springframework:spring-context's releases.

v6.1.14

⭐ New Features

• Use Locale.ROOT for locale neutral, case insensitive comparisons #33708
• Improve checks for relative paths in static resource handling #33689
• CorsUtils.isCorsRequest throws unhandled IllegalArgumentException and returns 500 Internal Server Error on malfomed Origin header #33682
• Skip processing of Java annotations in QualifierAnnotationAutowireCandidateResolver #33580
• Include argument name in MethodArgumentTypeMismatchException error message #33573
• Preserve coroutine context in WebClientExtensions #33548
• Blocking call detected in ConcurrentReferenceHashMap by BlockHound #33450
• Warning message about bean post-processing and eager injection may suggest the wrong cause #33184

🐞 Bug Fixes

• DelegatingFilterProxy Causes Pinned Virtual Threads #33656
• Potential NPE from MethodParameter.getMethod() check in KotlinDelegate.hasDefaultValue() #33609
• Missing native image hints for JDK proxies created by JMS connection factories #33590
• AotTestExecutionListener should not be invoked for a @DisabledInAotMode test class #33589
• Use encoded resource path instead of input path validation in spring-webflux #33568
• org.springframework.util.ResourceUtils#toRelativeURL drops custom URLStreamHandler #33561
• Current observation not in scope during WebClient ExchangeFilterFunction execution #33559
• ZoneIdEditor throws wrong exception type for TypeConverterSupport #33545
• MimeMessageHelper addInline with ByteArrayResource fail with null filename #33527
• @Cacheable throws NullPointerException when RuntimeException is thrown inside annotated code #33492
• Path variable values missing in RedirectView when PathPattern are used #33422
• Reactive HttpComponentsClientHttpResponse ignores Expires cookie attribute #33157

📔 Documentation

• Update fallback.adoc #33721
• Update scheduling.adoc #33703
• Fix link in testing/support-jdbc.adoc #33686
• Adapt Javadoc note about log level of BeanPostProcessorChecker #33617
• Reference the spring-framework-petclinic repository wich uses AspectJ #33539

🔨 Dependency Upgrades

• Upgrade to Apache HttpClient 5.4 #33587
• Upgrade to Apache HttpCore Reactive 5.3 #33588
• Upgrade to Awaitility 4.2.2 #33604
• Upgrade to Micrometer 1.12.11 #33647
• Upgrade to Reactor 2023.0.11 #33637

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​arey, @​asibross, @​boulce, @​drdpov, @​hosamaly, @​ilya40umov, @​izeye, and @​junhyeongkim2

v6.1.13

... (truncated)

• ac5c8ad Release v6.1.14
• fde7116 Consistently skip processing of plain Java annotations
• 0a64591 Add checkstyle rule for toLowerCase/toUpperCase
• 5302e7a Update fallback.adoc
• cad02c1 Update Antora Spring UI to v0.4.17
• c765d03 Use Locale.ROOT consistently for toLower/toUpperCase
• 11d4272 Use Locale.ROOT consistently for toLower/toUpperCase
• 23656ae Use Locale.ROOT consistently for toLower/toUpperCase
• feb6a5f Polishing
• a228eb8 Upgrade to Reactor 2023.0.11
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.