Skip to content

build(deps): bump the maven-dependencies group with 13 updates - #4882

Merged
kubernetes-prow[bot] merged 2 commits into
masterfrom
dependabot/maven/maven-dependencies-0200816351
Aug 20, 2026
Merged

build(deps): bump the maven-dependencies group with 13 updates#4882
kubernetes-prow[bot] merged 2 commits into
masterfrom
dependabot/maven/maven-dependencies-0200816351

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the maven-dependencies group with 13 updates:

Package From To
software.amazon.awssdk:sts 2.53.0 2.53.1
software.amazon.awssdk:auth 2.53.0 2.53.1
software.amazon.awssdk:http-auth-aws 2.53.0 2.53.1
software.amazon.awssdk:http-auth-spi 2.53.0 2.53.1
software.amazon.awssdk:http-client-spi 2.53.0 2.53.1
software.amazon.awssdk:utils 2.53.0 2.53.1
com.fasterxml.jackson.core:jackson-databind 2.22.1 2.22.2
com.fasterxml.jackson.core:jackson-core 2.22.1 2.22.2
com.squareup.okhttp3:okhttp 5.4.0 5.5.0
com.squareup.okhttp3:logging-interceptor 5.4.0 5.5.0
com.squareup.okhttp3:okhttp-jvm 5.4.0 5.5.0
ch.qos.logback:logback-classic 1.6.2 1.6.3
ch.qos.logback:logback-core 1.6.2 1.6.3

Updates software.amazon.awssdk:sts from 2.53.0 to 2.53.1

Updates software.amazon.awssdk:auth from 2.53.0 to 2.53.1

Updates software.amazon.awssdk:http-auth-aws from 2.53.0 to 2.53.1

Updates software.amazon.awssdk:http-auth-spi from 2.53.0 to 2.53.1

Updates software.amazon.awssdk:http-client-spi from 2.53.0 to 2.53.1

Updates software.amazon.awssdk:utils from 2.53.0 to 2.53.1

Updates software.amazon.awssdk:auth from 2.53.0 to 2.53.1

Updates software.amazon.awssdk:http-auth-aws from 2.53.0 to 2.53.1

Updates software.amazon.awssdk:http-auth-spi from 2.53.0 to 2.53.1

Updates software.amazon.awssdk:http-client-spi from 2.53.0 to 2.53.1

Updates software.amazon.awssdk:utils from 2.53.0 to 2.53.1

Updates com.fasterxml.jackson.core:jackson-databind from 2.22.1 to 2.22.2

Commits

Updates com.fasterxml.jackson.core:jackson-core from 2.22.1 to 2.22.2

Commits
  • 24bab14 [maven-release-plugin] prepare release jackson-core-2.22.2
  • dbbd2a0 Prep for 2.22.2 release
  • 038fc7a Merge branch '2.21' into 2.22
  • aaf3398 Merge branch '2.20' into 2.21
  • 2911dae Merge branch '2.19' into 2.20
  • ed8e9dc Merge branch '2.18' into 2.19
  • f8dc7d7 Post-release dep version bump
  • 7add1bf [maven-release-plugin] prepare for next development iteration
  • d11418c [maven-release-plugin] prepare release jackson-core-2.18.10
  • 66a7a17 Prep for 2.18.10 release
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-core from 2.22.1 to 2.22.2

Commits
  • 24bab14 [maven-release-plugin] prepare release jackson-core-2.22.2
  • dbbd2a0 Prep for 2.22.2 release
  • 038fc7a Merge branch '2.21' into 2.22
  • aaf3398 Merge branch '2.20' into 2.21
  • 2911dae Merge branch '2.19' into 2.20
  • ed8e9dc Merge branch '2.18' into 2.19
  • f8dc7d7 Post-release dep version bump
  • 7add1bf [maven-release-plugin] prepare for next development iteration
  • d11418c [maven-release-plugin] prepare release jackson-core-2.18.10
  • 66a7a17 Prep for 2.18.10 release
  • Additional commits viewable in compare view

Updates com.squareup.okhttp3:okhttp from 5.4.0 to 5.5.0

Changelog

Sourced from com.squareup.okhttp3:okhttp's changelog.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()
  • New: OkHttp artifacts are now signed with our [new signing key]. This project and three sibling projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
  • Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
  • Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
  • Fix: Closing a multipart part's sink no longer closes the entire request body.
  • Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts

... (truncated)

Commits

Updates com.squareup.okhttp3:logging-interceptor from 5.4.0 to 5.5.0

Changelog

Sourced from com.squareup.okhttp3:logging-interceptor's changelog.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()
  • New: OkHttp artifacts are now signed with our [new signing key]. This project and three sibling projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
  • Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
  • Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
  • Fix: Closing a multipart part's sink no longer closes the entire request body.
  • Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts

... (truncated)

Commits

Updates com.squareup.okhttp3:okhttp-jvm from 5.4.0 to 5.5.0

Changelog

Sourced from com.squareup.okhttp3:okhttp-jvm's changelog.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()
  • New: OkHttp artifacts are now signed with our [new signing key]. This project and three sibling projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
  • Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
  • Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
  • Fix: Closing a multipart part's sink no longer closes the entire request body.
  • Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts

... (truncated)

Commits

Updates com.squareup.okhttp3:logging-interceptor from 5.4.0 to 5.5.0

Changelog

Sourced from com.squareup.okhttp3:logging-interceptor's changelog.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()
  • New: OkHttp artifacts are now signed with our [new signing key]. This project and three sibling projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
  • Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
  • Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
  • Fix: Closing a multipart part's sink no longer closes the entire request body.
  • Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts

... (truncated)

Commits

Updates com.squareup.okhttp3:okhttp-jvm from 5.4.0 to 5.5.0

Changelog

Sourced from com.squareup.okhttp3:okhttp-jvm's changelog.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()
  • New: OkHttp artifacts are now signed with our [new signing key]. This project and three sibling projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
  • Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
  • Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
  • Fix: Closing a multipart part's sink no longer closes the entire request body.
  • Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts

... (truncated)

Commits

Updates ch.qos.logback:logback-classic from 1.6.2 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

  • In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

  • Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

  • The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

  • ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

  • Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

  • The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits
  • e8e824d prepare release 1.6.3
  • 761821b MDCBasedDiscriminator has a gated warning mechanism
  • 53ed122 update copyright year
  • c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
  • b5aa931 added BatchedSimpleInvocationGate
  • 1f22af7 add javadocs to SimpleInvocationGate
  • 638ffa7 prevent forward and backward slashes to escape to other directories
  • 7d6b9a4 add missing ch.qos.logback.core.property package
  • fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
  • c73b43f deprecate the withJansi path
  • Additional commits viewable in compare view

Updates ch.qos.logback:logback-core from 1.6.2 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-core's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

  • In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

  • Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

  • The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

  • ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

  • Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

  • The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits
  • e8e824d prepare release 1.6.3
  • 761821b MDCBasedDiscriminator has a gated warning mechanism
  • 53ed122 update copyright year
  • c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
  • b5aa931 added BatchedSimpleInvocationGate
  • 1f22af7 add javadocs to SimpleInvocationGate
  • 638ffa7 prevent forward and backward slashes to escape to other directories
  • 7d6b9a4 add missing ch.qos.logback.core.property package
  • fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
  • c73b43f deprecate the withJansi path
  • Additional commits viewable in compare view

Updates ch.qos.logback:logback-core from 1.6.2 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-core's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

  • In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

  • Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

  • The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

  • ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

  • Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

  • The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits
  • e8e824d prepare release 1.6.3
  • 761821b MDCBasedDiscriminator has a gated warning mechanism
  • 53ed122 update copyright year
  • c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
  • b5aa931 added BatchedSimpleInvocationGate
  • 1f22af7 add javadocs to SimpleInvocationGate
  • 638ffa7 prevent forward and backward slashes to escape to other directories
  • 7d6b9a4 add missing ch.qos.logback.core.property package
  • fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
  • c73b43f deprecate the withJansi path
  • Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
ch.qos.logback:logback-classic [>= 1.4.a, < 1.5]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the maven-dependencies group with 13 updates
341798c 
Bumps the maven-dependencies group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| software.amazon.awssdk:sts | `2.53.0` | `2.53.1` |
| software.amazon.awssdk:auth | `2.53.0` | `2.53.1` |
| software.amazon.awssdk:http-auth-aws | `2.53.0` | `2.53.1` |
| software.amazon.awssdk:http-auth-spi | `2.53.0` | `2.53.1` |
| software.amazon.awssdk:http-client-spi | `2.53.0` | `2.53.1` |
| software.amazon.awssdk:utils | `2.53.0` | `2.53.1` |
| [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson) | `2.22.1` | `2.22.2` |
| [com.fasterxml.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core) | `2.22.1` | `2.22.2` |
| [com.squareup.okhttp3:okhttp](https://github.com/lysine-dev/okhttp) | `5.4.0` | `5.5.0` |
| [com.squareup.okhttp3:logging-interceptor](https://github.com/lysine-dev/okhttp) | `5.4.0` | `5.5.0` |
| [com.squareup.okhttp3:okhttp-jvm](https://github.com/lysine-dev/okhttp) | `5.4.0` | `5.5.0` |
| [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.6.2` | `1.6.3` |
| [ch.qos.logback:logback-core](https://github.com/qos-ch/logback) | `1.6.2` | `1.6.3` |


Updates `software.amazon.awssdk:sts` from 2.53.0 to 2.53.1

Updates `software.amazon.awssdk:auth` from 2.53.0 to 2.53.1

Updates `software.amazon.awssdk:http-auth-aws` from 2.53.0 to 2.53.1

Updates `software.amazon.awssdk:http-auth-spi` from 2.53.0 to 2.53.1

Updates `software.amazon.awssdk:http-client-spi` from 2.53.0 to 2.53.1

Updates `software.amazon.awssdk:utils` from 2.53.0 to 2.53.1

Updates `software.amazon.awssdk:auth` from 2.53.0 to 2.53.1

Updates `software.amazon.awssdk:http-auth-aws` from 2.53.0 to 2.53.1

Updates `software.amazon.awssdk:http-auth-spi` from 2.53.0 to 2.53.1

Updates `software.amazon.awssdk:http-client-spi` from 2.53.0 to 2.53.1

Updates `software.amazon.awssdk:utils` from 2.53.0 to 2.53.1

Updates `com.fasterxml.jackson.core:jackson-databind` from 2.22.1 to 2.22.2
- [Commits](https://github.com/FasterXML/jackson/commits)

Updates `com.fasterxml.jackson.core:jackson-core` from 2.22.1 to 2.22.2
- [Commits](FasterXML/jackson-core@jackson-core-2.22.1...jackson-core-2.22.2)

Updates `com.fasterxml.jackson.core:jackson-core` from 2.22.1 to 2.22.2
- [Commits](FasterXML/jackson-core@jackson-core-2.22.1...jackson-core-2.22.2)

Updates `com.squareup.okhttp3:okhttp` from 5.4.0 to 5.5.0
- [Changelog](https://github.com/lysine-dev/okhttp/blob/main/CHANGELOG.md)
- [Commits](lysine-dev/okhttp@parent-5.4.0...parent-5.5.0)

Updates `com.squareup.okhttp3:logging-interceptor` from 5.4.0 to 5.5.0
- [Changelog](https://github.com/lysine-dev/okhttp/blob/main/CHANGELOG.md)
- [Commits](lysine-dev/okhttp@parent-5.4.0...parent-5.5.0)

Updates `com.squareup.okhttp3:okhttp-jvm` from 5.4.0 to 5.5.0
- [Changelog](https://github.com/lysine-dev/okhttp/blob/main/CHANGELOG.md)
- [Commits](lysine-dev/okhttp@parent-5.4.0...parent-5.5.0)

Updates `com.squareup.okhttp3:logging-interceptor` from 5.4.0 to 5.5.0
- [Changelog](https://github.com/lysine-dev/okhttp/blob/main/CHANGELOG.md)
- [Commits](lysine-dev/okhttp@parent-5.4.0...parent-5.5.0)

Updates `com.squareup.okhttp3:okhttp-jvm` from 5.4.0 to 5.5.0
- [Changelog](https://github.com/lysine-dev/okhttp/blob/main/CHANGELOG.md)
- [Commits](lysine-dev/okhttp@parent-5.4.0...parent-5.5.0)

Updates `ch.qos.logback:logback-classic` from 1.6.2 to 1.6.3
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.6.2...v_1.6.3)

Updates `ch.qos.logback:logback-core` from 1.6.2 to 1.6.3
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.6.2...v_1.6.3)

Updates `ch.qos.logback:logback-core` from 1.6.2 to 1.6.3
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.6.2...v_1.6.3)

---
updated-dependencies:
- dependency-name: software.amazon.awssdk:sts
  dependency-version: 2.53.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:auth
  dependency-version: 2.53.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:http-auth-aws
  dependency-version: 2.53.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:http-auth-spi
  dependency-version: 2.53.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:http-client-spi
  dependency-version: 2.53.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:utils
  dependency-version: 2.53.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:auth
  dependency-version: 2.53.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:http-auth-aws
  dependency-version: 2.53.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:http-auth-spi
  dependency-version: 2.53.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:http-client-spi
  dependency-version: 2.53.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:utils
  dependency-version: 2.53.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.22.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.fasterxml.jackson.core:jackson-core
  dependency-version: 2.22.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.fasterxml.jackson.core:jackson-core
  dependency-version: 2.22.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.squareup.okhttp3:okhttp
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: com.squareup.okhttp3:logging-interceptor
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: com.squareup.okhttp3:okhttp-jvm
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: com.squareup.okhttp3:logging-interceptor
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: com.squareup.okhttp3:okhttp-jvm
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.6.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: ch.qos.logback:logback-core
  dependency-version: 1.6.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 20, 2026
@kubernetes-prow kubernetes-prow Bot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Aug 20, 2026
@kubernetes-prow kubernetes-prow Bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Aug 20, 2026
yue9944882
yue9944882 reviewed Aug 20, 2026
View reviewed changes

@yue9944882 yue9944882 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@kubernetes-prow kubernetes-prow Bot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 20, 2026
@kubernetes-prow

kubernetes-prow Bot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dependabot[bot], yue9944882

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubernetes-prow kubernetes-prow Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 20, 2026
@kubernetes-prow
kubernetes-prow Bot merged commit 4c6b311 into master Aug 20, 2026
14 checks passed
@dependabot
dependabot Bot deleted the dependabot/maven/maven-dependencies-0200816351 branch August 20, 2026 17:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@yue9944882 yue9944882 yue9944882 left review comments
@brendandburns brendandburns Awaiting requested review from brendandburns

Assignees

@yue9944882 yue9944882

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. dependencies Pull requests that update a dependency file java Pull requests that update Java code lgtm "Looks good to me", indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@yue9944882