fix(deps): Bump the maven group across 8 directories with 4 updates by dependabot[bot] · Pull Request #614 · Backbase/stream-services

dependabot · 2026-07-10T22:03:10Z

Bumps the maven group with 1 update in the /stream-compositions/services directory: org.apache.activemq:activemq-broker.
Bumps the maven group with 1 update in the /stream-compositions/test-utils directory: org.apache.activemq:activemq-broker.
Bumps the maven group with 1 update in the /stream-legal-entity/legal-entity-bootstrap-task directory: org.wiremock:wiremock-standalone.
Bumps the maven group with 1 update in the /stream-legal-entity/legal-entity-http directory: org.wiremock:wiremock-standalone.
Bumps the maven group with 1 update in the /stream-portfolio/portfolio-http directory: org.wiremock:wiremock-standalone.
Bumps the maven group with 1 update in the /stream-product-catalog/product-catalog-task directory: org.wiremock:wiremock-standalone.
Bumps the maven group with 2 updates in the /stream-sdk/stream-parent directory: org.wiremock:wiremock-standalone and org.bouncycastle:bcpkix-jdk18on.
Bumps the maven group with 2 updates in the /stream-sdk/stream-parent/stream-test-support directory: org.wiremock:wiremock-standalone and org.bouncycastle:bcpkix-jdk18on.

Updates org.apache.activemq:activemq-broker from 6.2.4 to 6.2.6

Release notes

Sourced from org.apache.activemq:activemq-broker's releases.

Apache ActiveMQ 6.2.6

What's Changed

Bump to 6.2.6-SNAPSHOT by @jbonofre in apache/activemq#1961

[6.2.x] Add more transport types to the denied list for JMX part 2 (#1972) by @cshannon in apache/activemq#1973

Execute CI on activemq-5.19.x and activemq-6.2.x branches (6.2.x) by @jbonofre in apache/activemq#1958

build(deps): bump log4j-version from 2.25.3 to 2.25.4 by @robertregina59 in apache/activemq#1993

[6.2.x] Block the XBeanBrokerFactory by default inside VMTransportFactory (#2003) by @cshannon in apache/activemq#2010

[6.2.x] Handle validation for Composite URIs without parens (#2004) by @cshannon in apache/activemq#2012

[6.2.x] Disable the message servlet by default (#2000) by @cshannon in apache/activemq#2014

#2005 6.2.x - Fix authorization check on removeDestination by @mattrpav in apache/activemq#2009

[6.2.x] Remove "java.lang" package as a default allowed serializable package (#2026) by @cshannon in apache/activemq#2027

Bump dependencies for CVE fixes on 6.2.x by @jbonofre in apache/activemq#2030

Harden default broker and web console configuration (6.2.x backport) by @jbonofre in apache/activemq#2035

build(deps): bump shiro-version from 2.1.0 to 2.2.0 (6.2.x backport) by @jbonofre in apache/activemq#2041

[6.2.x] Harden web console and Jolokia access by default (#2025) by @jbonofre in apache/activemq#2037

[6.2.x] Backport network flaky test improvements by @cshannon in apache/activemq#2045

[6.2.x] Ensure connection info is processed before durable sync by @cshannon in apache/activemq#2048

New Contributors

@robertregina59 made their first contribution in apache/activemq#1993

Full Changelog: apache/activemq@activemq-6.2.5...activemq-6.2.6

Apache ActiveMQ 6.2.5

What's Changed

Bump to 6.2.5-SNAPSHOT version by @jbonofre in apache/activemq#1892

[6.2.x] SSL handshake write timeout enforcement (#1883) by @cshannon in apache/activemq#1894

[6.2.x] Minor bug fix for BrokerView#validateAllowedUri (#1900) by @cshannon in apache/activemq#1902

[6.2.x] Restrict URL protocol types loaded by XBeanBrokerFactory (#1910) by @cshannon in apache/activemq#1915

compilation-fix by @cshannon in apache/activemq#1919

[6.2.x] Make brokerName immutable in RegionBroker (#1917) by @cshannon in apache/activemq#1923

[6.2.x] Add Http discovery transport to denied list for JMX (#1918) by @cshannon in apache/activemq#1925

[6.2.x] Update resource cleanup on queueBrowse servlet (#1912) by @cshannon in apache/activemq#1928

[6.2.x] Update DestinationView uri resolution (#1914) by @cshannon in apache/activemq#1930

fix(webconsole): the webconsole now redirect to the slave.jsp when required (slave broker with startAsync="true") [6.2.x] by @jbonofre in apache/activemq#1934

[6.2.x] Queue browse improvements in webconsole (#1938) by @cshannon in apache/activemq#1942

[6.2.x] Add more transport types to the denied list for JMX (#1949) by @cshannon in apache/activemq#1952

[6.2.x] Add remote file filtering for XBeanBrokerFactory (#1950) by @cshannon in apache/activemq#1954

Full Changelog: apache/activemq@activemq-6.2.4...activemq-6.2.5

Commits

bb9523b [maven-release-plugin] prepare release activemq-6.2.6
4115627 Ensure connection info is processed before durable sync (#2048)
9c5639d Backport network flaky test improvements (#2045)
be8415f [6.2.x] Harden web console and Jolokia access by default (#2025) (#2037)
7d7d0af build(deps): bump shiro-version from 2.1.0 to 2.2.0 (#2023) (#2041)
df95bf8 Harden default broker and web console configuration (6.2.x backport) (#2035)
09a74c5 Bump dependencies for CVE fixes on 6.2.x (#2030)
68b5d2b Remove "java.lang" package as a default allowed serializable package (#2026) ...
dfeac9f #2005 6.2.x - Fix authorization check on removeDestination (#2009)
8b5af8d Disable the message servlet by default (#2000) (#2014)
Additional commits viewable in compare view

Updates org.apache.activemq:activemq-broker from 6.2.4 to 6.2.6

Release notes

Sourced from org.apache.activemq:activemq-broker's releases.

Apache ActiveMQ 6.2.6

What's Changed

Bump to 6.2.6-SNAPSHOT by @jbonofre in apache/activemq#1961

[6.2.x] Add more transport types to the denied list for JMX part 2 (#1972) by @cshannon in apache/activemq#1973

Execute CI on activemq-5.19.x and activemq-6.2.x branches (6.2.x) by @jbonofre in apache/activemq#1958

build(deps): bump log4j-version from 2.25.3 to 2.25.4 by @robertregina59 in apache/activemq#1993

[6.2.x] Block the XBeanBrokerFactory by default inside VMTransportFactory (#2003) by @cshannon in apache/activemq#2010

[6.2.x] Handle validation for Composite URIs without parens (#2004) by @cshannon in apache/activemq#2012

[6.2.x] Disable the message servlet by default (#2000) by @cshannon in apache/activemq#2014

#2005 6.2.x - Fix authorization check on removeDestination by @mattrpav in apache/activemq#2009

[6.2.x] Remove "java.lang" package as a default allowed serializable package (#2026) by @cshannon in apache/activemq#2027

Bump dependencies for CVE fixes on 6.2.x by @jbonofre in apache/activemq#2030

Harden default broker and web console configuration (6.2.x backport) by @jbonofre in apache/activemq#2035

build(deps): bump shiro-version from 2.1.0 to 2.2.0 (6.2.x backport) by @jbonofre in apache/activemq#2041

[6.2.x] Harden web console and Jolokia access by default (#2025) by @jbonofre in apache/activemq#2037

[6.2.x] Backport network flaky test improvements by @cshannon in apache/activemq#2045

[6.2.x] Ensure connection info is processed before durable sync by @cshannon in apache/activemq#2048

New Contributors

@robertregina59 made their first contribution in apache/activemq#1993

Full Changelog: apache/activemq@activemq-6.2.5...activemq-6.2.6

Apache ActiveMQ 6.2.5

What's Changed

Bump to 6.2.5-SNAPSHOT version by @jbonofre in apache/activemq#1892

[6.2.x] SSL handshake write timeout enforcement (#1883) by @cshannon in apache/activemq#1894

[6.2.x] Minor bug fix for BrokerView#validateAllowedUri (#1900) by @cshannon in apache/activemq#1902

[6.2.x] Restrict URL protocol types loaded by XBeanBrokerFactory (#1910) by @cshannon in apache/activemq#1915

compilation-fix by @cshannon in apache/activemq#1919

[6.2.x] Make brokerName immutable in RegionBroker (#1917) by @cshannon in apache/activemq#1923

[6.2.x] Add Http discovery transport to denied list for JMX (#1918) by @cshannon in apache/activemq#1925

[6.2.x] Update resource cleanup on queueBrowse servlet (#1912) by @cshannon in apache/activemq#1928

[6.2.x] Update DestinationView uri resolution (#1914) by @cshannon in apache/activemq#1930

fix(webconsole): the webconsole now redirect to the slave.jsp when required (slave broker with startAsync="true") [6.2.x] by @jbonofre in apache/activemq#1934

[6.2.x] Queue browse improvements in webconsole (#1938) by @cshannon in apache/activemq#1942

[6.2.x] Add more transport types to the denied list for JMX (#1949) by @cshannon in apache/activemq#1952

[6.2.x] Add remote file filtering for XBeanBrokerFactory (#1950) by @cshannon in apache/activemq#1954

Full Changelog: apache/activemq@activemq-6.2.4...activemq-6.2.5

Commits

bb9523b [maven-release-plugin] prepare release activemq-6.2.6
4115627 Ensure connection info is processed before durable sync (#2048)
9c5639d Backport network flaky test improvements (#2045)
be8415f [6.2.x] Harden web console and Jolokia access by default (#2025) (#2037)
7d7d0af build(deps): bump shiro-version from 2.1.0 to 2.2.0 (#2023) (#2041)
df95bf8 Harden default broker and web console configuration (6.2.x backport) (#2035)
09a74c5 Bump dependencies for CVE fixes on 6.2.x (#2030)
68b5d2b Remove "java.lang" package as a default allowed serializable package (#2026) ...
dfeac9f #2005 6.2.x - Fix authorization check on removeDestination (#2009)
8b5af8d Disable the message servlet by default (#2000) (#2014)
Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio

Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)

CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes

Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

WireMock Docker 3.0.3-1 - Docker Image with the Patch

WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x

Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file

NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@W0rty, @numacanedo, @Mahoney, @tomakehurst, @oleg-nenashev

3.0.2

🐛 Bug fixes

fix: avoid crash when printing help in wiremock-standalone (#2351) @tomasbjerre

👻 Maintenance

Reset system properties at end of test (#2356) @Mahoney

📦 Dependency updates

Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @dependabot

Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @dependabot

Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @dependabot

Commits

7a51264 Bumped patch version
0f72091 Stop NetworkAddressRules doing DNS lookups
984e79f Make NetworkAddressRulesAdheringDnsResolver testable
92d7793 Applied DNS resolver enforcement to webhooks extension
027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
21a9622 Bumped patch version
1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio

Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)

CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes

Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

WireMock Docker 3.0.3-1 - Docker Image with the Patch

WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x

Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file

NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@W0rty, @numacanedo, @Mahoney, @tomakehurst, @oleg-nenashev

3.0.2

🐛 Bug fixes

fix: avoid crash when printing help in wiremock-standalone (#2351) @tomasbjerre

👻 Maintenance

Reset system properties at end of test (#2356) @Mahoney

📦 Dependency updates

Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @dependabot

Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @dependabot

Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @dependabot

Commits

7a51264 Bumped patch version
0f72091 Stop NetworkAddressRules doing DNS lookups
984e79f Make NetworkAddressRulesAdheringDnsResolver testable
92d7793 Applied DNS resolver enforcement to webhooks extension
027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
21a9622 Bumped patch version
1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio

Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)

CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes

Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

WireMock Docker 3.0.3-1 - Docker Image with the Patch

WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x

Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file

NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@W0rty, @numacanedo, @Mahoney, @tomakehurst, @oleg-nenashev

3.0.2

🐛 Bug fixes

fix: avoid crash when printing help in wiremock-standalone (#2351) @tomasbjerre

👻 Maintenance

Reset system properties at end of test (#2356) @Mahoney

📦 Dependency updates

Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @dependabot

Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @dependabot

Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @dependabot

Commits

7a51264 Bumped patch version
0f72091 Stop NetworkAddressRules doing DNS lookups
984e79f Make NetworkAddressRulesAdheringDnsResolver testable
92d7793 Applied DNS resolver enforcement to webhooks extension
027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
21a9622 Bumped patch version
1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio

Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)

CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes

Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

WireMock Docker 3.0.3-1 - Docker Image with the Patch

WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x

Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file

NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@W0rty, @numacanedo, @Mahoney, @tomakehurst, @oleg-nenashev

3.0.2

🐛 Bug fixes

fix: avoid crash when printing help in wiremock-standalone (#2351) @tomasbjerre

👻 Maintenance

Reset system properties at end of test (#2356) @Mahoney

📦 Dependency updates

Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @dependabot

Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @dependabot

Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @dependabot

Commits

7a51264 Bumped patch version
0f72091 Stop NetworkAddressRules doing DNS lookups
984e79f Make NetworkAddressRulesAdheringDnsResolver testable
92d7793 Applied DNS resolver enforcement to webhooks extension
027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
21a9622 Bumped patch version
1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
Additional commits viewable in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio

Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)

CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes

Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

WireMock Docker 3.0.3-1 - Docker Image with the Patch

WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x

Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file

NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@W0rty, @numacanedo, @Mahoney, @tomakehurst, @oleg-nenashev

3.0.2

🐛 Bug fixes

fix: avoid crash when printing help in wiremock-standalone (#2351) @tomasbjerre

👻 Maintenance

Reset system properties at end of test (#2356) @Mahoney

📦 Dependency updates

Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @dependabot

Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @dependabot

Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @dependabot

Commits

7a51264 Bumped patch version
0f72091 Stop NetworkAddressRules doing DNS lookups
984e79f Make NetworkAddressRulesAdheringDnsResolver testable
92d7793 Applied DNS resolver enforcement to webhooks extension
027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
21a9622 Bumped patch version
1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
Additional commits viewable in compare view

Updates org.bouncycastle:bcpkix-jdk18on from 1.83 to 1.84

Changelog

Sourced from org.bouncycastle:bcpkix-jdk18on's changelog.

... (truncated)

Commits

See full diff in compare view

Updates org.bouncycastle:bcprov-jdk18on from 1.83 to 1.84

Changelog

Sourced from org.bouncycastle:bcprov-jdk18on's changelog.

... (truncated)

Commits

See full diff in compare view

Updates org.wiremock:wiremock-standalone from 3.0.1 to 3.0.3

Release notes

Sourced from org.wiremock:wiremock-standalone's releases.

3.0.3 - Security Release

🔒 Security

This security release addresses the following issues

CVE-2023-41327 - Controlled SSRF through URL in the WireMock Webhooks Extension and WireMock Studio

Base CVSS Score: 4.6 (AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C)

CVE-2023-41329 - Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes

Base CVSS Score: 3.9 (AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)

NOTE: WireMock Studio, a proprietary distribution discontinued in 2022, is also affected by those issues and also affected by CVE-2023-39967 - Overall CVSS Score 8.6 - “Controlled and full-read SSRF through URL parameter when testing a request, webhooks and proxy mode”. The fixes will not be provided. The vendor recommends migrating to WireMock Cloud which is available as SaaS and private beta for on-premises deployments

🔗 Related releases

WireMock Docker 3.0.3-1 - Docker Image with the Patch

WireMock 2.35.1 / WireMock Docker 2.35.1-1 - Backport to WireMock 2.x

Python WireMock 2.6.1 - Python library that bundles the WireMock JAR file

NOTE: Other distributions like Testcontainers modules or Helm chart need explicit version declaration, and hence a user action is needed to update the dependencies should they be considered a risk

Credits

@W0rty, @numacanedo, @Mahoney, @tomakehurst, @oleg-nenashev

3.0.2

🐛 Bug fixes

fix: avoid crash when printing help in wiremock-standalone (#2351) @tomasbjerre

👻 Maintenance

Reset system properties at end of test (#2356) @Mahoney

📦 Dependency updates

Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346) @dependabot

Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353) @dependabot

Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352) @dependabot

Commits

7a51264 Bumped patch version
0f72091 Stop NetworkAddressRules doing DNS lookups
984e79f Make NetworkAddressRulesAdheringDnsResolver testable
92d7793 Applied DNS resolver enforcement to webhooks extension
027ddaf Moved enforcement of network address rules to Apache client DNS resolver to a...
21a9622 Bumped patch version
1bb8b2d Bump org.eclipse.jetty:jetty-bom from 11.0.15 to 11.0.16 (#2346)
3fc3b88 Bump org.slf4j:log4j-over-slf4j from 2.0.7 to 2.0.9 (#2353)
0456440 Bump org.sonarqube from 4.3.0.3225 to 4.3.1.3277 (#2352)
18ccdc6 Merge pull request #2356 from wiremock/reset-system-properties
Additional commits viewable in compare view

Updates org.bouncycastle:bcpkix-jdk18on from 1.83 to 1.84

Changelog

Sourced from

Bumps the maven group with 1 update in the /stream-compositions/services directory: [org.apache.activemq:activemq-broker](https://github.com/apache/activemq). Bumps the maven group with 1 update in the /stream-compositions/test-utils directory: [org.apache.activemq:activemq-broker](https://github.com/apache/activemq). Bumps the maven group with 1 update in the /stream-legal-entity/legal-entity-bootstrap-task directory: [org.wiremock:wiremock-standalone](https://github.com/wiremock/wiremock). Bumps the maven group with 1 update in the /stream-legal-entity/legal-entity-http directory: [org.wiremock:wiremock-standalone](https://github.com/wiremock/wiremock). Bumps the maven group with 1 update in the /stream-portfolio/portfolio-http directory: [org.wiremock:wiremock-standalone](https://github.com/wiremock/wiremock). Bumps the maven group with 1 update in the /stream-product-catalog/product-catalog-task directory: [org.wiremock:wiremock-standalone](https://github.com/wiremock/wiremock). Bumps the maven group with 2 updates in the /stream-sdk/stream-parent directory: [org.wiremock:wiremock-standalone](https://github.com/wiremock/wiremock) and [org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java). Bumps the maven group with 2 updates in the /stream-sdk/stream-parent/stream-test-support directory: [org.wiremock:wiremock-standalone](https://github.com/wiremock/wiremock) and [org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java). Updates `org.apache.activemq:activemq-broker` from 6.2.4 to 6.2.6 - [Release notes](https://github.com/apache/activemq/releases) - [Commits](apache/activemq@activemq-6.2.4...activemq-6.2.6) Updates `org.apache.activemq:activemq-broker` from 6.2.4 to 6.2.6 - [Release notes](https://github.com/apache/activemq/releases) - [Commits](apache/activemq@activemq-6.2.4...activemq-6.2.6) Updates `org.wiremock:wiremock-standalone` from 3.0.1 to 3.0.3 - [Release notes](https://github.com/wiremock/wiremock/releases) - [Commits](wiremock/wiremock@3.0.1...3.0.3) Updates `org.wiremock:wiremock-standalone` from 3.0.1 to 3.0.3 - [Release notes](https://github.com/wiremock/wiremock/releases) - [Commits](wiremock/wiremock@3.0.1...3.0.3) Updates `org.wiremock:wiremock-standalone` from 3.0.1 to 3.0.3 - [Release notes](https://github.com/wiremock/wiremock/releases) - [Commits](wiremock/wiremock@3.0.1...3.0.3) Updates `org.wiremock:wiremock-standalone` from 3.0.1 to 3.0.3 - [Release notes](https://github.com/wiremock/wiremock/releases) - [Commits](wiremock/wiremock@3.0.1...3.0.3) Updates `org.wiremock:wiremock-standalone` from 3.0.1 to 3.0.3 - [Release notes](https://github.com/wiremock/wiremock/releases) - [Commits](wiremock/wiremock@3.0.1...3.0.3) Updates `org.bouncycastle:bcpkix-jdk18on` from 1.83 to 1.84 - [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html) - [Commits](https://github.com/bcgit/bc-java/commits) Updates `org.bouncycastle:bcprov-jdk18on` from 1.83 to 1.84 - [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html) - [Commits](https://github.com/bcgit/bc-java/commits) Updates `org.wiremock:wiremock-standalone` from 3.0.1 to 3.0.3 - [Release notes](https://github.com/wiremock/wiremock/releases) - [Commits](wiremock/wiremock@3.0.1...3.0.3) Updates `org.bouncycastle:bcpkix-jdk18on` from 1.83 to 1.84 - [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html) - [Commits](https://github.com/bcgit/bc-java/commits) Updates `org.bouncycastle:bcprov-jdk18on` from 1.83 to 1.84 - [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html) - [Commits](https://github.com/bcgit/bc-java/commits) --- updated-dependencies: - dependency-name: org.apache.activemq:activemq-broker dependency-version: 6.2.6 dependency-type: direct:development dependency-group: maven - dependency-name: org.apache.activemq:activemq-broker dependency-version: 6.2.6 dependency-type: direct:production dependency-group: maven - dependency-name: org.wiremock:wiremock-standalone dependency-version: 3.0.3 dependency-type: direct:development dependency-group: maven - dependency-name: org.wiremock:wiremock-standalone dependency-version: 3.0.3 dependency-type: direct:development dependency-group: maven - dependency-name: org.wiremock:wiremock-standalone dependency-version: 3.0.3 dependency-type: direct:development dependency-group: maven - dependency-name: org.wiremock:wiremock-standalone dependency-version: 3.0.3 dependency-type: direct:development dependency-group: maven - dependency-name: org.wiremock:wiremock-standalone dependency-version: 3.0.3 dependency-type: direct:development dependency-group: maven - dependency-name: org.bouncycastle:bcpkix-jdk18on dependency-version: '1.84' dependency-type: direct:production dependency-group: maven - dependency-name: org.bouncycastle:bcprov-jdk18on dependency-version: '1.84' dependency-type: direct:production dependency-group: maven - dependency-name: org.wiremock:wiremock-standalone dependency-version: 3.0.3 dependency-type: direct:development dependency-group: maven - dependency-name: org.bouncycastle:bcpkix-jdk18on dependency-version: '1.84' dependency-type: direct:production dependency-group: maven - dependency-name: org.bouncycastle:bcprov-jdk18on dependency-version: '1.84' dependency-type: direct:production dependency-group: maven ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Jul 10, 2026

dependabot Bot requested a review from a team as a code owner July 10, 2026 22:03

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Jul 10, 2026

dependabot Bot mentioned this pull request Jul 10, 2026

fix(deps): Bump the maven group across 8 directories with 4 updates #603

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): Bump the maven group across 8 directories with 4 updates#614

fix(deps): Bump the maven group across 8 directories with 4 updates#614
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/stream-compositions/services/maven-8a46584160

dependabot Bot commented on behalf of github Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 10, 2026

Apache ActiveMQ 6.2.6

What's Changed

New Contributors

Apache ActiveMQ 6.2.5

What's Changed

Apache ActiveMQ 6.2.6

What's Changed

New Contributors

Apache ActiveMQ 6.2.5

What's Changed

3.0.3 - Security Release

🔒 Security

🔗 Related releases

Credits

3.0.2

🐛 Bug fixes

👻 Maintenance

📦 Dependency updates

3.0.3 - Security Release

🔒 Security

🔗 Related releases

Credits

3.0.2

🐛 Bug fixes

👻 Maintenance

📦 Dependency updates

3.0.3 - Security Release

🔒 Security

🔗 Related releases

Credits

3.0.2

🐛 Bug fixes

👻 Maintenance

📦 Dependency updates

3.0.3 - Security Release

🔒 Security

🔗 Related releases

Credits

3.0.2

🐛 Bug fixes

👻 Maintenance

📦 Dependency updates

3.0.3 - Security Release

🔒 Security

🔗 Related releases

Credits

3.0.2

🐛 Bug fixes

👻 Maintenance

📦 Dependency updates

3.0.3 - Security Release

🔒 Security

🔗 Related releases

Credits

3.0.2

🐛 Bug fixes

👻 Maintenance

📦 Dependency updates

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants