FINERACT-2684: Update all non-major dependencies

[renovate-bot]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
actions/download-artifact	action	patch	v8.0.1 → v8.0.2
actions/setup-node	action	minor	v7.0.0 → v7.1.0
actions/upload-artifact	action	patch	v7.0.1 → v7.0.2
apache/kafka		minor	4.2.0-rc2 → 4.4.0-rc2
gradle (source)		minor	9.7.1 → 9.8.1
gradle/actions	action	minor	v6.3.0 → v6.4.0
localstack/localstack		minor	2.1 → 2.3
mariadb (source)		minor	12.2 → 12.3
postgres (source)	service	minor	18.3 → 18.6
tomcat (source)		patch	10.1.59-jdk25-temurin → 10.1.60-jdk25-temurin
at.yawk.lz4:lz4-java	devDependencies	minor	1.11.4 → 1.12.0
io.netty:netty-transport-native-unix-common (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-transport-classes-epoll (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-transport (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-resolver (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-handler-proxy (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-handler (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-codec-socks (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-codec-protobuf (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-codec-marshalling (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-codec-http2 (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-codec-http (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-codec-compression (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-codec-base (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-codec (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-common (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
io.netty:netty-buffer (source)	devDependencies	minor	4.1.138.Final → 4.2.19.Final
com.nimbusds:nimbus-jose-jwt	devDependencies	minor	10.9 → 10.10
org.apache.commons:commons-lang3 (source)	devDependencies	minor	3.20.0 → 3.21.0
io.cucumber:cucumber-spring (source)	devDependencies	patch	7.34.3 → 7.34.9
io.cucumber:cucumber-junit-platform-engine (source)	devDependencies	patch	7.34.3 → 7.34.9
io.cucumber:cucumber-java8 (source)	devDependencies	patch	7.34.3 → 7.34.9
io.cucumber:cucumber-java (source)	devDependencies	patch	7.34.3 → 7.34.9
org.apache.sshd:sshd-core (source)	devDependencies	minor	2.17.1 → 2.20.0
org.apache.sshd:sshd-common (source)	devDependencies	minor	2.17.1 → 2.20.0
org.postgresql:postgresql (source)	devDependencies	patch	42.7.13 → 42.7.14
org.mariadb.jdbc:mariadb-java-client (source)	devDependencies	patch	3.5.8 → 3.5.10
org.apache.avro:avro (source)	devDependencies	patch	1.12.1 → 1.12.2
io.rest-assured:xml-path (source)	devDependencies	minor	6.0.1 → 6.1.0
io.rest-assured:json-path (source)	devDependencies	minor	6.0.1 → 6.1.0
io.rest-assured:rest-assured (source)	devDependencies	minor	6.0.1 → 6.1.0
org.hibernate.validator:hibernate-validator (source)	devDependencies	patch	9.1.0.Final → 9.1.4.Final
io.swagger.core.v3:swagger-core-jakarta	devDependencies	patch	2.2.49 → 2.2.55
io.swagger.core.v3:swagger-jaxrs2-jakarta	devDependencies	patch	2.2.49 → 2.2.55
io.swagger.core.v3:swagger-annotations-jakarta	devDependencies	patch	2.2.49 → 2.2.55
org.apache.activemq:activemq-client (source)	devDependencies	minor	6.2.5 → 6.3.2
org.springdoc:springdoc-openapi-starter-webmvc-ui (source)	devDependencies	minor	3.0.3 → 3.1.1
org.apache.maven:maven-artifact (source)	devDependencies	minor	3.9.16 → 3.10.0
org.eclipse.jgit:org.eclipse.jgit.ssh.apache	devDependencies	minor	7.6.0.202603022253-r → 7.8.0.202609011348-r
org.eclipse.jgit:org.eclipse.jgit.gpg.bc	devDependencies	minor	7.6.0.202603022253-r → 7.8.0.202609011348-r
org.eclipse.jgit:org.eclipse.jgit	devDependencies	minor	7.6.0.202603022253-r → 7.8.0.202609011348-r
org.bouncycastle:bcpg-jdk18on (source)	devDependencies	minor	1.84 → 1.86
org.bouncycastle:bcutil-jdk18on (source)	devDependencies	minor	1.84 → 1.86
org.bouncycastle:bcprov-jdk18on (source)	devDependencies	minor	1.84 → 1.86
org.bouncycastle:bcpkix-jdk18on (source)	devDependencies	minor	1.84 → 1.86
org.projectlombok:lombok (source)	devDependencies	patch	1.18.46 → 1.18.48
commons-codec:commons-codec (source)	devDependencies	minor	1.22.0 → 1.23.0
org.mock-server:mockserver-junit-jupiter (source)	devDependencies	minor	5.14.0 → 5.15.0
com.github.spotbugs:spotbugs-annotations (source)	devDependencies	minor	4.9.8 → 4.10.5
io.github.classgraph:classgraph	devDependencies	patch	4.8.184 → 4.8.198
joda-time:joda-time (source)	devDependencies	minor	2.14.2 → 2.15.0
org.apache.tika:tika-parser-image-module (source)	devDependencies	patch	3.3.0 → 3.3.2
org.cyclonedx.bom	plugin	minor	3.4.1 → 3.5.1
com.gradleup.shadow	plugin	minor	9.4.1 → 9.6.1
org.openapi.generator	plugin	minor	7.22.0 → 7.26.0
org.apache.tika:tika-parser-microsoft-module (source)	devDependencies	patch	3.3.0 → 3.3.2
com.github.spotbugs	plugin	patch	6.5.4 → 6.5.12
com.github.andygoossens.modernizer	plugin	minor	1.13.0 → 1.15.0
io.swagger.core.v3.swagger-gradle-plugin	plugin	patch	2.2.49 → 2.2.55
org.springframework.boot	plugin	patch	4.1.0 → 4.1.1
org.zeroturnaround.gradle.jrebel	plugin	patch	1.2.2 → 1.2.3
org.nosphere.apache.rat	plugin	minor	0.8.1 → 0.11.0
org.apache.tika:tika-parser-miscoffice-module (source)	devDependencies	patch	3.3.0 → 3.3.2
com.diffplug.spotless	plugin	patch	8.10.2 → 8.10.4
org.barfuin.gradle.taskinfo	plugin	minor	3.0.2 → 3.1.0
org.apache.tika:tika-core (source)	devDependencies	patch	3.3.0 → 3.3.2
com.github.librepdf:openpdf	devDependencies	patch	3.0.4 → 3.0.5
software.amazon.msk:aws-msk-iam-auth (source)	devDependencies	patch	2.3.6 → 2.3.9
org.apache.commons:commons-collections4 (source)	devDependencies	minor	4.5.0 → 4.6.0
com.google.googlejavaformat:google-java-format	devDependencies	minor	1.35.0 → 1.37.0
com.google.guava:guava	devDependencies	minor	33.6.0-jre → 33.7.2-jre
ch.qos.logback:logback-classic (source, changelog)	devDependencies	minor	1.5.35 → 1.6.5
ch.qos.logback:logback-core (source, changelog)	devDependencies	minor	1.5.35 → 1.6.5
org.glassfish.jersey:jersey-bom (source)	devDependencies	patch	4.0.2 → 4.0.3
software.amazon.awssdk:bom	devDependencies	minor	2.44.4 → 2.55.14
org.mockito:mockito-bom	devDependencies	minor	5.23.0 → 5.24.0
io.cucumber:cucumber-bom (source)	devDependencies	patch	7.34.3 → 7.34.9
org.junit:junit-bom (source)	devDependencies	minor	6.0.3 → 6.1.3
org.jetbrains.kotlin:kotlin-bom (source)	devDependencies	minor	2.3.21 → 2.4.21
io.opentelemetry:opentelemetry-bom	devDependencies	minor	1.62.0 → 1.67.0
io.awspring.cloud:spring-cloud-aws-dependencies (source)	devDependencies	minor	4.0.2 → 4.2.0
org.springframework.boot:spring-boot-dependencies (source)	devDependencies	patch	4.1.0 → 4.1.1
io.micrometer:micrometer-bom	devDependencies	minor	1.16.5 → 1.17.1
org.slf4j:slf4j-bom (source, changelog)	devDependencies	patch	2.0.17 → 2.0.20
io.qameta.allure	plugin	minor	4.1.0 → 4.3.0

---

Release Notes

actions/download-artifact (actions/download-artifact)

v8.0.2

Compare Source

What's Changed

• Update the readme by @​danwkennedy in #​473
• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Update @​actions/artifact to 6.3.1 by @​tunc-d in #​492
• Prepare download-artifact v8.0.2 by @​tunc-d in #​493

New Contributors

• @​tunc-d made their first contribution in #​492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

actions/setup-node (actions/setup-node)

v7.1.0

Compare Source

What's Changed

Enhancements:

• Add support for mise.toml file by @​gperdomor in #​1421
• Support absolute paths in node-version-file by @​v-mahabaleshwars in #​1633

Bug fixes:

• Add Node version validation and manifest fetch retry by @​v-jitenderpalsingh in #​1580

Documentation updates:

• README.md: bump actions/checkout to latest version 7 by @​deining in #​1578
• docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by @​v-gowridurgad in #​1593
• Fixed cache recommendation syntax by @​SubJunk in #​1603

Dependency updates:

• Update workflow pins and migrate Node matrices to modern versions by @​v-HarithaVattikuti in #​1583
• Upgrade @​actions/cache to 6.2.0 by @​philip-gai in #​1584
• Pin @​types/node to v24 by @​v-priyagupta108 in #​1585
• Override brace-expansion to 5.0.8 by @​v-priyagupta108 with @​Copilot in #​1599
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in #​1598
• Upgrade prettier from 3.8.4 to 3.9.6 by @​dependabot in #​1590
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in #​1610
• Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by @​dependabot in #​1602
• Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by @​dependabot in #​1629
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in #​1616
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in #​1615
• Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by @​dependabot in #​1631
• Upgrade jest-each from 30.4.1 to 30.5.2 by @​dependabot in #​1636
• Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by @​dependabot in #​1638
• Update dependencies and add license files by @​v-HarithaVattikuti in #​1642
• Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by @​dependabot in #​1635

New Contributors

• @​v-jitenderpalsingh made their first contribution in #​1580
• @​philip-gai made their first contribution in #​1584
• @​gperdomor made their first contribution in #​1421
• @​SubJunk made their first contribution in #​1603

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

actions/upload-artifact (actions/upload-artifact)

v7.0.2

Compare Source

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in #​821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

apache/kafka (apache/kafka)

v4.3.1

Compare Source

v4.3.0

Compare Source

gradle/gradle (gradle)

v9.8.1: 9.8.1

Compare Source

This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.

This release addresses three high rated vulnerabilities:

• Unauthenticated worker-to-daemon channel deserializes untrusted Java objects
• Deserialization of untrusted Java objects before authentication in the client - daemon communication
• Failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts

The following issues were resolved:

• [Gradle 9.8.0 complains again about invalid Toolchains on Debian / Ubuntu packaged systems]- (#​39358)
• Gradle 9.8.0 removes root java.util.logging handlers installed by a custom LogManager (breaks Quarkus test log capture)
• Dependency resolution regression

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
Aman Gautam,
Björn Kautler,
Eng Zer Jun,
Hashim Khan,
Julian Krannich,
KBS,
Labh R Jethe,
Mark Dodgson,
Maxim,
monkey,
nataphon-ktsystems,
Paul King,
Qiu Tian,
rg_sandesh,
Roberto Perez Alcolea,
Sean,
Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

v9.8.0: 9.8.0

Compare Source

The Gradle team is excited to announce Gradle 9.8.0.

Here are the highlights of this release:

• Java 27 support
• Maven mirror settings reuse
• Linked problem locations in build output

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
Aman Gautam,
Björn Kautler,
Eng Zer Jun,
Hashim Khan,
Julian Krannich,
KBS,
Labh R Jethe,
Mark Dodgson,
Maxim,
monkey,
nataphon-ktsystems,
Paul King,
Qiu Tian,
rg_sandesh,
Roberto Perez Alcolea,
Sean,
Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.0 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.0 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

gradle/actions (gradle/actions)

v6.4.0

Compare Source

Highlights

Gradle version support status in the Job Summary

The actions now report the support status of every Gradle version used in a workflow, as job
annotations and in the Job Summary (#​1057). Thanks to @​ov7a for the contribution.

version kind	job annotation	version table	below the table
End-of-life — two or more major versions behind the latest release	warning	⚠️	expandable section naming the affected release lines, pointing at the Gradle Security Subscription
Out of date — one major behind, or more than two minors behind on the current major	notice	ℹ️	one-line legend pointing at the Gradle release lifecycle docs
Current	none	—	—

Deliberately not reported: patch releases (being on 9.7.0 when 9.7.1 exists is not flagged) and
pre-releases (release candidates, milestones and snapshots never produce annotations). The latest
Gradle release is determined from the wrapper checksum data already bundled with the action, so no
network access is required.

Note that these annotations are emitted independently of the add-job-summary setting: setting
add-job-summary: 'never' suppresses the Job Summary itself, but the warning and notice annotations
remain.

Gradle itself is now reported in the dependency graph

The dependency-submission action now applies v1.5.0 of the
GitHub Dependency Graph Gradle Plugin
(up from v1.4.2) (#​1069).

The headline change is that the Gradle Build Tool running the build is now reported as an
org.gradle:gradle-core dependency, so that GitHub can surface known vulnerabilities in the version
of Gradle used to run your build. These are the coordinates that GitHub advisories for the Gradle
Build Tool are published against.

Details worth knowing:

• The entry is always reported as a direct dependency with development scope.
• It is not affected by the project, configuration or scope filters, so it appears even in graphs
  that filter aggressively.
• Expect dependency graphs to gain this one new entry the first time a build runs after upgrading.

A new Gradle signing key, if you use dependency verification

[!IMPORTANT]
If your build has dependency verification
enabled, you must add a second trusted key before upgrading, or Dependency Graph generation will
fail signature verification.

github-dependency-graph-gradle-plugin 1.5.0 is signed with a new Gradle signing subkey, and the
key previously documented in our setup guide has been revoked upstream:

Artifact	Signing key
org.gradle:github-dependency-graph-gradle-plugin 1.5.0 and later	`E2879931BCA1A42E55F2D64DD9B2DFBD9

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.