Bump the minor-and-patch group across 1 directory with 11 updates

[dependabot]

Bumps the minor-and-patch group with 11 updates in the / directory:

Package	From	To
jakarta.servlet:jakarta.servlet-api	6.0.0	6.1.0
org.glassfish.jersey.connectors:jersey-apache-connector	3.1.11	3.1.12
commons-codec:commons-codec	1.22.0	1.22.1
com.atomgraph.etl.csv:csv2rdf	2.2.0	2.2.1
org.apache.jena:jena-shacl	6.1.0	6.2.0
org.apache.jena:jena-arq	6.1.0	6.2.0
com.auth0:java-jwt	4.5.2	4.6.0
org.jsoup:jsoup	1.22.2	1.23.1
org.junit.jupiter:junit-jupiter	6.1.0	6.1.2
org.sonatype.central:central-publishing-maven-plugin	0.10.0	0.11.0
com.github.eirslett:frontend-maven-plugin	2.0.0	2.0.2

Updates jakarta.servlet:jakarta.servlet-api from 6.0.0 to 6.1.0

Commits

• fe6e12a Prepare release jakarta.servlet:servlet-parent:6.1.0
• b09f123 Add missing JARs to webapp - Part of fix for #638
• e93b9bf Remove unused code. Part of fix for #638
• 04ad5c7 Update copyright date used in Javadoc footer
• 3154612 Remove text incorrectly added when originally addressing #18
• 314c6ed Revert Dependabot's JRuby update - it breaks the spec build
• 28a4bbe ---
• 7a912a8 ---
• 72d4380 ---
• f203652 Merge pull request #635 from jakartaee/dependabot/maven/org.apache.maven.plug...
• Additional commits viewable in compare view

Updates org.glassfish.jersey.connectors:jersey-apache-connector from 3.1.11 to 3.1.12

Updates commons-codec:commons-codec from 1.22.0 to 1.22.1

Changelog

Sourced from commons-codec:commons-codec's changelog.

Apache Commons Codec 1.22.1 Release Notes

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.22.1.

The Apache Commons Codec component contains encoders and decoders for formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

Fixed Bugs

• CODEC-344: Base64.Builder.setEncodeTable(byte...) accepts invalid custom alphabets. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-340: Base58.Builder.setEncodeTable(byte...) is ignored when encoding and decoding. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-342: Base32.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-343: Base32.Builder.setHexDecodeTable(boolean) sets the encode table to a decode lookup table. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-341: Base16.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-339: URLCodec.encodeUrl(BitSet, byte[]) allows custom safe sets to emit URL encoding control characters. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-338: PercentCodec loses literal '+' when plusForSpace is enabled. Thanks to Ruiqi Dong, Gary Gregory.
• CODEC-337: Digest ALL reuses System.in, so only the first algorithm sees the real input (#431). Thanks to Ruiqi Dong, Gary Gregory.

•         Fix Base64.toIntegerBytes(BigInteger) for zero edge case ([#441](https://github.com/apache/commons-codec/issues/441)). Thanks to Gary Gregory.
  

•         Add messages when throwing NullPointerException. Thanks to Gary Gregory.
  

•         Add messages when throwing NullPointerException. Thanks to Gary Gregory.
  

•         StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails fast on null input. Thanks to Gary Gregory.
  

Changes

•         Bump org.apache.commons:commons-parent from 98 to 103. Thanks to Gary Gregory.
  

•         Bump commons-io:commons-io from 2.21.0 to 2.22.0. Thanks to Gary Gregory.
  

For complete information on Apache Commons Codec, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Commons Codec website:

https://commons.apache.org/proper/commons-codec/

Download page: https://commons.apache.org/proper/commons-codec/download_codec.cgi

---

Commits

• dc8f6c8 Prepare for the release candidate 1.22.1 RC1
• 8203c1c Prepare for the next release candidate
• 5647fe2 StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails
• 00c27a9 Reduce vertical whitespace
• 568f2d7 Remove unused method
• 316fb15 Remove unused method
• bf6b543 Bump actions/checkout from 7.0.0 to 7.0.1
• e14cdfe Extract redundant code.
• 3351e63 Add messages when throwing NullPointerException.
• f22dab7 Update SCM tag
• Additional commits viewable in compare view

Updates com.atomgraph.etl.csv:csv2rdf from 2.2.0 to 2.2.1

Commits

• 35daf4c [maven-release-plugin] prepare release csv2rdf-2.2.1
• 4ede2b2 Merge pull request #10 from AtomGraph/rf-dependency-bumps
• f69373b More bumps
• 594c936 [maven-release-plugin] prepare for next development iteration
• See full diff in compare view

Updates org.apache.jena:jena-shacl from 6.1.0 to 6.2.0

Updates org.apache.jena:jena-arq from 6.1.0 to 6.2.0

Updates com.auth0:java-jwt from 4.5.2 to 4.6.0

Release notes

Sourced from com.auth0:java-jwt's releases.

4.6.0

Added

• feat: Add PS256 Support #788 (tanya732)
• Report out-of-range NumericDate claims distinctly from non-numeric ones #774 (arpitjain099)

Changelog

Sourced from com.auth0:java-jwt's changelog.

4.6.0 (2026-07-13)

Full Changelog

Added

• feat: Add PS256 Support #788 (tanya732)
• Report out-of-range NumericDate claims distinctly from non-numeric ones #774 (arpitjain099)

Commits

• 8920eed Release 4.6.0 (#789)
• 0525762 feat: Add PS256 Support (#788)
• 46e8373 chore: Migrate RL Scanner to usable actions (#784)
• bfd041f chore: Triage Dependabot PRs (#783)
• f720a21 Report out-of-range NumericDate claims distinctly from non-numeric ones (#774)
• 181dc51 Report out-of-range NumericDate claims distinctly from non-numeric ones
• See full diff in compare view

Updates org.jsoup:jsoup from 1.22.2 to 1.23.1

Release notes

Sourced from org.jsoup:jsoup's releases.

jsoup 1.23.1

jsoup Java HTML Parser release 1.23.1

jsoup 1.23.1 is out now, with a faster and more memory-efficient HTML parser, improved alignment with the HTML standard across noscript, CDATA, SVG, and MathML parsing, and safer, specification-correct HTTP redirects. The release also adds a fast immutable Element#classList(), direct outer-HTML output to an Appendable, and fixes across RCDATA parsing, XML conversion, tag-name handling, and Cleaner link detection.

Performance optimization was a major focus for this release. In our OpenJDK 21 benchmarks, ordinary string parsing is now 18% faster on average, parsing from an InputStream is 11% faster, and parsing with source position tracking is 70% faster while allocating 64% fewer bytes per document.

Source-tracked DOMs retain 58-65% less memory on representative medium-to-large documents, and the improvements hold under concurrent parsing without introducing new contention. Exact gains will naturally vary with document shape, JVM, and hardware.

This release also fixes a security issue in the Cleaner that could expose markup when malformed HTML is cleaned with a custom Safelist permitting certain raw-text elements. The built-in Safelists are unaffected.

jsoup is a Java library for working with real-world HTML and XML. It provides a very convenient API for extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors.

Download jsoup now.

Improvements

• Reduced retained memory when parsing with source position tracking enabled (Parser#setTrackPosition(true)). Source ranges are now stored in compact parser-owned span records instead of node and attribute user data, and Position objects are created lazily when source ranges are read. This cuts tracked DOM retained size by about 50-60% on representative benchmark documents, while keeping Node#sourceRange(), Element#endSourceRange(), and Attribute#sourceRange() behavior intact. #2498
• Added Element#classList(), an immutable snapshot of an element's class names in attribute order. Use hasClass() when you just need to test for one class, classList() when you want to read or iterate classes without needing a mutable result, and classNames() when you want the existing mutable, deduplicated set that can be written back with classNames(Set). The class APIs now share an HTML-whitespace scanner, which also makes classNames() faster and lighter on allocation, especially when walking many elements without class names. #2500
• Aligned HTML parser scope classification with the current HTML spec for select, foreignObject, and template. #2501
• Simplified the HTML tree builder's scope, implied-end-tag, and special-element checks by caching parser-only options on Tag. That improves HTML parser throughput by about 10% on small inputs and up to about 30% on larger inputs in the benchmark fixtures. #2502
• Improved HTML parser throughput stability by making hot tokeniser scan paths compile more predictably. #2507
• <noscript> fallback markup is now parsed into an inspectable DOM subtree in both the document head and body. The fallback acts as a contained parsing island, so malformed markup cannot disrupt the surrounding document structure, while normal HTML tokenization still applies within it. This also improves round-trip serialization. #2537
• Improved redirect credential handling as a defense-in-depth measure: explicit authorization headers and request cookies are no longer forwarded across origins, reducing exposure through open redirects and aligning with HTTP guidance. Cookies managed by a CookieStore continue to follow their configured scope. #2540
• Elements can now append their outer HTML, including their own tags, directly to an Appendable with Node#outerHtml(Appendable), without first creating a String. This complements Element#html(Appendable), which appends inner HTML only. #2532
• Aligned CDATA tokenization with the HTML spec: CDATA syntax in HTML content is parsed as a bogus comment, while it remains supported in SVG, MathML, and XML. Also improved namespace-aware fragment parsing so SVG and MathML contexts, HTML integration points, and context-sensitive tokenizer states are handled correctly. #2542
• When using the optional re2j regular expression engine, stack overflows caused by complex selector patterns are now normalized to a ValidationException with a Pattern complexity error message. #2548

Bug Fixes

• Fixed HTML parsing of mixed-case RCDATA end tags after tag-shaped text. For example, <title><p>Foo</TiTLE> and <textarea><img src=x></TeXtArEa> now keep the tag-shaped content as text instead of promoting it to markup. #2503
• Fixed W3CDom XML conversion so plain XML elements don't serialize with the reserved XML namespace as the default namespace. Explicit XML namespaces and xml:* attributes are still preserved. #2504
• Preserve control characters in parsed tag names #2538
• Updated HTTP redirects to follow the specification: 307 and 308 preserve the request method and content, 301 and 302 only change POST to GET, and Location is followed only for 301, 302, 303, 307, and 308 responses. Streamed request bodies are not buffered; if an automatic redirect requires replaying one, execution fails, so the caller can resend with a fresh stream. #2540
• Corrected the Cleaner's same-site link detection to compare hostnames rather than URL prefixes when applying rel=nofollow. #2543

Build Changes

• Cleaned up the Maven build for the multi-release JAR so Java 8 and Java 11+ sources compile as separate source sets. This avoids spurious Java 8 compiler warnings from newer-language overlay sources, keeps long-running parser checks behind an explicit profile, and preserves the same published artifacts and runtime behavior.
• Improved parallelism and tuned timing in our integration tests, so that a full mvn clean verify drops from ~ 1m18s to ~ 21 seconds.

---

My sincere thanks to everyone who contributed to this release! If you have any suggestions for the next release, I would love to hear them; please get in touch via jsoup discussions, or with me directly.

You can also follow me (@jhy@tilde.zone) on Mastodon / Fediverse to receive occasional notes about jsoup releases.

Changelog

Sourced from org.jsoup:jsoup's changelog.

1.23.1 (2026-Jul-30)

Improvements

• Reduced retained memory when parsing with source position tracking enabled (Parser#setTrackPosition(true)). Source ranges are now stored in compact parser-owned span records instead of node and attribute user data, and Position objects are created lazily when source ranges are read. This cuts tracked DOM retained size by about 50-60% on representative benchmark documents, while keeping Node#sourceRange(), Element#endSourceRange(), and Attribute#sourceRange() behavior intact. #2498
• Added Element#classList(), an immutable snapshot of an element's class names in attribute order. Use hasClass() when you just need to test for one class, classList() when you want to read or iterate classes without needing a mutable result, and classNames() when you want the existing mutable, deduplicated set that can be written back with classNames(Set). The class APIs now share an HTML-whitespace scanner, which also makes classNames() faster and lighter on allocation, especially when walking many elements without class names. #2500
• Aligned HTML parser scope classification with the current HTML spec for select, foreignObject, and template. #2501
• Simplified the HTML tree builder's scope, implied-end-tag, and special-element checks by caching parser-only options on Tag. That improves HTML parser throughput by about 10% on small inputs and up to about 30% on larger inputs in the benchmark fixtures. #2502
• Improved HTML parser throughput stability by making hot tokeniser scan paths compile more predictably. #2507
• <noscript> fallback markup is now parsed into an inspectable DOM subtree in both the document head and body. The fallback acts as a contained parsing island, so malformed markup cannot disrupt the surrounding document structure, while normal HTML tokenization still applies within it. This also improves round-trip serialization. #2537
• Improved redirect credential handling as a defense-in-depth measure: explicit authorization headers and request cookies are no longer forwarded across origins, reducing exposure through open redirects and aligning with HTTP guidance. Cookies managed by a CookieStore continue to follow their configured scope. #2540
• Elements can now append their outer HTML, including their own tags, directly to an Appendable with Node#outerHtml(Appendable), without first creating a String. This complements Element#html(Appendable), which appends inner HTML only. #2532
• Aligned CDATA tokenization with the HTML spec: CDATA syntax in HTML content is parsed as a bogus comment, while it remains supported in SVG, MathML, and XML. Also improved namespace-aware fragment parsing so SVG and MathML contexts, HTML integration points, and context-sensitive tokenizer states are handled correctly. #2542
• When using the optional re2j regular expression engine, stack overflows caused by complex selector patterns are now normalized to a ValidationException with a Pattern complexity error message. #2548

Bug Fixes

• Fixed HTML parsing of mixed-case RCDATA end tags after tag-shaped text. For example, <title><p>Foo</TiTLE> and <textarea><img src=x></TeXtArEa> now keep the tag-shaped content as text instead of promoting it to markup. #2503
• Fixed W3CDom XML conversion so plain XML elements don't serialize with the reserved XML namespace as the default namespace. Explicit XML namespaces and xml:* attributes are still preserved. #2504
• Preserve control characters in parsed tag names #2538
• Updated HTTP redirects to follow the specification: 307 and 308 preserve the request method and content, 301 and 302 only change POST to GET, and Location is followed only for 301, 302, 303, 307, and 308 responses. Streamed request bodies are not buffered; if an automatic redirect requires replaying one, execution fails, so the caller can resend with a fresh stream. #2540
• Corrected the Cleaner's same-site link detection to compare hostnames rather than URL prefixes when applying rel=nofollow. #2543

Build Changes

• Cleaned up the Maven build for the multi-release JAR so Java 8 and Java 11+ sources compile as separate source sets. This avoids spurious Java 8 compiler warnings from newer-language overlay sources, keeps long-running parser checks behind an explicit profile, and preserves the same published artifacts and runtime behavior.
• Improved parallelism and tuned timing in our integration tests, so that a full mvn clean verify drops from ~ 1m18s to ~ 21 seconds.

Commits

• bb077a8 [maven-release-plugin] prepare release jsoup-1.23.1
• cdb5579 Harden the test some
• b86b282 Normalize re2j complexity exceptions
• 0fcc369 Bump github/codeql-action from 4.37.0 to 4.37.1
• aea4a1b Bump actions/setup-java from 5.5.0 to 5.6.0
• ec9c879 Bump actions/checkout from 7.0.0 to 7.0.1
• 1fb2c97 Fix KeyVal.inputStream validation
• 3475afc Handle non-string internal attribute values; test for internal attribute data
• be8c375 Parse CDATA according to the context namespace
• 8996fce Add appendable outer HTML output
• Additional commits viewable in compare view

Updates org.junit.jupiter:junit-jupiter from 6.1.0 to 6.1.2

Release notes

Sourced from org.junit.jupiter:junit-jupiter's releases.

JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.1...r6.1.2

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

Commits

• b685426 Release 6.1.2
• ae244a6 Remove blanket outputDirectoryCreator from SuiteEngineTests (#5793)
• 43bd154 Finalize 6.1.2 release notes
• 0cd9510 Fix order of release note sections
• a1507cb Add initial 6.1.2 release notes to release notes index
• 9326641 Fix NoTestsDiscoveredException for suites containing only dynamic tests (#5839)
• 2ef1123 Create initial 6.1.2 release notes from template
• 83fa9ab Back to snapshots for further development
• 0d85889 Release 6.1.1
• 0363eee Finalize 6.1.1 release notes
• Additional commits viewable in compare view

Updates org.sonatype.central:central-publishing-maven-plugin from 0.10.0 to 0.11.0

Commits

• See full diff in compare view

Updates com.github.eirslett:frontend-maven-plugin from 2.0.0 to 2.0.2

Changelog

Sourced from com.github.eirslett:frontend-maven-plugin's changelog.

frontend-maven-plugin

Last public release:

Changelog

2.0.1

• Use pnpm .mjs file if it exists to support 11+ (#1224)

Commits

• a4c283d [maven-release-plugin] prepare release frontend-plugins-2.0.2
• dbe9454 Revert "Fix pnpm broken symlink replacement"
• ed2baed Logging OS command call errors at ERROR level
• fdfc922 Bump vite in /frontend-maven-plugin/src/it/example project
• fb39d07 Fix pnpm broken symlink replacement
• 358056a Bump ws in /frontend-maven-plugin/src/it/example project
• b3b0f3f Bump postcss in /frontend-maven-plugin/src/it/example project
• e72313f 1201: Added bunDownloadRoot
• 9238eb8 Bump com.fasterxml.jackson.core:jackson-databind
• d22cf33 Bump com.fasterxml.jackson.core:jackson-core in /frontend-plugin-core
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions