[dependabot]

Bumps the dependencies group with 2 updates in the / directory: com.diffplug.spotless and com.gradle:develocity-gradle-plugin.

Updates com.diffplug.spotless from 8.10.4 to 8.11.0

Updates com.gradle:develocity-gradle-plugin from 4.4.1 to 4.6.1

Bumps the dependencies group with 6 updates in the /core directory:

Package	From	To
com.google.guava:guava	33.3.1-jre	33.8.0-jre
org.yaml:snakeyaml	2.6	2.7
org.junit.platform:junit-platform-launcher	1.14.3	1.14.4
org.junit.jupiter:junit-jupiter	5.13.4	5.14.4
redis.clients:jedis	7.4.1	8.0.2
com.rabbitmq:amqp-client	5.35.0	5.37.0

Updates com.google.guava:guava from 33.3.1-jre to 33.8.0-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.8.0

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.8.0-jre</version>
  <!-- or, for Android: -->
  <version>33.8.0-android</version>
</dependency>

Jar files

• 33.8.0-jre.jar
• 33.8.0-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.8.0-jre
• 33.8.0-android

JDiff

• 33.8.0-jre vs. 33.7.2-jre
• 33.8.0-android vs. 33.7.2-android
• 33.8.0-android vs. 33.8.0-jre

Changelog

• collect: Enhanced HashBiMap and LinkedHashMultimap.ValueSet to defend against hash flooding (forthcoming CVE-2026-118042). (7cd44b3506)
• collect: Accidentally changed a few methods in ForwardingMap.StandardValues to be final. No Google-internal or GitHub-public code appears to be affected, but we will fix this in the next release. If it causes you problems, let us know.
• net: Added MediaType.APPLICATION_GZIP (application/gzip) to be used in preference to GZIP (application/x-gzip). (6393ebbdb6)
• primitives: Added Doubles.MIN_POSITIVE_VALUE and Floats.MIN_POSITIVE_VALUE as more clearly named aliases for Double.MIN_VALUE and Float.MIN_VALUE. (adf5554e7e)
• testlib: Added AbstractClassInitializationTest. (80fd5c114d)
• and, among the usual changes, a larger than usual number of small fixes (4afb1e04a4246c261be4742e1f2e2c39ebaf6266, 79152348ece2de85559eb2eb18133862d492c892, a279b884fe9890a3869142919352156f2a67a705, 786bb1a9b44685875ebe7b83f1404a1f07ac653c, 6b3a8d7498a7fde122967ba37a023ba3dcb47792, de57a419b56bcd887f51bb99103d91c65b7c5e86, fa64cc7c2b320aca9219981952bbb544f8f6ccff, 7b64964048948de3b5633a75d6e64f98cf8fcece, 5ae56d77e64305752b919ff2c96713f47ac0c94c, 37535d73f0416f30e0301efe61a8eb8ede44c1b7, ca8aedb2fdaf40fd6937a0643180aea51ca4154e, c0a8a1edc69393e8141424037571d9825f5fc0f4, 51246d06bb85ccc182a0aeb6a7adcbd55f759ae5, 81c7d030f8f144a4885ccf8efdc72c92605b4eec, 2b86a8216627a807ce8520abc6ae55437dbb85fb, 669a232b4e20ae6e8bc6efc62caaf2f830d56327, b157643c41f9ee6a38732b4fa1a590ba187912d9, ad73fbb9beff220aa26390630724855ef92fc50b, 1e6eb68f2ee8dc6cb164c285f7fe6ad5e8bc0905, 3d5be86651ec58b3f9d15c76cf888ade15aba39b)

33.7.2

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.2-jre</version>
</tr></table> 

... (truncated)

Commits

• See full diff in compare view

Updates org.yaml:snakeyaml from 2.6 to 2.7

Updates org.junit.platform:junit-platform-launcher from 1.14.3 to 1.14.4

Commits

• See full diff in compare view

Updates org.junit.jupiter:junit-jupiter from 5.13.4 to 5.14.4

Release notes

Sourced from org.junit.jupiter:junit-jupiter's releases.

JUnit 5.14.4 = Platform 1.14.4 + Jupiter 5.14.4 + Vintage 5.14.4

See Release Notes.

Full Changelog: junit-team/junit-framework@r5.14.3...r5.14.4

JUnit 5.14.3 = Platform 1.14.3 + Jupiter 5.14.3 + Vintage 5.14.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r5.14.2...r5.14.3

JUnit 5.14.2 = Platform 1.14.2 + Jupiter 5.14.2 + Vintage 5.14.2

See Release Notes.

New Contributors

• @​uglide made their first contribution in junit-team/junit-framework#5245

Full Changelog: junit-team/junit-framework@r5.14.1...r5.14.2

JUnit 5.14.1 = Platform 1.14.1 + Jupiter 5.14.1 + Vintage 5.14.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r5.14.0...r5.14.1

JUnit 5.14.0 = Platform 1.14.0 + Jupiter 5.14.0 + Vintage 5.14.0

See Release Notes.

Full Changelog: junit-team/junit-framework@r5.13.4...r5.14.0

JUnit 5.14.0-RC1 = Platform 1.14.0-RC1 + Jupiter 5.14.0-RC1 + Vintage 5.14.0-RC1

See Release Notes.

Full Changelog: junit-team/junit-framework@r5.13.4...r5.14.0-RC1

Commits

• 096fd69 Release 5.14.4
• 11fd02b Remove JDK 24 (EOL)
• 5b7f023 Fix integration tests on JDK 27
• 18f842a Test against JDK 26 (GA) and JDK 27 (EA)
• a5bf336 Polish 5.14.4 release notes
• 7667c14 Fix race condition in NodeTestTask (#5427)
• ac01f2d Include full display name in legacy XML reports (#5524)
• fbd4a8e Include class template invocation index in legacy reporting names
• 7d6f0c0 Only check PDF for GA releases
• 14f534d Test 5.14.x against JDK 25 ga (#5623)
• Additional commits viewable in compare view

Updates redis.clients:jedis from 7.4.1 to 8.0.2

Release notes

Sourced from redis.clients:jedis's releases.

8.0.2

Jedis 8.0.2 is a maintenance release for the 8.0 line, fixing MultiDbClient failover so it recovers to a healed database and keeps health checks running when no failover candidate is available.

Changes

🐛 Bug Fixes

• Fail over to a recovered database when the active one is inoperable (#4774)
• Keep MultiDbClient health checks alive when failover has no candidate (#4759)

🧰 Maintenance

• Document that automatic recovery is not guaranteed after the permanent failure (#4776)
• Update failover.md and some javadoc (#4772)

Contributors

We'd like to thank all the contributors who worked on this release!

@​ggivo

Full Changelog: redis/jedis@v8.0.1...v8.0.2

8.0.1

Jedis 8.0.1 is a maintenance release for the 8.0 line, fixing stale cluster topology after failover in JedisCluster.

Changes

🐛 Bug Fixes

• Refresh primaryNodesCache in JedisClusterInfoCache.discoverClusterSlots (#4692, backported in #4694)

Contributors

We'd like to thank all the contributors who worked on this release!

@​insaf021

Full Changelog: redis/jedis@v8.0.0...v8.0.1

8.0.0

Jedis 8.0.0 completes the client class consolidation started in 7.0.0, modernizes protocol defaults, tightens security defaults, and adds command coverage for Redis 8.8 and the Redis 8.10 preview.

• RESP3 auto-negotiation on by default for all UnifiedJedis-based clients (with graceful RESP2 fallback)
• Final removal of legacy JedisPooled / JedisSentineled classes in favor of the RedisClient family introduced in 7.0.0
• Removal of deprecated UnifiedJedis public constructors
• Internal refactoring that affects users of low-level extension points (custom CommandExecutor, Transaction subclasses, ClusterPipeline, CommandObjects) — protocol and connection wiring is now explicit at construction time
• Search modernization — the low-level cursor APIs are superseded by ftAggregateIterator(), and the manual broadcast API is removed (Redis 8.0+ broadcasts FT.CREATE server-side)
• TLS hostname verification enforced by default in DefaultJedisSocketFactory
• New Redis 8.8 command coverage — XNACK, JSON.SET FPHA, Array commands, INCREX, COUNT aggregator on ZINTER / ZUNION(STORE) and their *STORE variants, multi-aggregator TS.RANGE / TS.MRANGE, plus an experimental COLLECT parameter for FT.AGGREGATE
• Redis 8.10 command coverage — HIMPORT (Hinted Hash Templates), FT.ALIASLIST, MAXCOUNT / MAXSIZE on XREAD and XREADGROUP, SUNIONCARD / SDIFFCARD, LMOVEM / BLMOVEM, TS.READ, TS.NRANGE / TS.NREVRANGE, TS.QUERYLABELS, and EXCLUDEEMPTY on TS.MRANGE / TS.MREVRANGE

... (truncated)

Changelog

Sourced from redis.clients:jedis's changelog.

Release Process

Releases are drafted automatically by Release Drafter and deployed by the Release workflow when a draft is published.

Branches

Branch	Hosts	Example
master	next minor or major	8.1.0-SNAPSHOT
MAJOR.x	MAJOR.0.PATCH	7.x, 8.x
MAJOR.MINOR.x	MAJOR.MINOR.PATCH	7.5.x, 8.1.x

• Minor and major releases, including betas, are tagged on master.
• Patch releases are tagged on their maintenance branch, never on master.
• A maintenance branch is cut from the GA tag commit (8.1.x from v8.1.0).
• Fixes land on master first and are backported with a PR titled Backport #<pr> to <line>: <original title>, carrying the original labels.

How the draft is produced

On every push to master or a maintenance branch, Release Drafter updates one draft per branch:

• Version is derived from the nearest GA tag reachable from the branch, ignoring prerelease tags: patch bump on maintenance branches, minor bump on master. Example: 8.x at v8.0.1 drafts 8.0.2; master at v8.0.0 drafts 8.1.0.
• Changes are the pull requests merged to the branch since the latest GA release published from that branch. For the first patch after a branch is cut, the GA tag's commit date is used as the cutoff instead.
• Betas are prereleases and are not used as a base, so GA notes are cumulative since the previous GA.
• PRs labeled skip-changelog or churn are excluded. Unlabeled PRs appear uncategorized, so label backports.

Publishing

1. Review the draft on the Releases page and edit the notes if needed.
2. Publish from the draft. This keeps the release target on the right branch, which the next draft on that branch depends on. Do not create releases from the tag page.
3. For a patch of an older line, untick Set as the latest release.
4. Publishing creates the tag and triggers the Release workflow, which sets the Maven version from the tag and deploys to Maven Central.

Major releases and betas are not derived automatically. Run the workflow

... (truncated)

Commits

• eb8cd65 Backport #4777 to 8.0.x: Draft releases from maintenance branches (#4778)
• d18e256 Backport #4771 to 8.0.x: Document that automatic recovery is not guaranteed a...
• 53fecac Backport #4765 to 8.0.x: Fail over to a recovered database when the active on...
• b7f5067 Backport #4745 to 8.0.x: Update failover.md and some javadoc (#4772)
• af815c5 Backport #4756 to 8.0.x: Keep MultiDbClient health checks alive when failover...
• 96450d3 Bump snapshot version to 8.0.2 (#4715)
• 50ec1c8 Backport #4692 to 8.0.x: refresh primaryNodesCache in JedisClusterInfoCache.d...
• 36135a0 Point snapshot example at 8.0.1-SNAPSHOT on the 8.x branch
• 2de1a6d List Redis 8.6, 8.8 and 8.10 as supported in README
• fcf59cd Update version references in README and docs for 8.0.0
• Additional commits viewable in compare view

Updates com.rabbitmq:amqp-client from 5.35.0 to 5.37.0

Release notes

Sourced from com.rabbitmq:amqp-client's releases.

5.37.0

Changes between 5.36.0 and 5.37.0

This is a maintenance release with a bug fix, a usability improvement, and dependency upgrades. It is compatible with 5.36.0. All users are encouraged to upgrade.

Harden (deprecated) JSON reader

GitHub PR: #2100

Set preferred TLS protocol to version 1.3

GitHub issue: #2098

Bump dependencies

GitHub issue: #2093

Dependency

Maven

<dependency>
  <groupId>com.rabbitmq</groupId>
  <artifactId>amqp-client</artifactId>
  <version>5.37.0</version>
</dependency>

Gradle

compile 'com.rabbitmq:amqp-client:5.37.0'

5.36.0

Changes between 5.35.0 and 5.36.0

This is a maintenance release with bug fixes and dependency upgrades. It is compatible with 5.35.0. All users are encouraged to upgrade.

Do not enable hostname verification in useTlsWithNoVerification

GitHub PR: #2081

Be more defensive when parsing shortstr values in tables

GitHub PR: #2065

Bump dependencies

... (truncated)

Commits

• 0027775 [maven-release-plugin] prepare release v5.37.0
• 0f40842 Set release version to 5.37.0
• a93de83 Merge pull request #2107 from rabbitmq/dependabot/maven/v5.x/com.diffplug.spo...
• a544309 Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.2 to 3.10.3
• b47f881 Merge pull request #2104 from rabbitmq/dependabot/maven/v5.x/org.mockito-mock...
• 50b27c5 Bump org.mockito:mockito-core from 5.23.0 to 5.24.0
• 2a374aa Merge pull request #2102 from rabbitmq/dependabot/maven/v5.x/com.fasterxml.ja...
• 2d7a009 Bump com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.3
• a1f294a ci: use Erlang 28 alphas for 4.4
• b5572cf ci: test on Ubuntu 26.04
• Additional commits viewable in compare view

Bumps the dependencies group with 2 updates in the /modules/activemq directory: org.apache.activemq:activemq-client and org.apache.activemq:artemis-jakarta-client.
Bumps the dependencies group with 3 updates in the /modules/azure directory: com.squareup.okhttp3:okhttp, com.azure:azure-sdk-bom and com.microsoft.sqlserver:mssql-jdbc.
Bumps the dependencies group with 3 updates in the /modules/clickhouse directory: com.clickhouse:client-v2, com.clickhouse:clickhouse-r2dbc and com.clickhouse:clickhouse-jdbc.
Bumps the dependencies group with 1 update in the /modules/cockroachdb directory: org.postgresql:postgresql.
Bumps the dependencies group with 2 updates in the /modules/couchbase directory: com.squareup.okhttp3:okhttp and com.couchbase.client:java-client.
Bumps the dependencies group with 1 update in the /modules/cratedb directory: org.postgresql:postgresql.
Bumps the dependencies group with 1 update in the /modules/databend directory: com.databend:databend-jdbc.
Bumps the dependencies group with 1 update in the /modules/elasticsearch directory: org.elasticsearch.client:elasticsearch-rest-client.
Bumps the dependencies group with 1 update in the /modules/gcloud directory: com.google.cloud:libraries-bom.
Bumps the dependencies group with 8 updates in the /modules/hivemq directory:

Package	From	To
org.apache.commons:commons-lang3	3.20.0	3.21.0
commons-io:commons-io	2.21.0	2.22.0
org.javassist:javassist	3.32.0-GA	3.33.0-GA
org.jboss.shrinkwrap:shrinkwrap-api	1.2.6	2.0.0.Final
org.jboss.shrinkwrap:shrinkwrap-impl-base	1.2.6	2.0.0.Final
com.hivemq:hivemq-extension-sdk	4.50.0	4.56.1
com.hivemq:hivemq-mqtt-client	1.3.15	1.4.1
ch.qos.logback:logback-classic	1.5.37	1.6.6

Bumps the dependencies group with 1 update in the /modules/kafka directory: org.apache.kafka:kafka-clients.
Bumps the dependencies group with 1 update in the /modules/localstack directory: software.amazon.awssdk:bom.
Bumps the dependencies group with 1 update in the /modules/milvus directory: io.milvus:milvus-sdk-java.
Bumps the dependencies group with 1 update in the /modules/mongodb directory: org.mongodb:mongodb-driver-sync.
Bumps the dependencies group with 2 updates in the /modules/mssqlserver directory: com.microsoft.sqlserver:mssql-jdbc and io.r2dbc:r2dbc-mssql.
Bumps the dependencies group with 2 updates in the /modules/mysql directory: io.asyncer:r2dbc-mysql and com.mysql:mysql-connector-j.
Bumps the dependencies group with 1 update in the /modules/oceanbase directory: com.mysql:mysql-connector-j.
Bumps the dependencies group with 1 update in the /modules/openfga directory: dev.openfga:openfga-sdk.
Bumps the dependencies group with 1 update in the /modules/oracle-free directory: com.oracle.database.jdbc:ojdbc11.
Bumps the dependencies group with 1 update in the /modules/oracle-xe directory: com.oracle.database.jdbc:ojdbc11.
Bumps the dependencies group with 3 updates in the /modules/orientdb directory: com.orientechnologies:orientdb-client, org.apache.tinkerpop:gremlin-driver and com.orientechnologies:orientdb-gremlin.
Bumps the dependencies group with 1 update in the /modules/postgresql directory: org.postgresql:postgresql.
Bumps the dependencies group with 2 updates in the /modules/qdrant directory: io.qdrant:client and io.grpc:grpc-bom.
Bumps the dependencies group with 2 updates in the /modules/questdb directory: org.postgresql:postgresql and org.questdb:questdb.
Bumps the dependencies group with 1 update in the /modules/rabbitmq directory: com.rabbitmq:amqp-client.
Bumps the dependencies group with 2 updates in the /modules/scylladb directory: com.scylladb:java-driver-core and software.amazon.awssdk:dynamodb.
Bumps the dependencies group with 1 update in the /modules/tidb directory: com.mysql:mysql-connector-j.
Bumps the dependencies group with 1 update in the /modules/toxiproxy directory: redis.clients:jedis.
Bumps the dependencies group with 1 update in the /modules/trino directory: io.trino:trino-jdbc.
Bumps the dependencies group with 1 update in the /modules/weaviate directory: io.weaviate:client6.

Updates org.apache.activemq:activemq-client from 6.2.4 to 6.4.0

Release notes

Sourced from org.apache.activemq:activemq-client's releases.

Apache ActiveMQ 6.4.0

What's Changed

New Contributors

• @​arimu1 made their first contribution in apache/activemq#2270
• @​hai-ben made their first contribution in apache/activemq#2517
• @​jjj-n made their first contribution in apache/activemq#2540

Full Changelog: apache/activemq@activemq-6.3.2...activemq-6.4.0

Features

• #2132 Migrate SSL support away from ThreadLocal, support key alias and default to pkcs12 by @​mattrpav in apache/activemq#2133
• [AMQ-9857] Add SSL support for JMX connector in ManagementContext by @​jeanouii in apache/activemq#1661
• #1770 Feature: IP address allow/deny support by @​mattrpav in apache/activemq#2539
• #2273 activemq-pool support for JMS 3.1/2.0 by @​mattrpav in apache/activemq#2274
• Feature: Support for authorization of connection fields by @​mattrpav in apache/activemq#2461
• [AMQ-9692] Support destination gc sweep of destinations with only wildcard consumers by @​mattrpav in apache/activemq#1484
• Add support for PageFile free page truncation by @​cshannon in apache/activemq#2233
• feat(#1737): Add OAuth2 JWT authentication support via JAAS LoginModule by @​jbonofre in apache/activemq#1738
• feat(otel): Add OpenTelemetry distributed tracing support by @​jbonofre in apache/activemq#1769
• Docker image update to JDK 25 and README updates by @​colinwerner in apache/activemq#2052
• feat(#1716): Implement receiveBody() by @​jbonofre in apache/activemq#1543
• #2140 Widen MessageDatabase index-update points for subclasses by @​mattrpav in apache/activemq#2550

Fixes

• Fix AMQP Object message decompression by @​cshannon in apache/activemq#2256
• #2583 Duplicate message publish during failover leads to incorrect queue size metric by @​mattrpav in apache/activemq#2584
• #2583 Transacted fire-after-commit first exception exits loop prematurely leading to incorrect queue size by @​mattrpav in apache/activemq#2585
• fix(console): fix NPE in AbstractJmxCommand.execute and AbstractCommand.handleException by @​anmol-saxena-14 in apache/activemq#1967
• Return safe fallback from BrokerView read-only getters instead of throwing when broker not yet started by @​jbonofre in apache/activemq#2553
• StartCommand: keep waiting past the default start timeout unless a start exception was recorded by @​jbonofre in apache/activemq#2554
• Ensure subscriptions are cleaned up on failure by @​cshannon in apache/activemq#2680
• Ensure TransportConnection validates connection id by @​cshannon in apache/activemq#2682
• Fix TransportConnection getConnectionId() by @​cshannon in apache/activemq#2683
• LDAP hardening by @​mattrpav in apache/activemq#2695
• #9857 JMX SSL clean-up post-merge since was not rebased to new SslContext by @​mattrpav in apache/activemq#2668
• Fix nested values in MapMessage by @​cshannon in apache/activemq#2672
• Tighten default Jolokia access policy and bind the web console to loopback by @​jbonofre in apache/activemq#2639
• Validate subscription key length in KahaDB by @​cshannon in apache/activemq#2686
• Clear context write cache on ACL updates by @​cshannon in apache/activemq#2685
• Fix network bridge local-side close by @​mattrpav in apache/activemq#2475
• Fix: Assembly startup logs harmless WARN about schemas by @​mattrpav in apache/activemq#2501
• Improve GC checkpoint algorithm for empty durables by @​cshannon in apache/activemq#2505
• Fix concurrent advisory message evaluation (#2519) by @​jjj-n in apache/activemq#2540
• #2271 Update Producer getDeliveryDelay to always return zero by @​mattrpav in apache/activemq#2272
• #2398 FutureBrokerInfoTimeout is missed due to logic operator error by @​mattrpav in apache/activemq#2399
• #2282 Drop redundant sequence generator monitor in RegionBroker by @​mattrpav in apache/activemq#2283
• #2406 Guard against null region subscriptions in duplicate suppression by @​mattrpav in apache/activemq#2407
• #2418 Improve performance of IntSequenceGenerator by @​cshannon in apache/activemq#2408
• #2434 Avoid per-command MDC add+remove in TransportConnection.service by @​mattrpav in apache/activemq#2435

... (truncated)

Commits

• d0daf63 [maven-release-plugin] prepare release activemq-6.4.0
• 60f9751 Update LICENSE/NOTICE (#2733)
• 81be28e build(deps): bump com.nimbusds:nimbus-jose-jwt from 10.3 to 10.10 (#2724)
• 19aeabf build(deps): bump me.fabriciorby:maven-surefire-junit5-tree-reporter (#2725)
• c5f98ae build(deps): bump jackson-version from 2.22.3 to 2.22.4 (#2723)
• d3279e8 build(deps): bump org.ow2.asm:asm from 9.11 to 9.11.1 (#2710)
• 27c44c1 StartCommand: keep waiting past the default start timeout unless a start exce...
• f077022 Return safe fallback from BrokerView read-only getters instead of throwing wh...
• 343b5ee docker-java-version to 25; fix docker hub links (#2052)
• ec05f19 feat(#1737): Add OAuth2 JWT authentication support via JAAS LoginModule (#1738)
• Additional commits viewable in compare view

Updates org.apache.activemq:artemis-jakarta-client from 2.55.0 to 2.57.0

Updates com.squareup.okhttp3:okhttp from 5.4.0 to 5.5.1

Changelog

Sourced from com.squareup.okhttp3:okhttp's changelog.

Version 5.5.1

2026_10_22

• Fix: [Block 8 compromised eMudhra intermediate certificates][Mozilla_eMudhra]. Note that this update is not necessary for Android devices with Google Play Services as Google has issued an [automatic update][Google_eMudhra]. This change protects JVMs and AOSP devices that are exposed to the compromised certificates.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
</tr></table> 

... (truncated)

Commits

• be5151a Prepare for release 5.5.1.
• 6db9802 OkHttp 5.5.x: Blocklist 8 certificates for CVE-2026-111943 (#9805)
• a94bdf1 Prepare for release 5.5.0.
• ecc3b05 Use a fixed size for DoH request body (#9687)
• 9926082 Revert "Use a fixed size for DoH request body" (#9686)
• 0070c2e Use a fixed size for DoH request body
• 1576453 Order ServiceMetadata records per the spec (#9683)
• fb582e9 Flip wiring of Dns.SYSTEM (#9682)
• 4e884ab retryOnConnectionFailure doesn't impact ECH retries (#9681)
• 0433cee Only one contributing.md doc (#9678)
• Additional commits viewable in compare view

Updates com.azure:azure-sdk-bom from 1.2.32 to 1.3.9

Release notes

Sourced from com.azure:azure-sdk-bom's releases.

com.azure+azure-messaging-webpubsub-client_1.3.0

1.3.0 (2026-11-04)

Bugs Fixed

• Fixed secure WebSocket connections accepting untrusted certificates or certificates for a different hostname. Connections now validate certificates against the JDK's default trust store and verify the hostname.
• Fixed a race condition where send operations could miss fast acknowledgment responses.
• Fixed JSON payloads sent to groups or server events being encoded as strings instead of JSON values.
• Fixed WebSocket Pong frames to echo the payload of the corresponding Ping frame.
• Fixed incomplete fragmented messages being decoded when a WebSocket connection closes or its handler is removed.
• Fixed WebSocket connection attempts hanging when the peer does not complete the handshake, disconnects, or the handshake request cannot be sent. Opening handshakes now time out after 10 seconds.
• Fixed WebSocket event loop resources leaking after connection failures and remote disconnects.
• Fixed exceptions in open and close callbacks leaving operations incomplete or leaking received close frames.
• Fixed WebSocket close operations hanging when the peer does not respond or the close frame cannot be sent. Closing handshakes now force the transport closed after a 10-second timeout.
• Fixed interrupted WebSocket close operations losing the thread interrupt flag and skipping resource cleanup.
• Fixed unexpected WebSocket disconnects being reported as normal closures. Disconnects without a received close frame now report abnormal-closure status 1006.

Other Changes

• Verbose WebSocket send logs now record the payload length in bytes instead of message contents.
• Updated WebSocket event loops and compression handling to use Netty 4.2 APIs.

com.azure+azure-security-attestation_1.3.1

1.3.1 (2026-11-02)

Other Changes

Dependency Updates

• Upgraded azure-core from 1.60.0 to version 1.61.0.
• Upgraded nimbus-jose-jwt from 9.37.3 to version 9.37.4.

com.azure+azure-monitor-ingestion_1.3.1

1.3.1 (2026-11-02)

Other Changes

Dependency Updates

• Upgraded azure-core from 1.60.0 to version 1.61.0.
• Upgraded azure-core-http-netty from 1.16.8 to version 1.17.0.

com.azure+azure-identity-extensions_1.3.1

1.3.1 (2026-11-02)

Other Changes

Dependency Updates

... (truncated)

Commits

• d5b4973 Updating the SDK dependencies for azure-digitaltwins-core
• 18fe084 Reset changes to the patch version.
• 8ae8100 Increment package versions for openai releases (#35091)
• ababd85 [OpenAI] Update release date (#35085)
• 6421ba9 move the cleanup config to -SaveInputs parameter on the cli (#35088)
• f60e8e7 Reorganizing and consolidating samples (#35047)
• 8c91d3a Azure Monitor Ingestion: Add troubleshooting guide (#34944)
• be18200 Update patch_release_client.txt with ACS Email Library (#35083)
• 9063095 [OpenAI] Support for NonAzure OpenAI endpoint. (#35058)
• 7b20bee May eg release (#35084)
• Additional commits viewable in compare view

Updates com.microsoft.sqlserver:mssql-jdbc from 13.4.0.jre11 to 13.6.2.jre11

Release notes

Sourced from com.microsoft.sqlserver:mssql-jdbc's releases.

[13.6.1] Hotfix & Stable Release

Fixed issue

• Fix Callable Statements with prepareMethod=none #3073
  • What was fixed: Procedure-call parameters for dates, times, timestamps, and decimals with precision greater than 18 or scale greater than 6 are now written as plain literals when prepareMethod=none is used.
  • Who benefits: Applications executing callable statements with prepareMethod=none and affected parameter types.
  • Impact: Prevents invalid CAST(...) expressions from being emitted in EXEC argument lists while preserving typed parameter handling for other statements.

[13.6.0] Stable Release

Added

• Add FLOAT16 Vector Version Negotiation to the TVP Write Path #2997

  • What was added: Negotiated vector-version validation before writing VECTOR column metadata for table-valued parameters.
  • Who benefits: Applications sending vector columns through table-valued parameters.
  • Impact: Rejects all vectors on version 0 and FLOAT16 vectors on version 1 before data is written to the wire, with a clear driver error.

• Port Legacy FX Non-AE Test Scenarios to JUnit #3008

  • What was added: Forty-eight legacyFx-tagged JUnit tests covering previously unported non-Always-Encrypted functional scenarios.
  • Who benefits: Contributors and CI validation pipelines.
  • Impact: Improves regression coverage while advancing retirement of the legacy FX test suite.

• Add Cross-Driver Connection String Aliases for Unification #3011

  • What was added: Case-insensitive aliases for uid, trusted_connection, app, connectTimeout, columnEncryption, and quotedId, mapped to their canonical JDBC properties.
  • Who benefits: Applications sharing connection-string configuration across Microsoft data drivers.
  • Impact: Improves portability while preserving all existing JDBC property names and aliases.

• Add getCurrentApplicationName to PerformanceLogCallback #3018

  • What was added: A default getCurrentApplicationName() method that exposes the publishing connection's applicationName to performance callbacks.
  • Who benefits: Applications using connection pools and performance-event correlation.
  • Impact: Allows events to be associated with a pool or application without breaking existing callback implementations.

Changed

• Optimize MONEY, DECIMAL, and String Processing in the ResultSet Read Path #2991

  • What was changed: Removed intermediate allocations from MONEY/SMALLMONEY decoding, common BigDecimal encoding, short synchronous string reads, and NBCROW initialization.
  • Who benefits: Applications reading high-volume or wide result sets.
  • Impact: Reduces garbage-collection pressure and improves throughput while preserving decoded values and existing fallback behavior.

• Validate Reflective Class Names for Connection Properties #3004

  • What was changed: Added Java binary class-name validation before reflectively loading classes specified by properties such as socketFactoryClass and accessTokenCallbackClass.
  • Who benefits: Applications configuring custom callback, socket-factory, or related reflective classes.
  • Impact: Malformed class names now fail early with a dedicated driver error instead of producing confusing reflective-loading failures.

• Update Vector Tests for Server-Side FLOAT16/FLOAT32 Conversion #3005

  • What was changed: Updated and expanded vector tests for implicit and explicit conversion between FLOAT16 and FLOAT32 vector subtypes.
  • Who benefits: Contributors validating vector interoperability against servers supporting vector version 2.
  • Impact: Covers assignments, casts, conversions, bulk copy, routines, precision loss, nulls, and dimension mismatch behavior.

• Adjust License File to Enable GitHub Detection #3010

  • What was changed: Normalized the MIT license text formatting.

... (truncated)

Commits

• See full diff in compare view

Updates com.squareup.okhttp3:okhttp from 5.4.0 to 5.5.1

Changelog

Sourced from com.squareup.okhttp3:okhttp's changelog.

Version 5.5.1

2026_10_22

• Fix: [Block 8 compromised eMudhra intermediate certificates][Mozilla_eMudhra]. Note that this update is not necessary for Android devices with Google Play Services as Google has issued an [automatic update][Google_eMudhra]. This change protects JVMs and AOSP devices that are exposed to the compromised certificates.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
</tr></table> 

... (truncated)

Commits

• be5151a Prepare for release 5.5.1.
• 6db9802 OkHttp 5.5.x: Blocklist 8 certificates for CVE-2026-111943 (#9805)
• a94bdf1 Prepare for release 5.5.0.
• ecc3b05 Use a fixed size for DoH request body (#9687)
...

Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d4697814-2919-4650-a5cb-351786b0b903

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.