Update jline.version to v4 by red-hat-konflux[bot] · Pull Request #1666 · project-ncl/bacon

red-hat-konflux · 2026-03-03T21:31:54Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
org.jline:jline-console	`3.30.6` → `4.4.0`
org.jline:jline	`3.30.6` → `4.4.0`

Release Notes

jline/jline3 (org.jline:jline-console)

`v4.4.0`: JLine 4.4.0

Compare Source

JLine 4.4.0 is a feature-rich release bringing modern terminal protocol support, broader platform compatibility, and continued security hardening.

Highlights:

Kitty Keyboard Protocol — full support for the Kitty keyboard protocol, enabling unambiguous key event reporting (#2007)
In-band window resize — support for mode 2048 resize notifications across the terminal, reader, and builtins (Nano, Less, Tmux) (#2021, #2198)
Synchronized output — full mode 2026 support to eliminate flicker during rapid screen updates (#2022)
musl libc support — native libraries now load on Alpine and other musl-based distributions (#2197)
JdkConsoleProvider — drop-in JLine console that can replace System.console() (#2031)
Reproducible builds — source archives can now be built without a git checkout, thanks to nisse property fallbacks (#2151, #2153)
Security hardening — path traversal guards, ReDoS protection, cross-origin rejection, control character stripping, and SSH agent forwarding tightened across multiple modules
FFM signal handling rewrite — replaced shared Arena with self-pipe trick for reliable signal delivery (#2141)

⚠️ Breaking: the ambiguous key binding timeout has been reduced from 1000ms to 100ms (#2186), and SSH agent forwarding now requires the explicit -A flag (#2106).

💥 Breaking changes

fix: reduce ambiguous binding timeout from 1000ms to 100ms (#2186) @gnodet
fix: only forward the ssh agent when -A is given (#2106) @uchiha-bug-hunter

🚀 New features and improvements

feat: support in-band resize (mode 2048) in Nano, Less, and Tmux builtins (#2198) @gnodet
feat: add musl libc support for native libraries (#2197) @gnodet
feat: add Kitty Keyboard Protocol support (#2007) @gnodet
feat: add configurable behavior for too many completion candidates (fixes #2154) (#2196) @gnodet
feat: support in-band window resize notifications (mode 2048) (#2021) @gnodet
feat: add JdkConsoleProvider for drop-in JLine console (#2031) @gnodet
feat: verify macOS native library signatures in CI (#2173) @gnodet
feat: allow customizing the help source in Less pager (fixes #2056) (#2065) @gnodet
feat: full synchronized output (mode 2026) support (#2022) @gnodet
refactor: batch DEC mode probing into single DECRQM round-trip (#2023) @gnodet
feat: allow customizing the default prompt in Less pager (#2036) @gnodet
feat: add factory to simplify LineDisciplineTerminal + ScreenTerminal wiring (#2035) @gnodet
feat: add AttributedStringBuilder.appendCodePoint(int) (#2163) @gnodet
Enable reproducible builds from source archives (#2151) @gnodet
Add Terminal.getenv() for remote terminal environment support (#2030) @gnodet

🐛 Bug Fixes

fix: remove eval from MVX demo launchers (fixes #2191) (#2193) @gnodet
fix: DefaultHistory.read() records per-file entry count instead of total (fixes #2179) (#2194) @gnodet
fix: handle IOError in BindingReader gracefully instead of crashing (fixes #2155) (#2195) @gnodet
fix: lower native library candidate log level from WARNING to DEBUG (fixes #2185) (#2192) @gnodet
fix: reimplement FFM signal handling with self-pipe trick (fixes #2139) (#2141) @gnodet
fix: add software signal interception to Windows terminals (fixes #2127) (#2148) @gnodet
fix: escape control chars in oversized line-buffer display (#2175) @uchiha-bug-hunter
fix: escape IAC byte in the telnet data output stream (#2164) @uchiha-bug-hunter
fix: strip control characters from Less status messages (#2156) @uchiha-bug-hunter
fix: preserve termios baud rate when setting attributes (#2170) (#2172) @arimu1
fix: mask password value in DefaultPrompter result display (#2167) @uchiha-bug-hunter
fix: keep image options inside the kitty and iterm2 sequences (#2138) @uchiha-bug-hunter
fix: reject cross-origin keystroke POSTs in WebTerminal (#2118) @uchiha-bug-hunter
fix: stop answering DSR 7/8 with plain text in ScreenTerminal (#2128) @uchiha-bug-hunter
fix: reject theme path traversal in highlighter command (#2112) @uchiha-bug-hunter
fix: strip control characters from ssh banner and prompts (#2129) @uchiha-bug-hunter
fix: improve provider discovery for custom classloader environments (#2119) @gnodet
fix: use Arena.ofAuto instead of Arena.ofShared in FfmSignalHandler (fixes #2117) (#2120) @gnodet
fix: clamp out-of-range truecolor SGR components in ScreenTerminal (#2107) @uchiha-bug-hunter
fix: reject overlong hex components in OSC color responses (#2105) @uchiha-bug-hunter
fix: search multiple lib paths for versioned libutil.so (#2100) @gnodet
fix: strip OSC and other escape sequences in ansiAppend (#2099) @uchiha-bug-hunter
fix: confine ConfigurationPath lookups to the config directory (#2045) @uchiha-bug-hunter
fix: disable Read File command in nano restricted mode (#2055) @uchiha-bug-hunter
fix: drain buffered data before signaling EOF in NonBlockingPumpInputStream (#2063) @gnodet
fix: look up openpty in libc.so.6 for glibc 2.34+ (#2071) @gnodet
fix: guard styleMatches and highlighter rules against ReDoS (#2053) @uchiha-bug-hunter
fix: check NewObject() return in JNI newFileDescriptor/newRedirectPipe (fixes #2046) (#2047) @gnodet
fix: only read local jar: archives in PosixCommands getSources (#2052) @uchiha-bug-hunter
fix: clear thread interrupt flag after UserInterruptException (fixes #2039) (#2049) @gnodet
fix: guard against null lines and null rules in syntax highlighting (fixes #2040) (#2048) @gnodet
fix: validate terminal type before passing to infocmp (#2041) @uchiha-bug-hunter
fix: use ConcurrentHashMap for InfoCmp capability caches (#2038) @uchiha-bug-hunter

📝 Documentation updates

docs: document macOS native library signing process (#2180) @gnodet

📦 Dependency updates

chore: bump org.easymock:easymock from 5.6.0 to 5.7.0 (#2189) @dependabot[bot]
chore: bump eu.maveniverse.maven.nisse:extension from 0.9.5 to 0.9.7 (#2183) @dependabot[bot]
chore: bump com.google.jimfs:jimfs from 1.3.1 to 1.3.2 (#2181) @dependabot[bot]
chore: bump org.graalvm.buildtools:native-maven-plugin from 1.1.5 to 1.1.10 (#2168) @dependabot[bot]
chore: bump junit.version from 6.1.2 to 6.1.3 (#2162) @dependabot[bot]
chore: bump com.palantir.javaformat:palantir-java-format from 2.96.0 to 2.97.0 (#2160) @dependabot[bot]
chore: bump release-drafter/release-drafter from 7.6.0 to 7.7.0 (#2145) @dependabot[bot]
chore: bump actions/setup-java from 5.6.0 to 5.7.0 (#2142) @dependabot[bot]
chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.9.0 to 3.10.0 (#2171) @dependabot[bot]
chore: bump groovy.version from 5.0.7 to 5.1.0 (#2169) @dependabot[bot]
chore: bump actions/setup-java from 5 to 5.6.0 (#2135) @dependabot[bot]
chore: bump release-drafter/release-drafter from 7 to 7.6.0 (#2130) @dependabot[bot]
chore: bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.0 (#2131) @dependabot[bot]
chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.8.0 to 3.9.0 (#2122) @dependabot[bot]
chore: bump org.graalvm.sdk:graal-sdk from 25.1.3 to 25.2.4 (#2124) @dependabot[bot]
chore: bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 (#2114) @dependabot[bot]
chore: bump org.graalvm.buildtools:native-maven-plugin from 1.1.4 to 1.1.5 (#2104) @dependabot[bot]
chore: bump org.apache.ivy:ivy from 2.5.3 to 2.6.0 (#2097) @dependabot[bot]
chore: bump junit.version from 6.1.1 to 6.1.2 (#2084) @dependabot[bot]
chore: bump actions/setup-node from 6 to 7 (#2092) @dependabot[bot]
chore: bump org.graalvm.buildtools:native-maven-plugin from 1.1.3 to 1.1.4 (#2066) @dependabot[bot]
chore: bump sshd.version from 2.18.0 to 2.19.0 (#2057) @dependabot[bot]
chore: bump com.palantir.javaformat:palantir-java-format from 2.94.0 to 2.96.0 (#2059) @dependabot[bot]
chore: bump org.codehaus.gmavenplus:gmavenplus-plugin from 5.0.0 to 5.1.0 (#2043) @dependabot[bot]
chore: bump groovy.version from 5.0.6 to 5.0.7 (#2050) @dependabot[bot]
chore: bump org.graalvm.sdk:graal-sdk from 25.0.3 to 25.1.3 (#2027) @dependabot[bot]
chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.7.0 to 3.8.0 (#2026) @dependabot[bot]

👻 Maintenance

chore: use nisse 0.9.5 with .mvn/nisse.properties for source-archive builds (#2153) @gnodet
chore: use committer timestamp for archive date fallback (#2152) @gnodet
chore: migrate Release Drafter configs to new when syntax (#2177) @gnodet
chore: set correct target branch on GitHub releases (#2174) @gnodet
chore: clarify merge policy to require label, milestone, and assignee (#2121) @gnodet
chore: extract shared truecolor RGB clamping helper in csi_SGR (#2111) @gnodet
chore: remove 4.0.x from Dependabot configuration (#2094) @gnodet

`v4.3.1`: JLine 4.3.1

Compare Source

JLine 4.3.1 is a security patch release addressing ReDoS vulnerabilities.

🔒 Security Fixes

fix: guard regex matching against catastrophic backtracking (ReDoS) (#2012) @gnodet
- Adds SafeRegex utility with TimeoutCharSequence to enforce wall-clock deadlines during regex matching
- Fixes 8 locations across terminal, reader, and builtins where user-controlled input could trigger catastrophic backtracking
- Addresses GHSA-r2xf-8xr9-62gw, GHSA-2v9w-34q6-wpqx, GHSA-ph9c-7hw9-vhhw, GHSA-5q95-hrpc-m3w3

🐛 Bug Fixes

fix: warn on insecure permissions when history file created concurrently (#2013) @gnodet
fix: add synchronized to fillInStackTrace override (#2019) @gnodet

Full Changelog: jline/jline3@4.3.0...4.3.1

`v4.3.0`: JLine 4.3.0

Compare Source

JLine 4.3.0 includes new features, security hardening, platform support, and display fixes.

✨ New Features

feat: expose ScreenTerminal scrollback history and cell decoding utilities (#1996) @ammachado
feat: add AIX support to FFM terminal provider (#1985) @gnodet

🔒 Security Hardening

fix: create persisted history file with owner-only permissions (#1986) @uchiha-bug-hunter
fix: use exclusive create for extracted native library temp files (#1995) @uchiha-bug-hunter

🐛 Bug Fixes

fix: eliminate Display flicker on windows-vtp and high-FPS updates (#2002, fixes #1983) @gnodet
fix: add software signal interception to PosixSysTerminal (#1987, fixes #1982) @gnodet

🔧 Refactoring

refactor: defer exception allocation in Pty/redirect-pipe creation (#1976) @raneashay

📦 Dependency Updates

chore: bump junit.version from 6.1.0 to 6.1.1 (#2005)
chore: bump com.palantir.javaformat:palantir-java-format (#1992)
chore: bump eu.maveniverse.maven.nisse:extension from 0.9.2 to 0.9.3 (#1997)
chore: bump org.graalvm.buildtools:native-maven-plugin (#2003)
chore: bump actions/cache from 5 to 6 (#1990)

`v4.2.1`: JLine 4.2.1

Compare Source

JLine 4.2.1 is a security patch release addressing two denial-of-service vulnerabilities in the remote-telnet module.

🔒 Security Fixes

fix: clamp NAWS terminal dimensions to prevent CPU exhaustion (GHSA-2r2c-cx56-8933)
fix: cap NEW-ENVIRON variable count to prevent heap exhaustion (GHSA-47qp-hqvx-6r3f)

🐛 Bug Fixes

fix: add compiled groovy classes to javadoc classpath (#1972) @gnodet

📦 Dependency updates

chore: Bump com.diffplug.spotless:spotless-maven-plugin from 3.6.0 to 3.7.0 (#1973) @dependabot[bot]

`v4.2.0`: JLine 4.2.0

Compare Source

JLine 4.2.0 is a minor release that bumps the version to reflect API and behavioral changes since the 4.1.x series.

Highlights:

java.logging module dependency dropped — JLine now uses System.Logger (JEP 264), removing the java.logging module requirement and making JLine friendlier in custom JPMS runtimes (#1934)
ScreenTerminal unified — the two divergent copies (builtins vs terminal) are consolidated into org.jline.utils.ScreenTerminal, with a fix for stale status rows when using bordered status displays (#1971)
Exit command made configurable — the built-in exit command is now a regular, configurable command rather than hardcoded (#1870)
Prompt module — list and checkbox prompts now support per-item footers (#1933)
Robustness fixes — EOF propagation in PtyInputStream, signal handling with ISIG cleared, resize sync, graphics protocol detection on basic terminals, and several out-of-bounds guards

🚀 New features and improvements

refactor: unify ScreenTerminal — move from builtins to terminal module (#1971) @gnodet
feat(prompt): add optional per-item footer to list and checkbox prompts (#1933) @ingokegel
refactor: drop the java.logging module dependency and use System.Logger instead (#1934) @ingokegel
refactor: make exit command a regular, configurable command (#1870) @Elec332
feat: add custom name parameter to PicocliCommandRegistry (#1947) @gnodet

🐛 Bug Fixes

fix: sync LineReader display model on resize (fixes #1940) (#1941) @zikolach
fix: propagate EOF in PtyInputStream to avoid infinite loop (#1963) @gnodet
fix: override bulk write in NonCloseableOutputStream to avoid byte-at-a-time writes (#1962) @gnodet
fix: restore signal handling when ISIG is cleared (#1942) (#1959) @gnodet
fix: skip graphics protocol detection for basic terminal types (#1957) @gnodet
fix: keep polling the terminal probe response past a spurious EOF (#1944) @WouterGritter
fix: guard ScreenTerminal.poke() against out-of-bounds cursor position (#1946) @gnodet
fix: clamp cx in dumb_echo to prevent out-of-bounds cursor position (#1953) @gnodet
fix: validate version format in release workflow (#1954) @gnodet

📦 Dependency updates

chore: Bump com.palantir.javaformat:palantir-java-format from 2.92.0 to 2.93.0 (#1964) @dependabot[bot]
chore: Bump org.codehaus.gmavenplus:gmavenplus-plugin from 4.3.1 to 5.0.0 (#1938) @dependabot[bot]
chore: Bump org.graalvm.buildtools:native-maven-plugin from 1.1.1 to 1.1.2 (#1950) @dependabot[bot]
chore: Bump com.palantir.javaformat:palantir-java-format from 2.91.0 to 2.92.0 (#1949) @dependabot[bot]
chore: Bump sshd.version from 2.17.1 to 2.18.0 (#1926) @dependabot[bot]
chore: Bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 (#1928) @dependabot[bot]

👻 Maintenance

chore: add security policy (SECURITY.md) (#1958) @gnodet
chore: bump mvx to 0.13.0 (#1955) @gnodet
chore: replace Thread.sleep with Awaitility in shell tests (#1956) @gnodet
chore: upgrade CI build matrix from JDK 24 to JDK 25 (#1948) @gnodet
chore: configure RB value with nisse (#1932) @hboutemy

🚦 Tests

test: add LineReader EOF tests for different terminal providers (#1961) (#1968) @gnodet

`v4.1.3`: JLine 4.1.3

Compare Source

JLine 4.1.3 is a patch release with important fixes for terminal close handling, raw mode signal behavior, FFM memory management, and shell command argument parsing.

Bug Fixes

fix: terminal.close() blocks when pump thread is reading stdin (#1911, fixes #1909)
fix: clear ISIG in enterRawMode so Ctrl+C reaches raw-mode readers (#1912)
fix: use confined arenas instead of auto arenas in FFM CLibrary (#1913, fixes #1872)
fix: swap rows/columns in openpty winsize constructor call (#1914, fixes #1910)
fix: fix command argument parsing in DefaultCommandDispatcher (#1924)

Chores

chore: add OSS AI helper rules for project conventions (#1917)

Dependencies

chore: Bump org.graalvm.buildtools:native-maven-plugin from 1.1.0 to 1.1.1 (#1915)
chore: Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 (#1918)
chore: Bump com.diffplug.spotless:spotless-maven-plugin from 3.5.1 to 3.6.0 (#1919)

Full Changelog: jline/jline3@4.1.2...4.1.3

`v4.1.2`: JLine 4.1.2

Compare Source

JLine 4.1.2 is a patch release focused on correctness fixes across the parser, terminal I/O, and shell modules.

Bug Fixes

fix: echo preserves backslash before unrecognised escape sequences (#1901, fixes #1863)
fix: DefaultParser preserves backslashes inside quotes (#1902, fixes #1877)
fix: NonBlockingInputStream keeps thread alive after EOF (#1903, fixes #1879)
fix: ensure cursor position after alternate screen init (#1904, fixes #1883)
fix: use parser for command argument splitting (#1907, fixes #1876)

Dependencies

chore: Bump eu.maveniverse.maven.nisse:extension from 0.9.1 to 0.9.2 (#1905)

Full Changelog: jline/jline3@4.1.1...4.1.2

`v4.1.1`: JLine 4.1.1

Compare Source

JLine 4.1.1 is a patch release focused on stability fixes. The most notable change corrects the POSIX raw mode defaults (VMIN/VTIME) in enterRawMode, which could cause shell REPL sessions to hang or malfunction on certain platforms. This release also fixes a Display bug where the internal line buffer could alias or reject immutable caller-provided lists, hardens signal registration against null returns, and corrects alternate charset handling in ScreenTerminal.

🐛 Bug Fixes

fix: Fixed Display oldLines being set as possible immutable lists. (#1878) @Elec332
fix: use POSIX cfmakeraw defaults (VMIN=1, VTIME=0) in enterRawMode (#1871) @BryanSant
fix: skip null returns from signal registration in AbstractUnixSysTerminal (#1869) @BryanSant
fix: Fixed ScreenTerminal alt-charset (#1867) @Elec332

📦 Dependency updates

chore: Bump com.palantir.javaformat:palantir-java-format from 2.90.0 to 2.91.0 (#1898) @dependabot
chore: Bump eu.maveniverse.maven.nisse:extension from 0.9.0 to 0.9.1 (#1894) @dependabot
chore: Bump junit.version from 6.0.3 to 6.1.0 (#1893) @dependabot
chore: Bump groovy.version from 5.0.5 to 5.0.6 (#1865) @dependabot
chore: Bump eu.maveniverse.maven.nisse:extension from 0.8.4 to 0.9.0 (#1887) @dependabot
chore: Bump com.diffplug.spotless:spotless-maven-plugin from 3.5.0 to 3.5.1 (#1886) @dependabot
chore: Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.2 to 3.6.3 (#1889) @dependabot
chore: Bump com.diffplug.spotless:spotless-maven-plugin from 3.4.0 to 3.5.0 (#1880) @dependabot
chore: Bump slf4j.version from 2.0.17 to 2.0.18 (#1874) @dependabot

👻 Maintenance

refactor: Remove duplicate code in Shell impl tests (#1868) @Elec332

New Contributors

@BryanSant made their first contribution in #1869

Full Changelog: jline/jline3@4.1.0...4.1.1

`v4.1.0`: JLine 4.1.0

Compare Source

JLine 4.1 is the first minor release of the 4.x series, bringing new features, significant performance improvements, internal refactoring, and many bug fixes across terminal handling, encoding, and platform support.

Highlights include streaming pipes with concurrent pipeline execution, a new Sized interface for uniform terminal size access, optimized display rendering with direct byte buffers, modernized signal handling via Panama FFM sigaction(), and a comprehensive overhaul of termios constant mappings across all supported platforms.

🚀 New features and improvements

refactor: introduce Sized interface and Size.of() factory methods (#1731) @Elec332
feat: Added UnknownCommandException for Shell module (#1780) @Elec332
feat: bulk read for NonBlockingPumpInputStream (#1778) @gnodet
feat: add filterable(boolean) option to list and checkbox prompts (#1784) @ingokegel
refactor: Deduplicate AttributedCharSequence#emitStyleChange. (#1788) @Elec332
perf: optimize Display.update for minimal allocation and output bytes (#1785) @gnodet
feat: streaming pipes with concurrent pipeline execution (#1777) @gnodet
feat: optimize output rendering with direct byte buffer (#1749) @gnodet
feat: modernize signal handling via Panama FFM sigaction() (#1750) @gnodet
feat: Add /dev/tty fallback for terminals with piped streams (#1728) @gnodet

🐛 Bug Fixes

Fix status bar duplication after vertical resize (#1860) @Abdelilah-AIT-HAMOU
fix: remove proactive isNativeAccessEnabled() checks from terminal providers (#1859) @gnodet
fix: prevent DA response bytes from leaking to parent shell (#1856) (#1857) @gnodet
fix: correct inverted bounds check in readBuffered methods (#1853) @gnodet
fix: wire up unmapped termios constants in JNI and FFM providers (#1838) @gnodet
fix: correct Solaris termios constants from octal to proper hex (#1837) @gnodet
fix: correct FreeBSD PENDIN and NOFLSH termios constants (#1834) @gnodet
fix: correct Linux PENDIN termios constant (#1835) @gnodet
fix: add missing CDTR_IFLOW readback in OsX toAttributes (#1836) @gnodet
fix: replace Thread.sleep() with synchronization in TmuxEncodingTest (#1827) @gnodet
fix: add VT100 response feedback to SwingTerminal and WebTerminal (#1824) @gnodet
fix: use console encoding instead of default charset in Tmux (#1826) @gnodet
fix: tail -n counts lines correctly when input lacks trailing newline (fixes #1787) (#1823) @gnodet
fix: use terminal encoding instead of default charset in VirtualTerminal (fixes #1821) (#1822) @gnodet
fix: close terminal in PromptBuilderTest to prevent resource leak (fixes #1810) (#1820) @gnodet
fix: resolve redirect targets against session working directory (#1781) @gnodet
fix: erase probe emoji after grapheme cluster width detection (fixes #1801) (#1770) @ingokegel
fix: close PTY streams before shutdown to prevent hang on macOS (fixes #1808) (#1817) @gnodet
fix: register all FFM foreign function signatures for GraalVM native-image (#1802) @gnodet
fix: close terminals properly in tests (fixes #1806) (#1814) @gnodet
fix: deprecate SwingTerminal.dispose() in favor of close() (fixes #1805) (#1811) @gnodet
fix: avoid NPE when closing terminal with null masterOutput (#1813) @gnodet
fix: Fix AttributedStyle color chaining (#1792) @Elec332
fix: remove spurious (short) casts in Size setters (#1791) @gnodet
fix: move Terminal parameter to first position in columnSubSequence and columnSplitLength (#1790) @gnodet
fix: compiler error in ScreenTerminal.dump() (#1773) @Elec332

📦 Dependency updates

chore: Bump actions/upload-pages-artifact from 4 to 5 (#1783) @dependabot[bot]
chore: Bump org.graalvm.sdk:graal-sdk from 25.0.2 to 25.0.3 (#1799) @dependabot[bot]
chore: Bump eu.maveniverse.maven.nisse:extension from 0.8.3 to 0.8.4 (#1798) @dependabot[bot]
chore: Bump org.graalvm.buildtools:native-maven-plugin from 1.0.0 to 1.1.0 (#1816) @dependabot[bot]
chore: Bump eu.maveniverse.maven.nisse:extension from 0.8.2 to 0.8.3 (#1772) @dependabot[bot]

📝 Documentation updates

docs: add branch structure and release process to CLAUDE.md (#1844) @gnodet
docs: update website for JLine 4.0 release (#1774) @gnodet

👻 Maintenance

fix: deduplicate ReaderTestSupport between reader and builtins (fixes #1807) (#1815) @gnodet
chore: add dependabot for 4.0.x maintenance branch (#1849) @gnodet
fix: pass explicit version to nisse in release workflow (#1845) @gnodet
refactor: modernize codebase with Java 9-11 idioms (#1839) @gnodet
refactor: flatten terminal provider abstraction and extract TermiosMapping (#1828) @gnodet
refactor: extract shared ScreenTerminalOutputStream (fixes #1797) (#1825) @gnodet
refactor: Deduplicate AttributedCharSequence#emitStyleChange. (#1788) @Elec332
refactor: trim unused public API from optimization commits (#1789) @gnodet
refactor: standardize terminal dimension naming to columns/rows (#1755) @gnodet

🚦 Tests

test: fix TerminalGraphicsTest to validate actual terminal graphics behavior (fixes #1809) (#1818) @gnodet
Pass on test cases (class/function modifier & more) (#1794) @Elec332

`v4.0.16`: JLine 4.0.16

Compare Source

What's Changed

chore: Bump slf4j.version from 2.0.17 to 2.0.18 by @dependabot[bot] in #1875
chore: Bump com.diffplug.spotless:spotless-maven-plugin from 3.4.0 to 3.5.0 by @dependabot[bot] in #1882
chore: Bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.2 to 3.6.3 by @dependabot[bot] in #1890
chore: Bump com.diffplug.spotless:spotless-maven-plugin from 3.5.0 to 3.5.1 by @dependabot[bot] in #1891
chore: Bump eu.maveniverse.maven.nisse:extension from 0.8.4 to 0.9.0 by @dependabot[bot] in #1892
chore: Bump groovy.version from 5.0.5 to 5.0.6 by @dependabot[bot] in #1866
chore: Bump junit.version from 6.0.3 to 6.1.0 by @dependabot[bot] in #1895
chore: Bump eu.maveniverse.maven.nisse:extension from 0.9.0 to 0.9.1 by @dependabot[bot] in #1896
chore: Bump com.palantir.javaformat:palantir-java-format from 2.90.0 to 2.91.0 by @dependabot[bot] in #1899
chore: Bump eu.maveniverse.maven.nisse:extension from 0.9.1 to 0.9.2 by @dependabot[bot] in #1906
chore: Bump org.graalvm.buildtools:native-maven-plugin from 1.1.0 to 1.1.1 by @dependabot[bot] in #1916
chore: Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 by @dependabot[bot] in #1920
chore: Bump com.diffplug.spotless:spotless-maven-plugin from 3.5.1 to 3.6.0 by @dependabot[bot] in #1922
chore: Bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 by @dependabot[bot] in #1931
chore: Bump sshd.version from 2.17.1 to 2.18.0 by @dependabot[bot] in #1930
chore: Bump com.palantir.javaformat:palantir-java-format from 2.91.0 to 2.92.0 by @dependabot[bot] in #1951
chore: Bump org.graalvm.buildtools:native-maven-plugin from 1.1.1 to 1.1.2 by @dependabot[bot] in #1952
chore: Bump org.codehaus.gmavenplus:gmavenplus-plugin from 4.3.1 to 5.0.0 by @dependabot[bot] in #1939
chore: backport nisse RB config fix from #1932 by @gnodet in #1935
chore: Bump com.palantir.javaformat:palantir-java-format from 2.92.0 to 2.93.0 by @dependabot[bot] in #1967
chore: Bump com.diffplug.spotless:spotless-maven-plugin from 3.6.0 to 3.7.0 by @dependabot[bot] in #1975
chore: Bump actions/checkout from 6 to 7 by @dependabot[bot] in #1980
fix: backport telnet DoS mitigations (GHSA-47qp, GHSA-2r2c) to 4.0.x by @gnodet in #2001

Full Changelog: jline/jline3@4.0.15...4.0.16

`v4.0.15`: JLine 4.0.15

Compare Source

JLine 4.0.15 is a patch release

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

github-actions · 2026-05-24T22:02:16Z

Mend Scan Results

Status: ⚠️ Findings detected

⚠️ SCA findings detected

SCA scan output




Identified 379 dependencies

Detected 153 vulnerabilities (9 Critical, 64 High, 75 Medium, 5 Low)

Displaying top 50 vulnerabilities. View the full list on the application.
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| SEVERITY |                      LIBRARY                      |       ID       |                                               TOP FIX                                                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2025-14813 | Upgrade to version  https://github.com/bcgit/bc-java.git - r1rv84,                                   |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.84,org.bouncycastle:bcprov-jdk14:1.84,                             |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.84                                                               |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-5598  | Upgrade to version  https://github.com/bcgit/bc-java.git - r1rv84,                                   |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.84,org.bouncycastle:bcprov-jdk14:1.84,                             |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.84                                                               |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-58062 | Upgrade to version org.bouncycastle:bc-fips:2.0.2,org.bouncycastle:bcprov-lts8on:2.73.12,            |
|          |                                                   |                | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,                                 |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-59650 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,    |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.85, https://github.com/bcgit/bc-java.git - r1rv85                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | bcprov-jdk18on-1.74.jar                           | CVE-2026-8763  | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bcprov-jdk15to18:1.85,      |
|          |                                                   |                | org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bc-fips:2.1.3,                                     |
|          |                                                   |                | org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bc-fips:2.0.2,                               |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | httpclient5-5.5.1.jar                             | CVE-2026-71290 | Upgrade to version  https://github.com/apache/httpcomponents-client.git - rel/v5.6.4,                |
|          |                                                   |                | org.apache.httpcomponents.client5:httpclient5:5.6.4                                                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | lz4-1.3.0.jar                                     | CVE-2025-12183 | Upgrade to version org.lz4:lz4-java:1.8.1, https://github.com/yawkat/lz4-java.git - v1.8.1           |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | netty-handler-4.1.84.Final.jar                    | CVE-2026-75595 | Upgrade to version io.netty:netty-handler:4.2.17.Final,io.netty:netty-handler:4.1.137.Final,         |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.137.Final, https://github.com/netty/netty.git -       |
|          |                                                   |                | netty-4.2.17.Final                                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| CRITICAL | undertow-core-2.2.24.Final.jar                    | CVE-2025-12543 | Upgrade to version io.undertow:undertow-core:2.2.39.Final,                                           |
|          |                                                   |                | https://github.com/undertow-io/undertow.git - 2.3.21.Final,                                          |
|          |                                                   |                | https://github.com/undertow-io/undertow.git - 2.4.0.Beta1,                                           |
|          |                                                   |                | https://github.com/undertow-io/undertow.git - 2.2.39.Final                                           |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.74.jar                           | CVE-2026-12802 | Upgrade to version org.bouncycastle:bcpkix-lts8on:2.73.12,org.bouncycastle:bcpkix-fips:2.1.12,       |
|          |                                                   |                | org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-fips:1.0.12,                            |
|          |                                                   |                | org.bouncycastle:bcpkix-fips:2.0.12,org.bouncycastle:bcpkix-jdk15to18:1.85,                          |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.74.jar                           | CVE-2026-59639 | Upgrade to version org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-lts8on:2.73.12,      |
|          |                                                   |                | org.bouncycastle:bcpkix-fips:1.0.12,org.bouncycastle:bcpkix-jdk15to18:1.85,                          |
|          |                                                   |                | org.bouncycastle:bcpkix-fips:2.1.12,org.bouncycastle:bcpkix-fips:2.0.12,                             |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcpkix-jdk18on-1.74.jar                           | CVE-2026-59642 | Upgrade to version org.bouncycastle:bcpkix-fips:1.0.12,org.bouncycastle:bcpkix-fips:2.0.12,          |
|          |                                                   |                | org.bouncycastle:bcpkix-jdk15to18:1.85,org.bouncycastle:bcpkix-fips:2.1.12,                          |
|          |                                                   |                | org.bouncycastle:bcpkix-jdk18on:1.85,org.bouncycastle:bcpkix-lts8on:2.73.12,                         |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2024-29857 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk18on:1.78,     |
|          |                                                   |                | BouncyCastle.Cryptography - 2.3.1                                                                    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2024-30172 | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.78,org.bouncycastle:bcprov-jdk15to18:1.78,      |
|          |                                                   |                | org.bouncycastle:bcprov-jdk14:1.78, BouncyCastle.Cryptography - 2.3.1                                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2024-34447 | Upgrade to version org.bouncycastle:bctls-jdk18on:1.78,org.bouncycastle:bctls-jdk15to18:1.78,        |
|          |                                                   |                | org.bouncycastle:bctls-fips:1.0.19                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-12803 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-jdk18on:1.85,      |
|          |                                                   |                | org.bouncycastle:bcprov-lts8on:2.73.12, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-12816 | Upgrade to version org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,    |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.85, https://github.com/bcgit/bc-java.git - r1rv85                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-12860 | Upgrade to version org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bcprov-lts8on:2.73.12,      |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-13506 | Upgrade to version org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bc-fips:2.0.2,            |
|          |                                                   |                | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bcprov-jdk18on:1.85 |
|          |                                                   |                | ,org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85               |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-14682 | Upgrade to version org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,              |
|          |                                                   |                | org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bc-fips:2.0.2,                                     |
|          |                                                   |                | org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcprov-jdk15to18:1.85,                       |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-58059 | Upgrade to version org.bouncycastle:bc-fips:1.0.2.7,org.bouncycastle:bcprov-lts8on:2.73.12,          |
|          |                                                   |                | org.bouncycastle:bcprov-jdk18on:1.85,org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bc-fips:2.0.2,  |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.85, https://github.com/bcgit/bc-java.git - r1rv85                |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-58060 | Upgrade to version org.bouncycastle:bcprov-lts8on:2.73.12,org.bouncycastle:bcprov-jdk18on:1.85,      |
|          |                                                   |                | org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bc-fips:2.0.2 |
|          |                                                   |                | , https://github.com/bcgit/bc-java.git - r1rv85                                                      |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcprov-jdk18on-1.74.jar                           | CVE-2026-58061 | Upgrade to version org.bouncycastle:bc-fips:2.1.3,org.bouncycastle:bcprov-jdk18on:1.85,              |
|          |                                                   |                | org.bouncycastle:bc-fips:2.0.2,org.bouncycastle:bcprov-lts8on:2.73.12,                               |
|          |                                                   |                | org.bouncycastle:bcprov-jdk15to18:1.85,org.bouncycastle:bc-fips:1.0.2.7,                             |
|          |                                                   |                | https://github.com/bcgit/bc-java.git - r1rv85                                                        |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | bcutil-jdk18on-1.74.jar                           | CVE-2026-59645 | Upgrade to version org.bouncycastle:bcutil-lts8on:2.73.12,org.bouncycastle:bcutil-fips:2.1.7,        |
|          |                                                   |                | org.bouncycastle:bcutil-jdk18on:1.85,org.bouncycastle:bcutil-jdk15to18:1.85,                         |
|          |                                                   |                | org.bouncycastle:bcutil-fips:2.0.7, https://github.com/bcgit/bc-java.git - r1rv85                    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | hibernate-validator-6.0.23.Final-redhat-00001.jar | CVE-2025-35036 | Upgrade to version  https://github.com/hibernate/hibernate-validator.git - 7.0.0.Final,              |
|          |                                                   |                | https://github.com/hibernate/hibernate-validator.git - 6.2.0.Final                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-5.2.jar                                 | CVE-2026-54399 | Upgrade to version org.apache.httpcomponents.core5:httpcore5:5.4.3,                                  |
|          |                                                   |                | org.apache.httpcomponents.core5:httpcore5:5.5-beta2,                                                 |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3,                                      |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - v5.5-beta2                                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-5.3.6.jar                               | CVE-2026-54399 | Upgrade to version org.apache.httpcomponents.core5:httpcore5:5.4.3,                                  |
|          |                                                   |                | org.apache.httpcomponents.core5:httpcore5:5.5-beta2,                                                 |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3,                                      |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - v5.5-beta2                                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-h2-5.2.jar                              | CVE-2026-54428 | Upgrade to version org.apache.httpcomponents.core5:httpcore5-h2:5.5-beta2,                           |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.5-beta2,                                  |
|          |                                                   |                | org.apache.httpcomponents.core5:httpcore5-h2:5.4.3,                                                  |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3                                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | httpcore5-h2-5.3.6.jar                            | CVE-2026-54428 | Upgrade to version org.apache.httpcomponents.core5:httpcore5-h2:5.5-beta2,                           |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.5-beta2,                                  |
|          |                                                   |                | org.apache.httpcomponents.core5:httpcore5-h2:5.4.3,                                                  |
|          |                                                   |                | https://github.com/apache/httpcomponents-core.git - rel/v5.4.3                                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.21.2.jar                                  | CVE-2026-75140 | N/A                                                                                                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | jsoup-1.22.2.jar                                  | CVE-2026-75140 | N/A                                                                                                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | keycloak-core-25.0.3.jar                          | CVE-2024-10039 | N/A                                                                                                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | keycloak-server-spi-private-25.0.3.jar            | CVE-2026-2603  | Upgrade to version  https://github.com/keycloak/keycloak.git - 26.4.10,                              |
|          |                                                   |                | https://github.com/keycloak/keycloak.git - 26.5.5                                                    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | logback-classic-1.5.32.jar                        | CVE-2026-19880 | Upgrade to version ch.qos.logback:logback-classic:1.6.3                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | logback-core-1.5.32.jar                           | CVE-2026-13006 | Upgrade to version  https://github.com/qos-ch/logback.git - v_1.5.35,                                |
|          |                                                   |                | ch.qos.logback:logback-core:1.5.35                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | lz4-1.3.0.jar                                     | CVE-2025-66566 | Upgrade to version  https://github.com/yawkat/lz4-java.git - v1.10.1                                 |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-4.1.84.Final.jar                      | CVE-2026-42583 | Upgrade to version  https://github.com/netty/netty.git - netty-4.1.133.Final,                        |
|          |                                                   |                | io.netty:netty-codec:4.1.133.Final,io.netty:netty-codec-compression:4.2.13.Final,                    |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.2.13.Final                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-4.1.84.Final.jar                      | CVE-2026-59901 | io.netty:netty-codec-compression:4.2.16.Final,io.netty:netty-codec:4.1.136.Final                     |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-dns-4.1.84.Final.jar                  | CVE-2026-42579 | Upgrade to version io.netty:netty-codec-dns:4.1.133.Final, https://github.com/netty/netty.git -      |
|          |                                                   |                | netty-4.1.133.Final,io.netty:netty-codec-dns:4.2.13.Final, https://github.com/netty/netty.git -      |
|          |                                                   |                | netty-4.2.13.Final                                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-33870 | io.netty:netty-codec-http:4.1.132.Final,io.netty:netty-codec-http:4.2.10.Final                       |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-42584 | Upgrade to version io.netty:netty-codec-http:4.1.133.Final, https://github.com/netty/netty.git -     |
|          |                                                   |                | netty-4.2.13.Final,io.netty:netty-codec-http:4.2.13.Final, https://github.com/netty/netty.git -      |
|          |                                                   |                | netty-4.1.133.Final                                                                                  |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-42587 | Upgrade to version  https://github.com/netty/netty.git - netty-4.2.13.Final,                         |
|          |                                                   |                | io.netty:netty-codec-http:4.2.13.Final, https://github.com/netty/netty.git - netty-4.1.133.Final,    |
|          |                                                   |                | io.netty:netty-codec-http2:4.1.133.Final,io.netty:netty-codec-http2:4.2.13.Final,                    |
|          |                                                   |                | io.netty:netty-codec-http:4.1.133.Final                                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-55831 | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-55833 | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final    |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http-4.1.84.Final.jar                 | CVE-2026-56745 | Upgrade to version io.netty:netty-codec-http:4.2.16.Final,io.netty:netty-codec-http:4.1.136.Final,   |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.136.Final, https://github.com/netty/netty.git -       |
|          |                                                   |                | netty-4.2.16.Final                                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2023-44487 | Upgrade to version org.eclipse.jetty.http2:http2-server:9.4.53.v20231009,10.0.17,11.0.17,            |
|          |                                                   |                | org.eclipse.jetty.http2:jetty-http2-server:12.0.2,                                                   |
|          |                                                   |                | org.eclipse.jetty.http2:http2-common:9.4.53.v20231009,10.0.17,11.0.17,                               |
|          |                                                   |                | org.eclipse.jetty.http2:jetty-http2-common:12.0.2, nghttp - v1.57.0, swift-nio-http2 - 1.28.0,       |
|          |                                                   |                | io.netty:netty-codec-http2:4.1.100.Final, trafficserver - 9.2.3,                                     |
|          |                                                   |                | org.apache.tomcat:tomcat-coyote:8.5.94,9.0.81,10.1.14,                                               |
|          |                                                   |                | org.apache.tomcat.embed:tomcat-embed-core:8.5.94,9.0.81,10.1.14, Microsoft.AspNetCore.App - 6.0.23,  |
|          |                                                   |                | 7.0.12, contour - v1.26.1, proxygen - v2023.10.16.00, grpc-go - v1.56.3,v1.57.1,v1.58.3,             |
|          |                                                   |                | kubernetes/kubernetes - v1.25.15,v1.26.10,v1.27.7,v1.28.3,v1.29.0, kubernetes/apimachinery -         |
|          |                                                   |                | v0.25.15,v0.26.10,v0.27.7,v0.28.3,v0.29.0, kubernetes/apiserver- v0.25.15,v0.26.10,v0.27.7,v0.28.3,  |
|          |                                                   |                | v0.29.0                                                                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2025-55163 | Upgrade to version  https://github.com/netty/netty.git - 4.2.4.Final,                                |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.124.Final,io.netty:netty-codec-http2:4.1.124.Final,   |
|          |                                                   |                | io.netty:netty-codec-http2:4.2.4.Final                                                               |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2026-33871 | Upgrade to version  https://github.com/netty/netty.git - netty-4.1.132.Final,                        |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.2.11.Final                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2026-42587 | Upgrade to version  https://github.com/netty/netty.git - netty-4.2.13.Final,                         |
|          |                                                   |                | io.netty:netty-codec-http:4.2.13.Final, https://github.com/netty/netty.git - netty-4.1.133.Final,    |
|          |                                                   |                | io.netty:netty-codec-http2:4.1.133.Final,io.netty:netty-codec-http2:4.2.13.Final,                    |
|          |                                                   |                | io.netty:netty-codec-http:4.1.133.Final                                                              |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+
| HIGH     | netty-codec-http2-4.1.84.Final.jar                | CVE-2026-56819 | Upgrade to version io.netty:netty-codec-http2:4.1.136.Final,io.netty:netty-codec-http2:4.2.16.Final, |
|          |                                                   |                | https://github.com/netty/netty.git - netty-4.1.136.Final, https://github.com/netty/netty.git -       |
|          |                                                   |                | netty-4.2.16.Final                                                                                   |
+----------+---------------------------------------------------+----------------+------------------------------------------------------------------------------------------------------+


Paths at risk

P = policy violation
MSC = malicious vulnerability
CRITICAL/HIGH/MEDIUM/LOW = vulnerability severity

auth-3.5.1-SNAPSHOT.jar
|-- common-3.5.1-SNAPSHOT.jar
	|-- pnc-common-3.5.1-jakarta.jar
		|-- opentelemetry-ext-cli-java-2.0.0.jar
			|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
			|-- opentelemetry-exporter-otlp-1.51.0.jar
				|-- opentelemetry-exporter-sender-okhttp-1.51.0.jar
					|-- opentelemetry-exporter-common-1.51.0.jar
						|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
				|-- opentelemetry-sdk-logs-1.51.0.jar
					|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
				|-- opentelemetry-sdk-metrics-1.51.0.jar
					|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
			|-- opentelemetry-sdk-1.51.0.jar
				|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
				|-- opentelemetry-sdk-common-1.51.0.jar
					|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
				|-- opentelemetry-sdk-trace-1.51.0.jar
					|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
			|-- opentelemetry-semconv-1.29.0-alpha.jar
				|-- opentelemetry-api-1.51.0.jar [1 MEDIUM]
		|-- jsoup-1.22.2.jar [1 HIGH, 1 MEDIUM]
	|-- rest-api-3.5.14-java-client.jar
		|-- undertow-core-2.2.24.Final.jar [1 CRITICAL, 13 HIGH, 3 MEDIUM]
		|-- dto-3.5.14.jar
			|-- jsoup-1.22.2.jar [1 HIGH, 1 MEDIUM]
|-- keycloak-installed-adapter-25.0.3.jar
	|-- undertow-core-2.2.24.Final.jar [1 CRITICAL, 13 HIGH, 3 MEDIUM]
		|-- xnio-api-3.8.7.Final.jar [2 HIGH]
		|-- xnio-nio-3.8.7.Final.jar
			|-- xnio-api-3.8.7.Final.jar [2 HIGH]
	|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
	|-- keycloak-adapter-core-25.0.3.jar [1 MEDIUM]
		|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
		|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
		|-- keycloak-crypto-default-25.0.3.jar
			|-- bcpkix-jdk18on-1.74.jar [3 HIGH, 5 MEDIUM]
				|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
				|-- bcutil-jdk18on-1.74.jar [1 HIGH]
					|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
			|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
			|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
			|-- keycloak-server-spi-private-25.0.3.jar [1 HIGH, 7 MEDIUM, 1 LOW]
				|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
			|-- keycloak-server-spi-25.0.3.jar
				|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
	|-- keycloak-adapter-spi-25.0.3.jar
		|-- bcprov-jdk18on-1.74.jar [5 CRITICAL, 11 HIGH, 13 MEDIUM]
	|-- keycloak-core-25.0.3.jar [1 HIGH, 3 MEDIUM, 2 LOW]
		|-- keycloak-common-25.0.3.jar [2 MEDIUM]
cli-3.5.1-SNAPSHOT.jar
|-- logback-classic-1.5.32.jar [1 HIGH]
	|-- logback-core-1.5.32.jar [1 HIGH, 2 MEDIUM]
		|-- jansi-2.4.3.jar [1 LOW]
|-- jansi-2.4.3.jar [1 LOW]
|-- common-3.5.1-SNAPSHOT.jar
	|-- logback-classic-1.5.32.jar [1 HIGH]
	|-- pnc-common-3.5.1-jakarta.jar
		|-- jsoup-1.22.2.jar [1 HIGH, 1 MEDIUM]
|-- experimental-3.5.1-SNAPSHOT.jar
	|-- quarkus-domino-api-0.0.133.jar
		|-- quarkus-platform-bom-decomposer-0.0.133.jar
			|-- quarkus-bootstrap-maven-resolver-3.35.3.jar
				|-- smallrye-beanbag-maven-1.6.1.jar
					|-- jsoup-1.22.2.jar [1 HIGH, 1 MEDIUM]
		|-- cyclonedx-core-java-12.1.0.jar
			|-- json-schema-validator-1.5.9.jar
				|-- logback-classic-1.5.32.jar [1 HIGH]
				|-- itu-1.14.0.jar
					|-- logback-classic-1.5.32.jar [1 HIGH]
				|-- undertow-core-2.2.24.Final.jar [1 CRITICAL, 13 HIGH, 3 MEDIUM]
|-- pig-3.5.1-SNAPSHOT.jar
	|-- logback-classic-1.5.32.jar [1 HIGH]
	|-- logback-core-1.5.32.jar [1 HIGH, 2 MEDIUM]
	|-- org.eclipse.sisu.inject-1.1.0.jar
		|-- guice-5.1.0-classes.jar
			|-- guava-28.1-jre.jar [1 MEDIUM, 1 LOW]
	|-- javax.el-3.0.1-b12.jar [1 MEDIUM]
	|-- licenses-generator-3.5.1-SNAPSHOT.jar
		|-- maven-core-3.9.16.jar
			|-- guava-28.1-jre.jar [1 MEDIUM, 1 LOW]
			|-- maven-resolver-provider-3.9.16.jar
				|-- guava-28.1-jre.jar [1 MEDIUM, 1 LOW]
		|-- maven-embedder-3.9.16.jar
			|-- logback-classic-1.5.32.jar [1 HIGH]
			|-- guava-28.1-jre.jar [1 MEDIUM, 1 LOW]
			|-- maven-shared-utils-3.4.2.jar
				|-- jansi-2.4.3.jar [1 LOW]
			|-- jansi-2.4.3.jar [1 LOW]
	|-- core-2.6.7.jar
		|-- logback-classic-1.5.32.jar [1 HIGH]
		|-- guava-28.1-jre.jar [1 MEDIUM, 1 LOW]
		|-- commons-vfs2-2.10.0.jar
			|-- httpclient5-5.5.1.jar [1 CRITICAL, 1 MEDIUM]
			|-- httpcore5-5.3.6.jar [1 HIGH]
... *truncated, see full logs below*

SAST scan output

*no findings*

Full logs and artifacts

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-jline.version branch 3 times, most recently from ced842b to 46b67a4 Compare March 11, 2026 09:39

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-jline.version branch 4 times, most recently from 5592fb3 to aa4b19b Compare March 23, 2026 13:25

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-jline.version branch 3 times, most recently from 385bf23 to e2a638c Compare April 8, 2026 09:56

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-jline.version branch 2 times, most recently from d50ca61 to d6ce7f6 Compare April 30, 2026 01:49

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-jline.version branch 2 times, most recently from e65cb13 to c363edc Compare May 6, 2026 15:41

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-jline.version branch 2 times, most recently from 87cf1bc to ba99241 Compare May 24, 2026 21:50

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-jline.version branch from ba99241 to f6c1682 Compare May 28, 2026 15:12

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-jline.version branch 2 times, most recently from 3995810 to 408e42d Compare June 20, 2026 06:50

red-hat-konflux Bot changed the title ~~Update jline.version to v4 (major)~~ Update jline.version to v4 Jun 25, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-jline.version branch 3 times, most recently from ab32822 to 5fd46e3 Compare July 9, 2026 13:34

Update jline.version to v4

528691a

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot force-pushed the konflux/mintmaker/main/major-jline.version branch from 5fd46e3 to 528691a Compare August 30, 2026 01:25

Navigation Menu

Uh oh!

Update jline.version to v4 - #1666

Update jline.version to v4#1666
red-hat-konflux[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main/major-jline.version

red-hat-konflux Bot commented Mar 3, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 24, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

red-hat-konflux Bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v4.4.0: JLine 4.4.0

💥 Breaking changes

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

📦 Dependency updates

👻 Maintenance

v4.3.1: JLine 4.3.1

🔒 Security Fixes

🐛 Bug Fixes

v4.3.0: JLine 4.3.0

✨ New Features

🔒 Security Hardening

🐛 Bug Fixes

🔧 Refactoring

📦 Dependency Updates

v4.2.1: JLine 4.2.1

🔒 Security Fixes

🐛 Bug Fixes

📦 Dependency updates

v4.2.0: JLine 4.2.0

🚀 New features and improvements

🐛 Bug Fixes

📦 Dependency updates

👻 Maintenance

🚦 Tests

v4.1.3: JLine 4.1.3

Bug Fixes

Chores

Dependencies

v4.1.2: JLine 4.1.2

Bug Fixes

Dependencies

v4.1.1: JLine 4.1.1

🐛 Bug Fixes

📦 Dependency updates

👻 Maintenance

New Contributors

v4.1.0: JLine 4.1.0

🚀 New features and improvements

🐛 Bug Fixes

📦 Dependency updates

📝 Documentation updates

👻 Maintenance

🚦 Tests

v4.0.16: JLine 4.0.16

What's Changed

v4.0.15: JLine 4.0.15

Configuration

Documentation

Uh oh!

github-actions Bot commented May 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Mend Scan Results

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

red-hat-konflux Bot commented Mar 3, 2026 •

edited

Loading

`v4.4.0`: JLine 4.4.0

`v4.3.1`: JLine 4.3.1

`v4.3.0`: JLine 4.3.0

`v4.2.1`: JLine 4.2.1

`v4.2.0`: JLine 4.2.0

`v4.1.3`: JLine 4.1.3

`v4.1.2`: JLine 4.1.2

`v4.1.1`: JLine 4.1.1

`v4.1.0`: JLine 4.1.0

`v4.0.16`: JLine 4.0.16

`v4.0.15`: JLine 4.0.15

github-actions Bot commented May 24, 2026 •

edited

Loading