[CORE-69]: Bump the minor-and-patch-updates group across 1 directory with 4 updates

[dependabot]

Bumps the minor-and-patch-updates group with 4 updates in the / directory: org.apache.avro:avro, ch.qos.logback:logback-classic, com.fasterxml.jackson.core:jackson-databind and com.diffplug.spotless:spotless-plugin-gradle.

Updates org.apache.avro:avro from 1.12.1 to 1.12.2

Updates ch.qos.logback:logback-classic from 1.5.32 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

• In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

• Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

• The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

• ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

• Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

• The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

-- Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

• Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

• Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

  <property name="logback.skipCallerContradictionAnalysis" value="true"/>

• SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

• Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

• Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

• Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

... (truncated)

Commits

• e8e824d prepare release 1.6.3
• 761821b MDCBasedDiscriminator has a gated warning mechanism
• 53ed122 update copyright year
• c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
• b5aa931 added BatchedSimpleInvocationGate
• 1f22af7 add javadocs to SimpleInvocationGate
• 638ffa7 prevent forward and backward slashes to escape to other directories
• 7d6b9a4 add missing ch.qos.logback.core.property package
• fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
• c73b43f deprecate the withJansi path
• Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-databind from 2.21.3 to 2.22.2

Commits

• 25b2a22 [maven-release-plugin] prepare release jackson-databind-2.22.2
• bab1c1a Prep for 2.22.2 release
• bc03cf8 Merge branch '2.21' into 2.22
• 83379fb Merge branch '2.20' into 2.21
• 0d400c9 Merge branch '2.19' into 2.20
• ce36a27 Merge branch '2.18' into 2.19
• 7a209e1 Post-release dep version bump
• a432707 [maven-release-plugin] prepare for next development iteration
• 176df1d [maven-release-plugin] prepare release jackson-databind-2.18.10
• 7785f5f Prep for 2.18.10 release
• Additional commits viewable in compare view

Updates com.diffplug.spotless:spotless-plugin-gradle from 8.4.0 to 8.10.1

Release notes

Sourced from com.diffplug.spotless:spotless-plugin-gradle's releases.

Gradle Plugin v8.10.1

Fixed

• prettier() and other npm-based steps no longer fail to start on npm 12 (EUNKNOWNCONFIG from --scripts-prepend-node-path). (#3024)
• spotlessInternalRegisterDependencies now writes its output under a build directory that is configured after the plugin is applied, instead of always under the default build/. (#2114)
• targetExclude now accepts a Gradle Directory, DirectoryProperty, or Provider<Directory> and excludes the files under it. Previously the directory was treated as a single file, so excluding one silently did nothing. (#2667)

Gradle Plugin v8.10.0

Added

• New shortenFullyQualifiedTypes() step for Java, which replaces fully-qualified type names with their simple names and adds the imports they need. Best combined with importOrder() and removeUnusedImports(). (#2945)
• Add embedded lockfiles to Eclipse JDT for every supported version (4.9 through 4.40), so eclipse() resolves from Maven Central instead of querying a P2 update site. Versions without an embedded lockfile still fall back to P2 provisioning. (#1996)

Fixed

• removeUnusedImports no longer fails on Java import module declarations. (#2890)
• expandWildcardImports() now builds its type-solver classpath from each Java source set's compile classpath instead of every resolvable configuration. Unrelated configurations (for example generated-code or custom resolvable configs that are not ready yet) are no longer resolved. (#2998)
• spotlessCheck violation message now suggests the correct composite/included-build task path (e.g. ./gradlew :my-utils:spotlessApply) instead of a bare spotlessApply / :spotlessApply that does not select included-build tasks. (#2421)
• Parallel multi-project builds no longer intermittently fail with "Cannot fingerprint input property 'stepsInternalEquality': ConfigurationCacheHackList cannot be serialized" / "Failed to provision P2 dependencies" when using eclipse() (or other P2-backed steps). Subprojects now share one deduping P2 provisioner and P2 queries are serialized process-wide. (#3004)

Changes

• Default google-java-format remains 1.28.0 on JVM 17; bumps to 1.30.0 on JVM 21+; require at least 1.30.0 on JVM 25+ for import module support.
• Bump default eclipse version to latest 4.39 -> 4.40. (#1996)
• Bump default adocfmt version 0.2.0 -> 0.3.1, which adds table formatting support (formatTables, tableLayout, tableMaxLineWidth, tableBlankLines).

Gradle Plugin v8.9.0

Added

• Add support for Java formatting via prince-of-space with the new princeOfSpace() step. (#2991)

Fixed

• Prevent parallel Gradle input fingerprinting from failing when toggleOffOn() wraps a slow lazy formatter step with no matching target files. (#2994)

Changes

• Bump default greclipse version to latest 4.39 -> 4.40. (#2989)
• Bump default tabletest-formatter version 1.1.1 -> 1.1.2.

Gradle Plugin v8.8.0

Added

• Add support for custom string format for license header copyright year via yearStringFormat(). (#2965)

Gradle Plugin v8.7.0

Added

• Add support for AsciiDoc formatting via adocfmt. (#2960)
• flexmark() step now supports arbitrary formatter options via the formatterOptions map. (#2968)

Fixed

• toggleOffOn no longer disables lint-only steps such as forbidWildcardImports. (#2962)
• Prevent build caches from interfering when executing under the -PspotlessIdeHook mode. (#2365)
• Parse standard git year output in LicenseHeaderStep. (#2940)
• Fix StringIndexOutOfBoundsException in scenarios where copyright year is surrounded by whitespace. (#2973)

Changes

• Bump default greclipse version to latest 4.35 -> 4.39. (#2924)

Gradle Plugin v8.6.0

Added

• Add cacheDirectory(...) to eclipse(), eclipseCdt(), and greclipse(); the default P2 cache is $GRADLE_USER_HOME/caches/p2-data. (#2944)

Fixed

... (truncated)

Commits

• f2f2348 Published gradle/8.10.1
• 4bc8980 Published lib/4.10.1
• 6fedfd5 chore(deps): update plugin errorprone to v5.1.1 (#3035)
• 5e10f0b chore(deps): update plugin errorprone to v5.1.1
• 3aa82b5 fix: expand a directory passed to targetExclude into the files under it (#3032)
• 68bddde shortenFullyQualifiedTypes: skip FQNs whose simple name clashes with types de...
• 6f73ed3 fix(deps): update dependency org.codehaus.plexus:plexus-utils to v4.1.0 (#3030)
• bdeafe7 docs: changelog entry for the targetExclude directory fix
• 4187eb3 fix: expand a directory passed to targetExclude into the files under it
• cd525f2 shortenFullyQualifiedTypes: skip FQNs clashing with types declared in the sam...
• Additional commits viewable in compare view

[davidangb]

@dependabot rebase