You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/22 07:30:24 UTC
[PR] chore(deps-dev): Bump com.nimbusds:nimbus-jose-jwt from 10.9.1 to 10.10 [camel]
dependabot[bot] opened a new pull request, #26727:
URL: https://github.com/apache/camel/pull/26727
Bumps [com.nimbusds:nimbus-jose-jwt](https://bitbucket.org/connect2id/nimbus-jose-jwt) from 10.9.1 to 10.10.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt">com.nimbusds:nimbus-jose-jwt's changelog</a>.</em></p>
<blockquote>
<p>10.9.1 (2026-05-31)
* Fixes health status reporting when RefreshAheadCachingJWKSetSource,
JWKSetSourceWithHealthStatusReporting and OutageTolerantJWKSetSource are
used together. A failed refresh-ahead background update could previously
cause JWKSetSourceWithHealthStatusReporting to mark the JWK set source as
UNHEALTHY, even though OutageTolerantJWKSetSource was still within its
configured outage tolerance window and regular JWT validation could
continue using the cached JWK set. Refresh-ahead failures that are
covered by outage tolerance no longer cause the health status to become
unhealthy before the outage tolerance period has been exceeded (iss
<a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/619">#619</a>).</p>
<p>10.10 (2026-09-17)
* Adds JWEObject.MAX_DECOMPRESSED_PLAIN_TEXT_LENGTH for the default maximum
allowed length of decompressed plain text, in bytes. Used to establish an
active (dynamic) safety limit against zip-bomb attacks. Set to 1 mio bytes
(iss <a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/611">#611</a>).
* Adds MaxDecompressedPlainTextLength implementing JWEDecrypterOption, to
enable applications to override the default
JWEObject.MAX_DECOMPRESSED_PLAIN_TEXT_LENGTH (iss <a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/611">#611</a>).
* Adds explicit non-null checks to DeflateUtils (iss <a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/611">#611</a>).
* Fixes potential native memory resource leak in DeflateUtils when Deflater
or Inflater instances were not guaranteed to call .end() if stream
closing or processing threw an exception (iss <a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/611">#611</a>).
* Optimizes DeflateUtils resource management and memory allocation by
guaranteeing native stream cleanup, validating inputs, and pre-allocating
decompression buffers (iss <a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/611">#611</a>).
* Updates to com.google.code.gson:gson:2.14.0
* Updates to com.google.crypto.tink:tink:1.23.0
* Updates to BouncyCastle 1.86</p>
<p>11.0 (2026-09-xx)
* Compile source and target bumped from Java 7 to Java 8.
* Optimises JWS input composition for unencoded payloads (RFC 7797) to
conserve memory and CPU cycles. Introduces a helper JWSInput interface
with a ByteArrayJWSInput and ComposedJWSInput implementations for the JWS
input composition when the payloaded is encoded and when not (iss <a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/613">#613</a>).
* Adds JWTClaimsSet.getInstantClaims, getExpirationInstant,
getNotBeforeInstant and getIssueInstant methods. Adds
JWTClaimsSet.Builder.expirationInstant, notBeforeInstant and issueInstant
methods.
* Adds JSONObjectUtils.getEpochSecondAsInstant static method.
* Overrides equals and hashCode in Payload.
* Fixes health status reporting when RefreshAheadCachingJWKSetSource,
JWKSetSourceWithHealthStatusReporting and OutageTolerantJWKSetSource are
used together. A failed refresh-ahead background update could previously
cause JWKSetSourceWithHealthStatusReporting to mark the JWK set source as
UNHEALTHY, even though OutageTolerantJWKSetSource was still within its
configured outage tolerance window and regular JWT validation could
continue using the cached JWK set. Refresh-ahead failures that are</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/e055b3bf56bf379cf1ad0b804fe167cdd28ef445"><code>e055b3b</code></a> [maven-release-plugin] prepare for next development iteration</li>
<li><a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/c06d7694e9b40e7e759080249cd72fa658b3a26f"><code>c06d769</code></a> Adds JWEObject.MAX_DECOMPRESSED_PLAIN_TEXT_LENGTH - 10.x WIP (iss <a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/611">#611</a>)</li>
<li><a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/a4275136b97d927940d8894b9111fe096d3202c4"><code>a427513</code></a> Adds explicit non-null checks to DeflateUtils (iss <a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/611">#611</a>)</li>
<li><a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3302e151d38049e5cd872ea73503ccda30eb57f0"><code>3302e15</code></a> Fixes potential native memory resource leak in DeflateUtils when Deflater or ...</li>
<li><a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/d004e7996dd1ec9cf3a0f2329098f4b04d2cc7db"><code>d004e79</code></a> Optimizes DeflateUtils resource management and memory allocation by guarantee...</li>
<li><a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/98ed6bad083355abd9f40452773ae5ced831c985"><code>98ed6ba</code></a> Adjusts JWEObject.MAX_DECOMPRESSED_PLAIN_TEXT_LENGTH to 1 mio bytes (iss <a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/611">#611</a>)</li>
<li><a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/03501441035765c4d02e1e5d7636c5ad246f61cd"><code>0350144</code></a> Adds MaxDecompressedPlainTextLength implementing JWEDecrypterOption (iss <a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/611">#611</a>)</li>
<li><a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/218575fe2d5082ebb724f741371d2b0ddb1482f4"><code>218575f</code></a> Wires MaxDecompressedPlainTextLength (iss <a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/611">#611</a>)</li>
<li><a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/3fcb8f5d0a13ca7d7d3361400f49a67443c50c05"><code>3fcb8f5</code></a> Adds MaxDecompressedPlainTextLength tests for each JWEDecrypter (iss <a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/611">#611</a>)</li>
<li><a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/14ae7ac2a8bfb9566506c843b8bb94463d6d43bf"><code>14ae7ac</code></a> Adds CHANGELOG.txt entries (iss <a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/611">#611</a>)</li>
<li>Additional commits viewable in <a href="https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/10.10..10.9.1">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps-dev): Bump com.nimbusds:nimbus-jose-jwt from 10.9.1 to 10.10 [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #26727:
URL: https://github.com/apache/camel/pull/26727#issuecomment-5772778258
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps-dev): Bump com.nimbusds:nimbus-jose-jwt from 10.9.1 to 10.10 [camel]
Posted by "apupier (via GitHub)" <gi...@apache.org>.
apupier merged PR #26727:
URL: https://github.com/apache/camel/pull/26727
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps-dev): Bump com.nimbusds:nimbus-jose-jwt from 10.9.1 to 10.10 [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #26727:
URL: https://github.com/apache/camel/pull/26727#issuecomment-5773104961
<!-- ci-tested-modules -->
:test_tube: **CI tested the following changed modules:**
- `parent`
:white_check_mark: **POM dependency changes: targeted tests included**
Changed properties: nimbus-jose-jwt
<details><summary>Modules affected by dependency changes (2)</summary>
- `:camel-undertow-spring-security`
- `:camel-oauth`
</details>
---
<details><summary>:microscope: Scalpel shadow comparison — Scalpel: 20 of 692 tested, 4 compile-only — current: 0 all tested</summary>
[Maveniverse Scalpel](https://github.com/maveniverse/scalpel) detected **48 affected modules** (current approach: 0).
Changed properties: nimbus-jose-jwt
**Skip-tests mode would test 20 modules** (9 direct + 4 downstream), **skip tests for 4** (generated code, meta-modules)
<details><summary>:warning: Modules only in Scalpel (48)</summary>
- `apache-camel`
- `camel-allcomponents`
- `camel-catalog`
- `camel-catalog-console`
- `camel-catalog-maven`
- `camel-catalog-suggest`
- `camel-componentdsl`
- `camel-endpointdsl`
- `camel-endpointdsl-support`
- `camel-etc`
- `camel-itest`
- `camel-jbang-core`
- `camel-jbang-it`
- `camel-jbang-main`
- `camel-jbang-mcp`
- `camel-jbang-plugin-edit`
- `camel-jbang-plugin-generate`
- `camel-jbang-plugin-kubernetes`
- `camel-jbang-plugin-mcp`
- `camel-jbang-plugin-route-parser`
- `camel-jbang-plugin-test`
- `camel-jbang-plugin-tui`
- `camel-jbang-plugin-validate`
- `camel-jpa`
- `camel-kamelet-main`
- `camel-launcher`
- `camel-launcher-container`
- `camel-oauth`
- `camel-opentelemetry`
- `camel-report-maven-plugin`
- `camel-route-parser`
- `camel-salesforce`
- `camel-salesforce-codegen`
- `camel-salesforce-maven-plugin`
- `camel-salesforce-parent`
- `camel-servicenow`
- `camel-servicenow-maven-plugin`
- `camel-servicenow-parent`
- `camel-undertow-spring-security`
- `camel-wasm`
- `camel-yaml-dsl`
- `camel-yaml-dsl-deserializers`
- `camel-yaml-dsl-maven-plugin`
- `camel-yaml-dsl-validator`
- `camel-yaml-dsl-validator-maven-plugin`
- `coverage`
- `docs`
- `dummy-component`
</details>
<details><summary>Modules Scalpel would test (20)</summary>
- `apache-camel` ← depends on affected reactor module org.apache.camel:camel-route-parser
- `camel-allcomponents` ← depends on affected reactor module org.apache.camel:camel-wasm
- `camel-catalog` ← depends on affected reactor module org.apache.camel:camel-allcomponents
- `camel-catalog-console` ← depends on affected reactor module org.apache.camel:camel-allcomponents
- `camel-catalog-maven` ← depends on affected reactor module org.apache.camel:camel-allcomponents
- `camel-catalog-suggest` ← depends on affected reactor module org.apache.camel:camel-catalog
- `camel-componentdsl` ← depends on affected reactor module org.apache.camel:camel-catalog
- `camel-endpointdsl` ← depends on affected reactor module org.apache.camel:camel-catalog
- `camel-endpointdsl-support` ← depends on affected reactor module org.apache.camel:camel-endpointdsl
- `camel-etc` ← effective property workspace
- `camel-jbang-core` ← depends on affected reactor module org.apache.camel:camel-yaml-dsl-validator
- `camel-jbang-it` ← depends on affected reactor module org.apache.camel:camel-jbang-core
- `camel-jbang-main` ← depends on affected reactor module org.apache.camel:camel-jbang-core
- `camel-jbang-mcp` ← depends on affected reactor module org.apache.camel:camel-yaml-dsl-validator
- `camel-jbang-plugin-edit` ← depends on affected reactor module org.apache.camel:camel-route-parser
- `camel-jbang-plugin-generate` ← depends on affected reactor module org.apache.camel:camel-jbang-core
- `camel-jbang-plugin-kubernetes` ← depends on affected reactor module org.apache.camel:camel-jbang-core
- `camel-jbang-plugin-mcp` ← depends on affected reactor module org.apache.camel:camel-jbang-core
- `camel-jbang-plugin-route-parser` ← depends on affected reactor module org.apache.camel:camel-route-parser
- `camel-jbang-plugin-test` ← depends on affected reactor module org.apache.camel:camel-jbang-core
- `camel-jbang-plugin-tui` ← depends on affected reactor module org.apache.camel:camel-yaml-dsl-validator
- `camel-jbang-plugin-validate` ← depends on affected reactor module org.apache.camel:camel-yaml-dsl-validator
- `camel-jpa` ← effective property camel.surefire.fork.additional-vmargs
- `camel-kamelet-main` ← depends on affected reactor module org.apache.camel:camel-catalog-console
- `camel-launcher` ← depends on affected reactor module org.apache.camel:camel-jbang-plugin-validate
- `camel-launcher-container` ← effective property docker.context
- `camel-oauth` ← effective dep com.nimbusds:nimbus-jose-jwt
- `camel-opentelemetry` ← effective property opentracing-agent.lib
- `camel-report-maven-plugin` ← depends on affected reactor module org.apache.camel:camel-route-parser
- `camel-route-parser` ← depends on affected reactor module org.apache.camel:camel-allcomponents
- `camel-salesforce` ← downstream of org.apache.camel:camel-salesforce-parent
- `camel-salesforce-codegen` ← downstream of org.apache.camel:camel-salesforce-parent
- `camel-salesforce-parent` ← effective property salesforce.component.root
- `camel-servicenow` ← downstream of org.apache.camel:camel-servicenow-parent
- `camel-servicenow-maven-plugin` ← downstream of org.apache.camel:camel-servicenow-parent
- `camel-servicenow-parent` ← effective property servicenow.component.root
- `camel-undertow-spring-security` ← effective dep com.nimbusds:nimbus-jose-jwt
- `camel-wasm` ← effective property camel.surefire.fork.additional-vmargs
- `camel-yaml-dsl-maven-plugin` ← depends on affected reactor module org.apache.camel:camel-catalog
- `camel-yaml-dsl-validator` ← depends on affected reactor module org.apache.camel:camel-catalog
- `camel-yaml-dsl-validator-maven-plugin` ← depends on affected reactor module org.apache.camel:camel-yaml-dsl-validator
- `coverage` ← depends on affected reactor module org.apache.camel:camel-report-maven-plugin
- `docs` ← depends on affected reactor module org.apache.camel:camel-allcomponents
- `dummy-component` ← depends on affected reactor module org.apache.camel:camel-allcomponents
</details>
<details><summary>Modules with tests skipped (4)</summary>
- `camel-itest`
- `camel-salesforce-maven-plugin`
- `camel-yaml-dsl`
- `camel-yaml-dsl-deserializers`
</details>
> :information_source: Shadow mode — Scalpel observes but does not affect test execution. [Learn more](https://github.com/maveniverse/scalpel)
</details>
<details><summary>All tested modules (49 modules, 7m 19s total)</summary>
**Total reactor time:** 7m 19s
| Module | Duration | Status |
| --- | --- | --- |
| Camel :: Launcher | 51.1s | SUCCESS |
| Camel :: JPA | 45.9s | SUCCESS |
| Camel :: Salesforce | 44.0s | SUCCESS |
| Camel :: JBang :: MCP | 39.2s | SUCCESS |
| Camel :: JBang :: Plugin :: TUI | 30.8s | SUCCESS |
| Camel :: OpenTelemetry (deprecated) | 25.2s | SUCCESS |
| Camel :: OAuth | 24.4s | SUCCESS |
| Camel :: Catalog :: Camel Catalog | 21.7s | SUCCESS |
| Camel :: Component DSL | 19.0s | SUCCESS |
| Camel :: JBang :: Plugin :: Kubernetes | 14.3s | SUCCESS |
| Camel :: Docs | 14.1s | SUCCESS |
| Camel :: Wasm | 12.7s | SUCCESS |
| Camel :: JBang :: Plugin :: Testing | 7.5s | SUCCESS |
| Camel :: Catalog :: Camel Report Maven Plugin | 7.4s | SUCCESS |
| Camel :: Kamelet Main | 7.2s | SUCCESS |
| Camel :: YAML DSL :: Validator | 7.0s | SUCCESS |
| Camel :: Catalog :: Camel Route Parser | 6.6s | SUCCESS |
| Camel :: Undertow Spring Security | 6.2s | SUCCESS |
| Camel :: Salesforce :: Maven Plugin | 5.6s | SUCCESS |
| Camel :: ServiceNow :: Component | 5.5s | SUCCESS |
| Camel :: All Components Sync point | 4.8s | SUCCESS |
| Camel :: JBang :: Plugin :: Validate | 4.6s | SUCCESS |
| Camel :: YAML DSL :: Deserializers | 4.4s | SUCCESS |
| Camel :: YAML DSL :: Validator Maven Plugin | 3.6s | SUCCESS |
| Camel :: Catalog :: Maven | 2.8s | SUCCESS |
| Camel :: ServiceNow :: Maven Plugin | 2.5s | SUCCESS |
| Camel :: Catalog :: Suggest (deprecated) | 2.4s | SUCCESS |
| Camel :: Assembly | 2.1s | SUCCESS |
| Camel :: YAML DSL :: Maven Plugins | 1.7s | SUCCESS |
| Camel :: ServiceNow :: Parent | 1.7s | SUCCESS |
| Camel :: JBang :: Plugin :: Edit | 1.4s | SUCCESS |
| Camel :: Parent | 1.2s | SUCCESS |
| Camel :: Coverage | 1.2s | SUCCESS |
| Camel :: JBang :: Plugin :: Generate | 1.1s | SUCCESS |
| Camel :: JBang :: Integration tests | 1.0s | SUCCESS |
| Camel :: Salesforce :: Parent | 1.0s | SUCCESS |
| Camel :: Salesforce :: CodeGen | 0.9s | SUCCESS |
| Camel :: Endpoint DSL :: Support | 0.9s | SUCCESS |
| Camel :: JBang :: Main | 0.9s | SUCCESS |
| Camel :: Catalog :: Dummy Component | 0.8s | SUCCESS |
| Camel :: JBang :: Plugin :: MCP | 0.8s | SUCCESS |
| Camel :: Catalog :: Console | 0.7s | SUCCESS |
| Camel :: JBang :: Plugin :: Route Parser | 0.5s | SUCCESS |
| Camel :: Launcher :: Container | 0.5s | SUCCESS |
| Camel :: Etc | 0.1s | SUCCESS |
| Camel :: Endpoint DSL | n/a | |
| Camel :: Integration Tests | n/a | |
| Camel :: JBang :: Core | n/a | |
| Camel :: YAML DSL | n/a | |
**Top 20 slowest modules:**
- `Camel :: Launcher` (51.1s)
- `Camel :: JPA` (45.9s)
- `Camel :: Salesforce` (44.0s)
- `Camel :: JBang :: MCP` (39.2s)
- `Camel :: JBang :: Plugin :: TUI` (30.8s)
- `Camel :: OpenTelemetry (deprecated)` (25.2s)
- `Camel :: OAuth` (24.4s)
- `Camel :: Catalog :: Camel Catalog` (21.7s)
- `Camel :: Component DSL` (19.0s)
- `Camel :: JBang :: Plugin :: Kubernetes` (14.3s)
- `Camel :: Docs` (14.1s)
- `Camel :: Wasm` (12.7s)
- `Camel :: JBang :: Plugin :: Testing` (7.5s)
- `Camel :: Catalog :: Camel Report Maven Plugin` (7.4s)
- `Camel :: Kamelet Main` (7.2s)
- `Camel :: YAML DSL :: Validator` (7.0s)
- `Camel :: Catalog :: Camel Route Parser` (6.6s)
- `Camel :: Undertow Spring Security` (6.2s)
- `Camel :: Salesforce :: Maven Plugin` (5.6s)
- `Camel :: ServiceNow :: Component` (5.5s)
</details>
---
:gear: [View full build and test results](https://github.com/apache/camel/actions/runs/35699943744)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org