build(deps): bump the gradle group across 2 directories with 7 updates

[dependabot]

Bumps the gradle group with 6 updates in the / directory:

Package	From	To
org.springframework.modulith:spring-modulith-bom	2.1.0	2.1.1
com.google.auth:google-auth-library-oauth2-http	1.50.0	1.51.0
com.googlecode.libphonenumber:libphonenumber	9.0.37	9.0.38
org.flywaydb:flyway-mysql	13.3.0	13.4.0
io.github.classgraph:classgraph	4.8.193	4.8.194
org.graalvm.buildtools.native	1.1.10	1.1.11

Bumps the gradle group with 1 update in the /build-logic directory: org.openapitools:openapi-generator-gradle-plugin.

Updates org.springframework.modulith:spring-modulith-bom from 2.1.0 to 2.1.1

Release notes

Sourced from org.springframework.modulith:spring-modulith-bom's releases.

2.1.1

💡 Improvements

• Use Namastack version property in spring-modulith-events-core #1807

🪲 Bugs

• Event externalization throws ClassCastException with event listener using ApplicationListener.forPayload(…) #1832
• RabbitJackson2Configuration and RabbitJacksonConfiguration conflict when Jackson 2.x is on classpath (e.g. Eureka Client) #1830
• Ambiguous violation message when referring to a non-exposed type in a module generally available for access #1827
• ConcurrentModificationException in TestExecutionCondition when running tests with JUnit parallel class execution #1824
• Typo in spring.modulith.events.staleness.check-interval configuration property #1822
• Potential NullPointerException in FormattableType.of(…) for wildcard types #1806
• Fix Testcontainers setup to ensure fresh containers for SQL databases #1802
• MongoDB event publication tests use default localhost connection instead of Testcontainers #1755
• Unbounded wildcard / type-variable generic parameters break FormattableType (NPE in DefaultObservedModule.render) #1754
• Root module Flyway migrations are not executed during a test #1753

🔨 Dependency Upgrades

• Upgrade to Spring Boot 4.1.1 #1820
• Upgrade to Namastack Outbox 1.7.3 #1796, #1814
• Upgrade to Spring Framework 7.0.9 #1813
• Upgrade to Micrometer Tracing 1.7.1 #1812
• Upgrade to jGit 7.7.1.202607240634-r #1797

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​arendomoda, @​arimu1, @​char-yb, @​DragonFSKY, @​Hashim1999164, @​kalayciburak, @​seonwooj0810

Commits

• 83ce54c GH-1833 - Release version 2.1.1.
• ef8d256 GH-1832 - Polishing.
• 51e2cc4 GH-1832 - Invoke listeners through SimpleApplicationEventMulticaster.
• 3066000 GH-1830 - Polishing.
• 8127446 GH-1830 - Resolve Rabbit Jackson configuration conflict.
• 2bdcdc3 GH-1827 - Polishing.
• f93a928 GH-1827 - Clarify violation for non-exposed types in allowed modules.
• dacf640 GH-1824 - Use ConcurrentHashMap for the module dependency cache.
• 6827fd5 GH-1822 - Polishing.
• ccd78da GH-1822 - Fix typo in staleness check-interval property
• Additional commits viewable in compare view

Updates com.google.auth:google-auth-library-oauth2-http from 1.50.0 to 1.51.0

Updates com.googlecode.libphonenumber:libphonenumber from 9.0.37 to 9.0.38

Release notes

Sourced from com.googlecode.libphonenumber:libphonenumber's releases.

v9.0.38

Hi all,

Please find the new JARs on the maven site here.

The new release contains mostly metadata changes. Thanks to all those who contributed by providing issue reports! See detailed release notes.

Want to be notified of future releases? Join the discussion group!

Changelog

Sourced from com.googlecode.libphonenumber:libphonenumber's changelog.

Aug 26, 2026: v9.0.38 Metadata changes:

• Updated phone metadata for region code(s): GM, HK, IN, JO, PG, SN, TZ, ZW
• Updated geocoding data for country calling code(s): 55 (en), 61 (en), 91 (en), 220 (en), 221 (en), 263 (en)
• Updated carrier data for country calling code(s): 221 (en), 254 (en), 255 (en), 373 (en), 675 (en), 852 (en, zh), 962 (en)

Aug 13, 2026: v9.0.37 Metadata changes:

• Updated alternate formatting data for country calling code(s): 34, 90
• Updated phone metadata for region code(s): AR, BD, CL, ES, FJ, GM, GY, IL, MZ, NO, PE, SJ, SY, TG, TR, UG
• Updated short number metadata for region code(s): ES
• Updated geocoding data for country calling code(s): 220 (en), 963 (en)
• Updated carrier data for country calling code(s): 47 (en), 56 (en), 90 (en), 220 (en), 228 (en), 234 (en), 254 (en), 256 (en), 592 (en), 963 (en), 972 (en)
• Updated / refreshed time zone meta data.

Jul 30, 2026: v9.0.36 Metadata changes:

• Updated alternate formatting data for country calling code(s): 995
• Updated phone metadata for region code(s): BD, EH, FO, GE, IL, LI, MA, ML, NO, SJ
• Updated short number metadata for region code(s): FO, IT
• Updated carrier data for country calling code(s): 47 (en), 61 (en), 212 (en), 256 (en), 298 (en), 423 (en), 972 (en), 995 (en)

Jul 16, 2026: v9.0.35 Metadata changes:

• Updated alternate formatting data for country calling code(s): 995
• Updated phone metadata for region code(s): AC, CN, FO, GE, IR, KE, SE, UG, ZW
• Updated short number metadata for region code(s): FR
• Updated geocoding data for country calling code(s): 86 (en, zh)
• Updated carrier data for country calling code(s): 61 (en), 86 (en, zh), 93 (en, fa), 247 (en), 250 (en), 254 (en), 256 (en), 263 (en), 298 (en), 420 (en), 976 (en), 995 (en)

Jul 02, 2026: v9.0.34 Metadata changes:

• Updated alternate formatting data for country calling code(s): 34
• Updated phone metadata for region code(s): CM, ES, GY, HN, MZ, SR, TM, TZ, US, UZ
• Updated geocoding data for country calling code(s): 504 (en)
• Updated carrier data for country calling code(s): 46 (en), 255 (en), 258 (en), 352 (en), 381 (en), 592 (en), 597 (en), 886 (en), 998 (en)
• Updated / refreshed time zone meta data.

... (truncated)

Commits

• 796d807 [maven-release-plugin] prepare release v9.0.38
• ba2a029 Metadata updates for release 9.0.38 (#4068)
• 17c9061 Update README.md (#4066)
• 20a7284 Kkeshava maven update (#4065)
• See full diff in compare view

Updates org.flywaydb:flyway-mysql from 13.3.0 to 13.4.0

Updates io.github.classgraph:classgraph from 4.8.193 to 4.8.194

Release notes

Sourced from io.github.classgraph:classgraph's releases.

ClassGraph 4.8.194

ClassGraph 5.0.0 is coming shortly, and requires JDK 17 or newer. 4.8.194 is a bugfix release on the 4.x maintenance branch, and continues the file-by-file audit of the codebase that produced 4.8.190 through 4.8.193. As before, most of the bugs listed here were found by Claude through careful code analysis, and were fixed on the v5 branch and backported to v4.

The theme this time is the order in which scan sources are searched: which classloader's copy of a class wins, where the application classpath sits in that order, and how module layers are traversed. There is also a fix for a scan that never returns.

Bug fixes: deadlock

• A scan started from a thread holding a classloader lock never returned (#933). scan() and scan(int) submitted the Scanner to an ExecutorService and blocked the calling thread on the Future, so the first classes the scan needed were loaded on a worker thread. If the calling thread held a lock that the classloader also acquires — not unusual during a host's startup, as in Fabric/Knot — the worker blocked in ClassLoader.loadClass while the caller waited for it, and neither ever moved. Neither side of that cycle is a monitor that both threads contend for, so the JVM did not report it as a deadlock either, and jstack showed nothing wrong. The Scanner now runs on the calling thread; the ExecutorService is still used for the parallel stages of the scan, and is not used at all when numParallelTasks is 1, so scan(1) now loads every class it needs on the calling thread and cannot deadlock that way. scanAsync() is unchanged, since running on a pool thread is its purpose.

Bug fixes: classpath and classloader order

• A classloader could be ordered behind its own ancestors. The list of classloaders found in the environment was seeded with the thread context classloader, ClassGraph's own classloader and the system classloader before the call stack was read, so an ancestor could be placed ahead of the descendant that actually called ClassGraph. Only the position of the first classloader of a delegation chain to be reached is decided by that list — once a classloader is reached, its ClassLoaderHandler decides where its ancestors' classpath elements go relative to its own — so pinning an ancestor first silently converted parent-last delegation, the default for Tomcat's WebappClassLoader and for Spring Boot DevTools' RestartClassLoader, into parent-first delegation, inverting the class masking order. The classloaders found in the environment are now sorted by descending delegation depth, which cannot place an ancestor ahead of one of its descendants, and the call stack is read innermost frame first, so the immediate caller's classloader is preferred over that of the code that called it, mirroring how Class.forName(String) resolves against its immediate caller. Classloaders added with addClassLoader() are still appended after them, as that method documents.

• The application classpath was searched after the classloaders that delegate to it. The java.class.path entries were appended after every classloader had been visited, which inverts the masking order: a class present both on the application classpath and in a child classloader was reported from the child, whereas parent-first delegation makes the JVM load the application classloader's copy. Those entries are now contributed by the handler for the application classloader, so they land at the position the application classloader takes in the delegation order, like any other classloader's entries. This also makes ignoreParentClassLoaders() behave as its documentation says: it now leaves out only the entries that a parent classloader declares, instead of also dropping the application classloader's own entries when the application classloader is itself one of the classloaders being searched.

• A module layer reachable from more than one named layer was listed more than once, and the resulting order then depended on which layers the caller happened to name rather than on the layer DAG alone. Naming a parent layer and its child, in either order, gave the same result — the child first — so asking for the parent's modules to be searched first had no effect. The visited set is now shared across all top-level layers, so a layer named directly keeps the position its own name gives it, and is reached indirectly through ModuleLayer#parents() only if the caller did not name it. The javadoc now also states why a layer's own modules come before its parent layers': the classloader a layer creates is a jdk.internal.loader.Loader, whose loadClass checks this layer's own modules before the parent layers' and before its parent classloader — the reverse of the classloader axis, and observable, since a child layer may define a module with the same name as one in a parent layer and the child's copy then wins.

• Six ClassLoaderHandlers were missing classpath entries that their classloaders expose. An audit of the source of every supported classloader turned these up; nothing that was already read has been removed, since a field or method absent from the current source may still be present in an older version. Uno-JAR also accepts extra entries in the uno-jar.class.path system property, separated by |. A JBoss ResourceLoader that wraps another one, such as a FilteredResourceLoader, exposes only the location of the loader it delegates to. An Equinox BundleFileWrapper installed by a framework extension copies only the base file of the bundle file it wraps, so without following its bundleFile field the sub-path within the bundle is lost. A Felix Content with no file of its own delegates to the Content in its m_content field. The bundle file of an older Equinox classpath entry can be a nested directory or a wrapper chain, exactly as in newer versions, and the bundle's fragments have classpath entries of their own. A WebSphere Liberty AppClassLoader delegates to the classloaders of its configured libraries, split by precedence into beforeAppDelegateLoaders and afterAppDelegateLoaders, and a ThreadContextClassLoader searches the classloaders in followOnClassLoaders after its parent.

Bug fixes: resource paths

• A package root within a jarfile was separated from a resource path with !/ rather than /. A classpath entry can name a package root within a jarfile, e.g. app.jar!/BOOT-INF, and Resource#getURI() appended !/ between the URI of the classpath element and the path of the resource within it, giving app.jar!/BOOT-INF!/classes/hello/HelloController.class — a URL with two !/ separators but only one archive in it, which does not resolve. A package root is a directory within the jarfile, not a jarfile nested inside it, so a resource beneath it is separated from it by /. The default automatic package root prefixes masked this for the paths they cover.

Bug fixes: classfile parsing

• A class using the JVMS-specified encoding of a Class-valued annotation element vanished from scan results. JVMS 4.7.16.1 specifies that the class_info_index of a tag c annotation element value refers to a CONSTANT_Class entry, but javac writes the type descriptor directly as a CONSTANT_Utf8 entry instead, which is what AnnotationClassRef expects. With a classfile that follows the spec to the letter, the binary class name failed to parse as a descriptor and the whole class was silently dropped. CONSTANT_Class references are now converted to type descriptors, and UTF8 constants are passed through unchanged.

• Mixing RUNTIME- and CLASS-retention type-use annotations on one declaration dropped all the RUNTIME ones. javac emits both the RuntimeVisibleTypeAnnotations and RuntimeInvisibleTypeAnnotations attributes on the same target in that case, and the field, method and class attribute readers each overwrote the decorators of the first attribute with those of the second. The two lists are now merged.

• A constant declared by an implemented interface could not be found through an implementing class. The reflection driver's member cache walked the superclass chain caching declared methods and fields, then walked the interface graph caching only declared methods. Both kinds are now cached at both traversal sites, and methods and fields are read in separate try blocks, so a class whose fields cannot be read still has its methods cached, and vice versa.

Behaviour changes

• ClassInfo#toString() now names only the class in an extends or implements clause, as Java source does. It previously rendered a superclass or superinterface with its own modifiers, class type keyword and extends/implements clauses, producing output that is not a Java declaration:

  public static class Child extends public abstract static Parent extends java.lang.Exception implements public abstract static Marker implements public abstract static Tag
  

  The named class's modifiers, class type, type parameters, record parameters and supertypes all belong to its own declaration. This changes toString() output for any class whose supertypes have supertypes or modifiers of their own.

Dependencies and documentation

• Narcissus updated to 1.0.13, which adds a native library for Linux on arm64, so ClassGraph can read the classpath through Narcissus on that platform too.

• The README and the CIRCUMVENT_ENCAPSULATION javadoc listed the wrong set of platforms Narcissus supports: there have been no 32-bit x86 builds for a long time, and Linux arm64 and macOS arm64 were missing.

Commits

• 4ac0a76 [maven-release-plugin] prepare release classgraph-4.8.194
• 3b37a81 Run a blocking scan on the calling thread
• ff10ce4 Name only the class in an extends or implements clause
• fbe7127 Put the application classloader's classpath entries in their proper place
• 4e090c9 Order a classloader ahead of its own ancestors when finding scan sources
• ade5186 List each module layer once, in the order its own loader searches
• 68fceaa Separate a package root from a resource path with '/', not '!/'
• b07d80f Read the classpath entries that six ClassLoaderHandlers were missing
• 89bdb8a Handle the JVMS-specified encoding of 'c' annotation element values
• 1c2eee6 Merge runtime visible and invisible type annotation attributes
• Additional commits viewable in compare view

Updates org.graalvm.buildtools.native from 1.1.10 to 1.1.11

Release notes

Sourced from org.graalvm.buildtools.native's releases.

1.1.11

What's Changed

• Release 1.1.9 by @​graalvmbot in graalvm/native-build-tools#1022
• Bump version to 1.1.10-SNAPSHOT by @​graalvmbot in graalvm/native-build-tools#1023
• Update reachability metadata to 1.0.11 by @​graalvmbot in graalvm/native-build-tools#1028
• Make NativeImageLayerRuntimeTest platform-independent by @​vpelikh in graalvm/native-build-tools#1024
• Release 1.1.10 by @​graalvmbot in graalvm/native-build-tools#1030
• Move grund.toml to the project roots by @​vjovanov in graalvm/native-build-tools#1026
• Bump version to 1.1.11-SNAPSHOT by @​graalvmbot in graalvm/native-build-tools#1035
• Update reachability metadata to 1.0.12 by @​graalvmbot in graalvm/native-build-tools#1036
• Layers DSL follow-up: configuration-cache and test cleanup by @​jormundur00 in graalvm/native-build-tools#1034
• Fix Maven metadata copy across reactor modules by @​jormundur00 in graalvm/native-build-tools#1020
• Make embedded Maven output concise and reproducible by @​jormundur00 in graalvm/native-build-tools#1019
• Fix additive reachability metadata requires selection by @​jormundur00 in graalvm/native-build-tools#1018

New Contributors

• @​vpelikh made their first contribution in graalvm/native-build-tools#1024

Full Changelog: graalvm/native-build-tools@1.1.9...1.1.11

Commits

• 6cf521c Release 1.1.11
• 37fab88 Fix additive reachability metadata requires selection (#1018)
• c300d9f Make embedded Maven output concise and reproducible (#1019)
• 1987e3c Fix Maven metadata copy across reactor modules (#1020)
• f328d3a Layers DSL follow-up: configuration-cache and test cleanup (#1034)
• 8ae8060 Update reachability metadata to 1.0.12 (#1036)
• 6a60e3b Merge pull request #1035 from graalvm/bump-version-to-1.1.11-SNAPSHOT
• 0eac49e Bump version to 1.1.11-SNAPSHOT
• f2d657c Move grund.toml to the project roots (#1026)
• 395d386 Merge pull request #1030 from graalvm/release/1.1.10
• Additional commits viewable in compare view

Updates org.openapitools:openapi-generator-gradle-plugin from 7.24.0 to 7.25.0

Release notes

Sourced from org.openapitools:openapi-generator-gradle-plugin's releases.

v7.25.0 released

v7.25.0 stable release (breaking changes with fallbacks) comes with 240+ enhancements and bug fixes.

Below are the highlights of the changes. For a full list of changes, please refer to the "Pull Request" tab.

General

• Update parser to newer version (2.1.46) #24731
• Fix missing imports for schemaMapping in API interfaces #24672
• [GRADLE-WRAPPER] Generator status message visibility update #24670
• Stable hash for determining if input specification changed (Maven Plugin) #24645
• fix(normalizer): restore behavior of clearing a oneOf if the schema content cannot currently be used by the generator #24585
• [generators] Give clients a way to inject vendor overrides #24571
• Fix response isArray, isMap flags #24566
• Move shared git push template to _common #24565
• Add logic to handle any type (3.1) with additional properties #24559
• Normalize map schema (3.1 spec) #24558
• fix: keep allOf members that have properties alongside a validation keyword #24551
• feat(core): add splitOperationsByContentType option to divide operations #23935

C#

• fix(csharp): make generichost oneOf constructors public #24700
• [csharp][generichost] Allow property accessor overrides #24652
• [csharp][generichost] Refactor AsModel template #24650
• [csharp][generichost] Make host configuration optional #24451
• [csharp][generichost] Update partial to create HttpClient #24354

C++

• fix(cpp-boost-beast): validate request components #24351

Crystal

• fix(crystal): support Crystal 1.21 #24748

Dart

• Fix nullable query param #24738
• [dart] Do not convert format: date to UTC before formatting #24706
• Fix anyOf serialization in dart-dio #24605
• Fix Dart native nullable number deserialization (#20238) #24386
• [BUG][DART] PATCH tri-state optional handling #23696

Go

• fix(go): emit the oneOf no-match error once instead of once per member #24683
• Update go-server deps #24527
• Fix Golang pattern validation with regex fails on commas #24349
• fix(golang): use datatype only for enums instead of format #24337

Java

• [SPRING;KOTLIN-SPRING] Fix: enhance pageable parameter detection with OpenAPI reference resolution #24758
• [JAVA] [Spring] JSpecify, fix nullable + required field #24711
• Add support for interface only with vertx #24655

... (truncated)

Commits

• ef964b0 v7.25.0 release (#24763)
• 61c6a9a Fix missing imports for schemaMapping in API interfaces (#24672)
• bb7c33b fix: keep allOf members that have properties alongside a validation keyword (...
• b20cbb0 fix(spring): preserve original operation ID for pageable (#24724)
• 0c3e1f7 [python] write back the fully qualified apiPackage/modelPackage (#24739)
• 8674968 [FIX][KOTLIN][SPRING] mark @​param:JsonProperty as required in generated model...
• da510a9 fix(spring;kotlin-spring): enhance pageable parameter detection with OpenAPI ...
• 5dadfd8 [SPRING;KOTLIN-SPRING] bugfix - honor x-spring-paginated for spring-cloud (Fe...
• 09bd211 [scala-sttp4-jsoniter] bump jsoniter-scala to 2.40.1 and sbt to 1.13.0 (#24759)
• be73ed9 fix(kotlin-client): emit parameter table header before first parameter in jvm...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Diff breakdown — █ added ░ removed, scaled to the largest row.

api                                                 +7     -7    1
  build & config     █████████████░░░░░░░░░░░░░     +7     -7    1

ci                                                  +1     -1    1
  build & config     ██░░                           +1     -1    1

──────────────────────────────────────────────────────────────────
total (hand-written)                                +8     -8  2 files