From 25abf40684f598f93b1fdbb7ca80a99bf8107c94 Mon Sep 17 00:00:00 2001
From: Abdullah <89297042+AzazelSensei@users.noreply.github.com>
Date: Thu, 20 Aug 2026 06:08:50 +0300
Subject: [PATCH 1/3] Add Elements.before(Node) and after/prepend/append(Node)
 #953 (#2567)

Fix #953

---------

Co-authored-by: Jonathan Hedley <jonathan@hedley.net>
---
 CHANGES.md                                    |  1 +
 src/main/java/org/jsoup/select/Elements.java  | 61 ++++++++++++++++++-
 .../java/org/jsoup/select/ElementsTest.java   | 28 +++++++++
 3 files changed, 88 insertions(+), 2 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index 117558e131..30caabdf83 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -8,6 +8,7 @@
 * Improved `W3CDom` conversion performance for documents with many nested namespace declarations. The W3C converter now uses the same optimized namespace tracking as the XML parser. [#2559](https://github.com/jhy/jsoup/pull/2559)
 * Improved `W3CDom` XML conversion to retain processing instructions, comments outside the root element, and CDATA sections, which were previously dropped or converted to text. [#2572](https://github.com/jhy/jsoup/issues/2572)
 * DOM mutation methods, including child insertion and replacement, now reject operations that would create a cycle, such as making a node its own child or moving an ancestor beneath a descendant. [#2552](https://github.com/jhy/jsoup/issues/2552)
+* Added `Elements#before(Node)`, `after(Node)`, `prepend(Node)`, and `append(Node)` to match the existing HTML string methods. [#953](https://github.com/jhy/jsoup/issues/953)
 * XML serialization now repairs element and attribute names that start with an invalid character, rather than outputting `<null>` elements or dropping attributes. For example, an attribute named `1a` is written as `_1a`. Additional leading underscores keep repaired attribute names unique if they conflict with another attribute. [#2573](https://github.com/jhy/jsoup/issues/2573)
 
 ### Changes
diff --git a/src/main/java/org/jsoup/select/Elements.java b/src/main/java/org/jsoup/select/Elements.java
index e84e2a0e7b..aaca336fd1 100644
--- a/src/main/java/org/jsoup/select/Elements.java
+++ b/src/main/java/org/jsoup/select/Elements.java
@@ -14,10 +14,9 @@
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.HashSet;
-import java.util.Iterator;
 import java.util.LinkedHashSet;
 import java.util.List;
-import java.util.function.Predicate;
+import java.util.function.BiConsumer;
 import java.util.function.UnaryOperator;
 
 /**
@@ -314,6 +313,17 @@ public Elements prepend(String html) {
         }
         return this;
     }
+
+    /**
+     Add the supplied node to the start of each matched element's inner HTML. The node is cloned for each target.
+
+     @param node the node to add inside each element, before the existing HTML
+     @return this, for chaining
+     @see Element#prependChild(Node)
+     */
+    public Elements prepend(Node node) {
+        return insert(node, Element::prependChild);
+    }
     
     /**
      * Add the supplied HTML to the end of each matched element's inner HTML.
@@ -328,6 +338,17 @@ public Elements append(String html) {
         return this;
     }
 
+    /**
+     Add the supplied node to the end of each matched element's inner HTML. The node is cloned for each target.
+
+     @param node the node to add inside each element, after the existing HTML
+     @return this, for chaining
+     @see Element#appendChild(Node)
+     */
+    public Elements append(Node node) {
+        return insert(node, Element::appendChild);
+    }
+
     /**
      Insert the supplied HTML before each matched element's outer HTML.
 
@@ -341,6 +362,17 @@ public Elements before(String html) {
         return this;
     }
 
+    /**
+     Insert the supplied node before each matched element's outer HTML. The node is cloned for each target.
+
+     @param node the node to insert before each element
+     @return this, for chaining
+     @see Element#before(Node)
+     */
+    public Elements before(Node node) {
+        return insert(node, Element::before);
+    }
+
     /**
      Insert the supplied HTML after each matched element's outer HTML.
 
@@ -354,6 +386,31 @@ public Elements after(String html) {
         return this;
     }
 
+    /**
+     Insert the supplied node after each matched element's outer HTML. The node is cloned for each target.
+
+     @param node the node to insert after each element
+     @return this, for chaining
+     @see Element#after(Node)
+     */
+    public Elements after(Node node) {
+        return insert(node, Element::after);
+    }
+
+    /**
+     Applies a node insertion to each matched element, cloning the node for each target.
+
+     @param node     the node to insert
+     @param inserter the insertion operation
+     @return this, for chaining
+     */
+    private Elements insert(Node node, BiConsumer<Element, Node> inserter) {
+        Validate.notNull(node);
+        for (Element element : this)
+            inserter.accept(element, node.clone());
+        return this;
+    }
+
     /**
      Wrap the supplied HTML around each matched elements. For example, with HTML
      {@code <p><b>This</b> is <b>Jsoup</b></p>},
diff --git a/src/test/java/org/jsoup/select/ElementsTest.java b/src/test/java/org/jsoup/select/ElementsTest.java
index b1b9b3dde4..2a39215d6f 100644
--- a/src/test/java/org/jsoup/select/ElementsTest.java
+++ b/src/test/java/org/jsoup/select/ElementsTest.java
@@ -169,12 +169,40 @@ public class ElementsTest {
         assertEquals("<p>This <span>foo</span><a>is</a> <span>foo</span><a>jsoup</a>.</p>", TextUtil.stripNewlines(doc.body().html()));
     }
 
+    @Test public void beforeNode() {
+        Document doc = Jsoup.parse("<p>This <a>is</a> <a>jsoup</a>.</p>");
+        Element span = new Element("span").text("foo");
+        doc.select("a").before(span);
+        assertEquals("<p>This <span>foo</span><a>is</a> <span>foo</span><a>jsoup</a>.</p>", TextUtil.stripNewlines(doc.body().html()));
+        assertNull(span.parent()); // cloned per target; original is left alone
+        assertNotSame(span, doc.selectFirst("span"));
+    }
+
     @Test public void after() {
         Document doc = Jsoup.parse("<p>This <a>is</a> <a>jsoup</a>.</p>");
         doc.select("a").after("<span>foo</span>");
         assertEquals("<p>This <a>is</a><span>foo</span> <a>jsoup</a><span>foo</span>.</p>", TextUtil.stripNewlines(doc.body().html()));
     }
 
+    @Test public void afterNode() {
+        Document doc = Jsoup.parse("<p>This <a>is</a> <a>jsoup</a>.</p>");
+        Element span = new Element("span").text("foo");
+        doc.select("a").after(span);
+        assertEquals("<p>This <a>is</a><span>foo</span> <a>jsoup</a><span>foo</span>.</p>", TextUtil.stripNewlines(doc.body().html()));
+        assertNull(span.parent());
+    }
+
+    @Test public void prependAppendNode() {
+        Document doc = Jsoup.parse("<p>One</p><p>Two</p><p>Three</p>");
+        Elements ps = doc.select("p");
+        Element bold = new Element("b").text("Bold");
+        Element ital = new Element("i").text("Ital");
+        ps.prepend(bold).append(ital);
+        assertEquals("<p><b>Bold</b>Two<i>Ital</i></p>", TextUtil.stripNewlines(ps.get(1).outerHtml()));
+        assertNull(bold.parent());
+        assertNull(ital.parent());
+    }
+
     @Test public void wrap() {
         String h = "<p><b>This</b> is <b>jsoup</b></p>";
         Document doc = Jsoup.parse(h);

From d8cd95525749500a3c4644de55a8d69ea4a2e8b3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 20 Aug 2026 13:13:08 +1000
Subject: [PATCH 2/3] Bump io.netty:netty-bom from 4.2.16.Final to 4.2.17.Final
 (#2574)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [io.netty:netty-bom](https://github.com/netty/netty) from
4.2.16.Final to 4.2.17.Final.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/netty/netty/releases">io.netty:netty-bom's
releases</a>.</em></p>
<blockquote>
<h2>netty-4.2.17.Final</h2>
<h2>What's Changed</h2>
<ul>
<li>AsciiString.cached(String) should sanitize the provided String (<a
href="https://redirect.github.com/netty/netty/issues/13749">#13749</a>)
by <a href="https://github.com/vpelikh"><code>@​vpelikh</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17007">netty/netty#17007</a></li>
<li>Fix deploy workflow by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/17071">netty/netty#17071</a></li>
<li>Fix AsciiString.cached(String) performance regression by <a
href="https://github.com/dreamlike-ocean"><code>@​dreamlike-ocean</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/17074">netty/netty#17074</a></li>
<li>SslHandler: Fix possible buffer leak when an OOME is thrown during
allocation by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/17059">netty/netty#17059</a></li>
<li>Avoid leak presence detector in leak profile by <a
href="https://github.com/yawkat"><code>@​yawkat</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17073">netty/netty#17073</a></li>
<li>Add HttpContentCompressor constructor with ability to specify
desired maxPipelineDepth by <a
href="https://github.com/reta"><code>@​reta</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17068">netty/netty#17068</a></li>
<li>IoUring: preserve readPending when rescheduling cancelled reads by
<a
href="https://github.com/dreamlike-ocean"><code>@​dreamlike-ocean</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/17087">netty/netty#17087</a></li>
<li>Reject negative maxOrder in PooledByteBufAllocator by <a
href="https://github.com/coderbruis"><code>@​coderbruis</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17093">netty/netty#17093</a></li>
<li>Fix AdaptiveByteBuf._setLongLE calling checked setLongLE by <a
href="https://github.com/franz1981"><code>@​franz1981</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17098">netty/netty#17098</a></li>
<li>Snappy: Guard decoder against invalid chunk lengths by <a
href="https://github.com/yawkat"><code>@​yawkat</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17099">netty/netty#17099</a></li>
<li>Fix OCSP Tests by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17114">netty/netty#17114</a></li>
<li>Update to latest netty-tcnative release by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/17056">netty/netty#17056</a></li>
<li>Use safe decompressor in Lz4FrameDecoder by <a
href="https://github.com/yawkat"><code>@​yawkat</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17118">netty/netty#17118</a></li>
<li>Configure TestLens for the PR builds by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17129">netty/netty#17129</a></li>
<li>IoUring: add SO_INQ support for Unix domain sockets by <a
href="https://github.com/dreamlike-ocean"><code>@​dreamlike-ocean</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/17127">netty/netty#17127</a></li>
<li>fix(mqtt): drop UNSUBACK reason codes for MQTT 3.x encoding by <a
href="https://github.com/ChunMengLu"><code>@​ChunMengLu</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17117">netty/netty#17117</a></li>
<li>Propagate the CI envionment variables through to the docker builds
by <a href="https://github.com/chrisvest"><code>@​chrisvest</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/17138">netty/netty#17138</a></li>
<li>Codec-compression: Add decompressor API by <a
href="https://github.com/yawkat"><code>@​yawkat</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/16745">netty/netty#16745</a></li>
<li>Fix silent failures and optimize error short-circuit in
multi-threaded tests by <a
href="https://github.com/rajan-github"><code>@​rajan-github</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/17106">netty/netty#17106</a></li>
<li>Codec-compression: Add Bzip2Decompressor by <a
href="https://github.com/yawkat"><code>@​yawkat</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17145">netty/netty#17145</a></li>
<li>Fix buddy cache evicting chunks with live buffers by <a
href="https://github.com/franz1981"><code>@​franz1981</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17154">netty/netty#17154</a></li>
<li>Codec-compression: Add Snappy frame decompressor by <a
href="https://github.com/yawkat"><code>@​yawkat</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17153">netty/netty#17153</a></li>
<li>Codec-compression: Add zlib decompressors by <a
href="https://github.com/yawkat"><code>@​yawkat</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17155">netty/netty#17155</a></li>
<li>Codec-compression: Add Zstd decompressor by <a
href="https://github.com/yawkat"><code>@​yawkat</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17152">netty/netty#17152</a></li>
<li>Codec-compression: Add LZF decompressor by <a
href="https://github.com/yawkat"><code>@​yawkat</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17147">netty/netty#17147</a></li>
<li>Codec-compression: Add BrotliDecompressor by <a
href="https://github.com/yawkat"><code>@​yawkat</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17146">netty/netty#17146</a></li>
<li>Codec-compression: Add Lz4FrameDecompressor by <a
href="https://github.com/yawkat"><code>@​yawkat</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17148">netty/netty#17148</a></li>
<li><code>HttpObjectEncoder</code> /
<code>DefaultHttp2FrameWriter</code>: fix buffer leak when a
<code>Throwable</code> is thrown during header encoding by <a
href="https://github.com/HwangRock"><code>@​HwangRock</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17089">netty/netty#17089</a></li>
<li>Fix direct memory OOM on low-core containers by <a
href="https://github.com/franz1981"><code>@​franz1981</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17166">netty/netty#17166</a></li>
<li>IoUring: Fix the recvmmsg emulation by <a
href="https://github.com/dreamlike-ocean"><code>@​dreamlike-ocean</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/17187">netty/netty#17187</a></li>
<li>Avoid classloader leak via GlobalEventExecutor terminationFuture
failure by <a
href="https://github.com/seonwooj0810"><code>@​seonwooj0810</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/17140">netty/netty#17140</a></li>
<li>BrotliEncoder: Prevent duplicate close scheduling by <a
href="https://github.com/yawkat"><code>@​yawkat</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17175">netty/netty#17175</a></li>
<li>Fix JdkZlibDecompressor losing the tail of highly compressible
streams by <a
href="https://github.com/renechoi"><code>@​renechoi</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17191">netty/netty#17191</a></li>
<li>Update compress-lzf to 1.2.1 by <a
href="https://github.com/yawkat"><code>@​yawkat</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17194">netty/netty#17194</a></li>
<li>Do not write WebSocket handshake response to the tail of the
pipeline by <a
href="https://github.com/el-psy-kongroo-d"><code>@​el-psy-kongroo-d</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/17192">netty/netty#17192</a></li>
<li><code>HttpServerCodec</code>: do not consume the method queue for
1xx interim responses by <a
href="https://github.com/HwangRock"><code>@​HwangRock</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17182">netty/netty#17182</a></li>
<li>Weakly reference engines from the OpenSSL engine map by <a
href="https://github.com/bryce-anderson"><code>@​bryce-anderson</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/17199">netty/netty#17199</a></li>
<li>OpenSSL: Allow to obtain used named group via OpenSslSession by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/17058">netty/netty#17058</a></li>
<li>Add <code>.editorconfig</code> to enforce consistent coding style by
<a href="https://github.com/vpelikh"><code>@​vpelikh</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17052">netty/netty#17052</a></li>
<li>Update surefire plugin to latest version by <a
href="https://github.com/normanmaurer"><code>@​normanmaurer</code></a>
in <a
href="https://redirect.github.com/netty/netty/pull/17210">netty/netty#17210</a></li>
<li>Merge changes from forks by <a
href="https://github.com/chrisvest"><code>@​chrisvest</code></a> in <a
href="https://redirect.github.com/netty/netty/pull/17213">netty/netty#17213</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/vpelikh"><code>@​vpelikh</code></a> made
their first contribution in <a
href="https://redirect.github.com/netty/netty/pull/17007">netty/netty#17007</a></li>
<li><a
href="https://github.com/ChunMengLu"><code>@​ChunMengLu</code></a> made
their first contribution in <a
href="https://redirect.github.com/netty/netty/pull/17117">netty/netty#17117</a></li>
<li><a
href="https://github.com/rajan-github"><code>@​rajan-github</code></a>
made their first contribution in <a
href="https://redirect.github.com/netty/netty/pull/17106">netty/netty#17106</a></li>
<li><a
href="https://github.com/seonwooj0810"><code>@​seonwooj0810</code></a>
made their first contribution in <a
href="https://redirect.github.com/netty/netty/pull/17140">netty/netty#17140</a></li>
<li><a href="https://github.com/renechoi"><code>@​renechoi</code></a>
made their first contribution in <a
href="https://redirect.github.com/netty/netty/pull/17191">netty/netty#17191</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/netty/netty/commit/e0789d32c72f46fd2e7c99b6fdbbf7e2f4409e44"><code>e0789d3</code></a>
[maven-release-plugin] prepare release netty-4.2.17.Final</li>
<li><a
href="https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7"><code>1b5abc6</code></a>
Merge changes from forks (<a
href="https://redirect.github.com/netty/netty/issues/17213">#17213</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/36fbf5788c73e7040e6f18fed841a2cdfcae1452"><code>36fbf57</code></a>
Update surefire plugin to latest version (<a
href="https://redirect.github.com/netty/netty/issues/17210">#17210</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/a96226cb54e87e963e1e341cd7121f2217fc7c2e"><code>a96226c</code></a>
Add <code>.editorconfig</code> to enforce consistent coding style (<a
href="https://redirect.github.com/netty/netty/issues/17052">#17052</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/14a4e6ad865a187c3f1bf0da18d9146472e18192"><code>14a4e6a</code></a>
OpenSSL: Allow to obtain used named group via OpenSslSession (<a
href="https://redirect.github.com/netty/netty/issues/17058">#17058</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/26255b123f7c699cd88cbdb42f6ecc6ed5cb7843"><code>26255b1</code></a>
Weakly reference engines from the OpenSSL engine map (<a
href="https://redirect.github.com/netty/netty/issues/17199">#17199</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/ae414179e3a030e0747fb68648ff2433fa4539e1"><code>ae41417</code></a>
<code>HttpServerCodec</code>: do not consume the method queue for 1xx
interim responses ...</li>
<li><a
href="https://github.com/netty/netty/commit/41f1db523d3657954e9ad12250004cbdfde2a97d"><code>41f1db5</code></a>
Do not write WebSocket handshake response to the tail of the pipeline
(<a
href="https://redirect.github.com/netty/netty/issues/17192">#17192</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/035d76e3f43fa462e101c1e03b59a69984c5ebf3"><code>035d76e</code></a>
Update compress-lzf to 1.2.1 (<a
href="https://redirect.github.com/netty/netty/issues/17194">#17194</a>)</li>
<li><a
href="https://github.com/netty/netty/commit/7681affcf120fca1de8554095216ddea20b408c5"><code>7681aff</code></a>
Fix JdkZlibDecompressor losing the tail of highly compressible streams
(<a
href="https://redirect.github.com/netty/netty/issues/17191">#17191</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/netty/netty/compare/netty-4.2.16.Final...netty-4.2.17.Final">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=io.netty:netty-bom&package-manager=maven&previous-version=4.2.16.Final&new-version=4.2.17.Final)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 5113f5037b..812268399a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -625,7 +625,7 @@
       <dependency>
         <groupId>io.netty</groupId>
         <artifactId>netty-bom</artifactId>
-        <version>4.2.16.Final</version>
+        <version>4.2.17.Final</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>

From 7106824525712bfd84d40c51f430fa87e96e3476 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 20 Aug 2026 13:13:24 +1000
Subject: [PATCH 3/3] Bump github/codeql-action from 4.37.4 to 4.37.6 (#2575)

Bumps [github/codeql-action](https://github.com/github/codeql-action)
from 4.37.4 to 4.37.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.37.6</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>v4.37.5</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/5595ccaf912efad79be6eef63a5619ff05969be3"><code>5595cca</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4071">#4071</a>
from github/update-v4.37.6-6a9359a1b</li>
<li><a
href="https://github.com/github/codeql-action/commit/ec9c75796a7f2cee5af0c5ffa0b81dc3bb58754b"><code>ec9c757</code></a>
Add change note for PR 4070</li>
<li><a
href="https://github.com/github/codeql-action/commit/45c8742e17cbd668814137f95e605d925b8722a2"><code>45c8742</code></a>
Update changelog for v4.37.6</li>
<li><a
href="https://github.com/github/codeql-action/commit/6a9359a1bd054c53cae7bb737bd8d796cfbf3014"><code>6a9359a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4070">#4070</a>
from github/mbg/remote-address/change-file-default</li>
<li><a
href="https://github.com/github/codeql-action/commit/065cdc0394d424981db720df63ebc570e41b775f"><code>065cdc0</code></a>
Change <code>DEFAULT_CONFIG_FILE_NAME</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/f99dd5aeee9cf92e92d0c700cb0aa7afd7bbf431"><code>f99dd5a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4066">#4066</a>
from github/dependabot/npm_and_yarn/js-yaml-5.2.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/1804b211a343d69a6584d26fb3a68a8fe6ca39d4"><code>1804b21</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4068">#4068</a>
from github/mergeback/v4.37.5-to-main-d1ba80a1</li>
<li><a
href="https://github.com/github/codeql-action/commit/3020a2f46286abb1704269b22ada83bd0e81c64f"><code>3020a2f</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/93c3a5a40b7affbf8ea6a480767ed0db8e8d3c5c"><code>93c3a5a</code></a>
Update changelog and version after v4.37.5</li>
<li><a
href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a>
from github/update-v4.37.5-1cd4d01d5</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/v4.37.4...v4.37.6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=4.37.4&new-version=4.37.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/codeql.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3f482eea04..6c5a744694 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,11 +20,11 @@ jobs:
           distribution: 'temurin'
           cache: 'maven'
       - name: CodeQL Initialization
-        uses: github/codeql-action/init@v4.37.4
+        uses: github/codeql-action/init@v4.37.6
         with:
           languages: java
           queries: +security-and-quality
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4.37.4
+        uses: github/codeql-action/autobuild@v4.37.6
       - name: CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.4
+        uses: github/codeql-action/analyze@v4.37.6