[dependabot]

Bumps the all-minor-patch group with 5 updates:

Package	From	To
com.google.guava:guava	33.7.2-jre	33.8.0-jre
com.google.errorprone:error_prone_annotations	2.51.0	2.52.0
org.jsoup:jsoup	1.23.2	1.24.1
joda-time:joda-time	2.15.0	2.15.1
com.google.guava:guava-testlib	33.7.2-jre	33.8.0-jre

Updates com.google.guava:guava from 33.7.2-jre to 33.8.0-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.8.0

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.8.0-jre</version>
  <!-- or, for Android: -->
  <version>33.8.0-android</version>
</dependency>

Jar files

• 33.8.0-jre.jar
• 33.8.0-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.8.0-jre
• 33.8.0-android

JDiff

• 33.8.0-jre vs. 33.7.2-jre
• 33.8.0-android vs. 33.7.2-android
• 33.8.0-android vs. 33.8.0-jre

Changelog

• collect: Enhanced HashBiMap and LinkedHashMultimap.ValueSet to defend against hash flooding (forthcoming CVE-2026-118042). (7cd44b3506)
• collect: Accidentally changed a few methods in ForwardingMap.StandardValues to be final. No Google-internal or GitHub-public code appears to be affected, but we will fix this in the next release. If it causes you problems, let us know.
• net: Added MediaType.APPLICATION_GZIP (application/gzip) to be used in preference to GZIP (application/x-gzip). (6393ebbdb6)
• primitives: Added Doubles.MIN_POSITIVE_VALUE and Floats.MIN_POSITIVE_VALUE as more clearly named aliases for Double.MIN_VALUE and Float.MIN_VALUE. (adf5554e7e)
• testlib: Added AbstractClassInitializationTest. (80fd5c114d)
• and, among the usual changes, a larger than usual number of small fixes (4afb1e04a4246c261be4742e1f2e2c39ebaf6266, 79152348ece2de85559eb2eb18133862d492c892, a279b884fe9890a3869142919352156f2a67a705, 786bb1a9b44685875ebe7b83f1404a1f07ac653c, 6b3a8d7498a7fde122967ba37a023ba3dcb47792, de57a419b56bcd887f51bb99103d91c65b7c5e86, fa64cc7c2b320aca9219981952bbb544f8f6ccff, 7b64964048948de3b5633a75d6e64f98cf8fcece, 5ae56d77e64305752b919ff2c96713f47ac0c94c, 37535d73f0416f30e0301efe61a8eb8ede44c1b7, ca8aedb2fdaf40fd6937a0643180aea51ca4154e, c0a8a1edc69393e8141424037571d9825f5fc0f4, 51246d06bb85ccc182a0aeb6a7adcbd55f759ae5, 81c7d030f8f144a4885ccf8efdc72c92605b4eec, 2b86a8216627a807ce8520abc6ae55437dbb85fb, 669a232b4e20ae6e8bc6efc62caaf2f830d56327, b157643c41f9ee6a38732b4fa1a590ba187912d9, ad73fbb9beff220aa26390630724855ef92fc50b, 1e6eb68f2ee8dc6cb164c285f7fe6ad5e8bc0905, 3d5be86651ec58b3f9d15c76cf888ade15aba39b)

Commits

• See full diff in compare view

Updates com.google.errorprone:error_prone_annotations from 2.51.0 to 2.52.0

Release notes

Sourced from com.google.errorprone:error_prone_annotations's releases.

Error Prone 2.52.0

New checks:

• AlmostExhaustiveTestParameter: Prefer an exhaustive @TestParameter with an assumption to filter out specific enum values, so newly added enum values are automatically tested (disabled by default).
• SingleTestParameter: Suggest @TestParameter on the parameter instead of @TestParameters when there is only one test parameter, replacing PreferTestParameter (disabled by default).
• SingleValueTestParameter: Suggest replacing a @TestParameter that has only a single value with a local variable in the test method (disabled by default).
• ValueClassEquals: Require non-record concrete value classes to explicitly override equals and hashCode.

Other changes:

• LoopToTestParameter: Changed severity to SUGGESTION (disabled by default).
• DistinctVarargsChecker: Allow duplicate arguments to Iterables.concat (#6239) and Mockito argument matchers such as any() (#6240).
• UnusedVariable: Treat fields accessed via MethodHandles.Lookup (VarHandle/getter/setter lookups) or Atomic*FieldUpdater.newUpdater as used.
• StringBuilderInitWithChar / StringBuffer refactoring: Refactor StringBuffer to StringBuilder even when used with Matcher.appendReplacement and appendTail (when supported by the target JDK or Android minSdkVersion).
• CompileTimeConstant: Treat record and interface fields and field accesses on compile-time constants (compileTimeConstant.compileTimeConstantField) as compile-time constants.
• ValueClassIdentity / ReferenceEquality: Handle JEP 401 value classes.
• FieldCanBeFinal / ThreadSafety: Improve compile-time performance on large classes and deep type hierarchies, and update SafeRE to 1.1.0 (#6230).
• Added ClassName for caching resolved ClassSymbol, Type, and binary Name lookups across a compilation.

Closed issues: #5964, #6165, #6230, #6239, #6240, #6275

Full changelog: google/error-prone@v2.51.0...v2.52.0

Commits

• 1e32314 Release Error Prone 2.52.0
• ea4c6df Avoid calling SuggestedFixes.compilesWithFix in FieldCanBeFinal
• 04640b8 Update SafeRE to 1.1.0
• 6034e09 Bump the dependencies group across 1 directory with 8 updates
• 3cc36d5 Bump actions/setup-java from 6.0.1 to 6.1.0 in the github-actions group (#6270)
• 0202185 Migrate class and annotation name constants in Error Prone to ClassName.
• cdf0d94 Add ASTHelpers.overridesObjectEquals and overridesObjectHashCode helpers.
• 208015e Update MemoizeConstantVisitorStateLookups to suggest ClassName.
• e1a8a3e Add ValueClassEquals to require non-record concrete value classes to over...
• 2c6baed Handle JEP 401 value classes in ValueClassIdentity and ReferenceEquality
• Additional commits viewable in compare view

Updates org.jsoup:jsoup from 1.23.2 to 1.24.1

Release notes

Sourced from org.jsoup:jsoup's releases.

jsoup 1.24.1

jsoup 1.24.1 is out now, with major improvements to CSS selectors and HTML parsing.

This release introduces an opt-in Web query mode, bringing selector behavior closer to CSS and browser DOM standards. It also adds new selectors and improves the correctness and performance of :has() queries. Web mode will become the default in 1.25.1; the selector migration guide explains how to get ready.

HTML parsing is now more closely aligned with the current HTML standard, including improvements to tables, formatting elements, templates, and customizable select elements. This release also adds processing instruction support, and includes a number of performance improvements and bug fixes.

There are some changes to existing behavior, including :root matching and limits on Response.bodyStream(). Please make sure to review the changes below before upgrading.

jsoup is a Java library for working with real-world HTML and XML. It provides a very convenient API for extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors.

Download jsoup now.

Improvements

• Added an opt-in Web query mode to align jsoup's selectors with CSS and Web DOM standards. See the selector migration guide for more details. #2642
  • Enable with System.setProperty("jsoup.queryMode", "web"). Queries return matching descendants only, can match surrounding ancestors, and follow HTML/XML case rules. Attribute ~= matches whitespace separated tokens instead of regexes.
  • You can jsoup.queryMode=check to help prepare for Web mode. Selectors return legacy results and print differences to stderr, with caller locations to help identify affected code.
  • Added :scope, :matchesAttr(name, regex), |= attribute matching, and attribute case flags i and s. These work in both legacy and Web modes, so queries can be updated before switching modes.
  • Web mode will become the default in 1.25.1 and the only mode in 1.26.1.
• Added support for parsing processing instructions in HTML and XML, as ProcessingInstruction nodes. This supports marker nodes such as <?marker name="country-options"?>, matched by \<template for="country-options"> in the HTML Standard's new declarative streaming syntax. Processing instructions can be selected with ::pi or ::pi(target), and their data can be read and changed through the node's attribute methods. Change: when using the XML parser, ordinary <?target ...?> nodes are now represented by ProcessingInstruction instead of XmlDeclaration; the <?xml ...?> declaration remains an XmlDeclaration. #2613
• Added Parser.parseAttributes(String) to parse an attribute fragment using that parser's settings.
• :has() selectors with child and sibling combinators now run faster by limiting the search to the parts of the document where they can match. This particularly improves selectors such as :has(> a), :has(+ dd), and :has(+ div span). #2610
• SVG-specific tag and attribute names are now automatically case corrected (e.g. pathlength becomes pathLength) when parsing HTML. #2630
• Improved the HTML parse across document boundaries by handling whitespace separately from subsequent text. This better preserves the input's whitespace through parse and serialize round-trips. #2632
• Improved HTML parsing performance for documents with misplaced elements, and DOM update performance. #2646

Changes

• Removed APIs previously deprecated and scheduled for removal in 1.24.1. #2597
• Response.bodyStream() now observes the configured max body size and request timeout, consistent with the other response body methods. The default max size is 2 MB. You can configure that with maxBodySize(0) before executing the request to disable the cap. Response.isTruncated() reports when the decoded response content exceeded the configured limit. #2598
• Query selector parsing now limits each query to 128 structural steps, counting combinators, node selectors, and :has(), :is(), and :not() expressions together. More complex queries throw SelectorParseException during parsing.
• Attributes.equals() and hashCode() now exclude internal attributes, such as source ranges and user data. #2633

Bug Fixes

• Corrected :root to match the tree's root element in both query modes. Previously, it matched the element the query was called on. Use :scope to refer to that element.
• Standardized parser normalization of tag and attribute names so that HTML comparisons use ASCII-only case folding, and accepted control characters are preserved, aligning name handling to the HTML and XML specs. #2594
• Named character references without a semicolon before - or _ now decode correctly in attribute values, matching HTML and browser behavior (e.g., &copy- becomes ©-). #2588
• Support downloads > 2GB via Response.bodyStream() when maxBodySize(0) is configured. #2593
• Updated table and table-fragment parsing to place misnested content correctly per the HTML5 spec. For example, <table><b><p>X</b> places the paragraph before the table. #2601
• StreamParser now preserves its progress if you use the same Parser to parse another document, or call Element.append(String) on a streamed element. Previously, these operations replaced the active parse state and prevented streaming from continuing correctly. #2605
• Updated the adoption-agency algorithm to match the current HTML5 spec and to preserve formatting order when recovering misnested elements. #2604
• :has() now correctly matches sibling alternatives and descendants of siblings. Given <div id=a></div><div><span></span></div>, both #a:has(+ div, > span) and #a:has(+ div span) select #a. #2610
• Within node selectors, :not() now correctly applies :contains() and :matches() to the node value. For example, ::comment:not(:contains(foo)) excludes comments containing foo. #2610
• Updated <select> parsing to the current HTML spec, retaining elements such as buttons and other markup that the previous rules discarded. #2611
• Template parsing now closes unclosed templates at EOF and handles forms correctly in template documents and fragments. #2614
• Fixed handling of null characters and initial newlines in HTML to better match the HTML spec, including pre, listing, and textarea elements. Leading newlines in these elements' text are preserved when saving and reparsing HTML. #2616
• Fixed several HTML parsing edge cases across malformed doctypes, misplaced text in tables, and whitespace in framesets to match the HTML spec. #2618
• If a HTML void element ends up with children (via DOM manipulation), those are no longer serialized in html(). #2619
• Fixed a ConcurrentModificationException when emptying and reading separate childless elements concurrently. #2620
• Removed the old command, device, and menuitem tags, as they are no longer in the HTML spec. #2621
• Double-escaped script tags in body were being closed too early. #2627

... (truncated)

Changelog

Sourced from org.jsoup:jsoup's changelog.

1.24.1 (2026-Nov-03)

Improvements

• Added an opt-in Web query mode to align jsoup's selectors with CSS and Web DOM standards. See the selector migration guide for more details. #2642
  • Enable with System.setProperty("jsoup.queryMode", "web"). Queries return matching descendants only, can match surrounding ancestors, and follow HTML/XML case rules. Attribute ~= matches whitespace separated tokens instead of regexes.
  • You can jsoup.queryMode=check to help prepare for Web mode. Selectors return legacy results and print differences to stderr, with caller locations to help identify affected code.
  • Added :scope, :matchesAttr(name, regex), |= attribute matching, and attribute case flags i and s. These work in both legacy and Web modes, so queries can be updated before switching modes.
  • Web mode will become the default in 1.25.1 and the only mode in 1.26.1.
• Added support for parsing processing instructions in HTML and XML, as ProcessingInstruction nodes. This supports marker nodes such as <?marker name="country-options"?>, matched by \<template for="country-options"> in the HTML Standard's new declarative streaming syntax. Processing instructions can be selected with ::pi or ::pi(target), and their data can be read and changed through the node's attribute methods. Change: when using the XML parser, ordinary <?target ...?> nodes are now represented by ProcessingInstruction instead of XmlDeclaration; the <?xml ...?> declaration remains an XmlDeclaration. #2613
• Added Parser.parseAttributes(String) to parse an attribute fragment using that parser's settings.
• :has() selectors with child and sibling combinators now run faster by limiting the search to the parts of the document where they can match. This particularly improves selectors such as :has(> a), :has(+ dd), and :has(+ div span). #2610
• SVG-specific tag and attribute names are now automatically case corrected (e.g. pathlength becomes pathLength) when parsing HTML. #2630
• Improved the HTML parse across document boundaries by handling whitespace separately from subsequent text. This better preserves the input's whitespace through parse and serialize round-trips. #2632
• Improved HTML parsing performance for documents with misplaced elements, and DOM update performance. #2646

Changes

• Removed APIs previously deprecated and scheduled for removal in 1.24.1. #2597
• Response.bodyStream() now observes the configured max body size and request timeout, consistent with the other response body methods. The default max size is 2 MB. You can configure that with maxBodySize(0) before executing the request to disable the cap. Response.isTruncated() reports when the decoded response content exceeded the configured limit. #2598
• Query selector parsing now limits each query to 128 structural steps, counting combinators, node selectors, and :has(), :is(), and :not() expressions together. More complex queries throw SelectorParseException during parsing.
• Attributes.equals() and hashCode() now exclude internal attributes, such as source ranges and user data. #2633

Bug Fixes

• Corrected :root to match the tree's root element in both query modes. Previously, it matched the element the query was called on. Use :scope to refer to that element.
• Standardized parser normalization of tag and attribute names so that HTML comparisons use ASCII-only case folding, and accepted control characters are preserved, aligning name handling to the HTML and XML specs. #2594
• Named character references without a semicolon before - or _ now decode correctly in attribute values, matching HTML and browser behavior (e.g., &copy- becomes ©-). #2588
• Support downloads > 2GB via Response.bodyStream() when maxBodySize(0) is configured. #2593
• Updated table and table-fragment parsing to place misnested content correctly per the HTML5 spec. For example, <table><b><p>X</b> places the paragraph before the table. #2601
• StreamParser now preserves its progress if you use the same Parser to parse another document, or call Element.append(String) on a streamed element. Previously, these operations replaced the active parse state and prevented streaming from continuing correctly. #2605
• Updated the adoption-agency algorithm to match the current HTML5 spec and to preserve formatting order when recovering misnested elements. #2604
• :has() now correctly matches sibling alternatives and descendants of siblings. Given <div id=a></div><div><span></span></div>, both #a:has(+ div, > span) and #a:has(+ div span) select #a. #2610
• Within node selectors, :not() now correctly applies :contains() and :matches() to the node value. For example, ::comment:not(:contains(foo)) excludes comments containing foo. #2610
• Updated <select> parsing to the current HTML spec, retaining elements such as buttons and other markup that the previous rules discarded. #2611
• Template parsing now closes unclosed templates at EOF and handles forms correctly in template documents and fragments. #2614
• Fixed handling of null characters and initial newlines in HTML to better match the HTML spec, including pre, listing, and textarea elements. Leading newlines in these elements' text are preserved when saving and reparsing HTML. #2616
• Fixed several HTML parsing edge cases across malformed doctypes, misplaced text in tables, and whitespace in framesets to match the HTML spec. #2618
• If a HTML void element ends up with children (via DOM manipulation), those are no longer serialized in html(). #2619
• Fixed a ConcurrentModificationException when emptying and reading separate childless elements concurrently. #2620
• Removed the old command, device, and menuitem tags, as they are no longer in the HTML spec. #2621
• Double-escaped script tags in body were being closed too early. #2627
• Node.before(Node) and Node.after(Node) now leave the document unchanged when given the node itself, instead of throwing a NullPointerException. #2628
• Fixed HTML parse of <dialog>, <main>, and <search> so their start and end tags close open paragraphs correctly. #2629
• Updated the parse of malformed end tags such as </ COMMENT > to match the spec (<!-- COMMENT -->). #2631
• Source position tracking no longer impacts the adoption algo when repeated HTML formatting tags are reconstructed after a paragraph closes. #2633
• Fixed fragment parsing to ignore <body> and <frameset> start tags when the second open element is not body, matching the HTML spec. #2634
• Updated how the tokeniser handles malformed doctypes, to remove duplicative tokens and error messages. #2635
• Corrected HTML tokenisation of malformed comments such as <!---x and incomplete start tags such as <p id=, and improved their error reporting. #2636
• Fixed FormElement.empty() retaining associations with removed controls. If an input node removed by empty() was subsequently inserted outside its original form, it could incorrectly reappear in that form's elements() and formData() results. #2646

Commits

• 5e3c284 [maven-release-plugin] prepare release jsoup-1.24.1
• 5d63820 Link fix
• 55aa51e Bump org.sonatype.central:central-publishing-maven-plugin from 0.11.0 to 0.12...
• 3203485 Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.26.3 to 0.26.5 (#2...
• fdbfd44 Bump github/codeql-action from 4.38.3 to 4.39.0 (#2649)
• 6fedf39 Bump actions/setup-java from 6.0.1 to 6.1.0 (#2650)
• 0c508f1 Improve Selector javadoc
• 6feca03 Detach nested form controls on .empty()
• e1d48ba Improve query complexity accounting
• 76c125d Improve exception handling when parsing selectors across buffer boundaries.
• Additional commits viewable in compare view

Updates joda-time:joda-time from 2.15.0 to 2.15.1

Release notes

Sourced from joda-time:joda-time's releases.

Release v2.15.1

See the change notes for more information.

What's Changed

• Update time zone data to 2026fgtz by @​jodastephen in JodaOrg/joda-time#850

Full Changelog: JodaOrg/joda-time@v2.15.0...v2.15.1

Commits

• d451f7c Release v2.15.1
• a2292e2 Update time zone data to 2026fgtz (#850)
• See full diff in compare view

Updates com.google.guava:guava-testlib from 33.7.2-jre to 33.8.0-jre

Release notes

Sourced from com.google.guava:guava-testlib's releases.

33.8.0

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.8.0-jre</version>
  <!-- or, for Android: -->
  <version>33.8.0-android</version>
</dependency>

Jar files

• 33.8.0-jre.jar
• 33.8.0-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.8.0-jre
• 33.8.0-android

JDiff

• 33.8.0-jre vs. 33.7.2-jre
• 33.8.0-android vs. 33.7.2-android
• 33.8.0-android vs. 33.8.0-jre

Changelog

• collect: Enhanced HashBiMap and LinkedHashMultimap.ValueSet to defend against hash flooding (forthcoming CVE-2026-118042). (7cd44b3506)
• collect: Accidentally changed a few methods in ForwardingMap.StandardValues to be final. No Google-internal or GitHub-public code appears to be affected, but we will fix this in the next release. If it causes you problems, let us know.
• net: Added MediaType.APPLICATION_GZIP (application/gzip) to be used in preference to GZIP (application/x-gzip). (6393ebbdb6)
• primitives: Added Doubles.MIN_POSITIVE_VALUE and Floats.MIN_POSITIVE_VALUE as more clearly named aliases for Double.MIN_VALUE and Float.MIN_VALUE. (adf5554e7e)
• testlib: Added AbstractClassInitializationTest. (80fd5c114d)
• and, among the usual changes, a larger than usual number of small fixes (4afb1e04a4246c261be4742e1f2e2c39ebaf6266, 79152348ece2de85559eb2eb18133862d492c892, a279b884fe9890a3869142919352156f2a67a705, 786bb1a9b44685875ebe7b83f1404a1f07ac653c, 6b3a8d7498a7fde122967ba37a023ba3dcb47792, de57a419b56bcd887f51bb99103d91c65b7c5e86, fa64cc7c2b320aca9219981952bbb544f8f6ccff, 7b64964048948de3b5633a75d6e64f98cf8fcece, 5ae56d77e64305752b919ff2c96713f47ac0c94c, 37535d73f0416f30e0301efe61a8eb8ede44c1b7, ca8aedb2fdaf40fd6937a0643180aea51ca4154e, c0a8a1edc69393e8141424037571d9825f5fc0f4, 51246d06bb85ccc182a0aeb6a7adcbd55f759ae5, 81c7d030f8f144a4885ccf8efdc72c92605b4eec, 2b86a8216627a807ce8520abc6ae55437dbb85fb, 669a232b4e20ae6e8bc6efc62caaf2f830d56327, b157643c41f9ee6a38732b4fa1a590ba187912d9, ad73fbb9beff220aa26390630724855ef92fc50b, 1e6eb68f2ee8dc6cb164c285f7fe6ad5e8bc0905, 3d5be86651ec58b3f9d15c76cf888ade15aba39b)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml