Skip to content

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Dec 12, 2025

Bumps org.eclipse.jetty:jetty-bom from 11.0.26 to 12.1.5.

Release notes

Sourced from org.eclipse.jetty:jetty-bom's releases.

12.1.5

Changelog

  • #14097 - Can't use Jetty when the default Locale is Azerbaijan
  • #14085 - QoSHandler: Allow customization of rejection status code (429 vs 503) and improve extensibility
  • #14070 - Invalid logger usage in ThreadPool
  • #14063 - Add test scope to jetty-quic-util JUnit dependency
  • #14028 - Native memory leak in zstd compression handler
  • #14017 - Fix cookie-config web.xml attributes when used with quickstart
  • #13993 - Fixes for ThreadLimitHandler with NON_BLOCKING invocation type
  • #13964 - HTTP/2 Client infinite reconnection loop
  • #13962 - HTTP/2 Client connection timeout does not work

12.1.4

Special Thanks to the following Eclipse Jetty community members

Changelog

  • #14004 - Fix NPE in SecurityHandler, List can have restrictions on contains(null)
  • #13993 - Jetty 12 server deadlock
  • #13976 - Allow configuring the default max local streams on the H2 client
  • #13973 - Fix Multipart cleanup in HttpChannelState
  • #13971 - ContentSinkOutputStream does not have idempotent close
  • #13962 - HTTP/2 Client connection timeout does not work
  • #13945 - Document deployment in programming guide
  • #13939 - Add an asByteArrayAsync method taking promise for Content.Source
  • #13936 - Version12.1.3 breaks BINARY compatibility with 12.0.29: HttpContent.getByteBuffer() and more
  • #13931 - Introduce ConditionalHandler.NextElseReject
  • #13924 - Merge PR #13887 to 12.1.x - fix servlet filter mappings with quickstart
  • #13922 - ResourceServlet Download link broken
  • #13915 - You can not have both Frame and Text handler in 12.1.x Jetty websocket
  • #13896 - listener.onContent( ... ) clears that ByteBuffer before the call.
  • #13886 - Servlet filter mappings not working with quickstart
  • #13883 - Invalid logger usage in HttpOutput
  • #13850 - FileMappingHttpContentFactory change in 12.1.x still serves old files, even when last modified date on file changes
  • #13849 - Connection reset on HTTP/2 when using CompressionHandler with default WindowRateControl
  • #13841 - Warn the first time the TCCL fails to be set
  • #13837 - Limit ReservedThread creation (@​arsenalzp)
  • #13833 - CompressionHandler shouldn't compress response with specific status codes
  • #13832 - Introduced SecurityHandler.PathMethodMapped
  • #13812 - NullPointerException in GzipEncoderSink, breaking all requests with CompressionHandler
  • #13806 - Improved Credential to allow stronger password checksums.
  • #13768 - Sanitizing of HTTP headers names and values should remove NUL bytes (U+0000)
  • #13689 - eeX-demo-mock-resources.mod incorrectly depends on eeX-annotations
  • #13685 - Infinite loop on Content.copy() with Content.Source.from(... , Path, ) when Path has size 0.

... (truncated)

Commits
  • 4905d09 Updating to version 12.1.5
  • 03790e9 Fix ZStandard native memory leaks (#14087)
  • 52a743b QoSHandler customization of the status code and the writing of the response...
  • fd6011d Fix loop caused by NegotiatingClientConnection talking to broken server (#1...
  • c1e300d Replace reflection-based BundleClassLoaderHelper with spec-compliant BundleDe...
  • 787aa03 Improve buffer pools stats and dump (#14123)
  • 06ba4eb Introduced Jetty module json.mod, called "json" and not "ajax" despite the ...
  • b448fea Merge pull request #14083 from jetty/fix/jetty-12.1.x/14070-ThreadPoolDebugLog
  • d2a9738 [12.1.x EE8] Bump the build-deps group in /jetty-ee8 with 2 updates
  • d15dc5b [12.1.x Root pom] Bump the dev-dependencies group with 4 updates
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Dec 12, 2025
@JinwooHwang JinwooHwang force-pushed the 2.9.4-CVE-2025-66516-CVE-2025-54988 branch from 3caaace to 4c54360 Compare December 12, 2025 19:58
Dependabot couldn't find the original pull request head commit, 40c92bb.
@dependabot dependabot bot force-pushed the dependabot/maven/org.eclipse.jetty-jetty-bom-12.1.5 branch from 40c92bb to 127803a Compare December 12, 2025 19:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant