chore(deps): bump the maven-minor-and-patch group across 1 directory with 6 updates

[dependabot]

Bumps the maven-minor-and-patch group with 6 updates in the / directory:

Package	From	To
io.netty:netty-all	4.2.17.Final	4.2.18.Final
io.micrometer:micrometer-core	1.17.0	1.17.1
org.slf4j:slf4j-api	2.0.18	2.0.20
org.slf4j:slf4j-simple	2.0.18	2.0.20
tools.jackson.core:jackson-databind	3.2.2	3.2.3
org.apache.maven.plugins:maven-surefire-plugin	3.5.6	3.6.0

Updates io.netty:netty-all from 4.2.17.Final to 4.2.18.Final

Release notes

Sourced from io.netty:netty-all's releases.

netty-4.2.18.Final

Security fixes

• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
• CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility Notes

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

• Use X509ExtendedTrustManager in SSLErrorTest by @​normanmaurer in netty/netty#17221
• Update setup-testlens to v1.9.4 by @​marcphilipp in netty/netty#17223

... (truncated)

Commits

• 2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final
• 6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...
• c44a052 SPDY: SpdySessionHandler must limit the concurrent streams
• 374d965 HTTP: Limit the maximum number of concurrent pipelined requests
• 7e8b325 HTTP/2: Limit HPACK encoding table size
• e3ebf70 OCSP: Correctly handle that nextUpdate is optional
• 5388535 STOMP: Correctly release partial content on handler removal
• 3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
• 1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers
• 3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop...
• Additional commits viewable in compare view

Updates io.micrometer:micrometer-core from 1.17.0 to 1.17.1

Commits

• See full diff in compare view

Updates org.slf4j:slf4j-api from 2.0.18 to 2.0.20

Updates org.slf4j:slf4j-simple from 2.0.18 to 2.0.20

Updates tools.jackson.core:jackson-databind from 3.2.2 to 3.2.3

Commits

• 4179a66 [maven-release-plugin] prepare release jackson-databind-3.2.3
• 37c8a72 Prep for 3.2.3 release
• 5fa7881 Merge branch '3.1' into 3.2
• c9f17a2 Post-release dep version bump
• 1ea1c40 [maven-release-plugin] prepare for next development iteration
• 2968e8f [maven-release-plugin] prepare release jackson-databind-3.1.7
• d61810b Prep for 3.1.7 release
• e065a09 Merge branch '2.x' into 3.1
• fd189a7 Merge branch '2.22' into 2.x
• 211faf7 Post-release dep version bump
• Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0

Release notes

Sourced from org.apache.maven.plugins:maven-surefire-plugin's releases.

3.6.0

Please refer to the main page for what's new https://maven.apache.org/surefire/ And the migration page https://maven.apache.org/surefire/maven-surefire-plugin/whats-new-3-6-0.html

🚀 New features and improvements

• Fix #3303: distinguish JUnit 6 ParameterizedClass invocations (#3432) @​AzazelSensei
• [SUREFIRE-1639] - Add ability to configure JUnit 5 TestExecutionListener (#3438) @​pan3793
• Issue #838 Implement extension point to run diagnosis tools when forked JVM times out (#3372) @​olamy
• [SUREFIRE-2148] - Verify recovered BeforeAll does not fail build (#3419) @​wilx
• [SUREFIRE-823] - Decouple -DskipTests from Failsafe plugin (#3371) @​olamy
• Use StackWalker in StackTraceProvider when available (Java 9+) (#3374) @​olamy
• [Issue-3380] Send sourceQualifiedName to forked clients (#3380) (#3381) @​fabriciorby

🐛 Bug Fixes

• [SUREFIRE-523] - Link all reported tests to source XRef (#3445) @​wilx
• [SUREFIRE-3446] - Fix direct selection of JUnit Jupiter @​Nested classes (#3447) @​wilx
• Discover tests in a fork when a toolchain JDK is used (#3444) @​olamy
• [SUREFIRE-2239, SUREFIRE-2241, SUREFIRE-2260, SUREFIRE-2274, SUREFIRE-2300] Preserve JUnit Platform test identity across reruns (#3418) @​wilx
• Fix #3428: resolve parents via TestPlan.getParent for pre-1.8 platforms (#3429) @​kalayciburak
• [SUREFIRE-859] - Make random test order reproducible (#3421) @​wilx
• [SUREFIRE-862, SUREFIRE-3178] Handle missing Failsafe summary files (#3417) @​wilx
• fix: report AfterAll/AfterClass exceptions as errors again (#3412) (#3413) @​arimu1
• Fixes #3264 : tests inside @​Suite incorrectly classified as flakes (#3342) @​mirkoalicastro
• Fix Windows flake in CommandChannelDecoderTest (#3400) @​ascheman
• Fix reportNameSuffix in XML testcase classname (#3379) @​goutamadwant
• Fix: resolve relative classpath elements against the fork's working dir (#3333) @​cwegener-79

📝 Documentation updates

• Magnify the home, well at least have something rather than nothing :) (#3377) @​olamy
• Restore the straight quotes the FAQ conversion turned typographic (#3425) @​slachiewicz
• Restore the table borders lost in the APT conversion (#3424) @​slachiewicz
• Convert the FAQ from FML to Markdown (#3423) @​slachiewicz
• Convert the remaining site documentation from APT to Markdown (#3422) @​slachiewicz
• javadoc: clarify statelessTestsetReporter, consoleOutputReporter, (#3410) @​joshinii
• Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#3387) @​potiuk
• Update documentation we support Junit 6 as well :) (#3370) @​olamy

👻 Maintenance

• Stop dependabot from updating test fixtures (#3440) @​slachiewicz
• Migrate legacy plugin Javadoc annotations (#3416) @​wilx
• Use the resolver's own HTTP transport in the report plugin tests (#3414) @​slachiewicz
• Pin maven-jar-plugin 3.5.1 in modular IT fixtures (#3398) @​ascheman
• Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#3387) @​potiuk

... (truncated)

Commits

• 0ff622b [maven-release-plugin] prepare release surefire-3.6.0
• bb3932a Let's go for 3.6.0 release
• 3002a16 Bump mavenVersion from 3.9.14 to 3.9.16
• 61a531d Bump Maven parent version from 47 to 49 (#3449)
• e52ead4 [SUREFIRE-523] Link all reported tests to source XRef (#3445)
• 45102fa [SUREFIRE-3446] Fix direct selection of JUnit Jupiter @​Nested classes (#3447)
• b2e1f70 Fix #3303: distinguish JUnit 6 ParameterizedClass invocations (#3432)
• c051938 Discover tests in a fork when a toolchain JDK is used (#3444)
• db75df8 Bump org.codehaus.plexus:plexus-java from 1.5.2 to 1.6.0 (#3441)
• 77f2759 Bump org.codehaus.plexus:plexus-interpolation from 1.29 to 1.30.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.