chore(deps): bump the gradle-dependencies group across 1 directory with 12 updates

[dependabot]

Bumps the gradle-dependencies group with 12 updates in the /booklore-api directory:

Package	From	To
org.flywaydb:flyway-mysql	12.11.0	13.10.0
com.twelvemonkeys.imageio:imageio-jpeg	3.15.1	3.15.3
com.twelvemonkeys.imageio:imageio-tiff	3.15.1	3.15.3
com.twelvemonkeys.imageio:imageio-webp	3.15.1	3.15.3
com.twelvemonkeys.imageio:imageio-bmp	3.15.1	3.15.3
com.github.junrar:junrar	7.6.1	8.1.2
tools.jackson:jackson-bom	3.2.2	3.2.3
com.github.ben-manes.caffeine:caffeine	3.2.4	3.3.0
com.h2database:h2	2.5.250	2.5.252
org.hibernate.orm	7.4.8.Final	7.4.10.Final
io.github.ben-manes.versions	0.64.0	0.66.0
gradle-wrapper	9.7.1	9.8.1

Updates org.flywaydb:flyway-mysql from 12.11.0 to 13.10.0

Updates com.twelvemonkeys.imageio:imageio-jpeg from 3.15.1 to 3.15.3

Updates com.twelvemonkeys.imageio:imageio-tiff from 3.15.1 to 3.15.3

Updates com.twelvemonkeys.imageio:imageio-webp from 3.15.1 to 3.15.3

Updates com.twelvemonkeys.imageio:imageio-bmp from 3.15.1 to 3.15.3

Updates com.github.junrar:junrar from 7.6.1 to 8.1.2

Release notes

Sourced from com.github.junrar:junrar's releases.

Release v8.1.2

Changelog

🐛 Fixes

rar5

• refuse symlink targets with '..' after a name (19e06c1)
• keep absolute link names under the destination and walk symlinks from the canonical root (43b325e)
• anchor link paths on the canonical destination before creating directories (6bebb62)

unscoped

• replay a solid stream after a failed extraction (b9b61ce)
• restart the RAR 1.4 solid ordinal when replaying a solid stream (fdc86db)
• replay solid stream when re-extracting the same entry (d3bdab3)
• create regular files under the canonical destination (fd18ff6)
• deliver output past the declared size instead of rejecting it (82a623b)
• extract RAR5 entries of unknown size instead of an empty file (763b881)
• report a stream failure on the read reaching the declared size (46bbc83)
• report a stream failure on close once the full entry was read (683a91b)
• extract empty entries through getInputStream too (f4f2059)
• report extraction failures through getInputStream instead of a normal EOF (67474bd)

🧪 Tests

rar5

• pin each link-destination guard with a failing-without test (c9c80bd)

unscoped

• pin a RAR5 unknown-size entry in the regression corpus (8d471c3)

🛠 Build

deps

• bump com.fasterxml.jackson.core:jackson-databind (d756daf)
• bump com.fasterxml.jackson.datatype:jackson-datatype-jsr310 (014c70a)
• bump io.github.ben-manes.versions.settings (394d5aa)
• bump org.bouncycastle:bcprov-jdk18on from 1.85.2 to 1.86 (1677f5a)
• bump com.diffplug.spotless from 8.10.1 to 8.10.2 (55450fc)
• bump gradle/actions from 6.3.0 to 6.4.0 (4611f3f)
• bump org.jreleaser from 1.25.0 to 1.26.0 (1d10acc)
• bump actions/setup-java from 5 to 6 (ac678ad)
• bump com.diffplug.spotless from 8.10.0 to 8.10.1 (682b75f)

unscoped

• enable immutable github releases with jreleaser (c29e60f)

📝 Documentation

• record the regular-file and symlink-chain follow-ups to GHSA-ccq9-hw6f-p9cm (e22b8c5)
• state that Archive is not thread-safe and how stream failures surface (621f6de)

Contributors

... (truncated)

Changelog

Sourced from com.github.junrar:junrar's changelog.

8.1.2 (2026-10-09)

🐛 Fixes

rar5

• refuse symlink targets with '..' after a name (19e06c1)
• keep absolute link names under the destination and walk symlinks from the canonical root (43b325e)
• anchor link paths on the canonical destination before creating directories (6bebb62)

unscoped

• replay a solid stream after a failed extraction (b9b61ce)
• restart the RAR 1.4 solid ordinal when replaying a solid stream (fdc86db)
• replay solid stream when re-extracting the same entry (d3bdab3)
• create regular files under the canonical destination (fd18ff6)
• deliver output past the declared size instead of rejecting it (82a623b)
• extract RAR5 entries of unknown size instead of an empty file (763b881)
• report a stream failure on the read reaching the declared size (46bbc83)
• report a stream failure on close once the full entry was read (683a91b)
• extract empty entries through getInputStream too (f4f2059)
• report extraction failures through getInputStream instead of a normal EOF (67474bd)

🧪 Tests

rar5

• pin each link-destination guard with a failing-without test (c9c80bd)

unscoped

• pin a RAR5 unknown-size entry in the regression corpus (8d471c3)

🛠 Build

deps

• bump com.fasterxml.jackson.core:jackson-databind (d756daf)
• bump com.fasterxml.jackson.datatype:jackson-datatype-jsr310 (014c70a)
• bump io.github.ben-manes.versions.settings (394d5aa)
• bump org.bouncycastle:bcprov-jdk18on from 1.85.2 to 1.86 (1677f5a)
• bump com.diffplug.spotless from 8.10.1 to 8.10.2 (55450fc)
• bump gradle/actions from 6.3.0 to 6.4.0 (4611f3f)
• bump org.jreleaser from 1.25.0 to 1.26.0 (1d10acc)
• bump actions/setup-java from 5 to 6 (ac678ad)
• bump com.diffplug.spotless from 8.10.0 to 8.10.1 (682b75f)

unscoped

• enable immutable github releases with jreleaser (c29e60f)

📝 Documentation

• record the regular-file and symlink-chain follow-ups to GHSA-ccq9-hw6f-p9cm (e22b8c5)
• state that Archive is not thread-safe and how stream failures surface (621f6de)

8.1.1 (2026-08-31)

🐛 Fixes

io

• readLongBigEndian returned only the low 32 bits (efdbd79)

... (truncated)

Commits

• b9b61ce fix: replay a solid stream after a failed extraction
• fdc86db fix: restart the RAR 1.4 solid ordinal when replaying a solid stream
• d3bdab3 fix: replay solid stream when re-extracting the same entry
• d756daf build(deps): bump com.fasterxml.jackson.core:jackson-databind
• 014c70a build(deps): bump com.fasterxml.jackson.datatype:jackson-datatype-jsr310
• 394d5aa build(deps): bump io.github.ben-manes.versions.settings
• 1677f5a build(deps): bump org.bouncycastle:bcprov-jdk18on from 1.85.2 to 1.86
• 55450fc build(deps): bump com.diffplug.spotless from 8.10.1 to 8.10.2
• e22b8c5 docs: record the regular-file and symlink-chain follow-ups to GHSA-ccq9-hw6f-...
• 19e06c1 fix(rar5): refuse symlink targets with '..' after a name
• Additional commits viewable in compare view

Updates tools.jackson:jackson-bom from 3.2.2 to 3.2.3

Commits

• 169de87 [maven-release-plugin] prepare release jackson-bom-3.2.3
• c64410b Prep for 3.2.3 release
• 1f23ca6 Merge branch '3.1' into 3.2
• 432ca52 Post-release dep version bump
• e0d3ccf [maven-release-plugin] prepare for next development iteration
• 8abdaa6 [maven-release-plugin] prepare release jackson-bom-3.1.7
• 2abd85b Prep for 3.1.7 release
• c63b07a Post-release dep version bump
• b0a5033 [maven-release-plugin] prepare for next development iteration
• See full diff in compare view

Updates com.github.ben-manes.caffeine:caffeine from 3.2.4 to 3.3.0

Release notes

Sourced from com.github.ben-manes.caffeine:caffeine's releases.

3.3.0

• Improved read performance by avoiding false sharing in the fast-path check
• Improved adaptive climber for small caches and shifting workloads
• Fixed various minor issues found using AI audits
• Fixed over-aggressive refresh discard (#1970)

Commits

• af86011 fix jcache audit triage
• f063e56 Prevent overflow in snapshot durations
• 5b6fbd9 Saturate the audit stillness counter
• 48cb408 Read lazy cache views and policies once
• 4978d18 Normalize JCache processor loader failures
• c9038d8 Consume JCache iterator removals before listener failures
• 0b0afd2 polish
• c0edd00 restore coverage lost to recent fixes
• 5283c96 make CLOCK-Pro's cold hand a setting
• d15c205 make the bulk cache loaders serializable
• Additional commits viewable in compare view

Updates com.h2database:h2 from 2.5.250 to 2.5.252

Release notes

Sourced from com.h2database:h2's releases.

Version 2.5.252

Commits

• f986838 in preparation for a release
• 06c34a7 Merge pull request #4418 from andreitokar/issues-4380-4376
• 1aef3e0 #4376: Reading INFORMATION_SCHEMA.COLUMNS fails with a NPE while any material...
• 4bb8aee #4380: creating a MATERIALIZED VIEW makes a persistent database permanently u...
• 95b6af0 Merge pull request #4417 from andreitokar/issue-4395
• 6ec30b6 #4395 disallow constraints between temporary and permanent tables
• 0f0f856 Merge pull request #4416 from andreitokar/issue-4405
• f718b76 #4405 SecureFileStore.readFully() may skip decryption
• e231ff7 #4405 SecureFileStore.readFully() may skip
• 4da0d1d Merge pull request #4415 from jjh75607/fix/log-sql-aarch64
• Additional commits viewable in compare view

Updates org.hibernate.orm from 7.4.8.Final to 7.4.10.Final

Updates io.github.ben-manes.versions from 0.64.0 to 0.66.0

Updates gradle-wrapper from 9.7.1 to 9.8.1

Release notes

Sourced from gradle-wrapper's releases.

9.8.1

This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.

This release addresses three high rated vulnerabilities:

• Unauthenticated worker-to-daemon channel deserializes untrusted Java objects
• Deserialization of untrusted Java objects before authentication in the client - daemon communication
• Failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts

The following issues were resolved:

• [Gradle 9.8.0 complains again about invalid Toolchains on Debian / Ubuntu packaged systems]- (gradle/gradle#39358)
• Gradle 9.8.0 removes root java.util.logging handlers installed by a custom LogManager (breaks Quarkus test log capture)
• Dependency resolution regression

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam, Björn Kautler, Eng Zer Jun, Hashim Khan, Julian Krannich, KBS, Labh R Jethe, Mark Dodgson, Maxim, monkey, nataphon-ktsystems, Paul King, Qiu Tian, rg_sandesh, Roberto Perez Alcolea, Sean, Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

... (truncated)

Commits

• 39daf39 Release notes for Gradle 9.8.1 (#39409)
• 4fc92e5 Release notes for Gradle 9.8.1
• bfbd14a Make repository disabling stricter (#39403)
• 95e0bf9 Check daemon & worker preamble earlier (#39402)
• 7aa9a5b Improve display for distribution url in wrapper (#39401)
• 74a7720 Wrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...
• 651110a Check worker token before any serialization similarly to daemon
• 8a6b9d9 Harden repository disabling: disable them by default on failure unless there'...
• f28e514 Check the daemon token before any serialization
• 86ab273 Replace credentials for distribution url with *** and avoid showing the plain...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Frontend Test Results

452 tests  ±0   452 ✅ ±0   2s ⏱️ ±0s
 23 suites ±0     0 💤 ±0 
  1 files   ±0     0 ❌ ±0 

Results for commit e763ade. ± Comparison against base commit 01b3407.

[github-actions]

Backend Test Results

  465 files  ±0    465 suites  ±0   2m 26s ⏱️ -14s
3 374 tests ±0  3 359 ✅ ±0  15 💤 ±0  0 ❌ ±0 
3 431 runs  ±0  3 416 ✅ ±0  15 💤 ±0  0 ❌ ±0 

Results for commit e763ade. ± Comparison against base commit 01b3407.