Skip to content

build(deps): bump ai.djl:bom from 0.36.0 to 0.37.0 - #1444

Open
dependabot[bot] wants to merge 1 commit into
developmentfrom
dependabot/maven/ai.djl-bom-0.37.0
Open

dependabot[bot] wants to merge 1 commit into
developmentfrom
dependabot/maven/ai.djl-bom-0.37.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor

Bumps ai.djl:bom from 0.36.0 to 0.37.0.

Release notes

Sourced from ai.djl:bom's releases.

DJL v0.37.0 Release

This is the v0.37.0 release of DJL.

Changes

  • Bundled .java compilation and remote URL loading are now configurable, with tightened defaults (#3875)
  • Bumped log4j to 2.26.0 (#3877)
  • onnxruntime: allow sub-managers after NDManager.cap() (#3870)
  • Docs: fixed a typo (#3874)

Behavior changes

Two loading behaviors changed their defaults in #3875. Both previous behaviors remain available, but from this release each has to be enabled explicitly:

Behavior Default To restore
Compile bundled .java sources at model load off DJL_COMPILE_JAVA=true or -Dai.djl.compile_java=true
Unrestricted remote URL loading off DJL_ALLOW_INSECURE_URL=true or -Dai.djl.allow_insecure_url=true

Utils.openUrl now limits remote fetches to public http(s) destinations, resolves redirects explicitly with a bounded hop count, and allows file: and jar: only where they denote a local read. Loading from local directories, s3://, gs://, public http(s) archives, the djl:// model zoo and Hugging Face is unchanged. See the PR description for the full list and the flags.

Known issues / limitations

  • A model whose translator is available only as a raw .java file under lib/classes/ will not have it compiled by default; an error-level log names the flag. Models shipping a precompiled .class or .jar, or supplying a translator programmatically, are unaffected.
  • Loading a model over http(s) from a host that resolves to a private address now fails by default. Set the flag above if you serve models from an internal mirror.

Contributors

Thank you to the following community members for contributing to this release:

Rohit Kumar Srivastava, Vaibhav Srivastava, dev_Hakaze

Commits
  • 9d3fca3 Remove -SNAPSHOT for release v0.37.0
  • 3e888a9 Increase DJL version to 0.37.0
  • 1cb7449 [build] Bump log4j to 2.26.0 (#3877)
  • 02b4111 [api] Make bundled Java compilation opt-in and restrict remote URL loading (#...
  • e263d0d [docs] fix typo benifit -> benefit (#3874)
  • 1d6e058 fix(onnxruntime): allow sub-managers after NDManager.cap() (#3870)
  • 33caa1d fix(audio): use 32768.0f for 16-bit PCM normalization (#3869)
  • af1d0b8 Revert "Fix JNI memory safety issues in native utils (#3825)" (#3868)
  • 417016a Bump protobuf in /extensions/tokenizers/src/main/python (#3842)
  • 96599bb Bump com.fasterxml.jackson.core:jackson-databind from 2.19.2 to 2.21.5 (#3867)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Sep 21, 2026
@github-actions

Copy link
Copy Markdown

Submodule Changes


@dependabot
dependabot Bot force-pushed the dependabot/maven/ai.djl-bom-0.37.0 branch 3 times, most recently from 04e5e74 to 6cae35d Compare September 21, 2026 13:57
Comment thread pom.xml
<groupId>ai.djl</groupId>
<artifactId>bom</artifactId>
<version>0.36.0</version> <!-- WARNING: if changed, check the `com.google.code.gson:gson` version; see `docs/dependency_conflicts.md` -->
<version>0.37.0</version> <!-- WARNING: if changed, check the `com.google.code.gson:gson` version; see `docs/dependency_conflicts.md` -->

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mathieu usually validated this bump; we either need someone else in RG-L to do this, or to lock to 0.36.0.

Bumps [ai.djl:bom](https://github.com/deepjavalibrary/djl) from 0.36.0 to 0.37.0.
- [Release notes](https://github.com/deepjavalibrary/djl/releases)
- [Commits](deepjavalibrary/djl@v0.36.0...v0.37.0)

---
updated-dependencies:
- dependency-name: ai.djl:bom
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/maven/ai.djl-bom-0.37.0 branch from 6cae35d to 2486040 Compare September 22, 2026 12:32

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant