Bump the gradle-dependencies group across 14 directories with 19 updates

[dependabot]

Bumps the gradle-dependencies group with 19 updates in the / directory:

Package	From	To
com.puppycrawl.tools:checkstyle	9.0	9.3
com.google.errorprone:error_prone_core	2.43.0	2.50.0
junit:junit	4.11	4.13.2
net.ltgt.errorprone	4.2.0	4.4.0
org.openjdk.jmh:jmh-core	1.33	1.37
org.openjdk.jmh:jmh-generator-annprocess	1.33	1.37
biz.aQute.bnd.builder	7.1.0	7.4.0
com.yubico.yubikit:openpgp	3.1.0	3.2.1
com.yubico.yubikit:desktop	3.1.0	3.2.1
javax.mail:mail	1.4	1.4.7
jakarta.mail:jakarta.mail-api	2.0.1	2.1.5
jakarta.activation:jakarta.activation-api	2.0.0	2.1.4
io.grpc:grpc-protobuf	1.83.1	1.84.0
io.grpc:grpc-stub	1.83.1	1.84.0
io.grpc:grpc-services	1.83.1	1.84.0
io.grpc:grpc-netty-shaded	1.83.1	1.84.0
io.grpc:protoc-gen-grpc-java	1.83.1	1.84.0
io.grpc:grpc-stub	1.83.1	1.84.0
io.grpc:grpc-services	1.83.1	1.84.0
io.grpc:grpc-netty-shaded	1.83.1	1.84.0
io.grpc:protoc-gen-grpc-java	1.83.1	1.84.0
com.google.protobuf	0.9.4	0.10.0
gradle-wrapper	9.1.0	9.7.1
org.openjdk.jmh:jmh-core	1.33	1.37
org.openjdk.jmh:jmh-generator-annprocess	1.33	1.37
jakarta.mail:jakarta.mail-api	2.0.1	2.1.5
jakarta.activation:jakarta.activation-api	2.0.0	2.1.4
biz.aQute.bnd.builder	7.1.0	7.4.0
javax.mail:mail	1.4	1.4.7
biz.aQute.bnd.builder	7.1.0	7.4.0
io.grpc:grpc-protobuf	1.83.1	1.84.0
io.grpc:grpc-stub	1.83.1	1.84.0
io.grpc:grpc-services	1.83.1	1.84.0
io.grpc:grpc-netty-shaded	1.83.1	1.84.0
io.grpc:protoc-gen-grpc-java	1.83.1	1.84.0
javax.mail:mail	1.4	1.4.7
junit:junit	4.11	4.13.2
com.google.protobuf	0.9.4	0.10.0
biz.aQute.bnd.builder	7.1.0	7.4.0
junit:junit	4.11	4.13.2
biz.aQute.bnd.builder	7.1.0	7.4.0
com.yubico.yubikit:openpgp	3.1.0	3.2.1
com.yubico.yubikit:desktop	3.1.0	3.2.1
junit:junit	4.11	4.13.2
biz.aQute.bnd.builder	7.1.0	7.4.0
junit:junit	4.11	4.13.2
biz.aQute.bnd.builder	7.1.0	7.4.0
junit:junit	4.11	4.13.2
biz.aQute.bnd.builder	7.1.0	7.4.0
junit:junit	4.11	4.13.2
junit:junit	4.11	4.13.2
biz.aQute.bnd.builder	7.1.0	7.4.0
biz.aQute.bnd.builder	7.1.0	7.4.0
junit:junit	4.11	4.13.2
biz.aQute.bnd.builder	7.1.0	7.4.0

Bumps the gradle-dependencies group with 2 updates in the /core directory: org.openjdk.jmh:jmh-core and org.openjdk.jmh:jmh-generator-annprocess.
Bumps the gradle-dependencies group with 3 updates in the /jmail directory: biz.aQute.bnd.builder, jakarta.mail:jakarta.mail-api and jakarta.activation:jakarta.activation-api.
Bumps the gradle-dependencies group with 2 updates in the /mail directory: biz.aQute.bnd.builder and javax.mail:mail.
Bumps the gradle-dependencies group with 7 updates in the /misc directory:

Package	From	To
javax.mail:mail	1.4	1.4.7
io.grpc:grpc-protobuf	1.83.1	1.84.0
io.grpc:grpc-stub	1.83.1	1.84.0
io.grpc:grpc-services	1.83.1	1.84.0
io.grpc:grpc-netty-shaded	1.83.1	1.84.0
io.grpc:protoc-gen-grpc-java	1.83.1	1.84.0
com.google.protobuf	0.9.4	0.10.0
javax.mail:mail	1.4	1.4.7
io.grpc:grpc-protobuf	1.83.1	1.84.0
io.grpc:grpc-stub	1.83.1	1.84.0
io.grpc:grpc-services	1.83.1	1.84.0
io.grpc:grpc-netty-shaded	1.83.1	1.84.0
io.grpc:protoc-gen-grpc-java	1.83.1	1.84.0
javax.mail:mail	1.4	1.4.7
com.google.protobuf	0.9.4	0.10.0

Bumps the gradle-dependencies group with 1 update in the /mls directory: biz.aQute.bnd.builder.
Bumps the gradle-dependencies group with 1 update in the /pg directory: biz.aQute.bnd.builder.
Bumps the gradle-dependencies group with 3 updates in the /pgsc directory: biz.aQute.bnd.builder, com.yubico.yubikit:openpgp and com.yubico.yubikit:desktop.
Bumps the gradle-dependencies group with 1 update in the /pkix directory: biz.aQute.bnd.builder.
Bumps the gradle-dependencies group with 1 update in the /prov directory: biz.aQute.bnd.builder.
Bumps the gradle-dependencies group with 1 update in the /test directory: junit:junit.
Bumps the gradle-dependencies group with 1 update in the /tls directory: biz.aQute.bnd.builder.
Bumps the gradle-dependencies group with 1 update in the /tls-klog directory: biz.aQute.bnd.builder.
Bumps the gradle-dependencies group with 2 updates in the /util directory: junit:junit and biz.aQute.bnd.builder.

Updates com.puppycrawl.tools:checkstyle from 9.0 to 9.3

Release notes

Sourced from com.puppycrawl.tools:checkstyle's releases.

checkstyle-9.3

https://checkstyle.org/releasenotes.html#Release_9.3

checkstyle-9.2.1

https://checkstyle.org/releasenotes.html#Release_9.2.1

checkstyle-9.2

https://checkstyle.org/releasenotes.html#Release_9.2

checkstyle-9.1

https://checkstyle.org/releasenotes.html#Release_9.1

checkstyle-9.0.1

https://checkstyle.org/releasenotes.html#Release_9.0.1

Commits

• 5c19037 [maven-release-plugin] prepare release checkstyle-9.3
• c4b2862 doc: release notes 9.3
• ef2ac6c dependency: bump taglist-maven-plugin from 2.4 to 3.0.0
• e12eee4 minor: Specified violation messages in SeparatorWrapCheck
• 645262f Issue #11091: Fail test execution when input file hasn't specified violation ...
• 2372df1 infra: disable equalsverifier until https://github.com/jqno/equalsverifier/is...
• b37ec9c Issue #6320: Kill surviving mutations for REMOVE_CONDITIONALS in UnusedLocalV...
• 7cd807c Issue #11220: False positive in MissingSwitchDefault with pattern in switch l...
• 7124ab9 Issue #11187: OperatorWrapCheck throws NPE on guarded patterns
• 8a93900 infra: use master branch for no-error-xwiki execution
• Additional commits viewable in compare view

Updates com.google.errorprone:error_prone_core from 2.43.0 to 2.50.0

Release notes

Sourced from com.google.errorprone:error_prone_core's releases.

Error Prone 2.50.0

New checks:

• BoxingComparator: Detect implicitly-boxing Comparator.comparing key extractors
• ExposedPrivateType: Discourage references to private member classes from non-private APIs
• JUnitMethodInvoked: Discourage directly invoking JUnit test methods
• ListRemoveAmbiguous: Detect ambiguous calls to List.remove(int|Integer)
• PreferTestParameter: suggests using @TestParameter instead of @TestParameters for exhaustive boolean and enum parameters on single-element parameterized tests
• RecordComponentAccessorAnnotationConflict: Detect conflicts between record components and explicit accessor methods
• RecordComponentOverride: Discourage @Override on record component declarations that don't override anything
• ThrowableEqualsHashCode: Discourage overriding Throwable.equals() and hashCode()

Closed issues: #5553, #5649, #5778

Full changelog: google/error-prone@v2.49.0...v2.50.0

Error Prone 2.49.0

This release includes several changes to Matcher APIs, and removed some deprecated or problematic APIs:

• Remove deprecated MethodMatchers.withSignature API, which relies on fragile toString behaviour. Alternatives for matching on method signatures with varargs and type parameters were added in google/error-prone@a98a1c5.
• Removed variableType(Matcher) API. Matchers.variableType(Matcher) uses VariableTree#getType to match variable types, which own't work for lambda parameters with inferred types after JDK-8268850. The recommended replacement is variableType(TypePredicate).
• Make enclosingPackage return an optional. Module elements are not enclosed by a package, checks using enclosingPackage shouldn't assume an enclosing package exists when processing arbitrary elements.
• New FieldMatchers API, similar to MethodMatchers (google/error-prone@1dd9c3a).

New checks:

• AssertThrowsBlockToExpression: Discourage unnecessary block lambdas in assertThrows.
• AssertThrowsMinimizer: Suggest minimizing the amount of logic in assertThrows.
• MemorySegmentReferenceEquality: Discourage using reference equality for MemorySegments.
• PreferThrowsTag: Recommends using @throws instead of the legacy @exception javadoc tag.
• RecordAccessorInCompactConstructor: detect record accessors inside the compact canonical ctors, which read uninitialized fields.

Closed issues: #2283, #3503, #5210, #5289, #5548, #5548, #5554, #5609, #5614, #5656

Full changelog: google/error-prone@v2.48.0...v2.49.0

Error Prone 2.48.0

Changes:

• Added support for passing flags with command-line argument files (@-files) (google/error-prone@8e84edf)

New checks:

• AvoidValueSetter
• UnnecessarySemicolon

Closed issues: #5529, #5537, #5522, #5521

Full changelog: google/error-prone@v2.47.0...v2.48.0

... (truncated)

Commits

• d802cff Release Error Prone 2.50.0
• b12b5f2 In StringCharset, move the description from explanation to summary.
• a7ca02a Update AssertThrowsUtils to emit var thrown = assertThrows(...) instead o...
• 6b56517 Fix handling of nested tags in UnrecognisedJavadocTag
• d36e74f Remove translation of the fail() message into assertThrows(). We already ...
• c3581e9 Fix JavacFileManager compiler crash during speculative recompiles in modular ...
• da1f32b Remove assignments from assertThrows() lambdas. A large percentage of remai...
• dee62f7 Update AssertThrowsBlockToExpression to re-write single VariableTrees int...
• 4939448 Only hoist the last statement into the assertThrows() lambda.
• 30fd05a refactor: Rename JavaLangClash bug pattern to AvoidCommonTypeNames
• Additional commits viewable in compare view

Updates junit:junit from 4.11 to 4.13.2

Release notes

Sourced from junit:junit's releases.

JUnit 4.13.2

Please refer to the release notes for details.

JUnit 4.13.1

Please refer to the release notes for details.

JUnit 4.13

Please refer to the release notes for details.

JUnit 4.13 RC 2

Please refer to the release notes for details.

JUnit 4.13 RC 1

Please refer to the release notes for details.

JUnit 4.13 Beta 3

Please refer to the release notes for details.

JUnit 4.13 Beta 2

Please refer to the release notes for details.

JUnit 4.13 Beta 1

Please refer to the release notes for details.

JUnit 4.12

Please refer to the release notes for details.

JUnit 4.12 Beta 3

Please refer to the release notes for details.

JUnit 4.12 Beta 2

No release notes provided.

JUnit 4.12 Beta 1

No release notes provided.

Commits

• 05fe2a6 [maven-release-plugin] prepare release r4.13.2
• ff57344 Add build for JDK 17-ea
• 02aaa01 Improve check that thread is stopped
• e9a75f4 Merge test for exception type and message
• d27ad52 Rename DelegateStatement to DelegatingStatement
• b83dc2e Better name for test that stops statement
• 527f3a3 Replace InfiniteLoop with RunForASecond
• 2db6394 Tidy up FailOnTimeoutTest
• 64634e1 Update 4.13.2 release notes to document pull 1654
• f8ee412 Fix serialization of AssumptionViolatedException (#1654)
• Additional commits viewable in compare view

Updates net.ltgt.errorprone from 4.2.0 to 4.4.0

Updates org.openjdk.jmh:jmh-core from 1.33 to 1.37

Commits

• 2effa2c JMH v1.37.
• 09c78d5 7903508: JMH: Remove the Unicode dot prefix from secondary results
• 843f641 7903510: JMH: Add core performance checking tests
• 8bc325b 7903511: JMH: Add score stability performance tests
• 6b09724 7903450: JMH: Improve -prof perfnorm accuracy with robust estimations
• d88f901 7903504: JMH: Fix new Sonar warnings
• 47f651b 7903498: JMH: Reset worker interrupt status after iteration
• 482561a 7903492: JMH: Infrastructure code should yield occasionally for virtual execu...
• 9a97557 7903490: JMH: The interrupt to time-outing benchmark can be delivered to work...
• bf8db38 7903487: JMH: Make sure JMH profilers work on all tested configurations
• Additional commits viewable in compare view

Updates org.openjdk.jmh:jmh-generator-annprocess from 1.33 to 1.37

Commits

• 2effa2c JMH v1.37.
• 09c78d5 7903508: JMH: Remove the Unicode dot prefix from secondary results
• 843f641 7903510: JMH: Add core performance checking tests
• 8bc325b 7903511: JMH: Add score stability performance tests
• 6b09724 7903450: JMH: Improve -prof perfnorm accuracy with robust estimations
• d88f901 7903504: JMH: Fix new Sonar warnings
• 47f651b 7903498: JMH: Reset worker interrupt status after iteration
• 482561a 7903492: JMH: Infrastructure code should yield occasionally for virtual execu...
• 9a97557 7903490: JMH: The interrupt to time-outing benchmark can be delivered to work...
• bf8db38 7903487: JMH: Make sure JMH profilers work on all tested configurations
• Additional commits viewable in compare view

Updates biz.aQute.bnd.builder from 7.1.0 to 7.4.0

Release notes

Sourced from biz.aQute.bnd.builder's releases.

Bnd/Bndtools 7.4.0

See Release Notes

What's Changed

• Remove long-running test from ci server build by @​peterkir in bndtools/bnd#7222
• CI build output improvement by @​peterkir in bndtools/bnd#7223
• build(deps): bump ruby/setup-ruby from 1.306.0 to 1.307.0 by @​dependabot[bot] in bndtools/bnd#7227
• build(deps): bump step-security/harden-runner from 2.19.0 to 2.19.2 by @​dependabot[bot] in bndtools/bnd#7230
• build(deps): bump github/codeql-action from 4.35.2 to 4.36.0 by @​dependabot[bot] in bndtools/bnd#7246
• build(deps): bump step-security/harden-runner from 2.19.2 to 2.19.4 by @​dependabot[bot] in bndtools/bnd#7245
• Create SECURITY.md for bnd security documentation by @​chrisrueger in bndtools/bnd#7243
• build(deps): bump ruby/setup-ruby from 1.307.0 to 1.310.0 by @​dependabot[bot] in bndtools/bnd#7240
• build(deps): bump jekyll-seo-tag from 2.8.0 to 2.9.0 in /docs by @​dependabot[bot] in bndtools/bnd#7225
• Allow overriding HTTPClient request headers by @​chrisrueger in bndtools/bnd#7247
• docs: update generated docs by @​github-actions[bot] in bndtools/bnd#7248
• Set explicit headers before defaults and refine logging by @​chrisrueger in bndtools/bnd#7249
• Cooldowns for Dependabot updates by @​chrisrueger in bndtools/bnd#7250
• build(deps): bump org.apache.maven.plugins:maven-invoker-plugin from 3.10.0 to 3.10.1 in /maven-plugins by @​dependabot[bot] in bndtools/bnd#7219
• build(deps-dev): bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 in /maven-plugins by @​dependabot[bot] in bndtools/bnd#7251
• Surface Sonatype deployment IDs in CI Job Summary and workflow outputs by @​peterkir with @​Copilot in bndtools/bnd#7252
• Stabilize SonatypeDeploymentTest deployment ID discovery across CI by @​peterkir with @​Copilot in bndtools/bnd#7254
• Use PAT_WORKSPACE_REPO for create-workspace-template git auth by @​peterkir with @​Copilot in bndtools/bnd#7253
• Readme: Update Bnd Maven and Gradle plugin versions to 7.3.0 by @​chrisrueger in bndtools/bnd#7258
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in bndtools/bnd#7256
• build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @​dependabot[bot] in bndtools/bnd#7244
• build(deps): bump github/codeql-action from 4.36.0 to 4.36.1 by @​dependabot[bot] in bndtools/bnd#7257
• Bndtools Explorer Quick Links addition - Existing Bnd Workspace by @​peterkir in bndtools/bnd#7259
• Update baseline version to 7.3.0 by @​chrisrueger in bndtools/bnd#7260
• build(deps): bump github/codeql-action from 4.36.1 to 4.36.2 by @​dependabot[bot] in bndtools/bnd#7261
• Add sync baseline version step in postrelease workflow by @​chrisrueger in bndtools/bnd#7263
• Post release 7.3.0 by @​github-actions[bot] in bndtools/bnd#7266
• [maven][resolve] Provide a better logging experience for maven users when resolving by @​timothyjward in bndtools/bnd#7255
• build(deps): bump gradle/actions from 6.1.0 to 6.2.0 by @​dependabot[bot] in bndtools/bnd#7272
• build(deps): bump ruby/setup-ruby from 1.310.0 to 1.313.0 by @​dependabot[bot] in bndtools/bnd#7271
• build(deps): bump actions/setup-java from 5.2.0 to 5.3.0 by @​dependabot[bot] in bndtools/bnd#7273
• build(deps): bump concurrent-ruby from 1.3.6 to 1.3.7 in /docs by @​dependabot[bot] in bndtools/bnd#7278
• build(deps): bump ruby/setup-ruby from 1.313.0 to 1.314.0 by @​dependabot[bot] in bndtools/bnd#7282
• Persist and manage workspace template fragment indexes by @​maho7791 in bndtools/bnd#7284
• Fix IllegalArgumentException for Maven-style SNAPSHOT versions in PomResource by @​peterkir with @​Copilot in bndtools/bnd#7286
• Add repo deps command to export Maven GAVs for dash-licenses by @​juergen-albert in bndtools/bnd#7275
• docs: update generated docs by @​github-actions[bot] in bndtools/bnd#7287
• fix IndexOutOfBoundsException by @​chrisrueger in bndtools/bnd#7291
• fixing issue #7124 by @​peterkir in bndtools/bnd#7292
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in bndtools/bnd#7277
• build(deps): bump actions/setup-java from 5.3.0 to 5.4.0 by @​dependabot[bot] in bndtools/bnd#7295
• Exclude Eclipse features from P2 Repo .versions() by @​chrisrueger in bndtools/bnd#7296
• build(deps): bump ruby/setup-ruby from 1.314.0 to 1.315.0 by @​dependabot[bot] in bndtools/bnd#7299
• build(deps): bump ruby/setup-ruby from 1.315.0 to 1.316.0 by @​dependabot[bot] in bndtools/bnd#7301
• [Security] Maven Repositories: Add Trusted Checksum Verification by @​chrisrueger in bndtools/bnd#7269
• Fix NPE in RepoCollector initialization during Project construction by @​chrisrueger in bndtools/bnd#7304

... (truncated)

Commits

• 2046c36 build: Build Release 7.4.0
• aab8519 build: Build Release 7.4.0.RC3
• 606a199 build: Build Release 7.4.0.RC2
• afdf547 missing files
• 9074a7a build: Build Release 7.4.0.RC1
• b5c4c58 Revert "Eclipse feature support for buildpath"
• 4fd8e4a Eclipse feature support for buildpath
• a6ba530 Merge pull request #7336 from chrisrueger/7214-fix-deadlock-junit-tee
• 0fda33a Fix thread-safety in Tee class
• 061b7fd Merge pull request #7325 from bndtools/dependabot/github_actions/actions/chec...
• Additional commits viewable in compare view

Updates com.yubico.yubikit:openpgp from 3.1.0 to 3.2.1

Release notes

Sourced from com.yubico.yubikit:openpgp's releases.

YubiKit 3.2.1

A patch release with correctness and robustness fixes across fido, core and piv.

Fixes:

• fido module:
  • Decode COSE EC2 coordinates as unsigned (#362)
  • Made Ctap2Session.InfoData.getFirmwareVersion() public (#357)
• core module:
  • Bound TLV and CBOR parsing before allocating (#368)
  • Replaced the SLF4J fluent API with isXEnabled()-guarded calls, which crashed apps declaring minSdk < 24 (#366)
• piv module:
  • Fix RSA keys throwing IncompatibleClassChangeError on Java 24+
• fido-android-ui module:
  • Reuse isFormValid in the PIN submit guard (#367)
• test infrastructure:
  • The instrumented test APK installs on API 21 again (#365)
  • Test-run failures are no longer silent (#363, #364)
• build system:
  • Updated dependencies and pinned GitHub Actions to full commit SHAs (#370)

Improvements:

• fido module:
  • Build CTAP1 authenticator data without ByteBuffer.rewind()
• build system:
  • Pinned AGP to 9.3.2

Full Changelog: 3.2.0...3.2.1

YubiKit 3.2.0

This release focuses on the fido-android-ui module — a responsive UI redesign with adaptive layouts, NFC antenna hints, and screen-capture protection — along with WebAuthn extension and spec-compliance fixes and build tooling updates.

New in this release:

• fido-android-ui module:
  • Redesigned UI with adaptive layouts across portrait, landscape and full-screen presentations, including refreshed screens, titles/subtitles and PIN forms, and clearer display of the requesting app label and RP name / rpId (#330)
  • Added public NfcAntennaHint composable and supportsNfcAntennaHint() to display the device's physical NFC antenna locations (API 34+) (#330)
  • Apply FLAG_SECURE in non-debug builds and hide overlay windows during FIDO operations (#330)
  • Surface terminal extension errors in the UI (#344)
  • Hardened UI lifecycle: keep result on late key removal, prevent result-delivery races, guard continuation resume on cancel, handle NFC tag-lost, and preserve PIN input across rotation (#330)
  • Consistent "security key" terminology, clarified PIN-required policy, and landscape insets / orientation handling (#330)
• fido module:
  • Pre-validate WebAuthn extension inputs (#344)
  • Aligned WebAuthn extension errors to the spec, classify hard failures, and isolate client extension failures (#339, #344)
  • Respect uv=discouraged for non-discoverable / non-resident-key credentials (#330, #334)
  • Use callingApp origin in native clientData (#330)
• management module:
  • Read DeviceInfo pages by TAG_MORE_DATA count (#338)
• core module:
  • Use getProductId in USB device filter (#327)
• build system:
  • Upgraded to AGP 9.2.1 (#330)

... (truncated)

Changelog

Sourced from com.yubico.yubikit:openpgp's changelog.

• Version 3.2.1 (released 2026-09-08) ** fixes & improvements:
  • fido: decode COSE EC2 coordinates as unsigned
  • fido: made Ctap2Session.InfoData.getFirmwareVersion() public
  • core: bound TLV and CBOR parsing before allocating
  • core: replaced the SLF4J fluent API with isXEnabled()-guarded calls
  • piv: fix key params on Java 24+
  • fido-ui: reuse isFormValid in the PIN submit guard
  • testing: instrumented test APK installs on API 21 again
  • build: updated dependencies and pinned GitHub Actions to full commit SHAs
• Version 3.2.0 (released 2026-07-07) ** new:
  • fido-ui: new UI host with support for adaptive layouts, adjusting across phone portrait, landscape and full-screen presentations; screens now show the requesting app label and emphasize the RP name / rpId, with refreshed titles, subtitles and PIN forms
  • fido-ui: surface terminal extension errors in the UI
  • fido-ui: added public NfcAntennaHint API and supportsNfcAntennaHint() to detect and hint antenna location
  • fido-ui: apply FLAG_SECURE in non-debug builds and HIDE_OVERLAY_WINDOWS on the FIDO UI activity
  • fido: pre-validate WebAuthn extension inputs
  • management: read DeviceInfo pages by TAG_MORE_DATA count ** fixes & improvements:
  • fido: aligned WebAuthn extension errors to the spec, classify hard failures and isolate client extension failures
  • fido: respect uv=discouraged for non-discoverable / non-resident-key credentials
  • fido: use callingApp origin in native clientData
  • fido-ui: hardened UI lifecycle — keep result on late key removal, prevent result-delivery races, guard continuation resume on cancel, handle NFC tag-lost, and preserve PIN input across rotation
  • fido-ui: consistent "security key" terminology, clarified PIN-required policy, and landscape insets / orientation handling
  • core: use getProductId in USB device filter
  • build: upgraded to AGP 9.2.1, compileSdk/targetSdk 37, ktlint 1.8.0
  • build: updated dependencies and pinned GitHub Actions to latest versions

Commits

• ab641da chore: update NEWS
• 0346972 build: pin AGP to 9.3.2
• e960373 fix(fido): build authData without rewind()
• e33be87 fix(piv): declare getParams() for Java 24+
• 868884d chore: bump version to 3.2.1
• d290526 Merge PR #362
• 2c3f677 doc(fido): streamline COSE comments
• fafe2fe Merge PR #368
• 2edfc59 Merge PR #370
• 93a0a98 Merge PR #367
• Additional commits viewable in compare view

Updates com.yubico.yubikit:desktop from 3.1.0 to 3.2.1

Release notes

Sourced from com.yubico.yubikit:desktop's releases.

YubiKit 3.2.1

A patch release with correctness and robustness fixes across fido, core and piv.

Fixes:

• fido module:
  • Decode COSE EC2 coordinates as unsigned (#362)
  • Made Ctap2Session.InfoData.getFirmwareVersion() public (#357)
• core module:
  • Bound TLV and CBOR parsing before allocating (#368)
  • Replaced the SLF4J fluent API with isXEnabled()-guarded calls, which crashed apps declaring minSdk < 24 (#366)
• piv module:
  • Fix RSA keys throwing IncompatibleClassChangeError on Java 24+
• fido-android-ui module:
  • Reuse isFormValid in the PIN submit guard (#367)
• test infrastructure:
  • The instrumented test APK installs on API 21 again (#365)
  • Test-run failures are no longer silent (#363, #364)
• build system:
  • Updated dependencies and pinned GitHub Actions to full commit SHAs (#370)

Improvements:

• fido module:
  • Build CTAP1 authenticator data without ByteBuffer.rewind()
• build system:
  • Pinned AGP to 9.3.2

Full Changelog: 3.2.0...3.2.1

YubiKit 3.2.0

This release focuses on the fido-android-ui module — a responsive UI redesign with adaptive layouts, NFC antenna hints, and screen-capture protection — along with WebAuthn extension and spec-compliance fixes and build tooling updates.

New in this release:

• fido-android-ui module:
  • Redesigned UI with adaptive layouts across portrait, landscape and full-screen presentations, including refreshed screens, titles/subtitles and PIN forms, and clearer display of the requesting app label and RP name / rpId (#330)
  • Added public NfcAntennaHint composable and supportsNfcAntennaHint() to display the device's physical NFC antenna locations (API 34+) (#330)
  • Apply FLAG_SECURE in non-debug builds and hide overlay windows during FIDO operations (#330)
  • Surface terminal extension errors in the UI (#344)
  • Hardened UI lifecycle: keep result on late key removal, prevent result-delivery races, guard continuation resume on cancel, handle NFC tag-lost, and preserve PIN input across rotation (#330)
  • Consistent "security key" terminology, clarified PIN-required policy, and landscape insets / orientation handling (#330)
• fido module:
  • Pre-validate WebAuthn extension inputs (#344)
  • Aligned WebAuthn extension errors to the spec, classify hard failures, and isolate client extension failures (#339, #344)
  • Respect uv=discouraged for non-discoverable / non-resident-key credentials (#330, #334)
  • Use callingApp origin in native clientData (#330)
• management module:
  • Read DeviceInfo pages by TAG_MORE_DATA count (#338)
• core module:
  • Use getProductId in USB device filter (#327)
• build system:
  • Upgraded to AGP 9.2.1 (#330)

... (truncated)

Changelog

Sourced from com.yubico.yubikit:desktop's changelog.

• Version 3.2.1 (released 2026-09-08) ** fixes & improvements:
  • fido: decode COSE EC2 coordinates as unsigned
  • fido: made Ctap2Session.InfoData.getFirmwareVersion() public
  • core: bound TLV and CBOR parsing before allocating
  • core: replaced the SLF4J fluent API with isXEnabled()-guarded calls
  • piv: fix key params on Java 24+
  • fido-ui: reuse isFormValid in the PIN submit guard
  • testing: instrumented test APK installs on API 21 again
  • build: updated dependencies and pinned GitHub Actions to full commit SHAs
• Version 3.2.0 (released 2026-07-07) ** new:
  • fido-ui: new UI host with support for adaptive layouts, adjusting across phone portrait, landscape and full-screen presentations; screens now show the requesting app label and emphasize the RP name / rpId, with refreshed titles, subtitles and PIN forms
  • fido-ui: surface terminal extension errors in the UI
  • fido-ui: added public NfcAntennaHint API and supportsNfcAntennaHint() to detect and hint antenna location
  • fido-ui: apply FLAG_SECURE in non-debug builds and HIDE_OVERLAY_WINDOWS on the FIDO UI activity
  • fido: pre-validate WebAuthn extension inputs
  • management: read DeviceInfo pages by TAG_MORE_DATA count ** fixes & improvements:
  • fido: aligned WebAuthn extension errors to the spec, classify hard failures and isolate client extension failures
  • fido: respect uv=discouraged for non-discoverable / non-resident-key credentials
  • fido: use callingApp origin in native clientData
  • fido-ui: hardened UI lifecycle — keep result on late key removal, prevent result-delivery races, guard continuation resume on cancel, handle NFC tag-lost, and preserve PIN input across rotation
  • fido-ui: consistent "security key" terminology, clarified PIN-required policy, and landscape insets / orientation handling
  • core: use getProductId in USB device filter
  • build: upgraded to AGP 9.2.1, compileSdk/targetSdk 37, ktlint 1.8.0
  • build: updated dependencies and pinned GitHub Actions to latest versions

Commits

• ab641da chore: update NEWS
• 0346972 build: pin AGP to 9.3.2
• e960373 fix(fido): build authData without rewind()
• e33be87 fix(piv): declare getParams() for Java 24+
• 868884d chore: bump version to 3.2.1
• d290526 Merge PR #362
• 2c3f677 doc(fido): streamline COSE comments
• fafe2fe Merge PR #368
• 2edfc59 Merge PR #370
• 93a0a98 Merge PR #367
• Additional commits viewable in compare view

Updates javax.mail:mail from 1.4 to 1.4.7

Updates jakarta.mail:jakarta.mail-api from 2.0.1 to 2.1.5

Release notes

Sourced from jakarta.mail:jakarta.mail-api's releases.

Jakarta Mail 2.1.5 Final Release

The 2.1.5 release is a bug fix release of 2.1.x (Jakarta EE 10).

Following changes are included:

• jakartaee/mail-api#752: Inconsistent MailMessage contentId property
• jakartaee/mail-api#789: Only one META-INF/javamail.providers resource file is processed

Full Changelog: jakartaee/mail-api@2.1.4...2.1.5

Jakarta Mail 2.1.4 Final Release

The 2.1.4 release is a bug fix release of 2.1.x (Jakarta EE 10).

Following changes are included:

• jakartaee/mail-api#777: services/jakarta.mail.Provider override not working
• jakartaee/mail-api#699: Multipart performs blocking call in every instantiation
• jakartaee/mail-api#527: Using Jakarta mail and Javamail in the same runtime

Full Changelog: jakartaee/mail-api@2.1.3...2.1.4

Jakarta Mail 2.1.3 Final Release

The 2.1.3 release is a bug fix release of 2.1.x (Jakarta EE 10).

Following changes are included:

• jakartaee/mail-api#631: Session.getService does not use proper classloader in OSGI environment
• jakartaee/mail-api#665: Jakarta Mail erroneously assumes that classes can be loaded from Thread#getContextClassLoader
• jakartaee/mail-api#694: SharedFileInputStream should comply with spec
• jakartaee/mail-api#710: Cannot parse messages without a session
• updates dependency on Jakarta Activation API jar to version