fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Confidence
azul/zulu-openjdk-alpine	final	digest	5ce0ca2 → f000a0c
capralifecycle/actions-lib	action	patch	v1.6.3 → v1.6.5
docker/build-push-action	action	minor	v6.18.0 → v6.19.2
postgres		minor	18.1 → 18.3
org.apache.maven.plugins:maven-failsafe-plugin (source)	build	patch	3.5.4 → 3.5.5
org.junit.jupiter:junit-jupiter-api (source)	test	patch	6.0.2 → 6.0.3
org.junit:junit-bom (source)	import	patch	6.0.2 → 6.0.3
io.kotest:kotest-assertions-core-jvm	test	patch	6.1.2 → 6.1.4
org.jetbrains:annotations	compile	minor	26.0.2-1 → 26.1.0
io.opentelemetry:opentelemetry-bom	import	minor	1.58.0 → 1.59.0
ch.qos.logback:logback-classic (source, changelog)	compile	patch	1.5.27 → 1.5.32
com.fasterxml.jackson:jackson-bom	import	patch	2.21.0 → 2.21.1
tools.jackson:jackson-bom	import	minor	3.0.4 → 3.1.0
software.amazon.awssdk:bom	import	minor	2.41.20 → 2.42.4	2.42.7 (+2)
org.postgresql:postgresql (source)	compile	patch	42.7.9 → 42.7.10
org.flywaydb:flyway-database-postgresql (source)	compile	patch	12.0.0 → 12.0.3
org.flywaydb:flyway-core (source)	compile	patch	12.0.0 → 12.0.3
org.http4k:http4k-bom (source)	import	minor	6.27.0.0 → 6.31.1.0
no.liflig:snapshot-test (source)	compile	minor	1.20260109.090621 → 1.20260301.100531
no.liflig:liflig-logging (source)	compile	minor	3.20260201.155950 → 3.20260301.090108
no.liflig:liflig-document-store (source)	compile	minor	3.20260101.075717 → 3.20260301.100538
no.liflig:liflig-http4k-setup (source)	compile	minor	5.20260101.074054 → 5.20260302.103727
no.liflig:properties	compile	minor	3.20260129.164010 → 3.20260301.095514
org.jetbrains.kotlin:kotlin-maven-serialization (source)	build	patch	2.3.0 → 2.3.10
org.jetbrains.kotlin:kotlin-bom (source)	import	patch	2.3.0 → 2.3.10
no.liflig:kotlin-parent	parent	minor	3.20260202.023230 → 3.20260226.000318	3.20260306.065405

---

Release Notes

capralifecycle/actions-lib (capralifecycle/actions-lib)

v1.6.5

Compare Source

Bug Fixes

• use correct org reference in renovate config (971e49a)

v1.6.4

Compare Source

Bug Fixes

• deps: resolve tar arbitrary file read/write vulnerability (0d1b5c5)

docker/build-push-action (docker/build-push-action)

v6.19.2

Compare Source

• Preserve port in GIT_AUTH_TOKEN host by @​crazy-max in #​1458

Full Changelog: docker/build-push-action@v6.19.1...v6.19.2

v6.19.1

Compare Source

• Derive GIT_AUTH_TOKEN host from GitHub server URL by @​crazy-max in #​1456

Full Changelog: docker/build-push-action@v6.19.0...v6.19.1

v6.19.0

Compare Source

• Scope default git auth token to github.com by @​crazy-max in #​1451
• Bump brace-expansion from 1.1.11 to 1.1.12 in #​1396
• Bump form-data from 2.5.1 to 2.5.5 in #​1391
• Bump js-yaml from 3.14.1 to 3.14.2 in #​1429
• Bump lodash from 4.17.21 to 4.17.23 in #​1446
• Bump tmp from 0.2.3 to 0.2.4 in #​1398
• Bump undici from 5.28.4 to 5.29.0 in #​1397

Full Changelog: docker/build-push-action@v6.18.0...v6.19.0

kotest/kotest (io.kotest:kotest-assertions-core-jvm)

v6.1.4

Compare Source

v6.1.3

Compare Source

What's Changed

• clean-up-unused-class-PossibleMatch by @​AlexCue987 in #​5638
• document-shouldContainInOrder (#​5640) by @​AlexCue987 in #​5641
• Restore method removed in 6.1 by @​sksamuel in #​5645
• Filter out abstract classes if passed to the engine by @​sksamuel in #​5646
• Add Android instrumentation support to the Intellij plugin by @​sksamuel in #​5647
• add shouldContainInOrderWithoutOverlaps by @​AlexCue987 in #​5649
• Fix hangs with nested runTest by @​sksamuel in #​5655
• Flatten nested test output in TeamCity for Native by @​sksamuel in #​5643
• Add option to gradle plugin to configure power assert by @​sksamuel in #​5657
• Adding forAll functions for rows with 11 to 22 elements by @​NersesAM in #​5661
• Add JUnit Jupiter test module for backwards compatibility by @​sksamuel in #​5664
• Fix source ref lookup for data tests by @​sksamuel in #​5663
• SpringExtension now supports test class inheritance by @​rei-paypay in #​5667

New Contributors

• @​NersesAM made their first contribution in #​5661
• @​rei-paypay made their first contribution in #​5667

Full Changelog: kotest/kotest@v6.1.2...v6.1.3

JetBrains/java-annotations (org.jetbrains:annotations)

v26.1.0

Compare Source

• @NotNullByDefault is not experimental anymore.

open-telemetry/opentelemetry-java (io.opentelemetry:opentelemetry-bom)

v1.59.0

API

• Stabilize complex attributes
  (#​7973)
• Limit init valid hex array to range that can be true
  (#​7809)

Extensions

• Trace propagators: Deprecate OtTracePropagator
  (#​8020)
• Trace propagators: Deprecate JaegerPropagator
  (#​8019)

SDK

• Move io.opentelemetry.sdk.internal to io.opentelemetry.sdk.common.internal
  (#​8003)
• Always return ExtendedOpenTelemetry when incubator is available
  (#​7991)

Traces

• Fix memory leak in SdkSpan#spanEndingThread
  (#​7984)

Metrics

• Rework and publish metric benchmarks
  (#​8000)
• Update LongLastValueAggregator algo to avoid allocations
  (#​8017)

Testing

• Fix OTel JUnit5 Extension cleanup when using Nested test classes
  (#​7999)
• Add assertion support for Span hasException(null)
  (#​8033)

Exporters

• DEPRECATION: opentelemetry-exporter-zipkin is now deprecated with the
  last release planned for 1.65.0 (August 2026)
  (#​7974)
• Refactor http, grpc senders and promote to public API
  (#​7782)

Extensions

• Jaeger remote sampler: Remove unused code
  (#​7970)
• Incubator: Add AlwaysRecordSampler
  (#​7877)

Project tooling

• Align generate release contributors
  (#​8023)

pgjdbc/pgjdbc (org.postgresql:postgresql)

v42.7.10

Changed

• chore: Migrate to Shadow 9 PR 3931
• style: fix empty line before javadoc for checkstyle compliance PR #​3925
• style: fix lambda argument indentation for checkstyle compliance PR #​3922
• test: add autosave=always|never|conservative and cleanupSavepoints=true|false to the randomized CI jobs PR #​3917

Fixed

• fix: non-standard strings failing test for version 19 PR #​3934
• fix: small issues in ConnectionFactoryImpl PR #​3929
• fix: process pending responses before fastpath to avoid protocol errors PR # 3913
• doc: use.md, fix typos PR #​3911
• doc: datasource.md, fix minor formatting issue PR #​3912
• doc: add the new PGP signing key to the official documentation PR #​3912

Reverted

• Revert "fix: make all Calendar instances proleptic Gregorian (#​3837) (#​3887)" PR #​3932

flyway/flyway (org.flywaydb:flyway-database-postgresql)

v12.0.2

v12.0.1

http4k/http4k (org.http4k:http4k-bom)

v6.31.1.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-mcp-sdk: [Fix] Add missing ToolUseId type to MCP JSON

v6.31.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-core: [Unlikely break] Header lenses now strip quotes from header values (RFC 2045). H/T @​andy-barlow
• http4k-multipart: [Unlikely break] Default to using application/octet-stream for unknown content types. H/T @​andy-barlow
• http4k-ai-mcp-sdk: Add convenience function asServer() to convert any singular ServerCapability into a server

v6.30.1.0

Compare Source

• http4k-*: Upgrade versions
• http4k-testing-webdriver: [Fix] Respect the formaction and formmethod of the used submit input H/T @​tamj0rd2
• http4k-ai-mcp-testing: Fixed test MCP Apps host to accept non-string arguments from hosted app.
• http4k-ai-mcp-testing: Honour CSP headers when running MCP Apps host.

v6.30.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-mcp-sdk: [Breaking] Adding support for serverside OpenTelemetry Conventions MCP spans. API changes to allow for this change.

v6.29.0.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-mcp-client: [Breaking] Alteration to ToolResponse.Error to have content instead of just a string
• http4k-ai-mcp-sdk: [Breaking] Alteration to ToolResponse.Error to have content instead of just a string
• http4k-ops-opentelemetry: Added SSE filters to capture OTel traces
• http4k-ops-opentelemetry: Add support for OpenTelemetry Semantic Conventions (1.38.0)

v6.28.1.0

Compare Source

• http4k-*: Upgrade versions
• http4k-ai-mcp-testing: Remove unnecessary dependencies, various fixes to the MCP App test host

v6.28.0.0

Compare Source

• http4k-*: Upgrade versions, including Kotlin to 2.3.10
• http4k-ai-mcp-sdk: [Pro: Breaking] - Update MCP SDK to support latest MCP specification (2025-11-25), including support for Tasks, expanded Tool support,
  URL Form Elicitations and Sampling upgrades. Plus conformance updates to the latest MCP conformance tests. Also support for MCP Apps spec, allowing UIs to be
  usable inside Claude Code and friends. Small tweaks to the API surface which should be simple to fix.
• http4k-ai-mcp-client: [Pro: Breaking] - Updated client to support MCP 2025-11-25 features.
• http4k-ai-mcp-testing: [Pro: New module!] - Clients for testing MCP servers and a basic MCP Apps host to test out MCP Apps (UIs which can live in Claude
  and co)

capralifecycle/snapshot-test (no.liflig:snapshot-test)

v1.20260301.100531

Compare Source

capralifecycle/liflig-logging (no.liflig:liflig-logging)

v3.20260301.090108

Compare Source

v3.20260204.135728

Compare Source

v3.20260204.125822

Compare Source

capralifecycle/liflig-document-store (no.liflig:liflig-document-store)

v3.20260301.100538

Compare Source

capralifecycle/liflig-http4k-setup (no.liflig:liflig-http4k-setup)

v5.20260302.103727

Compare Source

v5.20260301.090218

Compare Source

capralifecycle/liflig-properties (no.liflig:properties)

v3.20260301.095514

Compare Source

v3.20260220.131704

Compare Source

JetBrains/kotlin (org.jetbrains.kotlin:kotlin-maven-serialization)

v2.3.10

Compare Source

Compiler

• KT-83984 Data races around kotlinx.serialization plugin protobuf extensions registration
• KT-83317 ClassCastException: with cast kotlin.UInt to java.lang.Number when defining constant
• KT-83031 K2: unstable resolution of EnhancedNullability from type-use NotNull in presence of unused code
• KT-81700 flaky overload resolution behaviors (false-positive errors, different final candidates, compile-time failures)
• KT-83983 Revert of KT-83081
• KT-83314 JSpecify @NullMarked changes Java equals(Object) to equals(Any?) causing override conflict in Kotlin 2.3
• KT-82863 @NoInfer regression since 2.2.20
• KT-82841 "kotlin.NoWhenBranchMatchedException" in when with !is check & non-sealed class in the middle of hierarchy

JVM. Reflection

• KT-83608 Kotlin-reflect: "Unknown origin of public abstract operator fun invoke(p1: P1, p2: P2): R"
• KT-83361 "KotlinReflectionInternalError: Type parameter not found: 0" on super types with Kotlin 2.3.0
• KT-42199 "KotlinReflectionInternalError: Unknown origin of public abstract operator fun invoke" on function reference to FunctionN.invoke
• KT-81024 Reflection: New KType implementation fails on arguments comparison for a Nothing type parameter

Tools. Compiler Plugins

• KT-83266 "Unsupported class file major version 69" for "produceReleaseComposeMapping" task with Kotlin 2.3
• KT-83099 Compose compiler does not generate stack trace mappings for project files

Tools. Gradle

• KT-83070 The KGP api reference is missing a description
• KT-82459 Improve iOS simulator boot implementation

Tools. Gradle. JS

• KT-82946 Js, Wasm: Upgrade NPM dependencies

Tools. Gradle. Multiplatform

• KT-83687 Revert deprecation of 'androidTarget' for AGP lower than 9

capralifecycle/liflig-kotlin-parent (no.liflig:kotlin-parent)

v3.20260226.000318

Compare Source

v3.20260221.141123

Compare Source

v3.20260220.192943

Compare Source

v3.20260207.220851

Compare Source

---

Configuration

📅 Schedule: Branch creation - Between 05:00 AM and 01:59 PM, only on Friday ( * 5-13 * * 5 ) in timezone Europe/Oslo, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

---

• Branch has one or more failed status checks