Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.
[View this repository on the Mend.io Web Portal](https://developer.mend.io/github/apache/sling-org-apache-sling-starter).

## Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

- [ ] chore(deps): update mongodb java driver to v5.7.1 (`org.mongodb:bson`, `org.mongodb:mongodb-driver-core`, `org.mongodb:mongodb-driver-sync`)
- [ ] chore(deps): update mongodb java driver to v5.8.1 (`org.mongodb:bson`, `org.mongodb:mongodb-driver-core`, `org.mongodb:mongodb-driver-sync`)
- [ ] chore(deps): update mongodb java driver to v5.9.2 (`org.mongodb:bson`, `org.mongodb:mongodb-driver-core`, `org.mongodb:mongodb-driver-sync`)
- [ ] chore(deps): update mongodb java driver to v5.10.0 (`org.mongodb:bson`, `org.mongodb:mongodb-driver-core`, `org.mongodb:mongodb-driver-sync`)
- [ ] chore(deps): update mongodb java driver to v5.11.1 (`org.mongodb:bson`, `org.mongodb:mongodb-driver-core`, `org.mongodb:mongodb-driver-sync`)
- [ ] chore(deps): update actions/setup-java action to v6
- [ ] 🔐 **Create all rate-limited PRs at once** 🔐

## PR Edited (Blocked)

The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below.

- [ ] [chore(deps): update apache pdfbox to v3](../pull/212) (`org.apache.pdfbox:fontbox`, `org.apache.pdfbox:pdfbox`)

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [chore(deps): update dependency org.apache.sling:org.apache.sling.resourceresolver to v2.0.6](../pull/666)
- [ ] [chore(deps): update dependency com.h2database:h2-mvstore to v2.5.250](../pull/678)
- [ ] [chore(deps): update dependency org.antlr:antlr4-runtime to v4.13.2](../pull/143)
- [ ] [chore(deps): update mongodb java driver to v5.4.0](../pull/674) (`org.mongodb:bson`, `org.mongodb:mongodb-driver-core`, `org.mongodb:mongodb-driver-sync`)
- [ ] [chore(deps): update mongodb java driver to v5.5.2](../pull/679) (`org.mongodb:bson`, `org.mongodb:mongodb-driver-core`, `org.mongodb:mongodb-driver-sync`)
- [ ] [chore(deps): update mongodb java driver to v5.6.5](../pull/680) (`org.mongodb:bson`, `org.mongodb:mongodb-driver-core`, `org.mongodb:mongodb-driver-sync`)
- [ ] [chore(deps): update apache tika to v4](../pull/398) (`org.apache.tika:tika-core`, `org.apache.tika:tika-parsers`)
- [ ] [chore(deps): update dependency io.dropwizard.metrics:metrics-core to v4](../pull/149)
- [ ] [chore(deps): update dependency org.jvnet.staxex:stax-ex to v2](../pull/158)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

- [ ] [chore(deps): update dependency org.apache.sling:org.apache.sling.xss to v2.4.10](../pull/583)

## Detected Dependencies

docker-compose (2)

docker/docker-compose-mongodb.yaml (1)

- `mongo 3.7` → [Updates: `8.3`]

docker/docker-compose-tar.yaml

dockerfile (1)

Dockerfile (1)

- `docker.io/eclipse-temurin 21` → [Updates: `26`]

github-actions (3)

.github/workflows/allowlist-check.yml (1)

- `apache/infrastructure-actions main`

.github/workflows/docker-push.yml (2)

- `actions/checkout v7`
- `actions/setup-java v5` → [Updates: `v6`]

.github/workflows/docker-release.yml (2)

- `actions/checkout v7`
- `actions/setup-java v5` → [Updates: `v6`]

maven (1)

pom.xml (9)

- `org.apache.sling:sling 66`
- `org.apache.httpcomponents:httpclient 4.5.14`
- `org.apache.felix:org.apache.felix.utils 1.11.8`
- `org.apache.sling:org.apache.sling.starter.integration-tests 15-SNAPSHOT`
- `org.apache.sling:slingfeature-maven-plugin 1.9.6`
- `org.apache.sling:org.apache.sling.feature.launcher 1.3.6`
- `biz.aQute.bnd:bnd-indexer-maven-plugin 7.4.0`
- `io.fabric8:docker-maven-plugin 0.49.0`
- `org.apache.sling:feature-launcher-maven-plugin 1.0.4`

osgi (18)

src/main/features/app/composum.json

src/main/features/app/htl_repl.json (1)

- `org.apache.sling:org.apache.sling.scripting.sightly.repl 1.0.10`

src/main/features/app/slingshot.json (1)

- `org.apache.sling:org.apache.sling.sample.slingshot 0.9.0`

src/main/features/app/starter.json (1)

- `org.apache.sling:org.apache.sling.starter.content 2.0.2`

src/main/features/base.json (61)

- `org.owasp.encoder:encoder 1.4.0`
- `commons-codec:commons-codec 1.22.1`
- `commons-collections:commons-collections 3.2.2`
- `javax.mail:mail 1.5.0-b01`
- `org.apache.commons:commons-collections4 4.6.0`
- `com.fasterxml.woodstox:woodstox-core 7.2.2`
- `com.fasterxml.jackson.core:jackson-annotations 2.22`
- `org.apache.commons:commons-math3 3.6.1`
- `org.apache.geronimo.bundles:jstl 1.2_1`
- `org.apache.httpcomponents:httpclient-osgi 4.5.14`
- `org.apache.httpcomponents:httpcore-osgi 4.4.16`
- `org.apache.sling:org.apache.sling.adapter 3.0.0`
- `org.apache.sling:org.apache.sling.auth.form 2.0.0`
- `org.apache.sling:org.apache.sling.bundleresource.impl 3.0.0`
- `org.apache.sling:org.apache.sling.commons.classloader 1.4.4`
- `org.apache.sling:org.apache.sling.commons.compiler 2.4.0`
- `org.apache.sling:org.apache.sling.commons.fsclassloader 2.0.0`
- `org.apache.sling:org.apache.sling.commons.mime 3.0.0`
- `org.apache.sling:org.apache.sling.commons.scheduler 2.7.14`
- `org.apache.sling:org.apache.sling.commons.threads 3.3.0`
- `org.apache.sling:org.apache.sling.engine 3.0.2`
- `org.apache.sling:org.apache.sling.fsresource 2.3.0`
- `org.apache.sling:org.apache.sling.i18n 3.0.0`
- `org.apache.sling:org.apache.sling.installer.factory.packages 1.0.4`
- `org.apache.sling:org.apache.sling.installer.hc 2.1.0`
- `org.apache.sling:org.apache.sling.models.api 2.0.0`
- `org.apache.sling:org.apache.sling.models.impl 2.0.2`
- `org.apache.sling:org.apache.sling.resourceresolver 2.0.4` → [Updates: `2.0.6`]
- `org.apache.sling:org.apache.sling.serviceusermapper 1.5.8`
- `org.apache.sling:org.apache.sling.servlets.get 3.0.0`
- `org.apache.sling:org.apache.sling.servlets.post 3.0.2`
- `org.apache.sling:org.apache.sling.servlets.resolver 3.0.10`
- `org.apache.sling:org.apache.sling.xss 2.4.8` → [Updates: `2.4.10`]
- `org.apache.felix:org.apache.felix.metatype 1.2.4`
- `commons-fileupload:commons-fileupload 1.6.0`
- `commons-io:commons-io 2.22.0`
- `org.apache.aries.jmx:org.apache.aries.jmx.mbeanserver-platform 0.0.1`
- `org.apache.aries.jmx:org.apache.aries.jmx.api 1.1.5`
- `org.apache.aries.jmx:org.apache.aries.jmx.core 1.1.8`
- `org.apache.aries.jmx:org.apache.aries.jmx.whiteboard 1.2.0`
- `org.apache.felix:org.apache.felix.bundlerepository 2.0.10`
- `org.apache.felix:org.apache.felix.http.jetty12 2.0.6`
- `org.apache.felix:org.apache.felix.http.whiteboard 4.0.0`
- `org.apache.felix:org.apache.felix.inventory 2.0.0`
- `org.apache.felix:org.apache.felix.prefs 1.1.0`
- `org.apache.sling:org.apache.sling.api 3.0.2`
- `org.apache.sling:org.apache.sling.auth.core 2.0.2`
- `org.apache.sling:org.apache.sling.extensions.threaddump 0.2.2`
- `io.dropwizard.metrics:metrics-core 3.2.6` → [Updates: `4.2.40`]
- `org.apache.sling:org.apache.sling.commons.metrics 2.0.0`
- `org.apache.felix:org.apache.felix.http.sslfilter 2.0.2`
- `org.apache.pdfbox:fontbox 2.0.37` → [Updates: `3.0.8`]
- `org.apache.pdfbox:jempbox 1.8.17`
- `org.apache.pdfbox:pdfbox 2.0.37` → [Updates: `3.0.8`]
- `org.apache.tika:tika-core 1.28.5` → [Updates: `4.0.0`]
- `org.apache.tika:tika-parsers 1.28.5` → [Updates: `4.0.0`]
- `org.apache.sling:org.apache.sling.resource.filter 1.0.2`
- `org.apache.sling:org.apache.sling.provisioning.model 1.8.6`
- `org.apache.sling:org.apache.sling.repoinit.parser 1.9.2`
- `org.apache.sling:org.apache.sling.jcr.repoinit 1.1.54`
- `org.apache.felix:org.apache.felix.framework 7.0.5`

src/main/features/boot.json (36)

- `org.apache.sling:org.apache.sling.jaxp-configurator 1.0.0`
- `org.apache.aries:org.apache.aries.util 2.0.0`
- `org.apache.commons:commons-text 1.15.0`
- `org.apache.commons:commons-lang3 3.20.0`
- `org.apache.felix:org.apache.felix.configadmin 1.9.26`
- `org.apache.felix:org.apache.felix.configadmin.plugin.interpolation 1.2.8`
- `org.apache.felix:org.apache.felix.eventadmin 1.6.4`
- `org.apache.felix:org.apache.felix.cm.json 2.0.8`
- `org.apache.geronimo.specs:geronimo-annotation_1.3_spec 1.3`
- `org.apache.geronimo.specs:geronimo-atinject_1.0_spec 1.2`
- `org.apache.geronimo.specs:geronimo-ws-metadata_2.0_spec 1.1.3`
- `org.apache.servicemix.bundles:org.apache.servicemix.bundles.jaxb-runtime 2.3.2_3`
- `org.apache.servicemix.bundles:org.apache.servicemix.bundles.saaj-impl 1.5.1_1`
- `org.apache.servicemix.specs:org.apache.servicemix.specs.jaxb-api-2.3 2.3_3`
- `org.apache.servicemix.specs:org.apache.servicemix.specs.jaxws-api-2.2 2.9.0`
- `org.apache.servicemix.specs:org.apache.servicemix.specs.saaj-api-1.3 2.9.0`
- `org.apache.sling:org.apache.sling.commons.log 6.2.0`
- `org.apache.sling:org.apache.sling.commons.logservice 1.1.2`
- `org.apache.felix:org.apache.felix.log 1.3.2`
- `org.apache.sling:org.apache.sling.commons.johnzon 2.0.0`
- `org.apache.sling:org.apache.sling.commons.osgi 2.4.2`
- `org.apache.sling:org.apache.sling.installer.core 3.14.6`
- `org.apache.felix:org.apache.felix.http.servlet-api 6.1.0`
- `org.apache.sling:org.apache.sling.installer.factory.configuration 2.0.0`
- `org.apache.sling:org.apache.sling.installer.provider.file 1.3.4`
- `org.apache.sling:org.apache.sling.javax.activation 0.3.0`
- `org.apache.sling:org.apache.sling.settings 1.5.0`
- `org.jvnet.staxex:stax-ex 1.8.3` → [Updates: `2.1.0`]
- `org.codehaus.woodstox:stax2-api 4.3.0`
- `org.osgi:org.osgi.service.component 1.5.1`
- `org.osgi:org.osgi.service.log 1.5.0`
- `org.osgi:org.osgi.util.function 1.2.0`
- `org.osgi:org.osgi.util.promise 1.3.0`
- `org.osgi:org.osgi.util.converter 1.0.9`
- `org.osgi:org.osgi.util.pushstream 1.1.0`
- `org.apache.felix:org.apache.felix.scr 2.2.18`

src/main/features/caconfig.json (4)

- `org.apache.sling:org.apache.sling.caconfig.api 1.3.0`
- `org.apache.sling:org.apache.sling.caconfig.impl 1.7.2`
- `org.apache.sling:org.apache.sling.caconfig.spi 1.4.0`
- `org.apache.sling:org.apache.sling.models.caconfig 1.0.2`

src/main/features/discovery.json (5)

- `org.apache.sling:org.apache.sling.discovery.api 1.0.6`
- `org.apache.sling:org.apache.sling.discovery.base 2.1.0`
- `org.apache.sling:org.apache.sling.discovery.commons 1.1.0`
- `org.apache.sling:org.apache.sling.discovery.oak 1.2.48`
- `org.apache.sling:org.apache.sling.discovery.support 1.0.8`

src/main/features/event.json (3)

- `org.apache.sling:org.apache.sling.event.dea 1.1.6`
- `org.apache.sling:org.apache.sling.event.api 1.0.4`
- `org.apache.sling:org.apache.sling.event 4.4.2`

src/main/features/groovy.json (1)

- `org.apache.aries.spifly:org.apache.aries.spifly.dynamic.bundle 1.3.7`

src/main/features/healthcheck.json (5)

- `org.apache.felix:org.apache.felix.healthcheck.api 2.0.4`
- `org.apache.felix:org.apache.felix.healthcheck.core 2.3.0`
- `org.apache.felix:org.apache.felix.healthcheck.generalchecks 3.0.8`
- `org.apache.sling:org.apache.sling.hc.api 1.0.4`
- `org.apache.sling:org.apache.sling.hc.support 1.0.10`

src/main/features/models-jacksonexporter.json (1)

- `org.apache.sling:org.apache.sling.models.jacksonexporter 2.0.0`

src/main/features/oak/oak_base.json (15)

- `org.apache.felix:org.apache.felix.jaas 1.0.2`
- `com.github.ben-manes.caffeine:caffeine 3.2.4`
- `org.apache.sling:org.apache.sling.jcr.api 2.4.2`
- `org.apache.sling:org.apache.sling.jcr.base 3.2.0`
- `org.apache.sling:org.apache.sling.jcr.davex 1.3.14`
- `org.apache.sling:org.apache.sling.jcr.jcr-wrapper 2.0.0`
- `org.apache.sling:org.apache.sling.jcr.registration 1.0.10`
- `org.apache.sling:org.apache.sling.jcr.webdav 2.3.10`
- `org.apache.sling:org.apache.sling.jcr.oak.server 1.4.4`
- `org.apache.sling:org.apache.sling.jcr.resource 3.3.6`
- `org.apache.sling:org.apache.sling.installer.provider.jcr 3.3.0`
- `org.apache.jackrabbit.vault:org.apache.jackrabbit.vault 4.2.0`
- `org.apache.sling:org.apache.sling.jcr.contentloader 3.0.0`
- `org.apache.sling:org.apache.sling.jcr.jackrabbit.accessmanager 5.0.0`
- `org.apache.sling:org.apache.sling.jcr.jackrabbit.usermanager 3.0.0`

src/main/features/oak/persistence/oak_persistence_mongods.json (4)

- `com.h2database:h2-mvstore 2.4.240` → [Updates: `2.5.250`]
- `org.mongodb:mongodb-driver-sync 5.3.1` → [Updates: `5.4.0`, `5.5.2`, `5.6.5`, `5.7.1`, `5.8.1`, `5.9.2`, `5.10.0`, `5.11.1`]
- `org.mongodb:bson 5.3.1` → [Updates: `5.4.0`, `5.5.2`, `5.6.5`, `5.7.1`, `5.8.1`, `5.9.2`, `5.10.0`, `5.11.1`]
- `org.mongodb:mongodb-driver-core 5.3.1` → [Updates: `5.4.0`, `5.5.2`, `5.6.5`, `5.7.1`, `5.8.1`, `5.9.2`, `5.10.0`, `5.11.1`]

src/main/features/oak/persistence/oak_persistence_sns.json

src/main/features/scripting.json (23)

- `org.antlr:antlr4-runtime 4.7.1` → [Updates: `4.13.2`]
- `org.apache.servicemix.bundles:org.apache.servicemix.bundles.rhino 1.7.15_1`
- `org.apache.sling:org.apache.sling.scripting.api 2.2.2`
- `org.apache.sling:org.apache.sling.scripting.spi 2.0.0`
- `org.apache.sling:org.apache.sling.scripting.core 3.0.2`
- `org.apache.sling:org.apache.sling.scripting.el-api 1.0.4`
- `org.apache.sling:org.apache.sling.scripting.javascript 3.1.6`
- `org.apache.sling:org.apache.sling.scripting.jsp-api 1.0.2`
- `org.apache.sling:org.apache.sling.scripting.jsp.taglib 2.4.2`
- `org.apache.sling:org.apache.sling.scripting.jsp 2.7.0`
- `org.apache.sling:org.apache.sling.scripting.sightly.compiler.java 1.2.2-1.4.0`
- `org.apache.sling:org.apache.sling.scripting.sightly.compiler 1.2.14-1.4.0`
- `org.apache.sling:org.apache.sling.scripting.sightly.js.provider 1.2.16`
- `org.apache.sling:org.apache.sling.scripting.sightly.runtime 1.2.6-1.4.0`
- `org.apache.sling:org.apache.sling.scripting.sightly 2.0.0-1.4.0`
- `org.apache.sling:org.apache.sling.scripting.freemarker 1.0.4`
- `org.freemarker:freemarker 2.3.35`
- `org.apache.sling:org.apache.sling.scripting.thymeleaf 2.0.2`
- `org.apache.servicemix.bundles:org.apache.servicemix.bundles.thymeleaf 3.1.2.RELEASE_1`
- `org.attoparser:attoparser 2.0.9.RELEASE`
- `org.unbescape:unbescape 1.1.6.RELEASE`
- `org.apache.servicemix.bundles:org.apache.servicemix.bundles.ognl 3.3.4_1`
- `org.javassist:javassist 3.33.0-GA`

src/main/features/validation.json (3)

- `org.apache.sling:org.apache.sling.models.validation-impl 1.1.0`
- `org.apache.sling:org.apache.sling.validation.api 1.0.2`
- `org.apache.sling:org.apache.sling.validation.core 1.0.4`

src/main/features/webconsole.json (15)

- `org.apache.felix:org.apache.felix.webconsole 5.0.18`
- `org.apache.felix:org.apache.felix.webconsole.plugins.ds 2.3.0`
- `org.apache.felix:org.apache.felix.webconsole.plugins.event 1.2.0`
- `org.apache.felix:org.apache.felix.webconsole.plugins.memoryusage 1.1.0`
- `org.apache.felix:org.apache.felix.webconsole.plugins.obr 1.1.0`
- `org.apache.felix:org.apache.felix.webconsole.plugins.packageadmin 1.1.0`
- `org.apache.sling:org.apache.sling.commons.log.webconsole 2.0.0`
- `org.apache.sling:org.apache.sling.extensions.webconsolebranding 1.0.4`
- `org.apache.felix:org.apache.felix.healthcheck.webconsoleplugin 2.2.0`
- `org.apache.felix:org.apache.felix.http.webconsoleplugin 1.2.2`
- `org.apache.felix:org.apache.felix.http.inventoryprinter 1.0.2`
- `org.apache.sling:org.apache.sling.extensions.webconsolesecurityprovider 2.0.0`
- `org.apache.sling:org.apache.sling.jcr.webconsole 1.1.0`
- `org.apache.sling:org.apache.sling.serviceuser.webconsole 2.0.0`
- `org.apache.sling:org.apache.sling.installer.console 2.0.0`

regex (1)

pom.xml (7)

- `org.ow2.asm:asm 9.10.1`
- `org.apache.jackrabbit:jackrabbit-jcr-commons 2.22.4`
- `org.apache.jackrabbit:oak-api 2.6.0`
- `org.slf4j:slf4j-api 2.0.19`
- `com.composum.nodes:composum-nodes-commons 4.3.5`
- `com.fasterxml.jackson.core:jackson-core 2.22.2`
- `org.codehaus.groovy:groovy 4.0.10`

---

- [ ] Check this box to trigger a request for Renovate to run again on this repository

Start with the Dependency Dashboard and review the dependency locations it names: pom.xml, Dockerfile, the Docker Compose file, GitHub Actions workflows, and the feature JSON files. Check the linked pull requests and rate-limited updates first; this issue is complete only when the intended dependency updates are handled and the relevant builds or workflows remain healthy.

Written by the indexing model from the issue text.