Updating External Dependencies - #49941
Open
jairmyree wants to merge 11 commits into
Open
Conversation
jairmyree
requested review from
a team,
JonathanGiles,
SwayGom,
abhipsaMisra,
alzimmermsft,
andyk-ms,
axisc,
brycewang-microsoft,
chenkennt,
digimaun,
g2vinay,
harsimar,
hmlam,
j7nw4r,
jpalvarezl,
moarychan,
rajkumar-rangaraj,
ramthi,
rujche,
samvaity,
saragluna,
timtay-microsoft,
trask,
vicancy,
xiang17 and
zackliu
as code owners
July 27, 2026 18:10
github-actions
Bot
added
Models Repository
Monitor - Autoconfigure
|
Azure Pipelines: Successfully started running 4 pipeline(s). 31 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request updates the Azure SDK for Java’s pinned third-party dependency versions across multiple modules (client libraries, tools, and test/stress/perf components), aligning the repository’s pom.xml files and the eng/versioning/external_dependencies.txt manifest.
Changes:
- Bumped Netty (+ TcNative) versions across Netty-based modules and updated associated enforcer “bannedDependencies” allowlists.
- Bumped Okio, Vert.x, Reactor, and Jackson Databind versions across affected modules and the external dependencies manifest.
- Updated module CHANGELOGs to record dependency upgrades.
Reviewed changes
Copilot reviewed 45 out of 45 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| sdk/webpubsub/azure-messaging-webpubsub-client/pom.xml | Bumps netty-codec-http version and updates enforcer include range. |
| sdk/webpubsub/azure-messaging-webpubsub-client/CHANGELOG.md | Notes Netty dependency upgrade. |
| sdk/tools/linting-extensions/pom.xml | Bumps jackson-databind version. |
| sdk/tools/azure-openrewrite/pom.xml | Bumps jackson-databind version (test deps). |
| sdk/template/azure-template-stress/pom.xml | Bumps vertx-codegen and updates enforcer include range. |
| sdk/parents/clientcore-parent/pom.xml | Bumps jackson-databind version (plugin dependency). |
| sdk/parents/azure-client-sdk-parent/pom.xml | Bumps jackson-databind version (plugin dependency). |
| sdk/parents/azure-client-sdk-parent-v2/pom.xml | Bumps jackson-databind version (plugin dependency). |
| sdk/openai/azure-ai-openai-realtime/pom.xml | Bumps netty-codec-http and updates enforcer include range. |
| sdk/monitor/azure-monitor-opentelemetry-exporter/pom.xml | Bumps okio (test scope) and updates enforcer include range. |
| sdk/monitor/azure-monitor-opentelemetry-exporter/CHANGELOG.md | Notes Okio dependency upgrade. |
| sdk/monitor/azure-monitor-opentelemetry-autoconfigure/pom.xml | Updates enforcer include range for Okio. |
| sdk/monitor/azure-monitor-opentelemetry-autoconfigure/CHANGELOG.md | Notes Okio dependency upgrade. |
| sdk/modelsrepository/azure-iot-modelsrepository/pom.xml | Bumps jackson-databind and updates enforcer include range. |
| sdk/modelsrepository/azure-iot-modelsrepository/CHANGELOG.md | Notes Jackson upgrade. |
| sdk/keyvault/azure-security-test-keyvault-jca/pom.xml | Bumps jackson-databind (test scope). |
| sdk/eventhubs/azure-messaging-eventhubs/docs/pom.xml | Bumps reactor-core for docs module. |
| sdk/cosmos/fabric-cosmos-spark-auth_4-0_2-13/pom.xml | Bumps jackson-databind and updates enforcer include range. |
| sdk/cosmos/fabric-cosmos-spark-auth_4-0_2-13/CHANGELOG.md | Notes jackson-databind dependency upgrade. |
| sdk/cosmos/fabric-cosmos-spark-auth_3/pom.xml | Bumps jackson-databind and updates enforcer include range. |
| sdk/cosmos/fabric-cosmos-spark-auth_3/CHANGELOG.md | Notes jackson-databind dependency upgrade. |
| sdk/cosmos/azure-cosmos-spark-account-data-resolver-sample/pom.xml | Bumps jackson-databind and updates enforcer include range. |
| sdk/cosmos/azure-cosmos-spark_4/pom.xml | Bumps jackson-databind. |
| sdk/cosmos/azure-cosmos-spark_3/pom.xml | Updates enforcer include range for jackson-databind. |
| sdk/cosmos/azure-cosmos-spark_3-5/pom.xml | Bumps jackson-databind. |
| sdk/cosmos/azure-cosmos-spark_3-4_2-12/pom.xml | Bumps jackson-databind. |
| sdk/cosmos/azure-cosmos-spark_3-4_2-12/CHANGELOG.md | Notes jackson-databind dependency upgrade. |
| sdk/cosmos/azure-cosmos-spark_3-3_2-12/pom.xml | Bumps jackson-databind. |
| sdk/cosmos/azure-cosmos-spark_3-3_2-12/CHANGELOG.md | Notes jackson-databind dependency upgrade. |
| sdk/core/pom.xml | Adds OWASP dependency-check pluginManagement to core aggregator POM. |
| sdk/core/azure-core/pom.xml | Bumps jackson-databind and reactor-core; updates enforcer include ranges. |
| sdk/core/azure-core/CHANGELOG.md | Notes Jackson/Reactor upgrades. |
| sdk/core/azure-core-version-tests/pom.xml | Bumps jackson-databind and reactor-core; updates enforcer include ranges. |
| sdk/core/azure-core-serializer-json-jackson/pom.xml | Bumps jackson-databind; updates enforcer include range. |
| sdk/core/azure-core-serializer-json-jackson/CHANGELOG.md | Notes Jackson upgrade. |
| sdk/core/azure-core-http-vertx/pom.xml | Bumps Vert.x versions; updates enforcer include ranges. |
| sdk/core/azure-core-http-vertx/CHANGELOG.md | Notes Vert.x upgrades. |
| sdk/core/azure-core-http-okhttp/pom.xml | Bumps okio-jvm; updates enforcer include range. |
| sdk/core/azure-core-http-okhttp/CHANGELOG.md | Notes Okio upgrade. |
| sdk/core/azure-core-http-netty/pom.xml | Bumps Netty + TcNative versions and updates enforcer include ranges. |
| sdk/core/azure-core-http-netty/CHANGELOG.md | Notes Netty/TcNative upgrades. |
| sdk/clientcore/http-okhttp3/pom.xml | Bumps okio-jvm; updates enforcer include range. |
| sdk/clientcore/http-netty4/pom.xml | Bumps Netty versions and updates enforcer include ranges. |
| eng/versioning/external_dependencies.txt | Updates central external dependency version manifest for Netty/TcNative/Okio/Vert.x/Reactor/Jackson Databind. |
| common/perf-test-core/pom.xml | Bumps Vert.x codegen and Reactor core allowlists + dependency version. |
jairmyree
requested review from
dpwatrous,
iwang2,
lilinvictorms,
skapur12,
wiboris and
xingwu1
as code owners
July 27, 2026 18:52
…tiple modules, including BOM generator, Azure core serializer, Cosmos SDK, and various Spark integrations. This update addresses compatibility and performance improvements in the Jackson library.
…e-sdk-for-java into jairmyree/dep-updates
alzimmermsft
approved these changes
Jul 29, 2026
jairmyree
enabled auto-merge (squash)
July 29, 2026 19:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request primarily updates several external dependencies to their latest versions, focusing on the Netty, Okio, Vert.x, Reactor, and Jackson libraries. These upgrades help ensure compatibility, security, and access to the latest bug fixes and features. The changes span multiple
pom.xmlfiles and the external dependencies manifest.The PR also updates the Core aggregate POM to make checking external dependencies more efficient.
Dependency Upgrades:
4.1.135.Finalto4.1.136.Final, and Netty TcNative from2.0.78.Finalto2.0.80.Finalacross relevant modules, includingazure-core-http-nettyandhttp-netty4(sdk/core/azure-core-http-netty/pom.xml,sdk/clientcore/http-netty4/pom.xml,eng/versioning/external_dependencies.txt) [1] [2] [3] [4] [5] [6] [7] [8] [9].3.16.0to3.17.0in both the OkHttp3 HTTP client and the external dependencies manifest (sdk/clientcore/http-okhttp3/pom.xml,eng/versioning/external_dependencies.txt) [1] [2] [3].4.5.27to4.5.30and Reactor Core from3.7.18to3.7.19in the performance test core module and external dependencies (common/perf-test-core/pom.xml,eng/versioning/external_dependencies.txt) [1] [2] [3].2.18.7to2.18.9in the external dependencies manifest (eng/versioning/external_dependencies.txt).