[CORE-69]: Bump the minor-patch-dependencies group across 1 directory with 8 updates

[dependabot]

Bumps the minor-patch-dependencies group with 8 updates in the / directory:

Package	From	To
com.nimbusds:nimbus-jose-jwt	9.42	9.46
com.fasterxml.jackson:jackson-bom	2.18.0	2.18.1
org.apache.commons:commons-compress	1.26.0	1.27.1
bio.terra:terra-common-lib	1.1.20-SNAPSHOT	1.1.22-SNAPSHOT
org.liquibase:liquibase-core	4.29.2	4.30.0
com.fasterxml.jackson.dataformat:jackson-dataformat-yaml	2.18.0	2.18.1
org.webjars.npm:swagger-ui-dist	5.17.14	5.18.2
com.fasterxml.jackson.datatype:jackson-datatype-jsr310	2.18.0	2.18.1

Updates com.nimbusds:nimbus-jose-jwt from 9.42 to 9.46

Changelog

Sourced from com.nimbusds:nimbus-jose-jwt's changelog.

9.42 (2024-10-28) * Promotes getCompatibleAlgorithms from MACSigner to MACProvider. * Promotes getMinRequiredSecretLength from MACSigner to MACProvider. * Removes the Set argument from the protected MACProvider constructors, the compatible HSxxx algorithms are now determined within the constructor. * MACVerifier must enforce a minimum secret key length of 384 bits for HS384 and of 512 bits for HS512 (iss #563). * OctetSequenceKeyGenerator must support "exp", "nbf" and "iat" (iss #575). * Updates to com.google.crypto.tink:tink:1.15.0

9.43 (2024-10-31) * Adds JWK.toRevokedJWK(KeyRevocation) method.

9.44 (2024-11-01) * JWKMatcher receives a capability to match non-revoked and revoked keys only, with JWKMatcher.Builder.nonRevokedOnly and revokedOnly. * Adds JWKMatcher.Builder.withKeyUseOnly, deprecating hasKeyUse. * Adds JWKMatcher.Builder.withKeyIDOnly, deprecating hasKeyID. * Adds JWKMatcher.Builder.withX509CertChainOnly, deprecating hasX509CertChain.

9.45 (2024-11-01) * New JWKMatcher.Builder(JWKMatcher) constructor.

9.46 (2024-11-08) * Adds JWKParameterNames.PUBLIC constant Set with the standard public JWK parameter names.

Commits

• 60b715f [maven-release-plugin] prepare for next development iteration
• 52a7024 Adds JWK.toRevokedJWK(KeyRevocation) method
• 9ec4adf [maven-release-plugin] prepare release 9.43
• c089ed6 [maven-release-plugin] prepare for next development iteration
• 767c4b5 JWKMatcher receives a capability to match non-revoked and revoked keys
• b19a507 [maven-release-plugin] prepare release 9.44
• 097f818 [maven-release-plugin] prepare for next development iteration
• 5b211fa New JWKMatcher.Builder(JWKMatcher) constructor
• 78b49b6 [maven-release-plugin] prepare release 9.45
• 418595b [maven-release-plugin] prepare for next development iteration
• Additional commits viewable in compare view

Updates com.fasterxml.jackson:jackson-bom from 2.18.0 to 2.18.1

Commits

• ef33ac7 [maven-release-plugin] prepare release jackson-bom-2.18.1
• f43bf9f Prepare for 2.18.1 release
• 6f5259d Change to snapshot version of jackson-parent
• 3f21ec5 Back to snapshot dep
• bb45933 [maven-release-plugin] prepare for next development iteration
• See full diff in compare view

Updates org.apache.commons:commons-compress from 1.26.0 to 1.27.1

Updates bio.terra:terra-common-lib from 1.1.20-SNAPSHOT to 1.1.22-SNAPSHOT

Updates org.liquibase:liquibase-core from 4.29.2 to 4.30.0

Release notes

Sourced from org.liquibase:liquibase-core's releases.

Liquibase v4.30.0

Liquibase 4.30.0 is a major release

[!IMPORTANT] Liquibase 4.30.0 contains new capabilities and notable enhancements for Liquibase OSS and Pro users including:

• Flow enhancements
• Validation improvements
• Clearer error messaging for thrown exceptions
• Addition of Anonymous Analytics
• Deprecation of the MacOS dmg installer in favor of installation via homebrew

[!NOTE] See the Liquibase 4.30.0 Release Notes for the complete set of release information.

Notable Changes

[OSS and PRO]

Anonymous Analytics:

• Liquibase can now gather anonymous usage analytics when commands are run. No user-specific data will be gathered.

For Liquibase OSS users, this functionality is enabled by default, but can be opted-out of before any data is sent. For Liquibase Pro users, this is disabled by default with the ability to opt-in. You can enable or disable sending analytics with the analytics-enabled property.

Gathering anonymous usage analytics allows us to better understand how Liquibase is actually being used by a very wide, diverse set of millions of users.

• Learn more https://docs.liquibase.com/analytics

[PRO]

Flow Enhancements: Detect pending changesets, and variable-variables

• There are two exciting Flow enhancements: the ability to condition action on presence of pending changesets, and the ability to use a global variable inside other global or stage variables, enabling variable-variables within flows.
• Learn more https://docs.liquibase.com/flow

[OSS]

Usability Improvements:

• Avoid ignoring caught exceptions, and instead return the exception and append the reason for better debugging.
• When using failOnError=false, changesets that failed will now show up in the default output.
• When using STRICT mode, update-to-tag will now throw an error when there is no tag specified or the tag specified does not exist.
• Added a Customizer that allows discovery of changesets that are not known to an application. This can be used to prevent an application's startup when discovering new, unexpected changesets before an update is made.

Deprecated: MacOS .dmg installer

• The MacOS dmg installer no longer ships with release artifacts. Please use the tar.gz or .zip release artifacts, or install via homebrew by running brew install liquibase

For a full list of improvements and bug fixes, see the [OSS] Changelog section.

[PRO] Changelog

🚀 New Features

... (truncated)

Changelog

Sourced from org.liquibase:liquibase-core's changelog.

Liquibase 4.30.0 is a major release

[!IMPORTANT] Liquibase 4.30.0 contains new capabilities and notable enhancements for Liquibase OSS and Pro users including Anonymous Analytics and deprecation of the MacOS dmg installer. [!NOTE] See the Liquibase 4.30.0 Release Notes for the complete set of release information.

Notable Changes

[PRO]

Anonymous Analytics:

• Liquibase can now gather anonymous usage analytics when commands are run. No user-specific data will be gathered.

For Liquibase OSS users, this functionality is enabled by default, but can be opted-out of before any data is sent. For Liquibase Pro users, this is disabled by default with the ability to opt-in.

Gathering anonymous usage analytics allows us to better understand how Liquibase is actually being used by a very wide, diverse set of millions of users.

• Learn more https://docs.liquibase.com/analytics

Flow Enhancements: Detect pending changesets, and variable-variables

• There are two exciting Flow enhancements: the ability to condition action on presence of pending changesets, and the ability to use a global variable inside other global or stage variables, enabling variable-variables within flows.
• Learn more https://docs.liquibase.com/flow

[OSS]

Deprecated: MacOS .dmg installer

• The MacOS dmg installer no longer ships with release artifacts. Please use the tar.gz or .zip release artifacts, or install via homebrew by running brew install liquibase

[PRO] Changelog

New Features

• DAT-18202 Implement wildcard check name argument for enable/disable in liquibase/liquibase-pro#2000 by @​wwillard7800
• DAT-17058: Add analytics in liquibase/liquibase-pro#1995 by @​liquibot
• DAT-17568 Added exit command action in liquibase/liquibase-pro#1689 by @​wwillard7800
• DAT-18689: Add extra information to failed changesets summary in liquibase/liquibase-pro#1996 by @​filipelautert
• DAT-18114 Added more logging for formatted SQL parsing in liquibase/liquibase-pro#1994 by @​wwillard7800
• DAT-18455 Add SQL file path to policy checks output in liquibase/liquibase-pro#1944 by @​wwillard7800

Changes

• DAT-17581 Exit with a non-zero if the changelog did not validate in liquibase/liquibase-pro#1870 by @​wwillard7800
• DAT-18540 Create new ReportWriter.open(String path) method that default to no-op in liquibase/liquibase-pro#1962 by @​wwillard7800
• DAT-18092: Use xdg-open to open reports in browser on linux operating systems in liquibase/liquibase-pro#1948 by @​abrackx
• DAT-18531 Clear out DBCL fast check cache before each Flow action in liquibase/liquibase-pro#1933 by @​wwillard7800

... (truncated)

Commits

• 38cc3e9 Only add child events when analytics is enabled (DAT-18943) (#6474)
• 2d8d90d Add 4.30.0 xsd and update changelog.txt (#6471)
• 789c5e6 enable analytics for release builds only (DAT-18902) (#6465)
• 3db80b4 Modify clob handling (#6410)
• 2c04047 DAT-17706 - Add checks example files to all format directories (#6461)
• 315d709 Update jreBundle to latest in install4j (#6457)
• 4db540b turn off analytics temporarily (DAT-18902) (#6464)
• 28e3fa5 Fix flakey ChangeLogSyncTaskTest test (DAT-18921) (#6463)
• f337b4a Adds customizer to discover and react to unknown change sets (#6432)
• 181fbc8 chore: fix expected files in examples directory (#6458)
• Additional commits viewable in compare view

Updates com.fasterxml.jackson.dataformat:jackson-dataformat-yaml from 2.18.0 to 2.18.1

Commits

• 4f3aa83 [maven-release-plugin] prepare release jackson-dataformats-text-2.18.1
• 2f722bc Prepare for 2.18.1 release
• 1619e14 Remove use of TypeFactory.defaultInstance()
• 998064b Backport #499 in 2.18(.1) as well
• 46de17e Merge branch '2.17' into 2.18
• 306d255 Backport #499 in 2.17(.3)
• cbf4ad9 Back to snapshot deps
• e4eca1c [maven-release-plugin] prepare for next development iteration
• See full diff in compare view

Updates org.webjars.npm:swagger-ui-dist from 5.17.14 to 5.18.2

Release notes

Sourced from org.webjars.npm:swagger-ui-dist's releases.

Swagger UI v5.18.2 Released!

5.18.2 (2024-11-07)

Bug Fixes

• update Scarf.js to v1.4.0 to avoid breaking Vitest (#10204) (adc1c3c), closes #10197

Swagger UI v5.18.1 Released!

5.18.1 (2024-11-05)

Bug Fixes

• docker: return explicit Node.js installation (#10198) (3e3dfc6), closes #10195

Swagger UI v5.18.0 Released!

5.18.0 (2024-11-05)

Features

• analytics: use Scarf.js to provide anonymized installation analytics (#10194) (fb55b9c)

---

Anonymized analytics

SwaggerUI uses Scarf to collect anonymized installation analytics. These analytics help support the maintainers of this library and ONLY run during installation. To opt out, you can set the scarfSettings.enabled field to false in your project's package.json:

// package.json
{
  // ...
  "scarfSettings": {
    "enabled": false
  }
  // ...
}

Alternatively, you can set the environment variable SCARF_ANALYTICS to false as part of the environment that installs your npm packages, e.g., SCARF_ANALYTICS=false npm install.

Commits

• 3c7e281 chore(release): cut the v5.18.2 release
• 1dd1f7c chore(dist): update Scarf.js to v1.4.0 (#10205)
• adc1c3c fix: update Scarf.js to v1.4.0 to avoid breaking Vitest (#10204)
• 7b84da5 chore(deps-dev): bump release-it from 17.5.0 to 17.10.0 (#10202)
• e5d00e8 chore(deps-dev): bump json-merger from 1.1.10 to 2.0.0 (#10201)
• 8fdf0d3 chore(deps-dev): bump jsdom from 24.0.0 to 25.0.1 (#10200)
• 05b7aff chore(docker): disable apk cache (#10203)
• 91b6e13 chore(deps-dev): bump husky from 9.0.11 to 9.1.6 (#10199)
• e5addb1 chore(release): cut the v5.18.1 release
• 3e3dfc6 fix(docker): return explicit Node.js installation (#10198)
• Additional commits viewable in compare view

Updates com.fasterxml.jackson.datatype:jackson-datatype-jsr310 from 2.18.0 to 2.18.1

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[davidangb]

do not merge - the TCL update breaks things. See CORE-117. I've made #381 to replace this.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.