Bump the prod-deps group across 1 directory with 8 updates

[dependabot]

Bumps the prod-deps group with 8 updates in the / directory:

Package	From	To
org.graalvm.polyglot:polyglot	25.0.3	25.1.3
org.graalvm.python:python-language	25.0.3	25.1.3
org.graalvm.python:python-resources	25.0.3	25.1.3
org.graalvm.truffle:truffle-runtime	25.0.3	25.1.3
org.graalvm.truffle:truffle-api	25.0.3	25.1.3
com.fasterxml.jackson:jackson-bom	2.22.0	2.22.1
ch.qos.logback:logback-classic	1.5.34	1.5.38
org.junit:junit-bom	6.1.0	6.1.2

Updates org.graalvm.polyglot:polyglot from 25.0.3 to 25.1.3

Commits

• d9de820 [GR-74345] Append global benchmark filters in PolyBench and implicitly exclud...
• a121746 [GR-76692] Update CI overlay
• 46e72d0 [GR-76684] Add test for build-time invokedynamic/constantdynamic bootstrap me...
• fe5c7d6 [GR-76591] Add Project Terminus docs
• 923ec69 [GR-68442] Update Barista bench suite to be graalhost aware.
• 048c371 [GR-21590] Update version numbers for upcoming release.
• 08de586 [GR-71949] Track nullSeen in Ristretto type profiles.
• 522dfaa Update js import to GraalJS 25.1.3
• b222ccc [GR-61365] Use reflection and service providers for protocol handling.
• 30d7ddb GR-76591 Restore Terminus migration note
• Additional commits viewable in compare view

Updates org.graalvm.python:python-language from 25.0.3 to 25.1.3

Changelog

Sourced from org.graalvm.python:python-language's changelog.

Version 25.1.3

• The standalone artifacts now include the Python version name before the Graal version. The new artifacts now start with graalpy<PYTHON_VERSION>-<GRAAL_VERSION>-<OPERATING_SYSTEM>-<ARCHITECTURE>.
• Standalone JVM artifacts are no longer released as separate distributions. For standalone deployments, use the GraalPy native artifacts. If you require Java interoperability, use our jbang launcher (jbang graalpy@oracle/graalpython -c "print('hello from GraalPy')") or a custom embedding.
• Add -X jit=0|1|2 presets to tune startup-heavy or throughput-oriented workloads, and make the GraalPy launcher default to the jit=1 preset.
• Treat foreign buffer objects as Python buffer-compatible binary objects, so APIs like memoryview, bytes, bytearray, binascii.hexlify, and io.BytesIO work naturally on them when embedding GraalPy in Java. This allows passing binary data between Python and Java's ByteBuffer and ByteSequence types with minimal (sometimes zero) copies.
• Add support for Truffle source options:
  • The python.Optimize option can be used to specify the optimization level, like the -O (level 1) and -OO (level 2) commandline options.
  • The python.NewGlobals option can be used to run a source with a fresh globals dictionary instead of the main module globals, which is useful for embeddings that want isolated top-level execution.
• Intern string literals in source files
• Allocation reporting via Truffle has been removed. Python object sizes were never reported correctly, so the data was misleading and there was a non-neglible overhead for object allocations even when reporting was inactive.
• Better readline support via JLine. Autocompletion and history now works in pdb
• Remove the intrinsified _ctypes module in favor of the native CPython version. This makes GraalPy's ctypes implementation more compatible and reduces the memory footprint of using ctypes.
• Add a new, more natural style of subclassing Java classes from Python by passing the new_style=True keyword. Multiple levels of inheritance are supported, and super() calls both in the constructor override via __new__ as well as in Java method overrides work as expected.
• Add polyglot.gil_locked_during_interop context manager. By default, the global interpreter lock (GIL) is unlocked when interacting with objects from another language, to give other Python threads a chance to run in parallel. While this avoids potential deadlocks, repeated unlocking and locking of the GIL can decrease performance, so this context manager can be used to keep the lock held around short-running interop.
• Add Github workflows that run our gates from the same job definitions as our internal CI. This will make it easier for contributors opening PRs on Github to ensure code contributions pass the same tests that we are running internally.
• Added support for specifying generics on foreign classes, and inheriting from such classes. Especially when using Java classes that support generics, this allows expressing the generic types in Python type annotations as well.
• Added a new java backend for the pyexpat module that uses a Java XML parser instead of the native expat library. It can be useful when running without native access or multiple-context scenarios. This backend is the default when embedding and can be switched back to native expat by setting python.PyExpatModuleBackend option to native. Standalone distribution still defaults to native expat backend.
• Add a new context option python.UnicodeCharacterDatabaseNativeFallback to control whether the ICU database may fall back to the native unicode character database from CPython for features and characters not supported by ICU. This requires native access to be enabled and is disabled by default for embeddings.
• Add a new context option python.AllowSignalHandlers to control whether Python code may install signal handlers. This is disabled by default for Java embedding and enabled in the standalone.
• Add an experimental python.InitializationEntropySource option to control the entropy source used for initialization-only randomness such as hash secret generation and random.Random(None) seeding. This means embeddings and tests can select deterministic or externally provided initialization entropy without affecting cryptographically relevant APIs like os.urandom() or random.SystemRandom().
• Dispatch sys.audit events to hooks registered with sys.addaudithook, including audit events raised through the PySys_Audit C API.
• Foreign temporal objects (dates, times, and timezones) are now given a Python class corresponding to their interop traits, i.e., date, time, datetime, or tzinfo. This allows any foreign objects with these traits to be used in place of the native Python types and Python methods available on these types work on the foreign types.
• Make BouncyCastle an optional dependency for embedding use cases. BouncyCastle is only needed for legacy RSA, DSA, and EC privat keys versions 0 and 1. To support these from Python embeddings, BouncyCastle must now be explicitly enabled by adding the org.graalvm.python:python-bouncycastle-support Maven artifact.
• The GraalPy Native standalone on Linux now uses a lower-footprint Native Image garbage collection configuration. This reduces resident set size (RSS) for many workloads, but may increase startup time and warmup time, and can slow down some workloads.

Version 25.0.1

• Allow users to keep going on unsupported JDK/OS/ARCH combinations at their own risk by opting out of early failure using -Dtruffle.UseFallbackRuntime=true, -Dpolyglot.engine.userResourceCache=/set/to/a/writeable/dir, -Dpolyglot.engine.allowUnsupportedPlatform=true, and -Dpolyglot.python.UnsupportedPlatformEmulates=[linux|macos|windows] and -Dorg.graalvm.python.resources.exclude=native.files.

Version 25.0.0

• sys.implementation.version now returns the GraalPy version instead of the Python version it implements. Also available as sys.graalpy_version_info for better discoverability by people already familiar with PyPy and its sys.pypy_version_info.
• GRAALPY_VERSION_NUM C macro now inlcudes the release level and serial number at the end to conform to the hexversion format. This shouldn't break any existing comparisons.
• dir(foreign_object) now returns both foreign methods and Python methods (it used to return only foreign methods).
• Support __name__, __doc__, __text_signature__ fields on foreign executables to serve as their proper counterparts on the Python side. This is useful to, for example, use Java functional interfaces in lieu of Python functions for things like LangChain's @tool annotation that want to inspect the underlying function.
• Remove support for running C extensions as LLVM bitcode. This also removes the related options python.UseSystemToolchain and python.NativeModules. Isolation of native code when embedding GraalPy into Java projects is now provided via the GraalVM enterprise edition polyglot isolate feature, which can launch in a separate external sub-process by setting the --engine.IsolateMode=external option.
• Remove built-in HPy module. HPy can now be installed and used from the upstream sources.
• Update Python standard library and core to 3.12.8.
• Implement faulthandler.dump_traceback_later to better support testing frameworks that implement resilience to crashes.
• Fix various issues affecting cibuildwheels on Windows, to make it easier for Python projects to provide native extensions for GraalPy on all supported platforms.
• Add support for sharing Arrow arrays and tables between Java, PyArrow, and Pandas to avoid data copying when embedding those libraries into a Java project.
• Enable FTS3, FTS4, FTS5, RTREE, and math function features in the bundled sqlite3 library.
• Add support patches for Torch 2.7.0, PyGObject 3.52.3, xmlschema 4.0.0, lxml < 5.4.0, SciPy 1.15, jq 1.8.0, NumPy < 2.3, ormsgpack < 1.9.1, pandas 2.2.3, PyArrow 19.0, PyMuPDF 1.25.4.
• The GraalPy Native standalone on Linux now uses the G1 garbage collector which is much faster.
• The full-featured Python REPL is now available on GraalPy standalone builds for Windows.

Version 24.2.0

• Updated developer metadata of Maven artifacts.
• Added gradle plugin for polyglot embedding of Python packages into Java.
• When calling a method on a foreign object in Python code, Python methods are now prioritized over foreign members.
• Added polyglot.register_interop_type and @polyglot.interop_type to define custom Python methods for a given foreign class/type. See the documentation for more information.
• Foreign objects are now given a Python class corresponding to their interop traits.

... (truncated)

Commits

• a88321e [GR-74345] Add initial peak benchmark copies
• a280e3b [GR-21590] Update version numbers for upcoming release.
• c688828 Update version numbers for upcoming release.
• f99e710 [GR-76286] Fix negative sequence slot index handling also for list and mmap.
• 1dc9395 [GR-76680] Add test using a GraalOS Python standalone.
• 79a9c4a [GR-76694] Update graal import
• edd1f9b Fix negative sequence slot index handling.
• ffb50ba Package GraalOS runtime to make graalos standalone and add smoke tests
• e22ce59 Update graal import
• 3c8ff2c [GR-76576] Skip windows jdk21 test paths that trigger native access.
• Additional commits viewable in compare view

Updates org.graalvm.python:python-resources from 25.0.3 to 25.1.3

Changelog

Sourced from org.graalvm.python:python-resources's changelog.

Version 25.1.3

• The standalone artifacts now include the Python version name before the Graal version. The new artifacts now start with graalpy<PYTHON_VERSION>-<GRAAL_VERSION>-<OPERATING_SYSTEM>-<ARCHITECTURE>.
• Standalone JVM artifacts are no longer released as separate distributions. For standalone deployments, use the GraalPy native artifacts. If you require Java interoperability, use our jbang launcher (jbang graalpy@oracle/graalpython -c "print('hello from GraalPy')") or a custom embedding.
• Add -X jit=0|1|2 presets to tune startup-heavy or throughput-oriented workloads, and make the GraalPy launcher default to the jit=1 preset.
• Treat foreign buffer objects as Python buffer-compatible binary objects, so APIs like memoryview, bytes, bytearray, binascii.hexlify, and io.BytesIO work naturally on them when embedding GraalPy in Java. This allows passing binary data between Python and Java's ByteBuffer and ByteSequence types with minimal (sometimes zero) copies.
• Add support for Truffle source options:
  • The python.Optimize option can be used to specify the optimization level, like the -O (level 1) and -OO (level 2) commandline options.
  • The python.NewGlobals option can be used to run a source with a fresh globals dictionary instead of the main module globals, which is useful for embeddings that want isolated top-level execution.
• Intern string literals in source files
• Allocation reporting via Truffle has been removed. Python object sizes were never reported correctly, so the data was misleading and there was a non-neglible overhead for object allocations even when reporting was inactive.
• Better readline support via JLine. Autocompletion and history now works in pdb
• Remove the intrinsified _ctypes module in favor of the native CPython version. This makes GraalPy's ctypes implementation more compatible and reduces the memory footprint of using ctypes.
• Add a new, more natural style of subclassing Java classes from Python by passing the new_style=True keyword. Multiple levels of inheritance are supported, and super() calls both in the constructor override via __new__ as well as in Java method overrides work as expected.
• Add polyglot.gil_locked_during_interop context manager. By default, the global interpreter lock (GIL) is unlocked when interacting with objects from another language, to give other Python threads a chance to run in parallel. While this avoids potential deadlocks, repeated unlocking and locking of the GIL can decrease performance, so this context manager can be used to keep the lock held around short-running interop.
• Add Github workflows that run our gates from the same job definitions as our internal CI. This will make it easier for contributors opening PRs on Github to ensure code contributions pass the same tests that we are running internally.
• Added support for specifying generics on foreign classes, and inheriting from such classes. Especially when using Java classes that support generics, this allows expressing the generic types in Python type annotations as well.
• Added a new java backend for the pyexpat module that uses a Java XML parser instead of the native expat library. It can be useful when running without native access or multiple-context scenarios. This backend is the default when embedding and can be switched back to native expat by setting python.PyExpatModuleBackend option to native. Standalone distribution still defaults to native expat backend.
• Add a new context option python.UnicodeCharacterDatabaseNativeFallback to control whether the ICU database may fall back to the native unicode character database from CPython for features and characters not supported by ICU. This requires native access to be enabled and is disabled by default for embeddings.
• Add a new context option python.AllowSignalHandlers to control whether Python code may install signal handlers. This is disabled by default for Java embedding and enabled in the standalone.
• Add an experimental python.InitializationEntropySource option to control the entropy source used for initialization-only randomness such as hash secret generation and random.Random(None) seeding. This means embeddings and tests can select deterministic or externally provided initialization entropy without affecting cryptographically relevant APIs like os.urandom() or random.SystemRandom().
• Dispatch sys.audit events to hooks registered with sys.addaudithook, including audit events raised through the PySys_Audit C API.
• Foreign temporal objects (dates, times, and timezones) are now given a Python class corresponding to their interop traits, i.e., date, time, datetime, or tzinfo. This allows any foreign objects with these traits to be used in place of the native Python types and Python methods available on these types work on the foreign types.
• Make BouncyCastle an optional dependency for embedding use cases. BouncyCastle is only needed for legacy RSA, DSA, and EC privat keys versions 0 and 1. To support these from Python embeddings, BouncyCastle must now be explicitly enabled by adding the org.graalvm.python:python-bouncycastle-support Maven artifact.
• The GraalPy Native standalone on Linux now uses a lower-footprint Native Image garbage collection configuration. This reduces resident set size (RSS) for many workloads, but may increase startup time and warmup time, and can slow down some workloads.

Version 25.0.1

• Allow users to keep going on unsupported JDK/OS/ARCH combinations at their own risk by opting out of early failure using -Dtruffle.UseFallbackRuntime=true, -Dpolyglot.engine.userResourceCache=/set/to/a/writeable/dir, -Dpolyglot.engine.allowUnsupportedPlatform=true, and -Dpolyglot.python.UnsupportedPlatformEmulates=[linux|macos|windows] and -Dorg.graalvm.python.resources.exclude=native.files.

Version 25.0.0

• sys.implementation.version now returns the GraalPy version instead of the Python version it implements. Also available as sys.graalpy_version_info for better discoverability by people already familiar with PyPy and its sys.pypy_version_info.
• GRAALPY_VERSION_NUM C macro now inlcudes the release level and serial number at the end to conform to the hexversion format. This shouldn't break any existing comparisons.
• dir(foreign_object) now returns both foreign methods and Python methods (it used to return only foreign methods).
• Support __name__, __doc__, __text_signature__ fields on foreign executables to serve as their proper counterparts on the Python side. This is useful to, for example, use Java functional interfaces in lieu of Python functions for things like LangChain's @tool annotation that want to inspect the underlying function.
• Remove support for running C extensions as LLVM bitcode. This also removes the related options python.UseSystemToolchain and python.NativeModules. Isolation of native code when embedding GraalPy into Java projects is now provided via the GraalVM enterprise edition polyglot isolate feature, which can launch in a separate external sub-process by setting the --engine.IsolateMode=external option.
• Remove built-in HPy module. HPy can now be installed and used from the upstream sources.
• Update Python standard library and core to 3.12.8.
• Implement faulthandler.dump_traceback_later to better support testing frameworks that implement resilience to crashes.
• Fix various issues affecting cibuildwheels on Windows, to make it easier for Python projects to provide native extensions for GraalPy on all supported platforms.
• Add support for sharing Arrow arrays and tables between Java, PyArrow, and Pandas to avoid data copying when embedding those libraries into a Java project.
• Enable FTS3, FTS4, FTS5, RTREE, and math function features in the bundled sqlite3 library.
• Add support patches for Torch 2.7.0, PyGObject 3.52.3, xmlschema 4.0.0, lxml < 5.4.0, SciPy 1.15, jq 1.8.0, NumPy < 2.3, ormsgpack < 1.9.1, pandas 2.2.3, PyArrow 19.0, PyMuPDF 1.25.4.
• The GraalPy Native standalone on Linux now uses the G1 garbage collector which is much faster.
• The full-featured Python REPL is now available on GraalPy standalone builds for Windows.

Version 24.2.0

• Updated developer metadata of Maven artifacts.
• Added gradle plugin for polyglot embedding of Python packages into Java.
• When calling a method on a foreign object in Python code, Python methods are now prioritized over foreign members.
• Added polyglot.register_interop_type and @polyglot.interop_type to define custom Python methods for a given foreign class/type. See the documentation for more information.
• Foreign objects are now given a Python class corresponding to their interop traits.

... (truncated)

Commits

• a88321e [GR-74345] Add initial peak benchmark copies
• a280e3b [GR-21590] Update version numbers for upcoming release.
• c688828 Update version numbers for upcoming release.
• f99e710 [GR-76286] Fix negative sequence slot index handling also for list and mmap.
• 1dc9395 [GR-76680] Add test using a GraalOS Python standalone.
• 79a9c4a [GR-76694] Update graal import
• edd1f9b Fix negative sequence slot index handling.
• ffb50ba Package GraalOS runtime to make graalos standalone and add smoke tests
• e22ce59 Update graal import
• 3c8ff2c [GR-76576] Skip windows jdk21 test paths that trigger native access.
• Additional commits viewable in compare view

Updates org.graalvm.truffle:truffle-runtime from 25.0.3 to 25.1.3

Commits

• d9de820 [GR-74345] Append global benchmark filters in PolyBench and implicitly exclud...
• a121746 [GR-76692] Update CI overlay
• 46e72d0 [GR-76684] Add test for build-time invokedynamic/constantdynamic bootstrap me...
• fe5c7d6 [GR-76591] Add Project Terminus docs
• 923ec69 [GR-68442] Update Barista bench suite to be graalhost aware.
• 048c371 [GR-21590] Update version numbers for upcoming release.
• 08de586 [GR-71949] Track nullSeen in Ristretto type profiles.
• 522dfaa Update js import to GraalJS 25.1.3
• b222ccc [GR-61365] Use reflection and service providers for protocol handling.
• 30d7ddb GR-76591 Restore Terminus migration note
• Additional commits viewable in compare view

Updates org.graalvm.truffle:truffle-api from 25.0.3 to 25.1.3

Commits

• d9de820 [GR-74345] Append global benchmark filters in PolyBench and implicitly exclud...
• a121746 [GR-76692] Update CI overlay
• 46e72d0 [GR-76684] Add test for build-time invokedynamic/constantdynamic bootstrap me...
• fe5c7d6 [GR-76591] Add Project Terminus docs
• 923ec69 [GR-68442] Update Barista bench suite to be graalhost aware.
• 048c371 [GR-21590] Update version numbers for upcoming release.
• 08de586 [GR-71949] Track nullSeen in Ristretto type profiles.
• 522dfaa Update js import to GraalJS 25.1.3
• b222ccc [GR-61365] Use reflection and service providers for protocol handling.
• 30d7ddb GR-76591 Restore Terminus migration note
• Additional commits viewable in compare view

Updates org.graalvm.python:python-language from 25.0.3 to 25.1.3

Changelog

Sourced from org.graalvm.python:python-language's changelog.

Version 25.1.3

• The standalone artifacts now include the Python version name before the Graal version. The new artifacts now start with graalpy<PYTHON_VERSION>-<GRAAL_VERSION>-<OPERATING_SYSTEM>-<ARCHITECTURE>.
• Standalone JVM artifacts are no longer released as separate distributions. For standalone deployments, use the GraalPy native artifacts. If you require Java interoperability, use our jbang launcher (jbang graalpy@oracle/graalpython -c "print('hello from GraalPy')") or a custom embedding.
• Add -X jit=0|1|2 presets to tune startup-heavy or throughput-oriented workloads, and make the GraalPy launcher default to the jit=1 preset.
• Treat foreign buffer objects as Python buffer-compatible binary objects, so APIs like memoryview, bytes, bytearray, binascii.hexlify, and io.BytesIO work naturally on them when embedding GraalPy in Java. This allows passing binary data between Python and Java's ByteBuffer and ByteSequence types with minimal (sometimes zero) copies.
• Add support for Truffle source options:
  • The python.Optimize option can be used to specify the optimization level, like the -O (level 1) and -OO (level 2) commandline options.
  • The python.NewGlobals option can be used to run a source with a fresh globals dictionary instead of the main module globals, which is useful for embeddings that want isolated top-level execution.
• Intern string literals in source files
• Allocation reporting via Truffle has been removed. Python object sizes were never reported correctly, so the data was misleading and there was a non-neglible overhead for object allocations even when reporting was inactive.
• Better readline support via JLine. Autocompletion and history now works in pdb
• Remove the intrinsified _ctypes module in favor of the native CPython version. This makes GraalPy's ctypes implementation more compatible and reduces the memory footprint of using ctypes.
• Add a new, more natural style of subclassing Java classes from Python by passing the new_style=True keyword. Multiple levels of inheritance are supported, and super() calls both in the constructor override via __new__ as well as in Java method overrides work as expected.
• Add polyglot.gil_locked_during_interop context manager. By default, the global interpreter lock (GIL) is unlocked when interacting with objects from another language, to give other Python threads a chance to run in parallel. While this avoids potential deadlocks, repeated unlocking and locking of the GIL can decrease performance, so this context manager can be used to keep the lock held around short-running interop.
• Add Github workflows that run our gates from the same job definitions as our internal CI. This will make it easier for contributors opening PRs on Github to ensure code contributions pass the same tests that we are running internally.
• Added support for specifying generics on foreign classes, and inheriting from such classes. Especially when using Java classes that support generics, this allows expressing the generic types in Python type annotations as well.
• Added a new java backend for the pyexpat module that uses a Java XML parser instead of the native expat library. It can be useful when running without native access or multiple-context scenarios. This backend is the default when embedding and can be switched back to native expat by setting python.PyExpatModuleBackend option to native. Standalone distribution still defaults to native expat backend.
• Add a new context option python.UnicodeCharacterDatabaseNativeFallback to control whether the ICU database may fall back to the native unicode character database from CPython for features and characters not supported by ICU. This requires native access to be enabled and is disabled by default for embeddings.
• Add a new context option python.AllowSignalHandlers to control whether Python code may install signal handlers. This is disabled by default for Java embedding and enabled in the standalone.
• Add an experimental python.InitializationEntropySource option to control the entropy source used for initialization-only randomness such as hash secret generation and random.Random(None) seeding. This means embeddings and tests can select deterministic or externally provided initialization entropy without affecting cryptographically relevant APIs like os.urandom() or random.SystemRandom().
• Dispatch sys.audit events to hooks registered with sys.addaudithook, including audit events raised through the PySys_Audit C API.
• Foreign temporal objects (dates, times, and timezones) are now given a Python class corresponding to their interop traits, i.e., date, time, datetime, or tzinfo. This allows any foreign objects with these traits to be used in place of the native Python types and Python methods available on these types work on the foreign types.
• Make BouncyCastle an optional dependency for embedding use cases. BouncyCastle is only needed for legacy RSA, DSA, and EC privat keys versions 0 and 1. To support these from Python embeddings, BouncyCastle must now be explicitly enabled by adding the org.graalvm.python:python-bouncycastle-support Maven artifact.
• The GraalPy Native standalone on Linux now uses a lower-footprint Native Image garbage collection configuration. This reduces resident set size (RSS) for many workloads, but may increase startup time and warmup time, and can slow down some workloads.

Version 25.0.1

• Allow users to keep going on unsupported JDK/OS/ARCH combinations at their own risk by opting out of early failure using -Dtruffle.UseFallbackRuntime=true, -Dpolyglot.engine.userResourceCache=/set/to/a/writeable/dir, -Dpolyglot.engine.allowUnsupportedPlatform=true, and -Dpolyglot.python.UnsupportedPlatformEmulates=[linux|macos|windows] and -Dorg.graalvm.python.resources.exclude=native.files.

Version 25.0.0

• sys.implementation.version now returns the GraalPy version instead of the Python version it implements. Also available as sys.graalpy_version_info for better discoverability by people already familiar with PyPy and its sys.pypy_version_info.
• GRAALPY_VERSION_NUM C macro now inlcudes the release level and serial number at the end to conform to the hexversion format. This shouldn't break any existing comparisons.
• dir(foreign_object) now returns both foreign methods and Python methods (it used to return only foreign methods).
• Support __name__, __doc__, __text_signature__ fields on foreign executables to serve as their proper counterparts on the Python side. This is useful to, for example, use Java functional interfaces in lieu of Python functions for things like LangChain's @tool annotation that want to inspect the underlying function.
• Remove support for running C extensions as LLVM bitcode. This also removes the related options python.UseSystemToolchain and python.NativeModules. Isolation of native code when embedding GraalPy into Java projects is now provided via the GraalVM enterprise edition polyglot isolate feature, which can launch in a separate external sub-process by setting the --engine.IsolateMode=external option.
• Remove built-in HPy module. HPy can now be installed and used from the upstream sources.
• Update Python standard library and core to 3.12.8.
• Implement faulthandler.dump_traceback_later to better support testing frameworks that implement resilience to crashes.
• Fix various issues affecting cibuildwheels on Windows, to make it easier for Python projects to provide native extensions for GraalPy on all supported platforms.
• Add support for sharing Arrow arrays and tables between Java, PyArrow, and Pandas to avoid data copying when embedding those libraries into a Java project.
• Enable FTS3, FTS4, FTS5, RTREE, and math function features in the bundled sqlite3 library.
• Add support patches for Torch 2.7.0, PyGObject 3.52.3, xmlschema 4.0.0, lxml < 5.4.0, SciPy 1.15, jq 1.8.0, NumPy < 2.3, ormsgpack < 1.9.1, pandas 2.2.3, PyArrow 19.0, PyMuPDF 1.25.4.
• The GraalPy Native standalone on Linux now uses the G1 garbage collector which is much faster.
• The full-featured Python REPL is now available on GraalPy standalone builds for Windows.

Version 24.2.0

• Updated developer metadata of Maven artifacts.
• Added gradle plugin for polyglot embedding of Python packages into Java.
• When calling a method on a foreign object in Python code, Python methods are now prioritized over foreign members.
• Added polyglot.register_interop_type and @polyglot.interop_type to define custom Python methods for a given foreign class/type. See the documentation for more information.
• Foreign objects are now given a Python class corresponding to their interop traits.

... (truncated)

Commits

• a88321e [GR-74345] Add initial peak benchmark copies
• a280e3b [GR-21590] Update version numbers for upcoming release.
• c688828 Update version numbers for upcoming release.
• f99e710 [GR-76286] Fix negative sequence slot index handling also for list and mmap.
• 1dc9395 [GR-76680] Add test using a GraalOS Python standalone.
• 79a9c4a [GR-76694] Update graal import
• edd1f9b Fix negative sequence slot index handling.
• ffb50ba Package GraalOS runtime to make graalos standalone and add smoke tests
• e22ce59 Update graal import
• 3c8ff2c [GR-76576] Skip windows jdk21 test paths that trigger native access.
• Additional commits viewable in compare view

Updates org.graalvm.python:python-resources from 25.0.3 to 25.1.3

Changelog

Sourced from org.graalvm.python:python-resources's changelog.

Version 25.1.3

• The standalone artifacts now include the Python version name before the Graal version. The new artifacts now start with graalpy<PYTHON_VERSION>-<GRAAL_VERSION>-<OPERATING_SYSTEM>-<ARCHITECTURE>.
• Standalone JVM artifacts are no longer released as separate distributions. For standalone deployments, use the GraalPy native artifacts. If you require Java interoperability, use our jbang launcher (jbang graalpy@oracle/graalpython -c "print('hello from GraalPy')") or a custom embedding.
• Add -X jit=0|1|2 presets to tune startup-heavy or throughput-oriented workloads, and make the GraalPy launcher default to the jit=1 preset.
• Treat foreign buffer objects as Python buffer-compatible binary objects, so APIs like memoryview, bytes, bytearray, binascii.hexlify, and io.BytesIO work naturally on them when embedding GraalPy in Java. This allows passing binary data between Python and Java's ByteBuffer and ByteSequence types with minimal (sometimes zero) copies.
• Add support for Truffle source options:
  • The python.Optimize option can be used to specify the optimization level, like the -O (level 1) and -OO (level 2) commandline options.
  • The python.NewGlobals option can be used to run a source with a fresh globals dictionary instead of the main module globals, which is useful for embeddings that want isolated top-level execution.
• Intern string literals in source files
• Allocation reporting via Truffle has been removed. Python object sizes were never reported correctly, so the data was misleading and there was a non-neglible overhead for object allocations even when reporting was inactive.
• Better readline support via JLine. Autocompletion and history now works in pdb
• Remove the intrinsified _ctypes module in favor of the native CPython version. This makes GraalPy's ctypes implementation more compatible and reduces the memory footprint of using ctypes.
• Add a new, more natural style of subclassing Java classes from Python by passing the new_style=True keyword. Multiple levels of inheritance are supported, and super() calls both in the constructor override via __new__ as well as in Java method overrides work as expected.
• Add polyglot.gil_locked_during_interop context manager. By default, the global interpreter lock (GIL) is unlocked when interacting with objects from another language, to give other Python threads a chance to run in parallel. While this avoids potential deadlocks, repeated unlocking and locking of the GIL can decrease performance, so this context manager can be used to keep the lock held around short-running interop.
• Add Github workflows that run our gates from the same job definitions as our internal CI. This will make it easier for contributors opening PRs on Github to ensure code contributions pass the same tests that we are running internally.
• Added support for specifying generics on foreign classes, and inheriting from such classes. Especially when using Java classes that support generics, this allows expressing the generic types in Python type annotations as well.
• Added a new java backend for the pyexpat module that uses a Java XML parser instead of the native expat library. It can be useful when running without native access or multiple-context scenarios. This backend is the default when embedding and can be switched back to native expat by setting python.PyExpatModuleBackend option to native. Standalone distribution still defaults to native expat backend.
• Add a new context option python.UnicodeCharacterDatabaseNativeFallback to control whether the ICU database may fall back to the native unicode character database from CPython for features and characters not supported by ICU. This requires native access to be enabled and is disabled by default for embeddings.
• Add a new context option python.AllowSignalHandlers to control whether Python code may install signal handlers. This is disabled by default for Java embedding and enabled in the standalone.
• Add an experimental python.InitializationEntropySource option to control the entropy source used for initialization-only randomness such as hash secret generation and random.Random(None) seeding. This means embeddings and tests can select deterministic or externally provided initialization entropy without affecting cryptographically relevant APIs like os.urandom() or random.SystemRandom().
• Dispatch sys.audit events to hooks registered with sys.addaudithook, including audit events raised through the PySys_Audit C API.
• Foreign temporal objects (dates, times, and timezones) are now given a Python class corresponding to their interop traits, i.e., date, time, datetime, or tzinfo. This allows any foreign objects with these traits to be used in place of the native Python types and Python methods available on these types work on the foreign types.
• Make BouncyCastle an optional dependency for embedding use cases. BouncyCastle is only needed for legacy RSA, DSA, and EC privat keys versions 0 and 1. To support these from Python embeddings, BouncyCastle must now be explicitly enabled by adding the org.graalvm.python:python-bouncycastle-support Maven artifact.
• The GraalPy Native standalone on Linux now uses a lower-footprint Native Image garbage collection configuration. This reduces resident set size (RSS) for many workloads, but may increase startup time and warmup time, and can slow down some workloads.

Version 25.0.1

• Allow users to keep going on unsupported JDK/OS/ARCH combinations at their own risk by opting out of early failure using -Dtruffle.UseFallbackRuntime=true, -Dpolyglot.engine.userResourceCache=/set/to/a/writeable/dir, -Dpolyglot.engine.allowUnsupportedPlatform=true, and -Dpolyglot.python.UnsupportedPlatformEmulates=[linux|macos|windows] and -Dorg.graalvm.python.resources.exclude=native.files.

Version 25.0.0

• sys.implementation.version now returns the GraalPy version instead of the Python version it implements. Also available as sys.graalpy_version_info for better discoverability by people already familiar with PyPy and its sys.pypy_version_info.
• GRAALPY_VERSION_NUM C macro now inlcudes the release level and serial number at the end to conform to the hexversion format. This shouldn't break any existing comparisons.
• dir(foreign_object) now returns both foreign methods and Python methods (it used to return only foreign methods).
• Support __name__, __doc__, __text_signature__ fields on foreign executables to serve as their proper counterparts on the Python side. This is useful to, for example, use Java functional interfaces in lieu of Python functions for things like LangChain's @tool annotation that want to inspect the underlying function.
• Remove support for running C extensions as LLVM bitcode. This also removes the related options python.UseSystemToolchain and python.NativeModules. Isolation of native code when embedding GraalPy into Java projects is now provided via the GraalVM enterprise edition polyglot isolate feature, which can launch in a separate external sub-process by setting the --engine.IsolateMode=external option.
• Remove built-in HPy module. HPy can now be installed and used from the upstream sources.
• Update Python standard library and core to 3.12.8.
• Implement faulthandler.dump_traceback_later to better support testing frameworks that implement resilience to crashes.
• Fix various issues affecting cibuildwheels on Windows, to make it easier for Python projects to provide native extensions for GraalPy on all supported platforms.
• Add support for sharing Arrow arrays and tables between Java, PyArrow, and Pandas to avoid data copying when embedding those libraries into a Java project.
• Enable FTS3, FTS4, FTS5, RTREE, and math function features in the bundled sqlite3 library.
• Add support patches for Torch 2.7.0, PyGObject 3.52.3, xmlschema 4.0.0, lxml < 5.4.0, SciPy 1.15, jq 1.8.0, NumPy < 2.3, ormsgpack < 1.9.1, pandas 2.2.3, PyArrow 19.0, PyMuPDF 1.25.4.
• The GraalPy Native standalone on Linux now uses the G1 garbage collector which is much faster.
• The full-featured Python REPL is now available on GraalPy standalone builds for Windows.

Version 24.2.0

• Updated developer metadata of Maven artifacts.
• Added gradle plugin for polyglot embedding of Python packages into Java.
• When calling a method on a foreign object in Python code, Python methods are now prioritized over foreign members.
• Added polyglot.register_interop_type and @polyglot.interop_type to define custom Python methods for a given foreign class/type. See the documentation for more information.
• Foreign objects are now given a Python class corresponding to their interop traits.

... (truncated)

Commits

• a88321e [GR-74345] Add initial peak benchmark copies
• a280e3b [GR-21590] Update version numbers for upcoming release.
• c688828 Update version numbers for upcoming release.
• f99e710 [GR-76286] Fix negative sequence slot index handling also for list and mmap.
• 1dc9395 [GR-76680] Add test using a GraalOS Python standalone.
• 79a9c4a [GR-76694] Update graal import
• edd1f9b Fix negative sequence slot index handling.
• ffb50ba Package GraalOS runtime to make graalos standalone and add smoke tests
• e22ce59 Update graal import
• 3c8ff2c [GR-76576] Skip windows jdk21 test paths that trigger native access.
• Additional commits viewable in compare view

Updates org.graalvm.truffle:truffle-runtime from 25.0.3 to 25.1.3

Commits

• d9de820 [GR-74345] Append global benchmark filters in PolyBench and implicitly exclud...
• a121746 [GR-76692] Update CI overlay
• 46e72d0 [GR-76684] Add test for build-time invokedynamic/constantdynamic bootstrap me...
• fe5c7d6 [GR-76591] Add Project Terminus docs
• 923ec69 [GR-68442] Update Barista bench suite to be graalhost aware.
• 048c371 [GR-21590] Update version numbers for upcoming release.
• 08de586 [GR-71949] Track nullSeen in Ristretto type profiles.
• 522dfaa Update js import to GraalJS 25.1.3
• b222ccc [GR-61365] Use reflection and service providers for protocol handling.
• 30d7ddb GR-76591 Restore Terminus migration note
• Additional commits viewable in compare view

Updates org.graalvm.truffle:truffle-api from 25.0.3 to 25.1.3

Commits

• d9de820 [GR-74345] Append global benchmark filters in PolyBench and implicitly exclud...
• a121746 [GR-76692] Update CI overlay
• 46e72d0 [GR-76684] Add test for build-time invokedynamic/constantdynamic bootstrap me...
• fe5c7d6 [GR-76591] Add Project Terminus docs
• 923ec69 [GR-68442] Update Barista bench suite to be graalhost aware.
• 048c371 [GR-21590] Update version numbers for upcoming release.
• 08de586 [GR-71949] Track nullSeen in Ristretto type profiles.
• 522dfaa Update js import to GraalJS 25.1.3
• b222ccc [GR-61365] Use reflection and service providers for protocol handling.
• 30d7ddb GR-76591 Restore Terminus migration note
• Additional commits viewable in compare view

Updates com.fasterxml.jackson:jackson-bom from 2.22.0 to 2.22.1

Commits

• b749a0c [maven-release-plugin] prepare release jackson-bom-2.22.1
• 569073f Prep for 2.22.1 release
• 87627b1 Merge branch '2.21' into 2.22
• da540ae Post-release dep version bump
• 5f0462e [maven-release-plugin] prepare for next development iteration
• 252ea90 [maven-release-plugin] prepare release jackson-bom-2.21.5
• 0bbea7f Prep for 2.21.5 release
• f6c940d Post-release dep version bump
• 31cfc40 [maven-release-plugin] prepare for next development iteration
• See full diff in compare view

Updates ch.qos.logback:logback-classic from 1.5.34 to 1.5.38

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.5.38

2026-07-09 Release of logback version 1.5.38

• In HardenedObjectInputStream, fixed a typo preventing Throwable objects from being white-filtered. This issue was reported in [PR #1045](qos-ch/logback#1045) by t0rchwo0d.

• A bitwise identical binary of this version can be reproduced by building from source code at commit d04984a41fce42977466f45a2f076f0ee5cc4207 associated with the tag v_1.5.38. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.37

2026-06-26 Release of logback version 1.5.37

1. • Given the numerous vulnerabilities related to conditional configuration processing based on the evaluation of Java expressions using the Janino library, support for such expressions has been removed. Users are offered the an online migration service or the <condition> element introduced in version 1.5.20. See the relevant documentation for more details.

• A bitwise identical binary of this version can be reproduced by building from source code at commit c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag v_1.5.37. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.36

2026-06-25 Release of logback version 1.5.36

• The 'condition' attribute in <if> elements now reject certain references that are associated with ACE attacks. This issue was reported by "yulate" (yulate531@gmail.com.com) and registered as CVE-2026-13006. Please note that ...

Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.