• #42976 - Quarkus REST in NATIVE - abstract resources with @Path requires impl. to be CDI beans while RESTEasy does not
• #45257 - update guide on writing extension regarding docs generation
• #45791 - Range response status reset when using a @ServerResponseFilter
• #55119 - Use branch instead of version to avoid dead link on main guides
• #55674 - context propagation not working correctly
• #55739 - Fix race in AeshLauncherImpl causing flaky test timeouts
• #55835 - Quarkus 3.38 in dev mode - WARNING: java.lang.foreign.Linker::downcallHandle has been called by org.aesh.terminal.tty.impl.LibC in an unnamed module
• #55962 - Enable WebSocket traffic logging in aesh websocket tests
• #55999 - [Docs]: Lift and Shift review of Deploying to OpenShift guide
• #56018 - Aesh: fix flaky WebSocket tests on Semeru by closing WebSocketClient
• #56103 - Mention the quarkus-config-doc-maven-plugin
• #56106 - Add licenses for generic file components in SBOMs
• #56120 - Move SSH enabled config to build time and gate all processor build steps
• #56129 - Fix wrapWithSpan context propagation
• #56153 - Keep the 206 status of Range responses when the JAX-RS response has been materialized
• #56222 - Make sure the callouts follow the Asciidoc syntax
• #56240 - Update redirect instructions for Roq
• #56279 - Security overview guide style review (3.40)
• #56301 - Upgrade aesh to 3.17.5 and improve AeshLauncher test framework
• #56336 - [3.39] Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine
• #56340 - Add a packaging overview guide
• #56346 - Manage projectreactor in the bom, update to 3.8.7
• #56348 - Update building-docs skill and docs-preview.sh for Roq migration
• #56354 - Upgrade hibernate ORM from 7.4.5.Final to 7.4.7.Final
• #56357 - [3.39] backport of doc improvement
• #56359 - Check Keycloak token type on the OIDC server-less verification path
• #56365 - [3.39] Upgrade RESTEasy to 6.2.18.Final
• #56374 - Remove warning from PeriodicMetricReader
• #56386 - Style and syntax violations in docs callouts
• #56389 - Do not use attributes in guide title to work around Roq/Yupiik limitation
• #56391 - Fix numbered callout lists in documentation examples
• #56393 - ReactiveRedisDataSource.withConnection leaks pool permit when cancelled before connection is acquired
• #56395 - Suppress PeriodicMetricReader exporter warnings
• #56400 - rest-jackson: ContextResolver result cached by entity class, dropping the media type from the key
• #56402 - rest-jackson: SecurityCustomSerialization caches its ObjectWriter in a JVM-wide static field, dropping the ObjectMapper from the key
• #56408 - Update the logging guide for supported APIs
• #56413 - Redis client: fix connection leaks caused by cancellation during acquisition
• #56424 - Quarkus REST: fix native mode when abstract resource with path is extended by a subclass without paths
• #56425 - Doc - place callout lists after source listings
• #56429 - Typo fixes in websockets-next guides
• #56430 - Ensure FullyFeaturedServerJacksonMessageBodyWriter uses media type properly
• #56431 - Ensure SecurityCustomSerialization uses ContextResolver
• #56432 - Remove orphaned callout markers with missing explanations
• #56444 - Drop steps for discarded toc plugin in docs preview
• #56449 - Fix remaining callout list placement issues in docs
• #56470 - [3.39] Decouple types discovery and generation of reflection-free Jackson serializers
• #56480 - fix: align docs-preview.sh default port to 8042
• #56487 - Update to Avro 1.12.2, auto-trust Avro-generated classes, add properties to configure additional Avro-trusted classes
• #56489 - SBOM component to product attribution
• #56493 - Certificate reload skips restored certificates by comparing against startup snapshot
• #56497 - [3.39] SBOM CPE attribution
• #56498 - Ensure restoring certificate to original works

• 0a5e0e7: [build] Reset versions to nightly after selenium-4.49.0 release (Selenium CI Bot)
• 60238b4: Update mirror info (Wed Sep 9 15:45:10 UTC 2026) (Selenium CI Bot)
• 56636ca: [build] key the repository cache on its trigger files and cache the Selenium Manager binaries (Titus Fortner)
• cec4b03: [build] retry the Bazel run once after a transient download failure (Titus Fortner)
• e44e60b: [build] pass secrets to the release verify job so it can query Sonatype (Titus Fortner)
• ca5effb: [rust] drop stale note that Selenium Manager cannot be built locally on Windows (Titus Fortner)
• 135dd70: [build] do not compute test targets for a release (Titus Fortner)
• eebe911: [build] support passing multiple targets to bazel execute (Titus Fortner)
• abc6eec: [build] build all Java release targets in one Bazel invocation (Titus Fortner)
• e56ba7d: [build] start the Selenium Manager release build after the CDP check instead of after the trunk lock (Titus Fortner)

• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
• CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

• Auto-port 4.1: Use X509ExtendedTrustManager in SSLErrorTest by @netty-project-bot in https://github.com/netty/netty/pull/17224
• Auto-port 4.1: Validate chunked-must-be-last regardless of HTTP version by @netty-project-bot in https://github.com/netty/netty/pull/17228
• Update junit version by @normanmaurer in https://github.com/netty/netty/pull/17233
• Auto-port 4.1: Add system property to disable RFC 6761 localhost resolution by @netty-project-bot in https://github.com/netty/netty/pull/17230
• Update setup-testlens to v1.9.4 (#17223) by @chrisvest in https://github.com/netty/netty/pull/17229
• Auto-port 4.1: Adjust failsafe plugin version to be in sync with surefire plugin by @netty-project-bot in https://github.com/netty/netty/pull/17241
• Auto-port 4.1: Release unsent LastHttpContent in HttpChunkedInput by @netty-project-bot in https://github.com/netty/netty/pull/17251
• Auto-port 4.1: HTTP/2: Release compressors after failed headers writes by @netty-project-bot in https://github.com/netty/netty/pull/17265
• Auto-port 4.1: HTTP/2: Prevent reentrant flush on writability change by @netty-project-bot in https://github.com/netty/netty/pull/17268
• Respect max messages per read in LocalServerChannel (#17255) by @normanmaurer in https://github.com/netty/netty/pull/17269
• Auto-port 4.1: HTTP: Preserve encoder state after header encoding failures by @netty-project-bot in https://github.com/netty/netty/pull/17275
• Bzip2: Correctly detect overflow during block size bound check (#17261) by @normanmaurer in https://github.com/netty/netty/pull/17273
• Auto-port 4.1: HTTP/2: Drain queued frames stranded by a writability change during flush by @netty-project-bot in https://github.com/netty/netty/pull/17280
• Port to 4.1: Add clock skew tolerance to OcspServerCertificateValidator by @normanmaurer in https://github.com/netty/netty/pull/17282
• Extract Bootstrap and ServerBootstrap setup to a common method (#15134) by @normanmaurer in https://github.com/netty/netty/pull/17289
• Release channel when FixedChannelPool acquire is cancelled (#17287) by @normanmaurer in https://github.com/netty/netty/pull/17291
• Auto-port 4.1: HTTP: Release content encoder after header mutation failure by @netty-project-bot in https://github.com/netty/netty/pull/17294
• Auto-port 4.1: Add a script that can download GHSA vulnerability reports by @netty-project-bot in https://github.com/netty/netty/pull/17302
• Auto-port 4.1: FileRegion: Remove outdated JDK upgrade warning by @netty-project-bot in https://github.com/netty/netty/pull/17311
• Auto-port 4.1: codec-dns: Fix query OPCODE bit offset and mask by @netty-project-bot in https://github.com/netty/netty/pull/17316
• Auto-port 4.1: Install patchelf as part of awslc docker image generation by @netty-project-bot in https://github.com/netty/netty/pull/17322
• Auto-port 4.1: POOL: Close active unhealthy channels on release by @netty-project-bot in https://github.com/netty/netty/pull/17319
• Update to use graal 21 by @normanmaurer in https://github.com/netty/netty/pull/17327
• Auto-port 4.1: Add more logging to CompositeBufferGatheringWriteTest to help diagnose flaky test by @netty-project-bot in https://github.com/netty/netty/pull/17329
• Fix graal docker file usage by @normanmaurer in https://github.com/netty/netty/pull/17333
• Auto-port 4.1: codec-dns: Report and allow setting full 16-bit EDNS(0) flags field by @netty-project-bot in https://github.com/netty/netty/pull/17332
• Kqueue: Continue reading when EOF is received before notify about channel inactivity by @normanmaurer in https://github.com/netty/netty/pull/17309
• Auto-port 4.1: Fix MQTT 5 properties length decoding for multi-byte Property Length (4.2 branch) by @netty-project-bot in https://github.com/netty/netty/pull/17338
• Auto-port 4.1: Increase timeout in test to address flakyness by @netty-project-bot in https://github.com/netty/netty/pull/17345
• Auto-port 4.1: DatagramUnicastIpv6MappedTest should explicit bind to ipv4 address to make test less flaky by @netty-project-bot in https://github.com/netty/netty/pull/17347
• Close Channel when connect is cancelled during resolution (#17321) by @normanmaurer in https://github.com/netty/netty/pull/17349
• Auto-port 4.1: Channel: Add unit tests for AbstractChannel edge-case failures and buffer releases by @netty-project-bot in https://github.com/netty/netty/pull/17351
• Auto-port 4.1: Http2: Cleanup child channel method signatures by @netty-project-bot in https://github.com/netty/netty/pull/17355
• Auto-port 4.1: Update to latest netty-tcnative release by @netty-project-bot in https://github.com/netty/netty/pull/17361
• Auto-port 4.1: Update to latest netty-jni-util release by @netty-project-bot in https://github.com/netty/netty/pull/17365
• Fix JdkZlibDecoder silently truncating highly compressible streams by @renechoi in https://github.com/netty/netty/pull/17364
• Auto-port 4.1: ByteBufUtil.HexUtil.HEXDUMP_TABLE array length 256*2 is enough by @netty-project-bot in https://github.com/netty/netty/pull/17369
• Auto-port 4.1: Update to latest netty tcnative version by @netty-project-bot in https://github.com/netty/netty/pull/17398
• Bulk merge for 4.1 by @normanmaurer in https://github.com/netty/netty/pull/17403

Full Changelog: https://github.com/netty/netty/compare/netty-4.1.137.Final...netty-4.1.138.Final

• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
• CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

• Use X509ExtendedTrustManager in SSLErrorTest by @normanmaurer in https://github.com/netty/netty/pull/17221
• Update setup-testlens to v1.9.4 by @marcphilipp in https://github.com/netty/netty/pull/17223
• Update lz4-java to 1.11.2 by @yawkat in https://github.com/netty/netty/pull/17222
• Validate chunked-must-be-last regardless of HTTP version by @husseinvr97 in https://github.com/netty/netty/pull/17055
• Add system property to disable RFC 6761 localhost resolution by @BoxJReilly in https://github.com/netty/netty/pull/17100
• Use VarHandle JCTools queues without Unsafe by @arnabnandy7 in https://github.com/netty/netty/pull/17185
• Adjust failsafe plugin version to be in sync with surefire plugin by @normanmaurer in https://github.com/netty/netty/pull/17236
• Fix NPE in AbstractNioChannel.removeReadOp() after concurrent deregistration by @seonwooj0810 in https://github.com/netty/netty/pull/17104
• Fix codec-native-quic published POM packaging by @arnabnandy7 in https://github.com/netty/netty/pull/17235
• http3: marshal QPACK resume/drain to stream event loop (fixes #17234) by @arnabnandy7 in https://github.com/netty/netty/pull/17232
• Release unsent LastHttpContent in HttpChunkedInput by @Gimini-3 in https://github.com/netty/netty/pull/17240
• Ensure OCSP is also tested with out native implementation by @normanmaurer in https://github.com/netty/netty/pull/17220
• QUIC: Delete local references as soon as possible in the JNI layer by @normanmaurer in https://github.com/netty/netty/pull/17258
• Decouple QUIC token validation from ODCID derivation by @Zhengcy05 in https://github.com/netty/netty/pull/17035
• HTTP/2: Release compressors after failed headers writes by @Gimini-3 in https://github.com/netty/netty/pull/17253
• HTTP/2: Prevent reentrant flush on writability change by @arnabnandy7 in https://github.com/netty/netty/pull/17266
• Respect max messages per read in LocalServerChannel by @Gimini-3 in https://github.com/netty/netty/pull/17255
• Bzip2: Correctly detect overflow during block size bound check by @normanmaurer in https://github.com/netty/netty/pull/17261
• HTTP: Preserve encoder state after header encoding failures by @Gimini-3 in https://github.com/netty/netty/pull/17271
• HTTP/2: Drain queued frames stranded by a writability change during flush by @bryce-anderson in https://github.com/netty/netty/pull/17279
• OSCP: Add clock skew tolerance to OcspServerCertificateValidator by @chrisvest in https://github.com/netty/netty/pull/17277
• Release channel when FixedChannelPool acquire is cancelled by @Gimini-3 in https://github.com/netty/netty/pull/17287
• HTTP: Release content encoder after header mutation failure by @Gimini-3 in https://github.com/netty/netty/pull/17292
• Correctly mark org.jctools:jctools-core-jdk11 as non optional by @normanmaurer in https://github.com/netty/netty/pull/17263
• Update flatten plugin and use flattenDependecyMode direct by @normanmaurer in https://github.com/netty/netty/pull/17296
• Add a script that can download GHSA vulnerability reports by @chrisvest in https://github.com/netty/netty/pull/17297
• FileRegion: Remove outdated JDK upgrade warning by @arnabnandy7 in https://github.com/netty/netty/pull/17308
• codec-dns: Fix query OPCODE bit offset and mask by @hyperxpro in https://github.com/netty/netty/pull/17314
• POOL: Close active unhealthy channels on release by @Gimini-3 in https://github.com/netty/netty/pull/17306
• QPACK: Correctly encode varint even when remainder is 128 by @normanmaurer in https://github.com/netty/netty/pull/17310
• Install patchelf as part of awslc docker image generation by @normanmaurer in https://github.com/netty/netty/pull/17317
• Add more logging to CompositeBufferGatheringWriteTest to help diagnose flaky test by @normanmaurer in https://github.com/netty/netty/pull/17313
• codec-dns: Report and allow setting full 16-bit EDNS(0) flags field by @hyperxpro in https://github.com/netty/netty/pull/17325
• Protobuf: Update protobuf-javanano to non alpha release by @normanmaurer in https://github.com/netty/netty/pull/17330
• Port EOF handling test by @normanmaurer in https://github.com/netty/netty/pull/17336
• Fix MQTT 5 properties length decoding for multi-byte Property Length (4.2 branch) by @dometec in https://github.com/netty/netty/pull/17105
• io_uring: do not release write memory that the kernel still owns by @HwangRock in https://github.com/netty/netty/pull/17238
• DatagramUnicastIpv6MappedTest should explicit bind to ipv4 address to make test less flaky by @normanmaurer in https://github.com/netty/netty/pull/17343
• Auto-port 4.2: Increase timeout in test to address flakyness by @netty-project-bot in https://github.com/netty/netty/pull/17344
• Close Channel when connect is cancelled during resolution by @Gimini-3 in https://github.com/netty/netty/pull/17321
• Channel: Add unit tests for AbstractChannel edge-case failures and buffer releases by @rajan-github in https://github.com/netty/netty/pull/17340
• Http2: Cleanup child channel method signatures by @normanmaurer in https://github.com/netty/netty/pull/17350
• QPACK: Only call firstByteEquals(...) when we actually have readables bytes in decodeLiteralValue(...) by @normanmaurer in https://github.com/netty/netty/pull/17352
• Update to latest netty-tcnative release by @normanmaurer in https://github.com/netty/netty/pull/17359
• Update to latest netty-jni-util release by @normanmaurer in https://github.com/netty/netty/pull/17363
• Make the Linux codec-native-quic artifacts loadable on musl (Alpine) by @fredericgermain in https://github.com/netty/netty/pull/17348
• ByteBufUtil.HexUtil.HEXDUMP_TABLE array length 256*2 is enough by @panchenko in https://github.com/netty/netty/pull/17357
• IoUring: Expose tcp_info by @normanmaurer in https://github.com/netty/netty/pull/17354
• Auto-port 4.2: Fix JdkZlibDecoder silently truncating highly compressible streams by @netty-project-bot in https://github.com/netty/netty/pull/17370
• Add missing EOF handling test for io_uring by @normanmaurer in https://github.com/netty/netty/pull/17374
• QUIC: Add missing NULL checks in native code to handle gracefully OOM by @normanmaurer in https://github.com/netty/netty/pull/17378
• Fix JZlibDecoder truncating highly compressible streams by @renechoi in https://github.com/netty/netty/pull/17392
• Fix typos in comments/javadoc by @TianHengZhuang in https://github.com/netty/netty/pull/17390
• Update to latest netty tcnative version by @normanmaurer in https://github.com/netty/netty/pull/17395
• Update quiche to 0.29.2 by @normanmaurer in https://github.com/netty/netty/pull/17393
• Bulk merge for 4.2 by @normanmaurer in https://github.com/netty/netty/pull/17402

• @marcphilipp made their first contribution in https://github.com/netty/netty/pull/17223
• @BoxJReilly made their first contribution in https://github.com/netty/netty/pull/17100
• @arnabnandy7 made their first contribution in https://github.com/netty/netty/pull/17185
• @Gimini-3 made their first contribution in https://github.com/netty/netty/pull/17240
• @Zhengcy05 made their first contribution in https://github.com/netty/netty/pull/17035
• @dometec made their first contribution in https://github.com/netty/netty/pull/17105
• @fredericgermain made their first contribution in https://github.com/netty/netty/pull/17348
• @panchenko made their first contribution in https://github.com/netty/netty/pull/17357
• @TianHengZhuang made their first contribution in https://github.com/netty/netty/pull/17390

Full Changelog: https://github.com/netty/netty/compare/netty-4.2.17.Final...netty-4.2.18.Final

Java     |     Python     |     DotNet     |     Ruby     |     JavaScript

• [build] improve pre-release workflow ordering by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17963
• [build] track the generated BiDi schema by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17962
• [dotnet] [bidi] Fix various missing fields in DTO by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17961
• [dotnet] [bidi] Fix mismatch of proxy json property names by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17960
• [dotnet] [bidi] Fix realm type enum serialization by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17959
• [dotnet] [bidi] Fix NamespaceUri json property name by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17958
• [dotnet] [bidi] Avoid massive command descriptors allocation by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17965
• [dotnet] [bidi] Add browsing context screencast support by @nvborisenko in https://github.com/SeleniumHQ/selenium/pull/17941
• [js][py] Capitalize non-Latin text in the getVisibleText atom by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17964
• [js][py][rb] derive BiDi field names and enum value types in the schema by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17966
• [py] chore fix for unreachable mypy warnings by @iampopovich in https://github.com/SeleniumHQ/selenium/pull/17969
• [py] wire print_pdf_tests.py into the browser test suites by @diemol in https://github.com/SeleniumHQ/selenium/pull/17976
• [build] generate compact execution log by @iamricard in https://github.com/SeleniumHQ/selenium/pull/17977
• [py] chore: enable mypy disallow untyped decorators and update type hints by @iampopovich in https://github.com/SeleniumHQ/selenium/pull/17974
• [grid] Fix 500 when downloading a file whose name contains spaces by @ashrafiucse in https://github.com/SeleniumHQ/selenium/pull/17968
• [java] add the LICENSE and NOTICE files to the jars created by @joerg1985 in https://github.com/SeleniumHQ/selenium/pull/17601
• [java] Remove deprecated GET /session/{sessionId}/se/files/{fileName} endpoint by @diemol in https://github.com/SeleniumHQ/selenium/pull/17982
• [java] shrink published javadoc jars by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17957
• [build] pin the rules_rs zlib bootstrap to an immutable snapshot by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17985
• [build] add a daily workflow to update the pinned CDDL specs by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17972
• [rust] fix Windows architecture detection under WOW64 by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17987
• [build] build Selenium Manager Linux binaries natively and pin the Rust toolchain by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17988
• [py] run the BiDi tests against the Grid server by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17980
• [py] fix flaky BiDi input tests that raced the page's autofocus by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17981
• [py] raise typed WebDriver errors for BiDi wire error codes by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17952
• [build] bump rules_rs to 0.0.108 by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17997
• [py] remove stale xfail markers from python tests by @aayushisabharwal in https://github.com/SeleniumHQ/selenium/pull/18002
• [build] populate linux bazel cache from gh-cache workflow instead of RBE by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/18003
• [dotnet] only embed the git revision in SourceLink metadata when stamping by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/18004
• [build] run Rust tests and build Selenium Manager from source on Windows by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17998
• [build] ship prebuilt Selenium Manager Linux arm64 binary in all bindings by @titusfortner in https://github.com/SeleniumHQ/selenium/pull/17999
• [java] remove try-catch while opening a new window #17754 by @joerg1985 in https://github.com/SeleniumHQ/selenium/pull/17996
• [build] add Launchpad fallback for the rules_rs zlib .deb fetch by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/18006
• [build] Upgrade rules_rs to 0.0.109 and @llvm to 0.8.19 by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17929
• [py] add BiDi upload tests that verify files actually reach the server by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/18007
• [rust] Add license and notice links to Selenium Manager help by @shubmittal in https://github.com/SeleniumHQ/selenium/pull/17986
• [rust] Add support for Chrome arm64 on Linux by @dennisameling in https://github.com/SeleniumHQ/selenium/pull/17915
• [java] remove let's guess URI encoding by @joerg1985 in https://github.com/SeleniumHQ/selenium/pull/17995
• [py] adopt the worthwhile ruff 0.16 rule families (tranches 1 and 2) by @AutomatedTester in https://github.com/SeleniumHQ/selenium/pull/17992

• @iamricard made their first contribution in https://github.com/SeleniumHQ/selenium/pull/17977
• @ashrafiucse made their first contribution in https://github.com/SeleniumHQ/selenium/pull/17968
• @aayushisabharwal made their first contribution in https://github.com/SeleniumHQ/selenium/pull/18002
• @shubmittal made their first contribution in https://github.com/SeleniumHQ/selenium/pull/17986

Full Changelog: https://github.com/SeleniumHQ/selenium/compare/selenium-4.48.0...selenium-4.49.0

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.581...7.21.0-rc.582

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.580...7.21.0-rc.581