[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.jline:jline-terminal-ffm	4.4.6 → 4.4.7
org.jline:jline-terminal-jni	4.4.6 → 4.4.7
org.jline:jline-reader	4.4.6 → 4.4.7
org.jline:jline-terminal	4.4.6 → 4.4.7

---

Release Notes

jline/jline3 (org.jline:jline-terminal-ffm)

v4.4.7: JLine 4.4.7

Compare Source

JLine 4.4.7 is a security and bug fix release addressing two security vulnerabilities and one rendering correctness bug.

The history /PATTERN search in HistoryCommands was compiling user-supplied regex patterns with a raw Pattern.compile + Matcher.find() call, with no execution-time guard — the only unprotected regex path in the project. A pathological pattern like (a+)+z would hang the session thread indefinitely via catastrophic backtracking (GHSA-vrw4-fppg-3rhf). The fix routes through SafeRegex, consistent with all other regex call sites. The telnet NEW-ENVIRON handler (TelnetIO.readNEVariables) enforced its 100-variable limit only within a single subnegotiation frame via a local counter that reset on each call. An unauthenticated client could send multiple frames to accumulate an unbounded number of environment entries and exhaust server heap (GHSA-7qh2-r6cc-r47w, bypassing the incomplete fix for CVE-2026-56740); the fix also checks the persistent connection-level map size. Finally, AttributedStringBuilder.setLength did not recompute lastLineLength after truncation, causing subsequent tab stops to be calculated against the wrong position; three regression tests covering cleared builder, newline removal, and last-line shortening were added by the contributor.

🐛 Bug Fixes

• fix: guard history /pattern regex search against ReDoS via SafeRegex (#​2286) @​gnodet
• fix: enforce NEW-ENVIRON variable limit across frames to prevent memory exhaustion (#​2287) @​gnodet
• fix: recompute tab position after truncation (#​2305) @​PHJ2000

📦 Dependency Updates

• chore: bump sshd.version from 2.19.0 to 2.20.0
• chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.10.2 to 3.10.3
• chore: bump com.palantir.javaformat:palantir-java-format from 2.98.0 to 2.100.0
• chore: bump slf4j.version from 2.0.19 to 2.0.20 (#​2289)
• chore: bump org.graalvm.sdk:graal-sdk from 25.3.4.1 to 25.4.4.1.1 (#​2292)

Full Changelog: jline/jline3@4.4.6...4.4.7

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.