Skip to content
This repository was archived by the owner on Sep 24, 2026. It is now read-only.

Sync fork with upstream LittleProxy/LittleProxy (resolve open Dependabot alerts) - #23

Closed
jstoneburner wants to merge 1028 commits into
masterfrom
sync-upstream-main-20260923
Closed

Sync fork with upstream LittleProxy/LittleProxy (resolve open Dependabot alerts)#23
jstoneburner wants to merge 1028 commits into
masterfrom
sync-upstream-main-20260923

Conversation

@jstoneburner

@jstoneburner jstoneburner commented Sep 23, 2026

Copy link
Copy Markdown

Summary

  • Merges 1,027 commits from upstream/main (LittleProxy/LittleProxy) into this fork, which was 1,027 commits behind with 119 open Dependabot alerts (15 critical, 61 high, 37 moderate, 6 low), including Log4Shell (CVE-2021-44228), multiple Jackson-databind deserialization RCEs, and several Netty HTTP request-smuggling and TLS/mTLS-bypass CVEs.
  • Bumps core dependencies to upstream's current pinned versions: Netty 4.2.18.Final, Guava 33.7.1-jre, Jackson BOM 2.22.2, Log4j 2.26.1, Jetty 11.0.24, HttpClient 4.5.14, dnsjava 3.6.5.
  • One merge conflict in src/test/java/org/littleshoot/proxy/EndToEndStoppingTest.java, resolved by taking upstream's fully modernized version. Our only fork-specific commit here (SECENG-407, removing a dead commented-out API key) touched code upstream has since rewritten and removed entirely during its own JUnit5/AssertJ modernization, so nothing dronedeploy-specific was lost.
  • No other dronedeploy-specific commits exist on top of the prior merge base.

Test plan

  • mvn package -Psmoke-test (JDK 17): 353 tests, 0 failures, 0 errors, 4 skipped
  • mvn package -Pslow-tests (JDK 17): 370 tests, 0 failures, 0 errors, 6 skipped
  • Shaded jar builds successfully
  • Confirm Dependabot re-scans and clears the alerts against the new dependency versions after merge

🤖 Generated with Claude Code

dependabot Bot and others added 30 commits December 29, 2025 20:44
@dependabot @asolntsev
Bump org.wiremock:wiremock-standalone from 3.10.0 to 3.13.2
2921e13 
Bumps [org.wiremock:wiremock-standalone](https://github.com/wiremock/wiremock) from 3.10.0 to 3.13.2.
- [Release notes](https://github.com/wiremock/wiremock/releases)
- [Commits](wiremock/wiremock@3.10.0...3.13.2)

---
updated-dependencies:
- dependency-name: org.wiremock:wiremock-standalone
  dependency-version: 3.13.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@clescot Charles Lescot
Feature/activity tracker logging (LittleProxy#668)
b569b71 
* feat: Add configurable logging activity tracker with `--activity-log-format` option.

* feat: Add ELF, W3C, LTSV, CSV, and HAProxy activity log formats with configuration options, programmatic API, and documentation.

* docs: add release note for explicit logging support with activity_log_format option.

* feat: Introduce unique connection IDs and configure an access logger for activity tracking.

* docs: Add documentation for customizing Log4j logging, including examples for separating access logs to console or a dedicated file.

* fix pull request number

* fix AtomicLong import.

* replace Date by ZonedDateTime

* LoggingActivityTracker.java is renamed to ActivityLogger.java

---------

Co-authored-by: Charles Lescot <charles@merovia.net>
@dependabot @asolntsev
Bump org.sonatype.central:central-publishing-maven-plugin
c0871e1 
Bumps [org.sonatype.central:central-publishing-maven-plugin](https://github.com/sonatype/central-publishing-maven-plugin) from 0.9.0 to 0.10.0.
- [Commits](https://github.com/sonatype/central-publishing-maven-plugin/commits)

---
updated-dependencies:
- dependency-name: org.sonatype.central:central-publishing-maven-plugin
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump com.fasterxml.jackson:jackson-bom from 2.20.1 to 2.21.0
d140df3 
Bumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 2.20.1 to 2.21.0.
- [Commits](FasterXML/jackson-bom@jackson-bom-2.20.1...jackson-bom-2.21.0)

---
updated-dependencies:
- dependency-name: com.fasterxml.jackson:jackson-bom
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump dnsjava:dnsjava from 3.6.3 to 3.6.4
1b4c58c 
Bumps [dnsjava:dnsjava](https://github.com/dnsjava/dnsjava) from 3.6.3 to 3.6.4.
- [Release notes](https://github.com/dnsjava/dnsjava/releases)
- [Changelog](https://github.com/dnsjava/dnsjava/blob/master/Changelog)
- [Commits](dnsjava/dnsjava@v3.6.3...v3.6.4)

---
updated-dependencies:
- dependency-name: dnsjava:dnsjava
  dependency-version: 3.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump org.codehaus.mojo:versions-maven-plugin from 2.20.1 to 2.21.0
b9abcbb 
Bumps [org.codehaus.mojo:versions-maven-plugin](https://github.com/mojohaus/versions) from 2.20.1 to 2.21.0.
- [Release notes](https://github.com/mojohaus/versions/releases)
- [Changelog](https://github.com/mojohaus/versions/blob/master/ReleaseNotes.md)
- [Commits](mojohaus/versions@2.20.1...2.21.0)

---
updated-dependencies:
- dependency-name: org.codehaus.mojo:versions-maven-plugin
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump org.junit.jupiter:junit-jupiter-api from 5.13.4 to 6.0.2
9032e59 
Bumps [org.junit.jupiter:junit-jupiter-api](https://github.com/junit-team/junit-framework) from 5.13.4 to 6.0.2.
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](junit-team/junit-framework@r5.13.4...r6.0.2)

---
updated-dependencies:
- dependency-name: org.junit.jupiter:junit-jupiter-api
  dependency-version: 6.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump org.seleniumhq.selenium:selenium-java from 4.39.0 to 4.40.0
2934a99 
Bumps [org.seleniumhq.selenium:selenium-java](https://github.com/SeleniumHQ/selenium) from 4.39.0 to 4.40.0.
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Commits](SeleniumHQ/selenium@selenium-4.39.0...selenium-4.40.0)

---
updated-dependencies:
- dependency-name: org.seleniumhq.selenium:selenium-java
  dependency-version: 4.40.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@asolntsev
compile&run tests with java17
3fee314 
The latest JUnit 6 requires Java17+.
@clescot Charles Lescot
move littleproxy.properties and log4j.xml in standard maven location (L…
e9de219 
…ittleProxy#667)

* move littleproxy.properties and log4j.xml in standard maven location (src/main/resources)
* add getFreePort() method to ProxyUtils
* assign a free port to startAndStopProxyServer() method to avoid the race error "port is already bound"

* load default_log4j.xml file if no config_file is set.
default_log4j.xml does not trigger a log file creation, to avoid any issues with project's sources.

* disable a sonar rule and explain why
* fix default_log4j.xml

* extract start method (non static) for testability

* extract getOptions method

* extract configureLogging method.

* remove default properties file.

* fix properties file loading.

* remove jmx dummy option.
change idle_connection_timeout to have a different value than the default one.

* using DOMConfigurator.configure() when loading default_log4j.xml file (never change), and DOMConfigurator.configureAndWatch() for a custom log config file.

* add to the IllegalArgumentException, the ParseException as the lastArgument, to not loose the initial problem.
We transform an Exception (a checked exception) into a RuntimeException (unchecked exception), that is an usual practice in java development (does not pollute the method signature in cascade).

* rename default log4j file into littleproxy_default_log4j.xml

* create config directory, provide a littleproxy.properties file example, and update the README.md.

---------

Co-authored-by: Charles Lescot <charles@merovia.net>
@asolntsev
release LittleProxy 2.6.0
0a8498d
@asolntsev
working on LittleProxy 2.6.1
765eb2a
@clescot Charles Lescot
Fix issue 680 generated jks and cert at root (LittleProxy#681)
444dcfe 
* define default JKS Keystore path

* pass custom JKS Keystore path as a param

* customize for each unit test the  jks_kesytore filename.

* remove deprecated method HttpProxyServerBootstrap#withTransportProtocol (does nothing).


---------

Co-authored-by: Charles Lescot <charles@merovia.net>
@asolntsev
fix flaky tests that fail because "random free port" was occupied
8869f86 
We can always pass "port=0" to LittleProxy - then it automatically picks a random free port (which usually doesn't fail).
@clescot Charles Lescot
Add spotless formatting plugin (LittleProxy#682)
af4dd06 
* add spotless formatting plugin

---------

Co-authored-by: Charles Lescot <charles@merovia.net>
@dependabot @asolntsev
Bump org.assertj:assertj-core from 3.27.6 to 3.27.7
8aded16 
Bumps [org.assertj:assertj-core](https://github.com/assertj/assertj) from 3.27.6 to 3.27.7.
- [Release notes](https://github.com/assertj/assertj/releases)
- [Commits](assertj/assertj@assertj-build-3.27.6...assertj-build-3.27.7)

---
updated-dependencies:
- dependency-name: org.assertj:assertj-core
  dependency-version: 3.27.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump com.diffplug.spotless:spotless-maven-plugin from 2.46.1 to 3.2.0
2b1890a 
Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 2.46.1 to 3.2.0.
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](diffplug/spotless@maven/2.46.1...lib/3.2.0)

---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-version: 3.2.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump org.apache.maven.plugins:maven-compiler-plugin
55b99b6 
Bumps [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) from 3.14.1 to 3.15.0.
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.14.1...maven-compiler-plugin-3.15.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-version: 3.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump com.diffplug.spotless:spotless-maven-plugin from 3.2.0 to 3.2.1
9dd1111 
Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.2.0 to 3.2.1.
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](diffplug/spotless@lib/3.2.0...maven/3.2.1)

---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-version: 3.2.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@clescot Charles Lescot @asolntsev
migration to log4j2 and async logging available (LittleProxy#684)
a68b521 
* migration to log4j2 ok.

* sort alphabetically properties (ending with version).

* add async logging handling

* add PERFORMANCE_AND_LOGGING.md

* replace the use of netty-all by netty-bom and required netty modules.

* replace log4j-slf4j2-impl scope provided by optional.
insert extraArtifacts in shade plugin configuration.

* move in pom.xml 'com.lmax:disruptor' dependency to the 'logging' block with a comment explaining async log4j2 requirement.

* fix uri field which was missing scheme, host and port when method is not CONNECT.

* add ASYNC_ACCESS_LOG_FILE for async access log. console and access log file are filled with activityLogger in the async log configuration.

---------

Co-authored-by: Charles Lescot <charles@merovia.net>
Co-authored-by: Andrei Solntsev <andrei.solntsev@gmail.com>
Charles Lescot @asolntsev
add request handling architecture document.
8cb2385
@dependabot @asolntsev
Bump com.diffplug.spotless:spotless-maven-plugin from 3.2.0 to 3.2.1
bf1cb18 
Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.2.0 to 3.2.1.
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](diffplug/spotless@lib/3.2.0...maven/3.2.1)

---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-version: 3.2.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump netty.version from 4.2.9.Final to 4.2.10.Final
34485e0 
Bumps `netty.version` from 4.2.9.Final to 4.2.10.Final.

Updates `io.netty:netty-example` from 4.2.9.Final to 4.2.10.Final
- [Commits](netty/netty@netty-4.2.9.Final...netty-4.2.10.Final)

Updates `io.netty:netty-bom` from 4.2.9.Final to 4.2.10.Final
- [Commits](netty/netty@netty-4.2.9.Final...netty-4.2.10.Final)

---
updated-dependencies:
- dependency-name: io.netty:netty-example
  dependency-version: 4.2.10.Final
  dependency-type: direct:development
  update-type: version-update:semver-patch
- dependency-name: io.netty:netty-bom
  dependency-version: 4.2.10.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@clescot Charles Lescot
464 little proxy authentication bug (LittleProxy#691)
c462036 
* fix upstream proxy authentication
* add unit test to demonstrate the bug.

---------

Co-authored-by: Charles Lescot <charles@merovia.net>
@asolntsev
Stop the launcher after every test
8006849 
Otherwise, all the launchers keep running until the end of ALL tests (and only then stopped by JVM shutdown hook).
@asolntsev
stably wait until the server gets started and stopped
a84084d 
... instead of sleeping 100ms and 1000ms which is not stable.

Sometimes start may take more than 100ms.
Sometimes shutdown may take more than 1000ms.
etc.
@dependabot @asolntsev
Bump org.apache.maven.plugins:maven-dependency-plugin
975dacf 
Bumps [org.apache.maven.plugins:maven-dependency-plugin](https://github.com/apache/maven-dependency-plugin) from 3.9.0 to 3.10.0.
- [Release notes](https://github.com/apache/maven-dependency-plugin/releases)
- [Commits](apache/maven-dependency-plugin@maven-dependency-plugin-3.9.0...maven-dependency-plugin-3.10.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-dependency-plugin
  dependency-version: 3.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Charles Lescot @asolntsev
fix LittleProxy#56
265b526 
test bug reported in LittleProxy#56
unit test succeed: bug is no longer present (if this unit test reproduce accurately the reported bug.
@asolntsev
start making thread dumps earlier for @timeout tests
168e3f1 
By default, we start taking thread dumps after 8 seconds. But some tests are annotated with @timeout(5) - they fail before the 8th second. And we don't get thread dumps for these tests when they fail. :(
@asolntsev
add test name to thread name during test execution
38fdf8c 
It will make easier to read thread dumps and understand which thread to which test is related.
asolntsev and others added 27 commits August 17, 2026 01:19
@asolntsev @claude
Document project scope in CONTRIBUTING.md
76ece9d 
LittleProxy aims to stay a small, focused library; ask contributors to
discuss new features first, and point them to BrowserUp Proxy for a
richer feature set built on top of LittleProxy.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@dependabot @asolntsev
Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2
fd2563e 
Bumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 2.22.1 to 2.22.2.
- [Commits](FasterXML/jackson-bom@jackson-bom-2.22.1...jackson-bom-2.22.2)

---
updated-dependencies:
- dependency-name: com.fasterxml.jackson:jackson-bom
  dependency-version: 2.22.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump com.google.guava:guava from 33.6.0-jre to 33.7.0-jre
fbca9a0 
Bumps [com.google.guava:guava](https://github.com/google/guava) from 33.6.0-jre to 33.7.0-jre.
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

---
updated-dependencies:
- dependency-name: com.google.guava:guava
  dependency-version: 33.7.0-jre
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump com.diffplug.spotless:spotless-maven-plugin from 3.9.0 to 3.10.0
a585fe5 
Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.9.0 to 3.10.0.
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](diffplug/spotless@maven/3.9.0...maven/3.10.0)

---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-version: 3.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump com.google.guava:guava from 33.7.0-jre to 33.7.1-jre
56145df 
Bumps [com.google.guava:guava](https://github.com/google/guava) from 33.7.0-jre to 33.7.1-jre.
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

---
updated-dependencies:
- dependency-name: com.google.guava:guava
  dependency-version: 33.7.1-jre
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump actions/setup-java from 5 to 6
29157f4 
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5 to 6.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@v5...v6)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@asolntsev
2.9.1: Bump Selenium from 4.47.0 to 4.48.0
90223ed
Aleksi Stoyanov @asolntsev
Allow SslEngineSource to control client certificate authentication mode
2608d99 
This PR lets callers request (rather than require) a client certificate,
without LittleProxy overriding the SSLEngine's client-auth configuration:

- ProxyConnection.encrypt() now calls setNeedClientAuth(true) only when
  authenticateClients is true; when false, the SSLEngine's client-auth
  setting is left exactly as the SslEngineSource created it
- This lets an SslEngineSource opt into setWantClientAuth(true) (or Netty's
  ClientAuth.OPTIONAL), which was previously always reset to need-auth
- Updated Javadoc on both encrypt() overloads and on
  HttpProxyServerBootstrap.withAuthenticateSslClients(boolean) to document
  the new "leave the engine untouched" semantics for authenticateClients=false

Backward compatible: the default authenticateSslClients=true continues to map
to setNeedClientAuth(true); for false, the previous setNeedClientAuth(false)
was a no-op on a freshly created engine.

Signed-off-by: Aleksi Stoyanov <aleksis@omnissa.com>
@asolntsev
workng on LittleProxy 2.10.0
521d822
@dependabot @asolntsev
Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.0 to 3.10.1
578ba39 
Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.10.0 to 3.10.1.
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](diffplug/spotless@maven/3.10.0...maven/3.10.1)

---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-version: 3.10.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump org.apache.maven.plugins:maven-surefire-report-plugin
6997649 
Bumps [org.apache.maven.plugins:maven-surefire-report-plugin](https://github.com/apache/maven-surefire) from 3.5.6 to 3.6.0.
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.5.6...surefire-3.6.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-surefire-report-plugin
  dependency-version: 3.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0
bcec904 
Bumps [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) from 3.5.6 to 3.6.0.
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](apache/maven-surefire@surefire-3.5.6...surefire-3.6.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump org.apache.maven.plugins:maven-compiler-plugin
ac63b97 
Bumps [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) from 3.15.0 to 3.16.0.
- [Release notes](https://github.com/apache/maven-compiler-plugin/releases)
- [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.15.0...maven-compiler-plugin-3.16.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-compiler-plugin
  dependency-version: 3.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump org.slf4j:slf4j-api from 2.0.18 to 2.0.19
80bae26 
Bumps org.slf4j:slf4j-api from 2.0.18 to 2.0.19.

---
updated-dependencies:
- dependency-name: org.slf4j:slf4j-api
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.1 to 3.10.2
19616de 
Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 3.10.1 to 3.10.2.
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](diffplug/spotless@maven/3.10.1...maven/3.10.2)

---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-version: 3.10.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@clescot
remove storpot and commons-pool 2 implementations
87559ad
@clescot
Merge pull request LittleProxy#724 from clescot/issue-83-shared-proxy…
9a28732 
…-to-server-connection-pool

Issue 83 shared proxy to server connection pool
@clescot
remove stormpot and commons-pool 2 references in README.md
68f8643
@clescot
Merge branch 'main' into issue-83-shared-proxy-to-server-connection-pool
3c4e353
@clescot
Merge pull request LittleProxy#799 from clescot/issue-83-shared-proxy…
cf72532 
…-to-server-connection-pool

Issue 83 shared proxy to server connection pool (remove some remaining references in doc)
@dependabot @asolntsev
Bump org.seleniumhq.selenium:selenium-java from 4.48.0 to 4.49.0
e7ed218 
Bumps [org.seleniumhq.selenium:selenium-java](https://github.com/SeleniumHQ/selenium) from 4.48.0 to 4.49.0.
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Commits](SeleniumHQ/selenium@selenium-4.48.0...selenium-4.49.0)

---
updated-dependencies:
- dependency-name: org.seleniumhq.selenium:selenium-java
  dependency-version: 4.49.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump netty.version from 4.2.17.Final to 4.2.18.Final
7f75ff1 
Bumps `netty.version` from 4.2.17.Final to 4.2.18.Final.

Updates `io.netty:netty-example` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

Updates `io.netty:netty-bom` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

---
updated-dependencies:
- dependency-name: io.netty:netty-bom
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: io.netty:netty-example
  dependency-version: 4.2.18.Final
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump org.codehaus.mojo:versions-maven-plugin from 2.21.0 to 2.22.0
2e7d861 
Bumps [org.codehaus.mojo:versions-maven-plugin](https://github.com/mojohaus/versions) from 2.21.0 to 2.22.0.
- [Release notes](https://github.com/mojohaus/versions/releases)
- [Changelog](https://github.com/mojohaus/versions/blob/master/ReleaseNotes.md)
- [Commits](mojohaus/versions@2.21.0...2.22.0)

---
updated-dependencies:
- dependency-name: org.codehaus.mojo:versions-maven-plugin
  dependency-version: 2.22.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump org.codehaus.mojo:taglist-maven-plugin from 3.2.2 to 3.2.3
adcf195 
Bumps [org.codehaus.mojo:taglist-maven-plugin](https://github.com/mojohaus/taglist-maven-plugin) from 3.2.2 to 3.2.3.
- [Release notes](https://github.com/mojohaus/taglist-maven-plugin/releases)
- [Commits](mojohaus/taglist-maven-plugin@taglist-maven-plugin-3.2.2...3.2.3)

---
updated-dependencies:
- dependency-name: org.codehaus.mojo:taglist-maven-plugin
  dependency-version: 3.2.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump org.apache.maven.plugins:maven-install-plugin from 3.1.4 to 3.2.0
a6fcb14 
Bumps [org.apache.maven.plugins:maven-install-plugin](https://github.com/apache/maven-install-plugin) from 3.1.4 to 3.2.0.
- [Release notes](https://github.com/apache/maven-install-plugin/releases)
- [Commits](apache/maven-install-plugin@maven-install-plugin-3.1.4...maven-install-plugin-3.2.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-install-plugin
  dependency-version: 3.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @asolntsev
Bump org.apache.maven.plugins:maven-deploy-plugin from 3.1.4 to 3.2.0
aaccf5b 
Bumps [org.apache.maven.plugins:maven-deploy-plugin](https://github.com/apache/maven-deploy-plugin) from 3.1.4 to 3.2.0.
- [Release notes](https://github.com/apache/maven-deploy-plugin/releases)
- [Commits](apache/maven-deploy-plugin@maven-deploy-plugin-3.1.4...maven-deploy-plugin-3.2.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-deploy-plugin
  dependency-version: 3.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@jstoneburner
Merge remote-tracking branch 'upstream/main' into sync-upstream-main-…
d969210 
…20260923

# Conflicts:
#	src/test/java/org/littleshoot/proxy/EndToEndStoppingTest.java
github-advanced-security[bot]
github-advanced-security Bot found potential problems Sep 23, 2026
View reviewed changes
Comment thread src/main/java/org/littleshoot/proxy/extras/SelfSignedSslEngineSource.java

// Initialize the SSLContext to work with our key managers.
sslContext = SSLContext.getInstance(PROTOCOL);
sslContext.init(keyManagers, trustManagers, null);
@jstoneburner

jstoneburner commented Sep 23, 2026

Copy link
Copy Markdown
Author

Closing without merging: this repo is confirmed unused anywhere in the org (no consumer, no deploy pipeline, dormant since 2019) and is being archived instead of kept current. No reviewer path exists either (no active owning team). See conversation history for the upstream-sync work if this repo is ever unarchived and reactivated.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

1 more reviewer
@github-advanced-security github-advanced-security[bot] github-advanced-security[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@jstoneburner @github-advanced-security @clescot @asolntsev @c00ler @BlueInf