[dependabot]

Bumps org.jline:jline-terminal from 4.4.6 to 4.4.8.

Release notes

Sourced from org.jline:jline-terminal's releases.

JLine 4.4.8 is a bugfix and enhancement release addressing an AnsiConsole stream-routing bug and improving command help output.

The AnsiConsole fix corrects a long-standing issue where ansiStream() used terminal.output() for both stdout and stderr, causing the non-terminal-backed stream to be silently redirected to the wrong file descriptor (for example, stderr output going to stdout when the terminal was selected via SysOut). The fix routes each stream to its correct fd: the terminal-backed stream goes through terminal.output(), while the other writes to the original system stream. ANSI mode for the non-terminal-backed stream is now auto-detected per-fd (preserving colors when it is a tty, stripping when redirected), with jansi.out.mode/jansi.err.mode properties still honoured as overrides. The enhancement from @​FSeidinger makes detailed command help richer: it now displays every non-empty line of the main description via CommandDescription#describe(), argument descriptions appear alongside argument names, and additional description lines are indented beneath the first for easier reading.

🐛 Bug Fixes

• fix: AnsiConsole.systemInstall() no longer redirects the non-terminal stream to the wrong fd (#2317) @​gnodet

✨ Enhancements

• feat: use detailed command description via describe() in command help (#2318) @​FSeidinger

📦 Dependency Updates

• chore: bump release-drafter/release-drafter from 7.7.0 to 7.9.0 (#2313) @​dependabot[bot]
• chore: bump com.palantir.javaformat:palantir-java-format from 2.101.0 to 2.102.0 (#2314, #2315) @​dependabot[bot]

Full Changelog: jline/jline3@4.4.7...4.4.8

JLine 4.4.7 is a security and bug fix release addressing two security vulnerabilities and one rendering correctness bug.

The history /PATTERN search in HistoryCommands was compiling user-supplied regex patterns with a raw Pattern.compile + Matcher.find() call, with no execution-time guard — the only unprotected regex path in the project. A pathological pattern like (a+)+z would hang the session thread indefinitely via catastrophic backtracking (GHSA-vrw4-fppg-3rhf). The fix routes through SafeRegex, consistent with all other regex call sites. The telnet NEW-ENVIRON handler (TelnetIO.readNEVariables) enforced its 100-variable limit only within a single subnegotiation frame via a local counter that reset on each call. An unauthenticated client could send multiple frames to accumulate an unbounded number of environment entries and exhaust server heap (GHSA-7qh2-r6cc-r47w, bypassing the incomplete fix for CVE-2026-56740); the fix also checks the persistent connection-level map size. Finally, AttributedStringBuilder.setLength did not recompute lastLineLength after truncation, causing subsequent tab stops to be calculated against the wrong position; three regression tests covering cleared builder, newline removal, and last-line shortening were added by the contributor.

🐛 Bug Fixes

• fix: guard history /pattern regex search against ReDoS via SafeRegex (#2286) @​gnodet
• fix: enforce NEW-ENVIRON variable limit across frames to prevent memory exhaustion (#2287) @​gnodet
• fix: recompute tab position after truncation (#2305) @​PHJ2000

📦 Dependency Updates

• chore: bump sshd.version from 2.19.0 to 2.20.0
• chore: bump com.diffplug.spotless:spotless-maven-plugin from 3.10.2 to 3.10.3
• chore: bump com.palantir.javaformat:palantir-java-format from 2.98.0 to 2.100.0
• chore: bump slf4j.version from 2.0.19 to 2.0.20 (#2289)
• chore: bump org.graalvm.sdk:graal-sdk from 25.3.4.1 to 25.4.4.1.1 (#2292)

Full Changelog: jline/jline3@4.4.6...4.4.7

Commits

• 72c9a4c chore: bump release-drafter/release-drafter from 7.7.0 to 7.9.0 (#2313)
• 325273d chore: bump com.palantir.javaformat:palantir-java-format (#2314)
• 4317b63 feat: use detailed command description via describe() in command help
• f5a5c53 fix: AnsiConsole.systemInstall() no longer redirects the non-terminal stream ...
• d1bffae chore: bump com.palantir.javaformat:palantir-java-format (#2312)
• 71607ed chore: upgrade Docusaurus from 3.7.0 to 3.10.2 to fix website build with webp...
• 78a846d chore: pin webpackbar to ^6.0.0 to fix website build with webpack 5.106+
• 29e069d docs: fix web-swing-terminals demo section to reference Launcher (fixes #2301)
• 26920f0 fix: recompute tab position after truncation
• fb1cd27 chore: bump com.palantir.javaformat:palantir-java-format from 2.98.0 to 2.100.0
• Additional commits viewable in compare view

[tzok]

@dependabot rebase