Skip to content

chore(deps): Bump djl-version from 0.36.0 to 0.37.0 - #26235

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/djl-version-0.37.0
Open

chore(deps): Bump djl-version from 0.36.0 to 0.37.0#26235
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/djl-version-0.37.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor

Bumps djl-version from 0.36.0 to 0.37.0.
Updates ai.djl:api from 0.36.0 to 0.37.0

Release notes

Sourced from ai.djl:api's releases.

DJL v0.37.0 Release

This is the v0.37.0 release of DJL.

Changes

  • Bundled .java compilation and remote URL loading are now configurable, with tightened defaults (#3875)
  • Bumped log4j to 2.26.0 (#3877)
  • onnxruntime: allow sub-managers after NDManager.cap() (#3870)
  • Docs: fixed a typo (#3874)

Behavior changes

Two loading behaviors changed their defaults in #3875. Both previous behaviors remain available, but from this release each has to be enabled explicitly:

Behavior Default To restore
Compile bundled .java sources at model load off DJL_COMPILE_JAVA=true or -Dai.djl.compile_java=true
Unrestricted remote URL loading off DJL_ALLOW_INSECURE_URL=true or -Dai.djl.allow_insecure_url=true

Utils.openUrl now limits remote fetches to public http(s) destinations, resolves redirects explicitly with a bounded hop count, and allows file: and jar: only where they denote a local read. Loading from local directories, s3://, gs://, public http(s) archives, the djl:// model zoo and Hugging Face is unchanged. See the PR description for the full list and the flags.

Known issues / limitations

  • A model whose translator is available only as a raw .java file under lib/classes/ will not have it compiled by default; an error-level log names the flag. Models shipping a precompiled .class or .jar, or supplying a translator programmatically, are unaffected.
  • Loading a model over http(s) from a host that resolves to a private address now fails by default. Set the flag above if you serve models from an internal mirror.

Contributors

Thank you to the following community members for contributing to this release:

Rohit Kumar Srivastava, Vaibhav Srivastava, dev_Hakaze

Commits
  • 9d3fca3 Remove -SNAPSHOT for release v0.37.0
  • 3e888a9 Increase DJL version to 0.37.0
  • 1cb7449 [build] Bump log4j to 2.26.0 (#3877)
  • 02b4111 [api] Make bundled Java compilation opt-in and restrict remote URL loading (#...
  • e263d0d [docs] fix typo benifit -> benefit (#3874)
  • 1d6e058 fix(onnxruntime): allow sub-managers after NDManager.cap() (#3870)
  • 33caa1d fix(audio): use 32768.0f for 16-bit PCM normalization (#3869)
  • af1d0b8 Revert "Fix JNI memory safety issues in native utils (#3825)" (#3868)
  • 417016a Bump protobuf in /extensions/tokenizers/src/main/python (#3842)
  • 96599bb Bump com.fasterxml.jackson.core:jackson-databind from 2.19.2 to 2.21.5 (#3867)
  • Additional commits viewable in compare view

Updates ai.djl.timeseries:timeseries from 0.36.0 to 0.37.0

Release notes

Sourced from ai.djl.timeseries:timeseries's releases.

DJL v0.37.0 Release

This is the v0.37.0 release of DJL.

Changes

  • Bundled .java compilation and remote URL loading are now configurable, with tightened defaults (#3875)
  • Bumped log4j to 2.26.0 (#3877)
  • onnxruntime: allow sub-managers after NDManager.cap() (#3870)
  • Docs: fixed a typo (#3874)

Behavior changes

Two loading behaviors changed their defaults in #3875. Both previous behaviors remain available, but from this release each has to be enabled explicitly:

Behavior Default To restore
Compile bundled .java sources at model load off DJL_COMPILE_JAVA=true or -Dai.djl.compile_java=true
Unrestricted remote URL loading off DJL_ALLOW_INSECURE_URL=true or -Dai.djl.allow_insecure_url=true

Utils.openUrl now limits remote fetches to public http(s) destinations, resolves redirects explicitly with a bounded hop count, and allows file: and jar: only where they denote a local read. Loading from local directories, s3://, gs://, public http(s) archives, the djl:// model zoo and Hugging Face is unchanged. See the PR description for the full list and the flags.

Known issues / limitations

  • A model whose translator is available only as a raw .java file under lib/classes/ will not have it compiled by default; an error-level log names the flag. Models shipping a precompiled .class or .jar, or supplying a translator programmatically, are unaffected.
  • Loading a model over http(s) from a host that resolves to a private address now fails by default. Set the flag above if you serve models from an internal mirror.

Contributors

Thank you to the following community members for contributing to this release:

Rohit Kumar Srivastava, Vaibhav Srivastava, dev_Hakaze

Commits
  • 9d3fca3 Remove -SNAPSHOT for release v0.37.0
  • 3e888a9 Increase DJL version to 0.37.0
  • 1cb7449 [build] Bump log4j to 2.26.0 (#3877)
  • 02b4111 [api] Make bundled Java compilation opt-in and restrict remote URL loading (#...
  • e263d0d [docs] fix typo benifit -> benefit (#3874)
  • 1d6e058 fix(onnxruntime): allow sub-managers after NDManager.cap() (#3870)
  • 33caa1d fix(audio): use 32768.0f for 16-bit PCM normalization (#3869)
  • af1d0b8 Revert "Fix JNI memory safety issues in native utils (#3825)" (#3868)
  • 417016a Bump protobuf in /extensions/tokenizers/src/main/python (#3842)
  • 96599bb Bump com.fasterxml.jackson.core:jackson-databind from 2.19.2 to 2.21.5 (#3867)
  • Additional commits viewable in compare view

Updates ai.djl:model-zoo from 0.36.0 to 0.37.0

Release notes

Sourced from ai.djl:model-zoo's releases.

DJL v0.37.0 Release

This is the v0.37.0 release of DJL.

Changes

  • Bundled .java compilation and remote URL loading are now configurable, with tightened defaults (#3875)
  • Bumped log4j to 2.26.0 (#3877)
  • onnxruntime: allow sub-managers after NDManager.cap() (#3870)
  • Docs: fixed a typo (#3874)

Behavior changes

Two loading behaviors changed their defaults in #3875. Both previous behaviors remain available, but from this release each has to be enabled explicitly:

Behavior Default To restore
Compile bundled .java sources at model load off DJL_COMPILE_JAVA=true or -Dai.djl.compile_java=true
Unrestricted remote URL loading off DJL_ALLOW_INSECURE_URL=true or -Dai.djl.allow_insecure_url=true

Utils.openUrl now limits remote fetches to public http(s) destinations, resolves redirects explicitly with a bounded hop count, and allows file: and jar: only where they denote a local read. Loading from local directories, s3://, gs://, public http(s) archives, the djl:// model zoo and Hugging Face is unchanged. See the PR description for the full list and the flags.

Known issues / limitations

  • A model whose translator is available only as a raw .java file under lib/classes/ will not have it compiled by default; an error-level log names the flag. Models shipping a precompiled .class or .jar, or supplying a translator programmatically, are unaffected.
  • Loading a model over http(s) from a host that resolves to a private address now fails by default. Set the flag above if you serve models from an internal mirror.

Contributors

Thank you to the following community members for contributing to this release:

Rohit Kumar Srivastava, Vaibhav Srivastava, dev_Hakaze

Commits
  • 9d3fca3 Remove -SNAPSHOT for release v0.37.0
  • 3e888a9 Increase DJL version to 0.37.0
  • 1cb7449 [build] Bump log4j to 2.26.0 (#3877)
  • 02b4111 [api] Make bundled Java compilation opt-in and restrict remote URL loading (#...
  • e263d0d [docs] fix typo benifit -> benefit (#3874)
  • 1d6e058 fix(onnxruntime): allow sub-managers after NDManager.cap() (#3870)
  • 33caa1d fix(audio): use 32768.0f for 16-bit PCM normalization (#3869)
  • af1d0b8 Revert "Fix JNI memory safety issues in native utils (#3825)" (#3868)
  • 417016a Bump protobuf in /extensions/tokenizers/src/main/python (#3842)
  • 96599bb Bump com.fasterxml.jackson.core:jackson-databind from 2.19.2 to 2.21.5 (#3867)
  • Additional commits viewable in compare view

Updates ai.djl.mxnet:mxnet-model-zoo from 0.36.0 to 0.37.0

Release notes

Sourced from ai.djl.mxnet:mxnet-model-zoo's releases.

DJL v0.37.0 Release

This is the v0.37.0 release of DJL.

Changes

  • Bundled .java compilation and remote URL loading are now configurable, with tightened defaults (#3875)
  • Bumped log4j to 2.26.0 (#3877)
  • onnxruntime: allow sub-managers after NDManager.cap() (#3870)
  • Docs: fixed a typo (#3874)

Behavior changes

Two loading behaviors changed their defaults in #3875. Both previous behaviors remain available, but from this release each has to be enabled explicitly:

Behavior Default To restore
Compile bundled .java sources at model load off DJL_COMPILE_JAVA=true or -Dai.djl.compile_java=true
Unrestricted remote URL loading off DJL_ALLOW_INSECURE_URL=true or -Dai.djl.allow_insecure_url=true

Utils.openUrl now limits remote fetches to public http(s) destinations, resolves redirects explicitly with a bounded hop count, and allows file: and jar: only where they denote a local read. Loading from local directories, s3://, gs://, public http(s) archives, the djl:// model zoo and Hugging Face is unchanged. See the PR description for the full list and the flags.

Known issues / limitations

  • A model whose translator is available only as a raw .java file under lib/classes/ will not have it compiled by default; an error-level log names the flag. Models shipping a precompiled .class or .jar, or supplying a translator programmatically, are unaffected.
  • Loading a model over http(s) from a host that resolves to a private address now fails by default. Set the flag above if you serve models from an internal mirror.

Contributors

Thank you to the following community members for contributing to this release:

Rohit Kumar Srivastava, Vaibhav Srivastava, dev_Hakaze

Commits
  • 9d3fca3 Remove -SNAPSHOT for release v0.37.0
  • 3e888a9 Increase DJL version to 0.37.0
  • 1cb7449 [build] Bump log4j to 2.26.0 (#3877)
  • 02b4111 [api] Make bundled Java compilation opt-in and restrict remote URL loading (#...
  • e263d0d [docs] fix typo benifit -> benefit (#3874)
  • 1d6e058 fix(onnxruntime): allow sub-managers after NDManager.cap() (#3870)
  • 33caa1d fix(audio): use 32768.0f for 16-bit PCM normalization (#3869)
  • af1d0b8 Revert "Fix JNI memory safety issues in native utils (#3825)" (#3868)
  • 417016a Bump protobuf in /extensions/tokenizers/src/main/python (#3842)
  • 96599bb Bump com.fasterxml.jackson.core:jackson-databind from 2.19.2 to 2.21.5 (#3867)
  • Additional commits viewable in compare view

Updates ai.djl.mxnet:mxnet-engine from 0.36.0 to 0.37.0

Release notes

Sourced from ai.djl.mxnet:mxnet-engine's releases.

DJL v0.37.0 Release

This is the v0.37.0 release of DJL.

Changes

  • Bundled .java compilation and remote URL loading are now configurable, with tightened defaults (#3875)
  • Bumped log4j to 2.26.0 (#3877)
  • onnxruntime: allow sub-managers after NDManager.cap() (#3870)
  • Docs: fixed a typo (#3874)

Behavior changes

Two loading behaviors changed their defaults in #3875. Both previous behaviors remain available, but from this release each has to be enabled explicitly:

Behavior Default To restore
Compile bundled .java sources at model load off DJL_COMPILE_JAVA=true or -Dai.djl.compile_java=true
Unrestricted remote URL loading off DJL_ALLOW_INSECURE_URL=true or -Dai.djl.allow_insecure_url=true

Utils.openUrl now limits remote fetches to public http(s) destinations, resolves redirects explicitly with a bounded hop count, and allows file: and jar: only where they denote a local read. Loading from local directories, s3://, gs://, public http(s) archives, the djl:// model zoo and Hugging Face is unchanged. See the PR description for the full list and the flags.

Known issues / limitations

  • A model whose translator is available only as a raw .java file under lib/classes/ will not have it compiled by default; an error-level log names the flag. Models shipping a precompiled .class or .jar, or supplying a translator programmatically, are unaffected.
  • Loading a model over http(s) from a host that resolves to a private address now fails by default. Set the flag above if you serve models from an internal mirror.

Contributors

Thank you to the following community members for contributing to this release:

Rohit Kumar Srivastava, Vaibhav Srivastava, dev_Hakaze

Commits
  • 9d3fca3 Remove -SNAPSHOT for release v0.37.0
  • 3e888a9 Increase DJL version to 0.37.0
  • 1cb7449 [build] Bump log4j to 2.26.0 (#3877)
  • 02b4111 [api] Make bundled Java compilation opt-in and restrict remote URL loading (#...
  • e263d0d [docs] fix typo benifit -> benefit (#3874)
  • 1d6e058 fix(onnxruntime): allow sub-managers after NDManager.cap() (#3870)
  • 33caa1d fix(audio): use 32768.0f for 16-bit PCM normalization (#3869)
  • af1d0b8 Revert "Fix JNI memory safety issues in native utils (#3825)" (#3868)
  • 417016a Bump protobuf in /extensions/tokenizers/src/main/python (#3842)
  • 96599bb Bump com.fasterxml.jackson.core:jackson-databind from 2.19.2 to 2.21.5 (#3867)
  • Additional commits viewable in compare view

Updates ai.djl.pytorch:pytorch-model-zoo from 0.36.0 to 0.37.0

Release notes

Sourced from ai.djl.pytorch:pytorch-model-zoo's releases.

DJL v0.37.0 Release

This is the v0.37.0 release of DJL.

Changes

  • Bundled .java compilation and remote URL loading are now configurable, with tightened defaults (#3875)
  • Bumped log4j to 2.26.0 (#3877)
  • onnxruntime: allow sub-managers after NDManager.cap() (#3870)
  • Docs: fixed a typo (#3874)

Behavior changes

Two loading behaviors changed their defaults in #3875. Both previous behaviors remain available, but from this release each has to be enabled explicitly:

Behavior Default To restore
Compile bundled .java sources at model load off DJL_COMPILE_JAVA=true or -Dai.djl.compile_java=true
Unrestricted remote URL loading off DJL_ALLOW_INSECURE_URL=true or -Dai.djl.allow_insecure_url=true

Utils.openUrl now limits remote fetches to public http(s) destinations, resolves redirects explicitly with a bounded hop count, and allows file: and jar: only where they denote a local read. Loading from local directories, s3://, gs://, public http(s) archives, the djl:// model zoo and Hugging Face is unchanged. See the PR description for the full list and the flags.

Known issues / limitations

  • A model whose translator is available only as a raw .java file under lib/classes/ will not have it compiled by default; an error-level log names the flag. Models shipping a precompiled .class or .jar, or supplying a translator programmatically, are unaffected.
  • Loading a model over http(s) from a host that resolves to a private address now fails by default. Set the flag above if you serve models from an internal mirror.

Contributors

Thank you to the following community members for contributing to this release:

Rohit Kumar Srivastava, Vaibhav Srivastava, dev_Hakaze

Commits
  • 9d3fca3 Remove -SNAPSHOT for release v0.37.0
  • 3e888a9 Increase DJL version to 0.37.0
  • 1cb7449 [build] Bump log4j to 2.26.0 (#3877)
  • 02b4111 [api] Make bundled Java compilation opt-in and restrict remote URL loading (#...
  • e263d0d [docs] fix typo benifit -> benefit (#3874)
  • 1d6e058 fix(onnxruntime): allow sub-managers after NDManager.cap() (#3870)
  • 33caa1d fix(audio): use 32768.0f for 16-bit PCM normalization (#3869)
  • af1d0b8 Revert "Fix JNI memory safety issues in native utils (#3825)" (#3868)
  • 417016a Bump protobuf in /extensions/tokenizers/src/main/python (#3842)
  • 96599bb Bump com.fasterxml.jackson.core:jackson-databind from 2.19.2 to 2.21.5 (#3867)
  • Additional commits viewable in compare view

Updates ai.djl.pytorch:pytorch-engine from 0.36.0 to 0.37.0

Release notes

Sourced from ai.djl.pytorch:pytorch-engine's releases.

DJL v0.37.0 Release

This is the v0.37.0 release of DJL.

Changes

  • Bundled .java compilation and remote URL loading are now configurable, with tightened defaults (#3875)
  • Bumped log4j to 2.26.0 (#3877)
  • onnxruntime: allow sub-managers after NDManager.cap() (#3870)
  • Docs: fixed a typo (#3874)

Behavior changes

Two loading behaviors changed their defaults in #3875. Both previous behaviors remain available, but from this release each has to be enabled explicitly:

Behavior Default To restore
Compile bundled .java sources at model load off DJL_COMPILE_JAVA=true or -Dai.djl.compile_java=true
Unrestricted remote URL loading off DJL_ALLOW_INSECURE_URL=true or -Dai.djl.allow_insecure_url=true

Utils.openUrl now limits remote fetches to public http(s) destinations, resolves redirects explicitly with a bounded hop count, and allows file: and jar: only where they denote a local read. Loading from local directories, s3://, gs://, public http(s) archives, the djl:// model zoo and Hugging Face is unchanged. See the PR description for the full list and the flags.

Known issues / limitations

  • A model whose translator is available only as a raw .java file under lib/classes/ will not have it compiled by default; an error-level log names the flag. Models shipping a precompiled .class or .jar, or supplying a translator programmatically, are unaffected.
  • Loading a model over http(s) from a host that resolves to a private address now fails by default. Set the flag above if you serve models from an internal mirror.

Contributors

Thank you to the following community members for contributing to this release:

Rohit Kumar Srivastava, Vaibhav Srivastava, dev_Hakaze

Commits
  • 9d3fca3 Remove -SNAPSHOT for release v0.37.0
  • 3e888a9 Increase DJL version to 0.37.0
  • 1cb7449 [build] Bump log4j to 2.26.0 (#3877)
  • 02b4111 [api] Make bundled Java compilation opt-in and restrict remote URL loading (#...
  • e263d0d [docs] fix typo benifit -> benefit (#3874)
  • 1d6e058 fix(onnxruntime): allow sub-managers after NDManager.cap() (#3870)
  • 33caa1d fix(audio): use 32768.0f for 16-bit PCM normalization (#3869)
  • af1d0b8 Revert "Fix JNI memory safety issues in native utils (#3825)" (#3868)
  • 417016a Bump protobuf in /extensions/tokenizers/src/main/python (#3842)
  • 96599bb Bump com.fasterxml.jackson.core:jackson-databind from 2.19.2 to 2.21.5 (#3867)
  • Additional commits viewable in compare view

Updates ai.djl.tensorflow:tensorflow-model-zoo from 0.36.0 to 0.37.0

Release notes

Sourced from ai.djl.tensorflow:tensorflow-model-zoo's releases.

DJL v0.37.0 Release

This is the v0.37.0 release of DJL.

Changes

  • Bundled .java compilation and remote URL loading are now configurable, with tightened defaults (#3875)
  • Bumped log4j to 2.26.0 (#3877)
  • onnxruntime: allow sub-managers after NDManager.cap() (#3870)
  • Docs: fixed a typo (#3874)

Behavior changes

Two loading behaviors changed their defaults in #3875. Both previous behaviors remain available, but from this release each has to be enabled explicitly:

Behavior Default To restore
Compile bundled .java sources at model load off DJL_COMPILE_JAVA=true or -Dai.djl.compile_java=true
Unrestricted remote URL loading off DJL_ALLOW_INSECURE_URL=true or -Dai.djl.allow_insecure_url=true

Utils.openUrl now limits remote fetches to public http(s) destinations, resolves redirects explicitly with a bounded hop count, and allows file: and jar: only where they denote a local read. Loading from local directories, s3://, gs://, public http(s) archives, the djl:// model zoo and Hugging Face is unchanged. See the PR description for the full list and the flags.

Known issues / limitations

  • A model whose translator is available only as a raw .java file under lib/classes/ will not have it compiled by default; an error-level log names the flag. Models shipping a precompiled .class or .jar, or supplying a translator programmatically, are unaffected.
  • Loading a model over http(s) from a host that resolves to a private address now fails by default. Set the flag above if you serve models from an internal mirror.

Contributors

Thank you to the following community members for contributing to this release:

Rohit Kumar Srivastava, Vaibhav Srivastava, dev_Hakaze

Commits
  • 9d3fca3 Remove -SNAPSHOT for release v0.37.0
  • 3e888a9 Increase DJL version to 0.37.0
  • 1cb7449 [build] Bump log4j to 2.26.0 (#3877)
  • 02b4111 [api] Make bundled Java compilation opt-in and restrict remote URL loading (#...
  • e263d0d [docs] fix typo benifit -> benefit (#3874)
  • 1d6e058 fix(onnxruntime): allow sub-managers after NDManager.cap() (#3870)
  • 33caa1d fix(audio): use 32768.0f for 16-bit PCM normalization (#3869)
  • af1d0b8 Revert "Fix JNI memory safety issues in native utils (#3825)" (#3868)
  • 417016a Bump protobuf in /extensions/tokenizers/src/main/python (#3842)
  • 96599bb Bump com.fasterxml.jackson.core:jackson-databind from 2.19.2 to 2.21.5 (#3867)
  • Additional commits viewable in compare view

Updates ai.djl.tensorflow:tensorflow-engine from 0.36.0 to 0.37.0

Release notes

Sourced from ai.djl.tensorflow:tensorflow-engine's releases.

DJL v0.37.0 Release

This is the v0.37.0 release of DJL.

Changes

  • Bundled .java compilation and remote URL loading are now configurable, with tightened defaults (#3875)
  • Bumped log4j to 2.26.0 (#3877)
  • onnxruntime: allow sub-managers after NDManager.cap() (#3870)
  • Docs: fixed a typo (#3874)

Behavior changes

Two loading behaviors changed their defaults in #3875. Both previous behaviors remain available, but from this release each has to be enabled explicitly:

Behavior Default To restore
Compile bundled .java sources at model load off DJL_COMPILE_JAVA=true or -Dai.djl.compile_java=true
Unrestricted remote URL loading off DJL_ALLOW_INSECURE_URL=true or -Dai.djl.allow_insecure_url=true

Utils.openUrl now limits remote fetches to public http(s) destinations, resolves redirects explicitly with a bounded hop count, and allows file: and jar: only where they denote a local read. Loading from local directories, s3://, gs://, public http(s) archives, the djl:// model zoo and Hugging Face is unchanged. See the PR description for the full list and the flags.

Known issues / limitations

  • A model whose translator is available only as a raw .java file under lib/classes/ will not have it compiled by default; an error-level log names the flag. Models shipping a precompiled .class or .jar, or supplying a translator programmatically, are unaffected.
  • Loading a model over http(s) from a host that resolves to a private address now fails by default. Set the flag above if you serve models from an internal mirror.

Contributors

Thank you to the following community members for contributing to this release:

Rohit Kumar Srivastava, Vaibhav Srivastava, dev_Hakaze

Commits
  • 9d3fca3 Remove -SNAPSHOT for release v0.37.0
  • 3e888a9 Increase DJL version to 0.37.0
  • 1cb7449 [build] Bump log4j to 2.26.0 (#3877)
  • 02b4111 [api] Make bundled Java compilation opt-in and restrict remote URL loading (#...
  • e263d0d [docs] fix typo benifit -> benefit (#3874)
  • 1d6e058 fix(onnxruntime): allow sub-managers after NDManager.cap() (#3870)
  • 33caa1d fix(audio): use 32768.0f for 16-bit PCM normalization (#3869)
  • af1d0b8 Revert "Fix JNI memory safety issues in native utils (#3825)" (#3868)
  • 417016a Bump protobuf in /extensions/tokenizers/src/main/python (#3842)
  • 96599bb Bump com.fasterxml.jackson.core:jackson-databind from 2.19.2 to 2.21.5 (#3867)
  • Additional commits viewable in compare view

Updates ai.djl.tensorflow:tensorflow-api from 0.36.0 to 0.37.0

Release notes

Sourced from ai.djl.tensorflow:tensorflow-api's releases.

DJL v0.37.0 Release

This is the v0.37.0 release of DJL.

Changes

  • Bundled .java compilation and remote URL loading are now configurable, with tightened defaults (#3875)
  • Bumped log4j to 2.26.0 (#3877)
  • onnxruntime: allow sub-managers after NDManager.cap() (#3870)
  • Docs: fixed a typo (#3874)

Behavior changes

Two loading behaviors changed their defaults in #3875. Both previous behaviors remain available, but from this release each has to be enabled explicitly:

Behavior Default To restore
Compile bundled .java sources at model load off DJL_COMPILE_JAVA=true or -Dai.djl.compile_java=true
Unrestricted remote URL loading off DJL_ALLOW_INSECURE_URL=true or -Dai.djl.allow_insecure_url=true

Utils.openUrl now limits remote fetches to public http(s) destinations, resolves redirects explicitly with a bounded hop count, and allows file: and jar: only where they denote a local read. Loading from local directories, s3://, gs://, public http(s) archives, the djl:// model zoo and Hugging Face is unchanged. See the PR description for the full list and the flags.

Known issues / limitations

  • A model whose translator is available only as a raw .java file under lib/classes/ will not have it compiled by default; an error-level log names the flag. Models shipping a precompiled .class or .jar, or supplying a translator programmatically, are unaffected.
  • Loading a model over http(s) from a host that resolves to a private address now fails by default. Set the flag above if you serve models from an internal mirror.

Contributors

Thank you to the following community members for contributing to this release:

Rohit Kumar Srivastava, Vaibhav Srivastava, dev_Hakaze

Commits
  • 9d3fca3 Remove -SNAPSHOT for release v0.37.0
  • 3e888a9 Increase DJL version to 0.37.0
  • 1cb7449 [build] Bump log4j to 2.26.0 (#3877)
  • 02b4111 [api] Make bundled Java compilation opt-in and restrict remote URL loading (#...
  • e263d0d [docs] fix typo benifit -> benefit (#3874)
  • 1d6e058 fix(onnxruntime): allow sub-managers after NDManager.cap() (#3870)
  • 33caa1d fix(audio): use 32768.0f for 16-bit PCM normalization (#3869)
  • af1d0b8 Revert "Fix JNI memory safety issues in native utils (#3825)" (#3868)
  • 417016a Bump protobuf in /extensions/tokenizers/src/main/python (#3842)
  • 96599bb Bump com.fasterxml.jackson.core:jackson-databind from 2.19.2 to 2.21.5 (#3867)
  • Additional commits viewable in compare view

Updates ai.djl:basicdataset from 0.36.0 to 0.37.0

Release notes

Sourced from ai.djl:basicdataset's releases.

DJL v0.37.0 Release

This is the v0.37.0 release of DJL.

Changes

  • Bundled .java compilation and remote URL loading are now configurable, with tightened defaults (#3875)
  • Bumped log4j to 2.26.0 (#3877)
  • onnxruntime: allow sub-managers after NDManager.cap() (#3870)
  • Docs: fixed a typo (#3874)

Behavior changes

Two loading behaviors changed their defaults in #3875. Both previous behaviors remain available, but from this release each has to be enabled explicitly:

Behavior Default To restore
Compile bundled .java sources at model load off DJL_COMPILE_JAVA=true or -Dai.djl.compile_java=true
Unrestricted remote URL loading off DJL_ALLOW_INSECURE_URL=true or -Dai.djl.allow_insecure_url=true

Utils.openUrl now limits remote fetches to public http(s) destinations, resolves redirects explicitly with a bounded hop count, and allows file: and jar: only where they denote a local read. Loading from local directories, s3://, gs://, public http(s) archives, the djl:// model zoo and Hugging Face is unchanged. See the PR description for the full list and the flags.

Known issues / limitations

  • A model whose translator is available only as a raw .java file under lib/classes/ will not have it compiled by default; an error-level log names the flag. Models shipping a precompiled .class or .jar, or supplying a translator programmatically, are unaffected.
  • Loading a model over http(s) from a host that resolves to a private address now fails by default. Set the flag above if you serve models from an internal mirror.

Contributors

Thank you to the following community members for contributing to this release:

Rohit Kumar Srivastava, Vaibhav Srivastava, dev_Hakaze

Commits
  • 9d3fca3 Remove -SNAPSHOT for release v0.37.0
  • 3e888a9 Increase DJL version to 0.37.0
  • 1cb7449 [build] Bump log4j to 2.26.0 (#3877)
  • 02b4111 [api] Make bundled Java compilation opt-in and restrict remote URL loading (#...
  • e263d0d [docs] fix typo benifit -> benefit (#3874)
  • 1d6e058 fix(onnxruntime): allow sub-managers after NDManager.cap() (#3870)
  • 33caa1d fix(audio): use 32768.0f for 16-bit PCM normalization (#3869)
  • af1d0b8 Revert "Fix JNI memory safety issues in native utils (#3825)" (#3868)
  • 417016a Bump protobuf in /extensions/tokenizers/src/main/python (#3842)
  • 96599bb Bump com.fasterxml.jackson.core:jackson-databind from 2.19.2 to 2.21.5 (#3867)
  • Additional commits viewable in compare view

Updates ai.djl.huggingface:tokenizers from 0.36.0 to 0.37.0

Release notes

Sourced from ai.djl.huggingface:tokenizers's releases.

DJL v0.37.0 Release

This is the v0.37.0 release of DJL.

Changes

  • Bundled .java compilation and remote URL loading are now configurable, with tightened defaults (#3875)
  • Bumped log4j to 2.26.0 (#3877)
  • onnxruntime: allow sub-managers after NDManager.cap() (#3870)
  • Docs: fixed a typo (#3874)

Behavior changes

Two loading behaviors changed their defaults in #3875. Both previous behaviors remain available, but from this release each has to be enabled explicitly:

Behavior Default To restore
Compile bundled .java sources at model load off DJL_COMPILE_JAVA=true or -Dai.djl.compile_java=true
Unrestricted remote URL loading off DJL_ALLOW_INSECURE_URL=true or -Dai.djl.allow_insecure_url=true

Utils.openUrl now limits remote fetches to public http(s) destinations, resolves redirects explicitly with a bounded hop count, and allows file: and jar: only where they denote a local read. Loading from local directories, s3://, gs://, public http(s) archives, the djl:// model zoo and Hugging Face is unchanged. See the PR description for the full list and the flags.

Known issues / limitations

  • A model whose translator is available only as a raw .java file under lib/classes/ will not have it compiled by default; an error-level log names the flag. Models shipping a precompiled .class or .jar, or supplying a translator programmatically, are unaffected.
  • Loading a model over http(s) from a host that resolves to a private address now fails by default. Set the flag above if you serve models from an internal mirror.

Contributors

Thank you to the following community members for contributing to this release:

Rohit Kumar Srivastava, Vaibhav Srivastava, dev_Hakaze

Commits
  • 9d3fca3 Remove -SNAPSHOT for release v0.37.0
  • 3e888a9 Increase DJL version to 0.37.0
  • 1cb7449 [build] Bump log4j to 2.26.0 (#3877)
  • 02b4111 [api] Make bundled Java compilation opt-in and restrict remote URL loading (#...
  • e263d0d [docs] fix typo benifit -> benefit (#3874)
  • 1d6e058 fix(onnxruntime): allow sub-managers after NDManager.cap() (#3870)

@dependabot
chore(deps): Bump djl-version from 0.36.0 to 0.37.0
d94e66b 
Bumps `djl-version` from 0.36.0 to 0.37.0.

Updates `ai.djl:api` from 0.36.0 to 0.37.0
- [Release notes](https://github.com/deepjavalibrary/djl/releases)
- [Commits](deepjavalibrary/djl@v0.36.0...v0.37.0)

Updates `ai.djl.timeseries:timeseries` from 0.36.0 to 0.37.0
- [Release notes](https://github.com/deepjavalibrary/djl/releases)
- [Commits](deepjavalibrary/djl@v0.36.0...v0.37.0)

Updates `ai.djl:model-zoo` from 0.36.0 to 0.37.0
- [Release notes](https://github.com/deepjavalibrary/djl/releases)
- [Commits](deepjavalibrary/djl@v0.36.0...v0.37.0)

Updates `ai.djl.mxnet:mxnet-model-zoo` from 0.36.0 to 0.37.0
- [Release notes](https://github.com/deepjavalibrary/djl/releases)
- [Commits](deepjavalibrary/djl@v0.36.0...v0.37.0)

Updates `ai.djl.mxnet:mxnet-engine` from 0.36.0 to 0.37.0
- [Release notes](https://github.com/deepjavalibrary/djl/releases)
- [Commits](deepjavalibrary/djl@v0.36.0...v0.37.0)

Updates `ai.djl.pytorch:pytorch-model-zoo` from 0.36.0 to 0.37.0
- [Release notes](https://github.com/deepjavalibrary/djl/releases)
- [Commits](deepjavalibrary/djl@v0.36.0...v0.37.0)

Updates `ai.djl.pytorch:pytorch-engine` from 0.36.0 to 0.37.0
- [Release notes](https://github.com/deepjavalibrary/djl/releases)
- [Commits](deepjavalibrary/djl@v0.36.0...v0.37.0)

Updates `ai.djl.tensorflow:tensorflow-model-zoo` from 0.36.0 to 0.37.0
- [Release notes](https://github.com/deepjavalibrary/djl/releases)
- [Commits](deepjavalibrary/djl@v0.36.0...v0.37.0)

Updates `ai.djl.tensorflow:tensorflow-engine` from 0.36.0 to 0.37.0
- [Release notes](https://github.com/deepjavalibrary/djl/releases)
- [Commits](deepjavalibrary/djl@v0.36.0...v0.37.0)

Updates `ai.djl.tensorflow:tensorflow-api` from 0.36.0 to 0.37.0
- [Release notes](https://github.com/deepjavalibrary/djl/releases)
- [Commits](deepjavalibrary/djl@v0.36.0...v0.37.0)

Updates `ai.djl:basicdataset` from 0.36.0 to 0.37.0
- [Release notes](https://github.com/deepjavalibrary/djl/releases)
- [Commits](deepjavalibrary/djl@v0.36.0...v0.37.0)

Updates `ai.djl.huggingface:tokenizers` from 0.36.0 to 0.37.0
- [Release notes](https://github.com/deepjavalibrary/djl/releases)
- [Commits](deepjavalibrary/djl@v0.36.0...v0.37.0)

---
updated-dependencies:
- dependency-name: ai.djl:api
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: ai.djl.timeseries:timeseries
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: ai.djl:model-zoo
  dependency-version: 0.37.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
- dependency-name: ai.djl.mxnet:mxnet-model-zoo
  dependency-version: 0.37.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
- dependency-name: ai.djl.mxnet:mxnet-engine
  dependency-version: 0.37.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
- dependency-name: ai.djl.pytorch:pytorch-model-zoo
  dependency-version: 0.37.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
- dependency-name: ai.djl.pytorch:pytorch-engine
  dependency-version: 0.37.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
- dependency-name: ai.djl.tensorflow:tensorflow-model-zoo
  dependency-version: 0.37.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
- dependency-name: ai.djl.tensorflow:tensorflow-engine
  dependency-version: 0.37.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
- dependency-name: ai.djl.tensorflow:tensorflow-api
  dependency-version: 0.37.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
- dependency-name: ai.djl:basicdataset
  dependency-version: 0.37.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
- dependency-name: ai.djl.huggingface:tokenizers
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 9, 2026
@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

  • First-time contributors require MANUAL approval for the GitHub Actions to run
  • You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
  • You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
  • Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

🧪 CI tested the following changed modules:

  • parent

✅ POM dependency changes: targeted tests included

Changed properties: djl-version

Modules affected by dependency changes (2)
  • :camel-djl
  • :camel-huggingface
🔬 Scalpel shadow comparison — Scalpel: 10 tested, 27 compile-only — current: 0 all tested

Maveniverse Scalpel detected 37 affected modules (current approach: 0).

⚠️ Modules only in Scalpel (37)
  • apache-camel
  • camel-allcomponents
  • camel-catalog
  • camel-catalog-console
  • camel-catalog-maven
  • camel-catalog-suggest
  • camel-componentdsl
  • camel-djl
  • camel-endpointdsl
  • camel-endpointdsl-support
  • camel-huggingface
  • camel-itest
  • camel-jbang-core
  • camel-jbang-it
  • camel-jbang-main
  • camel-jbang-mcp
  • camel-jbang-plugin-edit
  • camel-jbang-plugin-generate
  • camel-jbang-plugin-kubernetes
  • camel-jbang-plugin-mcp
  • camel-jbang-plugin-route-parser
  • camel-jbang-plugin-test
  • camel-jbang-plugin-tui
  • camel-jbang-plugin-validate
  • camel-kamelet-main
  • camel-launcher
  • camel-launcher-container
  • camel-report-maven-plugin
  • camel-route-parser
  • camel-yaml-dsl
  • camel-yaml-dsl-deserializers
  • camel-yaml-dsl-maven-plugin
  • camel-yaml-dsl-validator
  • camel-yaml-dsl-validator-maven-plugin
  • coverage
  • docs
  • dummy-component

Changed properties: djl-version

Skip-tests mode would test 10 modules (2 direct + 8 downstream), skip tests for 27 (generated code, meta-modules)

Modules Scalpel would test (10)
  • camel-djl
  • camel-huggingface
  • camel-jbang-mcp
  • camel-jbang-plugin-mcp
  • camel-jbang-plugin-route-parser
  • camel-jbang-plugin-tui
  • camel-jbang-plugin-validate
  • camel-launcher-container
  • camel-yaml-dsl-validator
  • camel-yaml-dsl-validator-maven-plugin
Modules with tests skipped (27)
  • apache-camel
  • camel-allcomponents
  • camel-catalog
  • camel-catalog-console
  • camel-catalog-maven
  • camel-catalog-suggest
  • camel-componentdsl
  • camel-endpointdsl
  • camel-endpointdsl-support
  • camel-itest
  • camel-jbang-core
  • camel-jbang-it
  • camel-jbang-main
  • camel-jbang-plugin-edit
  • camel-jbang-plugin-generate
  • camel-jbang-plugin-kubernetes
  • camel-jbang-plugin-test
  • camel-kamelet-main
  • camel-launcher
  • camel-report-maven-plugin
  • camel-route-parser
  • camel-yaml-dsl
  • camel-yaml-dsl-deserializers
  • camel-yaml-dsl-maven-plugin
  • coverage
  • docs
  • dummy-component

ℹ️ Shadow mode — Scalpel observes but does not affect test execution. Learn more

All tested modules (38 modules, 15.4s total)

Total reactor time: 15.4s

Module Duration Status
Camel :: AI :: Hugging Face 14.5s SUCCESS
Camel :: Parent 1.0s SUCCESS
Camel :: AI :: Deep Java Library n/a
Camel :: All Components Sync point n/a
Camel :: Assembly n/a
Camel :: Catalog :: Camel Catalog n/a
Camel :: Catalog :: Camel Report Maven Plugin n/a
Camel :: Catalog :: Camel Route Parser n/a
Camel :: Catalog :: Console n/a
Camel :: Catalog :: Dummy Component n/a
Camel :: Catalog :: Maven n/a
Camel :: Catalog :: Suggest n/a
Camel :: Component DSL n/a
Camel :: Coverage n/a
Camel :: Docs n/a
Camel :: Endpoint DSL n/a
Camel :: Endpoint DSL :: Support n/a
Camel :: Integration Tests n/a
Camel :: JBang :: Core n/a
Camel :: JBang :: Integration tests n/a
Camel :: JBang :: MCP n/a
Camel :: JBang :: Main n/a
Camel :: JBang :: Plugin :: Edit n/a
Camel :: JBang :: Plugin :: Generate n/a
Camel :: JBang :: Plugin :: Kubernetes n/a
Camel :: JBang :: Plugin :: MCP n/a
Camel :: JBang :: Plugin :: Route Parser n/a
Camel :: JBang :: Plugin :: TUI n/a
Camel :: JBang :: Plugin :: Testing n/a
Camel :: JBang :: Plugin :: Validate n/a
Camel :: Kamelet Main n/a
Camel :: Launcher n/a
Camel :: Launcher :: Container n/a
Camel :: YAML DSL n/a
Camel :: YAML DSL :: Deserializers n/a
Camel :: YAML DSL :: Maven Plugins n/a
Camel :: YAML DSL :: Validator n/a
Camel :: YAML DSL :: Validator Maven Plugin n/a

Top 20 slowest modules:

  • Camel :: AI :: Hugging Face (14.5s)
  • Camel :: Parent (1.0s)

⚙️ View full build and test results

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@davsclaus davsclaus davsclaus approved these changes

Assignees

No one assigned

Labels

core-build-and-dependencies dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@davsclaus