v5.2.2

2026-10-08light-touch

A patch that stops wiretap from instantiating every bean in a test context at startup, and clears the two scanner findings in the documentation site.

Highlights

01
Startup touches only share containers
The share-group offset-reset step asked Spring for every bean of type Object, which constructed each singleton in the context, lazy ones included. A lazy application bean that fails when built then failed the test context from inside wiretap. The lookup is now typed and leaves factory beans alone.
02
Runtime closures still clean
The exact runtime jars shipped by wiretap-core and wiretap-spring-boot were rebuilt and rescanned with Trivy 0.75.0 and its current database. No fixable critical, high or medium vulnerability exists, so the Java dependency set is unchanged.
03
Patched documentation toolchain
sharp moves to 0.35.5 and source-map-js to 1.2.2 to close the two open advisories, and the site moves to Next.js 16.4.0 with the latest compatible supporting packages.

Upgraded the documentation site to Next.js 16.4.0, React 19.3.0, shiki 4.5.0, zod 4.6.5 and the latest compatible supporting packages; refreshed the Wiretap AI skill and cheatsheet for 5.2.2.
Rescanned the published runtime closures with Trivy 0.75.0. No fixable finding exists, so the Java dependency set is unchanged from 5.2.1.

Starting a context no longer instantiates every singleton bean. The share-group offset-reset step now looks up share listener containers by type instead of enumerating every bean, so an unrelated lazy bean that fails on construction, such as a Kerberos ticket validator with no keytab path, no longer fails the test context.

Fixed GHSA-wq5f-xc86-pv6w (sharp 0.35.5) and CVE-2026-93749 (source-map-js 1.2.2) in the documentation site. Both are build-time packages that do not ship in the Java artifacts.