build(deps): bump build plugins and analysis tooling to current - #416
Merged
Conversation
Pure version maintenance, no behaviour change in the library. Two groups: Cross-repo drift, closed. The four sibling repos deliberately run the same toolchain versions, and BitcoinAddressFinder pulled ahead when its Dependabot PRs were merged. This brings the rest back in step: maven-compiler-plugin 3.15.0 -> 3.16.0 maven-surefire-plugin 3.5.6 -> 3.6.0 nullaway 0.14.0 -> 0.14.1 Behind current upstream in all four repos: git-commit-id-maven-plugin 10.0.0 -> 10.0.1 spotless-maven-plugin 3.10.1 -> 3.10.2 spotbugs-maven-plugin 4.10.4.0 -> 4.10.4.1 checker / checker-qual 4.2.2 -> 4.2.3 lombok 1.18.46 -> 1.18.48 slf4j-api / slf4j-simple 2.0.18 -> 2.0.19 The compiler and surefire versions also live under different property names in llama-langchain4j (compiler.plugin.version, surefire.version) and llama-kotlin (surefire.version); those are bumped too, so the reactor is internally consistent rather than only the core module. The checker bump moves ONE property that feeds both the annotation processor and the qualifiers, and that coupling is the point: the Nullness Checker resolves its own qualifiers through javac's symbol table, so the two must share a major version. That is the lesson from the 3.55.1 pin reverted in #412; the prose in the checker-qual comment is updated to match. Deliberately NOT bumped: jqwik stays at 1.9.3. Releases from 1.10.0 on print a prompt-injection string aimed at AI coding agents, and the workspace policy (policies/jqwik-prompt-injection.md) requires rejecting any PR that moves it. Dependabot will keep proposing it. A worthwhile side effect of surefire 3.6.0, verified by diffing the per-class reports before and after: a class whose @BeforeAll assumption aborts the whole class is now reported as SKIPPED instead of as `tests=0, skipped=0`. That is exactly the blind spot CLAUDE.md documents under "CI model policy" -- the shape that let every model-gated class silently contribute nothing while the job stayed green. Locally, model-free, it turns 25 classes and 256 tests from invisible into visibly skipped (1486/17 -> 1742/273). CI has the models, so those classes still run there; what changes is that a run which fails to provide them can no longer look like a full pass. Verified locally in this repo: mvn clean verify green, ctest 520/520, PIT 319/319 mutations killed (100%), the class-file gate clean over llama/target including a real `-P assembly` fat jar (1904 classes, 0 above major 52). slf4j-simple 2.0.19 was checked entry by entry rather than in aggregate: its only major-53 entry is META-INF/versions/9/module-info.class, which a classpath JVM never loads and the gate skips by design -- identical to 2.0.18. The fat jar carries the 7 slf4j-simple entries and 0 checkerframework classes, as intended. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AnNYn8W1xuVxVJtyL34GyH
bernardladenthin
had a problem deploying
to
maven-central
September 5, 2026 10:58 — with 
GitHub Actions
Failure
GitHub Actions
Failure
bernardladenthin
had a problem deploying
to
maven-central
September 5, 2026 10:58 — with
GitHub Actions
Failure
GitHub Actions
Failure
Review Summary✅ Approved — This is a well-executed routine dependency and plugin version maintenance update. Verification ResultsConsistency across modules:
Update Coverage:
Testing Documentation:
NotesThe surefire 3.6.0 upgrade brings improved test-skipped reporting, which will help surface invisibly-skipped test classes in local runs. This is a beneficial side effect per the PR description. No source code changes, test changes, or behavioral changes — purely dependency maintenance. Ready to merge. |
|
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pure version maintenance, no behaviour change in the library. One of four coordinated PRs (jllama / srcmorph / BAF / streambuffer).
Cross-repo drift, closed. The four sibling repos deliberately run the same toolchain versions; BitcoinAddressFinder pulled ahead when its Dependabot PRs were merged.
maven-compiler-pluginmaven-surefire-pluginnullawayBehind current upstream in all four repos.
git-commit-id-maven-pluginspotless-maven-pluginspotbugs-maven-pluginchecker/checker-quallombokslf4j-api/slf4j-simpleThe compiler and surefire versions also live under different property names in
llama-langchain4j(compiler.plugin.version,surefire.version) andllama-kotlin(surefire.version) — a name-based scan misses those. They are bumped too, so the reactor is internally consistent rather than only the core module.The checker bump moves one property that feeds both the annotation processor and the qualifiers, and that coupling is the point: the Nullness Checker resolves its own qualifiers through javac's symbol table, so the two must share a major version. That is the lesson from the 3.55.1 pin reverted in #412; the prose in the
checker-qualcomment is updated to match.Deliberately NOT bumped:
jqwikstays at 1.9.3. Releases from 1.10.0 on print a prompt-injection string aimed at AI coding agents, and the workspace policy requires rejecting any PR that moves it. Dependabot will keep proposing it.A worthwhile side effect of surefire 3.6.0
Verified by diffing the per-class reports before and after: a class whose
@BeforeAllassumption aborts the whole class is now reported as SKIPPED instead oftests=0, skipped=0. That is exactly the blind spotCLAUDE.mddocuments under "CI model policy" — the shape that let every model-gated class silently contribute nothing while the job stayed green. Locally, model-free, it turns 25 classes and 256 tests from invisible into visibly skipped (1486/17 → 1742/273). CI has the models, so those classes still run there; what changes is that a run which fails to provide them can no longer look like a full pass.Test plan
mvn clean verifygreenctest520/520llama/target, including a real-P assemblyfat jar: 1904 classes, 0 above major 52slf4j-simple 2.0.19checked entry by entry, not in aggregate: its only major-53 entry isMETA-INF/versions/9/module-info.class, which a classpath JVM never loads and the gate skips by design — identical to 2.0.18. The fat jar carries the 7 slf4j-simple entries and 0 checkerframework classes, as intended.Related PRs
Same change in srcmorph, streambuffer and BitcoinAddressFinder (category 2 only — BAF already carries category 1).
Checklist
CONTRIBUTING.mdandCODE_OF_CONDUCT.md🤖 Generated with Claude Code
https://claude.ai/code/session_01AnNYn8W1xuVxVJtyL34GyH
Generated by Claude Code