From 1285f1658126cb64a1aec1f9a075f119f3954340 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 5 Sep 2026 10:31:16 +0000 Subject: [PATCH] build(deps): bump build plugins and analysis tooling to current Pure version maintenance, no behaviour change in the library. Two groups: Cross-repo drift, closed. The four sibling repos deliberately run the same toolchain versions, and BitcoinAddressFinder pulled ahead when its Dependabot PRs were merged. This brings the rest back in step: maven-compiler-plugin 3.15.0 -> 3.16.0 maven-surefire-plugin 3.5.6 -> 3.6.0 nullaway 0.14.0 -> 0.14.1 Behind current upstream in all four repos: git-commit-id-maven-plugin 10.0.0 -> 10.0.1 spotless-maven-plugin 3.10.1 -> 3.10.2 spotbugs-maven-plugin 4.10.4.0 -> 4.10.4.1 checker / checker-qual 4.2.2 -> 4.2.3 lombok 1.18.46 -> 1.18.48 slf4j-api / slf4j-simple 2.0.18 -> 2.0.19 The compiler and surefire versions also live under different property names in llama-langchain4j (compiler.plugin.version, surefire.version) and llama-kotlin (surefire.version); those are bumped too, so the reactor is internally consistent rather than only the core module. The checker bump moves ONE property that feeds both the annotation processor and the qualifiers, and that coupling is the point: the Nullness Checker resolves its own qualifiers through javac's symbol table, so the two must share a major version. That is the lesson from the 3.55.1 pin reverted in #412; the prose in the checker-qual comment is updated to match. Deliberately NOT bumped: jqwik stays at 1.9.3. Releases from 1.10.0 on print a prompt-injection string aimed at AI coding agents, and the workspace policy (policies/jqwik-prompt-injection.md) requires rejecting any PR that moves it. Dependabot will keep proposing it. A worthwhile side effect of surefire 3.6.0, verified by diffing the per-class reports before and after: a class whose @BeforeAll assumption aborts the whole class is now reported as SKIPPED instead of as `tests=0, skipped=0`. That is exactly the blind spot CLAUDE.md documents under "CI model policy" -- the shape that let every model-gated class silently contribute nothing while the job stayed green. Locally, model-free, it turns 25 classes and 256 tests from invisible into visibly skipped (1486/17 -> 1742/273). CI has the models, so those classes still run there; what changes is that a run which fails to provide them can no longer look like a full pass. Verified locally in this repo: mvn clean verify green, ctest 520/520, PIT 319/319 mutations killed (100%), the class-file gate clean over llama/target including a real `-P assembly` fat jar (1904 classes, 0 above major 52). slf4j-simple 2.0.19 was checked entry by entry rather than in aggregate: its only major-53 entry is META-INF/versions/9/module-info.class, which a classpath JVM never loads and the gate skips by design -- identical to 2.0.18. The fat jar carries the 7 slf4j-simple entries and 0 checkerframework classes, as intended. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01AnNYn8W1xuVxVJtyL34GyH --- llama-kotlin/pom.xml | 2 +- llama-langchain4j/pom.xml | 4 ++-- llama/pom.xml | 20 ++++++++++---------- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/llama-kotlin/pom.xml b/llama-kotlin/pom.xml index fcad844c..d89b0c13 100644 --- a/llama-kotlin/pom.xml +++ b/llama-kotlin/pom.xml @@ -64,7 +64,7 @@ SPDX-License-Identifier: MIT 1.11.0 6.1.3 3.0 - 3.5.6 + 3.6.0 3.4.0 3.5.1 diff --git a/llama-langchain4j/pom.xml b/llama-langchain4j/pom.xml index fdfb49be..8a42093d 100644 --- a/llama-langchain4j/pom.xml +++ b/llama-langchain4j/pom.xml @@ -62,8 +62,8 @@ SPDX-License-Identifier: MIT 3.0 - 3.15.0 - 3.5.6 + 3.16.0 + 3.6.0 3.4.0 3.12.0 diff --git a/llama/pom.xml b/llama/pom.xml index a290ddad..e62c620e 100644 --- a/llama/pom.xml +++ b/llama/pom.xml @@ -56,16 +56,16 @@ SPDX-License-Identifier: MIT bernardladenthin 1.0.1 - 1.18.46 + 1.18.48 2.50.0 - 0.14.0 + 0.14.1 - 4.2.2 + 4.2.3 2.22.2 3.8.7 - 2.0.18 + 2.0.19 1.6.3 1.27 6.1.3 @@ -90,10 +90,10 @@ SPDX-License-Identifier: MIT section "jqwik prompt-injection in test output" for full context. --> 1.9.3 1.5.0 - 4.10.4.0 + 4.10.4.1 7.7.4 1.14.0 - 3.10.1 + 3.10.2 2.97.0 UTF-8 2026-09-01T07:57:45Z @@ -199,7 +199,7 @@ SPDX-License-Identifier: MIT org.checkerframework.framework.qual.DoesNotUnrefineReceiver". Processor and qualifiers must share a major version. - provided scope resolves both constraints at once: 4.2.2 is on the compile + provided scope resolves both constraints at once: 4.2.3 is on the compile classpath where the checker needs it, and provided is excluded from consumers' transitive graph AND from the fat jar (jar-with-dependencies takes scope runtime), so no checker-qual class of any version reaches a consumer's JVM. @@ -349,7 +349,7 @@ SPDX-License-Identifier: MIT io.github.git-commit-id git-commit-id-maven-plugin - 10.0.0 + 10.0.1 org.apache.maven.plugins @@ -359,7 +359,7 @@ SPDX-License-Identifier: MIT org.apache.maven.plugins maven-compiler-plugin - 3.15.0 + 3.16.0 org.apache.maven.plugins @@ -389,7 +389,7 @@ SPDX-License-Identifier: MIT org.apache.maven.plugins maven-surefire-plugin - 3.5.6 + 3.6.0