build(deps): langchain4j 1.20.0, and correct the log4j pin's rationale

[bernardladenthin]

Summary

Two independent maintenance items, one commit each.

1. The log4j pin is a floor guard now, not an active CVE fix (comment text only).
Both comments in llama/pom.xml still said logcaptor "brings 2.25.3, which is affected by CVE-2026-49844". That stopped being true when this repo moved to logcaptor 2.12.7, whose own pom declares <version.log4j>2.26.1</version.log4j> — exactly what the pin forces. The dependencyManagement entries therefore change nothing about the resolved graph today.

The pin is kept deliberately, as a lower bound: a logcaptor release that fell back to an affected line could not regress the test classpath silently. But a comment describing it as the fix sends the next reader looking for a vulnerability that is no longer reachable.

The comment also now states what the pin is not related to, because the two changes landed in the same week and were conflated once already: this has nothing to do with the Java 8 class-file floor. That one is slf4j-simple instead of logback plus checker-qual at provided scope, and it concerns the shipped artifact — both log4j artifacts are test scope and reach no published artifact at all.

No version, scope or dependency changed. Kept byte-parallel with the same rewrite in BitcoinAddressFinder, which carries the identical pin.

2. langchain4j 1.19.0 → 1.20.0.
The only dependency across the four sibling repos genuinely behind a stable upstream. Confined to llama-langchain4j, which is maven.compiler.release 17 because langchain4j 1.x requires Java 17; the core net.ladenthin:llama stays Java 8 and that split is untouched. Nothing about the old pin was deliberate — no rationale comment, not in the do-not-bump registry. It was a lag.

Test plan

• Affected unit / integration tests pass locally

  mvn -pl llama -am -DskipTests install    -> BUILD SUCCESS
  mvn -f llama-langchain4j/pom.xml verify  -> BUILD SUCCESS
      Tests run: 49, Failures: 0, Errors: 0, Skipped: 7
  

  Verified rather than assumed, because a langchain4j minor can move interface shapes and this module implements four of them. The module imports 44 types across agent.tool, data.message, model.chat.request(.json), model.chat.response and model.output; all still resolve, and the adapters compile unchanged against ChatModel, StreamingChatModel, EmbeddingModel and ScoringModel. The 7 skips are the model-gated integration tests (they self-skip without a GGUF); the 42 that ran are the mapping, schema-serializer and streaming-assembler suites — exactly the code touching the langchain4j API surface.

  verify rather than test on purpose: it also builds the javadoc jar, so a javadoc break from a changed signature fails now instead of at release time.

• xml.etree parses both poms; no -- inside any XML comment

• CI is green on this branch

• Docs / CHANGELOG updated where applicable — comment-only change plus a dependency bump with no behaviour change; the cross-repo record lives in workspace/crossrepostatus.md

Related issues / PRs

Pairs with the identical comment rewrite in BitcoinAddressFinder and with the registry-row decision in bernardladenthin/workspace#39.

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits
• No security-sensitive changes — the pin that was security-relevant is retained unchanged; only its comment is corrected

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01AnNYn8W1xuVxVJtyL34GyH

---

Generated by Claude Code

[claude]

Code Review: PR #419

Approved - Maintenance PR with sound changes and thorough verification.

Changes Analysis

1. Log4j Pin Comment Revision (llama/pom.xml)

   • Clarifies the pin is now a floor guard, not an active CVE fix
   • logcaptor 2.12.7 already requests log4j 2.26.1 (the pinned version)
   • Properly distinguishes from Java 8 class-file floor concern
   • Test-scope only, never reaches published artifacts
   • CVE-2026-49844 rationale well documented

2. LangChain4j 1.20.0 Upgrade (llama-langchain4j/pom.xml)

   • Tested locally: 49 tests run, 0 failures, 0 errors
   • All 44 imported langchain4j types resolve correctly
   • All 4 adapter implementations (ChatModel, etc) compile unchanged
   • Isolated to Java 17 module, core remains Java 8

Security Assessment

No regressions: log4j pin retained, test-scope only, minor stable dependency bump.

Ready to Merge

Confirm CI is green before final approval.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud