From 8c662dbd6ca512a1af2b1473c250c9d2300bb676 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 5 Sep 2026 10:57:51 +0000
Subject: [PATCH] build(deps): bump build plugins and analysis tooling to
 current

Pure version maintenance, no behaviour change. Two groups:

Cross-repo drift, closed. The four sibling repos deliberately run the same
toolchain versions, and BitcoinAddressFinder pulled ahead when its Dependabot
PRs were merged. This brings the rest back in step:

  maven-compiler-plugin  3.15.0  -> 3.16.0
  maven-surefire-plugin  3.5.6   -> 3.6.0
  nullaway               0.14.0  -> 0.14.1

Behind current upstream in all four repos:

  git-commit-id-maven-plugin  10.0.0    -> 10.0.1
  spotless-maven-plugin       3.10.1    -> 3.10.2
  spotbugs-maven-plugin       4.10.4.0  -> 4.10.4.1
  checker / checker-qual      4.2.2     -> 4.2.3
  lombok                      1.18.46   -> 1.18.48
  slf4j-api / slf4j-simple    2.0.18    -> 2.0.19

This reactor keeps the tooling properties per module rather than in the parent,
so the first six move in all three of srcmorph, srcmorph-cli and
srcmorph-maven-plugin; checker-qual and both slf4j artifacts are pinned as
literals in the parent's dependencyManagement and move there.

The checker bump moves ONE property that feeds both the annotation processor
and the qualifiers, and that coupling is the point: the Nullness Checker
resolves its own qualifiers through javac's symbol table, so the two must share
a major version -- the lesson from the 3.55.1 pin reverted in java-llama.cpp.
The prose in the checker-qual comment is updated to match.

logback-classic stays at 1.6.3, which is current; it is test-scope only here
(ListAppender capture) and never reaches an artifact.

Deliberately NOT bumped: jqwik stays at 1.9.3. Releases from 1.10.0 on print a
prompt-injection string aimed at AI coding agents, and the workspace policy
(policies/jqwik-prompt-injection.md) requires rejecting any PR that moves it.
Dependabot will keep proposing it.

Verified locally: reactor mvn clean verify green (654 + 39 + 32 tests), PIT
807/16/62 mutations all killed at 100%, the class-file gate clean across all
three modules' targets (3206 classes in 16 jars, 0 above major 52), and
spotless 3.10.2 reformats nothing -- the working tree after `spotless:apply`
holds only the four pom edits.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AnNYn8W1xuVxVJtyL34GyH
---
 pom.xml                       |  8 ++++----
 srcmorph-cli/pom.xml          | 16 ++++++++--------
 srcmorph-maven-plugin/pom.xml | 16 ++++++++--------
 srcmorph/pom.xml              | 16 ++++++++--------
 4 files changed, 28 insertions(+), 28 deletions(-)

diff --git a/pom.xml b/pom.xml
index 3e5aeb5..e94b168 100644
--- a/pom.xml
+++ b/pom.xml
@@ -122,7 +122,7 @@ SPDX-License-Identifier: Apache-2.0
             <dependency>
                 <groupId>org.slf4j</groupId>
                 <artifactId>slf4j-api</artifactId>
-                <version>2.0.18</version>
+                <version>2.0.19</version>
             </dependency>
             <!--
                 The SLF4J binding shipped inside srcmorph-cli's fat jar. It is slf4j-simple, not
@@ -140,7 +140,7 @@ SPDX-License-Identifier: Apache-2.0
             <dependency>
                 <groupId>org.slf4j</groupId>
                 <artifactId>slf4j-simple</artifactId>
-                <version>2.0.18</version>
+                <version>2.0.19</version>
             </dependency>
             <!--
                 Pin logback-classic for the TEST scope only: AiFieldGenerationSupportTest attaches a
@@ -198,7 +198,7 @@ SPDX-License-Identifier: Apache-2.0
                 org.checkerframework.framework.qual.DoesNotUnrefineReceiver". Processor and
                 qualifiers must share a major version.
 
-                Scope `provided` satisfies both constraints at once: 4.2.2 on the compile classpath
+                Scope `provided` satisfies both constraints at once: 4.2.3 on the compile classpath
                 where the checker needs it, and excluded from consumers' transitive graph AND from
                 the fat jar (jar-with-dependencies takes scope runtime), so no checker-qual class of
                 any version reaches a consumer's JVM. <optional>true</optional> alone would not have
@@ -212,7 +212,7 @@ SPDX-License-Identifier: Apache-2.0
             <dependency>
                 <groupId>org.checkerframework</groupId>
                 <artifactId>checker-qual</artifactId>
-                <version>4.2.2</version>
+                <version>4.2.3</version>
                 <scope>provided</scope>
             </dependency>
         </dependencies>
diff --git a/srcmorph-cli/pom.xml b/srcmorph-cli/pom.xml
index f9e8a46..efac4c3 100644
--- a/srcmorph-cli/pom.xml
+++ b/srcmorph-cli/pom.xml
@@ -48,17 +48,17 @@ SPDX-License-Identifier: Apache-2.0
         <junit.version>6.1.3</junit.version>
         <hamcrest.version>3.0</hamcrest.version>
         <errorprone.version>2.50.0</errorprone.version>
-        <nullaway.version>0.14.0</nullaway.version>
+        <nullaway.version>0.14.1</nullaway.version>
         <!-- checker.version also drives the org.checkerframework:checker annotation-processor
              artifact below; the checker-qual dependency version itself is managed by the
              parent's <dependencyManagement> (see comment above <dependencies>). -->
-        <checker.version>4.2.2</checker.version>
+        <checker.version>4.2.3</checker.version>
         <archunit.version>1.5.0</archunit.version>
-        <spotbugs.version>4.10.4.0</spotbugs.version>
-        <lombok.version>1.18.46</lombok.version>
+        <spotbugs.version>4.10.4.1</spotbugs.version>
+        <lombok.version>1.18.48</lombok.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
         <findsecbugs.version>1.14.0</findsecbugs.version>
-        <spotless.version>3.10.1</spotless.version>
+        <spotless.version>3.10.2</spotless.version>
         <palantir-java-format.version>2.97.0</palantir-java-format.version>
 
         <project.build.outputTimestamp>2026-09-01T07:56:35Z</project.build.outputTimestamp>
@@ -182,7 +182,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>io.github.git-commit-id</groupId>
                     <artifactId>git-commit-id-maven-plugin</artifactId>
-                    <version>10.0.0</version>
+                    <version>10.0.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
@@ -192,7 +192,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-compiler-plugin</artifactId>
-                    <version>3.15.0</version>
+                    <version>3.16.0</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
@@ -222,7 +222,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-plugin</artifactId>
-                    <version>3.5.6</version>
+                    <version>3.6.0</version>
                     <configuration>
                         <!--
                             argLine starts with @{argLine} so the JaCoCo agent (placed into the
diff --git a/srcmorph-maven-plugin/pom.xml b/srcmorph-maven-plugin/pom.xml
index c60487e..3224b59 100644
--- a/srcmorph-maven-plugin/pom.xml
+++ b/srcmorph-maven-plugin/pom.xml
@@ -84,20 +84,20 @@ SPDX-License-Identifier: Apache-2.0
         <jcstress.version>0.16</jcstress.version>
         <vmlens.version>1.2.28</vmlens.version>
         <errorprone.version>2.50.0</errorprone.version>
-        <nullaway.version>0.14.0</nullaway.version>
+        <nullaway.version>0.14.1</nullaway.version>
         <!-- checker.version also drives the org.checkerframework:checker annotation-processor
              artifact below; the checker-qual dependency version itself is managed by the
              parent's <dependencyManagement> (see comment above <dependencies>). -->
-        <checker.version>4.2.2</checker.version>
+        <checker.version>4.2.3</checker.version>
         <!-- jqwik / Lincheck are no longer dependencies of this module (both moved to srcmorph
              with the config package's tests); see srcmorph/pom.xml for the jqwik "DO NOT UPGRADE
              past 1.9.3" policy note (CLAUDE.md "jqwik prompt-injection in test output"). -->
         <archunit.version>1.5.0</archunit.version>
-        <spotbugs.version>4.10.4.0</spotbugs.version>
-        <lombok.version>1.18.46</lombok.version>
+        <spotbugs.version>4.10.4.1</spotbugs.version>
+        <lombok.version>1.18.48</lombok.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
         <findsecbugs.version>1.14.0</findsecbugs.version>
-        <spotless.version>3.10.1</spotless.version>
+        <spotless.version>3.10.2</spotless.version>
         <palantir-java-format.version>2.97.0</palantir-java-format.version>
 
         <ai.index.output.directory>${project.basedir}/src/site/ai</ai.index.output.directory>
@@ -266,12 +266,12 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>io.github.git-commit-id</groupId>
                     <artifactId>git-commit-id-maven-plugin</artifactId>
-                    <version>10.0.0</version>
+                    <version>10.0.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-compiler-plugin</artifactId>
-                    <version>3.15.0</version>
+                    <version>3.16.0</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
@@ -306,7 +306,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-plugin</artifactId>
-                    <version>3.5.6</version>
+                    <version>3.6.0</version>
                     <configuration>
                         <!--
                             argLine starts with @{argLine} so the JaCoCo agent (placed into the
diff --git a/srcmorph/pom.xml b/srcmorph/pom.xml
index c8b135b..755a7b2 100644
--- a/srcmorph/pom.xml
+++ b/srcmorph/pom.xml
@@ -72,11 +72,11 @@ SPDX-License-Identifier: Apache-2.0
         <hamcrest.version>3.0</hamcrest.version>
         <lincheck.version>3.7</lincheck.version>
         <errorprone.version>2.50.0</errorprone.version>
-        <nullaway.version>0.14.0</nullaway.version>
+        <nullaway.version>0.14.1</nullaway.version>
         <!-- checker.version also drives the org.checkerframework:checker annotation-processor
              artifact below; the checker-qual dependency version itself is managed by the
              parent's <dependencyManagement> (see comment above <dependencies>). -->
-        <checker.version>4.2.2</checker.version>
+        <checker.version>4.2.3</checker.version>
         <!-- DO NOT UPGRADE jqwik past 1.9.3. jqwik 1.10.0 added a deliberate
              anti-AI prompt-injection string to test stdout; the 1.10.1 user
              guide states the library "is not meant to be used by any 'AI'
@@ -86,11 +86,11 @@ SPDX-License-Identifier: Apache-2.0
              section "jqwik prompt-injection in test output" for full context. -->
         <jqwik.version>1.9.3</jqwik.version>
         <archunit.version>1.5.0</archunit.version>
-        <spotbugs.version>4.10.4.0</spotbugs.version>
-        <lombok.version>1.18.46</lombok.version>
+        <spotbugs.version>4.10.4.1</spotbugs.version>
+        <lombok.version>1.18.48</lombok.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
         <findsecbugs.version>1.14.0</findsecbugs.version>
-        <spotless.version>3.10.1</spotless.version>
+        <spotless.version>3.10.2</spotless.version>
         <palantir-java-format.version>2.97.0</palantir-java-format.version>
 
         <project.build.outputTimestamp>2026-09-01T07:56:35Z</project.build.outputTimestamp>
@@ -229,12 +229,12 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>io.github.git-commit-id</groupId>
                     <artifactId>git-commit-id-maven-plugin</artifactId>
-                    <version>10.0.0</version>
+                    <version>10.0.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-compiler-plugin</artifactId>
-                    <version>3.15.0</version>
+                    <version>3.16.0</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
@@ -264,7 +264,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-plugin</artifactId>
-                    <version>3.5.6</version>
+                    <version>3.6.0</version>
                     <configuration>
                         <!--
                             argLine starts with @{argLine} so the JaCoCo agent (placed into the