From 04fd290417e4a883fdb54a3cd781efd569e03d55 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 5 Sep 2026 10:26:19 +0000
Subject: [PATCH] build(deps): bump build plugins and analysis tooling to
 current

Pure version maintenance, no behaviour change. Two groups:

Cross-repo drift, closed. The four sibling repos deliberately run the same
toolchain versions, and BitcoinAddressFinder pulled ahead when its Dependabot
PRs were merged. This brings the rest back in step:

  maven-compiler-plugin  3.15.0  -> 3.16.0
  maven-surefire-plugin  3.5.6   -> 3.6.0
  nullaway               0.14.0  -> 0.14.1

Behind current upstream in all four repos:

  git-commit-id-maven-plugin  10.0.0    -> 10.0.1
  spotless-maven-plugin       3.10.1    -> 3.10.2
  spotbugs-maven-plugin       4.10.4.0  -> 4.10.4.1
  checker / checker-qual      4.2.2     -> 4.2.3

Note the checker bump moves ONE property that feeds both the annotation
processor and the qualifiers. That is deliberate and must stay that way:
the Nullness Checker resolves its own qualifiers through javac's symbol
table, so processor and checker-qual have to share a major version -- the
lesson from the reverted 3.55.1 pin in java-llama.cpp.

Deliberately NOT bumped: jqwik stays at 1.9.3. Releases from 1.10.0 on print
a prompt-injection string aimed at AI coding agents, and the workspace policy
(policies/jqwik-prompt-injection.md) requires rejecting any PR that moves it.
Dependabot will keep proposing it.

Verified locally: mvn clean verify green (288 tests), PIT 179/179 mutations
killed (100%), the class-file gate clean over target (500 classes, 0 above
major 52), and spotless 3.10.2 reformats nothing -- the working tree after
`spotless:apply` holds only the pom edit itself.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AnNYn8W1xuVxVJtyL34GyH
---
 pom.xml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pom.xml b/pom.xml
index 174d429..7279626 100644
--- a/pom.xml
+++ b/pom.xml
@@ -31,12 +31,12 @@ SPDX-License-Identifier: Apache-2.0
              section "jqwik prompt-injection in test output" for full context. -->
         <jqwik.version>1.9.3</jqwik.version>
         <errorprone.version>2.50.0</errorprone.version>
-        <nullaway.version>0.14.0</nullaway.version>
+        <nullaway.version>0.14.1</nullaway.version>
         <jspecify.version>1.0.1</jspecify.version>
-        <checker.version>4.2.2</checker.version>
-        <spotless.version>3.10.1</spotless.version>
+        <checker.version>4.2.3</checker.version>
+        <spotless.version>3.10.2</spotless.version>
         <palantir-java-format.version>2.97.0</palantir-java-format.version>
-        <spotbugs.version>4.10.4.0</spotbugs.version>
+        <spotbugs.version>4.10.4.1</spotbugs.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
         <findsecbugs.version>1.14.0</findsecbugs.version>
         <archunit.version>1.5.0</archunit.version>
@@ -246,12 +246,12 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>io.github.git-commit-id</groupId>
                     <artifactId>git-commit-id-maven-plugin</artifactId>
-                    <version>10.0.0</version>
+                    <version>10.0.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-compiler-plugin</artifactId>
-                    <version>3.15.0</version>
+                    <version>3.16.0</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
@@ -276,7 +276,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-plugin</artifactId>
-                    <version>3.5.6</version>
+                    <version>3.6.0</version>
                     <configuration>
                         <!--
                             @{argLine} is the JaCoCo-populated property (late replacement); it