Prepare the 26.10.23 release and constrain vulnerable runtime dependencies

README.md

@@ -111,7 +111,7 @@ Use the framework parent when you want its build and dependency management:
 <parent>
     <groupId>org.fireflyframework</groupId>
     <artifactId>fireflyframework-parent</artifactId>
-    <version>26.10.22</version>
+    <version>26.10.23</version>
     <relativePath/>
 </parent>
 ```
@@ -124,7 +124,7 @@ Or retain your existing parent and import the independent BOM:
         <dependency>
             <groupId>org.fireflyframework</groupId>
             <artifactId>fireflyframework-bom</artifactId>
-            <version>26.10.22</version>
+            <version>26.10.23</version>
             <type>pom</type>
             <scope>import</scope>
         </dependency>

build/bom/pom.xml

@@ -6,7 +6,7 @@
 
     <groupId>org.fireflyframework</groupId>
     <artifactId>fireflyframework-bom</artifactId>
-    <version>26.10.22</version>
+    <version>26.10.23</version>
     <packaging>pom</packaging>
 
     <name>Firefly Framework - BOM</name>
@@ -35,8 +35,9 @@
     </scm>
 
     <properties>
-        <fireflyframework.version>26.10.22</fireflyframework.version>
+        <fireflyframework.version>26.10.23</fireflyframework.version>
         <!-- Security patches beyond the selected platform BOMs. -->
+        <opentelemetry.version>1.67.0</opentelemetry.version>
         <jackson2-bom.version>2.22.4</jackson2-bom.version>
         <jackson-bom.version>3.1.7</jackson-bom.version>
         <lz4-java.version>1.11.4</lz4-java.version>
@@ -49,11 +50,30 @@
         <tomcat.version>11.0.25</tomcat.version>
         <freemarker.version>2.3.35</freemarker.version>
         <json.version>20260814</json.version>
+        <guava.version>33.7.2-jre</guava.version>
+        <snappy-java.version>1.1.10.9</snappy-java.version>
     </properties>
 
     <dependencyManagement>
         <dependencies>
             <!-- Security constraints shared by the consumer parent and BOM. -->
+            <dependency>
+                <groupId>com.google.guava</groupId>
+                <artifactId>guava</artifactId>
+                <version>${guava.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.xerial.snappy</groupId>
+                <artifactId>snappy-java</artifactId>
+                <version>${snappy-java.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>io.opentelemetry</groupId>
+                <artifactId>opentelemetry-bom</artifactId>
+                <version>${opentelemetry.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
             <dependency>
                 <groupId>com.microsoft.kiota</groupId>
                 <artifactId>microsoft-kiota-authentication-azure</artifactId>

build/parent/pom.xml

@@ -6,7 +6,7 @@
 
     <groupId>org.fireflyframework</groupId>
     <artifactId>fireflyframework-parent</artifactId>
-    <version>26.10.22</version>
+    <version>26.10.23</version>
     <packaging>pom</packaging>
 
     <name>Firefly Framework - Parent POM</name>
@@ -35,7 +35,7 @@
     </scm>
 
     <properties>
-        <fireflyframework.version>26.10.22</fireflyframework.version>
+        <fireflyframework.version>26.10.23</fireflyframework.version>
         <!-- Java -->
         <java.version>25</java.version>
         <maven.compiler.release>${java.version}</maven.compiler.release>
@@ -101,7 +101,7 @@
         <janino.version>3.1.12</janino.version>
 
         <!-- OpenTelemetry -->
-        <opentelemetry.version>1.62.0</opentelemetry.version>
+        <opentelemetry.version>1.67.0</opentelemetry.version>
 
         <!-- Jakarta REST -->
         <jersey.version>4.0.3</jersey.version>
@@ -171,11 +171,30 @@
         <tomcat.version>11.0.25</tomcat.version>
         <freemarker.version>2.3.35</freemarker.version>
         <json.version>20260814</json.version>
+        <guava.version>33.7.2-jre</guava.version>
+        <snappy-java.version>1.1.10.9</snappy-java.version>
     </properties>
 
     <dependencyManagement>
         <dependencies>
             <!-- Security constraints shared by the consumer parent and BOM. -->
+            <dependency>
+                <groupId>com.google.guava</groupId>
+                <artifactId>guava</artifactId>
+                <version>${guava.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.xerial.snappy</groupId>
+                <artifactId>snappy-java</artifactId>
+                <version>${snappy-java.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>io.opentelemetry</groupId>
+                <artifactId>opentelemetry-bom</artifactId>
+                <version>${opentelemetry.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
             <dependency>
                 <groupId>com.microsoft.kiota</groupId>
                 <artifactId>microsoft-kiota-authentication-azure</artifactId>
@@ -494,15 +513,6 @@
                 <version>${janino.version}</version>
             </dependency>
 
-            <!-- OpenTelemetry -->
-            <dependency>
-                <groupId>io.opentelemetry</groupId>
-                <artifactId>opentelemetry-bom</artifactId>
-                <version>${opentelemetry.version}</version>
-                <type>pom</type>
-                <scope>import</scope>
-            </dependency>
-
             <!-- AWS SDK v2 BOM -->
             <dependency>
                 <groupId>software.amazon.awssdk</groupId>

docs/examples/getting-started/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>org.fireflyframework</groupId>
         <artifactId>fireflyframework-parent</artifactId>
-        <version>26.10.22</version>
+        <version>26.10.23</version>
         <relativePath/>
     </parent>
     <groupId>com.example</groupId>

docs/examples/onboarding-coordination/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>org.fireflyframework</groupId>
         <artifactId>fireflyframework-parent</artifactId>
-        <version>26.10.22</version>
+        <version>26.10.23</version>
         <relativePath/>
     </parent>
     <groupId>com.example</groupId>

docs/examples/onboarding-event-store/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>org.fireflyframework</groupId>
         <artifactId>fireflyframework-parent</artifactId>
-        <version>26.10.22</version>
+        <version>26.10.23</version>
         <relativePath/>
     </parent>
     <groupId>com.example</groupId>

docs/release-reservations/26.10.23.json

@@ -0,0 +1,16 @@
+{
+  "status": "ATOMIC_PUBLIC_RELEASE_BRANCH_RESERVATION_CREATED",
+  "version": "26.10.23",
+  "versionMeaning": "YY.MM.numeric monthly patch counter",
+  "reservedRef": "refs/heads/release/26.10.23",
+  "base": "932a7cb3425a1a701fd38dfd051474231e926e0d",
+  "createdAtUtc": "2026-10-31T09:55:40.767959+00:00",
+  "counterReconciliationSHA256": "8a0c306ad0453bfab44f0a7db85ea80ec4d28281fdd6d0ee8800c22006e2f24f",
+  "portalInventorySHA256": "35d6b345f2178bd87b270fc92a5aa97bde6dd7a193993465889633708a27e3af",
+  "allKnownSourcePrivate22Protected": true,
+  "sourceBumpPending": true,
+  "finalTagCreated": false,
+  "releasePublished": false,
+  "globalOtherAccountVisibilityClaim": false,
+  "initialBatchPublicationStillRequiresGovernedPermissionAndStrictReadback": true
+}

docs/releases.md

@@ -1,6 +1,6 @@
 # Unified Jafly releases
 
-The monorepo builds one version train. The working source version is `26.10.22`; publication is a separate release-workflow operation.
+The monorepo builds one version train. The working source version is `26.10.23`; publication is a separate release-workflow operation.
 
 ## Workflows
 
@@ -9,9 +9,9 @@ The monorepo builds one version train. The working source version is `26.10.22`;
 - `dependency-graph.yml` resolves every reactor project on Java 25 and submits the complete Maven dependency snapshot from `main`. Dependabot can then check transitive dependencies as well as versions declared in POMs.
 - `codeql-advanced.yml` compiles Java sources, tests, and standalone examples on Java 25, and analyzes Java, Python, JavaScript/TypeScript, and Actions with the extended security queries. It retains SARIF for review. Uploads are controlled by `JAFLY_CODEQL_UPLOAD`; enable them only after the advanced workflow passes and default setup has been switched off.
 - `snapshots.yml` is manual and accepts only main/develop with a snapshot version. It runs the full framework and standalone-example gates, freezes the release-profile artifacts, and publishes them to the Jafly Maven repository. Independent reads verify every timestamped artifact and reread snapshot metadata to detect a concurrent replacement.
-- `release.yml` runs on a final `v*` tag or manual dispatch with the required `tag` input. The sole publishing job is named `release`. It validates all 86 projects, checks tag/version and local/remote tag commit equality, verifies the full reactor, deploys and verifies GitHub Packages, then deploys and verifies Maven Central. Only then does it create the GitHub Release.
+- `release.yml` runs on a final `v*` tag or manual dispatch with the required `tag` input. The sole publishing job is named `release`. It validates every inventoried reactor project, checks tag/version and local/remote tag commit equality, verifies the full reactor, deploys and verifies GitHub Packages, then deploys and verifies Maven Central. Only then does it create the GitHub Release.
 
-The root aggregator has no parent and is not published. The standalone artifacts in `build/parent` and `build/bom` remain published. Nested modules may inherit their effective version from a local framework parent. Explicitly nonpublishable samples remain in the test reactor and are excluded from both registries. With the current source inventory, 84 projects are publishable: 312 required main/POM/source/Javadoc files and 624 files when detached Central signatures are included.
+The root aggregator has no parent and is not published. The standalone artifacts in `build/parent` and `build/bom` remain published. Nested modules may inherit their effective version from a local framework parent. Explicitly nonpublishable samples remain in the test reactor and are excluded from both registries. The generated reactor inventory identifies publishable projects. Registry verification derives every required artifact, POM, source, Javadoc, and detached Central signature from the staged manifests.
 
 The root and nonpublishable samples must have both normal Maven deploy suppression and Central `skipPublishing` configured. The Central extension replaces the normal deploy binding; `maven.deploy.skip` alone cannot suppress its publication.
 
@@ -54,14 +54,14 @@ publication authorization, and the complete release gates below.
 
 ## Final-version procedure
 
-1. Qualify the source changes and set every explicit project/parent reference and internal version property to the same final version, for example `26.10.21`. Inherited versions resolve to that train.
+1. Reconcile published, staged, private, and concurrent allocations, then reserve an unused `YY.MM.Patch` counter. Qualify the source changes and use `python3 scripts/set_version.py <reserved-version>` to update every explicit project/parent reference and internal version property. Inherited versions resolve to that train.
 2. Run `python3 scripts/release_tools.py check` and `./mvnw -B -ntp clean verify`.
 3. Create an immutable tag whose name is exactly `v` plus the final POM version. The release workflow refuses a snapshot, a mismatched tag, or a checkout that differs from the tag commit.
 4. Inspect the complete `release` job result. A final release requires both registries and the GitHub Release to succeed. GitHub Packages can succeed before a later Central failure; this is a partial release, even though some artifacts are already downloadable.
 
-The first gate runs `clean install` with tests enabled, followed by every maintained standalone example. A release-profile installation then prepares the POMs, main JARs, sources, and Javadoc with tests skipped only for this packaging step. `github_packages.py` freezes and hashes those installed files, validates the reviewed package-home map and live GitHub package associations, then submits all 84 pinned Maven deploy-file executions in one process. It publishes each installed POM unchanged, preserving the parent and BOM metadata.
+The first gate runs `clean install` with tests enabled, followed by every maintained standalone example. A release-profile installation then prepares the POMs, main JARs, sources, and Javadoc with tests skipped only for this packaging step. `github_packages.py` freezes and hashes those installed files, validates the reviewed package-home map and live GitHub package associations, then submits all planned pinned Maven deploy-file executions in one process. It publishes each installed POM unchanged, preserving the parent and BOM metadata.
 
-GitHub verification downloads all 312 required files from the Jafly repository. Snapshot verification resolves each timestamped variant and reads all 84 metadata documents again after the downloads. Maven Central uses the existing signed aggregate-bundle profile and runs its lifecycle with tests enabled. These are separate artifact-generation steps; each registry is verified against its own produced bytes, without a promise of byte-identical archives or signatures across registries.
+GitHub verification downloads every required file in the frozen manifest from the Jafly repository. Snapshot verification resolves each timestamped variant and reads every publishable metadata document again after the downloads. Maven Central uses the existing signed aggregate-bundle profile and runs its lifecycle with tests enabled. These are separate artifact-generation steps; each registry is verified against its own produced bytes, without a promise of byte-identical archives or signatures across registries.
 
 The Central plugin version is [0.12.0](https://central.sonatype.org/publish/publish-portal-maven/). Its source stages each project's artifacts into a shared session directory and creates/uploads one aggregate ZIP after the last publishing project. The workflow forces its output directory to retain that ZIP. `autoPublish=true`, `waitUntil=published`, and `waitMaxTime=3600` require completed publication. Timeout, duplicate-coordinate errors, missing files, and digest mismatches fail the job. There are no log-grep exceptions or soft-success handlers.
 
@@ -80,7 +80,7 @@ Publishing uses the **Sonatype Central Portal** plugin (`central-publishing-mave
 
 `GITHUB_TOKEN` (built-in, `contents: write`) creates the final GitHub Release after both registries verify. Run `publishing-preflight.yml` to confirm secret *names* are present; presence does not prove Portal namespace or signing-key acceptance. Generated Maven settings use environment references, and publication logs redact the package token.
 
-GitHub Maven packages are repository-scoped. The reviewed `scripts/package-homes.json` directs all 84 publishable artifacts to `fireflyframework-jafly`. Before uploading any files, the publisher checks every package through the GitHub API. An absent package can be created; an existing package must belong to Jafly. A package still associated with another repository, an inaccessible association, or an API failure stops publication before Maven starts. Changing a deployment URL does not transfer a package or preserve its old versions. The captured `scripts/package-associations.jsonl` remains historical evidence of the previous registry layout. See [GitHub package permissions](https://docs.github.com/en/packages/learn-github-packages/about-permissions-for-github-packages).
+GitHub Maven packages are repository-scoped. The reviewed `scripts/package-homes.json` directs all previously associated publishable artifacts to `fireflyframework-jafly`. Before uploading any files, the publisher checks every package through the GitHub API. An absent package can be created; an existing package must belong to Jafly. A package still associated with another repository, an inaccessible association, or an API failure stops publication before Maven starts. Changing a deployment URL does not transfer a package or preserve its old versions. The captured `scripts/package-associations.jsonl` remains historical evidence of the previous registry layout. See [GitHub package permissions](https://docs.github.com/en/packages/learn-github-packages/about-permissions-for-github-packages).
 
 Namespace authorization and signing-key acceptance require a live publishing run. Credential presence, local tests, and a source POM version do not prove publication.
 

modules/agentic-bridge/fireflyframework-agentic-bridge-autoconfigure/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.fireflyframework</groupId>
         <artifactId>fireflyframework-agentic-bridge</artifactId>
-        <version>26.10.22</version>
+        <version>26.10.23</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

modules/agentic-bridge/fireflyframework-agentic-bridge-core/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.fireflyframework</groupId>
         <artifactId>fireflyframework-agentic-bridge</artifactId>
-        <version>26.10.22</version>
+        <version>26.10.23</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

modules/agentic-bridge/fireflyframework-agentic-bridge-samples/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.fireflyframework</groupId>
         <artifactId>fireflyframework-agentic-bridge</artifactId>
-        <version>26.10.22</version>
+        <version>26.10.23</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

modules/agentic-bridge/fireflyframework-agentic-bridge-starter/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.fireflyframework</groupId>
         <artifactId>fireflyframework-agentic-bridge</artifactId>
-        <version>26.10.22</version>
+        <version>26.10.23</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

modules/agentic-bridge/pom.xml

@@ -7,13 +7,13 @@
     <parent>
         <groupId>org.fireflyframework</groupId>
         <artifactId>fireflyframework-parent</artifactId>
-        <version>26.10.22</version>
+        <version>26.10.23</version>
         <relativePath>../../build/parent/pom.xml</relativePath>
     </parent>
 
     <groupId>org.fireflyframework</groupId>
     <artifactId>fireflyframework-agentic-bridge</artifactId>
-    <version>26.10.22</version>
+    <version>26.10.23</version>
     <packaging>pom</packaging>
 
     <name>Firefly Framework - Agentic Bridge</name>

modules/backoffice/pom.xml

@@ -7,12 +7,12 @@
     <parent>
         <groupId>org.fireflyframework</groupId>
         <artifactId>fireflyframework-parent</artifactId>
-        <version>26.10.22</version>
+        <version>26.10.23</version>
         <relativePath>../../build/parent/pom.xml</relativePath>
     </parent>
 
     <artifactId>fireflyframework-backoffice</artifactId>
-    <version>26.10.22</version>
+    <version>26.10.23</version>
     <packaging>jar</packaging>
 
     <name>Firefly Framework - Common Backoffice Library</name>

modules/batch/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>org.fireflyframework</groupId>
         <artifactId>fireflyframework-parent</artifactId>
-        <version>26.10.22</version>
+        <version>26.10.23</version>
         <relativePath>../../build/parent/pom.xml</relativePath>
     </parent>
     <artifactId>fireflyframework-batch</artifactId>

modules/cache-hazelcast/pom.xml

@@ -7,12 +7,12 @@
     <parent>
         <groupId>org.fireflyframework</groupId>
         <artifactId>fireflyframework-parent</artifactId>
-        <version>26.10.22</version>
+        <version>26.10.23</version>
         <relativePath>../../build/parent/pom.xml</relativePath>
     </parent>
 
     <artifactId>fireflyframework-cache-hazelcast</artifactId>
-    <version>26.10.22</version>
+    <version>26.10.23</version>
     <packaging>jar</packaging>
 
     <name>Firefly Framework - Cache - Hazelcast</name>

modules/cache-jcache/pom.xml

@@ -7,12 +7,12 @@
     <parent>
         <groupId>org.fireflyframework</groupId>
         <artifactId>fireflyframework-parent</artifactId>
-        <version>26.10.22</version>
+        <version>26.10.23</version>
         <relativePath>../../build/parent/pom.xml</relativePath>
     </parent>
 
     <artifactId>fireflyframework-cache-jcache</artifactId>
-    <version>26.10.22</version>
+    <version>26.10.23</version>
     <packaging>jar</packaging>
 
     <name>Firefly Framework - Cache - JCache</name>