[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.apache.commons:commons-lang3 (source)	3.21.0 → 3.22.0

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At 08:00 PM through 11:59 PM and 12:00 AM through 07:59 AM, Monday through Friday (* 20-23,0-7 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: gradle/libs.versions.toml

Command failed: ./gradlew -Dorg.gradle.jvmargs=-Xms512m -Xmx512m --console=plain --dependency-verification lenient -q properties

FAILURE: Build failed with an exception.

* What went wrong:
A problem occurred configuring root project 'sonarqube-mcp-server'.
> Could not resolve all artifacts for configuration 'classpath'.
   > Could not resolve org.sonarsource.scanner.lib:sonar-scanner-java-library-shaded:4.2.1.1698.
     Required by:
         buildscript of root project 'sonarqube-mcp-server' > org.sonarqube:org.sonarqube.gradle.plugin:7.5.0.8588 > org.sonarsource.scanner.gradle:sonarqube-gradle-plugin:7.5.0.8588
      > Could not resolve org.sonarsource.scanner.lib:sonar-scanner-java-library-shaded:4.2.1.1698.
         > Could not get resource 'https://plugins.gradle.org/m2/org/sonarsource/scanner/lib/sonar-scanner-java-library-shaded/4.2.1.1698/sonar-scanner-java-library-shaded-4.2.1.1698.pom'.
            > Could not GET 'https://repo.maven.apache.org/maven2/org/sonarsource/scanner/lib/sonar-scanner-java-library-shaded/4.2.1.1698/sonar-scanner-java-library-shaded-4.2.1.1698.pom'.
               > Received status code 429 from server: Too Many Requests
> There are 18 more failures with identical causes.

* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Get more help at https://help.gradle.org.

BUILD FAILED in 52s

File name: undefined

Post-upgrade command './gradlew --write-locks dependencies :its:dependencies' has not been added to the allowed list in allowedCommands

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: MCP-745

✅ All code review findings resolved.

_{Configure merge blocking}

[gitar-bot]

Code Review ✅ Approved 🟡 Medium risk 1 closed / 1 findings

Updating Commons Lang from 3.21.0 to 3.22.0 changes a runtime dependency and could alter behavior in application code that uses its utilities.

Bumps org.apache.commons:commons-lang3 from 3.21.0 to 3.22.0, with lock files updated to match. The previously flagged issue that lockfiles still pinned 3.21.0 and would break resolution has been addressed.

✅ 1 closed

✅ Bug: Lockfiles still pin commons-lang3 3.21.0, so resolution will fail

📄 gradle/libs.versions.toml:13
Both projects turn on dependencyLocking { lockAllConfigurations() } (build.gradle.kts, its/build.gradle.kts) in the default lock mode. This PR bumps the version catalog to 3.22.0 but leaves gradle.lockfile (org.apache.commons:commons-lang3:3.21.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath) and its/gradle.lockfile (commons-lang3:3.21.0=testRuntimeClasspath, which comes in through testImplementation(project(":"))) unchanged. In the default lock mode, the declared 3.22.0 wins conflict resolution against the locked 3.21.0, and Gradle then fails because the resolved version isn't in the lock state ("Dependency lock state out of date"). So compile, test and ITs all break. The repo README and docs/development/README.md both say lockfiles must be regenerated after a version change. To fix this, run ./gradlew :dependencies --write-locks and ./gradlew :its:dependencies --write-locks with Repox credentials and commit both lockfiles. You could also configure Renovate's post-upgrade tasks or lockfile maintenance so it updates gradle.lockfile by itself.

Verification Rules 2/2 met

Functional validation No results

Rules 2 passed 2 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.