build(deps): bump analysis tooling and shared libraries to current

[bernardladenthin]

Summary

Pure version maintenance, no behaviour change. One of four coordinated PRs (jllama / srcmorph / BAF / streambuffer).

This repo already carries the cross-repo group — maven-compiler-plugin 3.16.0, maven-surefire-plugin 3.6.0 and nullaway 0.14.1 landed here via Dependabot (#357–#360) and are exactly what the three sibling repos are now being brought up to. What is left is the group all four were behind on:

	before	after
git-commit-id-maven-plugin	10.0.0	10.0.1
spotless-maven-plugin	3.10.1	3.10.2
spotbugs-maven-plugin	4.10.4.0	4.10.4.1
checker / checker-qual	4.2.2	4.2.3
lombok	1.18.46	1.18.48
slf4j-api	2.0.18	2.0.19

The checker bump moves one property that feeds both the annotation processor and the qualifiers, and that coupling is the point: the Nullness Checker resolves its own qualifiers through javac's symbol table, so the two must share a major version — the lesson from the 3.55.1 pin reverted in java-llama.cpp.

The comment above the slf4j-api pin named the old version in prose ("logback-classic brings 2.0.17; we declare 2.0.18 directly"); it now names 2.0.19, so the rationale cannot drift away from the value it explains. logback-classic stays at 1.6.3, which is current.

Deliberately NOT bumped: jqwik stays at 1.9.3. Releases from 1.10.0 on print a prompt-injection string aimed at AI coding agents, and the workspace policy requires rejecting any PR that moves it. Dependabot will keep proposing it.

Test plan

• mvn clean verify green — 2214 tests, 0 failures
• Class-file gate clean over a real -P assembly fat jar: 15779 classes, 0 above major 65
• spotless 3.10.2 reformats nothing — the working tree after spotless:apply holds only the pom edit
• CI is green on this branch
• No source or test change; pom only

⚠️ One pre-existing main failure, not touched here

ExampleRunScriptJarVersionTest fails because 24 examples/run_*.sh|.bat files and docs/tuning-your-gpu.md still reference 1.8.0 while the project is at 1.9.0-SNAPSHOT. I confirmed it is pre-existing by running that test on an unmodified main — it fails there identically, so it is not caused by these bumps.

Whether those scripts should track the SNAPSHOT or stay on the last released version is a release-process decision, not a dependency one, so I left it for a separate change. The verification above therefore excluded that single test and nothing else. Say the word and I'll fix it — it is a mechanical 1.8.0 → 1.9.0-SNAPSHOT across 25 files, but the right target value is yours to pick.

Related PRs

Same change in java-llama.cpp, srcmorph and streambuffer — those three additionally carry the compiler/surefire/nullaway bumps this repo already has.

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits
• No security-sensitive changes

🤖 Generated with Claude Code

https://claude.ai/code/session_01AnNYn8W1xuVxVJtyL34GyH

---

Generated by Claude Code

[claude]

Review Summary ✅

This is a solid, well-executed dependency bump PR with no issues identified.

✅ Strengths

1. Surgical changes — Only pom.xml modified with patch-level version updates (7 additions, 7 deletions)
2. Excellent documentation — Clear rationale for each bump, intentional decisions (e.g., jqwik stay at 1.9.3), and rationale for cross-repo coordination
3. Test coverage — 2214 tests passed, class-file gate verified over real assembly jar, spotless validation clean
4. Version coupling handled correctly — Checker 4.2.2→4.2.3 bump is noted as coordinating with the nullness annotation processor
5. Comment maintenance — slf4j-api comment updated from prose naming old version to new version, preventing documentation drift

Code Quality

• ✅ No behavior changes (pom only)
• ✅ All updates are stable patch versions
• ✅ No source/test modifications
• ✅ Dependency convergence issues addressed

Security

• ✅ No security concerns — moving to current stable versions of all tools
• ✅ No risky alpha/beta versions

Decisions Affirmed

• ✅ Intentional jqwik 1.9.3 hold (rejecting 1.10.0+ due to prompt-injection strings) is correct per workspace policy
• ✅ Pre-existing ExampleRunScriptJarVersionTest failure noted and deferred — appropriate separation of concerns (dependency maintenance vs. release-process decisions)

Recommendation: Ready to merge. This is a low-risk maintenance update with strong test evidence and clear coordination across related repositories.