From 4e515b027a44aee9f578bd44406782ae7d147518 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 20 Sep 2026 11:29:04 +0000 Subject: [PATCH] build(deps): palantir-java-format 2.98.0, exec-maven-plugin 3.6.4, osv-scanner-action v2.6.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cross-repo dependency sweep of 2026-09-20. palantir-java-format 2.97.0 -> 2.98.0 all three modules (spotless formatter; bumped in all four sibling repos together) exec-maven-plugin 3.6.3 -> 3.6.4 srcmorph-maven-plugin (closes drift: BAF and streambuffer already carried 3.6.4) google/osv-scanner-action v2.5.1 -> v2.6.0 the reusable workflows CLAUDE.md's dependency table said slf4j 2.0.18 while the parent has converged on 2.0.19 since #205; synced. Deliberately NOT bumped: jqwik 1.9.3 (workspace policy), slf4j 2.0.19 (2.1.0 is alpha-only), maven-plugin-api / maven-plugin-tools (only Maven-4 betas/RCs on offer). The unresolvable `5.2.0` pin is unchanged — that is a java-llama.cpp release decision tracked in TODO.md, not a version bump. Verified as far as this repo currently allows: `mvn -pl srcmorph,srcmorph-cli, srcmorph-maven-plugin spotless:apply` under palantir 2.98.0 changes no Java file; with `-Dllama.version=5.2.0-SNAPSHOT` (java-llama.cpp's current main installed locally) all three modules compile and the reactor reaches spotbugs:check. That step then fails on 4 pre-existing findsecbugs findings in LlamaCppJniProviderSupport — reproduced identically on the unmodified origin/main tree, so not caused here. Recorded in TODO.md next to the 5.2.0 blocker it hides behind, because it will be the next red the moment that pin resolves. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01FbGmAZY9bwxox72iU13HvJ --- .github/workflows/osv-scanner.yml | 4 ++-- CLAUDE.md | 4 ++-- TODO.md | 11 +++++++++++ srcmorph-cli/pom.xml | 2 +- srcmorph-maven-plugin/pom.xml | 4 ++-- srcmorph/pom.xml | 2 +- 6 files changed, 19 insertions(+), 8 deletions(-) diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 06c54a13..c47be350 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -17,7 +17,7 @@ permissions: read-all jobs: scan-scheduled: if: ${{ github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }} - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.5.1" + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.6.0" permissions: actions: read contents: read @@ -25,7 +25,7 @@ jobs: scan-pr: if: ${{ github.event_name == 'pull_request' }} - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.5.1" + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.6.0" permissions: actions: read contents: read diff --git a/CLAUDE.md b/CLAUDE.md index e067a97c..1c8c858d 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -398,8 +398,8 @@ assume it has already been updated. | Dependency | Version | Used by | |---|---|---| | `net.ladenthin:llama` | 5.2.0 | `srcmorph` (`provider` package only) — llama.cpp JNI binding; its own SLF4J binding is excluded transitively (see "Java 8 bytecode floor") | -| `org.slf4j:slf4j-api` | 2.0.18 (converged in the parent) | `srcmorph`, `srcmorph-cli`, the plugin | -| `org.slf4j:slf4j-simple` | 2.0.18 (converged in the parent) | `srcmorph-cli` (runtime binding) | +| `org.slf4j:slf4j-api` | 2.0.19 (converged in the parent) | `srcmorph`, `srcmorph-cli`, the plugin | +| `org.slf4j:slf4j-simple` | 2.0.19 (converged in the parent) | `srcmorph-cli` (runtime binding) | | `ch.qos.logback:logback-classic` | 1.6.3 (converged in the parent) | `srcmorph` (**test scope only** — `ListAppender` capture) | | `com.fasterxml.jackson.core:jackson-databind` | pinned in parent | `srcmorph-cli` (JSON config) | | `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` | pinned in parent | `srcmorph-cli` (YAML config) | diff --git a/TODO.md b/TODO.md index 6b8e6965..4159af5e 100644 --- a/TODO.md +++ b/TODO.md @@ -28,6 +28,17 @@ everything below is genuinely still open. so publishing that release is the likelier fix. Decide which, then re-run CI to confirm — this is the one item here that blocks everything else in the repo. +- **Second latent red behind the one above: `spotbugs:check` fails on `srcmorph` with 4 findsecbugs + findings.** Found 2026-09-20 by compiling the reactor against a locally installed + `net.ladenthin:llama:5.2.0-SNAPSHOT` (`-Dllama.version=5.2.0-SNAPSHOT -DskipTests verify`), the + only way to get past the unresolvable pin: `LlamaCppJniProviderSupport` (introduced by `45b619c`, + 2026-09-05) raises `CRLF_INJECTION_LOGS` ×2 and `IMPROPER_UNICODE` ×2, all reported at line 49, and + nothing in `srcmorph/spotbugs-exclude.xml` covers the class. It is invisible today only because + every CI run dies at the dependency step before spotbugs runs; the moment the 5.2.0 pin resolves, + `Code style (spotless) + package graph` goes red on this instead. Reproduced on the unmodified + `origin/main` tree, so it is not an artefact of the dependency sweep. Fix the code or add a + justified suppression per `../workspace/policies/spotbugs-suppressions.md` in the same change + that unblocks the pin. - **The sixteen GPU classifier fat jars are verified structurally, never launched.** Since 1.2.0 `.github/verify-classifier-fatjars.sh` asserts each is the artifact its name claims (one jar per classifier, a native for the promised OS/arch, a native set that differs from the default jar's, so diff --git a/srcmorph-cli/pom.xml b/srcmorph-cli/pom.xml index efac4c36..6220fa34 100644 --- a/srcmorph-cli/pom.xml +++ b/srcmorph-cli/pom.xml @@ -59,7 +59,7 @@ SPDX-License-Identifier: Apache-2.0 7.7.4 1.14.0 3.10.2 - 2.97.0 + 2.98.0 2026-09-01T07:56:35Z diff --git a/srcmorph-maven-plugin/pom.xml b/srcmorph-maven-plugin/pom.xml index 414be321..f8c312fd 100644 --- a/srcmorph-maven-plugin/pom.xml +++ b/srcmorph-maven-plugin/pom.xml @@ -98,7 +98,7 @@ SPDX-License-Identifier: Apache-2.0 7.7.4 1.14.0 3.10.2 - 2.97.0 + 2.98.0 ${project.basedir}/src/site/ai @@ -347,7 +347,7 @@ SPDX-License-Identifier: Apache-2.0 org.codehaus.mojo exec-maven-plugin - 3.6.3 + 3.6.4 org.jacoco diff --git a/srcmorph/pom.xml b/srcmorph/pom.xml index 54c40e5e..6908b7ca 100644 --- a/srcmorph/pom.xml +++ b/srcmorph/pom.xml @@ -91,7 +91,7 @@ SPDX-License-Identifier: Apache-2.0 7.7.4 1.14.0 3.10.2 - 2.97.0 + 2.98.0 2026-09-01T07:56:35Z