Bump Jackson, LogCaptor, Atmosphere, jsign and the shared Claude/Gradle pins

.github/shared-files.sha256

@@ -49,14 +49,14 @@ c47fad91718bf42aac298f569dcb8d0e36c81987f8706952d0637fb34ec1a1b5  .github/FUNDIN
 e8f444ef851bd134330f1505f52b4b0970ef9a62dd76e4c25829241814ba5c73  .github/ISSUE_TEMPLATE/config.yml?repo
 2de09a4aa4b2bf2f9199c603806c6b6b65c254adbc35a6b5d184652f7022e69f  .mvn/jvm.config
 71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50  .mvn/jvm.config.license
-06f0af70ed125dc5cc1506e27970059fb831971d3faaee56f868789f3282fdf9  .github/workflows/publish.yml#verify-signing-key-gradle
+a4f42a0bfa9b14ca937675052b990e5f1dda238d762f9d0268ac282cd7030c0d  .github/workflows/publish.yml#verify-signing-key-gradle
 6e2ae11dad0616f66bbb2b6e6556f580bb987fd911d7132aa6bee2bfc7cc7b52  .java-version
 71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50  .java-version.license
-3f73b87c4675376cbe80f1fb914bd7020062dcdb9a7ee503d3ef787fd462358a  .github/workflows/claude.yml
-085f19495d9e0812dc90268ea7917579bd6eaf749c669a9f01922272a5cdf06f  .github/workflows/claude-code-review.yml
-463c34f6244675ee5bee3d28c28c84f5eb3c8bea4f45de3f6ce477348d29589c  .github/workflows/scorecard.yml
+30b3bed932fd05a34d79af0155166b548a7597e5ee4913aa105dd82a41d1936d  .github/workflows/claude.yml
+de1479c5c1e662c0f01d6afd0d18b4a71e8d8168b377287ca6e93285eef63358  .github/workflows/claude-code-review.yml
+fe768632e9abc1a8cd39b038a77c1a79dbfd036129bb7f0d84b393251b369be6  .github/workflows/scorecard.yml
 480afc0c1e41f3997b195d7297750b43599ba71a7471657aa32bfc9662b6fd30  .github/workflows/reuse.yml
-cf75cdc06e5ab02359c12b6a8eecb97f2dd3d95502cd2b397d539584cefa56c3  .github/workflows/osv-scanner.yml
+93aedaf67af1c4d63b2502107a51f2f454f2b3b4bc5f2fe892561e12363e57a9  .github/workflows/osv-scanner.yml
 52182fe4073eb696606813d768ff9444e6b751978f9d27a8d84cc269e9f6cb3a  .github/workflows/codeql.yml
 c9e757f2d0a2f456a08791697a94161c776d9b008a8aa75890da4133c81a99e9  .github/dependabot.yml
 c38151495be64cedc3f11c23b88ffc53f4e0f9d2ce5c0aaaa42b14e4af7e13ec  llama/lombok.config

.github/sign-windows-natives.sh

@@ -25,8 +25,8 @@
 set -euo pipefail
 
 ROOT="${1:?natives root}"
-JSIGN_VERSION="7.2"
-JSIGN_SHA256="9a99673bb011cc1d7faf00bc840a6b333fc8a9b596098da2f92946b68297f067"
+JSIGN_VERSION="7.6"
+JSIGN_SHA256="6cf58aa080e7ff82656f320cff8d4a3bff30408df8766806dcba3740dd839fa5"
 TSA_URL="http://ts.ssl.com"
 ES_ENDPOINT="${ES_ENDPOINT:-https://cs.ssl.com}"
 

.github/workflows/claude-code-review.yml

@@ -25,7 +25,7 @@ jobs:
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@374f254f5efaf968abfe15d399fd90972e8138b9 # v1
+        uses: anthropics/claude-code-action@e4a6faad497d33dbc7144135c75e41f82f0bf6c0 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: |

.github/workflows/claude.yml

@@ -36,7 +36,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@374f254f5efaf968abfe15d399fd90972e8138b9 # v1
+        uses: anthropics/claude-code-action@e4a6faad497d33dbc7144135c75e41f82f0bf6c0 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 

.github/workflows/publish.yml

@@ -30,7 +30,7 @@ env:
   # AGP 9.4.x needs Gradle >= 9.6.0 (android-llmservice/CLAUDE.md). Not seen by Dependabot: bump by hand,
   # together with the literal in verify-signing-key-gradle (a job kept identical in all four sibling
   # repositories, so it names its version itself).
-  GRADLE_VERSION: '9.8.1'
+  GRADLE_VERSION: '9.8.2'
   # The sccache/Depot compiler cache (CLAUDE.md, "CI build cache"). Inert without the token, which
   # stays per build job (SCCACHE_WEBDAV_TOKEN): at workflow level it would reach every job,
   # including those running third-party actions. A release build (a v* tag, which is what
@@ -195,7 +195,7 @@ jobs:
           distribution: temurin
       - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
         with:
-          gradle-version: "9.8.1"
+          gradle-version: "9.8.2"
       - name: Sign a throwaway artifact via useInMemoryPgpKeys (BouncyCastle)
         shell: bash
         env:

CHANGELOG.md

@@ -238,6 +238,13 @@ the first two items break every existing consumer at upgrade.
   core's; `check-natives.py` fails when they differ.
 
 ### Changed
+- Dependencies and build tooling bumped in step with the sibling repositories: Jackson 2.22.3 ->
+  2.22.4 (`jackson.version`, which the `jackson-bom` and the AAR pom follow), LogCaptor 2.12.7 ->
+  2.13.0 (test; still requests log4j 2.26.1, so the log4j floor guard is unchanged); in the agent
+  Atmosphere 4.0.72 -> 4.0.75 and central-publishing-maven-plugin 0.11.0 -> 0.12.0 (the reactor
+  already had it); jsign 7.2 -> 7.6 for the Windows code signing (`sign-windows-natives.sh`, new
+  SHA-256; same options, same eSigner authentication path); Gradle 9.8.1 -> 9.8.2 (`GRADLE_VERSION`
+  and the shared `verify-signing-key-gradle` job); `anthropics/claude-code-action` v1.0.255.
 - **`libjllama` exports only its interface.** Hidden visibility for the project's own translation
   units, a version script on ELF and an exported-symbols list on macOS keep the statically linked
   llama, llama-common, mtmd, cpp-httplib and BoringSSL symbols local: the Linux library exported

CLAUDE.md

@@ -3136,7 +3136,7 @@ certificate and the secrets exist.
   tolerates its skip (`!cancelled() && !contains(needs.*.result, 'failure') && ...`): skipped means
   no switch, run and failed (wrong secrets, the environment refusing the branch) means `package`
   is skipped too, because the signature was asked for.
-- **How**: `.github/sign-windows-natives.sh` -- **jsign** (`net.jsign:jsign:7.2` from Maven Central,
+- **How**: `.github/sign-windows-natives.sh` -- **jsign** (`net.jsign:jsign:7.6` from Maven Central,
   pinned by version and SHA-256; Java, runs on the Linux runner, no signtool) with
   `--storetype ESIGNER --keystore <endpoint> --storepass "<username>|<password>" --alias
   <credential id> --keypass <TOTP secret>` (read from jsign's `KeyStoreType`: the store password must

android-llmservice/CLAUDE.md

@@ -30,7 +30,7 @@ Structure (mirrors the consumer-test's plumbing):
   `.github/android-consumer-test` fixture is pinned the same way. AGP 9.4.x requires Gradle >= 9.6.0
   and JDK 17+; CI already runs JDK 21 everywhere (`.java-version`), so only the `gradle-version`
   pin on the jobs that build this project (and the `.github/android-consumer-test` fixture)
-  needed bumping (currently `9.8.1`). AGP 9.0+ has **built-in Kotlin support** (a runtime dependency on
+  needed bumping (currently `9.8.2`). AGP 9.0+ has **built-in Kotlin support** (a runtime dependency on
   Kotlin Gradle plugin 2.2.10+), so the standalone `org.jetbrains.kotlin.android` plugin is no longer
   applied — applying it now fails the build with "no longer required for Kotlin support since
   AGP 9.0" (`app/build.gradle.kts` line 7). The Compose compiler plugin still applies

llama-atmosphere-agent/CLAUDE.md

@@ -66,7 +66,7 @@ The pom depends on that starter with a `*:*` exclusion, so no Spring class reach
 only the starter jar itself does, which is where `WebConsole` reads the pages from. Drop the dependency
 and `--web` starts with nothing to open (`WebConsole.available()` says so at startup).
 
-**What Atmosphere is, for this purpose.** `org.atmosphere:atmosphere-ai` (4.0.72) ships
+**What Atmosphere is, for this purpose.** `org.atmosphere:atmosphere-ai` (4.0.75) ships
 `BuiltInAgentRuntime` + `OpenAiCompatibleClient`: a zero-framework OpenAI client that *always*
 streams (`stream:true`), accumulates `delta.tool_calls` by `index`, executes `ToolDefinition`
 executors, re-submits the conversation (assistant `tool_calls` message **without** a `content` key,

llama-atmosphere-agent/pom.xml

@@ -67,7 +67,7 @@ SPDX-License-Identifier: MIT
 		     the java-llama.cpp reactor. Overridable, e.g. -Dllama.version=5.3.0-SNAPSHOT to try a
 		     newer core from the snapshot repository below. -->
 		<llama.version>${project.version}</llama.version>
-		<atmosphere.version>4.0.72</atmosphere.version>
+		<atmosphere.version>4.0.75</atmosphere.version>
 		<jline.version>4.4.8</jline.version>
 		<jetty.version>12.1.14</jetty.version>
 		<acp.version>0.80.0</acp.version>
@@ -82,7 +82,7 @@ SPDX-License-Identifier: MIT
 		<source.plugin.version>3.4.0</source.plugin.version>
 		<javadoc.plugin.version>3.12.0</javadoc.plugin.version>
 		<gpg.plugin.version>3.2.8</gpg.plugin.version>
-		<central.publishing.version>0.11.0</central.publishing.version>
+		<central.publishing.version>0.12.0</central.publishing.version>
 		<exec.plugin.version>3.6.4</exec.plugin.version>
 		<spotless.version>3.10.4</spotless.version>
 		<palantir-java-format.version>2.102.0</palantir-java-format.version>

llama/pom.xml

@@ -72,13 +72,13 @@ SPDX-License-Identifier: MIT
 		<jmh.version>1.37</jmh.version>
 		<jcstress.version>0.16</jcstress.version>
 		<lincheck.version>3.7</lincheck.version>
-		<logcaptor.version>2.12.7</logcaptor.version>
+		<logcaptor.version>2.13.0</logcaptor.version>
 		<!-- FLOOR GUARD, no longer an active fix. log4j-api / log4j-to-slf4j arrive ONLY as
 		     test-scope transitives of io.github.hakky54:logcaptor. When this pin was added,
 		     logcaptor 2.12.6 requested log4j 2.25.3, affected by CVE-2026-49844
 		     (GHSA-qv9r-c865-cp47, moderate): MapMessage.asJson() emits bare NaN/Infinity
 		     tokens for non-finite floats, producing non-RFC-8259 JSON.
-		     logcaptor 2.12.7 declares <version.log4j>2.26.1</version.log4j> itself, i.e.
+		     logcaptor 2.12.7 and 2.13.0 declare <version.log4j>2.26.1</version.log4j> itself, i.e.
 		     exactly what this pin forces, so today it changes nothing about the resolved
 		     graph. It is kept as a lower bound: if logcaptor ever falls back to an affected
 		     line, the pin holds the version here instead of letting it regress silently.

pom.xml

@@ -62,7 +62,7 @@ SPDX-License-Identifier: MIT
 			because nothing managed it there. The BOM import below pins the whole family for every
 			module, so a transitive jackson can no longer be older than this.
 		-->
-		<jackson.version>2.22.3</jackson.version>
+		<jackson.version>2.22.4</jackson.version>
 	</properties>
 
 	<dependencyManagement>