diff --git a/.github/shared-files.sha256 b/.github/shared-files.sha256
index 7bb9de26..b926b18f 100644
--- a/.github/shared-files.sha256
+++ b/.github/shared-files.sha256
@@ -52,12 +52,12 @@ e8f444ef851bd134330f1505f52b4b0970ef9a62dd76e4c25829241814ba5c73 .github/ISSUE_
a4f42a0bfa9b14ca937675052b990e5f1dda238d762f9d0268ac282cd7030c0d .github/workflows/publish.yml#verify-signing-key-gradle
6e2ae11dad0616f66bbb2b6e6556f580bb987fd911d7132aa6bee2bfc7cc7b52 .java-version
71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50 .java-version.license
-30b3bed932fd05a34d79af0155166b548a7597e5ee4913aa105dd82a41d1936d .github/workflows/claude.yml
-de1479c5c1e662c0f01d6afd0d18b4a71e8d8168b377287ca6e93285eef63358 .github/workflows/claude-code-review.yml
-fe768632e9abc1a8cd39b038a77c1a79dbfd036129bb7f0d84b393251b369be6 .github/workflows/scorecard.yml
+48cf852de627f1b11f402e408af907ce3e9ec926f6ba11720467645117e92e3a .github/workflows/claude.yml
+362d1d169821b8954dc305dac36b8e2437acdbe2921ac42e9887a215663fa666 .github/workflows/claude-code-review.yml
+d4371cbcd6c5511e9b712599bbadc7b4c2437f3107f5d706a9adccdda24c2c44 .github/workflows/scorecard.yml
480afc0c1e41f3997b195d7297750b43599ba71a7471657aa32bfc9662b6fd30 .github/workflows/reuse.yml
93aedaf67af1c4d63b2502107a51f2f454f2b3b4bc5f2fe892561e12363e57a9 .github/workflows/osv-scanner.yml
-52182fe4073eb696606813d768ff9444e6b751978f9d27a8d84cc269e9f6cb3a .github/workflows/codeql.yml
+ed4231dc5b4ba9357a06974cb61e92b60e3eaac9a293810087efb2933e0cac82 .github/workflows/codeql.yml
c9e757f2d0a2f456a08791697a94161c776d9b008a8aa75890da4133c81a99e9 .github/dependabot.yml
c38151495be64cedc3f11c23b88ffc53f4e0f9d2ce5c0aaaa42b14e4af7e13ec llama/lombok.config
f26d05f25a154b84d8f281bb92857811749e2225cdbc167362de930c48b532d1 .github/workflows/publish.yml#startgate
diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml
index 8d491887..8913b1c0 100644
--- a/.github/workflows/clang-format.yml
+++ b/.github/workflows/clang-format.yml
@@ -19,7 +19,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+ - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
with:
python-version: "3.x"
- name: Install pinned clang-format
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index f19ab4d2..c96753cf 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -25,7 +25,7 @@ jobs:
- name: Run Claude Code Review
id: claude-review
- uses: anthropics/claude-code-action@e4a6faad497d33dbc7144135c75e41f82f0bf6c0 # v1
+ uses: anthropics/claude-code-action@6b6870e649b5ff408753befeaee5fc7989d4e6a9 # v1
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
prompt: |
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 1cbdb2b1..2600eff4 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -36,7 +36,7 @@ jobs:
- name: Run Claude Code
id: claude
- uses: anthropics/claude-code-action@e4a6faad497d33dbc7144135c75e41f82f0bf6c0 # v1
+ uses: anthropics/claude-code-action@6b6870e649b5ff408753befeaee5fc7989d4e6a9 # v1
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 02f86b73..da8c6ade 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -27,9 +27,9 @@ jobs:
with: { java-version: '25', distribution: temurin }
- uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
with: { java-version-file: .java-version, distribution: temurin }
- - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
+ - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
with: { languages: java, queries: +security-and-quality }
- name: Build with Maven
run: mvn --batch-mode --no-transfer-progress compile
- - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
+ - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
with: { category: "/language:java" }
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 98e295b1..2ffe907a 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -43,6 +43,6 @@ jobs:
retention-days: 5
- name: Upload to code-scanning
- uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
+ uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
with:
sarif_file: results.sarif
diff --git a/CHANGELOG.md b/CHANGELOG.md
index dea5592c..7a2696dd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -433,13 +433,21 @@ the first two items break every existing consumer at upgrade.
- `TextToSpeech` follows llama.cpp b11796 (#30902): `mtmd_helper::gen_audio` is initialised explicitly and
the synthesis input starts from upstream's defaults (a `stream` flag joined the struct, off here). No
change to the Java API; a projector without audio generation is refused with a message, as before.
+- Build tooling bumped in step with the sibling repositories: `anthropics/claude-code-action` v1.0.258,
+ `github/codeql-action` v4.39.1 and `actions/setup-python` v7.1.0 (clang-format workflow).
+ maven-clean-plugin 3.5.0, maven-install-plugin 3.2.0, maven-deploy-plugin 3.2.0 and
+ maven-dependency-plugin 3.11.0 are now declared in the reactor's pluginManagement and in
+ `llama-atmosphere-agent`: no POM named them, so their versions came from whichever Maven ran the build.
+ Maven 3.9 runs clean 3.2.0, install and deploy 3.1.x and dependency 3.7.0; the Ubuntu runners' Maven
+ 3.10.0 already matches, except that it leaves the dependency plugin to the newest release.
+ `dependency:build-classpath` and `copy-dependencies` give the same output under 3.7.0 and 3.11.0.
- Dependencies and build tooling bumped in step with the sibling repositories: Jackson 2.22.3 ->
2.22.4 (`jackson.version`, which the `jackson-bom` and the AAR pom follow), LogCaptor 2.12.7 ->
2.13.0 (test; still requests log4j 2.26.1, so the log4j floor guard is unchanged); in the agent
Atmosphere 4.0.72 -> 4.0.75 and central-publishing-maven-plugin 0.11.0 -> 0.12.0 (the reactor
already had it); jsign 7.2 -> 7.6 for the Windows code signing (`sign-windows-natives.sh`, new
SHA-256; same options, same eSigner authentication path); Gradle 9.8.1 -> 9.8.2 (`GRADLE_VERSION`
- and the shared `verify-signing-key-gradle` job); `anthropics/claude-code-action` v1.0.255.
+ and the shared `verify-signing-key-gradle` job).
- **Values that were ignored, misread or left to fail at load time are refused when they are set,
with an `IllegalArgumentException` naming the value:**
- `TrainingParameters.toJson()` (and so `LlamaTrainer.finetune`) checks the documented bounds before
diff --git a/CLAUDE.md b/CLAUDE.md
index b97c95b7..fa49f879 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -3012,7 +3012,8 @@ construction** (no CI guard needed). The parent also holds the shared `release`
Central Publishing) and a `` with every plugin version more than one module uses
(compiler, jar, resources, surefire, source, javadoc, gpg, central-publishing -- a module names such a
plugin without a version; without it a module that pins nothing builds with the default of whatever
-Maven runs it, which differed between CI and a local build), so one reactor `mvn -P release,natives deploy` signs and publishes all six
+Maven runs it, which differed between CI and a local build; and, for the same reason, clean, install,
+deploy and dependency, which no module configures but the lifecycle and CI's `mvn dependency:...` run), so one reactor `mvn -P release,natives deploy` signs and publishes all six
Maven artifacts (`llama-parent` pom, `llama` with its natives jars, `llama-langchain4j`,
`llama-kotlin`, `llama-ffm`, `llama-platform` pom) at the same version.
diff --git a/llama-atmosphere-agent/pom.xml b/llama-atmosphere-agent/pom.xml
index 31b71da0..7fe5077c 100644
--- a/llama-atmosphere-agent/pom.xml
+++ b/llama-atmosphere-agent/pom.xml
@@ -84,6 +84,10 @@ SPDX-License-Identifier: MIT
3.2.8
0.12.0
3.6.4
+ 3.5.0
+ 3.2.0
+ 3.2.0
+ 3.11.0
3.10.4
2.102.0
net.ladenthin.llama.atmosphere.LocalAgent
@@ -215,6 +219,38 @@ SPDX-License-Identifier: MIT
+
+
+
+
+ org.apache.maven.plugins
+ maven-clean-plugin
+ ${clean.plugin.version}
+
+
+ org.apache.maven.plugins
+ maven-install-plugin
+ ${install.plugin.version}
+
+
+ org.apache.maven.plugins
+ maven-deploy-plugin
+ ${deploy.plugin.version}
+
+
+ org.apache.maven.plugins
+ maven-dependency-plugin
+ ${dependency.plugin.version}
+
+
+
org.apache.maven.plugins
diff --git a/pom.xml b/pom.xml
index a2efd70f..b813bb4f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -134,6 +134,34 @@ SPDX-License-Identifier: MIT
maven-surefire-plugin
3.6.0
+
+
+ org.apache.maven.plugins
+ maven-clean-plugin
+ 3.5.0
+
+
+ org.apache.maven.plugins
+ maven-install-plugin
+ 3.2.0
+
+
+ org.apache.maven.plugins
+ maven-deploy-plugin
+ 3.2.0
+
+
+ org.apache.maven.plugins
+ maven-dependency-plugin
+ 3.11.0
+