From e5aa785dce23aebda785905ebf83b77c8804fed0 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 22:48:25 +0000 Subject: [PATCH] Bump Jackson and the shared Claude/Gradle pins - Jackson 2.22.3 -> 2.22.4 (the CLI's JSON/YAML configuration binding) - anthropics/claude-code-action v1.0.251 -> v1.0.255, now the same commit in all four repositories - Gradle 9.8.1 -> 9.8.2 in the shared verify-signing-key-gradle job - shared-files.sha256 rewritten, including the scorecard.yml / osv-scanner.yml hashes Dependabot's action bumps had left stale Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_011CYhRUUCqwrHXPuEhS9W4M --- .github/shared-files.sha256 | 10 +++++----- .github/workflows/claude-code-review.yml | 2 +- .github/workflows/claude.yml | 2 +- .github/workflows/publish.yml | 2 +- CHANGELOG.md | 3 +++ pom.xml | 2 +- 6 files changed, 12 insertions(+), 9 deletions(-) diff --git a/.github/shared-files.sha256 b/.github/shared-files.sha256 index ea9c329..b06080d 100644 --- a/.github/shared-files.sha256 +++ b/.github/shared-files.sha256 @@ -54,11 +54,11 @@ e8f444ef851bd134330f1505f52b4b0970ef9a62dd76e4c25829241814ba5c73 .github/ISSUE_ 49eda3d2e846e1b5ec1d0f646a1adafb45ef42efbc3a50931df207bf9759ef13 .github/workflows/sonarqube.yml?repo 6e2ae11dad0616f66bbb2b6e6556f580bb987fd911d7132aa6bee2bfc7cc7b52 .java-version 71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50 .java-version.license -3f73b87c4675376cbe80f1fb914bd7020062dcdb9a7ee503d3ef787fd462358a .github/workflows/claude.yml -085f19495d9e0812dc90268ea7917579bd6eaf749c669a9f01922272a5cdf06f .github/workflows/claude-code-review.yml -463c34f6244675ee5bee3d28c28c84f5eb3c8bea4f45de3f6ce477348d29589c .github/workflows/scorecard.yml +30b3bed932fd05a34d79af0155166b548a7597e5ee4913aa105dd82a41d1936d .github/workflows/claude.yml +de1479c5c1e662c0f01d6afd0d18b4a71e8d8168b377287ca6e93285eef63358 .github/workflows/claude-code-review.yml +fe768632e9abc1a8cd39b038a77c1a79dbfd036129bb7f0d84b393251b369be6 .github/workflows/scorecard.yml 480afc0c1e41f3997b195d7297750b43599ba71a7471657aa32bfc9662b6fd30 .github/workflows/reuse.yml -cf75cdc06e5ab02359c12b6a8eecb97f2dd3d95502cd2b397d539584cefa56c3 .github/workflows/osv-scanner.yml +93aedaf67af1c4d63b2502107a51f2f454f2b3b4bc5f2fe892561e12363e57a9 .github/workflows/osv-scanner.yml 52182fe4073eb696606813d768ff9444e6b751978f9d27a8d84cc269e9f6cb3a .github/workflows/codeql.yml c9e757f2d0a2f456a08791697a94161c776d9b008a8aa75890da4133c81a99e9 .github/dependabot.yml abea5fb970a46ccf9ba9127d59abf304202efd13c2d6a28da2ff75da0c92a9b8 .github/smoke-fatjar-cli.sh @@ -68,6 +68,6 @@ e3dde66089fd568f03caeefee86ea36a9f6eb7f47e5dc6d053e0e5784fd7a208 .github/workfl 3ef45f189f4419e0d4087f572b3c1b6085c0fe39ac7979b07deb2e882f7ffe8c .github/workflows/publish.yml#verify-signing-key 09230b04c5f14bdda50a0c862152ff197a656cbc3fd0d110899c5f8150f8aa9a .github/workflows/publish.yml#check-snapshot 51e987d59efd9887b43e345edc0e0f3db21686879e3ca6ea9f0fdbc493d37121 .github/workflows/publish.yml#check-tag -06f0af70ed125dc5cc1506e27970059fb831971d3faaee56f868789f3282fdf9 .github/workflows/publish.yml#verify-signing-key-gradle +a4f42a0bfa9b14ca937675052b990e5f1dda238d762f9d0268ac282cd7030c0d .github/workflows/publish.yml#verify-signing-key-gradle c2684a3f93aaf552c13f845307536c2a14dda315c7d7b1e416bc66951b811dc1 .github/workflows/publish.yml#github-snapshot c09a030706dbea4221851ca0fcbfa6fc686165b408724724ade61724da6e123b .github/workflows/publish.yml#github-release diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 40487c1..f19ab4d 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -25,7 +25,7 @@ jobs: - name: Run Claude Code Review id: claude-review - uses: anthropics/claude-code-action@374f254f5efaf968abfe15d399fd90972e8138b9 # v1 + uses: anthropics/claude-code-action@e4a6faad497d33dbc7144135c75e41f82f0bf6c0 # v1 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} prompt: | diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 5826e1b..1cbdb2b 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -36,7 +36,7 @@ jobs: - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@374f254f5efaf968abfe15d399fd90972e8138b9 # v1 + uses: anthropics/claude-code-action@e4a6faad497d33dbc7144135c75e41f82f0bf6c0 # v1 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 46cfaf3..0c7ae02 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -153,7 +153,7 @@ jobs: distribution: temurin - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6 with: - gradle-version: "9.8.1" + gradle-version: "9.8.2" - name: Sign a throwaway artifact via useInMemoryPgpKeys (BouncyCastle) shell: bash env: diff --git a/CHANGELOG.md b/CHANGELOG.md index 91e1a56..4f29948 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,9 @@ The release procedure (prompt template and step-by-step instructions) lives in [ ## [Unreleased] ### Changed +- Dependencies and build tooling bumped in step with the sibling repositories: Jackson 2.22.3 -> + 2.22.4 (the CLI's JSON/YAML configuration binding); `anthropics/claude-code-action` v1.0.255 and + Gradle 9.8.2 in the shared `verify-signing-key-gradle` job. - **Build tooling: spotbugs-maven-plugin 4.10.4.1 -> 4.10.5.0** in all three modules, in step with the sibling repositories, and `checker-qual` 4.3.1 managed in the parent (it had stayed at 4.3.0 next to the 4.3.1 Checker Framework processor). With the SpotBugs bump, **Lombok-generated code carries JSpecify nullness** (`lombok.addNullAnnotations = jspecify` in the diff --git a/pom.xml b/pom.xml index 0618e50..29dc0c4 100644 --- a/pom.xml +++ b/pom.xml @@ -78,7 +78,7 @@ SPDX-License-Identifier: Apache-2.0 parent POM, so the version used by both jackson dependencyManagement entries must live at this level. srcmorph-cli/pom.xml does not redeclare it. --> - 2.22.3 + 2.22.4