[bernardladenthin]

Summary

Version sweep of 2026-10-22. The same change lands in BitcoinAddressFinder, java-llama.cpp, srcmorph and streambuffer; the pull requests are listed below.

• Shared workflow pins: anthropics/claude-code-action v1.0.255 → v1.0.258 and github/codeql-action v4.39.0 → v4.39.1, each pinned by commit. shared-files.sha256 is rewritten for claude.yml, claude-code-review.yml, codeql.yml and scorecard.yml.
• Implicit Maven plugins declared: maven-clean-plugin 3.5.0, maven-resources-plugin 3.5.0, maven-install-plugin 3.2.0, maven-deploy-plugin 3.2.0 and maven-dependency-plugin 3.11.0. No POM named them, so their versions came from whichever Maven ran the build. The Ubuntu runners' Maven 3.10.0 already binds these versions but manages no dependency plugin, so mvn dependency:... took the newest release. A 3.9 Maven binds clean 3.2.0, resources 3.3.1, install and deploy 3.1.x and dependency 3.7.0. The pins make the build independent of the Maven that runs it, and check-versions.py now compares them across the repositories.
• CHANGELOG entry under Unreleased. The previous sweep's entry no longer names the superseded claude-code-action v1.0.255.

Every other Maven dependency, plugin and Action was already on its newest stable release. The deliberate pins stay as they are, among them jqwik 1.9.3 and log4j 2.26.1.

Test plan

• Each new action commit checked against the live tag with git ls-remote
• help:effective-pom shows the new plugin versions in every module
• Maven runs them in those versions, checked across the four repositories: clean:3.5.0, install:3.2.0, dependency:3.11.0
• Resource output is byte-identical under maven-resources-plugin 3.3.1 and 3.5.0
• dependency:build-classpath as formal-verification.yml calls it gives the same classpath under 3.11.0
• Build checks green: buildcheck unit tests, check-run-scripts, check-release-gate, check-shared-files, check-versions with 0 differences, workflows parse as YAML
• An independent review of the diff before the push; its findings are folded in
• CI is green on this branch
• CHANGELOG updated

check-shared-files warns about the four shared workflows until the sibling pull requests are merged too. That is the expected state of a sync that lands in four steps.

Related issues / PRs

Same sweep in the other repositories:

• Bump the shared Claude/CodeQL pins and setup-python; declare five implicit Maven plugins BitcoinAddressFinder#396
• Bump the shared Claude/CodeQL pins and setup-python; declare four implicit Maven plugins java-llama.cpp#555
• Bump the shared Claude/CodeQL pins; declare five implicit Maven plugins srcmorph#235
• JavaFX 21.0.12 -> 21.0.13 in JCPUThrottle and JScreenStreamer BroomCabinet#87
• crossrepostatus: 2026-10-22 dependency sweep workspace#60

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits
• No security-sensitive changes

🤖 Generated with Claude Code

https://claude.ai/code/session_01VBFFnrhtvXiUeyxjmUc4R2

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud