chore(deps): Renovate updates of 2026-10-26 combined

.github/workflows/ci.yml

@@ -53,7 +53,7 @@ jobs:
       # `package.json` declares as its packageManager.
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: '1.3.12'
+          bun-version: '1.4.4'
 
       # The browser test tier (`bun run test:browser`, wired into `check`) runs every
       # `*.browser.spec.ts` in headless Chromium, because jsdom resolves neither custom

.github/workflows/release.yml

@@ -27,7 +27,7 @@ jobs:
       - uses: gradle/actions/setup-gradle@v6
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: '1.3.12'
+          bun-version: '1.4.4'
       # The release gate is the CI gate run against the tagged tree, so it runs exactly
       # what CI runs, Spotless included, and nothing is excluded with `-x`.
       - run: ./gradlew check --no-daemon

backend/Dockerfile

@@ -2,7 +2,7 @@
 # `$BUILDPLATFORM`: the jar is JVM bytecode and the same for every architecture, so the build
 # runs once on the runner's own platform instead of once more under QEMU for arm64. The runtime
 # stage below stays per target, and so does anything built there for the JRE it runs on.
-FROM --platform=$BUILDPLATFORM gradle:9.4.1-jdk25 AS build
+FROM --platform=$BUILDPLATFORM gradle:9.8.2-jdk25 AS build
 WORKDIR /workspace
 COPY settings.gradle.kts build.gradle.kts gradle.properties ./
 COPY gradle ./gradle

frontend/Dockerfile

@@ -11,7 +11,7 @@
 # bun comes from a stage of its own on the same platform: `COPY --from=<image>` resolves the
 # image for the *target*, so the arm64 pass copied an arm64 bun into this amd64 stage and
 # `bun install` died with exit 255.
-FROM --platform=$BUILDPLATFORM oven/bun:1.3.12-alpine AS bun
+FROM --platform=$BUILDPLATFORM oven/bun:1.4.4-alpine AS bun
 
 FROM --platform=$BUILDPLATFORM node:24.22.1-alpine AS build
 COPY --from=bun /usr/local/bin/bun /usr/local/bin/bun
@@ -21,7 +21,7 @@ RUN bun install --frozen-lockfile
 COPY frontend/ ./
 RUN bun run build
 
-FROM nginxinc/nginx-unprivileged:1.27-alpine
+FROM nginxinc/nginx-unprivileged:1.31-alpine
 COPY frontend/nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /app/dist/frontend/browser /usr/share/nginx/html
 # 8080, not 80: nginx runs as uid 101 here, and a non-root process cannot bind a port

frontend/package.json

@@ -20,7 +20,7 @@
     "verify": "bun run check:static && bun run test:coverage && bun run build"
   },
   "private": true,
-  "packageManager": "bun@1.3.12",
+  "packageManager": "bun@1.4.4",
   "dependencies": {
     "@angular/cdk": "^22.2.4",
     "@angular/common": "^22.2.3",
@@ -43,7 +43,7 @@
     "d3-zoom": "^3.0.0",
     "dompurify": "3.4.17",
     "echarts": "^6.1.0",
-    "eventsource-parser": "4.1.1",
+    "eventsource-parser": "4.1.3",
     "highlight.js": "^11.12.0",
     "lucide": "^1.39.0",
     "marked": "^18.0.11",

gradle/libs.versions.toml

@@ -3,18 +3,18 @@ springBoot = "4.1.2"
 springDependencyManagement = "1.1.7"
 testcontainers = "2.0.5"
 # Pinned here rather than taken from the Boot BOM: Boot 4 no longer manages jsoup.
-jsoup = "1.21.2"
+jsoup = "1.23.2"
 # Pinned explicitly rather than taken from the Boot BOM: Lombok hooks into javac
 # internals, so a JDK bump is exactly where it breaks. A version the BOM moves under
 # us should show up as a diff here, not as a compile error.
-lombok = "1.18.46"
-greenmail = "2.1.9"
+lombok = "1.18.48"
+greenmail = "2.1.15"
 # Standalone (shaded) rather than the plain artifact: it brings its own Jetty and
 # would otherwise fight the one Boot puts on the test classpath.
-wiremock = "3.13.1"
+wiremock = "3.13.2"
 # Pinned rather than taken from the Boot BOM for the same reason as jsoup:
 # a template that stops rendering should show up as a diff here.
-freemarker = "2.3.34"
+freemarker = "2.3.35"
 # The HTML-to-Markdown converter, pinned for the same reason as the two above: an ad
 # that suddenly renders differently should show up as a diff here.
 flexmark = "0.64.8"
@@ -41,7 +41,7 @@ palantirJavaFormat = "2.98.0"
 # 0.8.13 is the current release and reads Java 25 class files without a warning —
 # checked on the toolchain bump, because a JaCoCo that cannot read the class file
 # version reports coverage of nothing rather than failing.
-jacoco = "0.8.13"
+jacoco = "0.8.16"
 
 [libraries]
 testcontainers-bom = { module = "org.testcontainers:testcontainers-bom", version.ref = "testcontainers" }

gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,9 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.8.2-bin.zip
 networkTimeout=10000
+retries=0
+retryBackOffMs=500
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists