From 2ede7c122598fe4bc317a274cdbc05197bf4be9f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 5 Sep 2026 11:10:04 +0000
Subject: [PATCH] build(deps): bump analysis tooling and shared libraries to
 current

Pure version maintenance, no behaviour change. This repo already carries the
cross-repo group -- maven-compiler-plugin 3.16.0, maven-surefire-plugin 3.6.0
and nullaway 0.14.1 landed here via Dependabot and are what the three sibling
repos are now being brought up to. What is left is the group all four were
behind on:

  git-commit-id-maven-plugin  10.0.0    -> 10.0.1
  spotless-maven-plugin       3.10.1    -> 3.10.2
  spotbugs-maven-plugin       4.10.4.0  -> 4.10.4.1
  checker / checker-qual      4.2.2     -> 4.2.3
  lombok                      1.18.46   -> 1.18.48
  slf4j-api                   2.0.18    -> 2.0.19

The checker bump moves ONE property that feeds both the annotation processor
and the qualifiers, and that coupling is the point: the Nullness Checker
resolves its own qualifiers through javac's symbol table, so the two must share
a major version -- the lesson from the 3.55.1 pin reverted in java-llama.cpp.

The comment above the slf4j-api pin named the old version in prose
("logback-classic brings 2.0.17; we declare 2.0.18 directly"); it now names
2.0.19, so the rationale cannot drift away from the value it explains.

logback-classic stays at 1.6.3, which is current.

Deliberately NOT bumped: jqwik stays at 1.9.3. Releases from 1.10.0 on print a
prompt-injection string aimed at AI coding agents, and the workspace policy
(policies/jqwik-prompt-injection.md) requires rejecting any PR that moves it.
Dependabot will keep proposing it.

Verified locally: mvn clean verify green at 2214 tests, and the class-file gate
clean over a real `-P assembly` fat jar (15779 classes, 0 above major 65).

One pre-existing failure on main is NOT touched here and is not caused by these
bumps: ExampleRunScriptJarVersionTest fails because 24 examples/run_*.sh|.bat
and docs/tuning-your-gpu.md still reference 1.8.0 while the project is at
1.9.0-SNAPSHOT. Confirmed by running that test on an unmodified main. Whether
those scripts should track the SNAPSHOT or the last release is a release-process
question, so it is left for a separate change; the verification above therefore
excluded that one test and nothing else.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AnNYn8W1xuVxVJtyL34GyH
---
 pom.xml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pom.xml b/pom.xml
index 084e71cf..d9b86462 100644
--- a/pom.xml
+++ b/pom.xml
@@ -42,7 +42,7 @@ SPDX-License-Identifier: Apache-2.0
     <properties>
         <sonar.organization>bernardladenthin</sonar.organization>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <slf4j.version>2.0.18</slf4j.version>
+        <slf4j.version>2.0.19</slf4j.version>
         <logback.version>1.6.3</logback.version>
         <project.build.outputTimestamp>2026-09-01T07:58:47Z</project.build.outputTimestamp>
         <!-- Test JVM heap: -Xmx2g cap, no eager -Xms. With reuseForks=false a fresh JVM is
@@ -66,16 +66,16 @@ SPDX-License-Identifier: Apache-2.0
              policy) for full context. -->
         <jqwik.version>1.9.3</jqwik.version>
         <archunit.version>1.5.0</archunit.version>
-        <spotbugs.version>4.10.4.0</spotbugs.version>
+        <spotbugs.version>4.10.4.1</spotbugs.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
         <findsecbugs.version>1.14.0</findsecbugs.version>
         <errorprone.version>2.50.0</errorprone.version>
         <nullaway.version>0.14.1</nullaway.version>
-        <checker.version>4.2.2</checker.version>
+        <checker.version>4.2.3</checker.version>
         <java-websocket.version>1.6.0</java-websocket.version>
         <jeromq.version>0.6.0</jeromq.version>
         <jspecify.version>1.0.1</jspecify.version>
-        <lombok.version>1.18.46</lombok.version>
+        <lombok.version>1.18.48</lombok.version>
         <bitcoinj.version>0.17.1</bitcoinj.version>
         <bcprov.version>1.85.2</bcprov.version>
         <protobuf.version>4.36.1</protobuf.version>
@@ -99,7 +99,7 @@ SPDX-License-Identifier: Apache-2.0
              newest patched stable so the alert clears; see the dependencyManagement entries. -->
         <log4j.version>2.26.1</log4j.version>
         <jmh.version>1.37</jmh.version>
-        <spotless.version>3.10.1</spotless.version>
+        <spotless.version>3.10.2</spotless.version>
         <palantir-java-format.version>2.97.0</palantir-java-format.version>
     </properties>
 
@@ -113,7 +113,7 @@ SPDX-License-Identifier: Apache-2.0
     <dependencyManagement>
         <dependencies>
             <!-- slf4j-api: bitcoinj brings 2.0.16, Java-WebSocket brings 2.0.13,
-                 logback-classic brings 2.0.17; we declare 2.0.18 directly. -->
+                 logback-classic brings 2.0.17; we declare 2.0.19 directly. -->
             <dependency>
                 <groupId>org.slf4j</groupId>
                 <artifactId>slf4j-api</artifactId>
@@ -200,7 +200,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>io.github.git-commit-id</groupId>
                     <artifactId>git-commit-id-maven-plugin</artifactId>
-                    <version>10.0.0</version>
+                    <version>10.0.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>