Bump Jackson, LogCaptor, pitest, central-publishing and the shared Claude/Gradle pins

.github/shared-files.sha256

@@ -52,11 +52,11 @@ e8f444ef851bd134330f1505f52b4b0970ef9a62dd76e4c25829241814ba5c73  .github/ISSUE_
 9a24b2a67ab8e6f52016093e9b6a89796adea29887b7820accede06cc0c0d170  .github/workflows/publish.yml#code-style
 6e2ae11dad0616f66bbb2b6e6556f580bb987fd911d7132aa6bee2bfc7cc7b52  .java-version
 71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50  .java-version.license
-3f73b87c4675376cbe80f1fb914bd7020062dcdb9a7ee503d3ef787fd462358a  .github/workflows/claude.yml
-085f19495d9e0812dc90268ea7917579bd6eaf749c669a9f01922272a5cdf06f  .github/workflows/claude-code-review.yml
-463c34f6244675ee5bee3d28c28c84f5eb3c8bea4f45de3f6ce477348d29589c  .github/workflows/scorecard.yml
+30b3bed932fd05a34d79af0155166b548a7597e5ee4913aa105dd82a41d1936d  .github/workflows/claude.yml
+de1479c5c1e662c0f01d6afd0d18b4a71e8d8168b377287ca6e93285eef63358  .github/workflows/claude-code-review.yml
+fe768632e9abc1a8cd39b038a77c1a79dbfd036129bb7f0d84b393251b369be6  .github/workflows/scorecard.yml
 480afc0c1e41f3997b195d7297750b43599ba71a7471657aa32bfc9662b6fd30  .github/workflows/reuse.yml
-cf75cdc06e5ab02359c12b6a8eecb97f2dd3d95502cd2b397d539584cefa56c3  .github/workflows/osv-scanner.yml
+93aedaf67af1c4d63b2502107a51f2f454f2b3b4bc5f2fe892561e12363e57a9  .github/workflows/osv-scanner.yml
 52182fe4073eb696606813d768ff9444e6b751978f9d27a8d84cc269e9f6cb3a  .github/workflows/codeql.yml
 c9e757f2d0a2f456a08791697a94161c776d9b008a8aa75890da4133c81a99e9  .github/dependabot.yml
 abea5fb970a46ccf9ba9127d59abf304202efd13c2d6a28da2ff75da0c92a9b8  .github/smoke-fatjar-cli.sh
@@ -66,6 +66,6 @@ e3dde66089fd568f03caeefee86ea36a9f6eb7f47e5dc6d053e0e5784fd7a208  .github/workfl
 3ef45f189f4419e0d4087f572b3c1b6085c0fe39ac7979b07deb2e882f7ffe8c  .github/workflows/publish.yml#verify-signing-key
 09230b04c5f14bdda50a0c862152ff197a656cbc3fd0d110899c5f8150f8aa9a  .github/workflows/publish.yml#check-snapshot
 51e987d59efd9887b43e345edc0e0f3db21686879e3ca6ea9f0fdbc493d37121  .github/workflows/publish.yml#check-tag
-06f0af70ed125dc5cc1506e27970059fb831971d3faaee56f868789f3282fdf9  .github/workflows/publish.yml#verify-signing-key-gradle
+a4f42a0bfa9b14ca937675052b990e5f1dda238d762f9d0268ac282cd7030c0d  .github/workflows/publish.yml#verify-signing-key-gradle
 c2684a3f93aaf552c13f845307536c2a14dda315c7d7b1e416bc66951b811dc1  .github/workflows/publish.yml#github-snapshot
 c09a030706dbea4221851ca0fcbfa6fc686165b408724724ade61724da6e123b  .github/workflows/publish.yml#github-release

.github/workflows/claude-code-review.yml

@@ -25,7 +25,7 @@ jobs:
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1
+        uses: anthropics/claude-code-action@e4a6faad497d33dbc7144135c75e41f82f0bf6c0 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: |

.github/workflows/claude.yml

@@ -36,7 +36,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1
+        uses: anthropics/claude-code-action@e4a6faad497d33dbc7144135c75e41f82f0bf6c0 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 

.github/workflows/publish.yml

@@ -153,7 +153,7 @@ jobs:
           distribution: temurin
       - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
         with:
-          gradle-version: "9.8.1"
+          gradle-version: "9.8.2"
       - name: Sign a throwaway artifact via useInMemoryPgpKeys (BouncyCastle)
         shell: bash
         env:

CHANGELOG.md

@@ -8,6 +8,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Changed
+- Dependencies and build tooling bumped in step with the sibling repositories: Jackson 2.22.3 ->
+  2.22.4, LogCaptor 2.12.7 -> 2.13.0 (test; still requests log4j 2.26.1, so the log4j floor guard is
+  unchanged), pitest-maven 1.30.0 -> 1.30.1, central-publishing-maven-plugin 0.11.0 -> 0.12.0;
+  `anthropics/claude-code-action` v1.0.255 and Gradle 9.8.2 in the shared `verify-signing-key-gradle` job.
 - **Build tooling: spotbugs-maven-plugin 4.10.4.1 -> 4.10.5.0**, in step with the sibling repositories, and with it
   **Lombok-generated code carries JSpecify nullness** (`lombok.addNullAnnotations = jspecify` in the
   shared `lombok.config`): under `@NullMarked` a generated `equals(Object)` parameter read as non-null

CLAUDE.md

@@ -596,10 +596,10 @@ No other sibling repo has OpenCL code, so this distinction is BAF-only.
 | `jcip-annotations` | 1.0 | JCIP concurrency annotations (bitcoinj transitive, runtime) |
 | `lmdbjava` | 0.9.3 | LMDB database bindings |
 | `lwjgl` / `lwjgl-opencl` | 3.4.3 | Java OpenCL bindings (plus per-platform `natives-*` classifiers) |
-| `jackson-databind` | 2.22.3 | JSON config parsing |
-| `jackson-dataformat-yaml` | 2.22.3 | YAML config parsing |
+| `jackson-databind` | 2.22.4 | JSON config parsing |
+| `jackson-dataformat-yaml` | 2.22.4 | YAML config parsing |
 | `guava` | 33.7.2-jre | Google core utilities |
-| `commons-codec` | 1.22.1 | Base58, hex encoding |
+| `commons-codec` | 1.23.0 | Base58, hex encoding |
 | `commons-io` | 2.22.0 | I/O utilities |
 | `Java-WebSocket` | 1.6.0 | WebSocket producer |
 | `jeromq` | 0.6.0 | ZeroMQ producer |

pom.xml

@@ -82,7 +82,7 @@ SPDX-License-Identifier: Apache-2.0
         <jsr305.version>3.0.2</jsr305.version>
         <jcip-annotations.version>1.0</jcip-annotations.version>
         <guava.version>33.7.2-jre</guava.version>
-        <jackson.version>2.22.3</jackson.version>
+        <jackson.version>2.22.4</jackson.version>
         <lmdbjava.version>0.9.3</lmdbjava.version>
         <lwjgl.version>3.4.3</lwjgl.version>
         <commons-io.version>2.22.0</commons-io.version>
@@ -91,13 +91,13 @@ SPDX-License-Identifier: Apache-2.0
         <junit.version>6.1.3</junit.version>
         <hamcrest.version>3.0</hamcrest.version>
         <mockito.version>5.24.0</mockito.version>
-        <logcaptor.version>2.12.7</logcaptor.version>
+        <logcaptor.version>2.13.0</logcaptor.version>
         <!-- FLOOR GUARD, no longer an active fix. log4j-api / log4j-to-slf4j arrive ONLY as
              test-scope transitives of io.github.hakky54:logcaptor. When this pin was added,
              logcaptor 2.12.6 requested log4j 2.25.3, affected by CVE-2026-49844
              (GHSA-qv9r-c865-cp47, moderate): MapMessage.asJson() emits bare NaN/Infinity tokens
              for non-finite floats, producing non-RFC-8259 JSON.
-             logcaptor 2.12.7 declares <version.log4j>2.26.1</version.log4j> itself, i.e. exactly
+             logcaptor 2.12.7 and 2.13.0 declare <version.log4j>2.26.1</version.log4j> itself, i.e. exactly
              what this pin forces, so today it changes nothing about the resolved graph. It is kept
              as a lower bound: if logcaptor ever falls back to an affected line, the pin holds the
              version here instead of letting it regress silently.
@@ -277,12 +277,12 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.pitest</groupId>
                     <artifactId>pitest-maven</artifactId>
-                    <version>1.30.0</version>
+                    <version>1.30.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.sonatype.central</groupId>
                     <artifactId>central-publishing-maven-plugin</artifactId>
-                    <version>0.11.0</version>
+                    <version>0.12.0</version>
                 </plugin>
             </plugins>
         </pluginManagement>