fix(deps): update all dependencies j:cdx-227

[renovate-coveo]

This PR contains the following updates:

Package	Type	Update	Change	Pending	Age	Adoption	Passing	Confidence
actions/checkout	action	patch	v4.3.0 → v4.3.1
actions/checkout (changelog)	action	digest	08eba0b → 34e1148
actions/setup-java	action	minor	v4.7.1 → v4.8.0
google-github-actions/release-please-action → googleapis/release-please-action	action	replacement	v4.1.1 → v4.1.1
step-security/harden-runner	action	minor	v2.13.1 → v2.14.0	v2.14.1
org.apache.maven:maven-model (source)	compile	patch	3.9.11 → 3.9.12
commons-codec:commons-codec (source)	compile	minor	1.19.0 → 1.20.0
org.mockito:mockito-core	test	minor	5.20.0 → 5.21.0
org.apache.maven.plugins:maven-source-plugin (source)	build	minor	3.3.1 → 3.4.0

[skip release]

This is a special PR that replaces google-github-actions/release-please-action with the community suggested minimal stable replacement version.

---

Release Notes

actions/checkout (actions/checkout)

v4.3.1

Compare Source

• Port v6 cleanup to v4 by @​ericsciple in #​2305

actions/setup-java (actions/setup-java)

v4.8.0

Compare Source

What's Changed

• License and Audit Fixes by @​HarithaVattikuti in #​960
• Update SapMachine URLs by @​RealCLanger in #​965

Full Changelog: actions/setup-java@v4...v4.8.0

step-security/harden-runner (step-security/harden-runner)

v2.14.0

Compare Source

What's Changed

• Selective installation: Harden-Runner now skips installation on GitHub-hosted runners when the repository has a custom property skip_harden_runner, allowing organizations to opt out specific repos.
• Avoid double install: The action no longer installs Harden-Runner if it’s already present on a GitHub-hosted runner, which could happen when a composite action also installs it.

Full Changelog: step-security/harden-runner@v2.13.3...v2.14.0

v2.13.3

Compare Source

What's Changed

• Fixed an issue where process events were not uploaded in certain edge cases.

Full Changelog: step-security/harden-runner@v2.13.2...v2.13.3

v2.13.2

Compare Source

What's Changed

• Fixed an issue where there was a limit of 512 allowed endpoints when using block egress policy. This restriction has been removed, allowing for an unlimited number of endpoints to be configured.
• Harden Runner now automatically detects if the agent is already pre-installed on a custom VM image used by a GitHub-hosted runner. When detected, the action will skip reinstallation and use the existing agent.

Full Changelog: step-security/harden-runner@v2.13.1...v2.13.2

mockito/mockito (org.mockito:mockito-core)

v5.21.0

Compare Source

^{Changelog generated by Shipkit Changelog Gradle Plugin}

5.21.0

• 2025-12-09 - 17 commit(s) by Giulio Longfils, Joshua Selbo, Woongi9, Zylox, dependabot[bot]
• Bump graalvm/setup-graalvm from 1.4.3 to 1.4.4 (#​3768)
• Bump graalvm/setup-graalvm from 1.4.2 to 1.4.3 (#​3767)
• Bump actions/checkout from 5 to 6 (#​3765)
• Adds output of matchers to potential mismatch; Fixes #​2468 (#​3760)
• Forbid mocking WeakReference with inline mock maker (#​3759)
• StackOverflowError when mocking WeakReference (#​3758)
• Bump actions/upload-artifact from 4 to 5 (#​3756)
• Bump graalvm/setup-graalvm from 1.4.1 to 1.4.2 (#​3755)
• Support primitives in GenericArrayReturnType. (#​3753)
• ClassNotFoundException when stubbing array of primitive type on Android (#​3752)
• Bump graalvm/setup-graalvm from 1.4.0 to 1.4.1 (#​3744)
• Bump gradle/actions from 4 to 5 (#​3743)
• Bump org.graalvm.buildtools.native from 0.11.0 to 0.11.1 (#​3738)
• Bump com.diffplug.spotless:spotless-plugin-gradle from 7.2.1 to 8.0.0 (#​3735)
• Bump graalvm/setup-graalvm from 1.3.7 to 1.4.0 (#​3734)
• Bump org.assertj:assertj-core from 3.27.5 to 3.27.6 (#​3733)
• Bump errorprone from 2.41.0 to 2.42.0 (#​3732)
• Feat: automatically detect class to mock in mockStatic and mockConstruction (#​3731)
• Return completed futures for unstubbed Future/CompletionStage in ReturnsEmptyValues (#​3727)
• automatically detect class to mock (#​2779)
• Incorrect "has following stubbing(s) with different arguments" message when using Argument Matchers (#​2468)

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) in timezone America/Toronto, Automerge - "after 9:00am and before 12:00pm on tuesday, wednesday, thursday" in timezone America/Toronto.

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.