fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
gradle (source)		minor	9.5.1 → 9.6.1
org.junit.jupiter:junit-jupiter (source)	devDependencies	patch	6.1.0 → 6.1.2
org.openrewrite.recipe:rewrite-rewrite	devDependencies	minor	0.26.0 → 0.28.0
org.openrewrite.recipe:rewrite-migrate-java	devDependencies	minor	3.36.0 → 3.40.0
org.openrewrite.recipe:rewrite-static-analysis	devDependencies	minor	2.36.0 → 2.39.0
com.github.spotbugs:spotbugs (source)	devDependencies	minor	4.9.8 → 4.10.3
com.google.errorprone:error_prone_core (source)	devDependencies	minor	2.49.0 → 2.50.0
com.github.spotbugs:spotbugs-annotations (source)	dependencies	minor	4.9.8 → 4.10.3
org.openrewrite:plugin	devDependencies	minor	7.34.0 → 7.37.0
com.velocitypowered:velocity-api (source)	dependencies	minor	3.4.0 → 3.5.1
com.github.spotbugs.snom:spotbugs-gradle-plugin	devDependencies	patch	6.5.5 → 6.5.9
com.gradleup.shadow:shadow-gradle-plugin	devDependencies	minor	9.4.2 → 9.6.0
me.clip:placeholderapi	dependencies	patch	2.12.2 → 2.12.3
com.diffplug.spotless:spotless-plugin-gradle	devDependencies	minor	8.6.0 → 8.8.0

---

Release Notes

gradle/gradle (gradle)

v9.6.1

Compare Source

v9.6.0

Compare Source

openrewrite/rewrite-rewrite (org.openrewrite.recipe:rewrite-rewrite)

v0.28.0: 0.28.0

Compare Source

What's Changed

• Fix UseRewriteTestDefaults corrupting output for classes with field initializers by @​timtebeek in #​80
• Avoid no-op change in SourceSpecTextBlockIndentation when margin is already minimal by @​timtebeek in #​81

Full Changelog: openrewrite/rewrite-rewrite@v0.27.0...v0.28.0

v0.27.0: 0.27.0

Compare Source

What's Changed

• Avoid renaming ExecutionContext parameter when it would shadow an outer scope by @​timtebeek in #​78

Full Changelog: openrewrite/rewrite-rewrite@v0.26.1...v0.27.0

v0.26.1: 0.26.1

What's Changed

• OpenRewrite v8.85.0: https://github.com/openrewrite/rewrite

Full Changelog: openrewrite/rewrite-rewrite@v0.26.0...v0.26.1

openrewrite/rewrite-migrate-java (org.openrewrite.recipe:rewrite-migrate-java)

v3.40.0: 3.40.0

Compare Source

What's Changed

• Keep \t and \f escapes in UseTextBlocks to avoid incidental whitespace stripping by @​timtebeek in #​1160
• Skip UseEnumSetOf empty conversion for static fields to avoid circular class-init (#​1157) by @​timtebeek in #​1161
• Skip UseMapOf for LinkedHashMap/TreeMap in the prose put() form (#​1163) by @​timtebeek in #​1165
• Skip AddMockitoJavaAgentToMavenSurefirePlugin when agent already configured in build/plugins by @​timtebeek in #​1166
• Add RedundantUtf8Charset recipe to drop redundant UTF-8 from Files calls by @​timtebeek in #​1167
• Fix Jakarta EE 10 web.xml migration by @​sakshichitnis27 in #​1159

New Contributors

• @​sakshichitnis27 made their first contribution in #​1159

Full Changelog: openrewrite/rewrite-migrate-java@v3.39.0...v3.40.0

v3.39.0: 3.39.0

Compare Source

What's Changed

• Make ExtractExplicitConstructorInvocationArguments templates context-free by @​knutwannheden in #​1140
• Convert Javadoc <br> tags to Markdown line breaks by @​timtebeek in #​1142
• Preserve angle brackets when converting @param <T> to Markdown by @​timtebeek in #​1141
• Fix JavadocToMarkdown's handling of varargs and JDKs newer than the bytecode source/target compatibility by @​sambsnyd in #​1143
• Move ReplaceUnusedVariablesWithUnderscore to Java best practices by @​timtebeek in #​1144
• Extend Use{List,Set,Map}Of to recognise prose-statement chains by @​steve-aom-elliott in #​1145
• Skip UseMapOf when the anonymous HashMap is assigned to a concrete HashMap variable by @​timtebeek in #​1149
• Fix jakarta.enterprise.concurrent-api version for EE9 and EE10 by @​evie-lau in #​1152
• Add recipe to replace jakarta jws-api with ws-api in EE10 by @​evie-lau in #​1151
• Upgrade maven-ejb-plugin alongside jakarta.ejb-api by @​evie-lau in #​1155
• Upgrade maven-ear-plugin for ee9 and ee11 by @​evie-lau in #​1156

Full Changelog: openrewrite/rewrite-migrate-java@v3.38.0...v3.39.0

v3.38.0

Compare Source

What's Changed

• use . instead # for FQN link in Markdown javadoc by @​barbulescu in #​1134
• Bump maven-pmd-plugin to 3.28.x for Java 25 support by @​timtebeek in #​1136
• Explain why Kotlin modules are capped at Java 24 during Java 25 migration by @​timtebeek in #​1137
• Preserve @{argLine} in AddSurefireFailsafeArgLine for JaCoCo coverage by @​timtebeek in #​1138
• Add recipe to extract complex explicit constructor invocation arguments (JEP 513) by @​timtebeek in #​1135
• Bump Kotlin 2.0-2.2 to 2.3 so Kotlin modules can reach Java 25 by @​timtebeek in #​1139

Full Changelog: openrewrite/rewrite-migrate-java@v3.37.0...v3.38.0

v3.37.0: 3.37.0

Compare Source

What's Changed

• Align Kotlin jvmTarget with the Java version during UpgradeJavaVersion by @​MBoegers in #​1120
• Move instance main methods recipe to JavaBestPractices by @​timtebeek in #​1130
• javadoc code tag language is not converted to markdown by @​barbulescu in #​1129
• Contribute AddMockitoJavaAgentToMavenSurefirePlugin Recipe by @​ryan-hudson in #​1128
• Preserve significant trailing space in UseTextBlocks (#​1132) by @​timtebeek in #​1133

New Contributors

• @​barbulescu made their first contribution in #​1129
• @​ryan-hudson made their first contribution in #​1128

Full Changelog: openrewrite/rewrite-migrate-java@v3.36.0...v3.37.0

openrewrite/rewrite-static-analysis (org.openrewrite.recipe:rewrite-static-analysis)

v2.39.0: 2.39.0

Compare Source

What's Changed

• Fix UseStringCaseInsensitiveOrder lambda matching by @​timtebeek in #​933
• Keep (Object) cast on array argument at varargs position by @​timtebeek in #​935
• Python: add Python tests for selected 7 recipes by @​greg-at-moderne in #​929
• Consolidate UseStringCaseInsensitiveOrder into a single Refaster template by @​timtebeek in #​937

Full Changelog: openrewrite/rewrite-static-analysis@v2.38.0...v2.39.0

v2.38.0: 2.38.0

Compare Source

What's Changed

• Fix UseTryWithResources moving resource out of scope for catch block by @​timtebeek in #​921
• Fix MinimumSwitchCases crash on Java 21 sealed-interface pattern switch by @​timtebeek in #​922
• Fix RemoveUnusedPrivateMethods deleting methods called with raw collection arguments by @​habiibullahm in #​898
• Add UseStringCaseInsensitiveOrder by @​steve-aom-elliott in #​923
• Add 7 cross-language code quality recipes by @​jkschneider in #​853
• Fix RemoveRedundantTypeCast removing cast that gives a var lambda its target type by @​timtebeek in #​925
• Tests for Kotlin, Groovy, TS for cross-language code quality recipes by @​greg-at-moderne in #​928
• Add RemoveUnreachableMultiCatchAlternative by @​steve-aom-elliott in #​926
• Use unnamed variable for unused try-with-resources resource on Java 21+ by @​timtebeek in #​930

New Contributors

• @​habiibullahm made their first contribution in #​898

Full Changelog: openrewrite/rewrite-static-analysis@v2.37.0...v2.38.0

v2.37.0: 2.37.0

What's Changed

• Preserve raw supertype cast on parameterized argument in RemoveRedundantTypeCast by @​timtebeek in #​915
• Preserve space when InstanceOfPatternMatch replaces a cast after a keyword by @​timtebeek in #​913
• InstanceOfPatternMatch not to remove double primitive cast by @​greg-at-moderne in #​918
• Fix UseDiamondOperator throwing array index out of bounds when operating on a varargs method by @​sambsnyd in #​919
• Fix false positive in AnnotateNullableParameters when parameter der… by @​stefanodallapalma in #​868

Full Changelog: openrewrite/rewrite-static-analysis@v2.36.0...v2.37.0

spotbugs/spotbugs (com.github.spotbugs:spotbugs)

v4.10.3

Compare Source

Fixed

• Fix LI_LAZY_INIT_STATIC false negative when the null guard is written in yoda-style (null == field) (#​4144)
• Fix DC_DOUBLECHECK, NP_SYNC_AND_NULL_CHECK_FIELD and SP_SPIN_ON_FIELD false negatives when the null guard is written in yoda-style (null == field) (#​4144)
• Fix message for UNS_UNSAFE_CALL bug pattern
• Restore CLI plugin loading by fixing DetectorFactoryCollection bootstrap ordering (#​4191)
• Fix UWF_NULL_FIELD false negative for fields initialized with cast null values (#​4034)
• Fix UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASS false positive for methods reached only through method references (#​4059)

Changed

• Ant FindBugsViewerTask: use default look and feel by default. (#​4165)

Refactor

• Ant FindBugsViewerTask: extend AbstractFindBugsTask to reduce duplicate code. (#​4165)

v4.10.2

Compare Source

Build

• Add release protection to ensure version released matches the tag and that snapshot has been removed. (#​4156)
• Drop binary incompatible Saxon-HE back to 12.9 to keep java 11 compatibility. (#​4159)
• Add binary check to the gradle build to ensure compatibility remains. (#​4159)

v4.10.1

Compare Source

Build

• 4.10.0 was not released due to a release process error (artifacts were built from a -SNAPSHOT version). 4.10.1 is the corrected release and contains the intended 4.10.0 contents.

google/error-prone (com.google.errorprone:error_prone_core)

v2.50.0: Error Prone 2.50.0

Compare Source

New checks:

• BoxingComparator: Detect implicitly-boxing Comparator.comparing key extractors
• ExposedPrivateType: Discourage references to private member classes from non-private APIs
• JUnitMethodInvoked: Discourage directly invoking JUnit test methods
• ListRemoveAmbiguous: Detect ambiguous calls to List.remove(int|Integer)
• PreferTestParameter: suggests using @TestParameter instead of @TestParameters for exhaustive boolean and enum parameters on single-element parameterized tests
• RecordComponentAccessorAnnotationConflict: Detect conflicts between record components and explicit accessor methods
• RecordComponentOverride: Discourage @Override on record component declarations that don't override
  anything
• ThrowableEqualsHashCode: Discourage overriding Throwable.equals() and hashCode()

Closed issues: #​5553, #​5649, #​5778

Full changelog: google/error-prone@v2.49.0...v2.50.0

spotbugs/spotbugs-gradle-plugin (com.github.spotbugs.snom:spotbugs-gradle-plugin)

v6.5.9

Compare Source

Bug Fixes

• deps: update dependency com.github.spotbugs:spotbugs to v4.10.3 (#​1754) (b19e3cb)

v6.5.8

Compare Source

Bug Fixes

• deps: update dependency androidx.lint:lint-gradle to v1.0.0 (#​1723) (18ee52e)

v6.5.7

Compare Source

Bug Fixes

• fix sonarqube deprecations (#​1726) (b466015)

v6.5.6

Compare Source

Bug Fixes

• deps: update spotbugsversion to v4.10.1 (#​1710) (b0860cb)
• deps: update spotbugsversion to v4.10.2 (#​1711) (5362594)

GradleUp/shadow (com.gradleup.shadow:shadow-gradle-plugin)

v9.6.0

Compare Source

Added

• Extract R8 rules from dependency JARs when using minimize { r8 { ... } }. (#​2089)

Changed

• Rename ShadowDslMarker to ShadowDsl. (#​2091)
• POTENTIALLY BREAKING: Apply @ShadowDsl to ShadowJar, ResourceTransformer, DependencyFilter, and Relocator. (#​2090)
  This restricts nested DSL configuration blocks from implicitly calling outer receiver APIs in Kotlin script files.

Fixed

• Validate ZIP entry names to prevent Zip Slip path traversal.
• Avoid resolving unused R8 dependency. (#​2101)

v9.5.1

Compare Source

Fixed

• Fix eager calls for toolchainSpec in Kotlin DSL. (#​2087)

v9.5.0

Compare Source

Added

• Check DuplicatesStrategy for merging transformers. (#​2026)
  This will log warnings when an incompatible DuplicatesStrategy (e.g., EXCLUDE) is applied in Gradle configuration for built-in ResourceTransformers.
• Add KotlinModuleMetadataTransformer. (#​2073)
• Add R8 as an opt-in minimize { r8 { ... } } tool for shrinking the final shadowed JAR. (#​2077)

Changed

• Bump min Gradle requirement to 9.2.0. (#​2057)
• Remove afterEvaluate when adding variants. (#​2056)
• Deprecate enableKotlinModuleRemapping for ShadowJar. (#​2073)
  Apply KotlinModuleMetadataTransformer explicitly to support relocating inside Kotlin module metadata files.
• Deprecate everything under ShadowCopyAction. (#​2083)

Fixed

• Fix the conflicts when using afterEvaluate with other plugins. (#​2055)

v9.4.3

Compare Source

Changed

• Update dependencies for resolving CVEs. (#​2069)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

---

• Branch has one or more failed status checks