[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
actions/upload-artifact	action	patch	v7.0.1 → v7.0.2
gradle (source)		patch	9.8.0 → 9.8.1
com.github.spotbugs:spotbugs-annotations (source)	devDependencies	patch	4.10.4 → 4.10.5
com.github.ben-manes.caffeine:caffeine	dependencies	patch	3.3.0 → 3.3.1
com.github.spotbugs:spotbugs (source)	devDependencies	patch	4.10.4 → 4.10.5
org.openrewrite:plugin	devDependencies	minor	7.29.0 → 7.41.0
com.github.spotbugs.snom:spotbugs-gradle-plugin	devDependencies	patch	6.5.12 → 6.5.13
io.github.miniplaceholders:miniplaceholders-api	dependencies	minor	3.1.0 → 3.2.0
com.diffplug.spotless:spotless-plugin-gradle	devDependencies	patch	8.10.3 → 8.10.4

---

Release Notes

actions/upload-artifact

v7.0.2

Compare Source

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in #​821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

gradle/gradle (gradle)

v9.8.1: 9.8.1

Compare Source

This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.

This release addresses three high rated vulnerabilities:

• Unauthenticated worker-to-daemon channel deserializes untrusted Java objects
• Deserialization of untrusted Java objects before authentication in the client - daemon communication
• Failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts

The following issues were resolved:

• [Gradle 9.8.0 complains again about invalid Toolchains on Debian / Ubuntu packaged systems]- (#​39358)
• Gradle 9.8.0 removes root java.util.logging handlers installed by a custom LogManager (breaks Quarkus test log capture)
• Dependency resolution regression

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
Aman Gautam,
Björn Kautler,
Eng Zer Jun,
Hashim Khan,
Julian Krannich,
KBS,
Labh R Jethe,
Mark Dodgson,
Maxim,
monkey,
nataphon-ktsystems,
Paul King,
Qiu Tian,
rg_sandesh,
Roberto Perez Alcolea,
Sean,
Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

spotbugs/spotbugs (com.github.spotbugs:spotbugs-annotations)

v4.10.5

Compare Source

Added

• Add ReflectiveAccessTracker to track fields accessed via reflection - such as VarHandle, MethodHandle or AtomicFieldUpdaters (#​3954) to fix issue (#​2749)
• Add automatic completion of class names in GUI class filter (#​749)

Changed

• @SuppressFBWarnings annotation on a method or a constructor now suppresses warnings reported in their lambdas too (#​724)
• Replace deprecated calls to 'SignatureParser' to 'GenericSignatureParser' where feasible (#​4336)
• Declaring to the interface lists/maps (#​4381)

Fixed

• Fix NP_NULL_ON_SOME_PATH false positive when a field null check that throws uses field == null but not null == field (#​4147)
• Fix RV_RETURN_VALUE_IGNORED_NO_SIDE_EFFECT false negative when the ignored result comes from Arrays.copyOf, Arrays.copyOfRange or any pure static method or constructor of a class using assert (#​3900)
• Fix AA_ASSERTION_OF_ARGUMENTS false negative when a public method validates a parameter with assert and instanceof (#​4305)
• Fix PT_ABSOLUTE_PATH_TRAVERSAL false negative for new File(parent, child), where the attacker controlled segment is the second argument (#​4340)
• Fix 'DM_USELESS_THREAD' false negative for Thread subclasses that do not override run() (#​4306)
• Fix UL_UNRELEASED_LOCK false negative when a method acquires a lock and never calls unlock (#​4310)
• Fix TLW_TWO_LOCK_WAIT false negatives when a class waits while holding two monitors but has no matching notify() call (#​4323)
• Fix NP_ALWAYS_NULL false positives when a non-null value is known to satisfy an instanceof check (#​4272)
• Fix RANGE_ARRAY_INDEX false positive when the array access is inside unreachable code caused by an impossible null condition (e.g. if (x == null && x != null)) (#​4275)
• Fix NP_NULL_ON_SOME_PATH false positive when instanceof check is always true because the value was created with new and its exact type is a subtype of the checked type (e.g. Base value = new Derived(); if (value instanceof Derived) result = new Object(); result.toString()) (#​4273)
• Fix NN_NAKED_NOTIFY false positive when guarded state is updated before the synchronized block that calls notify/notifyAll (#​3786)
• Fix SA_LOCAL_SELF_ASSIGNMENT false positive in methods with ++/-- inside a switch nested in a try-catch block (#​3929)
• Fix AT_NONATOMIC_OPERATIONS_ON_SHARED_VARIABLE false negative for non-atomic read-modify-write in inner classes accessing enclosing shared fields (#​4236)
• Fix OS_OPEN_STREAM false positive when the result of PrintWriter.append() is reassigned before closing the writer (#​4274)
• Fix OS_OPEN_STREAM false positive when a stream is wrapped (e.g. in a PrintStream, BufferedOutputStream or PrintWriter) and the wrapped stream is closed instead of the wrapper (#​4304)
• Fix SING_SINGLETON_GETTER_NOT_SYNCHRONIZED false negative when lazy init uses a ternary assignment instead of an if statement (#​4154)
• Fix UR_UNINIT_READ false negative for compound assignment to a field (e.g. m_iType |= e) (#​4233)
• Fix NP_BOOLEAN_RETURN_NULL false negative when null is returned via a local variable (#​4234)
• Fix MS_EXPOSE_BUF and EI_EXPOSE_BUF false negative when returning Buffer.array() (#​4235)
• Fix OBL_UNSATISFIED_OBLIGATION false negatives for unclosed CallableStatements returned by Connection.prepareCall (#​4148)
• Fix LI_LAZY_INIT_STATIC false negative when field is lazily initialized using a method call (#​4276)
• Fix DMI_RANDOM_USED_ONLY_ONCE FP when Random is used inside loop but created before (#​3937)
• Fix SARIF output writing source-location URI syntax exceptions to stderr when source filenames are unknown (#​1412)
• Fix IL_INFINITE_LOOP false positives for loops with conditions that are statically known to be true or false (#​3904)
• Narrow the definition of singletons (#​2985)
• Fix NP_LOAD_OF_KNOWN_NULL_VALUE false negative when null check uses instanceof (#​3916)
• Fix MC_OVERRIDABLE_METHOD_CALL_IN_CONSTRUCTOR false negative when a constructor calls an overridable method that takes arguments, such as a setter (e.g. setValue(value)) (#​4309)
• Fix CLI launcher scripts intercepting -conserveSpace with a JVM system property instead passing it to Java Application as equivalent to -effort:min (#​4268)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when clone() assigns a newly created lock object to the copy (#​4320)
• Fix CT_CONSTRUCTOR_THROW false positive with sealed classes (#​4259)
• Fix JrtfsCodeBase resolving JDK classes from the module image of the running JVM instead of the JDK the given jrt-fs.jar belongs to, so that -auxclasspath <other-jdk>/lib/jrt-fs.jar is honoured (#​4329)
• Fix USO_UNSAFE_ACCESSIBLE_OBJECT_SYNCHRONIZATION false positive when a lock is assigned to a newly allocated object (#​4331)
• Do not flag writeReplace() and writeExternal() as mutators (#​1719)
• Prevent XML external entity resolution in user-controlled data (#​4365)
• Fix handling of JSpecify type-use annotations in CheckRelaxingNullnessAnnotation (#​4389)
• Stop reporting missing java.applet at java 26 or higher (#​4390)

ben-manes/caffeine (com.github.ben-manes.caffeine:caffeine)

v3.3.1: 3.3.1

Compare Source

• Added a workaround for ForkJoinPool queue corruption caused by resubmitting a reusable ForkJoinTask (#​2021)
• Improved JCache read performance when using access expiration
• Fixed various minor issues found using AI audits

spotbugs/spotbugs-gradle-plugin (com.github.spotbugs.snom:spotbugs-gradle-plugin)

v6.5.13

Compare Source

Bug Fixes

• deps: update dependency com.github.spotbugs:spotbugs to v4.10.5 (#​1840) (fa0c06f)

MiniPlaceholders/MiniPlaceholders (io.github.miniplaceholders:miniplaceholders-api)

v3.2.0

Compare Source

Features

• Added support to Fabric 26.1+
• Added Minestom support
• Updated to Java 25

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

---

• Branch has one or more failed status checks

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: fb77494a-a8be-49f6-962e-dbeea83f0734

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.