From 7c876e595b54d0307aab79a58331f1e44a6de467 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 7 Aug 2026 14:32:21 +0000 Subject: [PATCH 1/4] Pin jspecify/checker-qual in dependencyManagement, bump archunit/junit patches MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The reactor is broken on main right now: Dependabot PR #169 bumped jspecify.version 1.0.0 -> 1.0.1 directly in all three child modules while net.ladenthin:llama:5.0.6 still pulls jspecify 1.0.0 transitively at compile scope, tripping maven-enforcer's DependencyConvergence at validate in every module. The PR's own Build check was already red; it was merged anyway. Pin jspecify (and, defensively, checker-qual — currently converged only because both sides happen to match today, the exact same latent shape jspecify had before PR #169) in the reactor parent's dependencyManagement, next to the existing slf4j-api/logback-classic/jackson pins, so every child module inherits one source of truth instead of repeating the version literal. Each child's own now-redundant jspecify.version/checker.version-on- the-dependency declarations are removed (checker.version itself is kept where it also drives the checker annotation-processor artifact). Also bump junit-jupiter 6.1.2 -> 6.1.3 and archunit-junit5 1.4.2 -> 1.5.0 to the latest patch/minor releases, aligning with BitcoinAddressFinder (already on archunit 1.5.0) and the other net.ladenthin Maven repos. Verified: reactor-wide mvn -B validate (DependencyConvergence passes in all 3 modules), mvn -B clean compile, and CoreArchitectureTest (13/13), CliArchitectureTest (7/7), PluginArchitectureTest (12/12) all green. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01KqVypnKbydSNgmGFfhCMUc --- pom.xml | 23 +++++++++++++++++++++++ srcmorph-cli/pom.xml | 18 +++++++++--------- srcmorph-maven-plugin/pom.xml | 17 +++++++++-------- srcmorph/pom.xml | 17 +++++++++-------- 4 files changed, 50 insertions(+), 25 deletions(-) diff --git a/pom.xml b/pom.xml index 7668e99..93181b1 100644 --- a/pom.xml +++ b/pom.xml @@ -146,6 +146,29 @@ SPDX-License-Identifier: Apache-2.0 jackson-dataformat-yaml ${jackson.version} + + + org.jspecify + jspecify + 1.0.1 + + + + org.checkerframework + checker-qual + 4.2.2 + diff --git a/srcmorph-cli/pom.xml b/srcmorph-cli/pom.xml index 3c34780..3b17c2b 100644 --- a/srcmorph-cli/pom.xml +++ b/srcmorph-cli/pom.xml @@ -33,13 +33,15 @@ SPDX-License-Identifier: Apache-2.0 references it, and child properties are never visible to a parent POM) — see srcmorph-parent/pom.xml. Not redeclared here. --> - 6.1.2 + 6.1.3 3.0 2.50.0 0.13.8 - 1.0.1 - 4.2.1 - 1.4.2 + + 4.2.2 + 1.5.0 4.10.3.0 1.18.46 7.7.4 @@ -51,9 +53,9 @@ SPDX-License-Identifier: Apache-2.0 @@ -66,12 +68,10 @@ SPDX-License-Identifier: Apache-2.0 org.jspecify jspecify - ${jspecify.version} org.checkerframework checker-qual - ${checker.version} - 6.1.2 + 6.1.3 3.0 1.37 0.16 1.2.28 2.50.0 0.13.8 - 1.0.1 - 4.2.1 + + 4.2.2 - 1.4.2 + 1.5.0 4.10.3.0 1.18.46 7.7.4 @@ -107,8 +109,9 @@ SPDX-License-Identifier: Apache-2.0 @@ -121,12 +124,10 @@ SPDX-License-Identifier: Apache-2.0 org.jspecify jspecify - ${jspecify.version} org.checkerframework checker-qual - ${checker.version} - 6.1.2 + 6.1.3 3.0 3.7 2.50.0 0.13.8 - 1.0.1 - 4.2.1 + + 4.2.2 1.9.3 - 1.4.2 + 1.5.0 4.10.3.0 1.18.46 7.7.4 @@ -65,8 +67,9 @@ SPDX-License-Identifier: Apache-2.0 @@ -79,12 +82,10 @@ SPDX-License-Identifier: Apache-2.0 org.jspecify jspecify - ${jspecify.version} org.checkerframework checker-qual - ${checker.version} net.ladenthin From 2da040c83ab85947fc40af23f12832a0632f0d9f Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 7 Aug 2026 14:36:16 +0000 Subject: [PATCH 2/4] Add CLAUDE.md pointer to workspace dependency-convergence-pinning policy Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01KqVypnKbydSNgmGFfhCMUc --- CLAUDE.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/CLAUDE.md b/CLAUDE.md index 2cf8caf..6ae0af7 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -474,6 +474,15 @@ classifier) and signs them via the cross-repo shared `.github/sign-fatjars.sh` ( java-llama.cpp). The convention + per-repo shapes + the classifier keep-in-sync rule are documented in [`../workspace/policies/fat-jar-release-assets.md`](../workspace/policies/fat-jar-release-assets.md). +## Dependency Convergence Pinning + +`dependencyConvergence` is enabled (maven-enforcer) in each of the 3 reactor modules; +`jspecify`/`checker-qual` are pinned in the reactor parent's `dependencyManagement` (next to the +existing `slf4j-api`/`logback-classic`/`jackson` pins) because `net.ladenthin:llama` brings both +transitively. Convention + the `excludedScopes` gotcha + merge-discipline guidance (this repo's +`main` was actually broken by exactly this pattern once — Dependabot PR #169) are in +[`../workspace/policies/dependency-convergence-pinning.md`](../workspace/policies/dependency-convergence-pinning.md). + ## Open TODOs Open TODOs for this repo live in [`TODO.md`](TODO.md). Cross-repo status From 85617af87bf4d2244b220bde8450c32e87ac57a8 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 7 Aug 2026 14:53:16 +0000 Subject: [PATCH 3/4] Revert actions/setup-java to floating @v5 (was pinned to exact @v5.6.0) Dependabot PR #171 rewrote every actions/setup-java@v5 reference to the exact release tag @v5.6.0 -- Dependabot's default github-actions behavior (compares against published Releases, rewrites to the exact tag once it touches a line, cannot be configured to preserve a floating major alias; no versioning-strategy support for this ecosystem). The floating @v5 alias is verified to correctly track the newest v5.x release, so reverting restores consistency with BitcoinAddressFinder and streambuffer, which still float @v5. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01KqVypnKbydSNgmGFfhCMUc --- .github/workflows/codeql.yml | 2 +- .github/workflows/publish.yml | 16 ++++++++-------- .github/workflows/sonarqube.yml | 2 +- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index bc30a34..2e3baac 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -19,7 +19,7 @@ jobs: security-events: write steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: { java-version: '21', distribution: temurin } - uses: github/codeql-action/init@v4 with: { languages: java, queries: +security-and-quality } diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 50c615e..66db813 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -170,7 +170,7 @@ jobs: environment: maven-central steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: java-version: '21' distribution: temurin @@ -211,7 +211,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: java-version: '21' distribution: temurin @@ -247,7 +247,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: java-version: '21' distribution: temurin @@ -273,7 +273,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: java-version: '21' distribution: temurin @@ -343,7 +343,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: { java-version: '21', distribution: temurin, cache: maven } - name: Test under vmlens (one class — staged scope) # VmlensInterleavingSmokeTest and the `vmlens` profile both live in @@ -375,7 +375,7 @@ jobs: contents: write steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: { java-version: '21', distribution: temurin } # Only srcmorph's jacoco report is uploaded by the `test` job (see the comment there) — # it carries the bulk of the test suite and the only PIT gate. Coveralls/Codecov are @@ -427,7 +427,7 @@ jobs: environment: maven-central steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: java-version: '21' distribution: temurin @@ -558,7 +558,7 @@ jobs: contents: write steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: java-version: '21' distribution: temurin diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml index dcd44b6..b5c982f 100644 --- a/.github/workflows/sonarqube.yml +++ b/.github/workflows/sonarqube.yml @@ -18,7 +18,7 @@ jobs: with: fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis - name: Set up JDK 21 - uses: actions/setup-java@v5.6.0 + uses: actions/setup-java@v5 with: java-version: 21 distribution: 'zulu' From 63fef7c577465273c21940cf04388284598b9695 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 7 Aug 2026 15:09:06 +0000 Subject: [PATCH 4/4] Bump pitest-maven 1.25.8 -> 1.25.9 in srcmorph and srcmorph-maven-plugin Latest stable release, matching the same bump in the other 3 sibling repos. Verified: reactor-wide mvn -B validate + clean compile, and a full PIT mutation run against the srcmorph module's 47-class/618-mutation gate (100% killed) on the new pitest version. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01KqVypnKbydSNgmGFfhCMUc --- srcmorph-maven-plugin/pom.xml | 2 +- srcmorph/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/srcmorph-maven-plugin/pom.xml b/srcmorph-maven-plugin/pom.xml index 29931d6..a930c1d 100644 --- a/srcmorph-maven-plugin/pom.xml +++ b/srcmorph-maven-plugin/pom.xml @@ -340,7 +340,7 @@ SPDX-License-Identifier: Apache-2.0 org.pitest pitest-maven - 1.25.8 + 1.25.9 org.sonatype.central diff --git a/srcmorph/pom.xml b/srcmorph/pom.xml index 7e7ee16..60adbb0 100644 --- a/srcmorph/pom.xml +++ b/srcmorph/pom.xml @@ -244,7 +244,7 @@ SPDX-License-Identifier: Apache-2.0 org.pitest pitest-maven - 1.25.8 + 1.25.9 org.sonatype.central