Skip to content

Bump the all-dependencies group across 1 directory with 13 updates - #4889

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/gradle/all-dependencies-ab30e5c82f
Open

Bump the all-dependencies group across 1 directory with 13 updates#4889
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/gradle/all-dependencies-ab30e5c82f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-dependencies group with 13 updates in the / directory:

Package From To
com.github.jk1.dependency-license-report 3.1.4 3.1.5
me.champeau.jmh 0.7.3 0.7.4
com.github.oshi:oshi-core 7.7.1 7.7.3
com.fasterxml.jackson:jackson-bom 2.22.3 2.22.4
io.netty:netty-bom 4.2.19.Final 4.2.20.Final
com.google.errorprone:error_prone_annotations 2.50.0 2.52.0
com.google.errorprone:error_prone_core 2.50.0 2.52.0
com.google.errorprone:error_prone_core 2.50.0 2.52.0
com.google.code.gson:gson 2.14.0 2.15.0
com.diffplug.spotless:spotless-plugin-gradle 8.10.4 8.11.0
net.ltgt.gradle:gradle-errorprone-plugin 5.1.1 5.2.0
me.champeau.jmh:jmh-gradle-plugin 0.7.3 0.7.4
com.diffplug.spotless 8.10.4 8.11.0
gradle-wrapper 9.8.1 9.8.2

Updates com.github.jk1.dependency-license-report from 3.1.4 to 3.1.5

Updates me.champeau.jmh from 0.7.3 to 0.7.4

Updates com.github.oshi:oshi-core from 7.7.1 to 7.7.3

Release notes

Sourced from com.github.oshi:oshi-core's releases.

Release 7.7.3

Bug Fixes and Improvements
  • #3837: Reject IPv6 address text with a dotted IPv4 component before compressed zero groups - @​PHJ2000.
  • #3843: HWDiskStore.getDiskType() on Windows now reports SSD, HDD, Removable or Virtual, read from the storage driver and falling back to MSFT_PhysicalDisk - @​dbwiddis.
  • #3848: Fixed listing processes on DragonFly BSD, which could panic the kernel since 7.7.2. OSProcess.getPath() there now reads the full path from the kernel for the current process only, and argv[0] or the command name for others - @​dbwiddis.
  • #3852: Fixed IPv4 and IPv6 addresses reported byte-reversed on big-endian Linux, such as s390x, in NetworkParams.getRoutes() and InternetProtocolStats.getConnections() - @​dbwiddis.
  • #3853: NetworkParams.getIpv4DefaultGateway() and getIpv6DefaultGateway() on Linux now read the kernel routing table, so they no longer return an empty string when the route command is missing or not on the PATH - @​dbwiddis.

Full change log

Release 7.7.2

Bug Fixes and Improvements
  • #3785: Fixed DragonFly BSD reporting 0 total swap, and the FFM implementation failing every sysctl read there - @​dbwiddis.
  • #3785, #3795, #3800, #3801, #3803, #3822, #3831: Fixed the TCP and UDP statistics from InternetProtocolStats on Linux, macOS, AIX, FreeBSD, OpenBSD, NetBSD and DragonFly BSD, where many counters were read from the wrong field or at the wrong width. Counters a platform does not keep now report 0, including IPv6 UDP on FreeBSD and macOS, and connection failures and UDP receive errors on AIX - @​dbwiddis.
  • #3787, #3816: ComputerSystem, Firmware and Baseboard now report SMBIOS values without root on FreeBSD and DragonFly BSD, and at all on NetBSD, where every value was unknown; NetBSD's serial numbers and UUID still need root. Firmware.getReleaseDate() is no longer garbled on any platform when the firmware does not write the date as MM/DD/YYYY - @​dbwiddis.
  • #3788, #3807, #3814, #3824: Fixed NetworkIF on the BSDs: traffic statistics were 0 on OpenBSD and DragonFly BSD, and on NetBSD for interfaces without a link-level address, and getSpeed() was always 0 on FreeBSD, OpenBSD and NetBSD. NetworkParams now reports DragonFly BSD's default gateways and reads NetBSD's routing table from the kernel - @​dbwiddis.
  • #3789, #3792, #3799, #3812, #3818: Fixed CentralProcessor on FreeBSD, NetBSD and DragonFly BSD, which miscounted cores, packages or logical processors and left identification and caches unknown, and on NetBSD ARM threw a StackOverflowError. AMD processors of family 16 and later now get the right family on OpenBSD and the right ProcessorID where OSHI builds one. FreeBSD context switch and interrupt counts no longer wrap at 2^32 - @​dbwiddis.
  • #3791, #3798, #3819, #3833: Fixed getDiskStores() on the BSDs: DragonFly BSD returned no disks, FreeBSD listed each disk as a partition of the next, and NetBSD listed each wedge as a separate disk. Partitions now sit under their disk with their mount points, and on OpenBSD and NetBSD without root they no longer include another disk's or misread their size when BLOCKSIZE is set - @​dbwiddis.
  • #3793, #3810, #3817, #3821, #3827, #3829, #3832: Fixed OSProcess on the BSDs. getPath() now returns the executable's full path from the kernel on FreeBSD, DragonFly BSD and NetBSD, as does getCurrentWorkingDirectory() on NetBSD. DragonFly BSD now reports bitness and affinity, FreeBSD other processes' open-file limits, and NetBSD every thread of a process and only real descriptors in getOpenFiles(). getServices() skips rcorder placeholders - @​dbwiddis.
  • #3797, #3805, #3826: Fixed getPowerSources() on FreeBSD and DragonFly BSD, which reported a battery on machines with none and only one of several, with units and signs now matching other platforms; getGraphicsCards() on current FreeBSD, which reported the wrong vendor and no device ID; and getUsbDevices() on FreeBSD, which was empty - @​dbwiddis.
  • #3808, #3820, #3823, #3825: Fixed FileSystem and OSFileStore on the BSDs. getMaxFileDescriptorsPerProcess() returns the per-process limit, NetBSD's getOpenFileDescriptors() is no longer 0, FreeBSD's getUUID() is found for every volume, and mount points with spaces and NetBSD and OpenBSD inode counts are read correctly - @​dbwiddis.

Full change log

Changelog

Sourced from com.github.oshi:oshi-core's changelog.

Commits
  • 47d0e45 [maven-release-plugin] prepare release oshi-parent-7.7.3
  • 7efc531 7.7.3 Release
  • c46a6c0 Resolve the three open Sonar findings
  • f5e572d Allow for whole-minute sources in the AIX boot time test (#3854)
  • c55f2d4 Read the Linux default gateways from the kernel routing table (#3853)
  • 5154264 Decode /proc/net addresses in the host's byte order on Linux (#3852)
  • 9480cbc Update dependency org.apache.maven.plugins:maven-enforcer-plugin to v3.7.0 (#...
  • 7170e1f Update eclipse-temurin Docker tag to v25.0.5_8-jdk-alpine (#3850)
  • 4e05429 Print JVM crash reports from every Unix CI job when its build fails
  • 0bb4198 Name the AppVeyor account in the on-demand build request
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson:jackson-bom from 2.22.3 to 2.22.4

Commits
  • 267bf9a [maven-release-plugin] prepare release jackson-bom-2.22.4
  • d41cad1 Prep for 2.22.4 release
  • 8fd9ace Merge branch '2.21' into 2.22
  • e1b27ed Post-release dep version bump
  • 5dfe489 [maven-release-plugin] prepare for next development iteration
  • b23db92 [maven-release-plugin] prepare release jackson-bom-2.21.8
  • 8937d04 Prep for 2.21.8 release
  • c44e739 Merge branch '2.20' into 2.21
  • b86d50e Merge branch '2.19' into 2.20
  • 7756e79 Merge branch '2.18' into 2.19
  • Additional commits viewable in compare view

Updates io.netty:netty-bom from 4.2.19.Final to 4.2.20.Final

Release notes

Sourced from io.netty:netty-bom's releases.

netty-4.2.20.Final

Security Fixes

What's Changed

... (truncated)

Commits
  • 4fb6a5f [maven-release-plugin] prepare release netty-4.2.20.Final
  • 3da0f5a Reject all control characters and DEL in HTTP request line tokens
  • 464cfd7 TLS/QUIC: Scope session resumption via a derived session_id_context
  • b85fb0a Don't preallocate the SUBACK and UNSUBACK reason code lists from the remainin...
  • c2196f9 Check the index before every numeric accessor on Unpooled buffers
  • dbf089b Fix use-after-free when QuicheQuicConnection.free() races an offloaded SSL task
  • 52ce8c5 Bound outstandingRemoteSettingsQueue to prevent unbounded heap growth
  • d576bd9 Add 0x20 case randomization and DNS cookie support to DnsNameResolver
  • fb4736f Check bounds in ByteBuf string accessors
  • debfda5 QPACK: Don't decode the name of Insert With Literal Name again for every valu...
  • Additional commits viewable in compare view

Updates com.google.errorprone:error_prone_annotations from 2.50.0 to 2.52.0

Release notes

Sourced from com.google.errorprone:error_prone_annotations's releases.

Error Prone 2.52.0

New checks:

  • AlmostExhaustiveTestParameter: Prefer an exhaustive @TestParameter with an assumption to filter out specific enum values, so newly added enum values are automatically tested (disabled by default).
  • SingleTestParameter: Suggest @TestParameter on the parameter instead of @TestParameters when there is only one test parameter, replacing PreferTestParameter (disabled by default).
  • SingleValueTestParameter: Suggest replacing a @TestParameter that has only a single value with a local variable in the test method (disabled by default).
  • ValueClassEquals: Require non-record concrete value classes to explicitly override equals and hashCode.

Other changes:

  • LoopToTestParameter: Changed severity to SUGGESTION (disabled by default).
  • DistinctVarargsChecker: Allow duplicate arguments to Iterables.concat (#6239) and Mockito argument matchers such as any() (#6240).
  • UnusedVariable: Treat fields accessed via MethodHandles.Lookup (VarHandle/getter/setter lookups) or Atomic*FieldUpdater.newUpdater as used.
  • StringBuilderInitWithChar / StringBuffer refactoring: Refactor StringBuffer to StringBuilder even when used with Matcher.appendReplacement and appendTail (when supported by the target JDK or Android minSdkVersion).
  • CompileTimeConstant: Treat record and interface fields and field accesses on compile-time constants (compileTimeConstant.compileTimeConstantField) as compile-time constants.
  • ValueClassIdentity / ReferenceEquality: Handle JEP 401 value classes.
  • FieldCanBeFinal / ThreadSafety: Improve compile-time performance on large classes and deep type hierarchies, and update SafeRE to 1.1.0 (#6230).
  • Added ClassName for caching resolved ClassSymbol, Type, and binary Name lookups across a compilation.

Closed issues: #5964, #6165, #6230, #6239, #6240, #6275

Full changelog: google/error-prone@v2.51.0...v2.52.0

Error Prone 2.51.0

New checks:

  • HashCodeInObjectsHash: Detect redundant hashCode() or Objects.hash() calls inside Objects.hash(...), and simplify single-argument Objects.hash(x) calls to Objects.hashCode(x).
  • LoopToTestParameter: Suggest migrating loops in unit tests to TestParameterInjector.
  • MissingJavadoc: Flag public types that are missing Javadoc comments (disabled by default).
  • PreferCharsetOverload: Prefer calling method and constructor overloads that accept a Charset over those that accept a String encoding name.
  • PreferPreconditions: Suggest using Guava's Preconditions instead of explicit if-throw statements for parameter validation (disabled by default).
  • RequireNonNullRefactoring: Refactor explicit if (x == null) { throw new NullPointerException(...); } checks to Objects.requireNonNull (disabled by default).
  • SimplifyTestParameter: Remove redundant explicit value lists on @TestParameter annotations for boolean and Enum types when all values are specified (disabled by default).
  • TraditionalJavadocToMarkdown: Convert traditional /** ... */ Javadoc comments into /// Markdown Javadoc comments (disabled by default).
  • ValueClassIdentity: Flag reliance on identity semantics (such as synchronization, WeakReference, IdentityHashMap, or System.identityHashCode) of value-based classes (disabled by default).

Other changes:

  • CompareToZero: Upgraded from warning to error, and expanded to flag non-relational operations, unary negation, and switch statements/expressions on compareTo and compare results without Integer.signum.
  • IfChainToSwitch: Enabled by default as a warning.
  • UndefinedEquals: Merged ArrayAsKeyOfSetOrMap and CollectionUndefinedEquality into UndefinedEquals (retaining their names as altNames), and generalized detection of types without well-defined equals or hashCode across direct equality, collection containment, and hash-based containers.
  • EqualsIncompatibleType / TruthIncompatibleType: Flag equality comparisons between distinct record types (#6107).
  • ReferenceEquality: Allow == comparisons on private classes whose type hierarchy does not override Object.equals (#5865), private static final sentinel fields, Thread (#5900), and com.sun.source.tree.Tree.
  • PatternMatchingInstanceof: Support while and for loops, parenthesized expressions (#5843), and replacing additional redundant casts when the instanceof already introduces a pattern variable.
  • DistinctVarargsChecker: Expanded to check Objects.hash, CompletableFuture.allOf/anyOf, EnumSet.of, Sets.union/intersection/difference, Stream.concat, Math.min/max, and additional JDK, Guava, Protobuf, Truth, and Mockito methods.
  • MustBeClosedChecker: Require java.lang.foreign.Arena.ofConfined and Arena.ofShared to be closed.
  • ImpossibleNullComparison: Flag null checks on the return value of Class.forName.
  • RestrictedApi / RestrictedInheritance: Added an allowedPaths attribute to allow calls or inheritance from matching file paths without a regular expression.
  • InlineMeInliner: Support substituting type arguments at call sites when inlining generic @InlineMe methods.
  • WellKnownKeep: Recognize Apache Beam DoFn annotations and retain open-source library annotations (Gson, Mockito, Guice, Objectify, TestParameterInjector, AutoFactory).

... (truncated)

Commits
  • 1e32314 Release Error Prone 2.52.0
  • ea4c6df Avoid calling SuggestedFixes.compilesWithFix in FieldCanBeFinal
  • 04640b8 Update SafeRE to 1.1.0
  • 6034e09 Bump the dependencies group across 1 directory with 8 updates
  • 3cc36d5 Bump actions/setup-java from 6.0.1 to 6.1.0 in the github-actions group (#6270)
  • 0202185 Migrate class and annotation name constants in Error Prone to ClassName.
  • cdf0d94 Add ASTHelpers.overridesObjectEquals and overridesObjectHashCode helpers.
  • 208015e Update MemoizeConstantVisitorStateLookups to suggest ClassName.
  • e1a8a3e Add ValueClassEquals to require non-record concrete value classes to over...
  • 2c6baed Handle JEP 401 value classes in ValueClassIdentity and ReferenceEquality
  • Additional commits viewable in compare view

Updates com.google.errorprone:error_prone_core from 2.50.0 to 2.52.0

Release notes

Sourced from com.google.errorprone:error_prone_core's releases.

Error Prone 2.52.0

New checks:

  • AlmostExhaustiveTestParameter: Prefer an exhaustive @TestParameter with an assumption to filter out specific enum values, so newly added enum values are automatically tested (disabled by default).
  • SingleTestParameter: Suggest @TestParameter on the parameter instead of @TestParameters when there is only one test parameter, replacing PreferTestParameter (disabled by default).
  • SingleValueTestParameter: Suggest replacing a @TestParameter that has only a single value with a local variable in the test method (disabled by default).
  • ValueClassEquals: Require non-record concrete value classes to explicitly override equals and hashCode.

Other changes:

  • LoopToTestParameter: Changed severity to SUGGESTION (disabled by default).
  • DistinctVarargsChecker: Allow duplicate arguments to Iterables.concat (#6239) and Mockito argument matchers such as any() (#6240).
  • UnusedVariable: Treat fields accessed via MethodHandles.Lookup (VarHandle/getter/setter lookups) or Atomic*FieldUpdater.newUpdater as used.
  • StringBuilderInitWithChar / StringBuffer refactoring: Refactor StringBuffer to StringBuilder even when used with Matcher.appendReplacement and appendTail (when supported by the target JDK or Android minSdkVersion).
  • CompileTimeConstant: Treat record and interface fields and field accesses on compile-time constants (compileTimeConstant.compileTimeConstantField) as compile-time constants.
  • ValueClassIdentity / ReferenceEquality: Handle JEP 401 value classes.
  • FieldCanBeFinal / ThreadSafety: Improve compile-time performance on large classes and deep type hierarchies, and update SafeRE to 1.1.0 (#6230).
  • Added ClassName for caching resolved ClassSymbol, Type, and binary Name lookups across a compilation.

Closed issues: #5964, #6165, #6230, #6239, #6240, #6275

Full changelog: google/error-prone@v2.51.0...v2.52.0

Error Prone 2.51.0

New checks:

  • HashCodeInObjectsHash: Detect redundant hashCode() or Objects.hash() calls inside Objects.hash(...), and simplify single-argument Objects.hash(x) calls to Objects.hashCode(x).
  • LoopToTestParameter: Suggest migrating loops in unit tests to TestParameterInjector.
  • MissingJavadoc: Flag public types that are missing Javadoc comments (disabled by default).
  • PreferCharsetOverload: Prefer calling method and constructor overloads that accept a Charset over those that accept a String encoding name.
  • PreferPreconditions: Suggest using Guava's Preconditions instead of explicit if-throw statements for parameter validation (disabled by default).
  • RequireNonNullRefactoring: Refactor explicit if (x == null) { throw new NullPointerException(...); } checks to Objects.requireNonNull (disabled by default).
  • SimplifyTestParameter: Remove redundant explicit value lists on @TestParameter annotations for boolean and Enum types when all values are specified (disabled by default).
  • TraditionalJavadocToMarkdown: Convert traditional /** ... */ Javadoc comments into /// Markdown Javadoc comments (disabled by default).
  • ValueClassIdentity: Flag reliance on identity semantics (such as synchronization, WeakReference, IdentityHashMap, or System.identityHashCode) of value-based classes (disabled by default).

Other changes:

  • CompareToZero: Upgraded from warning to error, and expanded to flag non-relational operations, unary negation, and switch statements/expressions on compareTo and compare results without Integer.signum.
  • IfChainToSwitch: Enabled by default as a warning.
  • UndefinedEquals: Merged ArrayAsKeyOfSetOrMap and CollectionUndefinedEquality into UndefinedEquals (retaining their names as altNames), and generalized detection of types without well-defined equals or hashCode across direct equality, collection containment, and hash-based containers.
  • EqualsIncompatibleType / TruthIncompatibleType: Flag equality comparisons between distinct record types (#6107).
  • ReferenceEquality: Allow == comparisons on private classes whose type hierarchy does not override Object.equals (#5865), private static final sentinel fields, Thread (#5900), and com.sun.source.tree.Tree.
  • PatternMatchingInstanceof: Support while and for loops, parenthesized expressions (#5843), and replacing additional redundant casts when the instanceof already introduces a pattern variable.
  • DistinctVarargsChecker: Expanded to check Objects.hash, CompletableFuture.allOf/anyOf, EnumSet.of, Sets.union/intersection/difference, Stream.concat, Math.min/max, and additional JDK, Guava, Protobuf, Truth, and Mockito methods.
  • MustBeClosedChecker: Require java.lang.foreign.Arena.ofConfined and Arena.ofShared to be closed.
  • ImpossibleNullComparison: Flag null checks on the return value of Class.forName.
  • RestrictedApi / RestrictedInheritance: Added an allowedPaths attribute to allow calls or inheritance from matching file paths without a regular expression.
  • InlineMeInliner: Support substituting type arguments at call sites when inlining generic @InlineMe methods.
  • WellKnownKeep: Recognize Apache Beam DoFn annotations and retain open-source library annotations (Gson, Mockito, Guice, Objectify, TestParameterInjector, AutoFactory).

... (truncated)

Commits
  • 1e32314 Release Error Prone 2.52.0
  • ea4c6df Avoid calling SuggestedFixes.compilesWithFix in FieldCanBeFinal
  • 04640b8 Update SafeRE to 1.1.0
  • 6034e09 Bump the dependencies group across 1 directory with 8 updates
  • 3cc36d5 Bump actions/setup-java from 6.0.1 to 6.1.0 in the github-actions group (#6270)
  • 0202185 Migrate class and annotation name constants in Error Prone to ClassName.
  • cdf0d94 Add ASTHelpers.overridesObjectEquals and overridesObjectHashCode helpers.
  • 208015e Update MemoizeConstantVisitorStateLookups to suggest ClassName.
  • e1a8a3e Add ValueClassEquals to require non-record concrete value classes to over...
  • 2c6baed Handle JEP 401 value classes in ValueClassIdentity and ReferenceEquality
  • Additional commits viewable in compare view

Updates com.google.errorprone:error_prone_core from 2.50.0 to 2.52.0

Release notes

Sourced from com.google.errorprone:error_prone_core's releases.

Error Prone 2.52.0

New checks:

  • AlmostExhaustiveTestParameter: Prefer an exhaustive @TestParameter with an assumption to filter out specific enum values, so newly added enum values are automatically tested (disabled by default).
  • SingleTestParameter: Suggest @TestParameter on the parameter instead of @TestParameters when there is only one test parameter, replacing PreferTestParameter (disabled by default).
  • SingleValueTestParameter: Suggest replacing a @TestParameter that has only a single value with a local variable in the test method (disabled by default).
  • ValueClassEquals: Require non-record concrete value classes to explicitly override equals and hashCode.

Other changes:

  • LoopToTestParameter: Changed severity to SUGGESTION (disabled by default).
  • DistinctVarargsChecker: Allow duplicate arguments to Iterables.concat (#6239) and Mockito argument matchers such as any() (#6240).
  • UnusedVariable: Treat fields accessed via MethodHandles.Lookup (VarHandle/getter/setter lookups) or Atomic*FieldUpdater.newUpdater as used.
  • StringBuilderInitWithChar / StringBuffer refactoring: Refactor StringBuffer to StringBuilder even when used with Matcher.appendReplacement and appendTail (when supported by the target JDK or Android minSdkVersion).
  • CompileTimeConstant: Treat record and interface fields and field accesses on compile-time constants (compileTimeConstant.compileTimeConstantField) as compile-time constants.
  • ValueClassIdentity / ReferenceEquality: Handle JEP 401 value classes.
  • FieldCanBeFinal / ThreadSafety: Improve compile-time performance on large classes and deep type hierarchies, and update SafeRE to 1.1.0 (#6230).
  • Added ClassName for caching resolved ClassSymbol, Type, and binary Name lookups across a compilation.

Closed issues: #5964, #6165, #6230, #6239, #6240, #6275

Full changelog: google/error-prone@v2.51.0...v2.52.0

Error Prone 2.51.0

New checks:

  • HashCodeInObjectsHash: Detect redundant hashCode() or Objects.hash() calls inside Objects.hash(...), and simplify single-argument Objects.hash(x) calls to Objects.hashCode(x).
  • LoopToTestParameter: Suggest migrating loops in unit tests to TestParameterInjector.
  • MissingJavadoc: Flag public types that are missing Javadoc comments (disabled by default).
  • PreferCharsetOverload: Prefer calling method and constructor overloads that accept a Charset over those that accept a String encoding name.
  • PreferPreconditions: Suggest using Guava's Preconditions instead of explicit if-throw statements for parameter validation (disabled by default).
  • RequireNonNullRefactoring: Refactor explicit if (x == null) { throw new NullPointerException(...); } checks to Objects.requireNonNull (disabled by default).
  • SimplifyTestParameter: Remove redundant explicit value lists on @TestParameter annotations for boolean and Enum types when all values are specified (disabled by default).
  • TraditionalJavadocToMarkdown: Convert traditional /** ... */ Javadoc comments into /// Markdown Javadoc comments (disabled by default).
  • ValueClassIdentity: Flag reliance on identity semantics (such as synchronization, WeakReference, IdentityHashMap, or System.identityHashCode) of value-based classes (disabled by default).

Other changes:

  • CompareToZero: Upgraded from warning to error, and expanded to flag non-relational operations, unary negation, and switch statements/expressions on compareTo and compare results without Integer.signum.
  • IfChainToSwitch: Enabled by default as a warning.
  • UndefinedEquals: Merged ArrayAsKeyOfSetOrMap and CollectionUndefinedEquality into UndefinedEquals (retaining their names as altNames), and generalized detection of types without well-defined equals or hashCode across direct equality, collection containment, and hash-based containers.
  • EqualsIncompatibleType / TruthIncompatibleType: Flag equality comparisons between distinct record types (#6107).
  • ReferenceEquality: Allow == comparisons on private classes whose type hierarchy does not override Object.equals (#5865), private static final sentinel fields, Thread (#5900), and com.sun.source.tree.Tree.
  • PatternMatchingInstanceof: Support while and for loops, parenthesized expressions (#5843), and replacing additional redundant casts when the instanceof already introduces a pattern variable.
  • DistinctVarargsChecker: Expanded to check Objects.hash, CompletableFuture.allOf/anyOf, EnumSet.of, Sets.union/intersection/difference, Stream.concat, Math.min/max, and additional JDK, Guava, Protobuf, Truth, and Mockito methods.
  • MustBeClosedChecker: Require java.lang.foreign.Arena.ofConfined and Arena.ofShared to be closed.
  • ImpossibleNullComparison: Flag null checks on the return value of Class.forName.
  • RestrictedApi / RestrictedInheritance: Added an allowedPaths attribute to allow calls or inheritance from matching file paths without a regular expression.
  • InlineMeInliner: Support subst...

    Description has been truncated

@dependabot
Bump the all-dependencies group across 1 directory with 13 updates
a70dde0 
Bumps the all-dependencies group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| com.github.jk1.dependency-license-report | `3.1.4` | `3.1.5` |
| me.champeau.jmh | `0.7.3` | `0.7.4` |
| [com.github.oshi:oshi-core](https://github.com/oshi/oshi) | `7.7.1` | `7.7.3` |
| [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) | `2.22.3` | `2.22.4` |
| [io.netty:netty-bom](https://github.com/netty/netty) | `4.2.19.Final` | `4.2.20.Final` |
| [com.google.errorprone:error_prone_annotations](https://github.com/google/error-prone) | `2.50.0` | `2.52.0` |
| [com.google.errorprone:error_prone_core](https://github.com/google/error-prone) | `2.50.0` | `2.52.0` |
| [com.google.errorprone:error_prone_core](https://github.com/google/error-prone) | `2.50.0` | `2.52.0` |
| [com.google.code.gson:gson](https://github.com/google/gson) | `2.14.0` | `2.15.0` |
| [com.diffplug.spotless:spotless-plugin-gradle](https://github.com/diffplug/spotless) | `8.10.4` | `8.11.0` |
| [net.ltgt.gradle:gradle-errorprone-plugin](https://github.com/tbroyer/gradle-errorprone-plugin) | `5.1.1` | `5.2.0` |
| me.champeau.jmh:jmh-gradle-plugin | `0.7.3` | `0.7.4` |
| com.diffplug.spotless | `8.10.4` | `8.11.0` |
| [gradle-wrapper](https://github.com/gradle/gradle) | `9.8.1` | `9.8.2` |



Updates `com.github.jk1.dependency-license-report` from 3.1.4 to 3.1.5

Updates `me.champeau.jmh` from 0.7.3 to 0.7.4

Updates `com.github.oshi:oshi-core` from 7.7.1 to 7.7.3
- [Release notes](https://github.com/oshi/oshi/releases)
- [Changelog](https://github.com/oshi/oshi/blob/master/CHANGELOG.md)
- [Commits](oshi/oshi@oshi-parent-7.7.1...oshi-parent-7.7.3)

Updates `com.fasterxml.jackson:jackson-bom` from 2.22.3 to 2.22.4
- [Commits](FasterXML/jackson-bom@jackson-bom-2.22.3...jackson-bom-2.22.4)

Updates `io.netty:netty-bom` from 4.2.19.Final to 4.2.20.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.19.Final...netty-4.2.20.Final)

Updates `com.google.errorprone:error_prone_annotations` from 2.50.0 to 2.52.0
- [Release notes](https://github.com/google/error-prone/releases)
- [Commits](google/error-prone@v2.50.0...v2.52.0)

Updates `com.google.errorprone:error_prone_core` from 2.50.0 to 2.52.0
- [Release notes](https://github.com/google/error-prone/releases)
- [Commits](google/error-prone@v2.50.0...v2.52.0)

Updates `com.google.errorprone:error_prone_core` from 2.50.0 to 2.52.0
- [Release notes](https://github.com/google/error-prone/releases)
- [Commits](google/error-prone@v2.50.0...v2.52.0)

Updates `com.google.code.gson:gson` from 2.14.0 to 2.15.0
- [Release notes](https://github.com/google/gson/releases)
- [Changelog](https://github.com/google/gson/blob/main/CHANGELOG.md)
- [Commits](google/gson@gson-parent-2.14.0...gson-parent-2.15.0)

Updates `com.diffplug.spotless:spotless-plugin-gradle` from 8.10.4 to 8.11.0
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](diffplug/spotless@gradle/8.10.4...gradle/8.11.0)

Updates `net.ltgt.gradle:gradle-errorprone-plugin` from 5.1.1 to 5.2.0
- [Release notes](https://github.com/tbroyer/gradle-errorprone-plugin/releases)
- [Commits](tbroyer/gradle-errorprone-plugin@v5.1.1...v5.2.0)

Updates `me.champeau.jmh:jmh-gradle-plugin` from 0.7.3 to 0.7.4

Updates `com.diffplug.spotless` from 8.10.4 to 8.11.0

Updates `gradle-wrapper` from 9.8.1 to 9.8.2
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](gradle/gradle@v9.8.1...v9.8.2)

---
updated-dependencies:
- dependency-name: com.github.jk1.dependency-license-report
  dependency-version: 3.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: me.champeau.jmh
  dependency-version: 0.7.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: com.github.oshi:oshi-core
  dependency-version: 7.7.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: com.fasterxml.jackson:jackson-bom
  dependency-version: 2.22.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: io.netty:netty-bom
  dependency-version: 4.2.20.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: com.google.errorprone:error_prone_annotations
  dependency-version: 2.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: com.google.errorprone:error_prone_core
  dependency-version: 2.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: com.google.errorprone:error_prone_core
  dependency-version: 2.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: com.google.code.gson:gson
  dependency-version: 2.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: com.diffplug.spotless:spotless-plugin-gradle
  dependency-version: 8.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: net.ltgt.gradle:gradle-errorprone-plugin
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: me.champeau.jmh:jmh-gradle-plugin
  dependency-version: 0.7.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: com.diffplug.spotless
  dependency-version: 8.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: gradle-wrapper
  dependency-version: 9.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 9, 2026
@dependabot dependabot Bot added the java Pull requests that update Java code label Nov 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@harsimar Harsimar Kaur (harsimar) Awaiting requested review from harsimar harsimar is a code owner
@johnoliver John (johnoliver) Awaiting requested review from johnoliver johnoliver is a code owner
@mattsains-msft Matthew Sainsbury (Microsoft) (mattsains-msft) Awaiting requested review from mattsains-msft mattsains-msft is a code owner
@rajkumar-rangaraj Rajkumar Rangaraj (rajkumar-rangaraj) Awaiting requested review from rajkumar-rangaraj rajkumar-rangaraj is a code owner
@ramthi Ram Thiru (ramthi) Awaiting requested review from ramthi ramthi is a code owner
@trask Trask Stalnaker (trask) Awaiting requested review from trask trask is a code owner
@xiang17 xiang17 Awaiting requested review from xiang17 xiang17 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants