fix(deps): update java dependencies by renovate[bot] · Pull Request #353 · metio/ilo

renovate · 2026-07-24T17:39:49Z

This PR contains the following updates:

Package	Change	Age	Confidence
org.simplify4u.plugins:sign-maven-plugin (source)	`1.1.0` → `1.2.0`
org.graalvm.buildtools:native-maven-plugin	`1.1.5` → `1.1.12`
org.apache.maven.plugins:maven-compiler-plugin (source)	`3.15.0` → `3.16.0`
com.diffplug.spotless:spotless-maven-plugin	`3.8.0` → `3.10.2`
net.sourceforge.pmd:pmd-java (source)	`7.26.0` → `7.27.0`
net.sourceforge.pmd:pmd-core (source)	`7.26.0` → `7.27.0`
org.pitest:pitest-maven (source)	`1.25.8` → `1.30.0`
org.apache.maven.plugins:maven-failsafe-plugin (source)	`3.5.6` → `3.6.0`
org.apache.maven.plugins:maven-surefire-plugin (source)	`3.5.6` → `3.6.0`
org.graalvm.sdk:graal-sdk	`25.1.3` → `25.3.4.1`
org.slf4j:slf4j-simple (source, changelog)	`2.0.18` → `2.0.19`
com.google.jimfs:jimfs	`1.3.1` → `1.3.2`
com.tngtech.archunit:archunit-junit5-api	`1.4.2` → `1.5.0`
com.tngtech.archunit:archunit-junit5	`1.4.2` → `1.5.0`
com.tngtech.archunit:archunit	`1.4.2` → `1.5.0`
wtf.metio.devcontainer:devcontainer.java	`2026.7.20081211` → `2026.9.4090148`
org.junit:junit-bom (source)	`6.1.2` → `6.1.3`
tools.jackson:jackson-bom	`3.2.1` → `3.2.2`
net.bytebuddy:byte-buddy-agent (source)	`1.18.11-jdk5` → `1.18.13-jdk5`
net.bytebuddy:byte-buddy (source)	`1.18.11-jdk5` → `1.18.13-jdk5`
wtf.metio.maven:maven-parent	`2026.7.17` → `2026.9.1061515`

Release Notes

s4u/sign-maven-plugin (org.simplify4u.plugins:sign-maven-plugin)

`v1.2.0`

Compare Source

NOTICE

This plugin is retired.

No further releases are planned - see #195 for the reasoning.

What's Changed

🔥 New features

Deprecate sign goal - plugin is retired (#264) @slawekjaranowski

🔨 Maintenance

Add migration guide to maven-gpg-plugin (#263) @slawekjaranowski
Add retired notice to README and site (#265) @slawekjaranowski
Remove CI and issue references from docs (#266) @slawekjaranowski

🧰 Dependency updates

Bump org.codehaus.plexus:plexus-xml from 3.0.0 to 3.0.1 (#185) @dependabot[bot]
Bump org.simplify4u:slf4j-mock from 2.3.0 to 2.4.0 (#209) @dependabot[bot]
Bump org.simplify4u.plugins:pgpverify-maven-plugin from 1.17.0 to 1.19.1 (#189, #190, #225, #227) @dependabot[bot]
Bump org.junit:junit-bom from 5.10.2 to 5.13.4 (#191, #196, #200, #202, #205, #214, #223, #228, #230, #231, #233, #234, #236, #239) @dependabot[bot]
Bump org.projectlombok:lombok from 1.18.30 to 1.18.44 (#179, #192, #211, #229, #242, #245, #260) @dependabot[bot]
Bump org.codehaus.plexus:plexus-utils from 4.0.0 to 4.0.3 (#183, #199, #261) @dependabot[bot]
Bump org.simplify4u:parent from 2.20.1 to 3.0.1 (#181, #187, #208, #253) @dependabot[bot]
Bump io.vavr:vavr from 0.10.4 to 1.0.1 (#203, #222, #240, #252, #259) @dependabot[bot]
Bump org.bouncycastle:bcpg-jdk18on from 1.77 to 1.85 (#184, #207, #232, #251) @dependabot[bot]
Bump org.assertj:assertj-core from 3.25.3 to 3.27.7 (#188, #193, #216, #217, #218, #220, #244, #246, #255) @dependabot[bot]

❤️ Thanks

Many thanks for collaboration on this release for: @slawekjaranowski

graalvm/native-build-tools (org.graalvm.buildtools:native-maven-plugin)

`v1.1.12`

Compare Source

What's Changed

Release 1.1.11 by @graalvmbot in #1037
Improve native-image executable discovery with explicit/convention launcher distinction by @vpelikh in #845
Bump version to 1.1.12-SNAPSHOT by @graalvmbot in #1040
Update reachability metadata to 1.0.13 by @graalvmbot in #1041

Full Changelog: graalvm/native-build-tools@1.1.11...1.1.12

`v1.1.11`

Compare Source

What's Changed

Release 1.1.9 by @graalvmbot in #1022
Bump version to 1.1.10-SNAPSHOT by @graalvmbot in #1023
Update reachability metadata to 1.0.11 by @graalvmbot in #1028
Make NativeImageLayerRuntimeTest platform-independent by @vpelikh in #1024
Release 1.1.10 by @graalvmbot in #1030
Move grund.toml to the project roots by @vjovanov in #1026
Bump version to 1.1.11-SNAPSHOT by @graalvmbot in #1035
Update reachability metadata to 1.0.12 by @graalvmbot in #1036
Layers DSL follow-up: configuration-cache and test cleanup by @jormundur00 in #1034
Fix Maven metadata copy across reactor modules by @jormundur00 in #1020
Make embedded Maven output concise and reproducible by @jormundur00 in #1019
Fix additive reachability metadata requires selection by @jormundur00 in #1018

New Contributors

@vpelikh made their first contribution in #1024

Full Changelog: graalvm/native-build-tools@1.1.9...1.1.11

`v1.1.10`

Compare Source

What's Changed

Release 1.1.9 by @graalvmbot in #1022
Bump version to 1.1.10-SNAPSHOT by @graalvmbot in #1023

Full Changelog: graalvm/native-build-tools@1.1.9...1.1.10

`v1.1.9`

Compare Source

What's Changed

Make repository test output concise by default by @jormundur00 in #1004
Decouple Maven plugin unit tests from remote bootstrap tasks by @jormundur00 in #1007
Clarify build prerequisites and add a core build mode by @jormundur00 in #1012
Release 1.1.8 by @graalvmbot in #1015
Bump version to 1.1.9-SNAPSHOT by @graalvmbot in #1016
Uplift the Native Image layer configuration model by @jormundur00 in #1011
Update reachability metadata to 1.0.10 by @graalvmbot in #1021

Full Changelog: graalvm/native-build-tools@1.1.8...1.1.9

`v1.1.8`

Compare Source

What's Changed

Release 1.1.7 by @graalvmbot in #1009
Bump version to 1.1.8-SNAPSHOT by @graalvmbot in #1010
Deprecate fallback plugin options by @jormundur00 in #997
Update reachability metadata to 1.0.9 by @graalvmbot in #1014

Full Changelog: graalvm/native-build-tools@1.1.7...1.1.8

`v1.1.7`

Compare Source

What's Changed

Release 1.1.6 by @graalvmbot in #996
Suppress missing Javadoc diagnostics across convention tasks by @jormundur00 in #994
Replace deprecated Kotlin DSL delegated accessors by @jormundur00 in #998
Fix Maven plugin unit-test mock maker and SLF4J setup by @jormundur00 in #999
Bump version to 1.1.7-SNAPSHOT by @graalvmbot in #1001
Bump io.netty:netty-codec-http from 4.1.135.Final to 4.1.136.Final in /samples/metadata-repo-integration by @dependabot[bot] in #1002
Avoid Maven internal API for console colors by @jormundur00 in #1003
Update reachability metadata to 1.0.8 by @graalvmbot in #1008

Full Changelog: graalvm/native-build-tools@1.1.6...1.1.7

`v1.1.6`

Compare Source

What's Changed

Prefer GraalVM's Java when running with agent by @vjovanov in #833
Make Maven agent execution ID configurable by @jormundur00 in #933
Fix optional JUnit dependency resolution in Maven native tests by @jormundur00 in #935
Log selected Maven metadata repository by @jormundur00 in #936
Fix Maven test agent paths with spaces by @jormundur00 in #934
Log Gradle agent output directory by @jormundur00 in #937
Clarify JUnit launcher alignment for Maven native tests by @jormundur00 in #938
Fix custom Gradle binary classpath wiring by @jormundur00 in #939
Document Maven native test output directories by @jormundur00 in #941
Fix Gradle agent toolchain detection by @jormundur00 in #943
Fix Gradle metadata repository service scoping by @jormundur00 in #942
Release 1.1.5 by @graalvmbot in #972
Fix Groovy agent predicate closures by @jormundur00 in #959
Make Maven skip apply to all goals by @jormundur00 in #960
Document Maven resource configuration by @jormundur00 in #965
Fix layered image configuration cache test by @jormundur00 in #958
Respect build-tool console colors for Native Image output by @jormundur00 in #961
Normalize platform-dependent resource and test paths by @jormundur00 in #981
Bump version to 1.1.6-SNAPSHOT by @graalvmbot in #990
Add class introduced in 6.1 by @marcphilipp in #867
Bump org.apache.commons:commons-lang3 from 3.12.0 to 3.18.0 in /samples/java-application-with-tests by @dependabot[bot] in #823
Fix order of access filter files by moving default to the start by @ArloL in #875
Allow the test classes directory to be configured for the NativeTestMojo by @thegridman in #757
Bump org.apache.commons:commons-lang3 from 3.12.0 to 3.18.0 in /samples/java-application-with-tests-in-src-main by @dependabot[bot] in #993
Preserve test runner argLine when configuring agent by @jormundur00 in #992
Update reachability metadata to 1.0.7 by @graalvmbot in #995

New Contributors

@ArloL made their first contribution in #875
@thegridman made their first contribution in #757

Full Changelog: graalvm/native-build-tools@1.1.5...1.1.6

hcoles/pitest (org.pitest:pitest-maven)

`v1.30.0`

Compare Source

#1492 Bump jackson version
#1493 Sheck directories populated when checking for empty projects
#1494 Accept comma separated feature parameters (thanks @lino)
#1496 Check non jvm lang dirs

Note, version bump from 1.25.x series made due to mislabelling of release as 1.29.10.

`v1.29.10`

Compare Source

`v1.25.9`

Compare Source

#1486 normalise record attribute order on first load
#1488 rework record interceptor to filter based on a marker line number
#1490 filter mutants in enum switch default block

google/jimfs (com.google.jimfs:jimfs)

`v1.3.2`

Compare Source

Fixed Files.move so that ATOMIC_MOVE always enables overwriting of an existing destination file. (3f6e092)
Ensured that SecureDirectoryStream.move works like Files.move with the ATOMIC_MOVE option, as specified, and required that all Path arguments to SecureDirectoryStream methods be from the same FileSystem as the stream itself. (398b0f9)
Fixed access from SystemJimfsFileSystemProvider to JimfsFileSystem when they are loaded by different class loaders. (5b756f1)
Fixed JimfsInputStream.read to always return 0 when len is 0. (0e5725b)

TNG/ArchUnit (com.tngtech.archunit:archunit-junit5-api)

`v1.5.0`: ArchUnit 1.5.0

Compare Source

Enhancements

Core

Support Java 27 / class file major version 71 (#1618)
Improve descriptions of JavaAccess.Predicates.originOwner and JavaAccess.Predicates.targetOwner (#1603; thanks to @StefanGraeber 👋)
Expose information on sealed classes via JavaClass: isSealed() and getPermittedSubclasses() (#1677)
Consider dependencies from caught exceptions (#1555; thanks to @bannmann 👋)
ImportOption.DoNotIncludeTests and OnlyIncludeTests consider tests in custom Gradle source sets (#1660; thanks to @Develop-KIM 👋)

Lang

ArchConditions offers new ArchCondition<JavaClass> haveAnyDependenciesThat(DescribedPredicate<Dependency>) (#1580; thanks to @wakingrufus 👋)

Library

ArchitectureMetrics.lakosMetrics is computed much more performantly (#1629; thanks to @ThanosTsiamis 👋)
TextFileBasedViolationStore is now thread-safe under parallel test execution (#1656; thanks to @kelunik 👋)
ModuleDependency now provides stable descriptions (#1648; thanks to @DragonFSKY 👋)

JUnit

archunit-junit6 supports ArchUnit with JUnit 6 (~~#1556~~, ~~#1658~~, #1659; many thanks to @arukiidou & @schulzjo-tng 👋)
AnalyzeClasses supports individual classes (#1569; thanks to @TheManWhoStaresAtCode 👋)
Preparation: archunit-junit:0.9.0 (which was renamed with ArchUnit 0.9.0) now relocates to archunit-junit4:0.9.0 (#1673; thanks to @schulzjo-tng 👋) – will be published after #1684 🙈

Documentation

Document Priority (#1671; thanks to @TheManWhoStaresAtCode 👋)
Document Package Identifiers in User Guide (#1672; thanks to @TheManWhoStaresAtCode 👋)

Internal Improvements

Text files now use UNIX line breaks (#1602, #1611; thanks to @StefanGraeber 👋)
Update Gradle from 8 to 9; build & test with JDK 25 (#1550, and also #1612, #1619)
Separate integration tests by JUnit version (#1636; many thanks to @schulzjo-tng 👋)
Replace junit-dataprovider with junit-jupiter-params (#1655)
ArchUnit releases now update Maven examples (and Gradle wrapper) of ArchUnit-Examples (#1450)
Avoid managing hamcrest dependency (#1467; thanks to @TheManWhoStaresAtCode 👋)

metio/devcontainer.java (wtf.metio.devcontainer:devcontainer.java)

`v2026.9.4090148`

Compare Source

2026.9.4090148

Dependencies

update softprops/action-gh-release digest to efb3536 (#90)
update docker.io/library/maven:3-eclipse-temurin-21 docker digest to 8f6ac12 (#89)
update actions/setup-java action to v6 (#88)
update docker.io/library/maven:3-eclipse-temurin-21 docker digest to 6131248 (#87)
update reviewdog/action-actionlint digest to dbe5299 (#85)
update metio/ci action to v2026.8.22144013 (#86)
update docker.io/library/maven:3-eclipse-temurin-21 docker digest to c07f7cc (#84)
update github actions (#83)
update metio/ci action to v2026.8.4134806 (#82)
update actions/setup-java digest to b6effb0 (#81)
update metio/ci action to v2026.8.2070928 (#80)
update metio/ci action to v2026.8.1094619 (#79)
update metio/ci action to v2026.7.30140746 (#78)
update metio/ci action to v2026.7.29150653 (#77)
update metio/ci action to v2026.7.28213002 (#76)
update metio/ci action to v2026.7.28183925 (#75)
update metio/ci action to v2026.7.26085035 (#73)
update metio/ci action to v2026.7.24201014 (#72)
update metio/ci action to v2026.7.23184830 (#71)
update reviewdog/action-actionlint digest to 5084226 (#70)
update reviewdog/action-actionlint digest to 01d2dd6 (#69)
update metio/ci action to v2026.7.20205609 (#68)
update actions/checkout digest to 3d3c42e (#67)

Fixed

update java dependencies (#74)

Usage

Pull the library from Maven Central.

junit-team/junit-framework (org.junit:junit-bom)

`v6.1.3`

raphw/byte-buddy (net.bytebuddy:byte-buddy-agent)

`v1.18.13`

Actually include the SBOM within the published artifacts.
Avoid propagation of path traversals that are contained in jar files which are copied without transformation.
Avoid repeated traversal of previously visited type hierarchies to improve performance.
Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.
Create Gradle tasks using Gradle's task registration API if available.

`v1.18.12`

Automatically support Kotlin in Gradle plugin.
Correct JNA injector which accidentally created on based on Unsafe.
Support dynamic attach on Windows ARM64 by shipping a native attach_hotspot_windows library for win32-aarch64.

metio/maven-parent (wtf.metio.maven:maven-parent)

`v2026.9.1061515`

Compare Source

2026.9.1061515

Dependencies

update java dependencies (#256) (#256)
update dependency com.github.spotbugs:spotbugs-maven-plugin to v4.10.4.0 (#255) (#255)
update metio/ci action to v2026.8.22144013 (#254) (#254)
update dependency org.graalvm.buildtools:native-maven-plugin to v1.1.10 (#253) (#253)
update dependency org.graalvm.buildtools:native-maven-plugin to v1.1.9 (#252) (#252)
update java dependencies (#251) (#251)
update dependency org.owasp:dependency-check-maven to v13 (#250) (#250)
update metio/ci action to v2026.8.4134806 (#249) (#249)
update dependency org.graalvm.buildtools:native-maven-plugin to v1.1.7 (#248) (#248)
update dependency org.cyclonedx:cyclonedx-maven-plugin to v2.9.3 (#247) (#247)
update metio/ci action to v2026.8.2070928 (#246) (#246)
update metio/ci action to v2026.8.1094619 (#245) (#245)

`v2026.8.1043609`

Compare Source

2026.8.1043609

Added

release monthly, within the shared Central budget
adopt the metio standard CI stack

Changed

inherit the org-wide community health files
pin metio/ci to the released 2026.7.26080346 (#235)

Dependencies

update metio/ci action to v2026.7.30140746 (#244) (#244)
update metio/ci action to v2026.7.29150653 (#243) (#243)
update metio/ci action to v2026.7.28213002 (#242) (#242)
update dependency org.codehaus.mojo:flatten-maven-plugin to v1.8.0 (#241) (#241)
update metio/ci action to v2026.7.26085035 (#240) (#240)
update actions/checkout digest to 3d3c42e (#236)
update dependency org.apache.maven.plugins:maven-jar-plugin to v3.5.1 (#237)

`v2026.7.24`

Compare Source

What's Changed

Bump org.graalvm.buildtools:native-maven-plugin from 1.1.4 to 1.1.5 by @dependabot[bot] in #231
Bump org.pitest:pitest-maven from 1.25.7 to 1.25.8 by @dependabot[bot] in #232
Bump org.graalvm.buildtools:native-maven-plugin from 1.1.5 to 1.1.6 by @dependabot[bot] in #233

Full Changelog: metio/maven-parent@2026.7.17...2026.7.24

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot added the dependencies Pull requests that update a dependency file label Jul 24, 2026

renovate Bot enabled auto-merge (rebase) July 24, 2026 17:39

renovate Bot added the dependencies Pull requests that update a dependency file label Jul 24, 2026

renovate Bot assigned sebhoss Jul 25, 2026

renovate Bot force-pushed the renovate/java-dependencies branch from f3f5721 to 633a1ce Compare July 27, 2026 05:46

renovate Bot changed the title ~~chore(deps): update dependency org.graalvm.buildtools:native-maven-plugin to v1.1.6~~ fix(deps): update java dependencies Jul 27, 2026

renovate Bot force-pushed the renovate/java-dependencies branch 4 times, most recently from 7ebe338 to 9166e5b Compare August 4, 2026 05:46

renovate Bot force-pushed the renovate/java-dependencies branch 3 times, most recently from 7a75a23 to 4cd7121 Compare August 10, 2026 15:50

renovate Bot force-pushed the renovate/java-dependencies branch 2 times, most recently from eccd66e to b23aba9 Compare August 23, 2026 03:57

renovate Bot force-pushed the renovate/java-dependencies branch 6 times, most recently from 5b7f684 to 5dc195d Compare September 3, 2026 00:54

renovate Bot force-pushed the renovate/java-dependencies branch 6 times, most recently from 10d4c6d to f363694 Compare September 7, 2026 23:37

fix(deps): update java dependencies

62795ce

renovate Bot force-pushed the renovate/java-dependencies branch from f363694 to 62795ce Compare September 16, 2026 18:34

Navigation Menu

Uh oh!

Uh oh!

fix(deps): update java dependencies - #353

fix(deps): update java dependencies#353
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/java-dependencies

renovate Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

renovate Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

NOTICE

What's Changed

🔥 New features

🔨 Maintenance

🧰 Dependency updates

❤️ Thanks

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

v1.5.0: ArchUnit 1.5.0

Enhancements

Core

Lang

Library

JUnit

Documentation

Internal Improvements

2026.9.4090148

Dependencies

Fixed

Usage

2026.9.1061515

Dependencies

2026.8.1043609

Added

Changed

Dependencies

What's Changed

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Jul 24, 2026 •

edited

Loading

`v1.5.0`: ArchUnit 1.5.0