Bump the patch-updates group with 9 updates

[dependabot]

Bumps the patch-updates group with 9 updates:

Package	From	To
com.fasterxml.jackson:jackson-bom	2.22.2	2.22.3
com.fasterxml.jackson.core:jackson-core	2.22.2	2.22.3
com.fasterxml.jackson.core:jackson-databind	2.22.2	2.22.3
com.fasterxml.jackson.dataformat:jackson-dataformat-yaml	2.22.2	2.22.3
org.slf4j:slf4j-api	2.0.19	2.0.20
org.slf4j:slf4j-simple	2.0.19	2.0.20
io.github.classgraph:classgraph	4.8.195	4.8.196
com.diffplug.spotless:spotless-maven-plugin	3.10.2	3.10.3
com.h2database:h2-mvstore	2.5.250	2.5.252

Updates com.fasterxml.jackson:jackson-bom from 2.22.2 to 2.22.3

Commits

• 9b1c380 [maven-release-plugin] prepare release jackson-bom-2.22.3
• f76ca14 Prep for 2.22.3 release
• d6ac108 Merge branch '2.21' into 2.22
• 093a05e Post-release dep version bump
• e7a71a2 [maven-release-plugin] prepare for next development iteration
• 62d4d51 [maven-release-plugin] prepare release jackson-bom-2.21.7
• 6171b54 Prep for 2.21.7 release
• 6702bf3 Merge branch '2.20' into 2.21
• 2feb1f9 Merge branch '2.19' into 2.20
• 1129aa0 Merge branch '2.18' into 2.19
• Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-core from 2.22.2 to 2.22.3

Commits

• eee4b9e [maven-release-plugin] prepare release jackson-core-2.22.3
• 31ee7eb Prep for 2.22.3 release
• 9fef13f Merge branch '2.21' into 2.22
• 9160f40 Post-release dep version bump
• 1169cb6 [maven-release-plugin] prepare for next development iteration
• b33f455 [maven-release-plugin] prepare release jackson-core-2.21.7
• ce8b7dc Prep for 2.21.7 release
• b69555e Merge branch '2.21' into 2.22
• 53df608 Merge branch '2.20' into 2.21
• 892f757 Merge branch '2.19' into 2.20
• Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.3

Commits

• 4385c5f [maven-release-plugin] prepare release jackson-databind-2.22.3
• ccb4fd0 Prep for 2.22.3 release
• 2958412 Merge branch '2.21' into 2.22
• 1215b94 Post-release dep version bump
• 1f0df62 [maven-release-plugin] prepare for next development iteration
• 13a9ff4 [maven-release-plugin] prepare release jackson-databind-2.21.7
• d168f96 Prep for 2.21.7 release
• eaf5c76 Merge branch '2.21' into 2.22
• e05ef4c Merge branch '2.20' into 2.21
• f6d4000 Merge branch '2.19' into 2.20
• Additional commits viewable in compare view

Updates com.fasterxml.jackson.dataformat:jackson-dataformat-yaml from 2.22.2 to 2.22.3

Commits

• e793b5f [maven-release-plugin] prepare release jackson-dataformats-text-2.22.3
• e8e9ece Prep for 2.22.3 release
• 2ea3d0c Merge branch '2.21' into 2.22
• 8e88b85 Post-release dep version bump
• 806abc9 [maven-release-plugin] prepare for next development iteration
• a11273c [maven-release-plugin] prepare release jackson-dataformats-text-2.21.7
• 5d16624 Prep for 2.21.7 release
• f047dd5 Merge branch '2.21' into 2.22
• 0f80164 Merge branch '2.20' into 2.21
• 4dcc3da Merge branch '2.19' into 2.20
• Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-core from 2.22.2 to 2.22.3

Commits

• eee4b9e [maven-release-plugin] prepare release jackson-core-2.22.3
• 31ee7eb Prep for 2.22.3 release
• 9fef13f Merge branch '2.21' into 2.22
• 9160f40 Post-release dep version bump
• 1169cb6 [maven-release-plugin] prepare for next development iteration
• b33f455 [maven-release-plugin] prepare release jackson-core-2.21.7
• ce8b7dc Prep for 2.21.7 release
• b69555e Merge branch '2.21' into 2.22
• 53df608 Merge branch '2.20' into 2.21
• 892f757 Merge branch '2.19' into 2.20
• Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.3

Commits

• 4385c5f [maven-release-plugin] prepare release jackson-databind-2.22.3
• ccb4fd0 Prep for 2.22.3 release
• 2958412 Merge branch '2.21' into 2.22
• 1215b94 Post-release dep version bump
• 1f0df62 [maven-release-plugin] prepare for next development iteration
• 13a9ff4 [maven-release-plugin] prepare release jackson-databind-2.21.7
• d168f96 Prep for 2.21.7 release
• eaf5c76 Merge branch '2.21' into 2.22
• e05ef4c Merge branch '2.20' into 2.21
• f6d4000 Merge branch '2.19' into 2.20
• Additional commits viewable in compare view

Updates com.fasterxml.jackson.dataformat:jackson-dataformat-yaml from 2.22.2 to 2.22.3

Commits

• e793b5f [maven-release-plugin] prepare release jackson-dataformats-text-2.22.3
• e8e9ece Prep for 2.22.3 release
• 2ea3d0c Merge branch '2.21' into 2.22
• 8e88b85 Post-release dep version bump
• 806abc9 [maven-release-plugin] prepare for next development iteration
• a11273c [maven-release-plugin] prepare release jackson-dataformats-text-2.21.7
• 5d16624 Prep for 2.21.7 release
• f047dd5 Merge branch '2.21' into 2.22
• 0f80164 Merge branch '2.20' into 2.21
• 4dcc3da Merge branch '2.19' into 2.20
• Additional commits viewable in compare view

Updates org.slf4j:slf4j-api from 2.0.19 to 2.0.20

Updates org.slf4j:slf4j-simple from 2.0.19 to 2.0.20

Updates org.slf4j:slf4j-simple from 2.0.19 to 2.0.20

Updates io.github.classgraph:classgraph from 4.8.195 to 4.8.196

Release notes

Sourced from io.github.classgraph:classgraph's releases.

ClassGraph 4.8.196

ClassGraph 5.0.0 is coming shortly, and requires JDK 17 or newer. 4.8.196 is a bugfix release on the 4.x maintenance branch, and continues the file-by-file audit that produced 4.8.190 through 4.8.195. As before, most of the bugs listed here were found by Claude through careful code analysis, and were fixed on the v5 branch and backported to v4.

Mocking the list classes with mockk works again (#945)

Since 4.8.185, mockk failed to mock ResourceList, ClassInfoList and the other list classes, with "class redefinition failed: attempted to add a method". These classes extend a package-private class, and releases since 4.8.185 were built with JDK 8, whose javac does not emit public bridge methods in the public subclass for add(T), add(int, T), remove(int) and set(int, T). The list classes now declare these methods themselves, so they are present whichever JDK builds the release.

Bug fixes: classpath elements and jarfiles

• The context classloader could be moved behind the application classloader. The classloaders found in the environment were sorted by descending delegation depth, so that a classloader is searched before its ancestors. That also put any classloader with more ancestors ahead of an unrelated one with fewer -- the application classloader ahead of a context classloader with no parent, for example -- although the context classloader is meant to be tried first. Each classloader is now inserted just ahead of the first of its ancestors that is already listed, which keeps descendants ahead of ancestors and otherwise keeps the preference order.

• Class-Path and Bundle-ClassPath manifest attributes are now read with their specified syntax. A Class-Path entry is a relative URL, so its percent encoding is now decoded, as the JVM's own classloader decodes it. Before, a jarfile written as my%20lib.jar was looked for under that literal name, so a jarfile with a space in its name could not be named at all. Bundle-ClassPath paths are now trimmed, unquoted and separated from their parameters, following the OSGi header syntax. Before, . , inner.jar named inner.jar, and a quoted path or one with a parameter named nothing that exists.

• When a zipfile has two entries with the same name, the last one is now used, as the JDK does. ClassGraph kept the first, so a scan could report a different resource, and open a different nested jarfile, than the JVM would load.

• META-INF/versions/09/ is no longer read as multi-release version 9. The JDK looks up versioned entries only under the plain decimal version number, so ClassGraph could report a class that the JVM never loads.

• The file of a nested jarfile is now always the outermost jarfile. It was the outer jarfile if the nested jarfile was stored, but null or a temporary file if it was deflated. ScanResult#getClasspathFiles() lists the outer jarfile once, however many jarfiles are nested within it.

• A zipfile with an Info-ZIP Unicode path extra field of a version other than 1 could not be read. java.util.zip.ZipFile opens such a file, since the JDK does not read that field. The field is now logged and ignored.

• A large nested jar with a long name could not be opened. A nested jar too large to hold in RAM is written to a temporary file named after its zip entry, and a long entry name made File.createTempFile fail with "File name too long". The name is now cut to its last 64 characters.

• A jarfile URL that redirected from http to https failed with "Got response code 301", since HttpURLConnection only follows a redirect that keeps the same scheme. Redirects are now followed, up to 20 times. A redirect from https to http, or to a scheme that has not been enabled, is refused.

• A SecurityManager that refused to let ClassGraph read a file's attributes stopped the scan of the rest of that directory. Only that file is now skipped.

• The Quarkus classloader handler failed the whole scan when a field it reads held a null or unexpected value. Such elements are now skipped.

• normalizePath did not collapse // in a path that did not end with a separator, so a//b stayed a//b while a//b/ became a/b.

Bug fixes: memory, file handles and temporary files

• A file is no longer memory-mapped when it could not be unmapped again. A SecurityManager that denied access to the buffer cleaner made new ClassGraph() throw "Cannot get buffer cleaner method". Now, below JDK 22, a file is only memory-mapped when the cleaner is available, since otherwise the mapping, and on Windows the file lock, would last until the buffer was garbage collected.

• A canceled scanAsync future leaked its ScanResult. A result that arrived after the future was canceled was never handed to anyone, so nothing closed it. It is now closed. The call stack and context classloader are still read on the calling thread, but the jarfiles are now opened when the task runs, so a task that is canceled before it starts opens nothing.

• Temporary files no longer use deleteOnExit(). Closing the scan already deletes every temporary file, so deleteOnExit() only made the JDK hold every temporary path until the JVM exited.

• A module reader could be left open if it was returned to its pool at the same moment the pool was being force-closed.

• Reading a stream of declared length allocated a buffer of that whole length up front, up to the maximum buffered jar size. The first buffer is now at most 16MB, and grows as data arrives. A related method doubled its buffer whenever a read returned zero bytes, even when the buffer was not full; no scan was affected, since the streams it is given never return zero.

• A refused unmap of a buffer view was logged as "Could not unmap ByteBuffer: java.lang.reflect.InvocationTargetException". Such a view is now refused without a log entry, and any other failure is logged with its real cause.

Bug fixes: the class graph

• ClassInfo#isAnonymousInnerClass() returned true for named local classes. It now agrees with Class#isAnonymousClass(). getFullyQualifiedDefiningMethodName() returned <clinit> for a class declared in an instance initializer or an instance field initializer, which javac compiles into the constructors; it now returns null for these, as Class#getEnclosingMethod() does.

• A local record, enum or interface was reported as not static.

... (truncated)

Commits

• 8f16afe [maven-release-plugin] prepare release classgraph-4.8.196
• f0f3d2d Declare the element methods in the public list classes, so mockk can mock the...
• a4d872d [maven-release-plugin] prepare for next development iteration
• 495b196 [maven-release-plugin] prepare release classgraph-4.8.196
• 4d08ea2 Keep a '$' after a '.' in a class reference as part of the nested class name
• 67c7d33 Follow an http to https redirect when downloading a jarfile
• b8d2225 Check in the LocalRecordTest classfile fixtures, which .gitignore excluded
• 1eb2fb2 Make AnnotationParameterValue.equals and hashCode agree with compareTo for un...
• 707fea6 Resolve type variables of an enclosing class, and tell a method's type variab...
• 534d034 Report local records as static, and fix type annotations on local class const...
• Additional commits viewable in compare view

Updates com.diffplug.spotless:spotless-maven-plugin from 3.10.2 to 3.10.3

Release notes

Sourced from com.diffplug.spotless:spotless-maven-plugin's releases.

Maven Plugin v3.10.3

Changes

• Generate formatter defaults from version catalog. (#3045)
• Bump default gson version 2.13.2 -> 2.14.0. (#3045)
• Bump default zjsonpatch version 0.4.14 -> 0.4.16. (#3045)
• Bump default jackson-dataformat-yaml version 2.14.1 -> 2.20.1. (#3045)
• Bump default ktfmt version 0.63 -> 0.64. (2988)
• Bump default cleanthat version 2.25 -> 2.26. (#2882)
• Bump default jackson version 2.20.1 -> 2.22.2. (#2819)
• Bump default javaparser version 3.27.1 -> 3.28.2. (#3065)
• Bump default palantir-java-format version 2.80.0 -> 2.98.0. (#3068)
• Bump default scalafmt version 3.8.1 -> 3.11.5. (#2173)
• Bump default google-java-format version 1.30.0 -> 1.36.1. (#3075)
• Bump default gherkin-utils version 10.0.0 -> 12.0.2. (#2979)

Fixed

• Fix release signing by using Gradle's required eight-digit signing subkey ID. (#3105)
• Fix race when creating the npm install cache directory. ((#3096)
• GrEclipse no longer emits expected OSGi and nested-jar warnings during initialization. (#2445)
• typescript prettier() no longer emits a warning when its parser is already set to typescript. (#3098)
• <versionCatalog> preserves standalone comments at section boundaries and the end of the file. (#3048)
• <versionCatalog> preserves entries when comments contain unmatched brackets, preserves commas inside quoted strings, and keeps significant line boundaries in multiline entries. (#3042)
• <versionCatalog> now reports unfinished entries as lints at their starting line. These fail formatting by default, so upgrading may expose catalog errors that previously caused silent data loss. (#3042)
• Eclipse JDT formatter step no longer fails with NoClassDefFoundError or NoSuchMethodError when lombok is active as a JVM agent (e.g. -javaagent:lombok.jar in Eclipse/VS Code/Cursor). (#2795)

Commits

• 61e2016 Published maven/3.10.3
• 49e0b07 Published lib/4.10.3
• b7a7748 Fix release signing key ID format (#3105)
• be8005a Document release signing correction (#3105)
• 073fe61 Use short signing subkey ID for release publishing
• 8ac44c7 Fix race when creating the npm install cache directory (#3096)
• 3f2d955 Update dependency org.slf4j:slf4j-api to v2.0.20 (#3100)
• 0c70ca8 Merge branch 'main' into fix/npm-cache-directory-race
• bbf44a4 Fix GrEclipse initialization warnings (#3097)
• b6bdcd0 Update dependency org.slf4j:slf4j-api to v2.0.20
• Additional commits viewable in compare view

Updates com.h2database:h2-mvstore from 2.5.250 to 2.5.252

Release notes

Sourced from com.h2database:h2-mvstore's releases.

Version 2.5.252

Commits

• f986838 in preparation for a release
• 06c34a7 Merge pull request #4418 from andreitokar/issues-4380-4376
• 1aef3e0 #4376: Reading INFORMATION_SCHEMA.COLUMNS fails with a NPE while any material...
• 4bb8aee #4380: creating a MATERIALIZED VIEW makes a persistent database permanently u...
• 95b6af0 Merge pull request #4417 from andreitokar/issue-4395
• 6ec30b6 #4395 disallow constraints between temporary and permanent tables
• 0f0f856 Merge pull request #4416 from andreitokar/issue-4405
• f718b76 #4405 SecureFileStore.readFully() may skip decryption
• e231ff7 #4405 SecureFileStore.readFully() may skip
• 4da0d1d Merge pull request #4415 from jjh75607/fix/log-sql-aarch64
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Copilot]

Copilot review overview

🟢 Approval recommended

The patch updates are consistent across their managed Maven properties with no unresolved issues found.

Review effort: Balanced
Findings: None

What changed in this PR

Updates shared dependency and build-tool patch versions across the Maven project.

Changes:

• Updates Jackson, SLF4J, ClassGraph, and Spotless versions.
• Updates H2 MVStore to 2.5.252.

File	Description
pom.xml	Updates shared dependency and plugin properties.
impl/​pom.xml	Updates the managed H2 MVStore version.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.