From 577cf4f9fa1fc52d7c12af040457b795a347a773 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 25 Aug 2026 07:57:03 +0000 Subject: [PATCH 1/2] Update actions/setup-java to v6 GitHub Actions: - actions/setup-java v5 -> v6 (11 call sites) setup-java v6 is an ESM rewrite that drops only the legacy "adopt" distributions and renames jdkFile -> jdk-file (deprecated alias kept). Every job here uses temurin (zulu in sonarqube.yml), both still supported, so the major bump is a no-op for this pipeline. No Maven change needed: every dependency and build plugin in the reactor is already on the newest stable release. The only updates on offer are pre-releases (Maven 4 betas, slf4j-api 2.1.0-alpha1) or jqwik past the banned 1.9.3, none of which are adopted. codeql-action and osv-scanner-action are likewise already current. Verified: mvn validate passes across the reactor. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_015736Ef93fk9VcaxpBs8C9J --- .github/workflows/codeql.yml | 2 +- .github/workflows/publish.yml | 18 +++++++++--------- .github/workflows/sonarqube.yml | 2 +- 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 2e3baac..3c7ebca 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -19,7 +19,7 @@ jobs: security-events: write steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: { java-version: '21', distribution: temurin } - uses: github/codeql-action/init@v4 with: { languages: java, queries: +security-and-quality } diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a0d98f8..156bbd3 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -170,7 +170,7 @@ jobs: environment: maven-central steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: java-version: '21' distribution: temurin @@ -211,7 +211,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: java-version: '21' distribution: temurin @@ -247,7 +247,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: java-version: '21' distribution: temurin @@ -273,7 +273,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: java-version: '21' distribution: temurin @@ -343,7 +343,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: { java-version: '21', distribution: temurin, cache: maven } - name: Test under vmlens (one class — staged scope) # VmlensInterleavingSmokeTest and the `vmlens` profile both live in @@ -392,7 +392,7 @@ jobs: with: name: plugin-jars path: fatjar/ - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: java-version: '21' distribution: temurin @@ -418,7 +418,7 @@ jobs: contents: write steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: { java-version: '21', distribution: temurin } # Only srcmorph's jacoco report is uploaded by the `test` job (see the comment there) — # it carries the bulk of the test suite and the only PIT gate. Coveralls/Codecov are @@ -470,7 +470,7 @@ jobs: environment: maven-central steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: java-version: '21' distribution: temurin @@ -601,7 +601,7 @@ jobs: contents: write steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5 + - uses: actions/setup-java@v6 with: java-version: '21' distribution: temurin diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml index b5c982f..0450e49 100644 --- a/.github/workflows/sonarqube.yml +++ b/.github/workflows/sonarqube.yml @@ -18,7 +18,7 @@ jobs: with: fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis - name: Set up JDK 21 - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: java-version: 21 distribution: 'zulu' From d208f84ed1e9d77f3f6a8f1130ec4610cfcbff85 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 25 Aug 2026 08:02:33 +0000 Subject: [PATCH 2/2] Record the setup-java bump and correct the logback version in the docs CHANGELOG: note the actions/setup-java v5 -> v6 bump. CLAUDE.md: the dependencies table listed logback-classic 1.6.1, but the reactor parent's dependencyManagement has pinned 1.6.3 for a while. The table is meant to mirror the poms, so this was stale documentation rather than a version change. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_015736Ef93fk9VcaxpBs8C9J --- CHANGELOG.md | 3 +++ CLAUDE.md | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 224b6c1..eb493ec 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,9 @@ The release procedure (prompt template and step-by-step instructions) lives in [ ## [Unreleased] +### Changed +- CI actions bumped to latest: `actions/setup-java` v5 → v6. + ### Fixed - Bumped `jackson.version` 2.22.0 → 2.22.1 (`jackson-databind` / `jackson-dataformat-yaml`, pinned in the parent `pom.xml`) to close diff --git a/CLAUDE.md b/CLAUDE.md index 19f4d2d..c7ff07b 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -364,7 +364,7 @@ assume it has already been updated. |---|---|---| | `net.ladenthin:llama` | 5.0.6 | `srcmorph` (`provider` package only) — llama.cpp JNI binding | | `org.slf4j:slf4j-api` | 2.0.18 (converged in the parent) | `srcmorph`, `srcmorph-cli`, the plugin | -| `ch.qos.logback:logback-classic` | 1.6.1 (converged in the parent) | `srcmorph-cli` (runtime binding) | +| `ch.qos.logback:logback-classic` | 1.6.3 (converged in the parent) | `srcmorph-cli` (runtime binding) | | `com.fasterxml.jackson.core:jackson-databind` | pinned in parent | `srcmorph-cli` (JSON config) | | `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` | pinned in parent | `srcmorph-cli` (YAML config) | | `org.apache.maven:maven-plugin-api` | 3.9.16 | `srcmorph-maven-plugin` (provided) |