Repository navigation
fix(deps): update all patch and minor versions (main) - #21087
Conversation
Pull request dashboard statusMerged · refreshed 2026-10-30 20:36 UTC Status above doesn't look right?
|
There was a problem hiding this comment.
🟡 Changes recommended
Updating the regression fixture to Spring Boot 1.5 removes the intended 1.3 loader coverage, while the existing check cannot detect the loss.
1 open issue
1 file not reviewed
.github/scripts/copilot-cli/package-lock.json: Generated file
What changed in this PR
This PR updates patch and minor dependencies used by the repository’s development tools, build conventions, and smoke-test packaging.
Changes:
- Updates Flint, rumdl, and GitHub Copilot CLI, including its platform-specific lockfile entries.
- Upgrades Error Prone to 2.51.0 and the JMH Gradle plugin to 0.7.4.
- Updates Spring Boot loader tools in the legacy smoke-test fixture to 1.5.22.RELEASE.
| File | Description |
|---|---|
smoke-tests/images/spring-boot-1.3/build.gradle.kts |
Updates the legacy fixture’s Spring Boot repackager. |
mise.toml |
Updates Flint and rumdl tool versions. |
examples/distro/buildSrc/src/main/kotlin/otel.nullaway-conventions.gradle.kts |
Updates Error Prone in the distribution example. |
dependencyManagement/build.gradle.kts |
Updates the shared Error Prone version. |
conventions/build.gradle.kts |
Updates the JMH Gradle plugin. |
.github/scripts/copilot-cli/package.json |
Updates GitHub Copilot CLI to 1.0.104. |
.github/scripts/copilot-cli/package-lock.json |
Synchronizes CLI packages and integrity hashes. |
.github/renovate.json5 |
Updates the Flint Renovate preset. |
Review effort: Balanced
30158aa to
4e56ca0
Compare
There was a problem hiding this comment.
🔵 Needs a closer look
The Spring Boot 1.3 smoke test now embeds the 1.5 loader, losing regression coverage for 1.3’s distinct class-loading behavior.
1 file not reviewed
.github/scripts/copilot-cli/package-lock.json: Generated file
Review effort: Balanced
Co-authored-by: trask <218610+trask@users.noreply.github.com>
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
There was a problem hiding this comment.
🟡 Changes recommended
The PR description and release notes list Spring Boot loader tools and Error Prone upgrades that the changes do not include.
1 open issue
1 resolved since last review
1 file not reviewed
.github/scripts/copilot-cli/package-lock.json: Generated file
Review effort: Balanced
|
wondering why didn't it update byte buddy to 1.18.16? |
good question, apparently #21089 should fix it |
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
1.0.103→1.0.1041.0.1050.22.14→0.22.15v0.22.14→v0.22.150.3.0→0.3.25.1.1→5.2.00.7.3→0.7.42.50.0→2.51.02.50.0→2.51.02.50.0→2.51.01.3.8.RELEASE→1.5.22.RELEASERelease Notes
github/copilot-cli (@github/copilot)
v1.0.104Compare Source
-p --autopilotstill honors itgrafana/flint (aqua:grafana/flint)
v0.22.15Compare Source
Fixed
Other
rvben/rumdl (rumdl)
v0.3.2Compare Source
Fixed
Upgrade pulldown-cmark to fix exponential parser event growth and duplicate
diagnostics after empty wikilink labels (RUSTSEC-2026-0414), and upgrade Tokio
to address its I/O safety advisory (RUSTSEC-2026-0386). Release publication now
requires a fresh dependency security audit, including during recovery runs.
MD087 recognizes inline suppression of heading-capitalization diagnostics,
avoiding false unused-disable warnings (#973).
MD022 enforces configured spacing below headings before lists and code fences,
including when MD031 or MD032 is disabled. Overlapping spacing fixes insert
the required blank lines only once (#971).
MD067 can safely reorder complete footnote definitions to match their first
references. Reordering is atomic, preserves surrounding content and directive
scope, and leaves ambiguous Markdown or MDX cases report-only (#969).
MD013 recognizes additional common abbreviations and titles, including numeric
references with formatted numbers, while preserving sentence boundaries after
ambiguous units and labels. Sentence-spacing checks share this behavior (#966).
MD013 preserves meaningful indentation inside multiline code spans following
a bare list marker when reflowing text.
security: patch parser dependencies and gate release publication (41d60e1)
ci: install only the tools required by parity checks (ce014aa)
MD013: preserve code-span indentation after bare list markers (9cf648f)
Downloads
Installation
Using uv (Recommended)
Using pip
Using pipx
Direct Download
Download the appropriate binary for your platform from the table above, extract it, and add it to your PATH.
v0.3.1Compare Source
Added
rumdl check-assetsreports assets unreferenced in complete Markdown sourcescans, with explicit include/keep globs and text or versioned JSON output.
Literal filename mentions are kept separately; incomplete scans emit no findings.
lines-above-mode = "exact"removes surplus blank lines above headingswhile preserving comments and the existing minimum-spacing default (#838).
uv.lock, declaredpyproject.tomlconstraints, or pre-commit/prek hook revisions for Ruff,Black, djLint and SQLFluff. Supports automatic source selection and one
configurable policy for mismatched or unresolved versions.
link-text-punctuation = "trailing"optionally recognizes sentenceendings in link text and image alt text while keeping each construct intact.
When enabled, semantic reflow also preserves detected sentence boundaries
when merging short lines.
style = "consistent"infers heading capitalization per document whilerespecting ignored words, proper names, level filters, and inline disables.
permit parallel execution, preserving tool order and applying formatted
replacements together from their original source ranges.
break-wordsadds project-specific or localized words to the semanticreflow defaults, with case-insensitive Unicode matching.
Changed
runs.
with paragraphs, including items containing only one semantic sentence.
and avoid copying line text while checking Python-Markdown list structure.
Fixed
nested JSX, including headings checked in parallel.
(
service A.,plan B.) from name initials (#965).A lone initial after a lowercase word (
edited by A. Smith) can now also split.Custom
abbreviationspreserve ambiguous initials globally, including whenthe same letter is used as a technical label.
definitions and reference labels with empty destinations.
delimiters span blocks and close inside a code span.
incorrect splits after characters whose lowercase forms change byte length.
sentence detection and counts them as single units in paragraph diagnostics.
Overlong asides prefer inner sentence boundaries before further width wrapping;
explicit hard breaks remain separate reflow segments.
Performance
Downloads
Installation
Using uv (Recommended)
Using pip
Using pipx
Direct Download
Download the appropriate binary for your platform from the table above, extract it, and add it to your PATH.
tbroyer/gradle-errorprone-plugin (net.ltgt.gradle:gradle-errorprone-plugin)
v5.2.0Add support for
-XepPrintTimingsand-XepRecordTimings(f243995)google/error-prone (com.google.errorprone:error_prone_test_helpers)
v2.51.0: Error Prone 2.51.0New checks:
HashCodeInObjectsHash: Detect redundanthashCode()orObjects.hash()calls insideObjects.hash(...), and simplify single-argumentObjects.hash(x)calls toObjects.hashCode(x).LoopToTestParameter: Suggest migrating loops in unit tests toTestParameterInjector.MissingJavadoc: Flag public types that are missing Javadoc comments (disabled by default).PreferCharsetOverload: Prefer calling method and constructor overloads that accept aCharsetover those that accept aStringencoding name.PreferPreconditions: Suggest using Guava'sPreconditionsinstead of explicitif-throwstatements for parameter validation (disabled by default).RequireNonNullRefactoring: Refactor explicitif (x == null) { throw new NullPointerException(...); }checks toObjects.requireNonNull(disabled by default).SimplifyTestParameter: Remove redundant explicit value lists on@TestParameterannotations forbooleanandEnumtypes when all values are specified (disabled by default).TraditionalJavadocToMarkdown: Convert traditional/** ... */Javadoc comments into///Markdown Javadoc comments (disabled by default).ValueClassIdentity: Flag reliance on identity semantics (such as synchronization,WeakReference,IdentityHashMap, orSystem.identityHashCode) of value-based classes (disabled by default).Other changes:
CompareToZero: Upgraded from warning to error, and expanded to flag non-relational operations, unary negation, andswitchstatements/expressions oncompareToandcompareresults withoutInteger.signum.IfChainToSwitch: Enabled by default as a warning.UndefinedEquals: MergedArrayAsKeyOfSetOrMapandCollectionUndefinedEqualityintoUndefinedEquals(retaining their names asaltNames), and generalized detection of types without well-definedequalsorhashCodeacross direct equality, collection containment, and hash-based containers.EqualsIncompatibleType/TruthIncompatibleType: Flag equality comparisons between distinctrecordtypes (#6107).ReferenceEquality: Allow==comparisons onprivateclasses whose type hierarchy does not overrideObject.equals(#5865),private static finalsentinel fields,Thread(#5900), andcom.sun.source.tree.Tree.PatternMatchingInstanceof: Supportwhileandforloops, parenthesized expressions (#5843), and replacing additional redundant casts when theinstanceofalready introduces a pattern variable.DistinctVarargsChecker: Expanded to checkObjects.hash,CompletableFuture.allOf/anyOf,EnumSet.of,Sets.union/intersection/difference,Stream.concat,Math.min/max, and additional JDK, Guava, Protobuf, Truth, and Mockito methods.MustBeClosedChecker: Requirejava.lang.foreign.Arena.ofConfinedandArena.ofSharedto be closed.ImpossibleNullComparison: Flag null checks on the return value ofClass.forName.RestrictedApi/RestrictedInheritance: Added anallowedPathsattribute to allow calls or inheritance from matching file paths without a regular expression.InlineMeInliner: Support substituting type arguments at call sites when inlining generic@InlineMemethods.WellKnownKeep: Recognize Apache BeamDoFnannotations and retain open-source library annotations (Gson,Mockito,Guice,Objectify,TestParameterInjector,AutoFactory).-XepPrintTimingsto print a timing report after compilation or-XepRecordTimingsto record timings programmatically (#6079).CompilationTestHelpernow reports all lines with mismatched diagnostic expectations in a single test run rather than failing on the first mismatch (#6116).Closed issues: #4914, #5182, #5843, #5857, #5865, #5878, #5900, #6029, #6079, #6107, #6116, #6133
spring-projects/spring-boot (org.springframework.boot:spring-boot-loader-tools)
v1.5.22.RELEASE🪲 Bug Fixes
📔 Documentation
🔨 Dependency Upgrades
❤️ Contributors
We'd like to thank all the contributors who worked on this release!
v1.5.21.RELEASE🪲 Bug Fixes
📔 Documentation
🔨 Dependency Upgrades
❤️ Contributors
We'd like to thank all the contributors who worked on this release!
v1.5.20.RELEASE🪲 Bug Fixes
@JsonTestwithout Jackson #16070🔨 Dependency Upgrades
❤️ Contributors
We'd like to thank all the contributors who worked on this release!
v1.5.19.RELEASE🔨 Dependency Upgrades
v1.5.18.RELEASE⭐ New Features
🪲 Bug Fixes
javaxmeta-annotations are present #15175📔 Documentation
🔨 Dependency Upgrades
❤️ Contributors
We'd like to thank all the contributors who worked on this release!
v1.5.17.RELEASE🪲 Bug fixes
📔 Documentation
🔨 Dependency upgrades
❤️ Contributors
We’d like to thank all the contributors who worked on our current release!
v1.5.16.RELEASE: v.1.5.16.RELEASE⭐New Features
🪲Bug fixes
Configuration
📅 Schedule: (UTC)
* 0-7 * * 2)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.