Upgrade GitHub Actions setup-java to v5 and update dependencies - #380
Conversation
…hunit patches DependencyConvergence's default excludedScopes=[test, provided] (verified against enforcer-rules 3.6.3) hides two real direct-vs-transitive version mismatches here: jspecify 1.0.1 (direct) vs 1.0.0 (via junit-jupiter, test scope) and logback-classic 1.6.1 (direct) vs 1.3.15 (via logcaptor, test scope). The build passes today only because both conflicting requests are test-scoped, not because they're actually pinned. Pin both explicitly so a future compile/runtime-scope consumer of either artifact can't silently break convergence, mirroring the sibling BitcoinAddressFinder incident where the same class of mismatch was compile-scoped and did fail CI. Also bump checker-qual 4.2.1 -> 4.2.2, junit-jupiter 6.1.2 -> 6.1.3, and archunit-junit5 1.4.2 -> 1.5.0 to the latest patch/minor releases, aligning with the other net.ladenthin Maven repos. Verified: mvn -B validate (DependencyConvergence passes), mvn -B clean compile, and LlamaArchitectureTest (12/12) all green. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KqVypnKbydSNgmGFfhCMUc
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KqVypnKbydSNgmGFfhCMUc
Dependabot PR #379 rewrote every actions/setup-java@v5 reference to the exact release tag @v5.6.0 when it detected a newer release existed -- this is Dependabot's default github-actions behavior (it compares against published Releases, not the maintainer-managed floating major alias, and rewrites to the exact tag once it touches a line). The floating @v5 alias itself is verified to correctly track the newest v5.x release (confirmed by comparing the peeled commit SHA of the v5 tag against the latest v5.x.y release tag), so reverting loses nothing and restores consistency with the other three sibling repos, two of which still float @v5 today. Dependabot has no supported config knob (no versioning-strategy for the github-actions ecosystem) to prevent this rewrite from recurring on the next bump -- accepted as a recurring manual cleanup rather than switching the whole fleet to exact/SHA pins. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KqVypnKbydSNgmGFfhCMUc
…pitest-maven 1.25.8 -> 1.25.9 in llama junit-jupiter was already bumped in the main llama module in a prior commit but missed here -- these two reactor sibling modules declare their own junit.version property. pitest-maven bump is the latest stable release. Verified: llama module -- mvn -B validate + clean compile + full PIT mutation run (295 mutations, 100% killed) on the new pitest version. llama-langchain4j -- mvn -B test (38/38, 4 expected model-gated skips). llama-kotlin -- mvn -B test (6/6). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KqVypnKbydSNgmGFfhCMUc
GitHub Actions
Failure
GitHub Actions
Failure
GitHub Actions
Error
|
Review completed. This PR safely upgrades GitHub Actions setup-java to v5 (floating), bumps Maven dependencies (checker-framework, junit, archunit, pitest), and defensively pins transitive dependency conflicts (jspecify, logback-classic). All changes are well-tested and documented. No security concerns - this is solid infrastructure hygiene. |
|
Detailed findings on the key changes: Dependency Convergence Pinning Strategy (llama/pom.xml lines 99-126) The defensive pinning strategy for jspecify and logback-classic is well-executed:
This mirrors the BitcoinAddressFinder incident referenced, where a similar but compile-scoped mismatch caused CI failures. Good forward-thinking pattern. Cross-module consistency: All junit.version updates across llama, llama-langchain4j, and llama-kotlin are synchronized (6.1.2 → 6.1.3). This prevents the three reactor modules from diverging on their test framework versions. Verification: Commits reference successful mvn validate (DependencyConvergence passes), compile, and full PIT mutation testing (295 mutations, 100% killed on latest pitest version). No test regressions. |
|
Additional observation on ArchUnit upgrade (1.4.2 → 1.5.0): This minor version bump is significant because ArchUnit is used for architectural validation in LlamaArchitectureTest. The commit message confirms the test still passes (12/12), which validates that the newer ArchUnit version is compatible with the project's architecture rules. No rule changes were needed, indicating good API stability in the library. This follows the pattern of the other dependency updates - all are conservative patch/minor releases that maintain API compatibility while fixing bugs or adding features. |
|
Final assessment - no issues found: STRENGTHS:
NO CONCERNS:
READY TO MERGE: This PR improves build stability and infrastructure hygiene with zero functional or security impact. |
|
2 participants
Summary
actions/setup-javafrom pinned v5.6.0 to v5 (floating minor/patch) across all workflowsdependencyManagementto prevent future transitive version conflictsTest plan
Related issues / PRs
Checklist
CONTRIBUTING.mdandCODE_OF_CONDUCT.mdSECURITY.md)https://claude.ai/code/session_01KqVypnKbydSNgmGFfhCMUc