bernardladenthin · bernardladenthin · Aug 7, 2026 · Aug 7, 2026 · Aug 7, 2026 · Aug 7, 2026
@@ -19,7 +19,7 @@ jobs:
       security-events: write
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5.6.0
+      - uses: actions/setup-java@v5
         with: { java-version: '21', distribution: temurin }
       - uses: github/codeql-action/init@v4
         with: { languages: java, queries: +security-and-quality }

@@ -170,7 +170,7 @@ jobs:
     environment: maven-central
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5.6.0
+      - uses: actions/setup-java@v5
         with:
           java-version: '21'
           distribution: temurin
@@ -211,7 +211,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5.6.0
+      - uses: actions/setup-java@v5
         with:
           java-version: '21'
           distribution: temurin
@@ -247,7 +247,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5.6.0
+      - uses: actions/setup-java@v5
         with:
           java-version: '21'
           distribution: temurin
@@ -273,7 +273,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5.6.0
+      - uses: actions/setup-java@v5
         with:
           java-version: '21'
           distribution: temurin
@@ -343,7 +343,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5.6.0
+      - uses: actions/setup-java@v5
         with: { java-version: '21', distribution: temurin, cache: maven }
       - name: Test under vmlens (one class — staged scope)
         # VmlensInterleavingSmokeTest and the `vmlens` profile both live in
@@ -375,7 +375,7 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5.6.0
+      - uses: actions/setup-java@v5
         with: { java-version: '21', distribution: temurin }
       # Only srcmorph's jacoco report is uploaded by the `test` job (see the comment there) —
       # it carries the bulk of the test suite and the only PIT gate. Coveralls/Codecov are
@@ -427,7 +427,7 @@ jobs:
     environment: maven-central
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5.6.0
+      - uses: actions/setup-java@v5
         with:
           java-version: '21'
           distribution: temurin
@@ -558,7 +558,7 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5.6.0
+      - uses: actions/setup-java@v5
         with:
           java-version: '21'
           distribution: temurin

@@ -18,7 +18,7 @@ jobs:
         with:
           fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
       - name: Set up JDK 21
-        uses: actions/setup-java@v5.6.0
+        uses: actions/setup-java@v5
         with:
           java-version: 21
           distribution: 'zulu'

@@ -474,6 +474,15 @@ classifier) and signs them via the cross-repo shared `.github/sign-fatjars.sh` (
 java-llama.cpp). The convention + per-repo shapes + the classifier keep-in-sync rule are documented
 in [`../workspace/policies/fat-jar-release-assets.md`](../workspace/policies/fat-jar-release-assets.md).
 
+## Dependency Convergence Pinning
+
+`dependencyConvergence` is enabled (maven-enforcer) in each of the 3 reactor modules;
+`jspecify`/`checker-qual` are pinned in the reactor parent's `dependencyManagement` (next to the
+existing `slf4j-api`/`logback-classic`/`jackson` pins) because `net.ladenthin:llama` brings both
+transitively. Convention + the `excludedScopes` gotcha + merge-discipline guidance (this repo's
+`main` was actually broken by exactly this pattern once — Dependabot PR #169) are in
+[`../workspace/policies/dependency-convergence-pinning.md`](../workspace/policies/dependency-convergence-pinning.md).
+
 ## Open TODOs
 
 Open TODOs for this repo live in [`TODO.md`](TODO.md). Cross-repo status

@@ -146,6 +146,29 @@ SPDX-License-Identifier: Apache-2.0
                 <artifactId>jackson-dataformat-yaml</artifactId>
                 <version>${jackson.version}</version>
             </dependency>
+            <!--
+                Converge jspecify: declared directly (compile scope) in every child module while
+                net.ladenthin:llama brings 1.0.0 transitively, also at compile scope — this is the
+                pair that broke maven-enforcer's DependencyConvergence in Dependabot PR #169
+                (merged despite a red Build check). Pin the higher version so it wins everywhere.
+            -->
+            <dependency>
+                <groupId>org.jspecify</groupId>
+                <artifactId>jspecify</artifactId>
+                <version>1.0.1</version>
+            </dependency>
+            <!--
+                Converge checker-qual: same shape as jspecify above (net.ladenthin:llama brings
+                4.2.1 transitively). Versions happen to match today, which is exactly the kind of
+                "converged by luck" state that let the jspecify mismatch go unnoticed until a
+                routine bump diverged it — pinned defensively so the next independent bump on
+                either side can't silently break convergence again.
+            -->
+            <dependency>
+                <groupId>org.checkerframework</groupId>
+                <artifactId>checker-qual</artifactId>
+                <version>4.2.2</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 

@@ -33,13 +33,15 @@ SPDX-License-Identifier: Apache-2.0
             <dependencyManagement> references it, and child properties are never visible to a
             parent POM) — see srcmorph-parent/pom.xml. Not redeclared here.
         -->
-        <junit.version>6.1.2</junit.version>
+        <junit.version>6.1.3</junit.version>
         <hamcrest.version>3.0</hamcrest.version>
         <errorprone.version>2.50.0</errorprone.version>
         <nullaway.version>0.13.8</nullaway.version>
-        <jspecify.version>1.0.1</jspecify.version>
-        <checker.version>4.2.1</checker.version>
-        <archunit.version>1.4.2</archunit.version>
+        <!-- checker.version also drives the org.checkerframework:checker annotation-processor
+             artifact below; the checker-qual dependency version itself is managed by the
+             parent's <dependencyManagement> (see comment above <dependencies>). -->
+        <checker.version>4.2.2</checker.version>
+        <archunit.version>1.5.0</archunit.version>
         <spotbugs.version>4.10.3.0</spotbugs.version>
         <lombok.version>1.18.46</lombok.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
@@ -51,9 +53,9 @@ SPDX-License-Identifier: Apache-2.0
     </properties>
 
     <!--
-        slf4j-api / logback-classic / jackson-databind / jackson-dataformat-yaml convergence pins
-        all live in the parent's <dependencyManagement> (net.ladenthin:srcmorph-parent) so every
-        reactor module shares them.
+        slf4j-api / logback-classic / jackson-databind / jackson-dataformat-yaml / jspecify /
+        checker-qual convergence pins all live in the parent's <dependencyManagement>
+        (net.ladenthin:srcmorph-parent) so every reactor module shares them.
     -->
 
     <dependencies>
@@ -66,12 +68,10 @@ SPDX-License-Identifier: Apache-2.0
         <dependency>
             <groupId>org.jspecify</groupId>
             <artifactId>jspecify</artifactId>
-            <version>${jspecify.version}</version>
         </dependency>
         <dependency>
             <groupId>org.checkerframework</groupId>
             <artifactId>checker-qual</artifactId>
-            <version>${checker.version}</version>
         </dependency>
 
         <!--

@@ -66,19 +66,21 @@ SPDX-License-Identifier: Apache-2.0
         <!-- Explicit device selection for the gpt-oss presets (the device flag); comma-separated backend
              device names (e.g. Vulkan1). Empty = leave default. Takes precedence over ai.mainGpu. -->
         <ai.devices></ai.devices>
-        <junit.version>6.1.2</junit.version>
+        <junit.version>6.1.3</junit.version>
         <hamcrest.version>3.0</hamcrest.version>
         <jmh.version>1.37</jmh.version>
         <jcstress.version>0.16</jcstress.version>
         <vmlens.version>1.2.28</vmlens.version>
         <errorprone.version>2.50.0</errorprone.version>
         <nullaway.version>0.13.8</nullaway.version>
-        <jspecify.version>1.0.1</jspecify.version>
-        <checker.version>4.2.1</checker.version>
+        <!-- checker.version also drives the org.checkerframework:checker annotation-processor
+             artifact below; the checker-qual dependency version itself is managed by the
+             parent's <dependencyManagement> (see comment above <dependencies>). -->
+        <checker.version>4.2.2</checker.version>
         <!-- jqwik / Lincheck are no longer dependencies of this module (both moved to srcmorph
              with the config package's tests); see srcmorph/pom.xml for the jqwik "DO NOT UPGRADE
              past 1.9.3" policy note (CLAUDE.md "jqwik prompt-injection in test output"). -->
-        <archunit.version>1.4.2</archunit.version>
+        <archunit.version>1.5.0</archunit.version>
         <spotbugs.version>4.10.3.0</spotbugs.version>
         <lombok.version>1.18.46</lombok.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
@@ -107,8 +109,9 @@ SPDX-License-Identifier: Apache-2.0
     </properties>
 
     <!--
-        slf4j-api / logback-classic convergence pins now live in the parent's
-        <dependencyManagement> (net.ladenthin:srcmorph-parent) so every reactor module shares them.
+        slf4j-api / logback-classic / jspecify / checker-qual convergence pins now live in the
+        parent's <dependencyManagement> (net.ladenthin:srcmorph-parent) so every reactor module
+        shares them.
     -->
 
     <dependencies>
@@ -121,12 +124,10 @@ SPDX-License-Identifier: Apache-2.0
         <dependency>
             <groupId>org.jspecify</groupId>
             <artifactId>jspecify</artifactId>
-            <version>${jspecify.version}</version>
         </dependency>
         <dependency>
             <groupId>org.checkerframework</groupId>
             <artifactId>checker-qual</artifactId>
-            <version>${checker.version}</version>
         </dependency>
         <!--
             The extracted core library: config/document/indexer/prompt/provider/support and the
@@ -339,7 +340,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.pitest</groupId>
                     <artifactId>pitest-maven</artifactId>
-                    <version>1.25.8</version>
+                    <version>1.25.9</version>
                 </plugin>
                 <plugin>
                     <groupId>org.sonatype.central</groupId>

@@ -38,13 +38,15 @@ SPDX-License-Identifier: Apache-2.0
              -Dllama.classifier=cuda13-windows-x86-64. GPU builds need their runtime on PATH
              (CUDA: the toolkit's bin\x64 with cudart64_13.dll/cublas64_13.dll). -->
         <llama.classifier></llama.classifier>
-        <junit.version>6.1.2</junit.version>
+        <junit.version>6.1.3</junit.version>
         <hamcrest.version>3.0</hamcrest.version>
         <lincheck.version>3.7</lincheck.version>
         <errorprone.version>2.50.0</errorprone.version>
         <nullaway.version>0.13.8</nullaway.version>
-        <jspecify.version>1.0.1</jspecify.version>
-        <checker.version>4.2.1</checker.version>
+        <!-- checker.version also drives the org.checkerframework:checker annotation-processor
+             artifact below; the checker-qual dependency version itself is managed by the
+             parent's <dependencyManagement> (see comment above <dependencies>). -->
+        <checker.version>4.2.2</checker.version>
         <!-- DO NOT UPGRADE jqwik past 1.9.3. jqwik 1.10.0 added a deliberate
              anti-AI prompt-injection string to test stdout; the 1.10.1 user
              guide states the library "is not meant to be used by any 'AI'
@@ -53,7 +55,7 @@ SPDX-License-Identifier: Apache-2.0
              contributor PR that bumps this MUST be rejected. See CLAUDE.md
              section "jqwik prompt-injection in test output" for full context. -->
         <jqwik.version>1.9.3</jqwik.version>
-        <archunit.version>1.4.2</archunit.version>
+        <archunit.version>1.5.0</archunit.version>
         <spotbugs.version>4.10.3.0</spotbugs.version>
         <lombok.version>1.18.46</lombok.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
@@ -65,8 +67,9 @@ SPDX-License-Identifier: Apache-2.0
     </properties>
 
     <!--
-        slf4j-api / logback-classic convergence pins live in the parent's
-        <dependencyManagement> (net.ladenthin:srcmorph-parent) so every reactor module shares them.
+        slf4j-api / logback-classic / jspecify / checker-qual convergence pins live in the
+        parent's <dependencyManagement> (net.ladenthin:srcmorph-parent) so every reactor module
+        shares them and no version literal is repeated per module.
     -->
 
     <dependencies>
@@ -79,12 +82,10 @@ SPDX-License-Identifier: Apache-2.0
         <dependency>
             <groupId>org.jspecify</groupId>
             <artifactId>jspecify</artifactId>
-            <version>${jspecify.version}</version>
         </dependency>
         <dependency>
             <groupId>org.checkerframework</groupId>
             <artifactId>checker-qual</artifactId>
-            <version>${checker.version}</version>
         </dependency>
         <dependency>
             <groupId>net.ladenthin</groupId>
@@ -243,7 +244,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.pitest</groupId>
                     <artifactId>pitest-maven</artifactId>
-                    <version>1.25.8</version>
+                    <version>1.25.9</version>
                 </plugin>
                 <plugin>
                     <groupId>org.sonatype.central</groupId>