[dependabot]

Bumps the gradle-dependencies group with 7 updates in the / directory:

Package	From	To
com.google.errorprone:error_prone_core	2.42.0	2.51.0
com.uber.nullaway:nullaway	0.14.2	0.14.3
com.diffplug.spotless	8.10.3	8.10.4
com.squareup.okhttp3:okhttp	5.5.0	5.5.1
com.fasterxml.jackson.core:jackson-databind	2.22.3	2.22.4
com.squareup.okhttp3:mockwebserver	5.5.0	5.5.1
gradle-wrapper	9.8.1	9.8.2

Updates com.google.errorprone:error_prone_core from 2.42.0 to 2.51.0

Release notes

Sourced from com.google.errorprone:error_prone_core's releases.

Error Prone 2.51.0

New checks:

• HashCodeInObjectsHash: Detect redundant hashCode() or Objects.hash() calls inside Objects.hash(...), and simplify single-argument Objects.hash(x) calls to Objects.hashCode(x).
• LoopToTestParameter: Suggest migrating loops in unit tests to TestParameterInjector.
• MissingJavadoc: Flag public types that are missing Javadoc comments (disabled by default).
• PreferCharsetOverload: Prefer calling method and constructor overloads that accept a Charset over those that accept a String encoding name.
• PreferPreconditions: Suggest using Guava's Preconditions instead of explicit if-throw statements for parameter validation (disabled by default).
• RequireNonNullRefactoring: Refactor explicit if (x == null) { throw new NullPointerException(...); } checks to Objects.requireNonNull (disabled by default).
• SimplifyTestParameter: Remove redundant explicit value lists on @TestParameter annotations for boolean and Enum types when all values are specified (disabled by default).
• TraditionalJavadocToMarkdown: Convert traditional /** ... */ Javadoc comments into /// Markdown Javadoc comments (disabled by default).
• ValueClassIdentity: Flag reliance on identity semantics (such as synchronization, WeakReference, IdentityHashMap, or System.identityHashCode) of value-based classes (disabled by default).

Other changes:

• CompareToZero: Upgraded from warning to error, and expanded to flag non-relational operations, unary negation, and switch statements/expressions on compareTo and compare results without Integer.signum.
• IfChainToSwitch: Enabled by default as a warning.
• UndefinedEquals: Merged ArrayAsKeyOfSetOrMap and CollectionUndefinedEquality into UndefinedEquals (retaining their names as altNames), and generalized detection of types without well-defined equals or hashCode across direct equality, collection containment, and hash-based containers.
• EqualsIncompatibleType / TruthIncompatibleType: Flag equality comparisons between distinct record types (#6107).
• ReferenceEquality: Allow == comparisons on private classes whose type hierarchy does not override Object.equals (#5865), private static final sentinel fields, Thread (#5900), and com.sun.source.tree.Tree.
• PatternMatchingInstanceof: Support while and for loops, parenthesized expressions (#5843), and replacing additional redundant casts when the instanceof already introduces a pattern variable.
• DistinctVarargsChecker: Expanded to check Objects.hash, CompletableFuture.allOf/anyOf, EnumSet.of, Sets.union/intersection/difference, Stream.concat, Math.min/max, and additional JDK, Guava, Protobuf, Truth, and Mockito methods.
• MustBeClosedChecker: Require java.lang.foreign.Arena.ofConfined and Arena.ofShared to be closed.
• ImpossibleNullComparison: Flag null checks on the return value of Class.forName.
• RestrictedApi / RestrictedInheritance: Added an allowedPaths attribute to allow calls or inheritance from matching file paths without a regular expression.
• InlineMeInliner: Support substituting type arguments at call sites when inlining generic @InlineMe methods.
• WellKnownKeep: Recognize Apache Beam DoFn annotations and retain open-source library annotations (Gson, Mockito, Guice, Objectify, TestParameterInjector, AutoFactory).
• Per-check timing collection is now disabled by default, reducing Error Prone compile-time overhead by ~3–5%; pass -XepPrintTimings to print a timing report after compilation or -XepRecordTimings to record timings programmatically (#6079).
• CompilationTestHelper now reports all lines with mismatched diagnostic expectations in a single test run rather than failing on the first mismatch (#6116).
• Replaced the RE2/J dependency with SafeRE.

Closed issues: #4914, #5182, #5843, #5857, #5865, #5878, #5900, #6029, #6079, #6107, #6116, #6133

Error Prone 2.50.0

New checks:

• BoxingComparator: Detect implicitly-boxing Comparator.comparing key extractors
• ExposedPrivateType: Discourage references to private member classes from non-private APIs
• JUnitMethodInvoked: Discourage directly invoking JUnit test methods
• ListRemoveAmbiguous: Detect ambiguous calls to List.remove(int|Integer)
• PreferTestParameter: suggests using @TestParameter instead of @TestParameters for exhaustive boolean and enum parameters on single-element parameterized tests
• RecordComponentAccessorAnnotationConflict: Detect conflicts between record components and explicit accessor methods
• RecordComponentOverride: Discourage @Override on record component declarations that don't override anything
• ThrowableEqualsHashCode: Discourage overriding Throwable.equals() and hashCode()

Closed issues: #5553, #5649, #5778

Full changelog: google/error-prone@v2.49.0...v2.50.0

... (truncated)

Commits

• 3e9c316 Release Error Prone 2.51.0
• 4f83ec3 Add Maven 3.9.16 setup to release workflow
• 47eb5be Exempt Apache Beam DoFn method annotations in WellKnownKeep
• 7e2efea [IfChainToSwitch] Lower the minimum if-chain length from 5 to 4
• 0a97086 [IfChainToSwitch] address issue where deleting trailing code can cause compil...
• f61d405 [Reachability] drop skipLabel from visitContinue
• 854665b Collapse duplicated package prefixes in _javac source jar paths.
• 3588433 Introduce -XepOpt:Nullness:LikelyPublicApiOnly=true for annotating only API...
• b8a8390 Merge CollectionUndefinedEquality and ArrayAsKeyOfSetOrMap into UndefinedEquals.
• 59f98c3 Allow == comparisons on Tree instances.
• Additional commits viewable in compare view

Updates com.uber.nullaway:nullaway from 0.14.2 to 0.14.3

Release notes

Sourced from com.uber.nullaway:nullaway's releases.

NullAway 0.14.3

Many bug fixes in this release. Thanks especially to @​vlsi and @​subhramit for all the contributions! As they are now committers, their many contributions are not credited individually below.

Two bug fixes of note are #2005 and #2003, which may lead to new warnings even outside JSpecify mode.

We have also added initial support for @PolyNull in library models in #1813. We will continue to enhance this support, but it should be helpful in removing some false positives from JSpecifyExperimental mode.

• Allow configuring suppression-remover source encoding (#1894)
• Compute a call's executable type once per generic inference by @​ericschlarmann (#1896)
• Skip nested annotation restoration from raw source types (#1898)
• Refine argument nullness after Objects.equals calls by @​Beluomini (#1900)
• Keep nullable map values nullable after containsKey (#1902)
• Read nullable fields from JSpecify JDK models into astubx (#1901)
• Avoid initialization-check crashes in @NullMarked constructors by @​ZedingZhang (#1929)
• Store types of implicit lambda parameters during inference (#1930)
• Compute erasure before binary promotion (#1935)
• Preserve captured type variables during constraint generation (#1941)
• Cache conversion of MethodSymbols to MethodRefs (#1964)
• Restore nullness annotations from implicit wildcard bounds (#1967)
• Use call-specific generic inference variables (#1965)
• Account for nullable map values in getOrDefault (#1985)
• Fix crash in map callbacks after an unmarked or suppressed filter predicate (#1996)
• Strip reference casts when computing access paths (#1997)
• Handle negated null checks in multi-argument boolean contracts (#1998)
• Skip parentheses around a lambda or method reference passed to unmarked code (#1999)
• Fix crash on method references to annotated array types (#2000)
• Skip a lower-bounded wildcard when restoring annotations on a call type (#2001)
• Strip parentheses before handlers match stream callbacks and boolean literals (#2002)
• Check explicitly typed lambda parameters against unmarked interface methods (#2003)
• Add PolyNull library models and apply them to Optional.orElseGet and Map.computeIfAbsent (#1813)
• Report unboxing of a @​Nullable operand inside a primitive conditional expression (#2005)
• Report unboxing of a @​Nullable result inside a primitive switch expression (#2006)
• Fix crash on null-marked code nested in unmarked lambdas and local classes (#2007)
• Strip parentheses before the futures and gRPC handlers match an argument (#2010)
• Recognize boolean constants behind a cast in EnsuresNonNullIf and stream filters (#2011)
• Treat a parenthesized lambda or method reference like an unwrapped one in generics checks (#2012)
• Recognize a cast null check in a boolean contract argument (#2013)
• Keep the access path of a map key, call argument, or array index cast to its own type (#2014)
• Check nested nullness of explicitly typed lambda parameters (#2015)
• Keep distinct constant map keys and call arguments on distinct access paths (#2016)
• Apply conditional library return models to method references (#1968)
• Reject conflicting fixed parameter models regardless of PolyNull (#2025)
• Keep the boxing wrapper in the identity of a variable map key (#2017)
• Maintenance
  • Report diff coverage after each test run, quoting the changed lines the run did not execute and the branches it took one way, and writing the whole report to <module>/build/reports/diff-coverage/test.txt; a // diff-coverage: ignore comment moves a line out of that list without changing the counts (#1833)

... (truncated)

Changelog

Sourced from com.uber.nullaway:nullaway's changelog.

Version 0.14.3

Many bug fixes in this release. Thanks especially to @​vlsi and @​subhramit for all the contributions! As they are now committers, their many contributions are not credited individually below.

Two bug fixes of note are #2005 and #2003, which may lead to new warnings even outside JSpecify mode.

We have also added initial support for @PolyNull in library models in #1813. We will continue to enhance this support, but it should be helpful in removing some false positives from JSpecifyExperimental mode.

• Allow configuring suppression-remover source encoding (#1894)
• Compute a call's executable type once per generic inference by @​ericschlarmann (#1896)
• Skip nested annotation restoration from raw source types (#1898)
• Refine argument nullness after Objects.equals calls by @​Beluomini (#1900)
• Keep nullable map values nullable after containsKey (#1902)
• Read nullable fields from JSpecify JDK models into astubx (#1901)
• Avoid initialization-check crashes in @NullMarked constructors by @​ZedingZhang (#1929)
• Store types of implicit lambda parameters during inference (#1930)
• Compute erasure before binary promotion (#1935)
• Preserve captured type variables during constraint generation (#1941)
• Cache conversion of MethodSymbols to MethodRefs (#1964)
• Restore nullness annotations from implicit wildcard bounds (#1967)
• Use call-specific generic inference variables (#1965)
• Account for nullable map values in getOrDefault (#1985)
• Fix crash in map callbacks after an unmarked or suppressed filter predicate (#1996)
• Strip reference casts when computing access paths (#1997)
• Handle negated null checks in multi-argument boolean contracts (#1998)
• Skip parentheses around a lambda or method reference passed to unmarked code (#1999)
• Fix crash on method references to annotated array types (#2000)
• Skip a lower-bounded wildcard when restoring annotations on a call type (#2001)
• Strip parentheses before handlers match stream callbacks and boolean literals (#2002)
• Check explicitly typed lambda parameters against unmarked interface methods (#2003)
• Add PolyNull library models and apply them to Optional.orElseGet and Map.computeIfAbsent (#1813)
• Report unboxing of a @​Nullable operand inside a primitive conditional expression (#2005)
• Report unboxing of a @​Nullable result inside a primitive switch expression (#2006)
• Fix crash on null-marked code nested in unmarked lambdas and local classes (#2007)
• Strip parentheses before the futures and gRPC handlers match an argument (#2010)
• Recognize boolean constants behind a cast in EnsuresNonNullIf and stream filters (#2011)
• Treat a parenthesized lambda or method reference like an unwrapped one in generics checks (#2012)
• Recognize a cast null check in a boolean contract argument (#2013)
• Keep the access path of a map key, call argument, or array index cast to its own type (#2014)
• Check nested nullness of explicitly typed lambda parameters (#2015)
• Keep distinct constant map keys and call arguments on distinct access paths (#2016)
• Apply conditional library return models to method references (#1968)
• Reject conflicting fixed parameter models regardless of PolyNull (#2025)
• Keep the boxing wrapper in the identity of a variable map key (#2017)

... (truncated)

Commits

• 4b19c42 Prepare for release 0.14.3.
• e91ea4b Keep the boxing wrapper in the identity of a variable map key (#2017)
• d9cd573 Enable zizmor job for merge queue (#2039)
• 7f85800 Reject conflicting fixed parameter models regardless of PolyNull (#2025)
• ef0ddbd Build third-party projects at pinned commits with patches until upstream merg...
• 3035507 Apply conditional library return models to method references (#1968)
• 5023d67 Pin oracle-actions/setup-java to the v1.5.0 tag (#2021)
• 9555b20 Keep distinct constant map keys and call arguments on distinct access paths (...
• 29b740d Check nested nullness of explicitly typed lambda parameters (#2015)
• 10606a3 Keep the access path of a map key, call argument, or array index cast to its ...
• Additional commits viewable in compare view

Updates com.diffplug.spotless from 8.10.3 to 8.10.4

Release notes

Sourced from com.diffplug.spotless's releases.

Gradle Plugin v8.10.4

Changes

• Bump default eclipse version from 4.40 to 4.41.
• spotlessInstallGitPrePushHook now respects Git’s core.hooksPath when installing the pre-push hook, instead of always writing to .git/hooks. (#3115
• Bump default gherkin version 42.0.0 -> 42.0.1. (#3088)
• Bump default jackson version 2.22.2 -> 2.22.3. (#3101)
• Bump default palantir-java-format version 2.98.0 -> 2.102.0. (#3103, #3132)
• Bump default mockito-core version 5.23.0 -> 5.24.0. (#3106)
• Bump default greclipse version to latest 4.40 -> 4.41. (#3123)
• Bump default ktfmt version 0.64 -> 0.65. (#3135)
  Which moved to the org.jetbrains.kotlinx:ktfmt coordinate and org.jetbrains.kotlinx.ktfmt package. Older versions are still supported.
• Bump default palantir-java-format version 2.99.0 -> 2.102.0. (#3132)

Fixed

• shortenFullyQualifiedTypes leaves a qualified name alone when the enclosing type extends or implements a type that is not in the same file, so an inherited member type cannot take the simple name. (#3117)
• expandWildcardImports no longer drops the import of a type that is only used to qualify a static member (such as Collections.sort(list) or TimeUnit.SECONDS), or the static import of a field or enum constant (such as PI from import static java.lang.Math.*), which produced code that did not compile. (#2833)

Commits

• d9e7a41 Published gradle/8.10.4
• c006d66 Published lib/4.10.4
• 8adb835 Merge release publishing fixes into main (#3138)
• 67b4dbf Remove internal publishing changes from release notes
• b9c4830 Keep Rewrite plugin on publicly resolvable releases (#3036)
• 1c93df4 Update dependency com.palantir.javaformat:palantir-java-format to v2.102.0 (#...
• ab153a9 Keep Rewrite plugin on publicly resolvable releases
• feb10d8 Update plugin rewrite to v7.41.0
• 2083664 Update changelogs for default formatter version bump (#3132)
• 7742abc Consolidate Palantir formatter changelog entries (#3132)
• Additional commits viewable in compare view

Updates com.squareup.okhttp3:okhttp from 5.5.0 to 5.5.1

Changelog

Sourced from com.squareup.okhttp3:okhttp's changelog.

Version 5.5.1

2026_10_22

• Fix: [Block 8 compromised eMudhra intermediate certificates][Mozilla_eMudhra]. Note that this update is not necessary for Android devices with Google Play Services as Google has issued an [automatic update][Google_eMudhra]. This change protects JVMs and AOSP devices that are exposed to the compromised certificates.

Commits

• be5151a Prepare for release 5.5.1.
• 6db9802 OkHttp 5.5.x: Blocklist 8 certificates for CVE-2026-111943 (#9805)
• See full diff in compare view

Updates com.fasterxml.jackson.core:jackson-databind from 2.22.3 to 2.22.4

Commits

• a56a810 [maven-release-plugin] prepare release jackson-databind-2.22.4
• c172c5d Prep for 2.22.4 release
• 1e761c0 Merge branch '2.21' into 2.22
• fe3780f Post-release dep version bump
• a0e1fad [maven-release-plugin] prepare for next development iteration
• c92512e [maven-release-plugin] prepare release jackson-databind-2.21.8
• 0a41b7c Prep for 2.21.8 release
• ab63665 Remove stale empty 2.23.0 section from 2.22 release notes
• 2b5a04b Merge branch '2.21' into 2.22
• 3402e80 Merge branch '2.20' into 2.21
• Additional commits viewable in compare view

Updates com.squareup.okhttp3:mockwebserver from 5.5.0 to 5.5.1

Changelog

Sourced from com.squareup.okhttp3:mockwebserver's changelog.

Version 5.5.1

2026_10_22

• Fix: [Block 8 compromised eMudhra intermediate certificates][Mozilla_eMudhra]. Note that this update is not necessary for Android devices with Google Play Services as Google has issued an [automatic update][Google_eMudhra]. This change protects JVMs and AOSP devices that are exposed to the compromised certificates.

Commits

• be5151a Prepare for release 5.5.1.
• 6db9802 OkHttp 5.5.x: Blocklist 8 certificates for CVE-2026-111943 (#9805)
• See full diff in compare view

Updates gradle-wrapper from 9.8.1 to 9.8.2

Release notes

Sourced from gradle-wrapper's releases.

9.8.2

The Gradle team is excited to announce Gradle 9.8.2.

Here are the highlights of this release:

• Java 27 support
• Maven mirror settings reuse
• Linked problem locations in build output

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam, Björn Kautler, Eng Zer Jun, Hashim Khan, Julian Krannich, KBS, Labh R Jethe, Mark Dodgson, Maxim, monkey, nataphon-ktsystems, Paul King, Qiu Tian, rg_sandesh, Roberto Perez Alcolea, Sean, Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.2 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.2 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

Commits

• 8de7bcf Speed up the AllVersionsCrossVersion flaky quarantine (#39494)
• 66805db Run all cross-version targets in flaky quarantine
• cdd4c8f Skip empty test tasks in the flaky test quarantine
• 6badb77 Split the AllVersionsCrossVersion quarantine across agents
• 1655e44 Prepare for 9.8.2 (#39492)
• 6702214 Prepare for 9.8.2
• 688c0c1 Fix false warning about unstable graph (#39479)
• 3601d4f Clarify selector reuse comments in SelectorState
• 6e836fd Fix false warning about unstable graph
• a0790e5 Fix hidden artifact cleanup pattern in CheckProject (#39451)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 12fca63d-3899-4eb9-925a-abb8618bc137

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.