[dependabot]

Bumps the gradle-dependencies group with 8 updates in the / directory:

Package	From	To
com.google.errorprone:error_prone_core	2.42.0	2.52.0
com.uber.nullaway:nullaway	0.14.2	0.14.3
com.diffplug.spotless	8.10.3	8.10.4
net.ltgt.errorprone	5.1.1	5.2.0
com.squareup.okhttp3:okhttp	5.5.0	5.5.1
com.fasterxml.jackson.core:jackson-databind	2.22.3	2.22.4
com.squareup.okhttp3:mockwebserver	5.5.0	5.5.1
gradle-wrapper	9.8.1	9.8.2

Updates com.google.errorprone:error_prone_core from 2.42.0 to 2.52.0

Release notes

Sourced from com.google.errorprone:error_prone_core's releases.

Error Prone 2.52.0

New checks:

• AlmostExhaustiveTestParameter: Prefer an exhaustive @TestParameter with an assumption to filter out specific enum values, so newly added enum values are automatically tested (disabled by default).
• SingleTestParameter: Suggest @TestParameter on the parameter instead of @TestParameters when there is only one test parameter, replacing PreferTestParameter (disabled by default).
• SingleValueTestParameter: Suggest replacing a @TestParameter that has only a single value with a local variable in the test method (disabled by default).
• ValueClassEquals: Require non-record concrete value classes to explicitly override equals and hashCode.

Other changes:

• LoopToTestParameter: Changed severity to SUGGESTION (disabled by default).
• DistinctVarargsChecker: Allow duplicate arguments to Iterables.concat (#6239) and Mockito argument matchers such as any() (#6240).
• UnusedVariable: Treat fields accessed via MethodHandles.Lookup (VarHandle/getter/setter lookups) or Atomic*FieldUpdater.newUpdater as used.
• StringBuilderInitWithChar / StringBuffer refactoring: Refactor StringBuffer to StringBuilder even when used with Matcher.appendReplacement and appendTail (when supported by the target JDK or Android minSdkVersion).
• CompileTimeConstant: Treat record and interface fields and field accesses on compile-time constants (compileTimeConstant.compileTimeConstantField) as compile-time constants.
• ValueClassIdentity / ReferenceEquality: Handle JEP 401 value classes.
• FieldCanBeFinal / ThreadSafety: Improve compile-time performance on large classes and deep type hierarchies, and update SafeRE to 1.1.0 (#6230).
• Added ClassName for caching resolved ClassSymbol, Type, and binary Name lookups across a compilation.

Closed issues: #5964, #6165, #6230, #6239, #6240, #6275

Full changelog: google/error-prone@v2.51.0...v2.52.0

Error Prone 2.51.0

New checks:

• HashCodeInObjectsHash: Detect redundant hashCode() or Objects.hash() calls inside Objects.hash(...), and simplify single-argument Objects.hash(x) calls to Objects.hashCode(x).
• LoopToTestParameter: Suggest migrating loops in unit tests to TestParameterInjector.
• MissingJavadoc: Flag public types that are missing Javadoc comments (disabled by default).
• PreferCharsetOverload: Prefer calling method and constructor overloads that accept a Charset over those that accept a String encoding name.
• PreferPreconditions: Suggest using Guava's Preconditions instead of explicit if-throw statements for parameter validation (disabled by default).
• RequireNonNullRefactoring: Refactor explicit if (x == null) { throw new NullPointerException(...); } checks to Objects.requireNonNull (disabled by default).
• SimplifyTestParameter: Remove redundant explicit value lists on @TestParameter annotations for boolean and Enum types when all values are specified (disabled by default).
• TraditionalJavadocToMarkdown: Convert traditional /** ... */ Javadoc comments into /// Markdown Javadoc comments (disabled by default).
• ValueClassIdentity: Flag reliance on identity semantics (such as synchronization, WeakReference, IdentityHashMap, or System.identityHashCode) of value-based classes (disabled by default).

Other changes:

• CompareToZero: Upgraded from warning to error, and expanded to flag non-relational operations, unary negation, and switch statements/expressions on compareTo and compare results without Integer.signum.
• IfChainToSwitch: Enabled by default as a warning.
• UndefinedEquals: Merged ArrayAsKeyOfSetOrMap and CollectionUndefinedEquality into UndefinedEquals (retaining their names as altNames), and generalized detection of types without well-defined equals or hashCode across direct equality, collection containment, and hash-based containers.
• EqualsIncompatibleType / TruthIncompatibleType: Flag equality comparisons between distinct record types (#6107).
• ReferenceEquality: Allow == comparisons on private classes whose type hierarchy does not override Object.equals (#5865), private static final sentinel fields, Thread (#5900), and com.sun.source.tree.Tree.
• PatternMatchingInstanceof: Support while and for loops, parenthesized expressions (#5843), and replacing additional redundant casts when the instanceof already introduces a pattern variable.
• DistinctVarargsChecker: Expanded to check Objects.hash, CompletableFuture.allOf/anyOf, EnumSet.of, Sets.union/intersection/difference, Stream.concat, Math.min/max, and additional JDK, Guava, Protobuf, Truth, and Mockito methods.
• MustBeClosedChecker: Require java.lang.foreign.Arena.ofConfined and Arena.ofShared to be closed.
• ImpossibleNullComparison: Flag null checks on the return value of Class.forName.
• RestrictedApi / RestrictedInheritance: Added an allowedPaths attribute to allow calls or inheritance from matching file paths without a regular expression.
• InlineMeInliner: Support substituting type arguments at call sites when inlining generic @InlineMe methods.
• WellKnownKeep: Recognize Apache Beam DoFn annotations and retain open-source library annotations (Gson, Mockito, Guice, Objectify, TestParameterInjector, AutoFactory).

... (truncated)

Commits

• 1e32314 Release Error Prone 2.52.0
• ea4c6df Avoid calling SuggestedFixes.compilesWithFix in FieldCanBeFinal
• 04640b8 Update SafeRE to 1.1.0
• 6034e09 Bump the dependencies group across 1 directory with 8 updates
• 3cc36d5 Bump actions/setup-java from 6.0.1 to 6.1.0 in the github-actions group (#6270)
• 0202185 Migrate class and annotation name constants in Error Prone to ClassName.
• cdf0d94 Add ASTHelpers.overridesObjectEquals and overridesObjectHashCode helpers.
• 208015e Update MemoizeConstantVisitorStateLookups to suggest ClassName.
• e1a8a3e Add ValueClassEquals to require non-record concrete value classes to over...
• 2c6baed Handle JEP 401 value classes in ValueClassIdentity and ReferenceEquality
• Additional commits viewable in compare view

Updates com.uber.nullaway:nullaway from 0.14.2 to 0.14.3

Release notes

Sourced from com.uber.nullaway:nullaway's releases.

NullAway 0.14.3

Many bug fixes in this release. Thanks especially to @​vlsi and @​subhramit for all the contributions! As they are now committers, their many contributions are not credited individually below.

Two bug fixes of note are #2005 and #2003, which may lead to new warnings even outside JSpecify mode.

We have also added initial support for @PolyNull in library models in #1813. We will continue to enhance this support, but it should be helpful in removing some false positives from JSpecifyExperimental mode.

• Allow configuring suppression-remover source encoding (#1894)
• Compute a call's executable type once per generic inference by @​ericschlarmann (#1896)
• Skip nested annotation restoration from raw source types (#1898)
• Refine argument nullness after Objects.equals calls by @​Beluomini (#1900)
• Keep nullable map values nullable after containsKey (#1902)
• Read nullable fields from JSpecify JDK models into astubx (#1901)
• Avoid initialization-check crashes in @NullMarked constructors by @​ZedingZhang (#1929)
• Store types of implicit lambda parameters during inference (#1930)
• Compute erasure before binary promotion (#1935)
• Preserve captured type variables during constraint generation (#1941)
• Cache conversion of MethodSymbols to MethodRefs (#1964)
• Restore nullness annotations from implicit wildcard bounds (#1967)
• Use call-specific generic inference variables (#1965)
• Account for nullable map values in getOrDefault (#1985)
• Fix crash in map callbacks after an unmarked or suppressed filter predicate (#1996)
• Strip reference casts when computing access paths (#1997)
• Handle negated null checks in multi-argument boolean contracts (#1998)
• Skip parentheses around a lambda or method reference passed to unmarked code (#1999)
• Fix crash on method references to annotated array types (#2000)
• Skip a lower-bounded wildcard when restoring annotations on a call type (#2001)
• Strip parentheses before handlers match stream callbacks and boolean literals (#2002)
• Check explicitly typed lambda parameters against unmarked interface methods (#2003)
• Add PolyNull library models and apply them to Optional.orElseGet and Map.computeIfAbsent (#1813)
• Report unboxing of a @​Nullable operand inside a primitive conditional expression (#2005)
• Report unboxing of a @​Nullable result inside a primitive switch expression (#2006)
• Fix crash on null-marked code nested in unmarked lambdas and local classes (#2007)
• Strip parentheses before the futures and gRPC handlers match an argument (#2010)
• Recognize boolean constants behind a cast in EnsuresNonNullIf and stream filters (#2011)
• Treat a parenthesized lambda or method reference like an unwrapped one in generics checks (#2012)
• Recognize a cast null check in a boolean contract argument (#2013)
• Keep the access path of a map key, call argument, or array index cast to its own type (#2014)
• Check nested nullness of explicitly typed lambda parameters (#2015)
• Keep distinct constant map keys and call arguments on distinct access paths (#2016)
• Apply conditional library return models to method references (#1968)
• Reject conflicting fixed parameter models regardless of PolyNull (#2025)
• Keep the boxing wrapper in the identity of a variable map key (#2017)
• Maintenance
  • Report diff coverage after each test run, quoting the changed lines the run did not execute and the branches it took one way, and writing the whole report to <module>/build/reports/diff-coverage/test.txt; a // diff-coverage: ignore comment moves a line out of that list without changing the counts (#1833)

... (truncated)

Changelog

Sourced from com.uber.nullaway:nullaway's changelog.

Version 0.14.3

Many bug fixes in this release. Thanks especially to @​vlsi and @​subhramit for all the contributions! As they are now committers, their many contributions are not credited individually below.

Two bug fixes of note are #2005 and #2003, which may lead to new warnings even outside JSpecify mode.

We have also added initial support for @PolyNull in library models in #1813. We will continue to enhance this support, but it should be helpful in removing some false positives from JSpecifyExperimental mode.

• Allow configuring suppression-remover source encoding (#1894)
• Compute a call's executable type once per generic inference by @​ericschlarmann (#1896)
• Skip nested annotation restoration from raw source types (#1898)
• Refine argument nullness after Objects.equals calls by @​Beluomini (#1900)
• Keep nullable map values nullable after containsKey (#1902)
• Read nullable fields from JSpecify JDK models into astubx (#1901)
• Avoid initialization-check crashes in @NullMarked constructors by @​ZedingZhang (#1929)
• Store types of implicit lambda parameters during inference (#1930)
• Compute erasure before binary promotion (#1935)
• Preserve captured type variables during constraint generation (#1941)
• Cache conversion of MethodSymbols to MethodRefs (#1964)
• Restore nullness annotations from implicit wildcard bounds (#1967)
• Use call-specific generic inference variables (#1965)
• Account for nullable map values in getOrDefault (#1985)
• Fix crash in map callbacks after an unmarked or suppressed filter predicate (#1996)
• Strip reference casts when computing access paths (#1997)
• Handle negated null checks in multi-argument boolean contracts (#1998)
• Skip parentheses around a lambda or method reference passed to unmarked code (#1999)
• Fix crash on method references to annotated array types (#2000)
• Skip a lower-bounded wildcard when restoring annotations on a call type (#2001)
• Strip parentheses before handlers match stream callbacks and boolean literals (#2002)
• Check explicitly typed lambda parameters against unmarked interface methods (#2003)
• Add PolyNull library models and apply them to Optional.orElseGet and Map.computeIfAbsent (#1813)
• Report unboxing of a @​Nullable operand inside a primitive conditional expression (#2005)
• Report unboxing of a @​Nullable result inside a primitive switch expression (#2006)
• Fix crash on null-marked code nested in unmarked lambdas and local classes (#2007)
• Strip parentheses before the futures and gRPC handlers match an argument (#2010)
• Recognize boolean constants behind a cast in EnsuresNonNullIf and stream filters (#2011)
• Treat a parenthesized lambda or method reference like an unwrapped one in generics checks (#2012)
• Recognize a cast null check in a boolean contract argument (#2013)
• Keep the access path of a map key, call argument, or array index cast to its own type (#2014)
• Check nested nullness of explicitly typed lambda parameters (#2015)
• Keep distinct constant map keys and call arguments on distinct access paths (#2016)
• Apply conditional library return models to method references (#1968)
• Reject conflicting fixed parameter models regardless of PolyNull (#2025)
• Keep the boxing wrapper in the identity of a variable map key (#2017)

... (truncated)

Commits

• 4b19c42 Prepare for release 0.14.3.
• e91ea4b Keep the boxing wrapper in the identity of a variable map key (#2017)
• d9cd573 Enable zizmor job for merge queue (#2039)
• 7f85800 Reject conflicting fixed parameter models regardless of PolyNull (#2025)
• ef0ddbd Build third-party projects at pinned commits with patches until upstream merg...
• 3035507 Apply conditional library return models to method references (#1968)
• 5023d67 Pin oracle-actions/setup-java to the v1.5.0 tag (#2021)
• 9555b20 Keep distinct constant map keys and call arguments on distinct access paths (...
• 29b740d Check nested nullness of explicitly typed lambda parameters (#2015)
• 10606a3 Keep the access path of a map key, call argument, or array index cast to its ...
• Additional commits viewable in compare view

Updates com.diffplug.spotless from 8.10.3 to 8.10.4

Release notes

Sourced from com.diffplug.spotless's releases.

Gradle Plugin v8.10.4

Changes

• Bump default eclipse version from 4.40 to 4.41.
• spotlessInstallGitPrePushHook now respects Git’s core.hooksPath when installing the pre-push hook, instead of always writing to .git/hooks. (#3115
• Bump default gherkin version 42.0.0 -> 42.0.1. (#3088)
• Bump default jackson version 2.22.2 -> 2.22.3. (#3101)
• Bump default palantir-java-format version 2.98.0 -> 2.102.0. (#3103, #3132)
• Bump default mockito-core version 5.23.0 -> 5.24.0. (#3106)
• Bump default greclipse version to latest 4.40 -> 4.41. (#3123)
• Bump default ktfmt version 0.64 -> 0.65. (#3135)
  Which moved to the org.jetbrains.kotlinx:ktfmt coordinate and org.jetbrains.kotlinx.ktfmt package. Older versions are still supported.
• Bump default palantir-java-format version 2.99.0 -> 2.102.0. (#3132)

Fixed

• shortenFullyQualifiedTypes leaves a qualified name alone when the enclosing type extends or implements a type that is not in the same file, so an inherited member type cannot take the simple name. (#3117)
• expandWildcardImports no longer drops the import of a type that is only used to qualify a static member (such as Collections.sort(list) or TimeUnit.SECONDS), or the static import of a field or enum constant (such as PI from import static java.lang.Math.*), which produced code that did not compile. (#2833)

Commits

• d9e7a41 Published gradle/8.10.4
• c006d66 Published lib/4.10.4
• 8adb835 Merge release publishing fixes into main (#3138)
• 67b4dbf Remove internal publishing changes from release notes
• b9c4830 Keep Rewrite plugin on publicly resolvable releases (#3036)
• 1c93df4 Update dependency com.palantir.javaformat:palantir-java-format to v2.102.0 (#...
• ab153a9 Keep Rewrite plugin on publicly resolvable releases
• feb10d8 Update plugin rewrite to v7.41.0
• 2083664 Update changelogs for default formatter version bump (#3132)
• 7742abc Consolidate Palantir formatter changelog entries (#3132)
• Additional commits viewable in compare view

Updates net.ltgt.errorprone from 5.1.1 to 5.2.0

Updates com.squareup.okhttp3:okhttp from 5.5.0 to 5.5.1

Changelog

Sourced from com.squareup.okhttp3:okhttp's changelog.

Version 5.5.1

2026_10_22

• Fix: [Block 8 compromised eMudhra intermediate certificates][Mozilla_eMudhra]. Note that this update is not necessary for Android devices with Google Play Services as Google has issued an [automatic update][Google_eMudhra]. This change protects JVMs and AOSP devices that are exposed to the compromised certificates.

Commits

• be5151a Prepare for release 5.5.1.
• 6db9802 OkHttp 5.5.x: Blocklist 8 certificates for CVE-2026-111943 (#9805)
• See full diff in compare view

Updates com.fasterxml.jackson.core:jackson-databind from 2.22.3 to 2.22.4

Commits

• a56a810 [maven-release-plugin] prepare release jackson-databind-2.22.4
• c172c5d Prep for 2.22.4 release
• 1e761c0 Merge branch '2.21' into 2.22
• fe3780f Post-release dep version bump
• a0e1fad [maven-release-plugin] prepare for next development iteration
• c92512e [maven-release-plugin] prepare release jackson-databind-2.21.8
• 0a41b7c Prep for 2.21.8 release
• ab63665 Remove stale empty 2.23.0 section from 2.22 release notes
• 2b5a04b Merge branch '2.21' into 2.22
• 3402e80 Merge branch '2.20' into 2.21
• Additional commits viewable in compare view

Updates com.squareup.okhttp3:mockwebserver from 5.5.0 to 5.5.1

Changelog

Sourced from com.squareup.okhttp3:mockwebserver's changelog.

Version 5.5.1

2026_10_22

• Fix: [Block 8 compromised eMudhra intermediate certificates][Mozilla_eMudhra]. Note that this update is not necessary for Android devices with Google Play Services as Google has issued an [automatic update][Google_eMudhra]. This change protects JVMs and AOSP devices that are exposed to the compromised certificates.

Commits

• be5151a Prepare for release 5.5.1.
• 6db9802 OkHttp 5.5.x: Blocklist 8 certificates for CVE-2026-111943 (#9805)
• See full diff in compare view

Updates gradle-wrapper from 9.8.1 to 9.8.2

Release notes

Sourced from gradle-wrapper's releases.

9.8.2

The Gradle team is excited to announce Gradle 9.8.2.

Here are the highlights of this release:

• Java 27 support
• Maven mirror settings reuse
• Linked problem locations in build output

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam, Björn Kautler, Eng Zer Jun, Hashim Khan, Julian Krannich, KBS, Labh R Jethe, Mark Dodgson, Maxim, monkey, nataphon-ktsystems, Paul King, Qiu Tian, rg_sandesh, Roberto Perez Alcolea, Sean, Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.2 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.2 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

Commits

• 8de7bcf Speed up the AllVersionsCrossVersion flaky quarantine (#39494)
• 66805db Run all cross-version targets in flaky quarantine
• cdd4c8f Skip empty test tasks in the flaky test quarantine
• 6badb77 Split the AllVersionsCrossVersion quarantine across agents
• 1655e44 Prepare for 9.8.2 (#39492)
• 6702214 Prepare for 9.8.2
• 688c0c1 Fix false warning about unstable graph (#39479)
• 3601d4f Clarify selector reuse comments in SelectorState
• 6e836fd Fix false warning about unstable graph
• a0790e5 Fix hidden artifact cleanup pattern in CheckProject (#39451)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 39cf730e-c156-4435-bf3e-1c3251869a0d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud