From a2b33b750306758e6977d4c65e584ad8bd227142 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 7 Aug 2026 14:29:03 +0000 Subject: [PATCH 1/4] Defensively pin jspecify/logback-classic, bump checker-qual/junit/archunit patches DependencyConvergence's default excludedScopes=[test, provided] (verified against enforcer-rules 3.6.3) hides two real direct-vs-transitive version mismatches here: jspecify 1.0.1 (direct) vs 1.0.0 (via junit-jupiter, test scope) and logback-classic 1.6.1 (direct) vs 1.3.15 (via logcaptor, test scope). The build passes today only because both conflicting requests are test-scoped, not because they're actually pinned. Pin both explicitly so a future compile/runtime-scope consumer of either artifact can't silently break convergence, mirroring the sibling BitcoinAddressFinder incident where the same class of mismatch was compile-scoped and did fail CI. Also bump checker-qual 4.2.1 -> 4.2.2, junit-jupiter 6.1.2 -> 6.1.3, and archunit-junit5 1.4.2 -> 1.5.0 to the latest patch/minor releases, aligning with the other net.ladenthin Maven repos. Verified: mvn -B validate (DependencyConvergence passes), mvn -B clean compile, and LlamaArchitectureTest (12/12) all green. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01KqVypnKbydSNgmGFfhCMUc --- llama/pom.xml | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/llama/pom.xml b/llama/pom.xml index 0c3cbc18..4a54ac02 100644 --- a/llama/pom.xml +++ b/llama/pom.xml @@ -59,13 +59,13 @@ SPDX-License-Identifier: MIT 1.18.46 2.50.0 0.13.8 - 4.2.1 + 4.2.2 2.22.1 3.8.6 2.0.18 1.6.1 1.27 - 6.1.2 + 6.1.3 3.0 1.37 0.16 @@ -80,7 +80,7 @@ SPDX-License-Identifier: MIT contributor PR that bumps this MUST be rejected. See CLAUDE.md section "jqwik prompt-injection in test output" for full context. --> 1.9.3 - 1.4.2 + 1.5.0 4.10.3.0 7.7.4 1.14.0 @@ -95,6 +95,15 @@ SPDX-License-Identifier: MIT dependencyConvergence rule passes. The direct slf4j-api version above must always win over the older 2.0.17 that logback-classic 1.5.32 brings in transitively. + + jspecify and logback-classic are pinned defensively even though the + conflicting transitive request (junit-jupiter -> junit-platform-commons + for jspecify; io.github.hakky54:logcaptor for logback-classic) is + test-scoped: maven-enforcer's DependencyConvergence rule excludes + test/provided scope by default (verified against enforcer-rules 3.6.3), + so today's pass is an accident of scope, not an actual pin. A future + compile/runtime-scope consumer of either artifact would otherwise break + convergence with no warning. --> @@ -103,6 +112,18 @@ SPDX-License-Identifier: MIT slf4j-api ${slf4j.version} + + + org.jspecify + jspecify + ${jspecify.version} + + + + ch.qos.logback + logback-classic + ${logback.version} + From b36b84dec368f80d47779fe850e98dce8c816ac5 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 7 Aug 2026 14:36:09 +0000 Subject: [PATCH 2/4] Add CLAUDE.md pointer to workspace dependency-convergence-pinning policy Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01KqVypnKbydSNgmGFfhCMUc --- CLAUDE.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/CLAUDE.md b/CLAUDE.md index 22f569c8..b1a59295 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1769,6 +1769,14 @@ llmservice job is **yet a publish gate** (not in the `publish-snapshot`/`publish graphs) so a Compose/AGP version-pin hiccup can't block a library release. `android-llmservice/**/build/` is git-ignored. +## Dependency Convergence Pinning + +`dependencyConvergence` is enabled (maven-enforcer, `llama/pom.xml`). Convention for pinning a +direct-vs-transitive version mismatch in `dependencyManagement`, the +`excludedScopes=[test,provided]` enforcer default gotcha (jspecify/logback-classic here are +pinned defensively because of it — see that file), and merge-discipline guidance are in +[`../workspace/policies/dependency-convergence-pinning.md`](../workspace/policies/dependency-convergence-pinning.md). + ## Open TODOs Open TODOs for this repo live in [`TODO.md`](TODO.md). Cross-repo status From 82589c37463f5caa1b04332c1fae43d65b76de1b Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 7 Aug 2026 14:53:08 +0000 Subject: [PATCH 3/4] Revert actions/setup-java to floating @v5 (was pinned to exact @v5.6.0) Dependabot PR #379 rewrote every actions/setup-java@v5 reference to the exact release tag @v5.6.0 when it detected a newer release existed -- this is Dependabot's default github-actions behavior (it compares against published Releases, not the maintainer-managed floating major alias, and rewrites to the exact tag once it touches a line). The floating @v5 alias itself is verified to correctly track the newest v5.x release (confirmed by comparing the peeled commit SHA of the v5 tag against the latest v5.x.y release tag), so reverting loses nothing and restores consistency with the other three sibling repos, two of which still float @v5 today. Dependabot has no supported config knob (no versioning-strategy for the github-actions ecosystem) to prevent this rewrite from recurring on the next bump -- accepted as a recurring manual cleanup rather than switching the whole fleet to exact/SHA pins. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01KqVypnKbydSNgmGFfhCMUc --- .github/workflows/codeql.yml | 2 +- .github/workflows/publish.yml | 68 ++++++++++++++++----------------- .github/workflows/sonarqube.yml | 2 +- 3 files changed, 36 insertions(+), 36 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 46d45227..b73e28b4 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -20,7 +20,7 @@ jobs: security-events: write steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: { java-version: '21', distribution: temurin } - uses: github/codeql-action/init@v4 with: { languages: java, queries: +security-and-quality } diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a2db7c82..094ede94 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -200,7 +200,7 @@ jobs: environment: maven-central steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: java-version: '21' distribution: temurin @@ -322,7 +322,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: java-version: '21' distribution: temurin @@ -355,7 +355,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: java-version: ${{ env.JAVA_VERSION }} distribution: temurin @@ -379,7 +379,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: java-version: ${{ env.JAVA_VERSION }} distribution: temurin @@ -422,7 +422,7 @@ jobs: path: models/ key: gguf-models-${{ hashFiles('.github/models.csv') }} enableCrossOsArchive: true - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -630,7 +630,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -687,7 +687,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -731,7 +731,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -770,7 +770,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -911,7 +911,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: java-version: ${{ env.JAVA_VERSION }} distribution: temurin @@ -1042,7 +1042,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: java-version: ${{ env.JAVA_VERSION }} distribution: temurin @@ -1136,7 +1136,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: java-version: ${{ env.JAVA_VERSION }} distribution: temurin @@ -1222,7 +1222,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: java-version: ${{ env.JAVA_VERSION }} distribution: temurin @@ -1311,7 +1311,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -1356,7 +1356,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -1815,7 +1815,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -1900,7 +1900,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -1938,7 +1938,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2042,7 +2042,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2121,7 +2121,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2155,7 +2155,7 @@ jobs: with: name: webui-generated path: ${{ github.workspace }}/llama/webui-generated/ - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2223,7 +2223,7 @@ jobs: enableCrossOsArchive: true - name: Validate model files run: bash .github/validate-models.sh - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2292,7 +2292,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2346,7 +2346,7 @@ jobs: enableCrossOsArchive: true - name: Validate model files run: bash .github/validate-models.sh - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2415,7 +2415,7 @@ jobs: enableCrossOsArchive: true - name: Validate model files run: bash .github/validate-models.sh - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2484,7 +2484,7 @@ jobs: enableCrossOsArchive: true - name: Validate model files run: bash .github/validate-models.sh - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2555,7 +2555,7 @@ jobs: enableCrossOsArchive: true - name: Validate model files run: .github\validate-models.bat - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2649,7 +2649,7 @@ jobs: enableCrossOsArchive: true - name: Validate model files run: .github\validate-models.bat - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2822,7 +2822,7 @@ jobs: with: name: Windows-x86_64-openvino path: ${{ github.workspace }}/llama/src/main/resources_windows_openvino/net/ladenthin/llama/ - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2917,7 +2917,7 @@ jobs: enableCrossOsArchive: true - name: Validate model files run: .github/validate-models.sh - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2955,7 +2955,7 @@ jobs: enableCrossOsArchive: true - name: Validate model files run: .github\validate-models.bat - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ env.JAVA_VERSION }} @@ -2980,7 +2980,7 @@ jobs: contents: write steps: - uses: actions/checkout@v7 - - uses: actions/setup-java@v5.6.0 + - uses: actions/setup-java@v5 with: { java-version: '${{ env.JAVA_VERSION }}', distribution: temurin } - uses: actions/download-artifact@v8 with: { name: jacoco-report, path: target/site/jacoco/ } @@ -3104,7 +3104,7 @@ jobs: name: Windows-x86_64-openvino path: ${{ github.workspace }}/llama/src/main/resources_windows_openvino/net/ladenthin/llama/ - name: Set up Maven Central Repository - uses: actions/setup-java@v5.6.0 + uses: actions/setup-java@v5 with: java-version: ${{ env.JAVA_VERSION }} distribution: 'temurin' @@ -3317,7 +3317,7 @@ jobs: name: Windows-x86_64-openvino path: ${{ github.workspace }}/llama/src/main/resources_windows_openvino/net/ladenthin/llama/ - name: Set up Maven Central Repository - uses: actions/setup-java@v5.6.0 + uses: actions/setup-java@v5 with: java-version: ${{ env.JAVA_VERSION }} distribution: 'temurin' diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml index 2e4c9b43..2ee66a0a 100644 --- a/.github/workflows/sonarqube.yml +++ b/.github/workflows/sonarqube.yml @@ -18,7 +18,7 @@ jobs: with: fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis - name: Set up JDK 21 - uses: actions/setup-java@v5.6.0 + uses: actions/setup-java@v5 with: java-version: 21 distribution: 'zulu' From 157d24d4bcbfa3178fbbe7b9fb65a5155c787ef7 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 7 Aug 2026 15:08:56 +0000 Subject: [PATCH 4/4] Bump junit-jupiter 6.1.2 -> 6.1.3 in llama-langchain4j/llama-kotlin, pitest-maven 1.25.8 -> 1.25.9 in llama junit-jupiter was already bumped in the main llama module in a prior commit but missed here -- these two reactor sibling modules declare their own junit.version property. pitest-maven bump is the latest stable release. Verified: llama module -- mvn -B validate + clean compile + full PIT mutation run (295 mutations, 100% killed) on the new pitest version. llama-langchain4j -- mvn -B test (38/38, 4 expected model-gated skips). llama-kotlin -- mvn -B test (6/6). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01KqVypnKbydSNgmGFfhCMUc --- llama-kotlin/pom.xml | 2 +- llama-langchain4j/pom.xml | 2 +- llama/pom.xml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/llama-kotlin/pom.xml b/llama-kotlin/pom.xml index 68d72d99..15f553bb 100644 --- a/llama-kotlin/pom.xml +++ b/llama-kotlin/pom.xml @@ -62,7 +62,7 @@ SPDX-License-Identifier: MIT consumable from Kotlin 2.3+ projects (typical Android Studio installs). --> 2.4.10 1.11.0 - 6.1.2 + 6.1.3 3.0 3.5.6 3.4.0 diff --git a/llama-langchain4j/pom.xml b/llama-langchain4j/pom.xml index e86e32c8..2b657d7a 100644 --- a/llama-langchain4j/pom.xml +++ b/llama-langchain4j/pom.xml @@ -58,7 +58,7 @@ SPDX-License-Identifier: MIT 17 1.18.1 - 6.1.2 + 6.1.3 3.0 diff --git a/llama/pom.xml b/llama/pom.xml index 4a54ac02..18dac96e 100644 --- a/llama/pom.xml +++ b/llama/pom.xml @@ -355,7 +355,7 @@ SPDX-License-Identifier: MIT org.pitest pitest-maven - 1.25.8 + 1.25.9 org.sonatype.central