build: spotbugs-maven-plugin 4.10.5.0, JLine 4.4.8, JSpecify nullness on Lombok code; llama.cpp b11558 -> b11574

[bernardladenthin]

Summary

• Dependency bumps (one commit): spotbugs-maven-plugin 4.10.4.1 -> 4.10.5.0 (SpotBugs 4.10.5, the first release that reads JSpecify; it reported NP_METHOD_PARAMETER_TIGHTENS_ANNOTATION on 27 classes -- under @NullMarked the parameter of a Lombok-generated equals(Object) read as non-null while Object.equals accepts null -- answered in the shared llama/lombok.config with lombok.addNullAnnotations = jspecify rather than a suppression, .github/shared-files.sha256 rewritten; the canonical copy is in the workspace policy); JLine 4.4.7 -> 4.4.8 in llama-atmosphere-agent (of its 604 classes only jansi/AnsiConsole and shell/impl/HelpCommands differ from 4.4.7, none of the files the eight carried JLine fixes touch; the agent compiles against it).
• llama.cpp b11558 -> b11574 in five reviewed steps, one commit each, every one ending at a tag (b11559, b11560, b11570, b11573, b11574; 16 commits / 69 files upstream, one tools/ui fix the auto-followed WebUI picks up). What reaches this project: #30014 hides ggml's symbols by default in the shared ggml / ggml-base (BUILD_SHARED_LIBS only, i.e. the modular library jars) -- verified by a local modular build: libggml-base.so exports 689 functions and libggml.so 16, the five the load path uses among them, and the model-free native Java tests ran over it (27/27, the RPC server resolved through ggml_backend_reg_get_proc_address included); #30329 reports compute-graph reallocations (two appended llama_perf_context_data fields and a graph reallocs log line per slot, no JSON change, Timings / getMetrics() untouched); #30378 / #30383 add two decision model types for /v1/systemone (vllm-decision2 with a strict payload, vllm-d3 with non-causal attention) behind an unchanged contract for the existing ones; #30095 --kv-unified reaches the speculative example. Patch 0012 is refreshed onto #30299's tests/CMakeLists.txt (llama_build_and_test(... LINK llama)); the other eleven apply unchanged and every drop-check still finds its defect. Per-step rows in docs/history/llama-cpp-breaking-changes.md; CLAUDE.md (pin line, the 0012 row), README badge, LlamaCppVersion, CHANGELOG.

Test plan

• Affected unit / integration tests pass locally: clean compile with Error Prone / NullAway / Checker and spotbugs:check at 0 bugs (the lombok.config change needs a clean build); the agent compiles against JLine 4.4.8. At b11574: a fresh FetchContent checkout through the real applier (all twelve patches, stamp written), the static test build, ctest 607/607, NativeLibraryLoadSmokeTest (the pin against the linked b11574-<commit>), LlamaLoggerTest, RpcServerTest; then the modular build (-DJLLAMA_BACKEND_DL=ON) with the symbol check above and RpcServerTest, LlamaLoggerTest, BackendLoadTest, NativeLibraryLoadSmokeTest over it, 27/27; spotless:check, check-patches.py (12 patches, 99 hunks, 0 problems), check-natives.py (23 jars, 0 disagreements), check-shared-files.py (0 changed here alone).
• CI is green on this branch. Not run locally: the model-backed Java suite (no GGUF in the sandbox) and the 23 natives builds -- CI's test and build jobs cover them. The shared-files job warns about lombok.config until the sibling pull requests merge (a sync lands in four steps; the job fails only on a copy changed here alone, which it is not).
• Docs / CHANGELOG updated where applicable

Related issues / PRs

Same sweep in the sibling repositories: bernardladenthin/BitcoinAddressFinder#387, bernardladenthin/srcmorph#225, bernardladenthin/streambuffer#179 and bernardladenthin/workspace#55 (the canonical lombok.config, the tool-version row and this bump in the cross-repo status).

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits
• No security-sensitive changes (if there are, I have notified the maintainer privately per SECURITY.md)

🤖 Generated with Claude Code

https://claude.ai/code/session_01AytmJF9faEiQEVt6eetQS2

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud