Bump the dependencies group with 6 updates by dependabot[bot] · Pull Request #6104 · google/error-prone

dependabot · 2026-09-13T13:23:12Z

Bumps the dependencies group with 6 updates:

Package	From	To
org.apache.maven.plugins:maven-compiler-plugin	`3.15.0`	`3.16.0`
org.apache.maven.plugins:maven-surefire-plugin	`3.5.6`	`3.6.0`
com.google.protobuf:protobuf-java	`4.36.0`	`4.36.1`
com.google.protobuf:protobuf-java-util	`4.36.0`	`4.36.1`
org.checkerframework:checker-qual	`4.2.2`	`4.2.3`
org.yaml:snakeyaml	`2.6`	`2.7`

Updates org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0

Release notes

Sourced from org.apache.maven.plugins:maven-compiler-plugin's releases.

3.16.0

🚀 New features and improvements

Recompile when dependencies change (#1102) @wilx

Fix incremental detection of empty sources, 3.x (#1075) @wilx

🐛 Bug Fixes

[MCOMPILER-578] - Track outputs across compiler executions (#1091) @wilx

Build fails when annotation processor list is empty (but present) (#1077) @wilx

[MCOMPILER-374] - Unable to compile MR-JAR code against older directories when module-info.java is present (#1093) @wilx

Make mcompiler-120 IT locale independent (#1063) @anilvdl

📝 Documentation updates

[MCOMPILER-569] - Document implicitly compiled excluded sources (#1092) @wilx

Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#1074) @potiuk

👻 Maintenance

Avoid using deprecated method CompilerConfiguration.setCompilerVersion (#1121) @slawekjaranowski

Replace adopt-openj9 by semeru JDK distribution on GH (#1122) @slawekjaranowski

Port the site documentation from APT to Markdown (#1110) @slachiewicz

Verify against Maven 4.0.0-rc-6 (#1105) @slachiewicz

Fix tests on Jenkins (#1100) @slawekjaranowski

Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#1074) @potiuk

Refactor compiler mojo to use dependency injection and improve string… (#1066) @slachiewicz

Fix ITs for Maven 3.10.x (#1061) @slawekjaranowski

Update maven-surefire-plugin version to 3.x in the MCOMPILER-481 IT (#1035) @cdouillard

📦 Dependency updates

Bump plexusCompilerVersion from 2.16.2 to 2.17.0 (#1112) @dependabot[bot]

Bump org.codehaus.plexus:plexus-java from 1.5.2 to 1.6.0 (#1113) @dependabot[bot]

use latest Maven 4 (#1045) @hboutemy

Bump apache/maven-gh-actions-shared/.github/workflows/release-drafter.yml from 4 to 5 (#1083) @dependabot[bot]

Bump apache/maven-gh-actions-shared/.github/workflows/pr-automation.yml from 4 to 5 (#1082) @dependabot[bot]

Bump apache/maven-gh-actions-shared/.github/workflows/maven-verify.yml from 4 to 5 (#1084) @dependabot[bot]

Bump org.apache.maven.plugins:maven-plugins from 48 to 49 (#1068) @dependabot[bot]

Bump org.apache.maven.plugins:maven-invoker-plugin from 3.9.1 to 3.10.1 (#1047) @dependabot[bot]

Bump org.apache.maven.plugins:maven-plugins from 47 to 48 (#1050) @dependabot[bot]

Bump mavenVersion from 3.9.14 to 3.9.16 (#1054) @dependabot[bot]

Bump org.ow2.asm:asm from 9.10 to 9.10.1 (#1059) @dependabot[bot]

Bump org.ow2.asm:asm from 9.9.1 to 9.10 (#1053) @dependabot[bot]

Bump mavenVersion from 3.9.13 to 3.9.14 (#1041) @dependabot[bot]

Bump mavenVersion from 3.9.12 to 3.9.13 (#1038) @dependabot[bot]

Bump org.apache.maven.plugin-testing:maven-plugin-testing-harness from 3.5.0 to 3.5.1 (#1032) @dependabot[bot]

Commits

e7bba6e [maven-release-plugin] prepare release maven-compiler-plugin-3.16.0
c906809 Avoid using deprecated method CompilerConfiguration.setCompilerVersion
ad74fee Replace adopt-openj9 by semeru JDK distribution on GH
beb0eda Recompile when dependencies change (#1102)
a0b689e [MCOMPILER-578] Track outputs across compiler executions (#1091)
2e81228 Fix incremental detection of empty sources, 3.x (#1075)
2132f5b configure ATR project
5992b77 Build fails when annotation processor list is empty (but present) (#1077)
acccef7 Bump plexusCompilerVersion from 2.16.2 to 2.17.0
72bc445 Bump org.codehaus.plexus:plexus-java from 1.5.2 to 1.6.0
Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0

Release notes

Sourced from org.apache.maven.plugins:maven-surefire-plugin's releases.

3.6.0

Please refer to the main page for what's new https://maven.apache.org/surefire/ And the migration page https://maven.apache.org/surefire/maven-surefire-plugin/whats-new-3-6-0.html

🚀 New features and improvements

Fix #3303: distinguish JUnit 6 ParameterizedClass invocations (#3432) @AzazelSensei

[SUREFIRE-1639] - Add ability to configure JUnit 5 TestExecutionListener (#3438) @pan3793

Issue #838 Implement extension point to run diagnosis tools when forked JVM times out (#3372) @olamy

[SUREFIRE-2148] - Verify recovered BeforeAll does not fail build (#3419) @wilx

[SUREFIRE-823] - Decouple -DskipTests from Failsafe plugin (#3371) @olamy

Use StackWalker in StackTraceProvider when available (Java 9+) (#3374) @olamy

[Issue-3380] Send sourceQualifiedName to forked clients (#3380) (#3381) @fabriciorby

🐛 Bug Fixes

[SUREFIRE-523] - Link all reported tests to source XRef (#3445) @wilx

[SUREFIRE-3446] - Fix direct selection of JUnit Jupiter @Nested classes (#3447) @wilx

Discover tests in a fork when a toolchain JDK is used (#3444) @olamy

[SUREFIRE-2239, SUREFIRE-2241, SUREFIRE-2260, SUREFIRE-2274, SUREFIRE-2300] Preserve JUnit Platform test identity across reruns (#3418) @wilx

Fix #3428: resolve parents via TestPlan.getParent for pre-1.8 platforms (#3429) @kalayciburak

[SUREFIRE-859] - Make random test order reproducible (#3421) @wilx

[SUREFIRE-862, SUREFIRE-3178] Handle missing Failsafe summary files (#3417) @wilx

fix: report AfterAll/AfterClass exceptions as errors again (#3412) (#3413) @arimu1

Fixes #3264 : tests inside @Suite incorrectly classified as flakes (#3342) @mirkoalicastro

Fix Windows flake in CommandChannelDecoderTest (#3400) @ascheman

Fix reportNameSuffix in XML testcase classname (#3379) @goutamadwant

Fix: resolve relative classpath elements against the fork's working dir (#3333) @cwegener-79

📝 Documentation updates

Magnify the home, well at least have something rather than nothing :) (#3377) @olamy

Restore the straight quotes the FAQ conversion turned typographic (#3425) @slachiewicz

Restore the table borders lost in the APT conversion (#3424) @slachiewicz

Convert the FAQ from FML to Markdown (#3423) @slachiewicz

Convert the remaining site documentation from APT to Markdown (#3422) @slachiewicz

javadoc: clarify statelessTestsetReporter, consoleOutputReporter, (#3410) @joshinii

Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#3387) @potiuk

Update documentation we support Junit 6 as well :) (#3370) @olamy

👻 Maintenance

Stop dependabot from updating test fixtures (#3440) @slachiewicz

Migrate legacy plugin Javadoc annotations (#3416) @wilx

Use the resolver's own HTTP transport in the report plugin tests (#3414) @slachiewicz

Pin maven-jar-plugin 3.5.1 in modular IT fixtures (#3398) @ascheman

Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#3387) @potiuk

... (truncated)

Commits

0ff622b [maven-release-plugin] prepare release surefire-3.6.0
bb3932a Let's go for 3.6.0 release
3002a16 Bump mavenVersion from 3.9.14 to 3.9.16
61a531d Bump Maven parent version from 47 to 49 (#3449)
e52ead4 [SUREFIRE-523] Link all reported tests to source XRef (#3445)
45102fa [SUREFIRE-3446] Fix direct selection of JUnit Jupiter @Nested classes (#3447)
b2e1f70 Fix #3303: distinguish JUnit 6 ParameterizedClass invocations (#3432)
c051938 Discover tests in a fork when a toolchain JDK is used (#3444)
db75df8 Bump org.codehaus.plexus:plexus-java from 1.5.2 to 1.6.0 (#3441)
77f2759 Bump org.codehaus.plexus:plexus-interpolation from 1.29 to 1.30.0
Additional commits viewable in compare view

Updates com.google.protobuf:protobuf-java from 4.36.0 to 4.36.1

Commits

See full diff in compare view

Updates com.google.protobuf:protobuf-java-util from 4.36.0 to 4.36.1

Updates org.checkerframework:checker-qual from 4.2.2 to 4.2.3

Release notes

Sourced from org.checkerframework:checker-qual's releases.

Checker Framework 4.2.3

Version 4.2.3 (2026-09-01)

User-visible changes

The -AsuggestPureMethods command-line option and the purity.effectively.pure warning no longer require -AcheckPurityAnnotations to also be supplied.

Implementation details

Made the field Java8InferenceContext.pathToExpression private; use getPathToExpression() and setPathToExpression() instead.

Renamed TreeUtils.isLikeDiamondMemberReference() to isRawTypedMemberReference().

Closed issues

#2816, #7677, #7678, #7681, #7682, #7684, #7693, #7694, #7696, #7698, #7701, #7702, #7875, #8046, #8047, #8048, #8050, #8052.

Changelog

Sourced from org.checkerframework:checker-qual's changelog.

Version 4.2.3 (2026-09-01)

User-visible changes

The -AsuggestPureMethods command-line option and the purity.effectively.pure warning no longer require -AcheckPurityAnnotations to also be supplied.

Changes for type system implementers

Made the field Java8InferenceContext.pathToExpression private; use getPathToExpression() and setPathToExpression() instead.

Renamed TreeUtils.isLikeDiamondMemberReference() to isRawTypedMemberReference().

Closed issues

#2816, #7677, #7678, #7681, #7682, #7684, #7693, #7694, #7696, #7698, #7701, #7702, #7875, #8046, #8047, #8048, #8050, #8052.

Commits

ddd330d new release 4.2.3
d44c55a Increase the timeout.
d07e6ce Fix links.
0af4fa2 Prep for release.
455d690 Infer the type arguments of ReferenceType::Identifier where ReferenceType...
81173f8 Add javac equivalent class for AnnotationEqualityVisitor (#7692)
81b9930 AFU Javadoc
ac24b72 Add ci_info jobs, simplify misc jobs
d27d6b4 Clear SubtypeVisitHistory after each outermost isSubtype call (#8064)
3180cc2 Update actions/setup-java action to v6
Additional commits viewable in compare view

Updates org.yaml:snakeyaml from 2.6 to 2.7

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the dependencies group with 6 updates: | Package | From | To | | --- | --- | --- | | [org.apache.maven.plugins:maven-compiler-plugin](https://github.com/apache/maven-compiler-plugin) | `3.15.0` | `3.16.0` | | [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.5.6` | `3.6.0` | | [com.google.protobuf:protobuf-java](https://github.com/protocolbuffers/protobuf) | `4.36.0` | `4.36.1` | | com.google.protobuf:protobuf-java-util | `4.36.0` | `4.36.1` | | [org.checkerframework:checker-qual](https://github.com/typetools/checker-framework) | `4.2.2` | `4.2.3` | | org.yaml:snakeyaml | `2.6` | `2.7` | Updates `org.apache.maven.plugins:maven-compiler-plugin` from 3.15.0 to 3.16.0 - [Release notes](https://github.com/apache/maven-compiler-plugin/releases) - [Commits](apache/maven-compiler-plugin@maven-compiler-plugin-3.15.0...maven-compiler-plugin-3.16.0) Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.5.6 to 3.6.0 - [Release notes](https://github.com/apache/maven-surefire/releases) - [Commits](apache/maven-surefire@surefire-3.5.6...surefire-3.6.0) Updates `com.google.protobuf:protobuf-java` from 4.36.0 to 4.36.1 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `com.google.protobuf:protobuf-java-util` from 4.36.0 to 4.36.1 Updates `com.google.protobuf:protobuf-java-util` from 4.36.0 to 4.36.1 Updates `org.checkerframework:checker-qual` from 4.2.2 to 4.2.3 - [Release notes](https://github.com/typetools/checker-framework/releases) - [Changelog](https://github.com/typetools/checker-framework/blob/master/docs/CHANGELOG.md) - [Commits](typetools/checker-framework@checker-framework-4.2.2...checker-framework-4.2.3) Updates `org.yaml:snakeyaml` from 2.6 to 2.7 --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-compiler-plugin dependency-version: 3.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: org.apache.maven.plugins:maven-surefire-plugin dependency-version: 3.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: com.google.protobuf:protobuf-java dependency-version: 4.36.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: com.google.protobuf:protobuf-java-util dependency-version: 4.36.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: com.google.protobuf:protobuf-java-util dependency-version: 4.36.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.checkerframework:checker-qual dependency-version: 4.2.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.yaml:snakeyaml dependency-version: '2.7' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-14T14:35:04Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 13, 2026

cpovirk approved these changes Sep 13, 2026

View reviewed changes

copybara-service Bot mentioned this pull request Sep 14, 2026

Bump the dependencies group with 6 updates #6110

Merged

copybara-service Bot closed this in 3aaeb46 Sep 14, 2026

dependabot Bot deleted the dependabot/maven/dependencies-cb8706ff92 branch September 14, 2026 14:35

Navigation Menu

Bump the dependencies group with 6 updates - #6104

Bump the dependencies group with 6 updates#6104
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/dependencies-cb8706ff92

dependabot Bot commented on behalf of github Sep 13, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 13, 2026

3.16.0

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

📦 Dependency updates

3.6.0

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

Checker Framework 4.2.3

Version 4.2.3 (2026-09-01)

User-visible changes

Implementation details

Closed issues

Version 4.2.3 (2026-09-01)

User-visible changes

Changes for type system implementers

Closed issues

Uh oh!

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant