fix(deps): update all minor and patch updates

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
maven (source)	3.9.9 → 3.9.10				patch
maven-wrapper (source)	3.3.2 → 3.3.3				patch
node (source)	20.12.0 → 20.12.1				patch
org.jacoco:jacoco-maven-plugin (source)	0.8.12 → 0.8.13			build	patch
org.apache.maven.plugins:maven-dependency-plugin (source)	3.8.1 → 3.9.0			build	minor
info.picocli:picocli (source)	4.7.6 → 4.7.7			compile	patch
org.apache.maven.plugins:maven-javadoc-plugin (source)	3.11.2 → 3.11.3			build	patch
org.codehaus.mojo:build-helper-maven-plugin (source)	3.6.0 → 3.6.1			build	patch
org.apache.maven.plugins:maven-antrun-plugin (source)	3.1.0 → 3.2.0			build	minor
org.wiremock:wiremock-jetty12 (source)	3.13.1 → 3.13.2			compile	patch
io.github.hakky54:ayza	10.0.0 → 10.0.1			compile	patch
org.apache.httpcomponents.client5:httpclient5 (source)	5.4.4 → 5.5			compile	minor
com.sonarsource.slang:sonar-apex-plugin (source)	1.22.1.1830 → 1.23.0.1929				minor
jakarta.inject:jakarta.inject-api	2.0.1 → 2.0.1.MR			compile	patch
com.sonarsource.dbd:sonar-dbd-java-frontend-plugin (source)	2.5.0.19957 → 2.6.0.20066				minor
com.sonarsource.swift:sonar-swift-plugin	5.0.0.12095 → 5.0.1.12254				patch
com.sonarsource.dbd:sonar-dbd-plugin (source)	2.5.0.19957 → 2.6.0.20066				minor
com.sonarsource.rpg:sonar-rpg-plugin (source)	3.11.0.7089 → 3.12.0.7371				minor
net.bytebuddy:byte-buddy	1.16.1 → 1.17.0			compile	minor
com.sonarsource.cpp:sonar-cfamily-plugin	6.75.1.93101 → 6.76.0.93913				minor
com.sonarsource.pli:sonar-pli-plugin (source)	1.18.0.6925 → 1.19.0.7056				minor
com.google.guava:guava	33.4.0-jre → 33.4.1-android			compile	patch
com.sonarsource.cobol:sonar-cobol-plugin (source)	5.10.1.9866 → 5.11.0.10062				minor
org.apache.commons:commons-compress (source)	1.27.1 → 1.28.0			compile	minor
commons-codec:commons-codec (source)	1.17.2 → 1.18.0			compile	minor
commons-io:commons-io (source)	2.18.0 → 2.19.0			compile	minor
com.sonarsource.abap:sonar-abap-plugin (source)	3.16.0.7570 → 3.17.0.7722				minor
org.apache.commons:commons-text (source)	1.13.1 → 1.14.0			compile	minor
org.apache.commons:commons-lang3 (source)	3.18.0 → 3.19.0			compile	minor
org.awaitility:awaitility (source)	4.2.2 → 4.3.0			compile	minor
org.sonarsource.kotlin:sonar-kotlin-plugin (source)	3.3.1.7792 → 3.3.2.8811				patch
org.sonarsource.xml:sonar-xml-plugin (source)	2.14.2.7437 → 2.15.0.7513				minor
org.sonarsource.text:sonar-text-plugin (source)	2.34.0.9939 → 2.35.0.10074				minor
org.springframework:spring-framework-bom	6.2.12 → 6.2.13			import	patch
org.sonarsource.html:sonar-html-plugin (source)	3.22.0.7011 → 3.23.0.7209				minor
org.flywaydb:flyway-maven-plugin (source)	11.14.0 → 11.14.1			build	patch
org.flywaydb:flyway-core (source)	11.14.0 → 11.14.1			compile	patch
org.jooq:jooq-codegen-maven (source)	3.19.15 → 3.19.16			build	patch
org.jooq:jooq (source)	3.19.15 → 3.19.16			compile	patch
org.sonarsource.slang:sonar-scala-plugin (source)	1.20.1.1884 → 1.21.0.1997				minor
org.sonarsource.python:sonar-python-plugin (source)	5.14.2.29072 → 5.15.0.29514				minor
org.sonarsource.slang:sonar-ruby-plugin (source)	1.21.1.1877 → 1.22.0.1992				minor
org.sonarsource.php:sonar-php-plugin (source)	3.42.2.15271 → 3.43.0.12862				minor
org.sonarsource.javascript:sonar-javascript-plugin (source)	11.7.1.36988 → 11.8.0.37897				minor
org.apache.httpcomponents.core5:httpcore5 (source)	5.3.2 → 5.3.3			compile	patch
org.sonarsource.java:sonar-java-plugin (source)	8.22.0.41895 → 8.23.0.42096				minor
org.apache.maven.plugins:maven-shade-plugin (source)	3.6.0 → 3.6.1			build	patch
org.apache.maven.plugins:maven-shade-plugin (source)	3.6.0 → 3.6.1			compile	patch
io.sentry:sentry	8.20.0 → 8.21.0			compile	minor
org.eclipse.jgit:org.eclipse.jgit	7.2.1.202505142326-r → 7.3.0.202506031305-r			test	minor
org.eclipse.jgit:org.eclipse.jgit	7.2.1.202505142326-r → 7.3.0.202506031305-r			compile	minor
uk.org.webcompere:system-stubs-jupiter	2.1.7 → 2.1.8			compile	patch
ch.qos.logback:logback-classic (source, changelog)	1.5.25 → 1.5.26			compile	patch
org.eclipse.lsp4j:org.eclipse.lsp4j.jsonrpc (source)	0.22.0 → 0.23.0			compile	minor
org.jetbrains.kotlin:kotlin-bom (source)	1.9.21 → 1.9.22			import	patch
org.mockito:mockito-junit-jupiter	5.8.0 → 5.9.0			test	minor
org.mockito:mockito-core	5.8.0 → 5.9.0			compile	minor
com.google.code.gson:gson	2.10 → 2.10.1			compile	patch
org.codehaus.plexus:plexus-archiver (source)	4.10.0 → 4.10.1			test	patch
org.junit.jupiter:junit-jupiter-engine (source)	5.13.1 → 5.13.2			compile	patch
org.junit.jupiter:junit-jupiter-params (source)	5.13.1 → 5.13.2			compile	patch
org.junit.jupiter:junit-jupiter-api (source)	5.13.1 → 5.13.2			compile	patch
net.bytebuddy:byte-buddy	1.17.6 → 1.17.7			compile	patch
com.squareup.okhttp3:mockwebserver3 (source)	5.0.0-alpha.16 → 5.0.0-alpha.17			compile	patch
com.squareup.okhttp3:okhttp (source)	5.0.0-alpha.16 → 5.0.0-alpha.17			compile	patch
org.apache.maven.plugins:maven-compiler-plugin (source)	3.5.1 → 3.6.0			build	minor
com.google.protobuf:protobuf-java (source)	4.28.2 → 4.28.3			compile	patch
org.apache.tomcat.embed:tomcat-embed-websocket	11.0.10 → 11.0.11			compile	patch
org.sonarsource.sonarqube:sonar-scanner-protocol (source)	9.9.0.65466 → 9.9.1.69595			compile	patch
org.sonarsource.sonar-packaging-maven-plugin:sonar-packaging-maven-plugin (source)	1.23.0.740 → 1.24.0.2621			build	minor
org.sonarsource.sonarqube:sonar-markdown (source)	25.3.0.104237 → 25.4.0.105899			compile	minor
org.sonarsource.api.plugin:sonar-plugin-api (source)	13.4.2.4284 → 13.4.3.4290			compile	patch
org.apache.commons:commons-csv (source)	1.13.0 → 1.14.0			compile	minor
org.sonarsource.sonar-packaging-maven-plugin:sonar-packaging-maven-plugin (source)	1.17 → 1.18.0.372			build	minor
org.sonarsource.git.blame:git-files-blame (source)	2.0.1.17 → 2.0.2.54			compile	patch
org.sonarsource.sonarqube:sonar-testing-harness (source)	9.9.0.65466 → 9.9.1.69595			test	patch
org.sonarsource.api.plugin:sonar-plugin-api (source)	9.14.0.375 → 9.15.0.435			provided	minor
org.sonarsource.analyzer-commons:sonar-analyzer-commons (source)	2.1.0.1111 → 2.2.0.1251			compile	minor
org.sonarsource.java:sonar-java-plugin (source)	7.16.0.30901 → 7.16.1.31255			provided	patch
org.sonarsource.sonarlint.core:sonarlint-core-parent (source)	10.47-SNAPSHOT → 10.47.0.84837			parent	patch

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

apache/maven (maven)

v3.9.10: 3.9.10

Compare Source

Release Notes - Maven - Version 3.9.10

Bug

• [MNG-8096] - Inconsistent dependency resolution behaviour for concurrent multi-module build can cause failures
• [MNG-8169] - MINGW support requires --add-opens java.base/java.lang=ALL-UNNAMED
• [MNG-8170] - Maven 3.9.8 contains weird native library for Jansi on Windows/arm64
• [MNG-8211] - Maven should fail builds that use CI Friendly versions but have no values set
• [MNG-8248] - WARNING: A restricted method in java.lang.System has been called
• [MNG-8256] - ProjectDependencyGraph bug: in case of filtering, non-direct module links are lost
• [MNG-8315] - Failure of mvn.cmd if a .mvn directory is located at drive root
• [MNG-8396] - Maven takes forever to resume
• [MNG-8711] - "Duplicate artifact" in LifecycleDependencyResolver

Improvement

• [MNG-8370] - Introduce maven.repo.local.head
• [MNG-8399] - JDK 24+ issues warning about usage of sun.misc.Unsafe
• [MNG-8707] - Add methods to remove compile and test source roots
• [MNG-8712] - improve dependency version explanation: it&#​39;s a requirement, not always effective version
• [MNG-8717] - Remove maven-plugin-plugin:addPluginArtifactMetadata from default binding
• [MNG-8722] - Use a single standalone version of asm
• [MNG-8731] - Use https for xsi:schemaLocation in generated descriptors
• [MNG-8734] - Simplify scripting like "get project version" cases

Task

• [MNG-8728] - Bump Eclipse Sisu from 0.9.0.M3 to 0.9.0.M4 and use Java 24 on CI

Dependency upgrade

• [MNG-8289] - Update Plexus annotations to 2.2.0
• [MNG-8443] - Bump com.google.guava:guava from 33.2.1-jre to 33.4.0-jre
• [MNG-8531] - Bump org.codehaus.plexus:plexus-utils from 3.5.1 to 3.6.0
• [MNG-8532] - Bump commons-io:commons-io from 2.16.1 to 2.18.0
• [MNG-8534] - Bump org.codehaus.mojo:buildnumber-maven-plugin from 3.2.0 to 3.2.1
• [MNG-8635] - Bump com.google.guava:failureaccess from 1.0.2 to 1.0.3
• [MNG-8636] - Bump com.google.guava:guava from 33.4.0-jre to 33.4.5-jre
• [MNG-8640] - Bump org.apache.maven:maven-parent from 43 to 44
• [MNG-8661] - Bump com.google.guava:guava from 33.4.5-jre to 33.4.6-jre
• [MNG-8701] - Bump org.codehaus.plexus:plexus-interpolation from 1.27 to 1.28
• [MNG-8702] - Bump org.codehaus.plexus:plexus-classworlds from 2.8.0 to 2.9.0
• [MNG-8703] - Bump commons-io:commons-io from 2.18.0 to 2.19.0
• [MNG-8704] - Bump com.google.guava:guava from 33.4.6-jre to 33.4.8-jre
• [MNG-8705] - Bump commons-jxpath:commons-jxpath from 1.3 to 1.4.0
• [MNG-8706] - Bump commons-cli:commons-cli from 1.8.0 to 1.9.0
• [MNG-8715] - Bump org.fusesource.jansi:jansi from 2.4.1 to 2.4.2
• [MNG-8716] - Bump resolver to 1.9.23
• [MNG-8745] - Bump xmlunitVersion from 2.10.0 to 2.10.2

What's Changed

• [MNG-8211] Fail the build if CI Friendly revision used without value by @​cstamhttps://github.com/apache/maven/pull/1656l/1656
• Add missing since by @​cstamhttps://github.com/apache/maven/pull/1682l/1682
• [MNG-8256] FilteredProjectDependencyGraph fix for non-transitive case by @​cstamhttps://github.com/apache/maven/pull/1724l/1724
• [MNG-8315] Failure of mvn.cmd if a .mvn folder is located at drive root by @​fmarhttps://github.com/apache/maven/pull/1806l/1806
• [MNG-8289] Update Plexus Annotations to 2.2.0 by @​dependabhttps://github.com/apache/maven/pull/1666l/1666
• [MNG-8370] Add maven.repo.local.head by @​slawekjaranowshttps://github.com/apache/maven/pull/1915l/1915
• [MNG-8443] Bump com.google.guava:guava from 33.2.1-jre to 33.4.0-jre by @​dependabhttps://github.com/apache/maven/pull/1991l/1991
• [MNG-8531] Bump org.codehaus.plexus:plexus-utils from 3.5.1 to 3.6.0 by @​dependabhttps://github.com/apache/maven/pull/2013l/2013
• [MNG-8532] Bump commons-io:commons-io from 2.16.1 to 2.18.0 by @​dependabhttps://github.com/apache/maven/pull/1926l/1926
• [MNG-8534] Bump org.codehaus.mojo:buildnumber-maven-plugin from 3.2.0 to 3.2.1 by @​dependabhttps://github.com/apache/maven/pull/1699l/1699
• Add PR Automation action by @​slawekjaranowshttps://github.com/apache/maven/pull/2113l/2113
• Bump com.google.guava:failureaccess from 1.0.2 to 1.0.3 by @​dependabhttps://github.com/apache/maven/pull/2167l/2167
• Bump com.google.guava:guava from 33.4.0-jre to 33.4.5-jre by @​dependabhttps://github.com/apache/maven/pull/2168l/2168
• [MNG-8640] Bump org.apache.maven:maven-parent from 43 to 44 by @​dependabhttps://github.com/apache/maven/pull/2163l/2163
• Use Maven 3.9.9 for build maven-3.9.x branch by @​slawekjaranowshttps://github.com/apache/maven/pull/2177l/2177
• [MNG-8248] Add enable-native-access to startup scripts by @​slawekjaranowshttps://github.com/apache/maven/pull/2171l/2171
• [MNG-8661] Bump com.google.guava:guava from 33.4.5-jre to 33.4.6-jre by @​dependabhttps://github.com/apache/maven/pull/2185l/2185
• Use dedicated local repo for ITs on Jenkins by @​slawekjaranowshttps://github.com/apache/maven/pull/2255l/2255
• [MNG-8701] Bump org.codehaus.plexus:plexus-interpolation from 1.27 to 1.28 by @​dependabhttps://github.com/apache/maven/pull/2240l/2240
• [MNG-8702] Bump org.codehaus.plexus:plexus-classworlds from 2.8.0 to 2.9.0 by @​dependabhttps://github.com/apache/maven/pull/2241l/2241
• [MNG-8703] Bump commons-io:commons-io from 2.18.0 to 2.19.0 by @​dependabhttps://github.com/apache/maven/pull/2258l/2258
• [MNG-8704] Bump com.google.guava:guava from 33.4.6-jre to 33.4.8-jre by @​dependabhttps://github.com/apache/maven/pull/2264l/2264
• [MNG-8705] Bump commons-jxpath:commons-jxpath from 1.3 to 1.4.0 by @​dependabhttps://github.com/apache/maven/pull/2270l/2270
• [MNG-8706] Bump commons-cli:commons-cli from 1.8.0 to 1.9.0 by @​dependabhttps://github.com/apache/maven/pull/1665l/1665
• [MNG-8715] Bump org.fusesource.jansi:jansi from 2.4.1 to 2.4.2 by @​dependabhttps://github.com/apache/maven/pull/2280l/2280
• [MNG-8707] Add methods to remove compile and test source roots by @​gnodhttps://github.com/apache/maven/pull/2275l/2275
• [MNG-8712] dependency version is a requirement, not effective by @​hboutehttps://github.com/apache/maven/pull/2279l/2279
• [MNG-8717] Remove maven-plugin-plugin:addPluginArtifactMetadata from default binding by @​slawekjaranowshttps://github.com/apache/maven/pull/2295l/2295
• [MNG-8169] Add opens java.base/java.lang=ALL-UNNAMED for MinGW by @​slawekjaranowshttps://github.com/apache/maven/pull/2296l/2296
• [MNG-8722] Use a single standalone version of asm by @​slawekjaranowshttps://github.com/apache/maven/pull/2297l/2297
• [MNG-8716] Bump resolver to 1.9.23 by @​slawekjaranowshttps://github.com/apache/maven/pull/2282l/2282
• [MNG-8731] Use https for xsi:schemaLocation in generated descriptors by @​slawekjaranowshttps://github.com/apache/maven/pull/2343l/2343
• [MNG-8711] Fix concurrent cache access by @​slawekjaranowshttps://github.com/apache/maven/pull/2345l/2345
• Update README.md by @​slawekjaranowshttps://github.com/apache/maven/pull/2353l/2353
• [MNG-8728] Bump Eclipse Sisu from 0.9.0.M3 to 0.9.0.M4 by @​cstamhttps://github.com/apache/maven/pull/2359l/2359
• [MNG-8728] Build ITs on JDK 21, 24 by @​slawekjaranowshttps://github.com/apache/maven/pull/2360l/2360
• [MNG-8734] Make Maven 3.9.10 ignore --raw-streams option by @​cstamhttps://github.com/apache/maven/pull/2361l/2361
• Bump xmlunitVersion from 2.10.0 to 2.10.1 by @​dependabhttps://github.com/apache/maven/pull/2354l/2354
• [MNG-8396] Backport: add cache layer to the filtered dep graph by @​cstamhttps://github.com/apache/maven/pull/2393l/2393
• [MNG-8745] Bump xmlunitVersion from 2.10.1 to 2.10.2 by @​dependabhttps://github.com/apache/maven/pull/2389l/2389

New Contributors

• @​fmarot made their first contributihttps://github.com/apache/maven/pull/1806l/1806

Full Changelog: apache/maven@maven-3.9.9...maven-3.9.10

apache/maven-wrapper (maven-wrapper)

v3.3.3: 3.3.3

Compare Source

💥 Breaking changes

• Remove wrapper lifecycle (#​357) @​slawekjaranowski

🚀 New features and improvements

• Fix Maven wrapper support for snapshot distributions (#​335) @​gnodet

🐛 Bug Fixes

• [MWRAPPER-143] - The wrapperVersion property is not used in only-script mode (#​145) @​bdemers
• fix: Maven wrapper relative distributionUrl does not work (fixes #​272) (#​107) @​danishcake
• Fix Windows Junction Link support in mvnw.cmd (#​143) @​fp024
• [MWRAPPER-158] - Remove incorrect license header (#​166) @​lbruun
• [MWRAPPER-161] - Improve script directory detection when using sh mvnw (#​329) @​ppkarwasz
• [MWRAPPER-162] - Removed dead link was getting 404 (#​167) @​montu376
• [MWRAPPER-159] - Fix shellcheck in mvnw (#​168) @​slawekjaranowski
• [MWRAPPER-146] - Bad substitution on Windows if MVNW_REPOURL is set on script-only (#​151) @​jahk04
• [MWRAPPER-147] - mvnw.cmd fails to launch maven if username contains space (#​152) @​sebthom
• [MWRAPPER-150] - Fails to validate checksums on MacOS Sequoia (#​155) @​jon-signal
• [MWRAPPER-111] - Trim whitespace when reading from properties file (#​158) @​mhalbritter
• [MWRAPPER-153] - Fixed only-mvnw.cmd fails when FIPS mode is enabled on Windows hosts (#​157) @​zbalkan

📝 Documentation updates

• Clarify usage of MAVEN_USER_HOME (#​359) @​slawekjaranowski
• site is now /tools/wrapper (#​336) @​hboutemy

👻 Maintenance

• Use invoker version from parent (#​356) @​slawekjaranowski
• Refresh download page (#​354) @​slawekjaranowski
• Update site descriptor to 2.0.0 (#​351) @​slawekjaranowski
• Enable prevent branch protection rules (#​348) @​slawekjaranowski
• Copy edit docs (#​344) @​elharo
• Prefer @​Inject (#​343) @​elharo
• Bump shellcheck to 0.10.0 (#​333) @​slachiewicz
• Enable GitHub Issues (#​169) @​slawekjaranowski
• [MNGSITE-529] - Rename "Goals" to "Plugin Documentation" (#​163) @​Bukama

📦 Dependency updates

• Bump mavenVersion from 3.9.6 to 3.9.11 (#​360) @​dependabot[bot]
• Bump exec-maven-plugin to 3.5.1 in ITs (#​355) @​slawekjaranowski
• Bump org.codehaus.mojo:mrm-maven-plugin from 1.6.0 to 1.7.0 (#​350) @​dependabot[bot]
• Bump org.codehaus.plexus:plexus-archiver from 4.10.0 to 4.10.1 (#​349) @​dependabot[bot]
• Bump actions/checkout from 4 to 5 (#​347) @​dependabot[bot]
• Bump commons-io:commons-io from 2.19.0 to 2.20.0 (#​339) @​dependabot[bot]
• Bump commons-io:commons-io from 2.18.0 to 2.19.0 (#​164) @​dependabot[bot]
• Bump org.apache.maven.resolver:maven-resolver-api from 1.9.20 to 1.9.24 (#​334) @​dependabot[bot]
• Bump org.codehaus.plexus:plexus-io from 3.4.2 to 3.5.1 (#​153) @​dependabot[bot]
• Bump org.codehaus.plexus:plexus-archiver from 4.9.2 to 4.10.0 (#​147) @​dependabot[bot]
• Upgrade to parent pom 45 (#​332) @​slachiewicz
• [MWRAPPER-154] - Bump commons-io:commons-io from 2.16.1 to 2.18.0 (#​161) @​dependabot[bot]
• Bump org.hamcrest:hamcrest from 2.2 to 3.0 ([#​149](https://redirec

---

Configuration

📅 Schedule: Branch creation - "after 7am every weekday,before 8pm every weekday" in timezone CET, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: SLCORE-2204