Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Repository problems

These problems occurred while renovating this repository. View logs.

• WARN: Error updating branch: update failure

Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

• build(deps): lock file maintenance

Errored

The following updates encountered an error and will be retried. To force a retry now, click on a checkbox below.

• build(deps): update nixpkgs digest to 554be64

Edited/Blocked

The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below.

• build(deps): update dependency org.eclipse.jdt:org.eclipse.jdt.core to v3.43.0

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• build(deps): update jfx.version to v26-ea+7 (org.openjfx:javafx-fxml, org.openjfx:javafx-controls, org.openjfx:javafx-graphics, org.openjfx:javafx-base)
• build(deps): update dependency com.google.guava:guava to v33.5.0-jre
• build(deps): update determinatesystems/flake-checker-action action to v12
• build(deps): update determinatesystems/magic-nix-cache-action action to v13
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

dockerfile

doc/jenkins/Dockerfile

• stackbrew/ubuntu 16.04@sha256:cd39646de5628c8188396c506fdc76dd94c7652a82439cc4318cfc05cc93fbb7

github-actions

.github/actions/setup-tests/action.yml

• DeterminateSystems/nix-installer-action v20@786fff0690178f1234e4e1fe9b536e94f5433196
• DeterminateSystems/magic-nix-cache-action v12@e1c1dae8e170ed20fd2e6aaf9979ca2d3905d636
• DeterminateSystems/flake-checker-action v11@f6b84c9884c22039e1fc23dadb4a0d0add56c197
• actions/cache v4.2.4@0400d5f644dc74513175e3cd8d07132dd4860809

.github/workflows/jreleaser.yml

• actions/checkout v5@08c6903cd8c0fde910a37f88322edcfb5dd907a8
• actions/attest-build-provenance v3.0.0@977bb373ede98d70efdf65b84cb5f73e068dcc2a
• actions/upload-artifact v4@ea165f8d65b6e75b540449e92b4886f43607fa02

.github/workflows/qodana.yml

• actions/checkout v5.0.0@08c6903cd8c0fde910a37f88322edcfb5dd907a8
• JetBrains/qodana-action v2025.2.1@27de2a744479d1d731934eeaf79287575ebc5dd3
• github/codeql-action v3@192325c86100d080feab897ff886c34abd4c83a3
• actions/checkout v5.0.0@08c6903cd8c0fde910a37f88322edcfb5dd907a8
• JetBrains/qodana-action v2025.2.1@27de2a744479d1d731934eeaf79287575ebc5dd3
• github/codeql-action v3@192325c86100d080feab897ff886c34abd4c83a3
• actions/checkout v5.0.0@08c6903cd8c0fde910a37f88322edcfb5dd907a8
• JetBrains/qodana-action v2025.2.1@27de2a744479d1d731934eeaf79287575ebc5dd3
• github/codeql-action v3@192325c86100d080feab897ff886c34abd4c83a3

.github/workflows/sbom.yml

• actions/checkout v5.0.0@08c6903cd8c0fde910a37f88322edcfb5dd907a8
• actions/setup-java v5.0.0@dded0888837ed1f317902acf8a20df0ad188d165
• actions/cache v4.2.4@0400d5f644dc74513175e3cd8d07132dd4860809
• slsa-framework/github-actions-demo v0.1@9474e92bbf825d5b4b46810fc9367dfc73429a2a

.github/workflows/scorecards.yml

• step-security/harden-runner v2.13.1@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a
• actions/checkout v5.0.0@08c6903cd8c0fde910a37f88322edcfb5dd907a8
• ossf/scorecard-action v2.4.2@05b42c624433fc40578a4040d5cf5e36ddca8cde
• actions/upload-artifact v4.6.2@ea165f8d65b6e75b540449e92b4886f43607fa02
• github/codeql-action v3.30.3@192325c86100d080feab897ff886c34abd4c83a3

.github/workflows/tests.yml

• actions/checkout v5@08c6903cd8c0fde910a37f88322edcfb5dd907a8
• actions/checkout v5.0.0@08c6903cd8c0fde910a37f88322edcfb5dd907a8
• actions/setup-java v5@dded0888837ed1f317902acf8a20df0ad188d165
• actions/checkout v5@08c6903cd8c0fde910a37f88322edcfb5dd907a8
• actions/checkout v5@08c6903cd8c0fde910a37f88322edcfb5dd907a8
• actions/checkout v5@08c6903cd8c0fde910a37f88322edcfb5dd907a8
• actions/checkout v5@08c6903cd8c0fde910a37f88322edcfb5dd907a8
• actions/checkout v5@08c6903cd8c0fde910a37f88322edcfb5dd907a8
• actions/checkout v5@08c6903cd8c0fde910a37f88322edcfb5dd907a8

gradle

spoon-dataflow/build.gradle

• se.patrikerdes.use-latest-versions 0.2.19
• com.github.ben-manes.versions 0.52.0
• com.github.johnrengelman.shadow 8.1.1
• commons-cli:commons-cli 1.10.0
• tools.aqua:z3-turnkey 4.14.1
• org.junit.jupiter:junit-jupiter 5.13.4

spoon-dataflow/settings.gradle

gradle-wrapper

spoon-dataflow/gradle/wrapper/gradle-wrapper.properties

• gradle 9.1.0

html

doc/_includes/head.html

• jquery 3.7.1
• jquery-cookie 1.4.1

maven

pom.xml

• org.eclipse.jdt:org.eclipse.jdt.core 3.41.0
• com.martiansoftware:jsap 2.1
• org.slf4j:slf4j-api 2.0.17
• commons-io:commons-io 2.20.0
• org.apache.commons:commons-lang3 3.18.0
• org.tukaani:xz 1.10
• com.fasterxml.jackson.core:jackson-databind 2.20.0
• org.apache.commons:commons-compress 1.28.0
• org.jspecify:jspecify 1.0.0
• org.assertj:assertj-core 3.27.6
• com.google.guava:guava 33.4.0-jre
• ch.qos.logback:logback-classic 1.5.18
• com.mysema.querydsl:querydsl-core 3.7.4
• org.apache.maven.shared:maven-invoker 3.3.0
• javax.validation:validation-api 2.0.1.Final
• org.kohsuke.metainf-services:metainf-services 1.11
• javax.xml.bind:jaxb-api 2.3.1
• org.apache.maven.plugins:maven-enforcer-plugin 3.6.1
• org.apache.maven.plugins:maven-checkstyle-plugin 3.6.0
• com.diffplug.spotless:spotless-maven-plugin 2.46.1

spoon-control-flow/pom.xml

• org.apache.maven.plugins:maven-checkstyle-plugin 3.6.0
• fr.inria.gforge.spoon:spoon-core 11.2.1
• org.jgrapht:jgrapht-core 1.5.2

spoon-decompiler/pom.xml

• fr.inria.gforge.spoon:spoon-core 11.2.1
• org.jboss.windup.decompiler.fernflower:fernflower 2.5.0.Final
• org.bitbucket.mstrobel:procyon-compilertools 0.6.0
• org.benf:cfr 0.152
• org.apache.maven.plugins:maven-checkstyle-plugin 3.6.0

spoon-javadoc/pom.xml

• org.assertj:assertj-core 3.27.6

spoon-pom/pom.xml

• org.mockito:mockito-core 5.20.0
• org.junit.jupiter:junit-jupiter-engine 5.13.4
• org.junit.jupiter:junit-jupiter-params 5.13.4
• org.junit.platform:junit-platform-launcher 1.13.4
• org.mockito:mockito-junit-jupiter 5.20.0
• org.hamcrest:hamcrest 3.0
• org.assertj:assertj-core 3.27.6
• org.apache.maven.plugins:maven-jar-plugin 3.4.2
• org.kohsuke.metainf-services:metainf-services 1.11
• org.cyclonedx:cyclonedx-maven-plugin 2.9.1
• org.apache.maven.plugins:maven-antrun-plugin 3.1.0
• org.apache.maven.plugins:maven-assembly-plugin 3.7.1
• org.apache.maven.plugins:maven-clean-plugin 3.5.0
• org.apache.maven.plugins:maven-compiler-plugin 3.14.1
• org.apache.maven.plugins:maven-dependency-plugin 3.8.1
• org.apache.maven.plugins:maven-deploy-plugin 3.1.4
• org.apache.maven.plugins:maven-install-plugin 3.1.4
• org.apache.maven.plugins:maven-javadoc-plugin 3.12.0
• org.apache.maven.plugins:maven-project-info-reports-plugin 3.9.0
• org.apache.maven.plugins:maven-release-plugin 3.1.1
• org.apache.maven.plugins:maven-resources-plugin 3.3.1
• org.apache.maven.plugins:maven-site-plugin 3.21.0
• org.apache.maven.plugins:maven-surefire-plugin 3.5.4
• com.mycila:license-maven-plugin 5.0.0
• org.jacoco:jacoco-maven-plugin 0.8.13
• org.eluder.coveralls:coveralls-maven-plugin 4.3.0
• javax.xml.bind:jaxb-api 2.3.1
• org.sonatype.plugins:nexus-staging-maven-plugin 1.7.0
• org.apache.maven.wagon:wagon-ssh 3.5.3
• org.apache.maven.plugins:maven-source-plugin 3.3.1
• org.apache.maven.plugins:maven-gpg-plugin 3.2.8
• org.apache.maven.plugins:maven-deploy-plugin 3.1.4
• org.apache.maven.plugins:maven-source-plugin 3.3.1
• org.apache.maven.plugins:maven-deploy-plugin 3.1.4
• org.jacoco:jacoco-maven-plugin 0.8.13

spoon-smpl/pom.xml

• org.apache.maven.plugins:maven-checkstyle-plugin 3.6.0
• fr.inria.gforge.spoon:spoon-core 11.2.1
• fr.inria.gforge.spoon:spoon-control-flow 0.0.2-SNAPSHOT

spoon-visualisation/pom.xml

• org.apache.maven.plugins:maven-shade-plugin 3.6.1
• org.openjfx:javafx-maven-plugin 0.0.8
• io.github.interacto:interacto-javafx 4.3.1
• fr.inria.gforge.spoon:spoon-core 11.2.1
• org.openjfx:javafx-base 26-ea+6
• org.openjfx:javafx-graphics 26-ea+6
• org.openjfx:javafx-controls 26-ea+6
• org.openjfx:javafx-fxml 26-ea+6
• org.jetbrains:annotations 26.0.2-1
• org.junit.jupiter:junit-jupiter-engine 5.13.4
• org.testfx:testfx-junit5 4.0.18
• org.testfx:openjfx-monocle 21.0.2

nix

flake.nix

• nixpkgs nixos-unstable
• nixpkgs nixos-unstable@8eaee110344796db060382e15d3af0a9fc396e0e

npm

doc/_release/changelog_generator/package.json

• git-log-parser ^1.2.0
• through2 ^4.0.0

---

• Check this box to trigger a request for Renovate to run again on this repository

[monperrus]

@cesarsotovalero this PR shows a new cool feature of @renovate-bot

[MartinWitt]

We may use this issue for discussion about blocked dependency updates. @I-Al-Istannen had a fun debugging session for this problem(#4699 (comment)) and it seems like we need a newer version of maven-project-info plugin. The update was closed unmerged a while ago. Was there any concern with the new version, or can we update it?

[slarse]

The update was closed unmerged a while ago.

Which update? Linkety link?

[I-Al-Istannen]

I assume #4456. I think we should explicitly list the default plugins (like maven-site-plugin) we rely on, so renovate can update them too. It seems to have missed the site plugin update, as it is not declared anywhere? Once we update the site plugin, we can update the javadoc plugin and probably also the report plugin without further breakage.

[slarse]

I think we should explicitly list the default plugins (like maven-site-plugin)

Agreed. This is best practice AFAIK.

[slarse]

@MartinWitt There are some dependency lookup errors. Maybe that's causing trouble? I also don't see why it would and there's nothing I can find in the docs about it, but eh, it's something.

[MartinWitt]

Okay, I believe the branch protection was the problem. I will investigate this further and try to enable it. The UI is a bit confusing because we somehow have 2 ways now to do the same. GitHub rules and branch protection.

Currently, the master is not protected, so please don't test the branch protection and try to push to master.

[MartinWitt]

To keep the conversation about dependencies and renovate focused, let's use this issue for this topic. As the configuration is new for us, there will still be some changes needed.

#5180 we currently don't automerge pinning of hashes. Anyone against enabling it?

[slarse]

Dependency pinning is good, I vote for automerge.

[monperrus]

me too.

[MartinWitt]

Current unmerged dependency updates

• chore(deps): update dependency org.testfx:openjfx-monocle to v1.8.0_20

  UI related and the UI needs an update.

• chore(deps): update jetbrains/qodana-action action to v2023
  I am working on it.

• chore(deps): update plugin com.github.johnrengelman.shadow to v8y
  gradle 8 breaked some behaivour will have a look.

• fix(deps): update dependency org.jgrapht:jgrapht-core to v1
  open to debug

• fix(deps): update dependency org.slf4j:slf4j-api to v2
  We decided against this pr because breaking.

• fix(deps): update jfx.version to v21 (major) (org.openjfx:javafx-fxml, org.openjfx:javafx-controls, org.openjfx:javafx-graphics, org.openjfx:javafx-base)
  UI related.

Looks, we finally have the dependencies back in our control.

[monperrus]

About the last lookup problem, I've asked at renovatebot/renovate#6894 (comment)

[monperrus]

no more dependency lookup problem thanks to SpoonLabs/spoon-dependencies@4b8a7af