deps: bump the gradle group across 1 directory with 6 updates

[dependabot]

Bumps the gradle group with 6 updates in the / directory:

Package	From	To
net.minestom:minestom	2026.07.01-26.1.2	2026.07.22-26.2
com.github.spotbugs:spotbugs-annotations	4.10.2	4.10.3
club.tesseract.minestom:minestom-utils	0.2.4	0.2.5
ch.qos.logback:logback-classic	1.5.37	1.5.38
org.junit:junit-bom	6.1.1	6.1.2
com.github.spotbugs	6.5.8	6.5.9

Updates net.minestom:minestom from 2026.07.01-26.1.2 to 2026.07.22-26.2

Release notes

Sourced from net.minestom:minestom's releases.

2026.07.22-26.2

This release continues the registry work introduced in 26.2. Registry backed protocol objects now expose their data directly, and new registry access APIs prepare Minestom for further registry cleanup. Compatibility bridges remain in place so projects can migrate gradually. Though they will be removed in the future.

This release also fixes races during login and chunk loading, and corrects the motion blocking heightmap for fluid and nonstandard block states.

Registry Access

RegistryData is now deprecated. Data belonging to blocks, materials, entity types, attributes, potion effects, villager professions, block sound types, and other static protocol objects can be read directly from those objects (#3292).

For example:

float hardness = block.hardness();
boolean containsFluid = block.fluid();
Shape collisionShape = block.collisionShape();
EquipmentSlot equipmentSlot = material.equipmentSlot();
BoundingBox boundingBox = entityType.boundingBox();

The old registry() accessors remain available for now, but are deprecated for removal.

StaticProtocolObject now has an explicit registryKey() accessor #3293. Static protocol objects still implement RegistryKey in this release, but that inheritance will be removed in a future release. Code that needs a key should begin requesting it explicitly:

RegistryKey<Block> blockKey = block.registryKey();

Tool#isCorrectForDrops and Tool#getSpeed now have overloads which accept a RegistryKey<Block>. Their Block overloads are deprecated.

The registries for the current server process are now available through MinecraftServer.getRegistries() and ServerProcess#registries() (#3294). This avoids retrieving the entire server process when only its registries are needed:

Registries registries = MinecraftServer.getRegistries();

Generated registry keys and tags now use deterministic ordering (#3291). BuiltinRegistries.BIOME is also the new name for the biome registry key. The old BuiltinRegistries.WORLDGEN_BIOME field remains as a deprecated compatibility alias.

Migration Notes

Most migrations are direct replacements:

• Replace calls through registry() with the matching accessor on the protocol object. For example, block.registry().hardness() becomes block.hardness() and entityType.registry().eyeHeight() becomes entityType.eyeHeight().
• Replace Block#isAir, Block#isSolid, Block#isLiquid, and Block#isFluid with air, solid, liquid, and fluid. The old names are deprecated.
• Replace Material#isArmor with Material#armor and Attribute#isSynced with Attribute#synced.
• Block entity access now returns the protocol object rather than its key or numeric ID. Replace block.registry().isBlockEntity() with block.blockEntityType() != null. Replace block.registry().blockEntity() and block.registry().blockEntityId() with block.blockEntityType(), then use key() or id() on the null checked result when needed.
• Replace block.registry().getBlockSoundType() with block.blockSoundType().
• Replace entityType.registry().entityAttachments(name) with entityType.entityAttachments(name). The new method returns List<Vec> instead of raw coordinate lists. Code using the old singular entityAttachment(name) method should select the first entry when present.
• Use StaticProtocolObject#registryKey() anywhere a static protocol object is being used as a registry key.

... (truncated)

Commits

• 84ab796 fix: MotionBlockingHeightmap use fluid (#3305)
• 95c39f7 feat: Add static registry access (#3294)
• e95286d refactor: Bridge RegistryData accessors (#3292)
• 9e71471 Codegen order determistically & fix key WORLDGEN_BIOME to BIOME (#3291)
• 1250175 feat: add explicit #registryKey to StaticProtocolObject (#3293)
• 3ee0d03 chore: update GraalVM reachability metadata [skip ci]
• 37d97a3 feat: Enforce more Errorprone and Javac lints (#3303)
• 07d3d4b chore: bump the non-breaking group across 1 directory with 6 updates (#3299)
• a032afa feat: Add errorprone & update style checks (#3301)
• 8070029 fix: set profile prior to login success and make it volatile (#3300)
• Additional commits viewable in compare view

Updates com.github.spotbugs:spotbugs-annotations from 4.10.2 to 4.10.3

Release notes

Sourced from com.github.spotbugs:spotbugs-annotations's releases.

4.10.3

SpotBugs 4.10.3

CHANGELOG

Fixed

• Fix LI_LAZY_INIT_STATIC false negative when the null guard is written in yoda-style (null == field) (#4144)
• Fix DC_DOUBLECHECK, NP_SYNC_AND_NULL_CHECK_FIELD and SP_SPIN_ON_FIELD false negatives when the null guard is written in yoda-style (null == field) (#4144)
• Fix message for UNS_UNSAFE_CALL bug pattern
• Restore CLI plugin loading by fixing DetectorFactoryCollection bootstrap ordering (#4191)
• Fix UWF_NULL_FIELD false negative for fields initialized with cast null values (#4034)
• Fix UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASS false positive for methods reached only through method references (#4059)

Changed

• Ant FindBugsViewerTask: use default look and feel by default. (#4165)

Refactor

• Ant FindBugsViewerTask: extend AbstractFindBugsTask to reduce duplicate code. (#4165)

CHECKSUM

file	checksum (sha256)
spotbugs-4.10.3-javadoc.jar	9670d6569864fd9a45c4aa92f6e3dc2d11e2c24b4ff0a3eabe64b293dc3f0534
spotbugs-4.10.3-sources.jar	e00994265d6b771db8cc79edd70500ab8af6334f636d3ac7bf169c5d7daefcbc
spotbugs-4.10.3.tgz	53c03a77da9746ed0c17aae6c0a9419a12ddeb8bf61dd7209a2e417550afd01d
spotbugs-4.10.3.zip	e814ee5bf9665412658c4d684e45eae3cf993148a71bc8bc93fb343e92288151
spotbugs-annotations-4.10.3-javadoc.jar	5da6c2d1fe6ef37022dda7fdf221965bb6de57a0276e1735f518840f56ccab1f
spotbugs-annotations-4.10.3-sources.jar	87974d23caffbc8c6e66c567747627267b5ed06573cee966d7af6d236b8d65bd
spotbugs-annotations.jar	3fabaf088f8cd10803cc87dba4666cf874bdcd2e07ad154ed3fe403647ce3f2a
spotbugs-ant-4.10.3-javadoc.jar	fab78b3c109057689dc2057a18071b1a997048bb18b45ae39835c1007b18f440
spotbugs-ant-4.10.3-sources.jar	af1c78c8e194c2f82ea3e0517ab38a5eb6ba608c8d0e776c9097605d6b7efca6
spotbugs-ant.jar	9ec240477b7c87270be7dfe3196180cd3763f04c369e5691feeb12e66110a065
spotbugs.jar	5b12b471979fd8d664e9772d4c7e7e11b25a55d71dbb0ef2d2dcb749959052e7
test-harness-4.10.3-javadoc.jar	1a495602098f524a4a62f227bc556f75236a0231d08d7bedaeae73d478067e94
test-harness-4.10.3-sources.jar	805d2d124b0d4ea513ee9262d4ad6027c3471d45defd80fd7d20e23425d17df7
test-harness-4.10.3.jar	bd10d1f11a1b93e4ca4db4d27772f611bd3407f9452dbbd2d1ba62584ddc171f
test-harness-core-4.10.3-javadoc.jar	cb08bb86e5c9d5b4c4459ab103b9cd0dd99527a56f6fa645ec10d07b0fe75735
test-harness-core-4.10.3-sources.jar	043a55d99a517c0d9cf702b0c183b4afd3f03af9eff4a86d59bb37df1b35b532
test-harness-core-4.10.3.jar	1f9a0ee8f150dd71f960ca4f59dcf7912a45d0e9e6aefc4585fd44b975454bc0
test-harness-jupiter-4.10.3-javadoc.jar	02b463d272ccc7e6f9c7dcbfe7087da23afb6f9b8ad24316362397ae21fcf4cc
test-harness-jupiter-4.10.3-sources.jar	17144f315686bfd01c02fa4ae7c916060c41de8eed58d5b8470416fa08f46ced
test-harness-jupiter-4.10.3.jar	a91146da3e993479cfefd2690781cbd102c6360ecc63a96d88995be3bd60fcbb

Changelog

Sourced from com.github.spotbugs:spotbugs-annotations's changelog.

4.10.3 - 2026-07-12

Fixed

• Fix LI_LAZY_INIT_STATIC false negative when the null guard is written in yoda-style (null == field) (#4144)
• Fix DC_DOUBLECHECK, NP_SYNC_AND_NULL_CHECK_FIELD and SP_SPIN_ON_FIELD false negatives when the null guard is written in yoda-style (null == field) (#4144)
• Fix message for UNS_UNSAFE_CALL bug pattern
• Restore CLI plugin loading by fixing DetectorFactoryCollection bootstrap ordering (#4191)
• Fix UWF_NULL_FIELD false negative for fields initialized with cast null values (#4034)
• Fix UMAC_UNCALLABLE_METHOD_OF_ANONYMOUS_CLASS false positive for methods reached only through method references (#4059)

Changed

• Ant FindBugsViewerTask: use default look and feel by default. (#4165)

Refactor

• Ant FindBugsViewerTask: extend AbstractFindBugsTask to reduce duplicate code. (#4165)

Commits

• 8d5cad4 release v4.10.3
• f849bce Update junit-framework monorepo to v6.1.2 (#4199)
• 368a213 Fixes #4138 : Detect yoda-style null guards in lazy-init and related detector...
• 21ba538 Update actions/stale digest to 1e223db (#4197)
• 6c91a0d Update dependency net.sf.saxon:Saxon-HE to v12.10 (#4198)
• 7fb263e Update actions/setup-java digest to 0f481fc (#4196)
• c8f9bb1 fix(deprecations): Replace deprecated io close with try with resources (#4194)
• 1c78756 chore{build): Update eclipse-convention.gradle.kts file (#4193)
• 1aec284 fix: improve EQ_DOESNT_OVERRIDE_EQUALS warning to mention symmetry risk (#4016)
• f3ddc36 Fixes #4055 : Record method-reference targets as called methods (#4059)
• Additional commits viewable in compare view

Updates club.tesseract.minestom:minestom-utils from 0.2.4 to 0.2.5

Commits

• 01f3034 feat: accessors for permission node and permission group
• 43501ad feat: accessors for permission node and permission group
• See full diff in compare view

Updates ch.qos.logback:logback-classic from 1.5.37 to 1.5.38

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.5.38

2026-07-09 Release of logback version 1.5.38

• In HardenedObjectInputStream, fixed a typo preventing Throwable objects from being white-filtered. This issue was reported in [PR #1045](qos-ch/logback#1045) by t0rchwo0d.

• A bitwise identical binary of this version can be reproduced by building from source code at commit d04984a41fce42977466f45a2f076f0ee5cc4207 associated with the tag v_1.5.38. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits

• d04984a prepare release 1.5.38
• 4fffda6 updateversion of maven-gpg-plugin
• 7ee48a1 Fixed a typo where java,lang.Throwable was written with a comma instead of a ...
• 84580a2 remove license profile
• f817c8d start work on 1.5.28-SNAPSHOT
• See full diff in compare view

Updates org.junit:junit-bom from 6.1.1 to 6.1.2

Release notes

Sourced from org.junit:junit-bom's releases.

JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.1...r6.1.2

Commits

• b685426 Release 6.1.2
• ae244a6 Remove blanket outputDirectoryCreator from SuiteEngineTests (#5793)
• 43bd154 Finalize 6.1.2 release notes
• 0cd9510 Fix order of release note sections
• a1507cb Add initial 6.1.2 release notes to release notes index
• 9326641 Fix NoTestsDiscoveredException for suites containing only dynamic tests (#5839)
• 2ef1123 Create initial 6.1.2 release notes from template
• 83fa9ab Back to snapshots for further development
• See full diff in compare view

Updates com.github.spotbugs from 6.5.8 to 6.5.9

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions