build(deps): bump build plugins and analysis tooling to current

[bernardladenthin]

Summary

Pure version maintenance, no behaviour change. One of four coordinated PRs (jllama / srcmorph / BAF / streambuffer).

Cross-repo drift, closed. The four sibling repos deliberately run the same toolchain versions; BitcoinAddressFinder pulled ahead when its Dependabot PRs were merged.

	before	after
maven-compiler-plugin	3.15.0	3.16.0
maven-surefire-plugin	3.5.6	3.6.0
nullaway	0.14.0	0.14.1

Behind current upstream in all four repos.

	before	after
git-commit-id-maven-plugin	10.0.0	10.0.1
spotless-maven-plugin	3.10.1	3.10.2
spotbugs-maven-plugin	4.10.4.0	4.10.4.1
checker / checker-qual	4.2.2	4.2.3
lombok	1.18.46	1.18.48
slf4j-api / slf4j-simple	2.0.18	2.0.19

This reactor keeps the tooling properties per module rather than in the parent, so the first six move in all three of srcmorph, srcmorph-cli and srcmorph-maven-plugin; checker-qual and both slf4j artifacts are pinned as literals in the parent's dependencyManagement and move there.

The checker bump moves one property that feeds both the annotation processor and the qualifiers, and that coupling is the point: the Nullness Checker resolves its own qualifiers through javac's symbol table, so the two must share a major version — the lesson from the 3.55.1 pin reverted in java-llama.cpp. The prose in the checker-qual comment is updated to match.

logback-classic stays at 1.6.3, which is current; it is test-scope only here (ListAppender capture) and never reaches an artifact.

Deliberately NOT bumped: jqwik stays at 1.9.3. Releases from 1.10.0 on print a prompt-injection string aimed at AI coding agents, and the workspace policy requires rejecting any PR that moves it. Dependabot will keep proposing it.

Test plan

• Reactor mvn clean verify green — 654 + 39 + 32 tests, 0 failures (spotless, spotbugs, enforcer, javadoc included)
• PIT at the 100 gate reactor-wide: 807 / 16 / 62 mutations, all 100% killed
• Class-file gate clean across all three modules' targets: 3206 classes in 16 jars, 0 above major 52
• spotless 3.10.2 reformats nothing — the working tree after spotless:apply holds only the four pom edits
• CI is green on this branch
• No source or test change; poms only

Local verification used -Dllama.version=5.2.0-SNAPSHOT against a locally installed core, since net.ladenthin:llama:5.2.0 is not published yet — the same constraint the repo's CI is under.

Related PRs

Same change in java-llama.cpp, streambuffer and BitcoinAddressFinder (category 2 only — BAF already carries category 1).

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits
• No security-sensitive changes

🤖 Generated with Claude Code

https://claude.ai/code/session_01AnNYn8W1xuVxVJtyL34GyH

---

Generated by Claude Code

[claude]

✅ Review Complete

Summary: This is a clean, well-coordinated dependency and plugin version bump across all three reactor modules. All changes are consistent and properly tested.

Strengths

1. Version Consistency — All tool and plugin versions are uniformly bumped across srcmorph, srcmorph-cli, and srcmorph-maven-plugin. No drift between modules.

2. Proper Constraint Maintenance — The critical checker/checker-qual version coupling is correctly preserved:

   • Parent pom.xml now pins checker-qual:4.2.3
   • All three modules use checker.version=4.2.3 for the annotation processor
   • Comment in parent POM updated to reflect the new version
   • Per CLAUDE.md, these must share a major version, and they do ✓

3. Deliberate Exclusions — The PR correctly avoids bumping jqwik beyond 1.9.3 and keeps logback-classic at 1.6.3 (test-scope only), both per documented policy.

4. Comprehensive Verification — Test plan shows:

   • Full reactor build: 725 tests passing
   • PIT at 100% mutation kill threshold across all modules
   • Class-file bytecode gate (major ≤ 52) clean
   • Spotless formatting verified
   • No breaking changes to source/tests

5. Cross-Repo Coordination — Addresses drift with sibling repos (java-llama.cpp, streambuffer, BAF).

No Issues Found

• ✓ No security vulnerabilities in the bumped versions
• ✓ No breaking API changes in scope
• ✓ No bytecode floor violations (Java 8 target maintained)
• ✓ No unintended transitive dependencies introduced
• ✓ All POM structure and organization preserved

Ready to merge. 🚀