Bump the maven group across 2 directories with 5 updates#1
Bump the maven group across 2 directories with 5 updates#1dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps the maven group with 3 updates in the /PaperSpigot-API directory: [com.google.code.gson:gson](https://github.com/google/gson), [org.yaml:snakeyaml](https://bitbucket.org/snakeyaml/snakeyaml) and [junit:junit](https://github.com/junit-team/junit4). Bumps the maven group with 3 updates in the /PaperSpigot-Server directory: [junit:junit](https://github.com/junit-team/junit4), org.apache.logging.log4j:log4j-core and [org.xerial:sqlite-jdbc](https://github.com/xerial/sqlite-jdbc). Updates `com.google.code.gson:gson` from 2.2.4 to 2.8.9 - [Release notes](https://github.com/google/gson/releases) - [Changelog](https://github.com/google/gson/blob/main/CHANGELOG.md) - [Commits](google/gson@gson-2.2.4...gson-parent-2.8.9) Updates `org.yaml:snakeyaml` from 1.15 to 2.0 - [Commits](https://bitbucket.org/snakeyaml/snakeyaml/branches/compare/snakeyaml-2.0..v1.15) Updates `junit:junit` from 4.12 to 4.13.1 - [Release notes](https://github.com/junit-team/junit4/releases) - [Changelog](https://github.com/junit-team/junit4/blob/main/doc/ReleaseNotes4.12.md) - [Commits](junit-team/junit4@r4.12...r4.13.1) Updates `junit:junit` from 4.11 to 4.13.1 - [Release notes](https://github.com/junit-team/junit4/releases) - [Changelog](https://github.com/junit-team/junit4/blob/main/doc/ReleaseNotes4.12.md) - [Commits](junit-team/junit4@r4.12...r4.13.1) Updates `org.apache.logging.log4j:log4j-core` from 2.17.0 to 2.17.1 Updates `org.xerial:sqlite-jdbc` from 3.7.2 to 3.41.2.2 - [Release notes](https://github.com/xerial/sqlite-jdbc/releases) - [Changelog](https://github.com/xerial/sqlite-jdbc/blob/master/CHANGELOG) - [Commits](xerial/sqlite-jdbc@sqlite-jdbc-3.7.2...3.41.2.2) --- updated-dependencies: - dependency-name: com.google.code.gson:gson dependency-version: 2.8.9 dependency-type: direct:production dependency-group: maven - dependency-name: org.yaml:snakeyaml dependency-version: '2.0' dependency-type: direct:production dependency-group: maven - dependency-name: junit:junit dependency-version: 4.13.1 dependency-type: direct:development dependency-group: maven - dependency-name: junit:junit dependency-version: 4.13.1 dependency-type: direct:development dependency-group: maven - dependency-name: org.apache.logging.log4j:log4j-core dependency-version: 2.17.1 dependency-type: direct:production dependency-group: maven - dependency-name: org.xerial:sqlite-jdbc dependency-version: 3.41.2.2 dependency-type: direct:production dependency-group: maven ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
WalkthroughDependency version updates were made in two Maven modules. PaperSpigot-API/pom.xml updates gson, SnakeYAML, and JUnit versions. PaperSpigot-Server/pom.xml updates a JUnit property, Log4j Core, and SQLite JDBC versions. No code or plugin configuration changes were included. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
PaperSpigot-Server/pom.xml (1)
72-77: sqlite-jdbc jump (3.7.2 → 3.41.2.2): test native extraction on multiple OSes; watch shaded fat-jar size.This is a large upgrade spanning many native loader changes. Since the server jar is shaded, validate:
- Driver auto-loading still occurs (JDBC 4) and no “no suitable driver” issues.
- Native extraction works on Linux and Windows (paths and tmp perms can bite CI/containers).
Please smoke-test DB features on Linux and Windows. If you see native extraction issues, consider excluding sqlite-jdbc from shading and loading it on the classpath instead.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled
- Linear integration is disabled
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
PaperSpigot-API/pom.xml(3 hunks)PaperSpigot-Server/pom.xml(3 hunks)
🔇 Additional comments (4)
PaperSpigot-Server/pom.xml (2)
14-14: JUnit bump to 4.13.1 looks safe; confirm Surefire compatibility.Given you’re on maven-surefire-plugin 2.18 (Lines 267-276), JUnit 4.13.1 is supported. No action needed beyond a quick test run.
Please run your unit tests locally to confirm no JUnit rule/assumption changes affect legacy tests.
45-49: Please verify Log4j alignment and clean up the stray comment
- The Maven Shade Plugin correctly excludes all
org/apache/logging/log4j/**classes from theorg.spigotmc:minecraft-serverartifact, so your shaded JAR won’t bundle any old Log4j bits.- You’ve added
log4j-core:2.17.1, which transitively pulls inlog4j-api:2.17.1, but we can’t run Maven here. On your machine, please run:to confirm that bothmvn -q -pl PaperSpigot-Server -am dependency:tree | grep -i 'log4j'log4j-apiandlog4j-coreresolve to 2.17.1. If you spot any other versions, add an explicit<dependency>onorg.apache.logging.log4j:log4j-api:2.17.1to force alignment.- Nit: the comment on the SpecialSource plugin version is misleading. In your POM around line 232, update or remove:
- <version>1.2.3</version> <!-- paper - bump log4j --> + <version>1.2.3</version> <!-- paper – specialsource-maven-plugin version bump -->PaperSpigot-API/pom.xml (2)
79-82: Gson 2.8.9 upgrade: OK; watch for subtle serialization differences from 2.2.4.This brings years of fixes. In rare cases, older custom TypeAdapters/InstanceCreators rely on pre-2.5 behavior. Run API serialization tests to be safe.
If you have JSON golden files, re-run them to confirm no output diffs. If diffs appear, pin a date format via GsonBuilder for stability.
105-109: JUnit 4.13.1 for API tests: LGTM.Brings small fixes without changing test semantics. No additional changes expected.
| <groupId>org.yaml</groupId> | ||
| <artifactId>snakeyaml</artifactId> | ||
| <version>1.15</version> | ||
| <version>2.0</version> | ||
| <scope>compile</scope> | ||
| </dependency> |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
SnakeYAML 2.0 can be breaking vs 1.15; scan for old constructors/usages.
2.x tightened/removed some deprecated APIs and encourages configuring LoaderOptions/DumperOptions explicitly. Legacy calls like new Yaml(new Constructor(...)) may need option objects.
Run this repo-wide check to spot likely breakers:
If you hit API breaks, consider upgrading to 1.33 as an interim (last 1.x with many fixes) or update code to pass LoaderOptions explicitly.
🏁 Script executed:
#!/bin/bash
# Look for common patterns that changed across 1.x -> 2.x
rg -n -C2 -tjava -e '\bnew\s+Yaml\s*\(' -e '\bnew\s+Constructor\s*\(' -e '\bDumperOptions\b' -e '\bLoaderOptions\b'Length of output: 4003
Address SnakeYAML 2.0 compatibility issues
We’ve verified that upgrading to SnakeYAML 2.0 will break existing code paths that rely on the old constructor overloads and default option behaviors. In particular, the following locations need your attention:
• PaperSpigot-Server/src/main/java/org/bukkit/craftbukkit/CraftServer.java:
– Line 145: new Yaml(new SafeConstructor())
• PaperSpigot-API/src/main/java/org/bukkit/plugin/PluginDescriptionFile.java:
– Line 181: new Yaml(new SafeConstructor() { … })
• PaperSpigot-API/src/main/java/org/bukkit/configuration/file/YamlConfiguration.java:
– Lines 28–30:
• private final DumperOptions yamlOptions = new DumperOptions();
• private final Yaml yaml = new Yaml(new YamlConstructor(), yamlRepresenter, yamlOptions);
These usages rely on lax defaults that 2.x no longer provides. You’ve two paths forward:
- Revert to the latest 1.x release (e.g. 1.33) to pick up bugfixes without breaking API changes.
- Modernize your SnakeYAML calls by explicitly creating and passing
LoaderOptionsandDumperOptionsinstances configured to mirror the old defaults (or your desired behavior). For example:LoaderOptions loaderOpts = new LoaderOptions(); loaderOpts.setAllowDuplicateKeys(true); // …set other options to restore legacy behavior… Yaml yaml = new Yaml(new SafeConstructor(loaderOpts), new Representer(), new DumperOptions());
Please update the impacted constructors and option setups before merging this dependency bump, or pin the version back to 1.x until you’ve completed the refactor.
🤖 Prompt for AI Agents
In PaperSpigot-API/pom.xml lines 90-94 and the referenced source files
(PaperSpigot-Server/src/main/java/org/bukkit/craftbukkit/CraftServer.java line
145; PaperSpigot-API/src/main/java/org/bukkit/plugin/PluginDescriptionFile.java
line 181;
PaperSpigot-API/src/main/java/org/bukkit/configuration/file/YamlConfiguration.java
lines 28-30) the project was updated to SnakeYAML 2.0 which changes constructor
overloads and defaults; fix by either reverting the dependency to the latest 1.x
(e.g. 1.33) in pom.xml, or update each Yaml instantiation to explicitly create
and pass LoaderOptions and DumperOptions configured to restore the previous
behavior (e.g., set allowDuplicateKeys and any other legacy flags on
LoaderOptions, construct SafeConstructor/Constructor with that LoaderOptions,
and pass matching DumperOptions/Representer) so the existing code paths keep
their prior semantics before merging.
1 participant
Bumps the maven group with 3 updates in the /PaperSpigot-API directory: com.google.code.gson:gson, org.yaml:snakeyaml and junit:junit.
Bumps the maven group with 3 updates in the /PaperSpigot-Server directory: junit:junit, org.apache.logging.log4j:log4j-core and org.xerial:sqlite-jdbc.
Updates
com.google.code.gson:gsonfrom 2.2.4 to 2.8.9Release notes
Sourced from com.google.code.gson:gson's releases.
Changelog
Sourced from com.google.code.gson:gson's changelog.
... (truncated)
Commits
6a368d8[maven-release-plugin] prepare release gson-parent-2.8.9ba96d53Fix missing bounds checks for JsonTreeReader.getPath() (#2001)ca1df7f#1981: Optional OSGi bundle's dependency on sun.misc package (#1993)c54caf3DeprecateGson.excluder()exposing internalExcluderclass (#1986)e6fae59Prevent Java deserialization of internal classes (#1991)bda2e3dImprove number strategy implementation (#1987)cd748dfFix LongSerializationPolicy null handling being inconsistent with Gson (#1990)fe30b85Support arbitrary Number implementation for Object and Number deserialization...1cc1627Fix incorrect feature request template label (#1982)7b9a283Bump bnd-maven-plugin from 5.3.0 to 6.0.0 (#1985)Updates
org.yaml:snakeyamlfrom 1.15 to 2.0Commits
c98ffbaissue 561: add negative test casee2ca740Use Maven wrapper on github49d91a1Fix target for github19e331dDisable toolchain for github42c7812Cobertura plugin does not work03c82b5Rename GlobalTagRejectionTest to be run by Maven6e8cd89Remove coberturad9b0f48Improve Javadoc519791aRun install and site goals under docker82f33d2Merge branch 'master' into add-module-infoUpdates
junit:junitfrom 4.12 to 4.13.1Release notes
Sourced from junit:junit's releases.
Commits
1b683f4[maven-release-plugin] prepare release r4.13.1ce6ce3aDraft 4.13.1 release notesc29dd82Change version to 4.13.1-SNAPSHOT1d17486Add a link to assertThrows in exception testing543905dUse separate line for annotation in Javadoc510e906Add sub headlines to class Javadoc610155bMerge pull request from GHSA-269g-pwp5-87ppb6cfd1eExplicitly wrap float parameter for consistency (#1671)a5d205cFix GitHub link in FAQ (#1672)3a5c6b4Deprecated since jdk9 replacing constructor instance of Double and Float (#1660)Updates
junit:junitfrom 4.11 to 4.13.1Release notes
Sourced from junit:junit's releases.
Commits
1b683f4[maven-release-plugin] prepare release r4.13.1ce6ce3aDraft 4.13.1 release notesc29dd82Change version to 4.13.1-SNAPSHOT1d17486Add a link to assertThrows in exception testing543905dUse separate line for annotation in Javadoc510e906Add sub headlines to class Javadoc610155bMerge pull request from GHSA-269g-pwp5-87ppb6cfd1eExplicitly wrap float parameter for consistency (#1671)a5d205cFix GitHub link in FAQ (#1672)3a5c6b4Deprecated since jdk9 replacing constructor instance of Double and Float (#1660)Updates
org.apache.logging.log4j:log4j-corefrom 2.17.0 to 2.17.1Updates
org.xerial:sqlite-jdbcfrom 3.7.2 to 3.41.2.2Release notes
Sourced from org.xerial:sqlite-jdbc's releases.
... (truncated)
Commits
080c808chore(release): 3.41.2.2 [skip ci]edb4b8afix: use random UUID for external resources0c5a645ci: replace jdk 19 with 2048e8ebebuild(deps): bump native-maven-plugin from 0.9.21 to 0.9.2200e9c3fdocs: use markdown for SECURITY.md because Github doesn't support Asciidoc0053e60ci: replace asciidoc variables during releasefb0f263docs: convert markdown to asciidoc128d9b2build(deps): bump graal-sdk from 22.3.0 to 22.3.2658e907build(deps): bump surefire.version from 3.0.0 to 3.1.0f149f9fbuild(deps): bump maven-gpg-plugin from 3.0.1 to 3.1.0Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by CodeRabbit