chore(deps): update all non-major dependencies

[renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/setup-go	action	minor	v5.1.0 -> v5.3.0
actions/setup-java	action	minor	v4.5.0 -> v4.7.0
github/codeql-action	action	minor	v3.27.4 -> v3.28.10
ossf/scorecard-action	action	patch	v2.4.0 -> v2.4.1
step-security/harden-runner	action	minor	v2.10.2 -> v2.11.0
org.eclipse.jetty:jetty-client (source)	test	patch	9.4.56.v20240826 -> 9.4.57.v20241219
com.google.re2j:re2j	compile	minor	1.7 -> 1.8
org.mockito:mockito-core	test	minor	5.14.2 -> 5.16.0
org.apache.maven.plugins:maven-javadoc-plugin	build	patch	3.11.1 -> 3.11.2
org.eclipse.jetty:jetty-server (source)	compile	patch	9.4.56.v20240826 -> 9.4.57.v20241219
org.eclipse.jetty:jetty-servlet (source)	compile	patch	9.4.56.v20240826 -> 9.4.57.v20241219
org.apache.maven.plugins:maven-deploy-plugin	build	patch	3.1.3 -> 3.1.4
com.google.code.gson:gson	compile	minor	2.11.0 -> 2.12.1
com.google.cloud.tools:appengine-maven-plugin (source)	compile	patch	2.8.1 -> 2.8.3
com.google.cloud.functions.invoker:java-function-invoker (source)	compile	minor	1.3.1 -> 1.4.0
com.google.cloud.functions:functions-framework-api (source)	compile	patch	1.1.0 -> 1.1.4
com.google.guava:guava	compile	minor	33.3.1-jre -> 33.4.0-jre
org.apache.maven.plugins:maven-compiler-plugin	build	minor	3.13.0 -> 3.14.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

actions/setup-go (actions/setup-go)

v5.3.0

Compare Source

What's Changed

• Use the new cache service: upgrade @actions/cache to ^4.0.0 by @​Link- in https://github.com/actions/setup-go/pull/531
• Configure Dependabot settings by @​HarithaVattikuti in https://github.com/actions/setup-go/pull/530
• Document update - permission section by @​HarithaVattikuti in https://github.com/actions/setup-go/pull/533
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 by @​dependabot in https://github.com/actions/setup-go/pull/534

New Contributors

• @​Link- made their first contribution in https://github.com/actions/setup-go/pull/531

Full Changelog: actions/setup-go@v5...v5.3.0

v5.2.0

Compare Source

What's Changed

• Leveraging the raw API to retrieve the version-manifest, as it does not impose a rate limit and hence facilitates unrestricted consumption without the need for a token for Github Enterprise Servers by @​Shegox in https://github.com/actions/setup-go/pull/496

New Contributors

• @​Shegox made their first contribution in https://github.com/actions/setup-go/pull/496

Full Changelog: actions/setup-go@v5...v5.2.0

actions/setup-java (actions/setup-java)

v4.7.0

Compare Source

What's Changed

• Configure Dependabot settings by @​HarithaVattikuti in https://github.com/actions/setup-java/pull/722
• README Update: Added a permissions section by @​benwells in https://github.com/actions/setup-java/pull/723
• Upgrade cache from version 3.2.4 to 4.0.0 by @​aparnajyothi-y in https://github.com/actions/setup-java/pull/724
• Upgrade @actions/http-client from 2.2.1 to 2.2.3 by @​dependabot in https://github.com/actions/setup-java/pull/728
• Upgrade actions/publish-immutable-action from 0.0.3 to 0.0.4 by @​dependabot in https://github.com/actions/setup-java/pull/727
• Upgrade @types/jest from 29.5.12 to 29.5.14 by @​dependabot in https://github.com/actions/setup-java/pull/729

New Contributors

• @​benwells made their first contribution in https://github.com/actions/setup-java/pull/723

Full Changelog: actions/setup-java@v4...v4.7.0

v4.6.0

Compare Source

What's Changed

Add-ons:

• Add Support for JetBrains Runtime by @​gmitch215 in https://github.com/actions/setup-java/pull/637

 - name: Checkout
   uses: actions/checkout@v4
 - name: Setup-java
   uses: actions/setup-java@v4
   with:
     distribution: ‘jetbrains’
     java-version: '21'

Bug fixes:

• Fix Ubuntu-latest CI failures by @​mahabaleshwars in https://github.com/actions/setup-java/pull/693

New Contributors

• @​gmitch215 made their first contribution in https://github.com/actions/setup-java/pull/637

Full Changelog: actions/setup-java@v4...v4.6.0

github/codeql-action (github/codeql-action)

v3.28.10

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.10 - 21 Feb 2025

• Update default CodeQL bundle version to 2.20.5. #​2772
• Address an issue where the CodeQL Bundle would occasionally fail to decompress on macOS. #​2768

See the full CHANGELOG.md for more information.

v3.28.9

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.9 - 07 Feb 2025

• Update default CodeQL bundle version to 2.20.4. #​2753

See the full CHANGELOG.md for more information.

v3.28.8

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.8 - 29 Jan 2025

• Enable support for Kotlin 2.1.10 when running with CodeQL CLI v2.20.3. #​2744

See the full CHANGELOG.md for more information.

v3.28.7

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.7 - 29 Jan 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.28.6

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.6 - 27 Jan 2025

• Re-enable debug artifact upload for CLI versions 2.20.3 or greater. #​2726

See the full CHANGELOG.md for more information.

v3.28.5

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.5 - 24 Jan 2025

• Update default CodeQL bundle version to 2.20.3. #​2717

See the full CHANGELOG.md for more information.

v3.28.4

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.4 - 23 Jan 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.28.3

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.3 - 22 Jan 2025

• Update default CodeQL bundle version to 2.20.2. #​2707
• Fix an issue downloading the CodeQL Bundle from a GitHub Enterprise Server instance which occurred when the CodeQL Bundle had been synced to the instance using the CodeQL Action sync tool and the Actions runner did not have Zstandard installed. #​2710
• Uploading debug artifacts for CodeQL analysis is temporarily disabled. #​2712

See the full CHANGELOG.md for more information.

v3.28.2

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.2 - 21 Jan 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.28.1

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.28.1 - 10 Jan 2025

• CodeQL Action v2 is now deprecated, and is no longer updated or supported. For better performance, improved security, and new features, upgrade to v3. For more information, see this changelog post. #​2677
• Update default CodeQL bundle version to 2.20.1. #​2678

See the full CHANGELOG.md for more information.

v3.28.0

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.28.0 - 20 Dec 2024

• Bump the minimum CodeQL bundle version to 2.15.5. #​2655
• Don't fail in the unusual case that a file is on the search path. #​2660.

See the full CHANGELOG.md for more information.

v3.27.9

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.9 - 12 Dec 2024

No user facing changes.

See the full CHANGELOG.md for more information.

v3.27.8

Compare Source

v3.27.7

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.7 - 10 Dec 2024

• We are rolling out a change in December 2024 that will extract the CodeQL bundle directly to the toolcache to improve performance. #​2631
• Update default CodeQL bundle version to 2.20.0. #​2636

See the full CHANGELOG.md for more information.

v3.27.6

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.6 - 03 Dec 2024

• Update default CodeQL bundle version to 2.19.4. #​2626

See the full CHANGELOG.md for more information.

v3.27.5

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

3.27.5 - 19 Nov 2024

No user facing changes.

See the full CHANGELOG.md for more information.

ossf/scorecard-action (ossf/scorecard-action)

v2.4.1

Compare Source

What's Changed

• This update bumps the Scorecard version to the v5.1.1 release. For a complete list of changes, please refer to the v5.1.0 and v5.1.1 release notes.
• Publishing results now uses half the API quota as before. The exact savings depends on the repository in question.
  • use Scorecard library entrypoint instead of Cobra hooking by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1423
• Some errors were made into annotations to make them more visible
  • Make default branch error more prominent by @​jsoref in https://github.com/ossf/scorecard-action/pull/1459
• There is now an optional file_mode input which controls how repository files are fetched from GitHub. The default is archive, but git produces the most accurate results for repositories with .gitattributes files at the cost of analysis speed.
  • add input for specifying --file-mode by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1509
• The underlying container for the action is now hosted on GitHub Container Registry. There should be no functional changes.
  • 🌱 publish docker images to GitHub Container Registry by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1453

Docs

• Installation docs update by @​JeremiahAHoward in https://github.com/ossf/scorecard-action/pull/1416

New Contributors

• @​JeremiahAHoward made their first contribution in https://github.com/ossf/scorecard-action/pull/1416
• @​jsoref made their first contribution in https://github.com/ossf/scorecard-action/pull/1459
  Full Changelog: ossf/scorecard-action@v2.4.0...v2.4.1

step-security/harden-runner (step-security/harden-runner)

v2.11.0

Compare Source

What's Changed

Release v2.11.0 in #​498
Harden-Runner Enterprise tier now supports the use of eBPF for DNS resolution and network call monitoring

Full Changelog: step-security/harden-runner@v2...v2.11.0

v2.10.4

Compare Source

What's Changed

Fixed a potential Harden-Runner post step failure that could occur when printing agent service logs. The fix gracefully handles failures without failing the post step.

Full Changelog: step-security/harden-runner@v2...v2.10.4

v2.10.3

Compare Source

What's Changed

Fixed an issue where DNS requests using uppercase characters (e.g., EXAMPLE.com) were blocked even when the domain was present in the allowed list. This update standardizes domain names to lowercase for consistent comparison.

Full Changelog: step-security/harden-runner@v2...v2.10.3

mockito/mockito (org.mockito:mockito-core)

v5.16.0

^{Changelog generated by Shipkit Changelog Gradle Plugin}

5.16.0

• 2025-03-03 - 10 commit(s) by Brice Dutheil, Rafael Winterhalter, TDL, dependabot[bot]
• Add support for including module-info in Mockito. (#​3597)
• Bump com.gradle.develocity from 3.19 to 3.19.1 (#​3579)
• Bump org.assertj:assertj-core from 3.27.2 to 3.27.3 (#​3577)
• Bump com.diffplug.spotless:spotless-plugin-gradle from 7.0.1 to 7.0.2 (#​3574)
• Bump com.diffplug.spotless:spotless-plugin-gradle from 6.25.0 to 7.0.1 (#​3571)
• Bump org.assertj:assertj-core from 3.27.1 to 3.27.2 (#​3569)
• Tweaks documentation on mockito agent config for maven (#​3568)
• Adds --info to diagnose closeAndReleaseStagingRepositories issues (#​3567)
• Refine reflection when calling management factory (#​3566)
• Avoid warning when dynamic attach is enabled (#​3551)

v5.15.2

Compare Source

^{Changelog generated by Shipkit Changelog Gradle Plugin}

5.15.2

• 2025-01-02 - 2 commit(s) by Brice Dutheil, dependabot[bot]
• Fix javadoc publication (#​3561)
• Bump org.assertj:assertj-core from 3.27.0 to 3.27.1 (#​3560)
• The release job is failed again (#​3542)

---

Configuration

📅 Schedule: Branch creation - "* 0-3 1 * *" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[ghost]

Gemini encountered an error creating the summary. You can try again by commenting @code-review-assist summarize.

[forking-renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.