[delphyne]

Summary

Resolves all 30 open Dependabot alerts (#60–#93: 1 critical, 15 high, 14 medium). The fixes come mainly from upgrading top-level dependencies and plugins; transitive pins remain only where no upstream release fixes the issue yet.

Alerts	Package	Fix	Ships?
#60, #78, #79, #81, #83, #86, #87, #90, #92	tools.jackson 3.1.4	Direct bump to 3.2.3	Yes
#72	log4j-api 2.26.0	Direct bump to 2.26.1	Yes
#93	plexus-utils 3.6.0	cyclonedx 3.4.1 brings 3.6.1, no pin needed	No (build-time)
#80, #82, #84, #85, #88, #89, #91	jackson 2.x 2.22.1	cyclonedx 3.4.1 still brings 2.22.1, so the existing buildscript force goes from 2.22.1 to 2.22.3	No (build-time)
#61–#70	Netty 4.1.135	grpc 1.84.0 moves to Netty 4.2.16	No (test-only)
#73, #74, #75	Netty 4.2.16	Netty 4.2.16 is still affected; fixes need 4.2.17+. The five per-module 4.1 constraints become one netty-bom:4.2.19.Final platform on the envoy suite	No (test-only)

Commits

1. Gradle wrapper: 9.5.0 → 9.8.0.
2. Build plugins:
   • cyclonedx 3.4.1, protobuf-plugin 0.10.0, license-report 3.1.4, graalvm-native 0.11.5.
   • The reachability metadata repository goes from 0.3.24 to 0.3.35 (0.11.5 requires ≥ 0.3.33).
   • The Jackson 2.x pin goes to 2.22.3.
3. Runtime libraries:
   • Jackson 3.2.3, log4j 2.26.1, Kotlin 2.4.20, protobuf 4.36.2, common-protos 2.78.0, commonmark 0.30.0, json-schema-validator 3.0.8.
   • Native-image metadata is regenerated per CONTRIBUTING.md. The additions are JDK switch bootstraps from Kotlin 2.4 and networknt's jsv-messages bundle.
4. Test dependencies: grpc 1.84.0, kotlinx-coroutines 1.11.0, kotest 6.2.5, and the Netty BOM.

Notes for reviewers

• Jackson 3.2 behaviour change (test model only).
  • Jackson 3.2 now evaluates class-level @JsonInclude(NON_DEFAULT) against a default-constructed instance. That dropped @type, proto_descriptor and services from the envoy example's GrpcJsonTranscoder config.
  • Envoy then refused to start, and the suite stalled on its readiness wait.
  • Those properties are now marked JsonInclude.ALWAYS. Shipped code does not use NON_DEFAULT.
• graalvm-native stays on 0.x.
  • Plugin 1.x requires a GraalVM that ships the reachability-metadata schema (GraalVM 25). GraalVM CE for JDK 21 ends at 21.0.2.
  • Moving the native toolchain to JDK 25 is left for a follow-up PR.
• graal-sdk stays at 23.1.2 to match the GraalVM CE 21.0.2 toolchain.
• Kotlin 2.4 creates a root .kotlin/ directory, which is now in .gitignore.

Test plan

• ./gradlew build: 225 example tests passed, including the envoy suite.
• ./gradlew -Pagent :protoc-gen-openapi-examples:check → metadataCopy → check → :nativeCompile.
• buildEnvironment / dependencies show plexus-utils 3.6.1, jackson 2.22.3 / 3.2.3, log4j-api 2.26.1, all Netty modules at 4.2.19.Final, and no Netty 4.1.
• CI native builds on all platforms.
• After merge: dependabot-update.yaml resubmits the graph; confirm the open alert count drops to 0.

🤖 Generated with Claude Code