Bump the gradle-dependencies group across 1 directory with 24 updates

gradle/libs.versions.toml

@@ -13,20 +13,20 @@
 java = "21"
 
 # Build / quality
-spotless = "8.8.0"
-errorprone-plugin = "5.1.0"
+spotless = "8.10.3"
+errorprone-plugin = "5.1.1"
 errorprone-core = "2.50.0"
 google-java-format = "1.25.2"
-jspecify = "1.0.0"
+jspecify = "1.0.1"
 
 # Runtime — core / serialization / observability (pinned to pk-auth)
 # Jackson 3 ("tools.jackson") — java.time and JDK 8 datatype support is built into databind 3,
 # so we do not pull jackson-datatype-jdk8 / jackson-datatype-jsr310 separately.
 jackson = "3.2.3"
 jackson-annotations = "2.22"
-caffeine = "3.2.4"
-micrometer = "1.17.0"
-slf4j = "2.0.18"
+caffeine = "3.3.0"
+micrometer = "1.17.1"
+slf4j = "2.0.20"
 
 # Dagger 2 — compile-time DI for the Dropwizard tier (NFR-2, no Spring). Pinned to pk-auth.
 dagger = "2.60.1"
@@ -37,38 +37,38 @@ jakarta-inject = "2.0.1"
 dropwizard = "5.0.2"
 
 # Persistence — JDBI/PostgreSQL backend (phase 2, tumbling reference). Pinned to pk-auth's jdbi.
-jdbi = "3.54.0"
+jdbi = "3.55.0"
 postgresql = "42.7.13"
 hikaricp = "7.1.0"
 
 # Persistence — Redis backend (phase 2, sliding/hot-path reference). Lettuce is the async Redis
 # client; velocity-only, so it tracks the current latest 6.x.
-lettuce = "7.6.0.RELEASE"
+lettuce = "7.8.0.RELEASE"
 
 # Testing — Testcontainers for the backend integration tests (Postgres now; Redis/LocalStack later).
 testcontainers = "1.21.4"
 
 # OpenAPI parsing — validates the committed velocity-api spec is well-formed OpenAPI 3.1 in a test
 # (velocity-api OpenApiSpecTest). velocity-only; tracks the current latest 2.1.x.
-swagger-parser = "2.1.22"
+swagger-parser = "2.1.48"
 
 # Test bundle (wired in the test convention plugin). Pinned to pk-auth.
-junit-jupiter = "6.1.2"
+junit-jupiter = "6.1.3"
 assertj = "3.27.7"
-mockito = "5.23.0"
-logback = "1.5.38"
+mockito = "5.24.0"
+logback = "1.6.5"
 
 # Security floors for transitive dependencies (see the "Transitive security floors" block in
 # velocity.java-conventions). None of these are direct dependencies of ours — they arrive
 # transitively (Netty via Lettuce, Jackson 2.x/logback via Dropwizard, commons-compress via
 # Testcontainers, rhino via swagger-parser). Each value is the first patched release for the
 # corresponding Dependabot advisory; it is applied as a *floor*, not a pin, so a higher version
 # on any resolution path still wins. Dependabot keeps these current on its weekly gradle run.
-netty = "4.2.15.Final"          # netty-handler / netty-resolver-dns advisories (GHSA, high)
-jackson2 = "2.21.5"             # jackson-databind 2.x case-insensitive @JsonIgnoreProperties bypass
-commons-compress = "1.26.0"     # Pack200 OOM + corrupted-DUMP infinite-loop DoS
-commons-lang3 = "3.18.0"        # uncontrolled recursion on long inputs
-rhino = "1.7.14.1"              # toFixed() high-CPU DoS
+netty = "4.2.18.Final"          # netty-handler / netty-resolver-dns advisories (GHSA, high)
+jackson2 = "2.22.3"             # jackson-databind 2.x case-insensitive @JsonIgnoreProperties bypass
+commons-compress = "1.28.0"     # Pack200 OOM + corrupted-DUMP infinite-loop DoS
+commons-lang3 = "3.21.0"        # uncontrolled recursion on long inputs
+rhino = "1.9.1"              # toFixed() high-CPU DoS
 
 [libraries]
 jspecify = { module = "org.jspecify:jspecify", version.ref = "jspecify" }

gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=9c0f7faeeb306cb14e4279a3e084ca6b596894089a0638e68a07c945a32c9e14
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
+distributionSha256Sum=bafd5ce9cfaea0fbccfdc8439a1ac42fbd4cd9c89dc9a988228d8a2639a58e6c
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.8.0-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500

settings.gradle.kts

@@ -10,7 +10,7 @@ plugins {
     // Maven Central publishing via Sonatype Central Portal. The aggregation plugin is auto-applied
     // to subprojects with `maven-publish` — `./gradlew publishAggregationToCentralPortal` uploads
     // every signed publication to the Central Portal in a single bundle (NFR-16).
-    id("com.gradleup.nmcp.settings") version "1.6.1"
+    id("com.gradleup.nmcp.settings") version "1.6.2"
 }
 
 rootProject.name = "velocity-engine"