[dependabot]

Bumps the test group with 3 updates: net.bytebuddy:byte-buddy, org.apache.maven.plugins:maven-enforcer-plugin and io.vavr:vavr.

Updates net.bytebuddy:byte-buddy from 1.18.15 to 1.18.16

Release notes

Sourced from net.bytebuddy:byte-buddy's releases.

Byte Buddy 1.18.16

• Correct detection of a dropped implicit this frame in constructors with long or double parameters when using Advice.
• Detect a dropped uninitialized this frame in constructors after full frames when using Advice with copied arguments.
• Update ASM to version 9.11.1 and the ASM to Class File API bridge to version 0.0.14.
• Use a valid tag for the Gradle plugin portal.

Changelog

Sourced from net.bytebuddy:byte-buddy's changelog.

23. October 2026: version 1.18.16

• Correct detection of a dropped implicit this frame in constructors with long or double parameters when using Advice.
• Detect a dropped uninitialized this frame in constructors after full frames when using Advice with copied arguments.
• Update ASM to version 9.11.1 and the ASM to Class File API bridge to version 0.0.14.
• Use a valid tag for the Gradle plugin portal.

Commits

• 0229449 [publish] Releasing Byte Buddy 1.18.16
• 29c1a29 [release] Complete failed release from where it failed.
• 2f7c4ed Change tag which was rejected.
• 6ade578 [release] Release new version
• 7d6ad78 Update checksums
• d7bf69f Detect dropped uninitialized 'this' frame in constructors after full frames.
• 2901502 Compare constructor frame divergence in frame entries rather than slots.
• 8ade117 Update ASM and bridge.
• 4e25942 [publish] Start next development iteration 1.18.16-SNAPSHOT
• See full diff in compare view

Updates org.apache.maven.plugins:maven-enforcer-plugin from 3.6.3 to 3.7.0

Release notes

Sourced from org.apache.maven.plugins:maven-enforcer-plugin's releases.

3.7.0

⚠️ Deprecated

• Name enforcer 4.0.0 as the release that removes the legacy rule API (#1047) @​slachiewicz
• Deprecate the evaluateBeanshell rule (#1034) @​slachiewicz

🚀 New features and improvements

• Improve RequireUpperBoundDeps error message (#1059) @​Sambuddha-Jana
• [MENFORCER-433] - Add banPropertyPrefix rule to ban Maven properties by configured prefixes (#1039) @​juliojgd
• Improve RequireUpperBoundDeps error message (#1022) @​dhruv9b
• [ENFORCER-939] - Support enforcer.skip without a POM (#1021) @​dhruv9b

🐛 Bug Fixes

• Fix RequireUpperBoundDeps with test-scope mediation (#1064) @​efegokdemir
• Fix EnforcerRuleCache concurrency across plugin realms (#1057) @​efegokdemir
• Resolve plugins on copies of the model plugins (#1046) @​slachiewicz
• [MENFORCER-517] - RequireReleaseDeps checks now also for optional dependencies (#1025) @​schwarfl
• fix: avoid misleading legacy warning for unknown rules (#1037) @​efegokdemir
• requireFilesExist should accept a symbolic link (#1031) @​slawekjaranowski
• Fix/916 require same versions for managed report plugins (#1024) @​dhruv9b
• fix: correct enforceBytecodeVersion excludes filtering (#990) @​w3lld1
• Fix: support custom output for 9 enforcer rules that ignored getMessage() (#1004) @​btpka3
• RequireFilesExist should accept a file reached through .. (#977) (#1011) @​AzazelSensei

📝 Documentation updates

• Deprecate the evaluateBeanshell rule (#1034) @​slachiewicz
• javadoc grammar (#1013) @​elharo
• Restore the common wording on the download page (#1008) @​slachiewicz
• Use <a id> rather than <a name> for the FAQ anchors (#1010) @​slachiewicz
• Convert the FAQ from FML to Markdown (#1009) @​slachiewicz
• Remove obsolete note, clean up typos (#1001) @​scordio
• Add enforceBytecodeVersion to rules index (#983) @​omribz156
• Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#989) @​potiuk

👻 Maintenance

• Ignore SLF4J 2.x in Dependabot (#1062) @​slachiewicz
• Remove redundant rat configuration (#1061) @​slawekjaranowski
• Fix ATR project name (#1060) @​slawekjaranowski
• Use push for PR Automation (#1058) @​slawekjaranowski
• Use workflow_run for PR check (#1056) @​slawekjaranowski
• Add project metadata for ATR (#1044) @​slawekjaranowski
• Use ReaderInputStream builder in RequireTextFileChecksum (#1052) @​slawekjaranowski
• Use Resolver RemoteRepository in BannedRepositories (#1051) @​slawekjaranowski
• Add PR check workflow (#1053) @​slawekjaranowski
• Replace plexus-utils StringUtils with commons-lang3 in enforcer-rules (#1048) @​slachiewicz

... (truncated)

Commits

• 465ebf2 [maven-release-plugin] prepare release enforcer-3.7.0
• b24b05c Fix test-scope mediation in RequireUpperBoundDeps
• 2b75dd3 Improve RequireUpperBoundDeps error message (#1059)
• b519cd0 Fix EnforcerRuleCache concurrency across plugin realms (#1055)
• f622234 Ignore SLF4J 2.x in Dependabot
• 5a9ebca Remove redundant rat configuration
• e8512d0 Fix ATR project name
• 08605b2 Use push for PR Automation
• fbe1ae5 Use workflow_run for PR check (#1056)
• b1d59aa Bump commons-codec:commons-codec from 1.22.1 to 1.23.0
• Additional commits viewable in compare view

Updates io.vavr:vavr from 1.0.1 to 1.1.0

Release notes

Sourced from io.vavr:vavr's releases.

v1.1.0

Vavr 1.1.0 is out - a maintenance-heavy minor release focused on correctness and performance of the 1.x line.

This release wasn't planned. Most of these fixes were made during work on Vavr 2.0.0, but they turned out to be easy to backport, and there was no good reason to make 1.x users wait for them. So here they are.

Huge thanks to everyone who contributed!

Highlights

Faster LinkedHashMap / LinkedHashSet (#3302, #3303, #3292, #3294)

put() for an already-present key is now O(1) instead of O(n), and the internal insertion-order structure was switched from Queue to Vector.

Serialized instances from 1.0.1 can still be deserialized.

Either#transform (#3268)

Either gets the missing transform(Function<? super Either<L, R>, ? extends U>), consistent with the rest of the Vavr types.

Better Null-Safety Annotations (#3266, #3317)

Missing JSpecify annotations were added, including @NonNull on Option's type parameter.

Behavior Changes Worth Knowing

These are bug fixes, but they may change observable behavior if you did not pay attention to the contract:

• Try.Failure#equals now also compares the exception type and message, not just stack traces (#3274)
• Try#andFinallyTry() no longer swallows the original failure when the finalizer also throws (#3288)
• Map#replace(Tuple2, Tuple2) now checks the full entry, not just the key (#3289)
• Queue#replace now replaces only the first occurrence (#3271)
• Multimap#isDistinct() no longer returns true for SEQ containers (#3286)

What's Changed

• Make Lazy.value explicitly volatile by @​pivovarit in #3176
• Annotate Option's generic parameter as @​NonNull by @​jkstrauss in #3266
• Implement missing Either#transform by @​pivovarit in #3268
• Fix Queue#flatMap ordering issue by @​pivovarit in #3270
• Fix Queue#replace violating first-occurrence-only semantics by @​pivovarit in #3271
• Fix Iterator#findLast returning None for null matches by @​pivovarit in #3272
• Fix Failure#equals comparing only stack traces, ignoring exception type and message by @​pivovarit in #3274
• Fix Map#computeIfPresent returning None for null by @​pivovarit in #3276
• Fix future cancellation callbacks by @​puneetdixit200 in #3280
• Fix TreeMap.collector() null-checking by @​pivovarit in #3281
• Preserve custom comparator through derived operations for TreeMultimap by @​pivovarit in #3282
• Fix Tree#build() validating wrong parameters in null checks by @​pivovarit in #3283
• Fix LinkedHashMultimap.toJavaMap() losing insertion order by @​pivovarit in #3284

... (truncated)

Commits

• 1601038 [maven-release-plugin] prepare release v1.1.0 [ci skip]
• 1e90c0b update central-publishing-maven-plugin
• 5009577 update version to 1.1.0-SNAPSHOT
• 1a7e9f3 fix Maven entry
• 3de703c Fix List.remove throwing NullPointerException when the list contains null (#3...
• 3379311 serialization compatibility
• 2d0fbb0 add missing jspecify annotations (#3317)
• 15a39e4 fix LinkedHashMap#put (#3309)
• aaab61c swap Queue for Vector in LinkedHashMap (#3303)
• b6c43e3 O(1) LinkedHashMap/LinkedHashSet#put() for existing keys (#3302)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions