Commits
Tarun Sukhani authored 47a4b81e36c
chore(deps): resolve vendored jars for the merged Renovate bumps The three Renovate branches just merged (all-minor-patch, micrometer, swagger/openapi) edit framework/dependencies.yml only. That manifest is an Ivy input, not something the build reads at compile time -- framework/lib/ holds the jars the build actually compiles and tests against, and those jars are tracked here. Merging the bumps alone left the manifest claiming micrometer 1.17.1 while lib/ still shipped 1.17.0, which is also why those branches' CI went green without ever exercising a new jar. Ran `ant resolve -Dprune=true`: 14 jars copied, 14 pruned, a clean 1:1 swap with no version straddling left in lib/. byte-buddy 1.18.11 -> 1.18.12 javassist 3.32.0-GA -> 3.33.0-GA protobuf-java 4.35.1 -> 4.36.0 okhttp (3 artifacts) 5.4.0 -> 5.5.0 micrometer (5 artifacts) 1.17.0 -> 1.17.1 swagger (3 artifacts) 2.2.53 -> 2.2.54 byte-buddy resolves to a plain 1.18.12, not the -jdk5 line: the allowedVersions pin added in 56f63abfb is holding. javassist's -GA suffix is that project's normal release scheme, not a sibling-artifact trap. Verified against the new jars: `ant test` green end to end in 5m08s (clean -> jar -> unittest -> integration-test -> gradle-plugin-test), with the integration leg's 15 suites / 61 tests reporting 0 failures across the SSE, h2, h3, WebSocket, CORS, metrics, JPA and docviewer paths. The micrometer and okhttp bumps touch the metrics and SSE paths specifically, and both are covered there. The same run also validates the Gradle 9.7.0 -> 9.7.1 wrapper bump merged in 495b83b08: gradle-plugin-test shells out to ./gradlew, so it downloaded the new distribution and verified it against the pinned distributionSha256Sum (acd53f1e..d20a, confirmed byte-for-byte against services.gradle.org's published .sha256) before running the TestKit suite. A bad checksum would have failed the leg rather than passed it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>