fix(deps): update gradle

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.uber.nullaway:nullaway	0.13.1 → 0.13.3
com.google.errorprone:error_prone_core (source)	2.48.0 → 2.49.0
org.owasp.dependencycheck	12.2.0 → 12.2.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

uber/NullAway (com.uber.nullaway:nullaway)

v0.13.3

Compare Source

Quick follow-up release to 0.13.2 to fix a crash (#​1523).

• Add @​InjectSoftAssertions to default excluded field annotations by @​is-ivanov (#​1516)
• Fix check for enclosing NewClassTree (#​1524)
• Maintenance
  • Remove onOverrideMethodInvocationVarargsArrayNullability handler method (#​1518)
  • Update to Checker Framework 4.0.0 (#​1519)

v0.13.2

Compare Source

Various bug fixes in this release and better JSpecify support.

• Fix for explicitly-typed lambda parameters in JDK 24+ (#​1452)
• Improve handling of wildcard upper bounds in generic method inference by @​dhruv-agr (#​1454)
• Add default support for @​PostConstruct as an initializer annotation (#​1459)
• Include nested annotation information in astubx files when loading external library models by @​haewiful (#​1456)
• JSpecify: assume NONNULL in generic method inference for unconstrained type variables (#​1471)
• JSpecify: improve inference for generic methods based on method reference arguments (#​1438)
• Improve printing of annotated type variables in error messages (#​1478)
• Initial handling of constructor diamond operators (#​1464)
• Handle restrictive type-use @NonNull annotations on varargs array (#​1484)
• Test case for issue 1493 (#​1496)
• Fix library modeling for varargs arrays (#​1485)
• Re-introduce annotations elided by javac for certain cases (#​1473)
• JDK javac plugin: properly handle nested annotations on array parameter types and varargs (#​1497)
• Print only @Nullable type use annotations in error messages (#​1507)
• Better handling of method references passed to generic methods in JSpecify mode (#​1499)
• Support for Spring's @​Value annotation (#​1505)
• Fix crash with captured array types (#​1508)
• Maintenance
  • Update comments in NullabilityUtil#hasAnyAnnotationMatching (#​1457)
  • Update to Gradle 9.3.1 (#​1458)
  • Update to Error Prone 2.47.0 (#​1461)
  • Switch InvocationAndContext to be a record (#​1463)
  • Upgrade GitHub Actions for Node 24 compatibility by @​salmanmkc (#​1465)
  • Upgrade GitHub Actions to latest versions by @​salmanmkc (#​1466)
  • Bump various dependencies (#​1469)
  • Use text blocks in CustomLibraryModelsTests (#​1482)
  • Update Error Prone and EP plugin (#​1486)
  • Update to Gradle 9.4.0 (#​1491)
  • Minor cleanup, no behavior changes by @​armandino (#​1487)
  • Update to Error Prone 2.49.0 (#​1514)

google/error-prone (com.google.errorprone:error_prone_core)

v2.49.0: Error Prone 2.49.0

This release includes several changes to Matcher APIs, and removed some deprecated or problematic APIs:

• Remove deprecated MethodMatchers.withSignature API, which relies on fragile toString behaviour. Alternatives for matching on method signatures with varargs and type parameters were added in a98a1c5.
• Removed variableType(Matcher) API. Matchers.variableType(Matcher) uses VariableTree#getType to match variable types, which own't work for lambda parameters with inferred types after JDK-8268850. The recommended replacement is variableType(TypePredicate).
• Make enclosingPackage return an optional. Module elements are not enclosed by a package, checks using enclosingPackage shouldn't assume an enclosing package exists when processing arbitrary elements.
• New FieldMatchers API, similar to MethodMatchers (1dd9c3a).

New checks:

• AssertThrowsBlockToExpression: Discourage unnecessary block lambdas in assertThrows.
• AssertThrowsMinimizer: Suggest minimizing the amount of logic in assertThrows.
• MemorySegmentReferenceEquality: Discourage using reference equality for MemorySegments.
• PreferThrowsTag: Recommends using @throws instead of the legacy @exception javadoc tag.
• RecordAccessorInCompactConstructor: detect record accessors inside the compact canonical ctors, which read uninitialized fields.

Closed issues: #​2283, #​3503, #​5210, #​5289, #​5548, #​5548, #​5554, #​5609, #​5614, #​5656

Full changelog: google/error-prone@v2.48.0...v2.49.0

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.