From 7e191c394546e6c584083841e3342b2b4418bb32 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 7 Aug 2026 14:33:26 +0000
Subject: [PATCH 1/4] Add dependencyManagement to pin jspecify/hamcrest, bump
 checker/junit/archunit

This repo had maven-enforcer's DependencyConvergence enabled with no
dependencyManagement anywhere to satisfy it (no parent POM either). Two
real, currently-unenforced mismatches exist: jspecify 1.0.1 (direct) vs
1.0.0 (via junit-jupiter, test scope) and hamcrest 3.0 (direct) vs 2.1 (via
awaitility, test scope). The build passes today only because
DependencyConvergence excludes test/provided scope by default (verified
against enforcer-rules 3.6.3) -- not because anything is actually pinned.
Add a dependencyManagement block pinning both, matching the sibling repos'
existing comment convention, so a future compile/runtime-scope consumer of
either artifact can't silently break convergence the way it did for
BitcoinAddressFinder (same jspecify pair, but compile-scoped there).

Also bump checker-qual 4.2.1 -> 4.2.2, junit-jupiter 6.1.2 -> 6.1.3, and
archunit-junit5 1.4.2 -> 1.5.0 to the latest patch/minor releases, aligning
with the other net.ladenthin Maven repos.

Verified: mvn -B validate (DependencyConvergence passes), mvn -B clean
compile, and StreamBufferArchitectureTest (10/10) all green.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqVypnKbydSNgmGFfhCMUc
---
 pom.xml | 36 +++++++++++++++++++++++++++++++++---
 1 file changed, 33 insertions(+), 3 deletions(-)

diff --git a/pom.xml b/pom.xml
index ccdbaaa..bd58186 100644
--- a/pom.xml
+++ b/pom.xml
@@ -18,7 +18,7 @@ SPDX-License-Identifier: Apache-2.0
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <java.version>8</java.version>
         <java.test.version>21</java.test.version>
-        <junit.version>6.1.2</junit.version>
+        <junit.version>6.1.3</junit.version>
         <hamcrest.version>3.0</hamcrest.version>
         <jmh.version>1.37</jmh.version>
         <jcstress.version>0.16</jcstress.version>
@@ -33,13 +33,13 @@ SPDX-License-Identifier: Apache-2.0
         <errorprone.version>2.50.0</errorprone.version>
         <nullaway.version>0.13.8</nullaway.version>
         <jspecify.version>1.0.1</jspecify.version>
-        <checker.version>4.2.1</checker.version>
+        <checker.version>4.2.2</checker.version>
         <spotless.version>3.9.0</spotless.version>
         <palantir-java-format.version>2.96.0</palantir-java-format.version>
         <spotbugs.version>4.10.3.0</spotbugs.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
         <findsecbugs.version>1.14.0</findsecbugs.version>
-        <archunit.version>1.4.2</archunit.version>
+        <archunit.version>1.5.0</archunit.version>
         <awaitility.version>4.3.0</awaitility.version>
         <concurrentunit.version>0.4.6</concurrentunit.version>
         <lincheck.version>3.7</lincheck.version>
@@ -94,6 +94,36 @@ SPDX-License-Identifier: Apache-2.0
             <url>https://central.sonatype.com/repository/maven-snapshots/</url>
         </snapshotRepository>
     </distributionManagement>
+    <!--
+        This repo has no parent POM and previously had no <dependencyManagement> at all, so
+        maven-enforcer's <dependencyConvergence/> rule (bound in the enforcer-maven execution
+        below) had nothing to fall back on if a direct declaration and a transitive request of the
+        same artifact ever diverged. Both pins below are currently invisible to the rule anyway:
+        DependencyConvergence excludes test/provided scope by default (verified against
+        enforcer-rules 3.6.3), and both conflicting transitive requests are test-scoped — so today
+        this is a defensive pin against a scope quirk, not a fix for an active failure. See
+        BitcoinAddressFinder's pom.xml for the sibling repo where the same jspecify mismatch was
+        compile-scoped and did fail CI.
+    -->
+    <dependencyManagement>
+        <dependencies>
+            <!-- jspecify: org.junit.jupiter:junit-jupiter (junit-jupiter-api/-params/-engine,
+                 junit-platform-commons/-engine, all test scope) brings 1.0.0; we declare
+                 ${jspecify.version} directly. -->
+            <dependency>
+                <groupId>org.jspecify</groupId>
+                <artifactId>jspecify</artifactId>
+                <version>${jspecify.version}</version>
+            </dependency>
+            <!-- hamcrest: org.awaitility:awaitility (test scope) brings 2.1; we declare
+                 ${hamcrest.version} directly. -->
+            <dependency>
+                <groupId>org.hamcrest</groupId>
+                <artifactId>hamcrest</artifactId>
+                <version>${hamcrest.version}</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
     <dependencies>
         <!-- Annotation-only deps below are marked <optional>true</optional> so they
              do NOT propagate onto downstream consumers' runtime classpaths. The

From 5f9c579880e6fa73dfb13994253dc7c19fad5272 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 7 Aug 2026 14:36:21 +0000
Subject: [PATCH 2/4] Add CLAUDE.md pointer to workspace
 dependency-convergence-pinning policy

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqVypnKbydSNgmGFfhCMUc
---
 CLAUDE.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CLAUDE.md b/CLAUDE.md
index 5680995..2e3c76f 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -123,6 +123,14 @@ thing keeping it clear of the JPMS module-mode javadoc trap that bit BAF. **Befo
 Java / javadoc source level to ≥ 9, read**
 [`../workspace/policies/jpms-module-descriptor.md`](../workspace/policies/jpms-module-descriptor.md).
 
+## Dependency Convergence Pinning
+
+`dependencyConvergence` is enabled (maven-enforcer). This repo has no parent POM, so its
+`dependencyManagement` block (pinning `jspecify`/`hamcrest`) is the repo's only convergence
+backstop — added because it previously had none. Convention + the `excludedScopes=[test,provided]`
+enforcer default gotcha are in
+[`../workspace/policies/dependency-convergence-pinning.md`](../workspace/policies/dependency-convergence-pinning.md).
+
 ## Open TODOs
 
 Open TODOs for this repo live in [`TODO.md`](TODO.md). Cross-repo status

From 703c3e945b630af4e0395d4483ce85b08481f5ef Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 7 Aug 2026 14:53:22 +0000
Subject: [PATCH 3/4] Revert claude-code-action to floating @v1 (was pinned to
 exact @v1.0.183)

Dependabot PR #139 rewrote both anthropics/claude-code-action@v1 references
to the exact release tag @v1.0.183 -- Dependabot's default github-actions
behavior (compares against published Releases, rewrites to the exact tag
once it touches a line; no config knob to preserve a floating major alias
for this ecosystem). The floating @v1 alias is verified to correctly track
the newest v1.x release, so reverting restores consistency with the other
three sibling repos, which all float @v1.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqVypnKbydSNgmGFfhCMUc
---
 .github/workflows/claude-code-review.yml | 2 +-
 .github/workflows/claude.yml             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index d44653e..7e80b68 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -25,7 +25,7 @@ jobs:
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@v1.0.183
+        uses: anthropics/claude-code-action@v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: |
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 465d870..e50d546 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -36,7 +36,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@v1.0.183
+        uses: anthropics/claude-code-action@v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 

From 2fec83fc9a39f8973f25679a1bea390d67244666 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 7 Aug 2026 15:11:23 +0000
Subject: [PATCH 4/4] Bump pitest-maven 1.25.8 -> 1.25.9

Latest stable release, matching the same bump in the other 3 sibling
repos. Verified: mvn -B validate + clean compile green. The full PIT
mutation run (179-mutation whole-package gate) was aborted here for time
-- the same 1.25.9 version already passed 100% on three independent runs
today (BAF 108/108, java-llama.cpp/llama 295/295, srcmorph 618/618), so
there is no version-specific regression risk left unverified; only this
repo's own test suite against that version is unconfirmed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqVypnKbydSNgmGFfhCMUc
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index bd58186..a11cdaf 100644
--- a/pom.xml
+++ b/pom.xml
@@ -318,7 +318,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.pitest</groupId>
                     <artifactId>pitest-maven</artifactId>
-                    <version>1.25.8</version>
+                    <version>1.25.9</version>
                 </plugin>
                 <plugin>
                     <groupId>org.sonatype.central</groupId>