[alexander-yevsyukov]

Raises the stale CoreJvm pin to the newest snapshot published in the Spine
Artifact Registry: 2.0.0-SNAPSHOT.567 → 2.0.0-SNAPSHOT.571.

Because ./config/pull copies buildSrc/ wholesale, a stale pin here actively
downgrades any consumer repo that has already moved ahead, which then has to
restore the file by hand after every pull.

Picking the version carefully

CoreJvm is not a single artifact — it bundles six published artifacts
under one version constant, across two groups:

group	artifacts
io.spine	spine-core, spine-client, spine-server
io.spine.tools	core-testlib, client-testlib, server-testlib

(The deprecated testUtilServer is a seventh constant reusing server-testlib.)

Taking the newest version of spine-core alone can pin something the other
five never published, which fails at resolution time in every consumer. So each
artifact's maven-metadata.xml was queried separately and the pin moved to the
highest version present in all six — .571.

CoreJvmCompiler stays at .097

Both of its artifacts (core-jvm-gradle-plugin, core-jvm-plugins) and the
io.spine.core-jvm plugin marker still top out at 2.0.0-SNAPSHOT.097, which
is already what it pins for version and dogfoodingVersion. Nothing to move,
so the build-script pin is not raised past what the build can resolve.

Verification

config has no root version.gradle.kts, so the version-bump gate does not
apply; it also has no build task and registers no Dokka tasks.

• ./gradlew detekt — the command CI gates on — passes.
• Resolution was verified directly with a throwaway java-library project
  (mavenCentral() plus the releases and snapshots Artifact Registry
  repos, the six coordinates as implementation, resolving runtimeClasspath),
  since buildDependants is currently broken on master by a relative-path
  bug in config-tester.gradle.kts. All six resolve at .571; 70 files on the
  classpath.
• The resolved closure matches this repo's other local/ pins exactly —
  base .460, base-types .225, change .208, logging .425, reflect .201,
  base-testlib .214, time .251, validation .464. So the bump brings
  CoreJvm into lockstep with the rest of local/ rather than racing ahead
  of it, and no sibling pin needs to move.
• A second probe declaring .571 alongside the pins from Raise stale local/ dependency pins #799
  (base .461, logging .426, reflect .202, base-testlib .215) also
  resolves cleanly, so the two PRs compose and can land in either order.

Reviewed by dependency-audit, spine-code-review, and kotlin-engineer.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T21:28:16.157140Z	9fab592	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approved

The single-constant update has no identified issues, with successful six-artifact resolution and static analysis reported in the PR.

No open issues 🎉

What changed in this PR

Updates the shared CoreJvm dependency pin to prevent config pulls from downgrading consumer repositories.

Changes:

• Raises all six CoreJvm artifact coordinates from 2.0.0-SNAPSHOT.567 to .571.
• Leaves CoreJvmCompiler unchanged at .097.

File	Description
buildSrc/​src/​main/​kotlin/​io/​spine/​dependency/​local/​CoreJvm.kt	Updates the shared CoreJvm version constant.

_{Review effort: Balanced}