From 98ff97ec2a60b4af9e0b31f849040074f9340b10 Mon Sep 17 00:00:00 2001
From: Bernard Ladenthin <bernard.ladenthin@gmail.com>
Date: Wed, 28 Oct 2026 11:17:55 +0100
Subject: [PATCH] chore(deps): bump dependencies, build plugins and the Claude
 action

Re-check of 2026-10-28 (workspace crossrepostatus.md, "Dependency /
plugin freshness"): every coordinate brought to its newest stable
release, the same values in all four Java repositories. palantir
2.103.0 changes no formatting (spotless:apply on JDK 25 left the
sources unchanged); the build compiles with Error Prone and NullAway
0.14.3 (Docker, maven:3.9-eclipse-temurin-25).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DuAkLtHrCTx81vP5Mt4jad
---
 .github/workflows/claude-code-review.yml | 2 +-
 .github/workflows/claude.yml             | 2 +-
 CHANGELOG.md                             | 2 ++
 pom.xml                                  | 4 ++--
 4 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index 905c66d..fed59a8 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -25,7 +25,7 @@ jobs:
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@925afb53776cf1a2b738c6bdbed37b4d4000ef13 # v1
+        uses: anthropics/claude-code-action@d70510b174a1244958df0b03166a54912811f3e6 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: |
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index d1cf601..aa498b2 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -36,7 +36,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@925afb53776cf1a2b738c6bdbed37b4d4000ef13 # v1
+        uses: anthropics/claude-code-action@d70510b174a1244958df0b03166a54912811f3e6 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 48e9348..6039651 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Changed
+- **Build plugins:** jacoco-maven-plugin 0.8.16, palantir-java-format 2.103.0 (no formatting change)
+  and `anthropics/claude-code-action` v1.0.264, the same pins as the three sibling repositories.
 - **The GPG signing-key preflight runs only when something is published.** The two jobs
   `verify-signing-key` and `verify-signing-key-gradle` ran on every trigger: red on every pull request,
   because the `maven-central` environment admits only `main` and `v*` tags, and on a push to `main`
diff --git a/pom.xml b/pom.xml
index a7c7875..1a169b4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -35,7 +35,7 @@ SPDX-License-Identifier: Apache-2.0
         <jspecify.version>1.0.1</jspecify.version>
         <checker.version>4.3.1</checker.version>
         <spotless.version>3.10.4</spotless.version>
-        <palantir-java-format.version>2.102.0</palantir-java-format.version>
+        <palantir-java-format.version>2.103.0</palantir-java-format.version>
         <spotbugs.version>4.10.5.0</spotbugs.version>
         <fb-contrib.version>7.7.4</fb-contrib.version>
         <findsecbugs.version>1.14.0</findsecbugs.version>
@@ -344,7 +344,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.jacoco</groupId>
                     <artifactId>jacoco-maven-plugin</artifactId>
-                    <version>0.8.15</version>
+                    <version>0.8.16</version>
                 </plugin>
                 <plugin>
                     <groupId>org.pitest</groupId>