[pashidlos]

Toolchain refresh for phase 2: Gradle 9, Java 25, current dependencies, CI and Dependabot.

Important

Breaking: Java 25, the latest LTS, is now the minimum (it was 11). Proposed release: 6.0.0. Release it together with the other SDK majors after the server 6.0 release; don't merge it before then.

This branch includes #124 (trailing-slash fix) and #125 (dependency sweep) through a merge commit, without rewriting history. Until those two merge, this PR's diff also shows their changes. Merge order: #124 → #125 → this PR → #123. #124 and #125 can merge now (#124 releases 5.6.1).

Build

• Gradle and plugins:
  • Gradle 6.1 → 9.8.2. The wrapper is regenerated, with distributionSha256Sum.
  • The build uses a plugins {} block, and freefair lombok goes 5.1.1 → 9.8.3. This supersedes Bump io.freefair.gradle:lombok-plugin from 5.1.1 to 9.8.3 #120, which fails because lombok 9 needs Gradle 9. Dependabot closes Bump io.freefair.gradle:lombok-plugin from 5.1.1 to 9.8.3 #120 by itself once this lands on master.
• Java 25: compiled with release 25 (class files version 69). CI runs on 25. It also runs on 27, the newest non-LTS JDK, as a forward-compatibility leg with continue-on-error: it shows red if 27 breaks, but the required check doesn't fail. jitpack.yml uses openjdk25, and JitPack resolves that to JDK 25.0.1.
• Shadow plugin: already dropped on master by chore(deps): fix vulnerable test and build dependencies, submit the Gradle dependency graph #125.
• Version from the tag:
  • maven-publish now has an explicit publication and a sources jar.
  • group and version moved to gradle.properties. The local default is 0.0.0-SNAPSHOT, and the stale version '4.3.1' is gone.
  • JitPack runs ./gradlew clean -Pgroup=com.github.Visual-Regression-Tracker -Pversion=<tag> -xtest publishToMavenLocal, and its -Pversion overrides that default. The artifact version is therefore the tag; until now the POM said 4.3.1.

Dependencies

	Before	After
gson	2.9.0	2.15.0
slf4j-api	1.7.25	2.0.20
logback-classic (test)	1.5.16	1.6.6
testng (test)	7.7.0	7.12.0
mockito-core (test)	4.4.0	5.24.0 (attached as a javaagent, as Mockito 5 asks)
mockwebserver (test)	4.11.0	mockwebserver3 5.5.1; tests migrated to its API
system-stubs-testng (test)	2.1.3	2.1.8
commons-io (test)	2.18.0	removed (unused)
hamcrest (test)	via junit 4	3.0, explicit

Consumers who log through SLF4J 1.7 bindings need an SLF4J 2 provider; logback 1.3+ and log4j-slf4j2-impl both work.

CI and tooling

• Actions: actions/checkout@v7, actions/setup-java@v6, gradle/actions/setup-gradle@v6 (wrapper validation, MIT basic cache), codecov/codecov-action@v7 over OIDC. Dead codecov-action@v1.0.12 replaced (last upload 2024-10).
• Jobs: the matrix job test runs on 25 and 27 (27 non-blocking). The Java 25 leg also uploads coverage and runs JitPack's exact command. dependency-submission.yml from chore(deps): fix vulnerable test and build dependencies, submit the Gradle dependency graph #125 builds on 25. The required check build is a gate over the whole matrix, so branch protection needs no change.
• pull_request triggers: runs for any base branch, so stacked PRs get CI too, plus a concurrency group.
• Dependabot (reference pattern):
  • gradle: weekly, limit 5, with gradle-minor-patch, gradle-major and gradle-security groups;
  • github-actions: one group;
  • the stale mockwebserver ignore is gone.
• Codacy: the README badge is removed in the docs PR. Delete the leftover CODACY_TOKEN secret in repo settings. There is no SonarCloud.

Verification

• ./gradlew build in eclipse-temurin:25 and :27: 63 tests pass on each.
• JitPack's exact command on eclipse-temurin:25 passes. Class files are version 69 (Java 25).
• OSV check of every resolved coordinate (dependencies + buildEnvironment): 32 packages, 0 known vulnerabilities. Every declared dependency is on its latest stable release.
• The jar from this branch on a JDK 25 runtime, against visualregressiontracker/api:6.0.0-rc1 (the examples-java CI compose file): base64, bytes and file tracking, sourceBranch, comment, merge, 413 → multipart, UNRESOLVED, stop. All pass.
• jitpack.io itself, for commit 6ff258f527 of this branch (build log): openjdk25 → JDK 25.0.1, Gradle 9.8.2, BUILD SUCCESSFUL. The POM lists gson 2.15.0 and slf4j-api 2.0.20.

system-stubs attaches byte-buddy dynamically, so the test JVM runs with -XX:+EnableDynamicAgentLoading. That keeps the warning out of the test reports and works on 25+.

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (next@3de8398). Learn more about missing BASE report.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             next     #122   +/-   ##
=======================================
  Coverage        ?   91.82%           
  Complexity      ?       68           
=======================================
  Files           ?        8           
  Lines           ?      269           
  Branches        ?       22           
=======================================
  Hits            ?      247           
  Misses          ?       18           
  Partials        ?        4           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.