Update all non-major dependencies

.github/renovate.json

@@ -84,6 +84,11 @@
       ],
       "groupName": "Telemetry (OpenTelemetry & Prometheus)"
     },
+    {
+      "description": "Error Prone (error_prone_core + error_prone_annotations) is grouped on its own because compiler-check upgrades routinely surface new bug patterns that require source fixes, so they need dedicated review and follow-up separate from the catch-all bump PR.",
+      "matchPackagePrefixes": ["com.google.errorprone"],
+      "groupName": "Error Prone"
+    },
     {
       "description": "Google Cloud client stack used by the GCS repository - cloud client, api and auth libraries plus the BOM. Kept separate from the gRPC transport it consumes and from general com.google.* utility libs (guava, gson, errorprone).",
       "matchPackagePrefixes": [
@@ -192,7 +197,7 @@
       "groupName": "GitHub Actions"
     }
   ],
-  "schedule": ["* * * * *"],
+  "schedule": ["before 9am on the first day of the month"],
   "prConcurrentLimit": 300,
   "prHourlyLimit": 20,
   "minimumReleaseAge": "5 days"

.github/workflows/renovate-changelog-prepare.yml

@@ -4,6 +4,11 @@ name: Generate Renovate Changelog (Stage 1 - Prepare)
 # Checks out BASE repo code only, runs the trusted Python script,
 # and saves the generated changelog file + PR metadata as an artifact
 # for Stage 2 to pick up and push to the fork branch.
+#
+# Generation is skipped (SKIP=true in the artifact metadata) when the PR
+# carries the 'no-changelog' label, or when a user other than solrbot has
+# manually edited changelog/unreleased/ in the PR — in that case the bot
+# must not overwrite the manual changes.
 on:
   pull_request:
     types:
@@ -21,6 +26,7 @@ concurrency:
 
 permissions:
   contents: read
+  pull-requests: read # Needed to list PR commits for the manual-edit check
 
 jobs:
   generate:
@@ -37,15 +43,51 @@ jobs:
           ref: ${{ github.event.pull_request.base.ref }}
           repository: ${{ github.repository }}
 
+      - name: Check whether changelog generation should be skipped
+        id: skip-check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+          HAS_NO_CHANGELOG_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'no-changelog') }}
+        run: |
+          set -euo pipefail
+          skip=false
+
+          if [ "$HAS_NO_CHANGELOG_LABEL" = "true" ]; then
+            skip=true
+            echo "::notice::Skipping changelog generation for PR#${PR_NUMBER}: PR has the 'no-changelog' label"
+          else
+            # Skip if any PR commit from a user other than solrbot touched
+            # changelog/unreleased/ — a human has taken over the changelog
+            # entry and the bot must not overwrite it. Commits with an
+            # unresolvable login are treated as manual edits (fail safe).
+            while read -r sha login; do
+              if [ "$login" != "solrbot" ]; then
+                if gh api "repos/${REPO}/commits/${sha}" --jq '.files[].filename' | grep -q '^changelog/unreleased/'; then
+                  skip=true
+                  echo "::notice::Skipping changelog generation for PR#${PR_NUMBER}: changelog/unreleased/ was manually edited by '${login}' in commit ${sha}"
+                  break
+                fi
+              fi
+            done < <(gh api --paginate "repos/${REPO}/pulls/${PR_NUMBER}/commits" \
+                       --jq '.[] | "\(.sha) \(.author.login // "unknown")"')
+          fi
+
+          echo "skip=${skip}" >> "$GITHUB_OUTPUT"
+
       - name: Set up Python
+        if: steps.skip-check.outputs.skip != 'true'
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.x'
 
       - name: Install dependencies
+        if: steps.skip-check.outputs.skip != 'true'
         run: python3 -m pip install --quiet pyyaml
 
       - name: Generate changelog entry
+        if: steps.skip-check.outputs.skip != 'true'
         env:
           PR_NUMBER: ${{ github.event.pull_request.number }}
           PR_TITLE: ${{ github.event.pull_request.title }}
@@ -59,15 +101,16 @@ jobs:
           PR_NUMBER: ${{ github.event.pull_request.number }}
           HEAD_REF: ${{ github.event.pull_request.head.ref }}
           HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          SKIP: ${{ steps.skip-check.outputs.skip }}
         run: |
           set -euo pipefail
           mkdir -p artifact
-          if [ -d changelog/unreleased ]; then
+          if [ "$SKIP" != "true" ] && [ -d changelog/unreleased ]; then
             cp -r changelog/unreleased artifact/changelog-unreleased
           fi
           # Use printf + env vars to avoid shell injection from PR metadata values
-          printf 'PR_NUMBER=%s\nHEAD_REF=%s\nHEAD_REPO=%s\n' \
-            "$PR_NUMBER" "$HEAD_REF" "$HEAD_REPO" \
+          printf 'PR_NUMBER=%s\nHEAD_REF=%s\nHEAD_REPO=%s\nSKIP=%s\n' \
+            "$PR_NUMBER" "$HEAD_REF" "$HEAD_REPO" "$SKIP" \
             > artifact/pr-metadata.env
           echo "Artifact contents:"; find artifact/ -type f
 

.github/workflows/renovate-changelog-push.yml

@@ -3,6 +3,10 @@ name: Generate Renovate Changelog (Stage 2 - Push)
 # Stage 2: runs after Stage 1 completes, in the base-repo context with access to
 # SOLRBOT_GITHUB_TOKEN. Downloads the pre-generated artifact (no fork code executed here),
 # validates metadata, and pushes the changelog file to the fork branch.
+#
+# If Stage 1 flagged SKIP=true in the artifact metadata (PR has the
+# 'no-changelog' label, or a user manually edited changelog/unreleased/),
+# this workflow leaves the changelog untouched.
 on:
   workflow_run:
     workflows:
@@ -53,6 +57,7 @@ jobs:
           PR_NUMBER=$(grep '^PR_NUMBER=' "$META_FILE" | cut -d= -f2- || true)
           HEAD_REF=$(grep  '^HEAD_REF='  "$META_FILE" | cut -d= -f2- || true)
           HEAD_REPO=$(grep '^HEAD_REPO=' "$META_FILE" | cut -d= -f2- || true)
+          SKIP=$(grep      '^SKIP='      "$META_FILE" | cut -d= -f2- || true)
 
           if [ -z "$PR_NUMBER" ] || [ -z "$HEAD_REF" ] || [ -z "$HEAD_REPO" ]; then
             echo "::error::Missing required metadata fields (PR_NUMBER, HEAD_REF, or HEAD_REPO)"; exit 1
@@ -75,12 +80,21 @@ jobs:
             echo "::error::HEAD_REF is not a valid Git branch name: '$HEAD_REF'"; exit 1
           fi
 
+          # SKIP is optional (absent in artifacts from older Stage 1 runs); default to false
+          if [ "$SKIP" = "true" ]; then
+            echo "::notice::Stage 1 flagged skip for PR#${PR_NUMBER} — leaving changelog untouched"
+          else
+            SKIP=false
+          fi
+
           echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
           echo "head_ref=$HEAD_REF"   >> "$GITHUB_OUTPUT"
           echo "head_repo=$HEAD_REPO" >> "$GITHUB_OUTPUT"
-          echo "Validated: PR#${PR_NUMBER} on ${HEAD_REPO}@${HEAD_REF}"
+          echo "skip=$SKIP"           >> "$GITHUB_OUTPUT"
+          echo "Validated: PR#${PR_NUMBER} on ${HEAD_REPO}@${HEAD_REF} (skip=${SKIP})"
 
       - name: Clone fork branch
+        if: steps.meta.outputs.skip != 'true'
         env:
           SOLRBOT_TOKEN: ${{ secrets.SOLRBOT_GITHUB_TOKEN }}
           HEAD_REPO: ${{ steps.meta.outputs.head_repo }}
@@ -97,6 +111,7 @@ jobs:
             fork-checkout
 
       - name: Apply changelog to fork checkout
+        if: steps.meta.outputs.skip != 'true'
         id: apply
         env:
           PR_NUMBER: ${{ steps.meta.outputs.pr_number }}

changelog/unreleased/PR#4591-update-all-non-major-dependencies.yml

@@ -0,0 +1,13 @@
+title: "Updated dependencies: caffeine 3.2.3 -> 3.2.4, gradle-versions-plugin
+  0.53.0 -> 0.54.0, byte-buddy 1.18.8-jdk5 -> 1.18.9, carrot2-core 4.8.1 -> 4.8.6,
+  randomizedtesting 2.8.4 -> 2.9.1, spotless 8.3.0 -> 8.7.0, ecj 3.39.0 -> 3.46.0,
+  annotations 26.0.2 -> 26.1.0, langchain4j 1.16.3 -> 1.17.0, dependency-check-gradle
+  12.1.3 -> 12.2.2, spotbugs 4.9.8 -> 4.10.2"
+type: dependency_update
+authors:
+  - name: solrbot
+  - name: Jan Høydahl
+    url: https://home.apache.org/phonebook.html?uid=janhoy
+links:
+  - name: PR#4591
+    url: https://github.com/apache/solr/pull/4591

gradle.lockfile

@@ -13,5 +13,5 @@ org.apache.rat:apache-rat-api:0.15=ratDeps
 org.apache.rat:apache-rat-core:0.15=ratDeps
 org.apache.rat:apache-rat-tasks:0.15=ratDeps
 org.apache.rat:apache-rat:0.15=ratDeps
-org.eclipse.jdt:ecj:3.39.0=ecjDeps
+org.eclipse.jdt:ecj:3.46.0=ecjDeps
 empty=

gradle/libs.versions.toml

@@ -61,15 +61,15 @@ bats-file = "0.3.0"
 # @keep bats-support version used in packaging
 bats-support = "0.2.0"
 bc-jose4j = "0.9.6"
-benmanes-caffeine = "3.2.3"
-benmanes-versions = "0.53.0"
+benmanes-caffeine = "3.2.4"
+benmanes-versions = "0.54.0"
 bouncycastle = "1.84"
 # @keep Browserify version used in ref-guide
 browserify = "17.0.0"
-bytebuddy = "1.18.8-jdk5"
-carrot2-core = "4.8.1"
+bytebuddy = "1.18.9"
+carrot2-core = "4.8.6"
 carrotsearch-hppc = "0.10.0"
-carrotsearch-randomizedtesting = "2.8.4"
+carrotsearch-randomizedtesting = "2.9.1"
 # @keep for version alignment
 checkerframework = "4.2.0"
 codehaus-woodstox = "4.3.0"
@@ -80,11 +80,11 @@ compose = "1.11.1"
 cuvs-java = "26.06.0"
 cuvs-lucene = "25.12.0"
 decompose = "3.5.0"
-diffplug-spotless = "8.3.0"
+diffplug-spotless = "8.7.0"
 # @keep Use for dockerfile JRE version
 dockerfile-baseimage-java = "25"
 dropwizard-metrics = "4.2.39"
-eclipse-ecj = "3.39.0"
+eclipse-ecj = "3.46.0"
 eclipse-jetty = "12.1.10"
 # @keep jgit version used by git-status.gradle
 eclipse-jgit = "7.7.0.202606012155-r"
@@ -135,7 +135,7 @@ jayway-jsonpath = "3.0.0"
 jctools = "4.0.6"
 jersey = "4.0.2"
 # @keep for version alignment
-jetbrains-annotations = "26.0.2"
+jetbrains-annotations = "26.1.0"
 # @keep for version alignment
 jna = "5.19.1"
 # @keep for version alignment
@@ -152,7 +152,7 @@ kotlinx-serialization = "1.11.0"
 # @keep used by spotless
 ktlint = "1.8.0"
 ktor = "3.5.0"
-langchain4j-bom = "1.16.3"
+langchain4j-bom = "1.17.0"
 # @keep Link checker version used in ref-guide
 link-checker = "1.4.2"
 littlerobots-versioncatalogupdate = "1.1.0"
@@ -181,15 +181,15 @@ opentelemetry-runtime-telemetry = "2.22.0-alpha"
 oshai-logging = "8.0.4"
 # @keep for version alignment
 ow2-asm = "9.10.1"
-owasp-dependencycheck = "12.1.3"
+owasp-dependencycheck = "12.2.2"
 # @keep for version alignment
 perfmark = "0.27.0"
 prometheus-metrics = "1.1.0"
 quicktheories = "0.26"
 semver4j = "6.0.0"
 slf4j = "2.0.17"
 spatial4j = "0.8"
-spotbugs = "4.9.8"
+spotbugs = "4.10.2"
 squareup-okhttp3-okhttp = "5.4.0"
 squareup-okio = "3.17.0"
 stephenc-jcip = "1.0-1"

solr/api/gradle.lockfile

@@ -2,7 +2,7 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 # To regenerate this file, run: ./gradlew :solr:api:dependencies --write-locks
-com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.8.4=jarValidation,testCompileClasspath,testRuntimeClasspath
+com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.9.1=jarValidation,testCompileClasspath,testRuntimeClasspath
 com.carrotsearch:hppc:0.10.0=jarValidation,testRuntimeClasspath
 com.fasterxml.jackson.core:jackson-annotations:2.22=compileClasspath,jarValidation,runtimeClasspath,swaggerBuild,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson.core:jackson-core:2.22.0=jarValidation,swaggerBuild,testCompileClasspath,testRuntimeClasspath
@@ -16,13 +16,14 @@ com.fasterxml.jackson.jakarta.rs:jackson-jakarta-rs-json-provider:2.22.0=swagger
 com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations:2.22.0=jarValidation,swaggerBuild,testRuntimeClasspath
 com.fasterxml.jackson:jackson-bom:2.22.0=compileClasspath,jarValidation,runtimeClasspath,swaggerBuild,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.woodstox:woodstox-core:7.2.1=jarValidation,testRuntimeClasspath
-com.github.ben-manes.caffeine:caffeine:3.2.3=annotationProcessor,errorprone,jarValidation,testAnnotationProcessor,testRuntimeClasspath
+com.github.ben-manes.caffeine:caffeine:3.2.4=annotationProcessor,errorprone,jarValidation,testAnnotationProcessor,testRuntimeClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.auto.service:auto-service-annotations:1.0.1=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.auto.value:auto-value-annotations:1.11.1=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.auto:auto-common:1.2.2=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_annotation:2.41.0=annotationProcessor,errorprone,testAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.47.0=annotationProcessor,errorprone,jarValidation,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.47.0=jarValidation,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.49.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_check_api:2.41.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.41.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.googlejavaformat:google-java-format:1.27.0=annotationProcessor,errorprone,testAnnotationProcessor

solr/benchmark/gradle.lockfile

@@ -2,7 +2,7 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 # To regenerate this file, run: ./gradlew :solr:benchmark:dependencies --write-locks
-com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.8.4=compileClasspath,jarValidation,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.9.1=compileClasspath,jarValidation,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.carrotsearch:hppc:0.10.0=jarValidation,runtimeClasspath,testRuntimeClasspath
 com.fasterxml.jackson.core:jackson-annotations:2.22=compileClasspath,jarValidation,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.jackson.core:jackson-core:2.22.0=jarValidation,runtimeClasspath,testRuntimeClasspath
@@ -12,13 +12,14 @@ com.fasterxml.jackson.dataformat:jackson-dataformat-smile:2.22.0=jarValidation,r
 com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations:2.22.0=jarValidation,runtimeClasspath,testRuntimeClasspath
 com.fasterxml.jackson:jackson-bom:2.22.0=compileClasspath,jarValidation,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.woodstox:woodstox-core:7.2.1=jarValidation,runtimeClasspath,testRuntimeClasspath
-com.github.ben-manes.caffeine:caffeine:3.2.3=annotationProcessor,errorprone,jarValidation,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
+com.github.ben-manes.caffeine:caffeine:3.2.4=annotationProcessor,errorprone,jarValidation,runtimeClasspath,testAnnotationProcessor,testRuntimeClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.auto.service:auto-service-annotations:1.0.1=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.auto.value:auto-value-annotations:1.11.1=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.auto:auto-common:1.2.2=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_annotation:2.41.0=annotationProcessor,errorprone,testAnnotationProcessor
-com.google.errorprone:error_prone_annotations:2.47.0=annotationProcessor,compileClasspath,errorprone,jarValidation,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.47.0=compileClasspath,jarValidation,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.google.errorprone:error_prone_annotations:2.49.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_check_api:2.41.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.errorprone:error_prone_core:2.41.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.googlejavaformat:google-java-format:1.27.0=annotationProcessor,errorprone,testAnnotationProcessor