build(deps): Bump the dev-dependencies group with 11 updates

examples/dropwizard-demo/build.gradle.kts

@@ -46,8 +46,8 @@ dependencies {
     implementation(libs.slf4j.api)
     runtimeOnly(libs.logback.classic)
 
-    compileOnly("com.google.errorprone:error_prone_annotations:2.49.0")
-    testCompileOnly("com.google.errorprone:error_prone_annotations:2.49.0")
+    compileOnly("com.google.errorprone:error_prone_annotations:2.50.0")
+    testCompileOnly("com.google.errorprone:error_prone_annotations:2.50.0")
 
     testImplementation(libs.dropwizard.testing)
 }

gradle/libs.versions.toml

@@ -15,7 +15,7 @@ java = "21"
 # this from getting bumped back. Revisit when Spotless 8 ships a fix.
 spotless = "8.6.0"
 errorprone-plugin = "5.1.0"
-errorprone-core = "2.49.0"
+errorprone-core = "2.50.0"
 google-java-format = "1.25.2"
 jspecify = "1.0.0"
 
@@ -36,15 +36,15 @@ jdbi = "3.53.0"
 flyway = "12.8.1"
 postgresql = "42.7.11"
 hikaricp = "7.0.2"
-aws-sdk = "2.46.7"
+aws-sdk = "2.46.8"
 testcontainers = "1.21.4"
 
 # Spring Boot adapter (Phase 8). Spring Boot 4 / Spring Security 7. Spring Boot 4 standardized
 # on Jackson 3 (`tools.jackson.*`), the same namespace pk-auth-core uses (ADR 0009) — so the
 # previous Jackson 2 bridge module is gone, replaced by direct registration of the core's
 # `PkAuthObjectMappers.pkAuthModule()` as a Spring bean. Brief §6.10 originally specified
 # 3.5.x / 6.5.x; the upgrade landed as a deliberate framework refresh.
-spring-boot = "4.0.6"
+spring-boot = "4.1.0"
 spring-security = "7.1.0"
 # H2 in the demo so reviewers can run the spring-boot-demo without an external Postgres.
 # Confined to the demo's runtime; the starter does not pull it in.

pk-auth-dropwizard/build.gradle.kts

@@ -50,8 +50,8 @@ dependencies {
 
     // Dropwizard's transitive Jersey/Jakarta dependencies surface annotations whose enclosing
     // packages reference com.google.errorprone.annotations.* — same pattern as the JDBI module.
-    compileOnly("com.google.errorprone:error_prone_annotations:2.49.0")
-    testCompileOnly("com.google.errorprone:error_prone_annotations:2.49.0")
+    compileOnly("com.google.errorprone:error_prone_annotations:2.50.0")
+    testCompileOnly("com.google.errorprone:error_prone_annotations:2.50.0")
 
     implementation(libs.slf4j.api)
 

pk-auth-micronaut/build.gradle.kts

@@ -46,8 +46,8 @@ dependencies {
 
     // Micronaut's @Inject site references the JDBI errorprone @GuardedBy via the persistence
     // modules. Same trick as pk-auth-persistence-jdbi.
-    compileOnly("com.google.errorprone:error_prone_annotations:2.49.0")
-    testCompileOnly("com.google.errorprone:error_prone_annotations:2.49.0")
+    compileOnly("com.google.errorprone:error_prone_annotations:2.50.0")
+    testCompileOnly("com.google.errorprone:error_prone_annotations:2.50.0")
 
     annotationProcessor(libs.micronaut.inject.java)
 

pk-auth-persistence-jdbi/build.gradle.kts

@@ -23,8 +23,8 @@ dependencies {
     // Without errorprone-annotations on the compile classpath, javac emits an annotation-not-found
     // warning that -Werror turns fatal. Pulled in compileOnly so we don't broadcast it as a
     // runtime dependency.
-    compileOnly("com.google.errorprone:error_prone_annotations:2.49.0")
-    testCompileOnly("com.google.errorprone:error_prone_annotations:2.49.0")
+    compileOnly("com.google.errorprone:error_prone_annotations:2.50.0")
+    testCompileOnly("com.google.errorprone:error_prone_annotations:2.50.0")
     implementation(libs.flyway.core)
     runtimeOnly(libs.flyway.postgres)
     runtimeOnly(libs.postgresql)

pk-auth-persistence-jdbi/src/main/java/com/codeheadsystems/pkauth/persistence/jdbi/JdbiCredentialRepository.java

@@ -204,12 +204,6 @@ public int deleteByUserHandle(UserHandle userHandle) {
   // Internal helpers
   // -------------------------------------------------------------------------
 
-  /**
-   * Runs {@code body} and wraps any {@link JdbiException} (or other unchecked JDBC exception) in a
-   * {@link PkAuthPersistenceException} so adapter exception mappers can produce a uniform 503.
-   * {@link PkAuthPersistenceException} (including {@link DuplicateCredentialException}) is
-   * re-thrown unchanged so the duplicate-credential branch reaches the caller intact.
-   */
   /**
    * Binds a nullable value. When non-null, defers to JDBI's standard binding. When null, calls
    * {@code bindNull} with the supplied SQL type so Postgres receives a typed NULL rather than the
@@ -224,6 +218,12 @@ private static void bindNullable(Update update, String name, Object value, int s
     }
   }
 
+  /**
+   * Runs {@code body} and wraps any {@link JdbiException} (or other unchecked JDBC exception) in a
+   * {@link PkAuthPersistenceException} so adapter exception mappers can produce a uniform 503.
+   * {@link PkAuthPersistenceException} (including {@link DuplicateCredentialException}) is
+   * re-thrown unchanged so the duplicate-credential branch reaches the caller intact.
+   */
   private static <T> T wrap(String op, Supplier<T> body) {
     try {
       return body.get();

pk-auth-spring-boot-starter/src/main/java/com/codeheadsystems/pkauth/spring/autoconfigure/PkAuthWebAutoConfiguration.java

@@ -108,11 +108,6 @@ public SecurityFilterChain pkAuthSecurityFilterChain(
         .build();
   }
 
-  /**
-   * The ceremony controller is mounted explicitly via {@code @Import}, but Spring component-scan
-   * doesn't run on starter packages. We register the bean here so host apps don't need a
-   * {@code @ComponentScan(basePackages = "com.codeheadsystems.pkauth.spring.web")}.
-   */
   /**
    * Shared ceremony orchestrator (JWT mint + label lookup + wire mapping). Lives in {@code
    * pk-auth-jwt} so every adapter holds a single dependency rather than three.
@@ -126,6 +121,11 @@ public CeremonyOrchestrator pkAuthCeremonyOrchestrator(
     return PkAuthComposition.ceremonyOrchestrator(service, jwtIssuer, credentialRepository);
   }
 
+  /**
+   * The ceremony controller is mounted explicitly via {@code @Import}, but Spring component-scan
+   * doesn't run on starter packages. We register the bean here so host apps don't need a
+   * {@code @ComponentScan(basePackages = "com.codeheadsystems.pkauth.spring.web")}.
+   */
   @Bean
   @ConditionalOnMissingBean
   public PkAuthCeremonyController pkAuthCeremonyController(CeremonyOrchestrator orchestrator) {