From c2400fe6d02d7caee063508a3a9b2a0a336915a3 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 24 Jul 2026 16:23:41 +0000
Subject: [PATCH] =?UTF-8?q?build(deps):=20bump=20logback-classic=201.5.38?=
 =?UTF-8?q?=E2=86=921.6.0,=20maven-jar-plugin=203.5.0=E2=86=923.5.1,=20sco?=
 =?UTF-8?q?recard-action=20v2.4.3=E2=86=92v2.4.4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Match the dependency/action versions already adopted in bitcoinaddressfinder:
- logback-classic 1.5.38 -> 1.6.0 (parent dependencyManagement pin; comment
  clarified that the managed version wins over the llama transitive for
  enforcer DependencyConvergence) + CLAUDE.md dependency table
- maven-jar-plugin 3.5.0 -> 3.5.1 in all three module poms (srcmorph,
  srcmorph-cli, srcmorph-maven-plugin)
- ossf/scorecard-action v2.4.3 -> v2.4.4

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011AbombALVWxqqmYB7mF1kD
---
 .github/workflows/scorecard.yml |  2 +-
 CLAUDE.md                       |  2 +-
 pom.xml                         | 10 ++++++----
 srcmorph-cli/pom.xml            |  2 +-
 srcmorph-maven-plugin/pom.xml   |  2 +-
 srcmorph/pom.xml                |  2 +-
 6 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index c18e7c0..5905ed8 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -29,7 +29,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@v2.4.3
+        uses: ossf/scorecard-action@v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
diff --git a/CLAUDE.md b/CLAUDE.md
index 19e1fb1..98f5646 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -355,7 +355,7 @@ assume it has already been updated.
 |---|---|---|
 | `net.ladenthin:llama` | 5.0.6 | `srcmorph` (`provider` package only) — llama.cpp JNI binding |
 | `org.slf4j:slf4j-api` | 2.0.18 (converged in the parent) | `srcmorph`, `srcmorph-cli`, the plugin |
-| `ch.qos.logback:logback-classic` | 1.5.38 (converged in the parent) | `srcmorph-cli` (runtime binding) |
+| `ch.qos.logback:logback-classic` | 1.6.0 (converged in the parent) | `srcmorph-cli` (runtime binding) |
 | `com.fasterxml.jackson.core:jackson-databind` | pinned in parent | `srcmorph-cli` (JSON config) |
 | `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` | pinned in parent | `srcmorph-cli` (YAML config) |
 | `org.apache.maven:maven-plugin-api` | 3.9.16 | `srcmorph-maven-plugin` (provided) |
diff --git a/pom.xml b/pom.xml
index e40c9ef..1f10989 100644
--- a/pom.xml
+++ b/pom.xml
@@ -99,14 +99,16 @@ SPDX-License-Identifier: Apache-2.0
                 <version>2.0.18</version>
             </dependency>
             <!--
-                Pin the version the llama dependency already brings in transitively (runtime scope),
-                so an explicit test-scope declaration (used to attach a ListAppender in
-                AiFieldGenerationSupportTest) stays converged with it.
+                Pin logback-classic (runtime scope) so the runtime binding and the explicit
+                test-scope declaration (used to attach a ListAppender in
+                AiFieldGenerationSupportTest) stay converged. The managed version here wins over
+                whatever the llama dependency brings in transitively, satisfying maven-enforcer's
+                DependencyConvergence.
             -->
             <dependency>
                 <groupId>ch.qos.logback</groupId>
                 <artifactId>logback-classic</artifactId>
-                <version>1.5.38</version>
+                <version>1.6.0</version>
             </dependency>
             <!--
                 JSON/YAML binding for srcmorph-cli's CConfiguration. Both artifacts are pinned to the
diff --git a/srcmorph-cli/pom.xml b/srcmorph-cli/pom.xml
index c4495db..ee8026a 100644
--- a/srcmorph-cli/pom.xml
+++ b/srcmorph-cli/pom.xml
@@ -185,7 +185,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-jar-plugin</artifactId>
-                    <version>3.5.0</version>
+                    <version>3.5.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
diff --git a/srcmorph-maven-plugin/pom.xml b/srcmorph-maven-plugin/pom.xml
index b1b0f00..7e09619 100644
--- a/srcmorph-maven-plugin/pom.xml
+++ b/srcmorph-maven-plugin/pom.xml
@@ -255,7 +255,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-jar-plugin</artifactId>
-                    <version>3.5.0</version>
+                    <version>3.5.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
diff --git a/srcmorph/pom.xml b/srcmorph/pom.xml
index ba5a619..c4d6b70 100644
--- a/srcmorph/pom.xml
+++ b/srcmorph/pom.xml
@@ -189,7 +189,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-jar-plugin</artifactId>
-                    <version>3.5.0</version>
+                    <version>3.5.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>