Upgrade logback-classic to 1.6.0 and maven-jar-plugin to 3.5.1

.github/workflows/scorecard.yml

@@ -29,7 +29,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@v2.4.3
+        uses: ossf/scorecard-action@v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif

CLAUDE.md

@@ -355,7 +355,7 @@ assume it has already been updated.
 |---|---|---|
 | `net.ladenthin:llama` | 5.0.6 | `srcmorph` (`provider` package only) — llama.cpp JNI binding |
 | `org.slf4j:slf4j-api` | 2.0.18 (converged in the parent) | `srcmorph`, `srcmorph-cli`, the plugin |
-| `ch.qos.logback:logback-classic` | 1.5.38 (converged in the parent) | `srcmorph-cli` (runtime binding) |
+| `ch.qos.logback:logback-classic` | 1.6.0 (converged in the parent) | `srcmorph-cli` (runtime binding) |
 | `com.fasterxml.jackson.core:jackson-databind` | pinned in parent | `srcmorph-cli` (JSON config) |
 | `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` | pinned in parent | `srcmorph-cli` (YAML config) |
 | `org.apache.maven:maven-plugin-api` | 3.9.16 | `srcmorph-maven-plugin` (provided) |

pom.xml

@@ -99,14 +99,16 @@ SPDX-License-Identifier: Apache-2.0
                 <version>2.0.18</version>
             </dependency>
             <!--
-                Pin the version the llama dependency already brings in transitively (runtime scope),
-                so an explicit test-scope declaration (used to attach a ListAppender in
-                AiFieldGenerationSupportTest) stays converged with it.
+                Pin logback-classic (runtime scope) so the runtime binding and the explicit
+                test-scope declaration (used to attach a ListAppender in
+                AiFieldGenerationSupportTest) stay converged. The managed version here wins over
+                whatever the llama dependency brings in transitively, satisfying maven-enforcer's
+                DependencyConvergence.
             -->
             <dependency>
                 <groupId>ch.qos.logback</groupId>
                 <artifactId>logback-classic</artifactId>
-                <version>1.5.38</version>
+                <version>1.6.0</version>
             </dependency>
             <!--
                 JSON/YAML binding for srcmorph-cli's CConfiguration. Both artifacts are pinned to the

srcmorph-cli/pom.xml

@@ -185,7 +185,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-jar-plugin</artifactId>
-                    <version>3.5.0</version>
+                    <version>3.5.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>

srcmorph-maven-plugin/pom.xml

@@ -255,7 +255,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-jar-plugin</artifactId>
-                    <version>3.5.0</version>
+                    <version>3.5.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>

srcmorph/pom.xml

@@ -189,7 +189,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-jar-plugin</artifactId>
-                    <version>3.5.0</version>
+                    <version>3.5.1</version>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>