fix(deps): update all dependencies j:cdx-227 (major)

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update	Pending
@commitlint/config-conventional (source)	19.8.1 -> 20.0.0					devDependencies	major
@octokit/auth-app	^7.0.0 -> ^8.0.0					devDependencies	major
actions/checkout	v4.3.0 -> v5.0.0					action	major
actions/checkout	v4 -> v5					action	major
actions/setup-java	v4.7.1 -> v5.0.0					action	major
actions/setup-node	v4.4.0 -> v5.0.0					action	major	v6.0.0
com.diffplug.spotless:spotless-maven-plugin	2.46.1 -> 3.0.0					build	major
io.github.resilience4j:resilience4j-retry (source)	1.7.1 -> 2.3.0					compile	major

---

Release Notes

conventional-changelog/commitlint (@​commitlint/config-conventional)

v20.0.0

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

19.8.1 (2025-05-08)

Note: Version bump only for package @​commitlint/config-conventional

octokit/auth-app.js (@​octokit/auth-app)

v8.1.1

Compare Source

Bug Fixes

• deps: update dependency @​octokit/types to v15 (#​721) (8b76e56)

v8.1.0

Compare Source

Features

• support using a remote HSM or JWT signing service in lieu of private keys (#​712) (ef7a95d)

v8.0.2

Compare Source

Bug Fixes

• dont lose this reference for loggers (#​708) (06900f0)

v8.0.1

Compare Source

Bug Fixes

• deps: update octokit monorepo (major) (#​704) (56cded1)

v8.0.0

Compare Source

Continuous Integration

• stop testing against NodeJS v18 (#​702) (a168de5)

BREAKING CHANGES

• Drop support for NodeJS v18

• build: set minimal node version in build script to v20

• ci: stop testing against NodeJS v18

actions/checkout (actions/checkout)

v5.0.0

Compare Source

What's Changed

• Update actions checkout to use node 24 by @​salmanmkc in #​2226
• Prepare v5.0.0 release by @​salmanmkc in #​2238

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

actions/setup-java (actions/setup-java)

v5.0.0

Compare Source

What's Changed

Breaking Changes

• Upgrade to node 24 by @​salmanmkc in #​888

Make sure your runner is updated to this version or newer to use this release. v2.327.1 Release Notes

Dependency Upgrades

• Upgrade Publish Immutable Action by @​HarithaVattikuti in #​798
• Upgrade eslint-plugin-jest from 27.9.0 to 28.11.0 by @​dependabot[bot] in #​730
• Upgrade undici from 5.28.5 to 5.29.0 by @​dependabot[bot] in #​833
• Upgrade form-data to bring in fix for critical vulnerability by @​gowridurgad in #​887
• Upgrade actions/checkout from 4 to 5 by @​dependabot[bot] in #​896

Bug Fixes

• Prevent default installation of JetBrains pre-releases by @​priyagupta108 in #​859
• Improve Error Handling for Setup-Java Action to Help Debug Intermittent Failures by @​gowridurgad in #​848

New Contributors

• @​gowridurgad made their first contribution in #​848
• @​salmanmkc made their first contribution in #​888

Full Changelog: actions/setup-java@v4...v5.0.0

actions/setup-node (actions/setup-node)

v5.0.0

Compare Source

What's Changed

Breaking Changes

• Enhance caching in setup-node with automatic package manager detection by @​priya-kinthali in #​1348

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless.
To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

• Upgrade action to use node24 by @​salmanmkc in #​1325

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

• Upgrade @​octokit/request-error and @​actions/github by @​dependabot[bot] in #​1227
• Upgrade uuid from 9.0.1 to 11.1.0 by @​dependabot[bot] in #​1273
• Upgrade undici from 5.28.5 to 5.29.0 by @​dependabot[bot] in #​1295
• Upgrade form-data to bring in fix for critical vulnerability by @​gowridurgad in #​1332
• Upgrade actions/checkout from 4 to 5 by @​dependabot[bot] in #​1345

New Contributors

• @​priya-kinthali made their first contribution in #​1348
• @​salmanmkc made their first contribution in #​1325

Full Changelog: actions/setup-node@v4...v5.0.0

diffplug/spotless (com.diffplug.spotless:spotless-maven-plugin)

v3.0.0

[3.0.0] - 2025-01-06

resilience4j/resilience4j (io.github.resilience4j:resilience4j-retry)

v2.3.0

Compare Source

Enhancements

• Issue #​2234: Allow passing custom Clock to CircuitBreaker without needing to use internal API.
• Issue #​2131: Added support for RxJava3 in Spring projects.
• Issue #​2029: Include decorateSupplier as a Retry instance method.
• Issue #​2246: Add handling for the case where a non-checked retry consumer is interrupted during sleep.
• Issue #​2245: Refactor Retry#executeSuspendExecute condition to enhance consistency with FlowRetry.
• Issue #​2232: Convert Synchronized to ReentrantLock to avoid virtual-thread pinning issues.
• Issue #​2241: Implement a lock-free sliding window for internal CircuitBreaker metrics.
• Issue #​2239: Add a Clock to CircuitBreakerConfig and utilize it in the state machine.
• Issue #​2200: Ignore unknown exceptions in CircuitBreaker configuration.
• Issue #​2233: Improve exception message for failure rate threshold in CircuitBreaker configuration.
• Issue #​1404: Configure exponential backoff or randomized wait duration if base configuration allows it.
• Issue #​2179: Ensure RateLimiter.executeSuspendFunction respects drainPermissionsOnResult in the configuration.
• Issue #​2152: Ensure the randomize function always returns a number greater than 1.0.
• Issue #​2130: Add support for Feign 12.5+.
• Issue #​2121: Specify required RateLimiter permits in annotations.

Bugs

• Issue #​2243: Fixed potential memory leak in DefaultEventConsumerRegistry.
• Issue #​2209: Resolved issue where CompletionStage does not complete on user-supplied predicate failures.
• Issue #​2190: Fixed StackOverflowError and circular reference in CircuitBreaker configuration handling.
• Issue #​2175: Fixed validation error message for slowCallDurationThreshold.

v2.2.0

Compare Source

Enhancements

• Support Micronaut 4
• Issue #​1962: Added apache commons configuration based registries

Bugs

• Issue #​2052: Support class name using SpEL expression at @​Circuitbreaker name field enhancement
• Issue #​2040: ThreadPoolBulkhead always uses the "default" configuration in micronaut application bug
• Issue #​2037: Removing stale retry configurations from configuration map enhancement
• Issue #​1625: New module that collects overall information enhancement
• Issue #​1565: Do not retry if IntervalFunction returns interval less than 0
• Issue #​1865: Timelimiter always uses the "default" configuration in micronaut application
• Issue #​2038: java.lang.StackOverflowError due to infinite loop in CircuitBreakerStateMachine$OpenState.tryAcquirePermission

v2.1.0

Compare Source

Enhancements

• Fallbackmethod supports usage of annotations in Spring
• Issue #​1955: RecordResultPredicate can be configured in Spring Boot config now

Bugs

• Issue #​1980: Fixed API regression following removal of io.vavr dependencies in v2.0.0

v2.0.2

Compare Source

Bugs

• Issue #​1835: Fixed CircuitBreaker CheckedSupplier and CheckedFunction decorator not opening on recordResultPredicate

v2.0.1

Compare Source

Enhancements

• Support Spring Boot 3 by adding resilience4j-spring-boot3 and resilience4j-spring6

• Issue #​1787: Apply Spring Boot customizers even if there is no instance entry in the config file

Bugs

• Issue #​1825: Aspectj must not be mandatory in Spring Boot modules

• Issue #​1809: Fixed concurrency issue in Cache module

v2.0.0

Compare Source

• Removed Vavr as a dependency
• Upgraded to Java 17
• Upgraded to Kotlin 1.7.20
• Upgraded to Spring Boot 2.7
• Upgraded to Micronaut 3.7.3

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) in timezone America/Toronto, Automerge - "after 9:00am and before 12:00pm on tuesday, wednesday, thursday" in timezone America/Toronto.

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[alexprudhomme]

cant update this without Java 17