Update all non-major dependencies (branch_9x) (#4586)

Co-authored-by: Jan Høydahl <jan.git@cominvent.com>

Author: solrbot

.github/renovate.json

@@ -9,6 +9,33 @@
     "fileFilters": ["solr/licenses/*.sha1"],
     "executionMode": "branch"
   },
+  "packageRules": [
+    {
+      "description": "Pin com.palantir.consistent-versions to 2.32.0; newer versions require Java 17 but branch_9x builds with Java 11",
+      "matchPackageNames": ["com.palantir.consistent-versions"],
+      "allowedVersions": "2.32.0"
+    },
+    {
+      "description": "Pin org.carrot2:carrot2-core to 4.5.1; 4.8.6 requires Java 21 but branch_9x builds with Java 11",
+      "matchPackageNames": ["org.carrot2:carrot2-core"],
+      "allowedVersions": "4.5.1"
+    },
+    {
+      "description": "Keep org.apache.hadoop on 3.4.x; 3.5.0 requires Java 17 but branch_9x builds with Java 11",
+      "matchPackagePrefixes": ["org.apache.hadoop:"],
+      "allowedVersions": "<3.5.0"
+    },
+    {
+      "description": "Pin dev.langchain4j to 0.35.0; 0.36.2 requires Java 17 but branch_9x builds with Java 11",
+      "matchPackagePrefixes": ["dev.langchain4j:"],
+      "allowedVersions": "0.35.0"
+    },
+    {
+      "description": "Keep Error Prone on 2.31.0; the build hard-pins it to 2.31.0 for JDK11 compatibility on branch_9x",
+      "matchPackagePrefixes": ["com.google.errorprone:"],
+      "allowedVersions": "2.31.0"
+    }
+  ],
   "schedule": ["* * * * *"],
   "prConcurrentLimit": 100,
   "prHourlyLimit": 10,

build.gradle

@@ -21,7 +21,7 @@ import java.time.format.DateTimeFormatter
 plugins {
   id 'base'
   id 'com.palantir.consistent-versions' version '2.32.0'
-  id 'org.owasp.dependencycheck' version '12.1.3'
+  id 'org.owasp.dependencycheck' version '12.2.2'
   id 'ca.cutterslade.analyze' version '1.10.0'
   id 'de.thetaphi.forbiddenapis' version '3.10' apply false
   id 'de.undercouch.download' version '5.7.0' apply false

gradle/validation/owasp-dependency-check.gradle

@@ -28,7 +28,7 @@ configure(rootProject) {
     formats = ['ALL']
     skipProjects = [':solr:solr-ref-guide', ':solr-missing-doclet']
     skipConfigurations = ['unifiedClasspath', 'permitUnusedDeclared']
-    suppressionFile = file("${resources}/exclusions.xml")
+    suppressionFile = "${resources}/exclusions.xml"
     analyzers {
       assemblyEnabled = false
     }

versions.lock

@@ -19,7 +19,7 @@ com.fasterxml.jackson.module:jackson-module-scala_2.13:2.22.0 (2 constraints: e7
 com.fasterxml.woodstox:woodstox-core:7.2.0 (3 constraints: 6235ec97)
 com.github.ben-manes.caffeine:caffeine:3.2.4 (2 constraints: 0e123b17)
 com.github.luben:zstd-jni:1.5.6-4 (1 constraints: 600d6236)
-com.github.spotbugs:spotbugs-annotations:4.8.6 (1 constraints: 14051d36)
+com.github.spotbugs:spotbugs-annotations:4.10.2 (1 constraints: 39053d3b)
 com.github.stephenc.jcip:jcip-annotations:1.0-1 (3 constraints: c71d2c87)
 com.github.virtuald:curvesapi:1.08 (1 constraints: 9f0ac8c0)
 com.google.android:annotations:4.1.1.4 (4 constraints: a33b86f4)
@@ -322,6 +322,7 @@ org.jetbrains.kotlin:kotlin-stdlib:2.2.21 (10 constraints: 929b3d90)
 org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.10 (2 constraints: f31f0a21)
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.10 (6 constraints: 745eefc1)
 org.jspecify:jspecify:1.0.0 (8 constraints: 577d1349)
+org.junit:junit-bom:6.1.0 (1 constraints: c0115ade)
 org.locationtech.jts:jts-core:1.19.0 (2 constraints: a31de760)
 org.locationtech.jts.io:jts-io-common:1.19.0 (1 constraints: 930d513a)
 org.locationtech.proj4j:proj4j:1.2.2 (1 constraints: 5d0daf2c)

versions.props

@@ -8,7 +8,7 @@ com.carrotsearch:hppc=0.10.0
 com.cybozu.labs:langdetect=1.1-20120112
 com.fasterxml.jackson:jackson-bom=2.22.0
 com.github.ben-manes.caffeine:caffeine=3.2.4
-com.github.spotbugs:*=4.8.6
+com.github.spotbugs:*=4.10.2
 com.github.stephenc.jcip:jcip-annotations=1.0-1
 com.google.cloud:google-cloud-bom=0.265.0
 com.google.errorprone:*=2.31.0