build(pom): collect dep versions in properties, bump dep/plugin versions, make javadoc strict

.gitignore

@@ -48,4 +48,7 @@ src/test/resources/**/*.gbnf
 
 **/*.etag
 **/*.lastModified
-src/main/cpp/llama.cpp/
+src/main/cpp/llama.cpp/
+
+# jcstress / jqwik test outputs (generated in repo root)
+/.jqwik-database

CLAUDE.md

@@ -921,3 +921,18 @@ In Javadoc comments, never use bare Unicode characters for operators and symbols
 | `≠` | `≠` |
 
 Use numeric hex entities (`&#xNNNN;`) for any Unicode symbol outside ASCII. Named entities (`&lt;`, `&gt;`) are acceptable for `<` and `>`.
+
+## SpotBugs Suppressions
+
+`spotbugs-exclude.xml` at the repo root contains documented suppressions for findings that are by-design or false positives. **When refactoring or renaming code referenced in that file, re-check the affected `<Match>` blocks:**
+
+- `<Class>`, `<Method>`, and `<Field>` filters use exact string matches — a rename silently disables the suppression and may either un-suppress a real bug or leave a stale entry behind.
+- After refactors, run `mvn -B -ntp -DskipTests -Dgpg.skip=true verify` and confirm the BugInstance count is unchanged. A drop means a suppression is now stale and should be deleted; an increase means a new finding needs its own decision (fix vs. suppress).
+- Keep the rationale comment on each `<Match>` accurate — if the original justification no longer applies to the post-refactor code, remove the suppression rather than leave outdated reasoning in place.
+- Never use `--` inside `<!-- ... -->` comment bodies in `spotbugs-exclude.xml` — XML forbids it and the entire filter file silently stops loading (every previously suppressed finding reappears).
+
+## Open TODOs
+
+- **`@VisibleForTesting` audit.** No usages currently. Walk the production tree for package-private/protected methods or fields that exist purely so tests can reach them, and either annotate (`com.google.common.annotations.VisibleForTesting`) or move into the test source tree.
+- **Strict null-safety with Maven hard-check.** Nullability annotations today are sporadic and from `org.jetbrains.annotations`. Migrate to JSpecify (`org.jspecify:jspecify`) and add Error Prone + NullAway in the compiler plugin so the build fails on potential NPEs (the BitcoinAddressFinder pom.xml already does this and is a working reference).
+- **At least one LogCaptor smoke test.** SLF4J + Logback are wired in (`OSInfo` uses an SLF4J logger; `LlamaLoader` deliberately uses `System.err` for bootstrap). Add a `LogCaptor.forClass(OSInfo.class)` test that confirms a known log message actually fires through the configured pipeline, so a future logback misconfiguration is caught at test time rather than silently swallowed.

pom.xml

@@ -50,14 +50,24 @@ SPDX-License-Identifier: MIT
 
 	<properties>
 		<jna.version>5.18.1</jna.version>
+		<jetbrains-annotations.version>26.1.0</jetbrains-annotations.version>
+		<jackson.version>2.21.3</jackson.version>
+		<reactive-streams.version>1.0.4</reactive-streams.version>
+		<slf4j.version>2.0.18</slf4j.version>
+		<logback.version>1.5.32</logback.version>
+		<animal-sniffer.version>1.27</animal-sniffer.version>
+		<junit.version>6.1.0</junit.version>
+		<jmh.version>1.37</jmh.version>
 		<jcstress.version>0.16</jcstress.version>
 		<lincheck.version>2.39</lincheck.version>
 		<vmlens.version>1.2.28</vmlens.version>
-		<jqwik.version>1.9.2</jqwik.version>
-		<archunit.version>1.3.0</archunit.version>
-		<spotbugs.version>4.8.6.6</spotbugs.version>
+		<jqwik.version>1.10.0</jqwik.version>
+		<archunit.version>1.4.2</archunit.version>
+		<spotbugs.version>4.9.8.3</spotbugs.version>
 		<fb-contrib.version>7.6.4</fb-contrib.version>
-		<findsecbugs.version>1.13.0</findsecbugs.version>
+		<findsecbugs.version>1.14.0</findsecbugs.version>
+		<spotless.version>3.5.1</spotless.version>
+		<palantir-java-format.version>2.66.0</palantir-java-format.version>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<project.build.outputTimestamp>${git.commit.time}</project.build.outputTimestamp>
 	</properties>
@@ -66,7 +76,7 @@ SPDX-License-Identifier: MIT
 		<dependency>
 			<groupId>org.junit.jupiter</groupId>
 			<artifactId>junit-jupiter</artifactId>
-			<version>6.1.0</version>
+			<version>${junit.version}</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>
@@ -84,34 +94,34 @@ SPDX-License-Identifier: MIT
 		<dependency>
 			<groupId>org.jetbrains</groupId>
 			<artifactId>annotations</artifactId>
-			<version>26.1.0</version>
+			<version>${jetbrains-annotations.version}</version>
 			<scope>compile</scope>
 		</dependency>
 		<dependency>
 			<groupId>com.fasterxml.jackson.core</groupId>
 			<artifactId>jackson-databind</artifactId>
-			<version>2.21.3</version>
+			<version>${jackson.version}</version>
 		</dependency>
 		<!-- Reactive Streams API used by LlamaPublisher to expose token streams as a
 		     Publisher<LlamaOutput>. Java 8 compatible, ~5 KB, supplies the standard
 		     interfaces that Reactor / RxJava / Kotlin coroutines bridge to. -->
 		<dependency>
 			<groupId>org.reactivestreams</groupId>
 			<artifactId>reactive-streams</artifactId>
-			<version>1.0.4</version>
+			<version>${reactive-streams.version}</version>
 		</dependency>
 		<!-- Required by OSInfo (vendored from xerial/sqlite-jdbc) for log emission. -->
 		<dependency>
 			<groupId>org.slf4j</groupId>
 			<artifactId>slf4j-api</artifactId>
-			<version>2.0.18</version>
+			<version>${slf4j.version}</version>
 		</dependency>
 		<!-- Default SLF4J binding shipped with this library. Runtime scope: not
 		     required on the compile classpath, only loaded at JVM startup. -->
 		<dependency>
 			<groupId>ch.qos.logback</groupId>
 			<artifactId>logback-classic</artifactId>
-			<version>1.5.32</version>
+			<version>${logback.version}</version>
 			<scope>runtime</scope>
 		</dependency>
 		<!-- @IgnoreJRERequirement marker used by OSInfo (vendored from xerial/sqlite-jdbc)
@@ -120,19 +130,19 @@ SPDX-License-Identifier: MIT
 		<dependency>
 			<groupId>org.codehaus.mojo</groupId>
 			<artifactId>animal-sniffer-annotations</artifactId>
-			<version>1.27</version>
+			<version>${animal-sniffer.version}</version>
 			<scope>provided</scope>
 		</dependency>
 		<dependency>
 			<groupId>org.openjdk.jmh</groupId>
 			<artifactId>jmh-core</artifactId>
-			<version>1.37</version>
+			<version>${jmh.version}</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>
 			<groupId>org.openjdk.jmh</groupId>
 			<artifactId>jmh-generator-annprocess</artifactId>
-			<version>1.37</version>
+			<version>${jmh.version}</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>
@@ -150,11 +160,84 @@ SPDX-License-Identifier: MIT
 	</dependencies>
 
 	<build>
+		<pluginManagement>
+			<plugins>
+				<plugin>
+					<groupId>com.diffplug.spotless</groupId>
+					<artifactId>spotless-maven-plugin</artifactId>
+					<version>${spotless.version}</version>
+				</plugin>
+				<plugin>
+					<groupId>com.github.spotbugs</groupId>
+					<artifactId>spotbugs-maven-plugin</artifactId>
+					<version>${spotbugs.version}</version>
+				</plugin>
+				<plugin>
+					<groupId>com.vmlens</groupId>
+					<artifactId>vmlens-maven-plugin</artifactId>
+					<version>${vmlens.version}</version>
+				</plugin>
+				<plugin>
+					<groupId>io.github.git-commit-id</groupId>
+					<artifactId>git-commit-id-maven-plugin</artifactId>
+					<version>10.0.0</version>
+				</plugin>
+				<plugin>
+					<groupId>org.apache.maven.plugins</groupId>
+					<artifactId>maven-compiler-plugin</artifactId>
+					<version>3.15.0</version>
+				</plugin>
+				<plugin>
+					<groupId>org.apache.maven.plugins</groupId>
+					<artifactId>maven-gpg-plugin</artifactId>
+					<version>3.2.8</version>
+				</plugin>
+				<plugin>
+					<groupId>org.apache.maven.plugins</groupId>
+					<artifactId>maven-jar-plugin</artifactId>
+					<version>3.5.0</version>
+				</plugin>
+				<plugin>
+					<groupId>org.apache.maven.plugins</groupId>
+					<artifactId>maven-javadoc-plugin</artifactId>
+					<version>3.12.0</version>
+				</plugin>
+				<plugin>
+					<groupId>org.apache.maven.plugins</groupId>
+					<artifactId>maven-resources-plugin</artifactId>
+					<version>3.5.0</version>
+				</plugin>
+				<plugin>
+					<groupId>org.apache.maven.plugins</groupId>
+					<artifactId>maven-source-plugin</artifactId>
+					<version>3.4.0</version>
+				</plugin>
+				<plugin>
+					<groupId>org.apache.maven.plugins</groupId>
+					<artifactId>maven-surefire-plugin</artifactId>
+					<version>3.5.5</version>
+				</plugin>
+				<plugin>
+					<groupId>org.codehaus.mojo</groupId>
+					<artifactId>exec-maven-plugin</artifactId>
+					<version>3.6.3</version>
+				</plugin>
+				<plugin>
+					<groupId>org.jacoco</groupId>
+					<artifactId>jacoco-maven-plugin</artifactId>
+					<version>0.8.14</version>
+				</plugin>
+				<plugin>
+					<groupId>org.sonatype.central</groupId>
+					<artifactId>central-publishing-maven-plugin</artifactId>
+					<version>0.10.0</version>
+				</plugin>
+			</plugins>
+		</pluginManagement>
 		<plugins>
 			<plugin>
 				<groupId>io.github.git-commit-id</groupId>
 				<artifactId>git-commit-id-maven-plugin</artifactId>
-				<version>10.0.0</version>
 				<executions>
 					<execution>
 						<id>get-git-properties</id>
@@ -174,7 +257,6 @@ SPDX-License-Identifier: MIT
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-compiler-plugin</artifactId>
-				<version>3.15.0</version>
 				<configuration>
 					<source>1.8</source>
 					<target>1.8</target>
@@ -194,7 +276,7 @@ SPDX-License-Identifier: MIT
 								<path>
 									<groupId>org.openjdk.jmh</groupId>
 									<artifactId>jmh-generator-annprocess</artifactId>
-									<version>1.37</version>
+									<version>${jmh.version}</version>
 								</path>
 							</annotationProcessorPaths>
 						</configuration>
@@ -236,7 +318,6 @@ SPDX-License-Identifier: MIT
 			</plugin>
 			<plugin>
 				<artifactId>maven-resources-plugin</artifactId>
-				<version>3.5.0</version>
 				<executions>
 					<!-- Copy custom cuda libs to the output directory -->
 					<execution>
@@ -285,7 +366,6 @@ SPDX-License-Identifier: MIT
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-source-plugin</artifactId>
-				<version>3.4.0</version>
 				<executions>
 					<execution>
 						<id>attach-sources</id>
@@ -298,9 +378,11 @@ SPDX-License-Identifier: MIT
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-javadoc-plugin</artifactId>
-				<version>3.12.0</version>
 				<configuration>
 					<source>1.8</source>
+					<failOnError>true</failOnError>
+					<failOnWarnings>true</failOnWarnings>
+					<doclint>all</doclint>
 				</configuration>
 				<executions>
 					<execution>
@@ -314,7 +396,6 @@ SPDX-License-Identifier: MIT
 			<plugin>
 				<groupId>org.jacoco</groupId>
 				<artifactId>jacoco-maven-plugin</artifactId>
-				<version>0.8.14</version>
 				<executions>
 					<execution>
 						<id>prepare-agent</id>
@@ -346,7 +427,6 @@ SPDX-License-Identifier: MIT
 				-->
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-surefire-plugin</artifactId>
-				<version>3.5.5</version>
 				<configuration>
 					<argLine>@{argLine} -XX:ErrorFile=hs_err_pid%p.log -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=.</argLine>
 					<!--
@@ -360,10 +440,36 @@ SPDX-License-Identifier: MIT
 					<redirectTestOutputToFile>true</redirectTestOutputToFile>
 				</configuration>
 			</plugin>
+			<plugin>
+				<groupId>com.diffplug.spotless</groupId>
+				<artifactId>spotless-maven-plugin</artifactId>
+				<configuration>
+					<java>
+						<includes>
+							<include>src/main/java/**/*.java</include>
+							<include>src/test/java/**/*.java</include>
+						</includes>
+						<palantirJavaFormat>
+							<version>${palantir-java-format.version}</version>
+						</palantirJavaFormat>
+						<removeUnusedImports/>
+						<trimTrailingWhitespace/>
+						<endWithNewline/>
+					</java>
+				</configuration>
+				<executions>
+					<execution>
+						<id>spotless-check</id>
+						<phase>verify</phase>
+						<goals>
+							<goal>check</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
 			<plugin>
 				<groupId>com.github.spotbugs</groupId>
 				<artifactId>spotbugs-maven-plugin</artifactId>
-				<version>${spotbugs.version}</version>
 				<configuration>
 					<effort>Default</effort>
 					<threshold>Default</threshold>
@@ -396,7 +502,6 @@ SPDX-License-Identifier: MIT
 			<plugin>
 				<groupId>org.codehaus.mojo</groupId>
 				<artifactId>exec-maven-plugin</artifactId>
-				<version>3.6.3</version>
 				<configuration>
 					<mainClass>org.openjdk.jmh.Main</mainClass>
 					<classpathScope>test</classpathScope>
@@ -433,7 +538,6 @@ SPDX-License-Identifier: MIT
 					<plugin>
 						<groupId>org.apache.maven.plugins</groupId>
 						<artifactId>maven-gpg-plugin</artifactId>
-						<version>3.2.8</version>
 						<executions>
 							<execution>
 								<id>sign-artifacts</id>
@@ -453,7 +557,6 @@ SPDX-License-Identifier: MIT
 					<plugin>
 						<groupId>org.sonatype.central</groupId>
 						<artifactId>central-publishing-maven-plugin</artifactId>
-						<version>0.10.0</version>
 						<extensions>true</extensions>
 						<configuration>
 							<publishingServerId>central</publishingServerId>
@@ -472,7 +575,6 @@ SPDX-License-Identifier: MIT
 					<plugin>
 						<groupId>org.apache.maven.plugins</groupId>
 						<artifactId>maven-jar-plugin</artifactId>
-						<version>3.5.0</version>
 						<executions>
 							<!-- Pick class files AND libs from custom output
 							directory -->
@@ -501,7 +603,6 @@ SPDX-License-Identifier: MIT
 					<plugin>
 						<groupId>org.apache.maven.plugins</groupId>
 						<artifactId>maven-jar-plugin</artifactId>
-						<version>3.5.0</version>
 						<executions>
 							<!-- Pick class files AND libs from custom output
 							directory -->
@@ -537,7 +638,6 @@ SPDX-License-Identifier: MIT
 					<plugin>
 						<groupId>com.vmlens</groupId>
 						<artifactId>vmlens-maven-plugin</artifactId>
-						<version>${vmlens.version}</version>
 						<configuration>
 							<!--
 								Lincheck generates its own TestThreadExecution class on the fly.