Bump local dependencies, migrate to Jackson 3, and align conflicting artifact versions

[alexander-yevsyukov]

What changed

Local (Spine) dependency bumps

Artifact	From	To
ToolBase (incl. dogfoodingVersion)	2.0.0-SNAPSHOT.404	2.0.0-SNAPSHOT.410
Base (incl. versionForBuildScript)	2.0.0-SNAPSHOT.426	2.0.0-SNAPSHOT.440
CoreJvm	2.0.0-SNAPSHOT.522	2.0.0-SNAPSHOT.523
Time	2.0.0-SNAPSHOT.244	2.0.0-SNAPSHOT.250
Validation	2.0.0-SNAPSHOT.450	2.0.0-SNAPSHOT.460
Logging	2.0.0-SNAPSHOT.422	2.0.0-SNAPSHOT.423
Change	2.0.0-SNAPSHOT.206	2.0.0-SNAPSHOT.207

ModelCompiler is removed — superseded by the Spine Compiler and no longer
referenced. Compiler.fatCli is corrected from compiler-fat-cli to
compiler-cli-all, which is the artifact actually published by the cliFatJar
publication in cli/build.gradle.kts and the coordinate Artifacts.fatCli()
already returned — the old constant pointed at something that was never
published.

Third-party dependency bumps

Artifact	From	To
Jackson	2.22.1 (com.fasterxml.jackson)	3.2.1 (tools.jackson)
Palantir Java Format	2.91.0	2.97.0
Log4j2	2.26.0	2.26.1
Testcontainers	1.21.4	2.0.5

Jackson 3 renames the coordinates from com.fasterxml.jackson.* to
tools.jackson.*, which is why docs/dependencies/ shows a large diff. A new
JacksonV2 object retains the 2.x line for artifacts that reach us
transitively, and buildSrc/build.gradle.kts stays pinned to Jackson 2.18.3
because the buildSrc sources still use the 2.x API.

Testcontainers 2.x prefixes its module artifacts (junit-jupiter →
testcontainers-junit-jupiter, and so on) while the core artifact keeps the
plain testcontainers name. Nothing in this repository consumes Testcontainers,
so the bump only affects other config consumers.

Forcing the spine-time version

./gradlew clean build reported a genuine cross-module conflict:

The project uses several versions of `io.spine:spine-time` dependency.
module: api,    configuration: implementation, version: 2.0.0-SNAPSHOT.250
module: params, configuration: implementation, version: 2.0.0-SNAPSHOT.244

spine-time arrives by two routes — transitively at .244 (via spine-core →
spine-client → spine-server), and at .250 from our own Time constant
through spine-time-java. Nothing forced it, so conflict resolution picked a
different winner per module.

Time.lib and Time.javaExtensions are now in the allprojects force list in
the root build.gradle.kts, matching what tests/build.gradle.kts already did.
Both are forced together deliberately: pinning spine-time without
spine-time-java would let the core and its extensions diverge, which is a
worse failure than the original.

Aligning the transitive Jackson 2.x line in the integration tests

The Jackson 3 migration moved the Jackson object to the tools.jackson group,
so the existing Jackson.forceArtifacts(...) calls in tests/build.gradle.kts
began pinning the 3.x coordinates and stopped aligning com.fasterxml.jackson.*
— which reaches that build only transitively. Because forceVersions() enables
failOnVersionConflict(), the resulting divergence failed
:compiler-extension:extractIncludeProto outright rather than resolving to the
higher version.

An eachDependency rule now aligns the whole com.fasterxml.jackson group to
JacksonV2.version. A group rule rather than an enumerated force list, because
the conflict also covered artifacts JacksonV2 does not model
(jackson-jr-objects, jackson-module-kotlin). A BOM cannot serve here: the
Protobuf plugin configurations, compileProtoPath among them, ignore
enforcedPlatform — as BomsPlugin.supportsBom already documents.
jackson-annotations is excluded because Jackson 3.x keeps consuming it at its
own version (2.22), forced separately via Jackson.annotations.

The Palantir Java Format bump to 2.97.0 then fixed the same divergence at its
source: 2.97.0 requests jackson-core/databind at exactly 2.22.1 and
jackson-annotations at 2.22, matching JacksonV2.version and
Jackson.annotationsVersion. The alignment rule is therefore currently
belt-and-braces rather than load-bearing — it is kept so a future bump on either
side fails soft instead of reproducing the same opaque conflict.

Housekeeping

• config submodule updated to 02824c32 (on config's master).
• .github/workflows/gradle-wrapper-validation.yml removed.
• @Disabled on JavaCodeStyleFormatterPluginSpec now carries its reason.
• Version bumped to 2.0.0-SNAPSHOT.066.
• docs/dependencies/{pom.xml,dependencies.md} regenerated. dependencies.md
  grows substantially because ToolBase .410 widens the IntelliJ Platform
  transitive surface; the module-section count is unchanged, so this is added
  entries rather than duplication.

Verification

Run locally on JDK 21:

• ./gradlew build dokkaGenerate — PASS, no version-conflict diagnostics.
• tests/./gradlew clean build (integration) — PASS, including
  :compiler-extension:extractIncludeProto, the task that previously failed.
• docs/dependencies/pom.xml records spine-time at 2.0.0-SNAPSHOT.250.

Reviewers run: spine-code-review, kotlin-engineer, dependency-audit,
review-docs.

Notes for the reviewer

• The branch is behind master (which merged Update config #84). Both sides carry their own
  Bump version -> 2.0.0-SNAPSHOT.065 commit, so version.gradle.kts, the
  config pointer, and docs/dependencies/ may need conflict resolution on
  merge. This branch is at .066, above master's .065, so the version gate
  holds.
• dependency-audit finding, for the config repo rather than this branch:
  four symbols were removed without the conventional @Deprecated tombstone —
  ModelCompiler, Compiler.cliApi, Validation.model, and
  Validation.configModule. No caller survives here, but other config
  consumers may still reference them. The same diff handles this correctly for
  the Jackson symbols, which is the pattern to copy.
• Separately tracked bug in config's POM reporter. generatePom resolves
  subprojects' configurations from a root task action, which Gradle 9.6 rejects
  (IllegalResolutionException: ... without an exclusive lock). The failure is
  swallowed and logged at info, so the report silently falls back to
  declared versions and its content depends on which tasks ran before it —
  making standalone ./gradlew generatePom emit false "several versions"
  warnings for artifacts that force(...) has already reconciled. Written up in
  the config repo as .agents/tasks/pom-report-cross-project-resolution.md;
  out of scope here.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates this repository’s build and dependency model to newer Spine snapshots and modernizes third‑party dependencies by migrating to Jackson 3 while explicitly managing remaining Jackson 2.x transitives and resolving cross-module version conflicts.

Changes:

• Bump local Spine dependency snapshots and project version to 2.0.0-SNAPSHOT.066, removing obsolete coordinates (ModelCompiler, Compiler.cliApi) and correcting the Compiler fat CLI artifact coordinate.
• Migrate Jackson to tools.jackson:* (3.x) while keeping a modeled Jackson 2.x line (JacksonV2) to align transitive com.fasterxml.jackson:* dependencies (notably for integration tests).
• Address build/reproducibility and dependency consistency: force spine-time consistently, opt the license report task out of build cache, and regenerate dependency reporting POM.

Reviewed changes

Copilot reviewed 22 out of 24 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
version.gradle.kts	Bumps the compiler/project version to 2.0.0-SNAPSHOT.066.
tests/build.gradle.kts	Adds Jackson 2.x alignment for transitive com.fasterxml.jackson:* while keeping Jackson 3 as the declared line.
jvm/src/test/kotlin/io/spine/tools/compiler/jvm/style/JavaCodeStyleFormatterPluginSpec.kt	Adds a reason to the disabled test annotation.
docs/dependencies/pom.xml	Regenerates dependency report POM reflecting updated versions and Jackson 3 coordinates.
buildSrc/src/main/kotlin/io/spine/gradle/report/license/LicenseReporter.kt	Disables build-cache for license report generation; uses shared path constants via imports.
buildSrc/src/main/kotlin/io/spine/dependency/test/Testcontainers.kt	Bumps Testcontainers to 2.x and updates module coordinates to the new prefixed artifact names.
buildSrc/src/main/kotlin/io/spine/dependency/local/Validation.kt	Bumps Validation version and removes unused legacy coordinates.
buildSrc/src/main/kotlin/io/spine/dependency/local/ToolBase.kt	Bumps ToolBase (and dogfooding) versions.
buildSrc/src/main/kotlin/io/spine/dependency/local/Time.kt	Bumps Spine Time version.
buildSrc/src/main/kotlin/io/spine/dependency/local/ModelCompiler.kt	Removes the obsolete ModelCompiler dependency definition.
buildSrc/src/main/kotlin/io/spine/dependency/local/Logging.kt	Bumps Spine Logging version.
buildSrc/src/main/kotlin/io/spine/dependency/local/CoreJvm.kt	Bumps Spine Core JVM version.
buildSrc/src/main/kotlin/io/spine/dependency/local/Compiler.kt	Bumps fallback Compiler versions, removes cliApi, and corrects fat CLI artifact coordinate.
buildSrc/src/main/kotlin/io/spine/dependency/local/Change.kt	Bumps Spine Change version.
buildSrc/src/main/kotlin/io/spine/dependency/local/Base.kt	Bumps Spine Base versions (including buildscript version).
buildSrc/src/main/kotlin/io/spine/dependency/lib/Roaster.kt	Removes outdated Roaster Java-version note (keeping the current version).
buildSrc/src/main/kotlin/io/spine/dependency/lib/PalantirJavaFormat.kt	Bumps Palantir Java Format version.
buildSrc/src/main/kotlin/io/spine/dependency/lib/Log4j2.kt	Bumps Log4j2 and adds an explicit SLF4J 2.x bridge coordinate.
buildSrc/src/main/kotlin/io/spine/dependency/lib/JacksonV2.kt	Introduces modeled Jackson 2.x dependency line for transitive alignment.
buildSrc/src/main/kotlin/io/spine/dependency/lib/Jackson.kt	Migrates Jackson to 3.x tools.jackson coordinates and documents the annotations exception.
buildSrc/src/main/kotlin/io/spine/dependency/boms/Boms.kt	Switches optional Jackson BOM to Jackson 2.x (JacksonV2.bom).
buildSrc/src/main/kotlin/BuildExtensions.kt	Adds shared excludeJetBrainsAnnotations() helper for published dependencies.
buildSrc/build.gradle.kts	Clarifies why buildSrc stays pinned to Jackson 2.x API/coordinates.
build.gradle.kts	Forces spine-time and spine-time-java consistently across all projects.
.github/workflows/gradle-wrapper-validation.yml	Removes the Gradle wrapper validation workflow.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 22 out of 24 changed files in this pull request and generated no new comments.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.89%. Comparing base (d93a34d) to head (9f6f464).

Additional details and impacted files

@@            Coverage Diff            @@
##             master      #85   +/-   ##
=========================================
  Coverage     76.89%   76.89%           
  Complexity      688      688           
=========================================
  Files           205      205           
  Lines          4025     4025           
  Branches        402      402           
=========================================
  Hits           3095     3095           
  Misses          800      800           
  Partials        130      130           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Copilot reviewed 22 out of 24 changed files in this pull request and generated no new comments.