Bump local dependencies, migrate to Jackson 3, and align conflicting artifact versions

build.gradle.kts

@@ -31,6 +31,7 @@ import io.spine.dependency.local.Base
 import io.spine.dependency.local.CoreJvm
 import io.spine.dependency.local.Reflect
 import io.spine.dependency.local.TestLib
+import io.spine.dependency.local.Time
 import io.spine.dependency.local.Validation
 import io.spine.gradle.RunBuild
 import io.spine.gradle.publish.PublishingRepos
@@ -111,6 +112,8 @@ allprojects {
                 Reflect.lib,
                 Base.lib,
                 TestLib.lib,
+                Time.lib,
+                Time.javaExtensions,
                 CoreJvm.server,
                 Validation.runtime,
                 Validation.javaBundle

buildSrc/build.gradle.kts

@@ -47,8 +47,11 @@ repositories {
 /**
  * The version of Jackson used by `buildSrc`.
  *
- * Please keep this value in sync with [io.spine.dependency.lib.Jackson.version].
- * It is not a requirement but would be good in terms of consistency.
+ * This value is deliberately decoupled from [io.spine.dependency.lib.Jackson.version],
+ * which now points to Jackson 3.x. The `buildSrc` sources still use the Jackson 2.x API
+ * (`com.fasterxml.jackson.*`), so they must stay on a 2.x version until they are migrated
+ * to `tools.jackson.*`. Any maintained 2.x release will do — bump this only when `buildSrc`
+ * itself needs a fix from a later 2.x, not to track the newest one.
  */
 val jacksonVersion = "2.18.3"
 

buildSrc/src/main/kotlin/BuildExtensions.kt

@@ -356,11 +356,12 @@ fun Project.allowDuplicationInSourcesJar() {
  *
  * Build script classpaths pin the module to the version used by the Kotlin
  * runtime embedded into Gradle (`strictly 13.0`, "Pinned to the embedded
- * Kotlin"), while `kotlinx-coroutines` and other transitive dependencies of
- * this plugin require `23.0.0`. Gradle 9.6 may fail to reconcile the two
- * declarations — the outcome depends on the shape of the consumer's dependency
- * graph — making the plugin unresolvable without a consumer-side workaround,
- * such as forcing the module version on the build script classpath.
+ * Kotlin"), while `kotlinx-coroutines` and other transitive dependencies require
+ * later versions such as `23.0.0`.
+ * Gradle 9.6 may fail to reconcile the two declarations — the outcome depends on
+ * the shape of the consumer's dependency graph — making the plugin unresolvable
+ * without a consumer-side workaround, such as forcing the module version on
+ * the build script classpath.
  *
  * The annotations are compile-time metadata, not needed at runtime.
  * Consumers still receive version `13.0` through the `kotlin-stdlib`

buildSrc/src/main/kotlin/io/spine/dependency/boms/Boms.kt

@@ -28,7 +28,7 @@ package io.spine.dependency.boms
 
 import io.spine.dependency.DependencyWithBom
 import io.spine.dependency.kotlinx.Coroutines
-import io.spine.dependency.lib.Jackson
+import io.spine.dependency.lib.JacksonV2
 import io.spine.dependency.lib.Kotlin
 import io.spine.dependency.lib.Grpc
 import io.spine.dependency.test.JUnit
@@ -60,7 +60,7 @@ object Boms {
      * Technology-based BOMs.
      */
     object Optional {
-        val jackson = Jackson.bom
+        val jackson = JacksonV2.bom
         val grpc = Grpc.bom
     }
 }

buildSrc/src/main/kotlin/io/spine/dependency/lib/Jackson.kt

@@ -29,13 +29,35 @@ package io.spine.dependency.lib
 import io.spine.dependency.Dependency
 import io.spine.dependency.DependencyWithBom
 
-// https://github.com/FasterXML/jackson/wiki/Jackson-Releases
-@Suppress("unused")
+/**
+ * Jackson library dependencies.
+ *
+ * Jackson 3.x uses the `tools.jackson` group ID and the matching `tools.jackson.*`
+ * packages ([JSTEP-1](https://github.com/FasterXML/jackson-future-ideas/wiki/JSTEP-1)).
+ * The sole exception is `jackson-annotations`: Jackson 3.x keeps
+ * consuming the 2.x artifact, so both its coordinates and its
+ * `com.fasterxml.jackson.annotation` package stay unchanged.
+ *
+ * The Jackson 2.x artifacts, which some of our dependencies still consume,
+ * are declared by [JacksonV2].
+ *
+ * See:
+ *  - [Jackson Releases](https://github.com/FasterXML/jackson/wiki/Jackson-Releases)
+ *  - [Migrating to Jackson 3](https://github.com/FasterXML/jackson/blob/main/jackson3/MIGRATING_TO_JACKSON_3.md)
+ */
+@Suppress("unused", "ConstPropertyName")
 object Jackson : DependencyWithBom() {
-    override val group = "com.fasterxml.jackson"
-    override val version = "2.22.1"
-
-    // https://github.com/FasterXML/jackson-annotations?tab=readme-ov-file#release-notes
+    override val group = "tools.jackson"
+    override val version = "3.2.1"
+
+    /**
+     * The version of `jackson-annotations`, which Jackson 3.x deliberately keeps
+     * on the 2.x line.
+     *
+     * Must match the `jackson.version.annotations` property declared by the [JacksonV2.bom].
+     *
+     * See: https://github.com/FasterXML/jackson-annotations?tab=readme-ov-file#release-notes
+     */
     const val annotationsVersion = "2.22"
 
     // https://github.com/FasterXML/jackson-bom
@@ -54,19 +76,23 @@ object Jackson : DependencyWithBom() {
     val databind = "$coreGroup:jackson-databind"
 
     // https://github.com/FasterXML/jackson-annotations
-    val annotations = "$coreGroup:jackson-annotations:$annotationsVersion"
+    val annotations = "com.fasterxml.jackson.core:jackson-annotations:$annotationsVersion"
 
     // https://github.com/FasterXML/jackson-module-kotlin/releases
     val moduleKotlin = "$moduleGroup:jackson-module-kotlin"
 
-    // https://github.com/FasterXML/jackson-modules-java8
+    @Deprecated(
+        "The module was merged into `jackson-databind` in Jackson 3.0" +
+                " and is no longer published.",
+        ReplaceWith("Jackson.databind", "io.spine.dependency.lib.Jackson"),
+        level = DeprecationLevel.ERROR
+    )
     val moduleParameterNames = "$moduleGroup:jackson-module-parameter-names"
 
     override val modules = listOf(
         core,
         databind,
-        moduleKotlin,
-        moduleParameterNames
+        moduleKotlin
     )
 
     object DataFormat : Dependency() {
@@ -81,10 +107,13 @@ object Jackson : DependencyWithBom() {
         // https://github.com/FasterXML/jackson-dataformats-text/releases
         val yaml = "$group:$infix-yaml"
 
+        // https://github.com/FasterXML/jackson-dataformats-binary/tree/3.x/protobuf
+        val protobuf = "$group:$infix-protobuf"
+
         val xmlArtifact = "$xml:$version"
         val yamlArtifact = "$yaml:$version"
 
-        override val modules = listOf(xml, yaml)
+        override val modules = listOf(xml, yaml, protobuf)
     }
 
     object DataType : Dependency() {
@@ -93,38 +122,50 @@ object Jackson : DependencyWithBom() {
 
         private const val infix = "jackson-datatype"
 
-        // https://github.com/FasterXML/jackson-modules-java8
+        @Deprecated(
+            "The module was merged into `jackson-databind` in Jackson 3.0" +
+                    " and is no longer published.",
+            ReplaceWith("Jackson.databind", "io.spine.dependency.lib.Jackson"),
+            level = DeprecationLevel.ERROR
+        )
         val jdk8 = "$group:$infix-jdk8"
 
-        // https://github.com/FasterXML/jackson-modules-java8/tree/2.19/datetime
+        @Deprecated(
+            "The module was merged into `jackson-databind` in Jackson 3.0" +
+                    " and is no longer published.",
+            ReplaceWith("Jackson.databind", "io.spine.dependency.lib.Jackson"),
+            level = DeprecationLevel.ERROR
+        )
         val dateTime = "$group:$infix-jsr310"
 
-        // https://github.com/FasterXML/jackson-datatypes-collections/blob/2.19/guava
+        // https://github.com/FasterXML/jackson-datatypes-collections/tree/3.x/guava
         val guava = "$group:$infix-guava"
 
-        // https://github.com/FasterXML/jackson-dataformats-binary/tree/2.19/protobuf
+        @Deprecated(
+            "Protobuf support is a data format, not a data type." +
+                    " The `$infix-protobuf` artifact has never been published.",
+            ReplaceWith("Jackson.DataFormat.protobuf", "io.spine.dependency.lib.Jackson"),
+            level = DeprecationLevel.ERROR
+        )
         val protobuf = "$group:$infix-protobuf"
 
-        // https://github.com/FasterXML/jackson-datatypes-misc/tree/2.19/javax-money
+        // https://github.com/FasterXML/jackson-datatypes-misc/tree/3.x/javax-money
         val javaXMoney = "$group:$infix-javax-money"
 
-        // https://github.com/FasterXML/jackson-datatypes-misc/tree/2.19/moneta
+        // https://github.com/FasterXML/jackson-datatypes-misc/tree/3.x/moneta
         val moneta = "$group:jackson-datatype-moneta"
 
         override val modules = listOf(
-            jdk8,
-            dateTime,
             guava,
-            protobuf,
             javaXMoney,
             moneta
         )
     }
 
-    // https://github.com/FasterXML/jackson-jr
+    // https://github.com/FasterXML/jackson-jr/tree/3.x
     object Junior : Dependency() {
         override val version = Jackson.version
-        override val group = "com.fasterxml.jackson.jr"
+        override val group = "$groupPrefix.jr"
 
         val objects = "$group:jackson-jr-objects"
 

buildSrc/src/main/kotlin/io/spine/dependency/lib/JacksonV2.kt

@@ -0,0 +1,107 @@
+/*
+ * Copyright 2026, TeamDev. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Redistribution and use in source and/or binary forms, with or without
+ * modification, must retain the above copyright notice and the following
+ * disclaimer.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+package io.spine.dependency.lib
+
+import io.spine.dependency.Dependency
+import io.spine.dependency.DependencyWithBom
+
+/**
+ * Jackson 2.x dependencies.
+ *
+ * Jackson 2.x artifacts keep the `com.fasterxml.jackson.*` group IDs, unlike
+ * Jackson 3.x, which moved to `tools.jackson`
+ * ([JSTEP-1](https://github.com/FasterXML/jackson-future-ideas/wiki/JSTEP-1)).
+ *
+ * We declare the 2.x line to align the versions of the artifacts pulled transitively by third-party
+ * dependencies, while our own code uses Jackson 3.x declared by [Jackson].
+ *
+ * The `jackson-annotations` artifact, although it belongs to the 2.x line, is
+ * declared by [Jackson.annotations] because Jackson 3.x keeps consuming it.
+ *
+ * See:
+ *  - [Jackson Releases](https://github.com/FasterXML/jackson/wiki/Jackson-Releases)
+ *
+ * @see Jackson
+ */
+@Suppress("unused")
+object JacksonV2 : DependencyWithBom() {
+    override val group = "com.fasterxml.jackson"
+    override val version = "2.22.1"
+
+    // https://github.com/FasterXML/jackson-bom
+    override val bom = "$group:jackson-bom:$version"
+
+    private val groupPrefix = group
+
+    /**
+     * All Jackson 2.x modules we use are declared by the nested objects,
+     * such as [Core] or [DataType].
+     */
+    override val modules = emptyList<String>()
+
+    object Core : Dependency() {
+        override val version = JacksonV2.version
+        override val group = "$groupPrefix.core"
+
+        @Suppress("MemberNameEqualsClassName")
+        val core = "$group:jackson-core"
+        val databind = "$group:jackson-databind"
+
+        override val modules = listOf(core, databind)
+    }
+
+    object DataType : Dependency() {
+        override val version = JacksonV2.version
+        override val group = "$groupPrefix.datatype"
+
+        val jdk8 = "$group:jackson-datatype-jdk8"
+        val jsr310 = "$group:jackson-datatype-jsr310"
+        val guava = "$group:jackson-datatype-guava"
+
+        override val modules = listOf(jdk8, jsr310, guava)
+    }
+
+    object DataFormat : Dependency() {
+        override val version = JacksonV2.version
+        override val group = "$groupPrefix.dataformat"
+
+        val xml = "$group:jackson-dataformat-xml"
+        val yaml = "$group:jackson-dataformat-yaml"
+        val protobuf = "$group:jackson-dataformat-protobuf"
+
+        override val modules = listOf(xml, yaml, protobuf)
+    }
+
+    object Module : Dependency() {
+        override val version = JacksonV2.version
+        override val group = "$groupPrefix.module"
+
+        val parameterNames = "$group:jackson-module-parameter-names"
+
+        override val modules = listOf(parameterNames)
+    }
+}

buildSrc/src/main/kotlin/io/spine/dependency/lib/Log4j2.kt

@@ -37,6 +37,22 @@ package io.spine.dependency.lib
  */
 @Suppress("unused", "ConstPropertyName")
 object Log4j2 {
-    private const val version = "2.26.0"
+    const val version = "2.26.1"
+
     const val core = "org.apache.logging.log4j:log4j-core:$version"
+
+    /**
+     * Routes the calls made through the [SLF4J API][Slf4J.lib] to the [core] backend.
+     *
+     * Add this artifact when a third-party library logs via SLF4J — such as Micronaut —
+     * and its output should reach the Log4j2 backend of the application.
+     *
+     * The artifact is `log4j-slf4j2-impl`, the binding for the SLF4J 2.x that [Slf4J]
+     * declares. Do not substitute `log4j-slf4j-impl`: it binds SLF4J 1.7 only, and
+     * under SLF4J 2.x it registers no provider, which leaves the logging silently
+     * unbound instead of failing the build.
+     *
+     * @see <a href="https://logging.apache.org/log4j/2.x/log4j-slf4j2-impl/">Log4j2 SLF4J 2.x binding</a>
+     */
+    const val slf4j2Bridge = "org.apache.logging.log4j:log4j-slf4j2-impl:$version"
 }

buildSrc/src/main/kotlin/io/spine/dependency/lib/PalantirJavaFormat.kt

@@ -36,7 +36,7 @@ import io.spine.dependency.Dependency
 object PalantirJavaFormat : Dependency() {
 
     override val group = "com.palantir.javaformat"
-    override val version = "2.91.0"
+    override val version = "2.97.0"
     override val modules: List<String> = listOf("$group:palantir-java-format")
 
     val lib = artifact(modules[0])

buildSrc/src/main/kotlin/io/spine/dependency/lib/Roaster.kt

@@ -30,13 +30,6 @@ package io.spine.dependency.lib
 @Suppress("unused", "ConstPropertyName")
 object Roaster {
 
-    /**
-     * This is the last version built with Java 11.
-     *
-     * Starting from the version
-     * [2.29.0.Final](https://github.com/forge/roaster/releases/tag/2.29.0.Final),
-     * Roaster requires Java 17.
-     */
     private const val version = "2.31.0.Final"
 
     const val group = "org.jboss.forge.roaster"

buildSrc/src/main/kotlin/io/spine/dependency/local/Base.kt

@@ -33,8 +33,8 @@ package io.spine.dependency.local
  */
 @Suppress("ConstPropertyName", "unused")
 object Base {
-    const val version = "2.0.0-SNAPSHOT.426"
-    const val versionForBuildScript = "2.0.0-SNAPSHOT.426"
+    const val version = "2.0.0-SNAPSHOT.440"
+    const val versionForBuildScript = "2.0.0-SNAPSHOT.440"
     const val group = Spine.group
     private const val prefix = "spine"
     const val libModule = "$prefix-base"