[kiview]

The grouped Dependabot PR #12158 fails about 20 module checks. This PR fixes the causes on our side, so that the group can be recreated and pass.

Changes

javax.annotation.Nullable no longer resolves after the Guava bump
Guava 33.4+ no longer depends on com.google.code.findbugs:jsr305. r2dbc and the R2DBC providers in MySQL, MariaDB, PostgreSQL, MSSQL and ClickHouse import javax.annotation.Nullable. Until now they compiled only because core's Guava brought jsr305 in transitively. With Guava 33.8.0, :testcontainers-r2dbc:compileJava fails, and so does every module that depends on it.
→ This PR declares jsr305:3.0.2 as compileOnly in those six modules. The published POMs don't change.

Pulsar 5 requires Java 17
pulsar-client 5.0.1 is published for Java 17+, and the module is still built against Java 8, so dependency resolution fails.
→ This PR adds a Dependabot rule to ignore major org.apache.pulsar:* updates.

localstack/localstack:0.12.8 was removed from Docker Hub
Every 0.12.x tag now returns manifest unknown, so LegacyModeTest fails on every full run. It passed on 2026-10-27 and failed on #12161 on 2026-11-13.
→ This PR removes the 0.12 test image. The "0.12" non-legacy case duplicated the 0.11 case, which stays. The custom-tag legacy test now retags 0.11.3.

Verification

I couldn't verify this locally because Maven Central returned 429 (Too Many Requests) while resolving dependencies, so CI on this PR is the check. After this merges, ask Dependabot to recreate #12158 (its recreate command), so the group is rebuilt on top of this fix.

---

Generated by Claude Code

Summary by CodeRabbit

• Chores
  • Updated build compatibility settings across several database modules and limited automatic Pulsar updates to versions compatible with the module’s Java baseline.
• Tests
  • Adjusted LocalStack legacy-mode test coverage to use the 0.11 series; the 0.12 test image is no longer included.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The PR adds compile-only JSR-305 dependencies to six modules, updates the LocalStack legacy-mode test images and cases to use LocalStack 0.11, and configures Dependabot to ignore major Pulsar dependency updates.

Changes: Nullable Annotation Dependencies

Layer / File(s)	Summary
Add compile-only JSR-305 dependencies modules/clickhouse/build.gradle, modules/mariadb/build.gradle, modules/mssqlserver/build.gradle, modules/mysql/build.gradle, modules/postgresql/build.gradle, modules/r2dbc/build.gradle	Each module declares JSR-305 3.0.2 as a compile-only dependency. Comments note that Guava 33.4 and later no longer transitively provide javax.annotation.Nullable.

LocalStack Legacy-Mode Tests

Layer / File(s)	Summary
Update legacy-mode test images and cases modules/localstack/src/test/java/org/testcontainers/containers/localstack/LegacyModeTest.java, modules/localstack/src/test/java/org/testcontainers/containers/localstack/LocalstackTestImages.java	The custom image setup uses LocalStack 0.11.3. The legacy-off cases no longer include LocalStack 0.12, and the 0.12.8 image constant is removed.

Pulsar Dependency Update Rules

Layer / File(s)	Summary
Ignore major Pulsar dependency updates .github/dependabot.yml	The Pulsar Dependabot configuration ignores semver-major updates for Apache Pulsar dependencies and notes the Java version requirements.

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Suggested reviewers: eddumelendez, rnorth

Merge Risk: Minimal · up to 2d877

This change restores compilation of modules that used Guava's transitive Nullable annotation, removes a test image that is no longer available, and stops Dependabot from proposing Pulsar 5 upgrades that need Java 17. Production behavior is unchanged, and there is no identified merge-blocking risk.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title names three changes: the jsr305 compileOnly additions, the Pulsar 5 Dependabot ignore rule, and the LocalStack 0.12.8 test image removal. The changeset covers all three, so the title matches…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description follows the repository template's intent. It states the problem, lists the changes per cause, and gives verification notes. It gives a clear reason for each change: Guava 33.4+ no long…

Full details: Title check

Explanation

The title names three changes: the jsr305 compileOnly additions, the Pulsar 5 Dependabot ignore rule, and the LocalStack 0.12.8 test image removal. The changeset covers all three, so the title matches the main change. It is specific and does not use vague terms. Its wording is a little long at 9 words, and it refers to 'Unblock grouped Dependabot update', which describes the purpose rather than the code change, but it stays related to the changeset.

Full details: Description check

Explanation

The description follows the repository template's intent. It states the problem, lists the changes per cause, and gives verification notes. It gives a clear reason for each change: Guava 33.4+ no longer brings in jsr305, Pulsar 5 requires Java 17, and localstack/localstack:0.12.8 was removed from Docker Hub. It also links the related Dependabot PR #12158. The template's sections (contributing checklist, new-module steps, dependency-upgrade note) do not apply to this change. The description covers the required content for a bug-fix style PR. The template's 'Describing Your Changes' guidance is met: broken behaviour, the fix, and a related issue reference are all present.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: da2ca589-2111-4f64-9c81-e76eb75c1963

Commits

Reviewing files that changed from the base of the PR and between beb8f38 and 2d877c5.

Files selected for processing: 9

• .github/dependabot.yml
• modules/clickhouse/build.gradle
• modules/localstack/src/test/java/org/testcontainers/containers/localstack/LegacyModeTest.java
• modules/localstack/src/test/java/org/testcontainers/containers/localstack/LocalstackTestImages.java
• modules/mariadb/build.gradle
• modules/mssqlserver/build.gradle
• modules/mysql/build.gradle
• modules/postgresql/build.gradle
• modules/r2dbc/build.gradle

Files with no reviewable changes: 1

• modules/localstack/src/test/java/org/testcontainers/containers/localstack/LocalstackTestImages.java

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.