SLCORE-2193 Apply renovate version bumps

.github/workflows/build.yml

@@ -40,10 +40,10 @@ jobs:
     outputs:
       build_number: ${{ steps.build.outputs.build_number }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4
         with:
-          version: 2025.9.12
+          version: 2026.3.2
       - uses: SonarSource/ci-github-actions/build-maven@v1
         id: build
         with:
@@ -66,15 +66,15 @@ jobs:
     env:
       BUILD_NUMBER: ${{ needs.build-number.outputs.BUILD_NUMBER }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           fetch-depth: 0
       - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4
         with:
-          version: 2025.9.12
+          version: 2026.3.2
       - name: Vault
         id: secrets
-        uses: SonarSource/vault-action-wrapper@320bd31b03e5dacaac6be51bbbb15adf7caccc32 # 3.1.0
+        uses: SonarSource/vault-action-wrapper@3d5c87cb535e4a2c7a09adcbcfdefa751854dee3 # 3.3.0
         with:
           secrets: |
             development/kv/data/next url | NEXT_URL;
@@ -106,7 +106,7 @@ jobs:
           mvn -B "${maven_goals[@]}" "${sonar_props[@]}"
       - name: Generate test report on failure
         if: failure()
-        uses: dorny/test-reporter@dc3a92680fcc15842eef52e8c4606ea7ce6bd3f3 # v2.1.1
+        uses: dorny/test-reporter@3d76b34a4535afbd0600d347b09a6ee5deb3ed7f # v2.6.0
         with:
           name: QA Linux Test Report
           reporter: java-junit
@@ -133,10 +133,10 @@ jobs:
     env:
       BUILD_NUMBER: ${{ needs.build-number.outputs.BUILD_NUMBER }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4
         with:
-          version: 2025.9.12
+          version: 2026.3.2
       - uses: SonarSource/ci-github-actions/config-maven@v1
         id: config
         with:
@@ -149,7 +149,7 @@ jobs:
           mvn -B -Dcommercial verify
       - name: Generate test report on failure
         if: failure()
-        uses: dorny/test-reporter@dc3a92680fcc15842eef52e8c4606ea7ce6bd3f3 # v2.1.1
+        uses: dorny/test-reporter@3d76b34a4535afbd0600d347b09a6ee5deb3ed7f # v2.6.0
         with:
           name: QA Windows Test Report
           reporter: java-junit
@@ -206,10 +206,10 @@ jobs:
             category: "-DexcludedGroups=SonarCloud"
             java: 17
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4
         with:
-          version: 2025.9.12
+          version: 2026.3.2
       - name: Select Java ${{ matrix.java }}
         run: mise use java@${{ matrix.java }}
       - name: Compute month key
@@ -232,13 +232,13 @@ jobs:
       - name: Vault (SonarCloud IT token)
         if: ${{ matrix.sc == true }}
         id: secrets-sc
-        uses: SonarSource/vault-action-wrapper@320bd31b03e5dacaac6be51bbbb15adf7caccc32 # v3.1.0
+        uses: SonarSource/vault-action-wrapper@3d5c87cb535e4a2c7a09adcbcfdefa751854dee3 # 3.3.0
         with:
           secrets: |
             development/team/sonarlint/kv/data/${{ matrix.sc_token_path }} token | SONARCLOUD_IT_TOKEN;
       - name: Vault (GITHUB Token)
         id: secrets-gh
-        uses: SonarSource/vault-action-wrapper@320bd31b03e5dacaac6be51bbbb15adf7caccc32 # v3.1.0
+        uses: SonarSource/vault-action-wrapper@3d5c87cb535e4a2c7a09adcbcfdefa751854dee3 # 3.3.0
         with:
           secrets: |
             development/github/token/licenses-ro token | GITHUB_TOKEN;
@@ -260,7 +260,7 @@ jobs:
           mvn -f its/pom.xml -Dsonar.runtimeVersion=${{ matrix.sq_version }} ${{ matrix.category }} verify surefire-report:report
       - name: Generate QA test report on failure
         if: failure()
-        uses: dorny/test-reporter@dc3a92680fcc15842eef52e8c4606ea7ce6bd3f3
+        uses: dorny/test-reporter@3d76b34a4535afbd0600d347b09a6ee5deb3ed7f
         with:
           name: QA ${{ matrix.name }} Test Report
           reporter: java-junit
@@ -310,7 +310,7 @@ jobs:
     env:
       BUILD_NUMBER: ${{ needs.build-number.outputs.BUILD_NUMBER }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - uses: SonarSource/ci-github-actions/promote@v1
         with:
           promote-pull-request: true

.github/workflows/full-release.yml

@@ -58,13 +58,13 @@ jobs:
       contents: write # write for peter-evans/create-pull-request, read for actions/checkout
       pull-requests: write # write for peter-evans/create-pull-request
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: bump-version
         env: 
           NEW_VERSION: ${{ needs.release.outputs.new-version }}
         run: |
           mvn versions:set -DgenerateBackupPoms=false -DnewVersion="$NEW_VERSION-SNAPSHOT"
-      - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7
+      - uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
         with:
           author: ${{ github.actor }} <${{ github.actor }}>
           commit-message: Prepare next development iteration

.github/workflows/shadow_scans.yml

@@ -13,10 +13,10 @@ jobs:
       id-token: write
       contents: write
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4
         with:
-          version: 2025.9.12
+          version: 2026.3.2
       - uses: SonarSource/ci-github-actions/build-maven@v1 # dogfood
         with:
           maven-args: -Dcommercial -Dsonar.coverage.jacoco.xmlReportPaths=${{ github.workspace }}/report-aggregate/target/site/jacoco-aggregate/jacoco.xml

.mvn/wrapper/maven-wrapper.properties

@@ -1,19 +1,3 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-wrapperVersion=3.3.2
+wrapperVersion=3.3.4
 distributionType=only-script
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip
+distributionUrl=https://repox.jfrog.io/repox/sonarsource/org/apache/maven/apache-maven/3.3.4/apache-maven-3.3.4-bin.zip

backend/analysis-engine/pom.xml

@@ -81,7 +81,7 @@
                 <artifactItem>
                   <groupId>org.sonarsource.python</groupId>
                   <artifactId>sonar-python-plugin</artifactId>
-                  <version>5.14.2.29072</version>
+                  <version>5.18.0.31561</version>
                   <type>jar</type>
                 </artifactItem>
               </artifactItems>

backend/cli/pom.xml

@@ -306,7 +306,7 @@
     <dependency>
       <groupId>info.picocli</groupId>
       <artifactId>picocli</artifactId>
-      <version>4.7.6</version>
+      <version>4.7.7</version>
     </dependency>
     <dependency>
       <groupId>${project.groupId}</groupId>

backend/commons/pom.xml

@@ -30,7 +30,7 @@
     <dependency>
         <groupId>org.sonarsource.git.blame</groupId>
         <artifactId>git-files-blame</artifactId>
-      <version>2.0.1.17</version>
+      <version>2.0.2.54</version>
     </dependency>
     <dependency>
       <groupId>org.eclipse.jgit</groupId>

backend/core/pom.xml

@@ -107,7 +107,7 @@
     <dependency>
       <groupId>org.apache.httpcomponents.core5</groupId>
       <artifactId>httpcore5</artifactId>
-      <version>5.3.2</version>
+      <version>5.4.1</version>
     </dependency>
     <dependency>
       <groupId>com.squareup.okhttp3</groupId>

backend/plugin-commons/pom.xml

@@ -57,7 +57,7 @@
     <dependency>
       <groupId>org.apache.commons</groupId>
       <artifactId>commons-csv</artifactId>
-      <version>1.13.0</version>
+      <version>1.14.1</version>
     </dependency>
 
     <!-- Tests -->

backend/plugin-commons/src/test/projects/base-plugin/pom.xml

@@ -13,7 +13,7 @@
     <dependency>
       <groupId>org.sonarsource.api.plugin</groupId>
       <artifactId>sonar-plugin-api</artifactId>
-      <version>9.17.0.587</version>
+      <version>9.14.0.375</version>
       <scope>provided</scope>
     </dependency>
   </dependencies>

backend/plugin-commons/src/test/projects/classloader-leak-plugin/pom.xml

@@ -18,7 +18,7 @@
     <dependency>
       <groupId>org.sonarsource.api.plugin</groupId>
       <artifactId>sonar-plugin-api</artifactId>
-      <version>9.17.0.587</version>
+      <version>9.14.0.375</version>
       <scope>provided</scope>
     </dependency>
   </dependencies>

backend/plugin-commons/src/test/projects/dependent-plugin/pom.xml

@@ -13,7 +13,7 @@
     <dependency>
       <groupId>org.sonarsource.api.plugin</groupId>
       <artifactId>sonar-plugin-api</artifactId>
-      <version>9.17.0.587</version>
+      <version>9.14.0.375</version>
       <scope>provided</scope>
     </dependency>
     <dependency>

backend/rule-extractor/pom.xml

@@ -80,55 +80,55 @@
                 <artifactItem>
                   <groupId>org.sonarsource.java</groupId>
                   <artifactId>sonar-java-plugin</artifactId>
-                  <version>8.22.0.41895</version>
+                  <version>8.25.0.42802</version>
                   <type>jar</type>
                 </artifactItem>
                 <artifactItem>
                   <groupId>org.sonarsource.javascript</groupId>
                   <artifactId>sonar-javascript-plugin</artifactId>
-                  <version>11.7.1.36988</version>
+                  <version>11.8.0.37897</version>
                   <type>jar</type>
                 </artifactItem>
                 <artifactItem>
                   <groupId>org.sonarsource.php</groupId>
                   <artifactId>sonar-php-plugin</artifactId>
-                  <version>3.42.2.15271</version>
+                  <version>3.55.0.15704</version>
                   <type>jar</type>
                 </artifactItem>
                 <artifactItem>
                   <groupId>org.sonarsource.python</groupId>
                   <artifactId>sonar-python-plugin</artifactId>
-                  <version>5.14.2.29072</version>
+                  <version>5.18.0.31561</version>
                   <type>jar</type>
                 </artifactItem>
                 <artifactItem>
                   <groupId>org.sonarsource.kotlin</groupId>
                   <artifactId>sonar-kotlin-plugin</artifactId>
-                  <version>3.3.1.7792</version>
+                  <version>3.4.0.8957</version>
                   <type>jar</type>
                 </artifactItem>
                 <artifactItem>
                   <groupId>org.sonarsource.slang</groupId>
                   <artifactId>sonar-ruby-plugin</artifactId>
-                  <version>1.21.1.1877</version>
+                  <version>1.22.0.1992</version>
                   <type>jar</type>
                 </artifactItem>
                 <artifactItem>
                   <groupId>org.sonarsource.slang</groupId>
                   <artifactId>sonar-scala-plugin</artifactId>
-                  <version>1.20.1.1884</version>
+                  <version>1.21.0.1997</version>
                   <type>jar</type>
                 </artifactItem>
                 <artifactItem>
                   <groupId>org.sonarsource.html</groupId>
                   <artifactId>sonar-html-plugin</artifactId>
-                  <version>3.22.0.7011</version>
+                  <version>3.24.0.7341</version>
                   <type>jar</type>
                 </artifactItem>
                 <artifactItem>
                   <groupId>org.sonarsource.xml</groupId>
                   <artifactId>sonar-xml-plugin</artifactId>
-                  <version>2.14.2.7437</version>
+                  <version>2.16.0.7616</version>
                   <type>jar</type>
                 </artifactItem>
               </artifactItems>
@@ -168,25 +168,25 @@
                     <artifactItem>
                       <groupId>com.sonarsource.abap</groupId>
                       <artifactId>sonar-abap-plugin</artifactId>
-                      <version>3.16.0.7570</version>
+                      <version>3.17.0.7722</version>
                       <type>jar</type>
                     </artifactItem>
                     <artifactItem>
                       <groupId>com.sonarsource.cpp</groupId>
                       <artifactId>sonar-cfamily-plugin</artifactId>
-                      <version>6.75.1.93101</version>
+                      <version>6.78.0.96395</version>
                       <type>jar</type>
                     </artifactItem>
                     <artifactItem>
                       <groupId>com.sonarsource.cobol</groupId>
                       <artifactId>sonar-cobol-plugin</artifactId>
-                      <version>5.10.1.9866</version>
+                      <version>5.11.0.10062</version>
                       <type>jar</type>
                     </artifactItem>
                     <artifactItem>
                       <groupId>com.sonarsource.pli</groupId>
                       <artifactId>sonar-pli-plugin</artifactId>
-                      <version>1.18.0.6925</version>
+                      <version>1.21.0.7212</version>
                       <type>jar</type>
                     </artifactItem>
                     <artifactItem>
@@ -198,19 +198,19 @@
                     <artifactItem>
                       <groupId>com.sonarsource.rpg</groupId>
                       <artifactId>sonar-rpg-plugin</artifactId>
-                      <version>3.11.0.7089</version>
+                      <version>3.13.0.7515</version>
                       <type>jar</type>
                     </artifactItem>
                     <artifactItem>
                       <groupId>com.sonarsource.swift</groupId>
                       <artifactId>sonar-swift-plugin</artifactId>
-                      <version>5.0.0.12095</version>
+                      <version>5.1.0.12421</version>
                       <type>jar</type>
                     </artifactItem>
                     <artifactItem>
                       <groupId>com.sonarsource.slang</groupId>
                       <artifactId>sonar-apex-plugin</artifactId>
-                      <version>1.22.1.1830</version>
+                      <version>1.24.0.2040</version>
                       <type>jar</type>
                     </artifactItem>
                     <artifactItem>

backend/rule-extractor/src/test/java/mediumtests/RuleExtractorMediumTests.java

@@ -51,14 +51,14 @@ class RuleExtractorMediumTests {
 
   private static final int COMMERCIAL_RULE_TEMPLATES_COUNT = 11;
   private static final int NON_COMMERCIAL_RULE_TEMPLATES_COUNT = 16;
-  private static final int COMMERCIAL_SECURITY_HOTSPOTS_COUNT = 88;
-  private static final int NON_COMMERCIAL_SECURITY_HOTSPOTS_COUNT = 326;
-  private static final int ALL_RULES_COUNT_WITHOUT_COMMERCIAL = 2661;
-  private static final int ALL_RULES_COUNT_WITH_COMMERCIAL = 4746;
+  private static final int COMMERCIAL_SECURITY_HOTSPOTS_COUNT = 82;
+  private static final int NON_COMMERCIAL_SECURITY_HOTSPOTS_COUNT = 298;
+  private static final int ALL_RULES_COUNT_WITHOUT_COMMERCIAL = 2732;
+  private static final int ALL_RULES_COUNT_WITH_COMMERCIAL = 4823;
   // commercial plugins might not be available
   // (if you pass -Dcommercial to maven, a profile will be activated that downloads the commercial plugins)
   private static final boolean COMMERCIAL_ENABLED = System.getProperty("commercial") != null;
-  private static final Optional<Version> NODE_VERSION = Optional.of(Version.create("20.12.0"));
+  private static final Optional<Version> NODE_VERSION = Optional.of(Version.create("20.20.0"));
   private static final RuleSettings EMPTY_SETTINGS = new RuleSettings(Map.of());
   private static Set<Path> allJars;
 

its/plugins/custom-sensor-plugin/pom.xml

@@ -35,7 +35,7 @@
       <!-- packaged with the plugin -->
       <groupId>org.apache.commons</groupId>
       <artifactId>commons-lang3</artifactId>
-      <version>3.18.0</version>
+      <version>3.20.0</version>
     </dependency>
 
 

its/plugins/global-extension-plugin/pom.xml

@@ -38,7 +38,7 @@
       <!-- packaged with the plugin -->
       <groupId>org.apache.commons</groupId>
       <artifactId>commons-lang3</artifactId>
-      <version>3.18.0</version>
+      <version>3.20.0</version>
     </dependency>
   </dependencies>