update dependencies

build.gradle

@@ -2,7 +2,7 @@
 plugins {
   id 'com.github.ben-manes.versions' version '0.53.0'
   id 'com.github.spotbugs' version '6.4.8' apply false
-  id 'com.gradleup.shadow' version '9.3.2' apply false
+  id 'com.gradleup.shadow' version '9.4.1' apply false
   id 'me.champeau.jmh' version '0.7.3'
   id 'com.netflix.nebula.dependency-recommender' version '14.0.0'
   id 'com.netflix.nebula.netflixoss' version '13.0.0'
@@ -102,7 +102,7 @@ subprojects {
   }
 
   checkstyle {
-    toolVersion = '13.3.0'
+    toolVersion = '13.4.0'
     ignoreFailures = false 
     configFile = rootProject.file('codequality/checkstyle.xml')
     configDirectory = rootProject.file("codequality")
@@ -133,7 +133,7 @@ subprojects {
   }
 
   pmd {
-    toolVersion = '7.16.0'
+    toolVersion = '7.23.0'
     ignoreFailures = false
     sourceSets = [sourceSets.main]
     ruleSets = []

codequality/pmd.xml

@@ -15,6 +15,8 @@
     <exclude name="ArrayIsStoredDirectly"/>
     <exclude name="AtLeastOneConstructor"/>
     <exclude name="AvoidCatchingGenericException"/>
+    <exclude name="AssignmentInOperand"/>
+    <exclude name="AvoidDeeplyNestedIfStmts"/>
     <exclude name="AvoidDuplicateLiterals"/>
     <exclude name="AvoidFieldNameMatchingMethodName"/>
     <exclude name="AvoidInstantiatingObjectsInLoops"/>
@@ -57,6 +59,7 @@
     <exclude name="OneDeclarationPerLine"/>
     <exclude name="OnlyOneReturn"/>
     <exclude name="PrematureDeclaration"/>
+    <exclude name="PublicMemberInNonPublicType"/>
     <exclude name="RedundantFieldInitializer"/>
     <exclude name="ReplaceJavaUtilDate"/>
     <exclude name="SignatureDeclareThrowsException"/>
@@ -68,6 +71,7 @@
     <exclude name="ShortMethodName"/>
     <exclude name="ShortVariable"/>
     <exclude name="TooManyFields"/>
+    <exclude name="TypeParameterNamingConventions"/>
     <exclude name="TooManyMethods"/>
     <exclude name="UncommentedEmptyMethodBody"/>
     <exclude name="UnusedPrivateMethod"/>

dependencies.properties

@@ -2,9 +2,9 @@
 ch.qos.reload4j:reload4j = 1.2.26
 com.amazonaws:aws-java-sdk-core = 1.12.797
 com.amazonaws:aws-java-sdk-cloudwatch = 1.12.797
-com.fasterxml.jackson.core:jackson-core = 2.21.1
-com.fasterxml.jackson.core:jackson-databind = 2.21.1
-com.fasterxml.jackson.dataformat:jackson-dataformat-smile = 2.21.1
+com.fasterxml.jackson.core:jackson-core = 2.21.2
+com.fasterxml.jackson.core:jackson-databind = 2.21.2
+com.fasterxml.jackson.dataformat:jackson-dataformat-smile = 2.21.2
 com.github.ben-manes.caffeine:caffeine = 2.9.3
 com.google.inject.extensions:guice-servlet = 5.1.0
 com.google.inject:guice = 5.1.0
@@ -15,19 +15,19 @@ com.netflix.governator:governator = 1.17.13
 com.netflix.governator:governator-api = 1.17.13
 com.netflix.governator:governator-core = 1.17.13
 com.netflix.servo:servo-core = 0.13.2
-com.typesafe:config = 1.4.5
+com.typesafe:config = 1.4.6
 io.dropwizard.metrics:metrics-core = 4.2.38
 io.dropwizard.metrics5:metrics-core = 5.0.6
 io.micrometer:micrometer-core = 1.16.4
 javax.inject:javax.inject = 1
 javax.servlet:javax.servlet-api = 4.0.1
 net.openhft:zero-allocation-hashing = 0.16
 nl.jqno.equalsverifier:equalsverifier = 3.19.4
-org.apache.logging.log4j:log4j-api = 2.25.3
-org.apache.logging.log4j:log4j-core = 2.25.3
-org.apache.logging.log4j:log4j-jcl = 2.25.3
-org.apache.logging.log4j:log4j-jul = 2.25.3
-org.apache.logging.log4j:log4j-slf4j-impl = 2.25.3
+org.apache.logging.log4j:log4j-api = 2.25.4
+org.apache.logging.log4j:log4j-core = 2.25.4
+org.apache.logging.log4j:log4j-jcl = 2.25.4
+org.apache.logging.log4j:log4j-jul = 2.25.4
+org.apache.logging.log4j:log4j-slf4j-impl = 2.25.4
 org.eclipse.jetty:jetty-servlet = 9.4.58.v20250814
 org.eclipse.jetty:jetty-webapp = 9.4.58.v20250814
 org.hsqldb:hsqldb = 2.7.4
@@ -40,5 +40,5 @@ org.slf4j:slf4j-simple = 1.7.36
 org.springframework:spring-beans = 5.3.39
 org.springframework:spring-web = 5.3.39
 org.springframework.boot:spring-boot-autoconfigure = 2.7.18
-software.amazon.awssdk:aws-core = 2.42.9
-software.amazon.awssdk:sdk-core = 2.42.9
+software.amazon.awssdk:aws-core = 2.42.32
+software.amazon.awssdk:sdk-core = 2.42.32

gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.0-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

spectator-api/src/main/java/com/netflix/spectator/api/Registry.java

@@ -153,7 +153,6 @@ default RegistryConfig config() {
   /** Iterator for traversing the set of meters in the registry. */
   @Override Iterator<Meter> iterator();
 
-  /////////////////////////////////////////////////////////////////
   // Additional helper methods below
 
   /**

spectator-api/src/main/java/com/netflix/spectator/api/patterns/GaugePoller.java

@@ -58,7 +58,6 @@ static <T> Future<?> schedule(WeakReference<T> ref, long delay, Consumer<T> poll
   }
 
   /** Schedule collection of gauges for a registry. */
-  @SuppressWarnings("PMD")
   static <T> Future<?> schedule(
       ScheduledExecutorService executor, WeakReference<T> ref, long delay, Consumer<T> poll) {
     final AtomicReference<Future<?>> futureRef = new AtomicReference<>();

spectator-api/src/main/java/com/netflix/spectator/api/patterns/PolledMeter.java

@@ -530,7 +530,6 @@ void cleanup(Registry registry) {
      * Update the registry if this meter is not expired, otherwise cleanup any state
      * associated with this meter.
      */
-    @SuppressWarnings("PMD.AvoidCatchingThrowable")
     void doUpdate(Registry registry) {
       if (hasExpired()) {
         cleanup(registry);

spectator-api/src/main/java/com/netflix/spectator/impl/AsciiSet.java

@@ -62,7 +62,6 @@ private static boolean isJava8() {
    * Creates a new string without copying the buffer if possible. The String class has a
    * package private constructor that allows the buffer to be shared.
    */
-  @SuppressWarnings("PMD.AvoidCatchingThrowable")
   private static String newString(char[] buf) {
     if (STRING_CONSTRUCTOR != null) {
       try {

spectator-api/src/main/java/com/netflix/spectator/impl/Scheduler.java

@@ -357,6 +357,7 @@ void incrementUncaught(Throwable t) {
   /**
    * Wraps the user supplied task with metadata for subsequent executions.
    */
+  @SuppressWarnings("PMD.OverrideBothEqualsAndHashCodeOnComparable")
   static class DelayedTask implements ScheduledFuture<Void> {
     private final Clock clock;
     private final Options options;
@@ -428,7 +429,6 @@ void updateNextExecutionTime(Counter skipped) {
      *     Handle to stats that should be updated based on the execution of the
      *     task.
      */
-    @SuppressWarnings("PMD.AvoidCatchingThrowable")
     void runAndReschedule(DelayQueue<DelayedTask> queue, Stats stats) {
       thread = Thread.currentThread();
       boolean scheduleAgain = options.schedulingPolicy != Policy.RUN_ONCE;

spectator-ext-gc/src/main/java/com/netflix/spectator/gc/GcLogger.java

@@ -190,7 +190,6 @@ public List<GcEvent> getLogs() {
     return logs;
   }
 
-  @SuppressWarnings("PMD.AvoidDeeplyNestedIfStmts")
   private void updateMetrics(String name, GcInfo info) {
     final Map<String, MemoryUsage> before = info.getMemoryUsageBeforeGc();
     final Map<String, MemoryUsage> after = info.getMemoryUsageAfterGc();

spectator-ext-ipc/src/main/java/com/netflix/spectator/ipc/http/HostSanitizer.java

@@ -122,7 +122,6 @@ private static String removePort(String host) {
     return pos >= 0 ? host.substring(0, pos) : host;
   }
 
-  @SuppressWarnings("PMD")
   private static String sanitizeSegments(String host, Set<String> allowed) {
     HostStringBuilder builder = new HostStringBuilder();
 

spectator-ext-ipc/src/main/java/com/netflix/spectator/ipc/http/HttpRequestBuilder.java

@@ -394,7 +394,6 @@ protected HttpResponse sendImpl() throws IOException {
     }
   }
 
-  @SuppressWarnings("PMD.AssignmentInOperand")
   private byte[] readAll(InputStream in, int contentLength) throws IOException {
     if (in == null) {
       // For error status codes with a content-length of 0 we see this case