Upgrade dependencies

.github/dependabot.yml

@@ -9,3 +9,5 @@ updates:
     directory: "/"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7

.github/workflows/build.yml

@@ -10,7 +10,7 @@ jobs:
   matrix-build:
     strategy:
       matrix:
-        java: [25]
+        java: [25, 26]
         os: ['ubuntu-latest', 'windows-latest'] # 'macos-latest' has issues with UI tests
     env:
       DEFAULT_JAVA: 25
@@ -28,7 +28,7 @@ jobs:
 
     steps:
 
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
         persist-credentials: false
@@ -42,7 +42,7 @@ jobs:
       uses: gradle/actions/setup-gradle@v6
 
     - name: Cache SonarQube packages
-      uses: actions/cache@v5
+      uses: actions/cache@v6
       if: ${{ env.DEFAULT_JAVA == matrix.java && env.DEFAULT_OS == matrix.os }}
       with:
         path: ~/.sonar/cache
@@ -100,8 +100,10 @@ jobs:
 
   ossindex:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         persist-credentials: false
     - uses: actions/setup-java@v5

.github/workflows/codeql-analysis.yml

@@ -35,7 +35,7 @@ jobs:
           build-mode: none # This mode only analyzes Java. Set this to 'autobuild' or 'manual' to analyze Kotlin too.
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         persist-credentials: false
     - uses: actions/setup-java@v5

.github/workflows/dependency-submission.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       with:
         persist-credentials: false
     - name: Setup Java

.github/workflows/release.yml

@@ -24,16 +24,17 @@ jobs:
         shell: bash
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
       - name: Fail if not running on main branch
         if: ${{ github.ref != 'refs/heads/main' }}
-        uses: actions/github-script@v9
-        with:
-          script: |
-            core.setFailed('Not running on main branch, github.ref is ${{ github.ref }}. Please start this workflow only on main')
+        run: |
+          echo "Not running on main branch, github.ref is $GITHUB_REF. Please start this workflow only on main"
+          exit 1
+        env:
+          GITHUB_REF: ${{ github.ref }}
 
       - name: Set up Java
         uses: actions/setup-java@v5
@@ -80,7 +81,7 @@ jobs:
       contents: write # Required for creating GitHub release
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: true
       - name: Set up Java
@@ -94,10 +95,11 @@ jobs:
 
       - name: Fail if not running on main branch
         if: ${{ github.ref != 'refs/heads/main' }}
-        uses: actions/github-script@v9
-        with:
-          script: |
-            core.setFailed('Not running on main branch, github.ref is ${{ github.ref }}. Please start this workflow only on main')
+        run: |
+          echo "Not running on main branch, github.ref is $GITHUB_REF. Please start this workflow only on main"
+          exit 1
+        env:
+          GITHUB_REF: ${{ github.ref }}
 
       - name: Publish to Central Repository
         if: ${{ ! inputs.skip-maven-central }}

.github/zizmor.yml

@@ -0,0 +1,9 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "actions/*": ref-pin
+        "gradle/actions/setup-gradle": ref-pin
+        "gradle/actions/dependency-submission": ref-pin
+        "github/codeql-action/*": ref-pin
+        "*": hash-pin

.vscode/settings.json

@@ -5,6 +5,7 @@
         "source.fixAll": "explicit"
     },
     "java.codeGeneration.useBlocks": true,
+    // Too many false positives
     "java.compile.nullAnalysis.mode": "disabled",
     "java.configuration.updateBuildConfiguration": "automatic",
     "java.test.config": {
@@ -25,4 +26,4 @@
         "connectionId": "itsallcode",
         "projectKey": "white-rabbit"
     },
-}
+}

CHANGELOG.md

@@ -6,6 +6,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [1.11.0] - unreleased
 
+See [Release](https://github.com/itsallcode/white-rabbit/releases/tag/v1.11.0) / [Milestone](https://github.com/itsallcode/white-rabbit/milestone/13?closed=1)
+
+* Upgrade dependencies (PR [#309](https://github.com/itsallcode/white-rabbit/pull/309))
+  * Removed jansi due to vulnerability CVE-2026-8484
+
 ## [1.10.0] - 2026-05-25
 
 See [Release](https://github.com/itsallcode/white-rabbit/releases/tag/v1.10.0) / [Milestone](https://github.com/itsallcode/white-rabbit/milestone/12?closed=1)

build.gradle

@@ -1,14 +1,14 @@
 plugins {
     id 'eclipse'
-    id "org.sonarqube" version "7.3.0.8198"
+    id "org.sonarqube" version "7.3.1.8318"
     id "org.jetbrains.gradle.plugin.idea-ext" version "1.4.1"
-    id 'com.gradleup.shadow' version '9.4.1' apply false
+    id 'com.gradleup.shadow' version '9.5.1' apply false
     id "com.moowork.node" version "1.3.1" apply false
     id "com.github.ben-manes.versions" version "0.54.0"
-    id "org.panteleyev.jpackageplugin" version "2.0.1" apply false
+    id "org.panteleyev.jpackageplugin" version "2.1.0" apply false
     id "org.gradle.crypto.checksum" version "1.4.0" apply false
     id "io.github.gradle-nexus.publish-plugin" version "2.0.0"
-    id 'org.sonatype.gradle.plugins.scan' version '3.1.5'
+    id 'org.sonatype.gradle.plugins.scan' version '3.1.6'
 }
 
 version = "1.10.0"

gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.5.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500

jfxui/build.gradle

@@ -36,7 +36,6 @@ dependencies {
 
     runtimeOnly libs.log4j.core
     runtimeOnly libs.log4j.jul
-    runtimeOnly libs.jansi
 
     testImplementation libs.testfx
     testImplementation libs.bundles.testUtils

jfxui/src/main/java/org/itsallcode/whiterabbit/jfxui/App.java

@@ -10,7 +10,6 @@ public class App
     public static void main(final String[] args)
     {
         System.setProperty("javafx.preloader", SplashScreenLoader.class.getName());
-        System.setProperty("log4j.skipJansi", "false");
         System.setProperty("java.util.logging.manager", "org.apache.logging.log4j.jul.LogManager");
 
         DesktopIntegration.getInstance().register();

jfxui/src/main/resources/log4j2.xml

@@ -2,7 +2,7 @@
 <Configuration status="INFO">
     <Appenders>
         <Console name="Console" target="SYSTEM_OUT">
-            <PatternLayout charset="UTF-8" noConsoleNoAnsi="true"
+            <PatternLayout charset="UTF-8"
                 pattern="%date{HH:mm:ss.SSS} [%thread] %highlight{%-5level} %logger{1.} - %message%n" />
         </Console>
         <RollingFile name="File" fileName="${sys:user.home}/.whiterabbit/logs/white-rabbit.log"

settings.gradle

@@ -20,10 +20,10 @@ dependencyResolutionManagement {
     }
     versionCatalogs {
         libs {
-            version('junitJupiter', '6.1.0')
+            version('junitJupiter', '6.1.1')
             version('mockito', '5.23.0')
-            version('log4j', '2.26.0')
-            version('javafx', '27-ea+17')
+            version('log4j', '2.26.1')
+            version('javafx', '27-ea+24')
 
             library('junitParams', 'org.junit.jupiter', 'junit-jupiter-params').versionRef('junitJupiter')
             library('assertj', 'org.assertj:assertj-core:3.27.7')
@@ -38,11 +38,10 @@ dependencyResolutionManagement {
             library('testfx', 'org.testfx:testfx-junit5:4.0.18')
             library('monocle', 'org.pdfsam:javafx-monocle:21')
 
-            library('jsonBindApi', 'jakarta.json.bind:jakarta.json.bind-api:3.0.1')
+            library('jsonBindApi', 'jakarta.json.bind:jakarta.json.bind-api:3.0.2')
             library('yasson', 'org.eclipse:yasson:3.0.4')
 
             library('jdtAnnotations', 'org.eclipse.jdt:org.eclipse.jdt.annotation:2.4.100')
-            library('jansi', 'org.fusesource.jansi:jansi:2.4.3')
             library('log4j.api', 'org.apache.logging.log4j', 'log4j-api').versionRef('log4j')
             library('log4j.core', 'org.apache.logging.log4j', 'log4j-core').versionRef('log4j')
             library('log4j.jul', 'org.apache.logging.log4j', 'log4j-jul').versionRef('log4j')