From 3701f68cf650d78a7c84e48b5d7653ee465a53bc Mon Sep 17 00:00:00 2001
From: Ricardo Zanini <ricardozanini@gmail.com>
Date: Wed, 2 Sep 2026 09:57:06 -0400
Subject: [PATCH] Upgrade dependencies to latest stable versions

Parent POM updates:
- com.diffplug.spotless: 3.10.0 -> 3.10.1
- com.fasterxml.jackson: 2.22.1 -> 2.22.2
- com.google.protobuf.protobuf-java-util: 4.36.0 -> 4.36.1
- io.github.classgraph: 4.8.193 -> 4.8.194
- io.grpc.java: 1.83.1 -> 1.84.0
- com.networknt:json-schema-validator: 2.0.0 -> 2.0.7

Impl POM updates:
- net.thisptr:jackson-jq: 1.6.2 -> 1.6.4 (includes Jandex 3.x support)
- org.a2aproject.sdk:a2a-java-sdk-client: 1.2.0.Final -> 1.3.0.Final

Dependabot configuration improvements:
- Add grouping for patch and minor updates to reduce PR noise
- Set open-pull-requests-limit to 10 per branch
- Ignore major version updates (require manual review)
- Groups related updates into single PRs for easier review

Note on com.networknt upgrade:
Version 3.x was skipped because it requires Jackson 3.x (tools.jackson.*)
which would be a breaking change. Upgraded to 2.0.7 which uses Jackson
2.22.1 and is compatible with our current Jackson 2.22.2.

Note on jackson-jq 1.6.4:
This version includes Jandex 3.x support (via eiiches/jackson-jq#549),
which eliminates Jandex reindexing warnings in Quarkus 3.x+ builds.

Signed-off-by: Ricardo Zanini <ricardozanini@gmail.com>
---
 .github/dependabot.yml | 49 ++++++++++++++++++++++++++++++++++++++++++
 impl/pom.xml           |  4 ++--
 pom.xml                | 12 +++++------
 3 files changed, 57 insertions(+), 8 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 07a00d280..e9db586b3 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,6 +9,25 @@ updates:
       - ricardozanini
       - fjtirado
     target-branch: "main"
+    groups:
+      # Group all patch updates together
+      patch-updates:
+        patterns:
+          - "*"
+        update-types:
+          - "patch"
+      # Group all minor updates together
+      minor-updates:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+    # Limit number of open PRs
+    open-pull-requests-limit: 10
+    # Ignore pre-release versions
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   # Updates for 4.x branch
   - package-ecosystem: "maven"
@@ -19,6 +38,21 @@ updates:
       - ricardozanini
       - fjtirado
     target-branch: "4.x"
+    groups:
+      patch-updates:
+        patterns:
+          - "*"
+        update-types:
+          - "patch"
+      minor-updates:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   # Updates for 5.x branch
   - package-ecosystem: "maven"
@@ -29,3 +63,18 @@ updates:
       - ricardozanini
       - fjtirado
     target-branch: "5.x"
+    groups:
+      patch-updates:
+        patterns:
+          - "*"
+        update-types:
+          - "patch"
+      minor-updates:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
diff --git a/impl/pom.xml b/impl/pom.xml
index 44a2bf15e..a43a7bd74 100644
--- a/impl/pom.xml
+++ b/impl/pom.xml
@@ -12,12 +12,12 @@
         <version.com.h2database>2.4.240</version.com.h2database>
         <version.com.github.f4b6a3>5.2.4</version.com.github.f4b6a3>
         <version.jakarta.ws.rs>4.0.0</version.jakarta.ws.rs>
-        <version.net.thisptr>1.6.2</version.net.thisptr>
+        <version.net.thisptr>1.6.4</version.net.thisptr>
         <version.org.glassfish.jersey>4.0.2</version.org.glassfish.jersey>
         <version.com.cronutils>9.2.1</version.com.cronutils>
         <version.docker.java>3.7.1</version.docker.java>
         <version.org.graalvm.polyglot>25.3.4.1</version.org.graalvm.polyglot>
-        <version.org.a2aproject.sdk>1.2.0.Final</version.org.a2aproject.sdk>
+        <version.org.a2aproject.sdk>1.3.0.Final</version.org.a2aproject.sdk>
         <version.com.google.code.gson>2.14.0</version.com.google.code.gson>
     </properties>
     <dependencyManagement>
diff --git a/pom.xml b/pom.xml
index 210be1f82..b7ae858dd 100644
--- a/pom.xml
+++ b/pom.xml
@@ -59,15 +59,15 @@
         <version.buildnumber.plugin>3.3.0</version.buildnumber.plugin>
         <version.checkstyle.plugin>3.6.0</version.checkstyle.plugin>
 
-        <version.com.diffplug.spotless>3.10.0</version.com.diffplug.spotless>
+        <version.com.diffplug.spotless>3.10.1</version.com.diffplug.spotless>
         <version.compiler.plugin>3.15.0</version.compiler.plugin>
         <version.com.github.os72.protoc.jar>3.11.4</version.com.github.os72.protoc.jar>
-        <version.com.google.protobuf.protobuf.java.util>4.36.0</version.com.google.protobuf.protobuf.java.util>
+        <version.com.google.protobuf.protobuf.java.util>4.36.1</version.com.google.protobuf.protobuf.java.util>
         <version.deploy.plugin>3.1.4</version.deploy.plugin>
         <version.enforcer.plugin>3.6.3</version.enforcer.plugin>
         <version.failsafe.plugin>3.5.6</version.failsafe.plugin>
         <version.gpg.plugin>3.2.8</version.gpg.plugin>
-        <version.io.grpc.java>1.83.1</version.io.grpc.java>
+        <version.io.grpc.java>1.84.0</version.io.grpc.java>
         <version.jar.plugin>3.5.1</version.jar.plugin>
         <version.jdk>${java.version}</version.jdk>
         <version.jsonschema2pojo-maven-plugin>1.3.3</version.jsonschema2pojo-maven-plugin>
@@ -85,12 +85,12 @@
         <version.awaitility>4.3.0</version.awaitility>
         <version.com.google.protobuf.java>4.32.1</version.com.google.protobuf.java>
         <version.ch.qos.logback>1.6.3</version.ch.qos.logback>
-        <version.com.fasterxml.jackson>2.22.1</version.com.fasterxml.jackson>
+        <version.com.fasterxml.jackson>2.22.2</version.com.fasterxml.jackson>
         <version.com.fasterxml.jackson.annotations>2.22</version.com.fasterxml.jackson.annotations>
-        <version.com.networknt>2.0.0</version.com.networknt>
+        <version.com.networknt>2.0.7</version.com.networknt>
         <version.com.squareup.okhttp3.mockwebserver>5.5.0</version.com.squareup.okhttp3.mockwebserver>
         <version.io.cloudevents>5.0.0</version.io.cloudevents>
-        <version.io.github.classgraph.classgraph>4.8.193</version.io.github.classgraph.classgraph>
+        <version.io.github.classgraph.classgraph>4.8.194</version.io.github.classgraph.classgraph>
         <version.jakarta.validation>3.1.1</version.jakarta.validation>
         <version.jsonassert>1.5.2</version.jsonassert>
         <version.org.assertj>3.27.7</version.org.assertj>