[tonygermano]

Summary

Renovate's vulnerability PR #522 proposes com.google.guava:guava 32.0.1-jre → 33.7.2-android. Guava publishes every release in a -jre and an -android flavor, and Renovate's Maven versioning treats the suffix as an ordinary qualifier, so it can move us to the wrong flavor. This PR applies the regex versioning that Renovate's docs recommend for this case (https://docs.renovatebot.com/modules/versioning/regex/). The suffix goes into the compatibility group, and Renovate only offers versions whose compatibility matches the current one. Once this is merged, #522 should offer 33.7.2-jre instead.

While looking at renovate.json, I also removed the groups that the version catalog makes redundant. Renovate's Gradle manager records each catalog entry's version.ref as its sharedVariableName, and uses that as the group name when no groupName is configured. Every [versions] entry in gradle/libs.versions.toml therefore already updates as a single PR.

• Removed jetty, bouncycastle, jackson and log4j. Each one only matches artifacts on a single catalog ref (jetty-schemas is the exception, but it has its own version and doesn't need to move with Jetty).
• Removed netty. Its only addition beyond the netty ref is netty-reactive-streams, which Drop the unused netty-reactive-streams jars #507 removes.
• Narrowed pdfbox to org.apache.pdfbox:* and de.rototor.pdfbox:*. The old *pdfbox* pattern also matched com.openhtmltopdf:openhtmltopdf-pdfbox, which shares the openhtmltopdf ref with openhtmltopdf-core. That would have split one version line across two branches and produced conflicting PRs.
• Kept aws-sdk, jersey, sun-xml, apache-commons and test-tooling. Each spans more than one ref or includes artifacts on literal versions that should move together.

The two changes are in separate commits.

#507 also edits the netty group in renovate.json (it removes com.typesafe.netty*). Whichever PR merges second will need a trivial rebase. Resolving it means deleting the group.

Testing

Claude checked:

• renovate-config-validator --strict --no-global renovate.json (Renovate 44.199.0, official Docker image): the config validates as repo config.
• The Guava regex splits 32.0.1-jre, 33.7.2-jre and 33.7.2-android into the expected major, minor, patch and compatibility parts.
• Renovate's source: lib/workers/repository/updates/branch-name.ts uses sharedVariableName as groupName when no group is set, and the Gradle catalog extractor sets sharedVariableName from version.ref.
• ./gradlew clean build -PdisableSigning=true passes (the build doesn't read renovate.json).

Not tested: an actual Renovate run against this branch.

---

🤖 Drafted with Claude Code

[github-actions]

Test Results

133 files  ±0  133 suites  ±0   3m 19s ⏱️ +26s
817 tests ±0  817 ✅ ±0  0 💤 ±0  0 ❌ ±0 
943 runs  ±0  937 ✅ ±0  6 💤 ±0  0 ❌ ±0 

Results for commit 7eaee05. ± Comparison against base commit 3c79615.

[pacmano1]

Ran Renovate locally (--platform=local, which still runs the OSV alerts this config turns on) on this branch and its base, with 44.188.2 (the version that opened #522) and 44.199.0.

The Guava rule doesn't change #522. On 44.188.2 this branch offers 33.7.2-android, same as the base. On 44.199.0 both offer 33.7.2-jre because of Renovate's built-in workarounds:guavaVariants (renovatebot/renovate#47554, first in 44.195.0), which config:recommended pulls in. With that preset ignored, both are back to -android. I'd drop the Guava commit.

Dropping the groups splits jars with advisories off from the rest. Without the jetty, jackson, netty and log4j groups, those jars go to renovate/*-monorepo branches, except jars with an OSV advisory, which fall back to the catalog ref name. Jetty does it today: jetty-http goes to renovate/jetty and the other 12 with a 9.4.58 update to renovate/jetty-monorepo, both bumping the same jetty line. Renovate warns "Found sourceUrl with multiple branches that should probably be combined into a group". With OSV alerts off, all of Jetty stays in jetty-monorepo. With older Jackson, Netty and Log4j in a scratch copy (2.12.0, 4.1.42.Final, 2.14.1), each splits the same way on this branch and not on the base, where the groups are named like the refs. Keep those four groups.

pdfbox and Bouncy Castle came out as described.

Co-authored with Claude Code.