fix(deps): update all dependencies j:cdx-227

[renovate-coveo]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/checkout	action	patch	v4.3.0 → v4.3.1
actions/checkout (changelog)	action	digest	08eba0b → 34e1148
actions/setup-java	action	minor	v4.7.1 → v4.8.0
google-github-actions/release-please-action → googleapis/release-please-action	action	replacement	v4.1.1 → v4.1.1
step-security/harden-runner	action	minor	v2.13.1 → v2.14.0
org.apache.maven:maven-model (source)	compile	patch	3.9.11 → 3.9.12
commons-codec:commons-codec (source)	compile	minor	1.19.0 → 1.20.0
org.mockito:mockito-core	test	minor	5.20.0 → 5.21.0
org.apache.maven.plugins:maven-source-plugin (source)	build	minor	3.3.1 → 3.4.0

[skip release]

This is a special PR that replaces google-github-actions/release-please-action with the community suggested minimal stable replacement version.

---

Release Notes

actions/checkout (actions/checkout)

v4.3.1

Compare Source

• Port v6 cleanup to v4 by @​ericsciple in #​2305

actions/setup-java (actions/setup-java)

v4.8.0

Compare Source

What's Changed

• License and Audit Fixes by @​HarithaVattikuti in #​960
• Update SapMachine URLs by @​RealCLanger in #​965

Full Changelog: actions/setup-java@v4...v4.8.0

step-security/harden-runner (step-security/harden-runner)

v2.14.0

Compare Source

What's Changed

• Selective installation: Harden-Runner now skips installation on GitHub-hosted runners when the repository has a custom property skip_harden_runner, allowing organizations to opt out specific repos.
• Avoid double install: The action no longer installs Harden-Runner if it’s already present on a GitHub-hosted runner, which could happen when a composite action also installs it.

Full Changelog: step-security/harden-runner@v2.13.3...v2.14.0

v2.13.3

Compare Source

What's Changed

• Fixed an issue where process events were not uploaded in certain edge cases.

Full Changelog: step-security/harden-runner@v2.13.2...v2.13.3

v2.13.2

Compare Source

What's Changed

• Fixed an issue where there was a limit of 512 allowed endpoints when using block egress policy. This restriction has been removed, allowing for an unlimited number of endpoints to be configured.
• Harden Runner now automatically detects if the agent is already pre-installed on a custom VM image used by a GitHub-hosted runner. When detected, the action will skip reinstallation and use the existing agent.

Full Changelog: step-security/harden-runner@v2.13.1...v2.13.2

apache/commons-codec (commons-codec:commons-codec)

v1.20.0

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.20.0.

The Apache Commons Codec component contains encoders and decoders for
formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

mockito/mockito (org.mockito:mockito-core)

v5.21.0

Compare Source

^{Changelog generated by Shipkit Changelog Gradle Plugin}

5.21.0

• 2025-12-09 - 17 commit(s) by Giulio Longfils, Joshua Selbo, Woongi9, Zylox, dependabot[bot]
• Bump graalvm/setup-graalvm from 1.4.3 to 1.4.4 (#​3768)
• Bump graalvm/setup-graalvm from 1.4.2 to 1.4.3 (#​3767)
• Bump actions/checkout from 5 to 6 (#​3765)
• Adds output of matchers to potential mismatch; Fixes #​2468 (#​3760)
• Forbid mocking WeakReference with inline mock maker (#​3759)
• StackOverflowError when mocking WeakReference (#​3758)
• Bump actions/upload-artifact from 4 to 5 (#​3756)
• Bump graalvm/setup-graalvm from 1.4.1 to 1.4.2 (#​3755)
• Support primitives in GenericArrayReturnType. (#​3753)
• ClassNotFoundException when stubbing array of primitive type on Android (#​3752)
• Bump graalvm/setup-graalvm from 1.4.0 to 1.4.1 (#​3744)
• Bump gradle/actions from 4 to 5 (#​3743)
• Bump org.graalvm.buildtools.native from 0.11.0 to 0.11.1 (#​3738)
• Bump com.diffplug.spotless:spotless-plugin-gradle from 7.2.1 to 8.0.0 (#​3735)
• Bump graalvm/setup-graalvm from 1.3.7 to 1.4.0 (#​3734)
• Bump org.assertj:assertj-core from 3.27.5 to 3.27.6 (#​3733)
• Bump errorprone from 2.41.0 to 2.42.0 (#​3732)
• Feat: automatically detect class to mock in mockStatic and mockConstruction (#​3731)
• Return completed futures for unstubbed Future/CompletionStage in ReturnsEmptyValues (#​3727)
• automatically detect class to mock (#​2779)
• Incorrect "has following stubbing(s) with different arguments" message when using Argument Matchers (#​2468)

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) in timezone America/Toronto, Automerge - "after 9:00am and before 12:00pm on tuesday, wednesday, thursday" in timezone America/Toronto.

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.