Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.

If you want to run Renovate manually, [you can use trigger this workflow here](https://redirect.github.com/coveo-platform/renovate/actions/workflows/launch-renovate.yml).

## Config Migration Needed

- [ ] Select this checkbox to let Renovate create an automated Config Migration PR.

## Repository Problems

Renovate tried to run on this repository, but found these problems.

- ⚠️ WARN: Some upgrade(s) did not have a releaseTimestamp, but as we're running with minimumReleaseAgeBehaviour=timestamp-optional, proceeding. See debug logs for more information

## Deprecations / Replacements
> [!WARNING]
The following dependencies are either deprecated or have replacements available.

| Datasource | Package | Replacement PR? |
|------------|------|--------------|
| github-actions | [google-github-actions/release-please-action](https://redirect.github.com/google-github-actions/release-please-action) |  |

## PR Edited (Blocked)

The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below.

- [ ] [chore(deps): lock file maintenance j:cdx-227](../pull/172)

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [chore(deps): replace google-github-actions/release-please-action action with googleapis/release-please-action v4.1.1 j:cdx-227](../pull/198)
- [ ] [fix(deps): update all dependencies j:cdx-227](../pull/183) (`actions/checkout`, `actions/setup-java`, `coveo/public-actions`, `ossf/scorecard-action`, `step-security/harden-runner`, `org.apache.maven:maven-model`, `commons-codec:commons-codec`, `org.mockito:mockito-core`, `joda-time:joda-time`, `com.google.code.gson:gson`, `org.apache.logging.log4j:log4j-core`, `org.apache.maven.plugins:maven-source-plugin`)
- [ ] [fix(deps): update all dependencies j:cdx-227 (major)](../pull/180) (`@actions/core`, `@commitlint/config-conventional`, `@octokit/auth-app`, `actions/checkout`, `actions/setup-java`, `actions/setup-node`, `actions/upload-artifact`, `com.diffplug.spotless:spotless-maven-plugin`, `io.github.resilience4j:resilience4j-retry`)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## Detected Dependencies

github-actions (7)

.github/workflows/build.yml (3)

- `step-security/harden-runner v2.13.1@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a` → [Updates: `v2.21.1`]
- `actions/checkout v4.3.0@08eba0b27e820071cde6df949e0beb9ba4906955` → [Updates: `v4.4.0`, `v7.0.1`]
- `actions/setup-java v4.7.1@c5195efecf7bdfc987ee8bae7a71cb8b11521c00` → [Updates: `v4.9.1`, `v6.0.0`]

.github/workflows/codeql.yml (1)

- `coveo/public-actions main` → [Updates: `main`]

.github/workflows/dependency-review.yml (1)

- `coveo/public-actions main` → [Updates: `main`]

.github/workflows/maven-publish.yml (3)

- `step-security/harden-runner v2.13.1@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a` → [Updates: `v2.21.1`]
- `actions/checkout v4.3.0@08eba0b27e820071cde6df949e0beb9ba4906955` → [Updates: `v4.4.0`, `v7.0.1`]
- `actions/setup-java v4.7.1@c5195efecf7bdfc987ee8bae7a71cb8b11521c00` → [Updates: `v4.9.1`, `v6.0.0`]

.github/workflows/pr-title-semantic-lint.yml (2)

- `step-security/harden-runner v2.13.1@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a` → [Updates: `v2.21.1`]
- `actions/checkout v4@08eba0b27e820071cde6df949e0beb9ba4906955` → [Updates: `v7`, `v4`]

.github/workflows/release.yml (6)

- `step-security/harden-runner v2.13.1@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a` → [Updates: `v2.21.1`]
- `actions/checkout v4.3.0@08eba0b27e820071cde6df949e0beb9ba4906955` → [Updates: `v4.4.0`, `v7.0.1`]
- `actions/setup-node v4.4.0@49933ea5288caeca8642d1e84afbd3f7d6820020` → [Updates: `v7.0.0`]
- `actions/setup-java v4.7.1@c5195efecf7bdfc987ee8bae7a71cb8b11521c00` → [Updates: `v4.9.1`, `v6.0.0`]
- `google-github-actions/release-please-action v4.1.1@e4dc86ba9405554aeba3c6bb2d169500e7d3b4ee` → [Updates: `v4.1.1`]
- `node 18`

.github/workflows/scorecards.yml (5)

- `step-security/harden-runner v2.13.1@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a` → [Updates: `v2.21.1`]
- `actions/checkout v4.3.0@08eba0b27e820071cde6df949e0beb9ba4906955` → [Updates: `v4.4.0`, `v7.0.1`]
- `ossf/scorecard-action v2.4.3@4eaacf0543bb3f2c246792bd56e8cdeffafb205a` → [Updates: `v2.4.4`]
- `actions/upload-artifact v4.6.2@ea165f8d65b6e75b540449e92b4886f43607fa02` → [Updates: `v7.0.1`]
- `github/codeql-action v3.26.13@f779452ac5af1c261dce0346a8f964149f49322b` → [Updates: `v3.37.9`, `v4.37.9`]

maven (1)

pom.xml (13)

- `org.apache.maven.plugins:maven-source-plugin 3.3.1` → [Updates: `3.4.0`]
- `com.diffplug.spotless:spotless-maven-plugin 2.46.1` → [Updates: `3.10.2`]
- `org.apache.maven.plugins:maven-javadoc-plugin 3.12.0`
- `org.apache.maven.plugins:maven-gpg-plugin 3.2.8`
- `org.apache.logging.log4j:log4j-core 2.25.4` → [Updates: `2.26.1`]
- `com.google.code.gson:gson 2.13.2` → [Updates: `2.14.0`]
- `io.github.cdimascio:dotenv-java 3.2.0`
- `joda-time:joda-time 2.14.0` → [Updates: `2.14.3`]
- `org.mockito:mockito-core 5.20.0` → [Updates: `5.23.0`]
- `junit:junit 4.13.2`
- `commons-codec:commons-codec 1.19.0` → [Updates: `1.22.1`]
- `io.github.resilience4j:resilience4j-retry 1.7.1` → [Updates: `2.4.0`]
- `org.apache.maven:maven-model 3.9.11` → [Updates: `3.9.16`]

npm (1)

package.json (3)

- `@actions/core ^1.10.0` → [Updates: `^3.0.0`]
- `@commitlint/config-conventional 19.8.1` → [Updates: `21.2.2`]
- `@octokit/auth-app ^7.0.0` → [Updates: `^8.0.0`]

renovate-config (1)

renovate.json