[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
de.siegmar:fastcsv (source)	3.7.0 → 4.4.0
org.sonarsource.api.plugin:sonar-plugin-api (source)	13.2.0.3137 → 14.2.0.5584
org.sonarsource.sonarqube:sonar-testing-harness (source)	25.9.0.112764 → 26.10.0.133078
org.sonarsource.sonarqube:sonar-scanner-engine (source)	25.9.0.112764 → 26.4.0.121862

---

Release Notes

osiegmar/FastCSV (de.siegmar:fastcsv)

v4.4.0

Compare Source

Features

• add header validation support to NamedCsvRecordHandler (#​151) (e50ad43)
• deprecate allowExtraCharsAfterClosingQuote (4523745), closes #​170
• propagate CsvParseException from readers unwrapped (1f4fa3e)

Bug Fixes

• align IndexedCsvReader header capture exception wrapping with page reads (1923e7e)
• clear stale CR flag on data chars in StrictCsvParser (d598c2c)
• close file stream when building a reader from a Path fails (53b2311)
• make IndexedCsvReader page reads with named records order-independent (00193db)
• make writer construction from a Path safe (849373e)
• prevent leading empty line from being captured as header (9d4b178)
• reject prebuilt CsvIndex with mismatched pageSize (9878618)
• restore missing space before link in SourceExample component (36e45ee)
• restrict IndexedCsvReader to UTF-8 and single-byte charsets (695e090)

Performance Improvements

• avoid String allocation for empty fields (6ada9d4)
• bulk-copy scan loops in RelaxedCsvParser (e623a6e)
• defer validation message formatting in parsers (2f23a35)
• skip unescape pass for quoted fields without escaped quotes (09a256b)

v4.3.1

Compare Source

Bug Fixes

• detect BOM correctly on short streams in BomInputStream (efc1633)
• prevent ArrayIndexOutOfBoundsException in NamedCsvRecord.findFields (0a05a0b)
• prevent data corruption after seek in IndexedCsvReader with multibyte charsets (c7d45ff)
• prevent skipLine from resurrecting an unterminated last line at EOF (be02dab)
• reject non-ASCII-compatible charsets in IndexedCsvReader (8cc6ea8)

v4.3.0

Compare Source

Features

• add allowUnclosedQuote flag to reader builders (#​173) (171101a)
• lock skipLines once CSV parsing has started (fb018d2)

Bug Fixes

• clear stale CR flag on closing quote in StrictCsvParser (a6d3de5)
• peekLine in RelaxedCsvParser truncated long lines (ce86205)
• peekLine left buffer in inconsistent state after compaction (0819c4f)
• reset() in StrictCsvParser left parser-state fields stale (9c0d607)

v4.2.0

Compare Source

Features

• add FieldMismatchStrategy to replace allowExtraFields/allowMissingFields (b1049ac), closes #​176

v4.1.1

Compare Source

Bug Fixes

• correct BomInputStream buffer offset for short inputs (#​174) (1275474)

Performance Improvements

• precompute comment strategy check in parser (6d6e874)
• use range check in fast-forward loops (85eb73f)

v4.1.0

Compare Source

v4.0.0

Compare Source

SonarSource/sonar-plugin-api (org.sonarsource.api.plugin:sonar-plugin-api)

v14.2.0.5584

Compare Source

What's Changed

• Update dependency mise to 2026.10.3 by @​renovate[bot] in #​334
• PLUGINAPI-241 Deprecate Server.getStartedAt() and CoreProperties.SERVER_STARTTIME by @​pierre-guillot-gh in #​338
• PLUGINAPI-237 Define the HostPlatform and ResourceFetcher APIs by @​claire-villard-sonarsource in #​335

Full Changelog: SonarSource/sonar-plugin-api@14.1.0.5543...14.2.0.5584

v14.1.0.5543

Compare Source

What's Changed

• PLUGINAPI-226 Remove deprecation on IssueStatus.CONFIRMED by @​vikvorona in #​324
• PLUGINAPI-231 Expose the response content type of a web service action by @​emma44-m in #​329

Full Changelog: SonarSource/sonar-plugin-api@14.0.0.4498...14.1.0.5543

v14.0.0.4498

Compare Source

What's Changed

• PLUGINAPI-175 Upgrade logback and slf4j versions by @​henryju in #​316
• PLUGINAPI-219 Update target Java version to 17 and upgrade JUnit to 6.x by @​henryju in #​317

Full Changelog: SonarSource/sonar-plugin-api@13.11.0.4459...14.0.0.4498

v13.11.0.4459

PLUGINAPI-208 - Declare MQR mode metrics for worst issue severity for overall code
PLUGINAPI-209 - Declare MQR flat metrics software quality count for new and overall code

v13.10.0.4437

Compare Source

What's Changed

• PLUGINAPI-201 Add new_ncloc (New Lines of Code) core metric by @​christoph-sachse-sonarsource in #​299

New Contributors

• @​christoph-sachse-sonarsource made their first contribution in #​299

Full Changelog: SonarSource/sonar-plugin-api@13.9.0.4428...13.10.0.4437

v13.9.0.4428

Compare Source

PLUGINAPI-203 Add supportsScopedOrganizationTokens flag to WebService

v13.8.0.4399

Compare Source

What's Changed

• PLUGINAPI-194 Make PropertyDefinition.create public by @​claire-villard-sonarsource in #​297

Full Changelog: SonarSource/sonar-plugin-api@13.7.0.4381...13.8.0.4399

v13.7.0.4381

Compare Source

What's Changed

• PLUGINAPI-190 Promote hidden to a first-class flag on PropertyDefinition by @​steve-marion-sonarsource in #​290

Full Changelog: SonarSource/sonar-plugin-api@13.6.0.4371...13.7.0.4381

v13.6.0.4371

Compare Source

What's Changed

• PLUGINAPI-182 Rework the new manifest module by @​henryju in #​280
• PLUGINAPI-183 Update compatibility list for 26.3 and 2025.1.6 by @​hatem-amairi-sonarsource in #​281
• PLUGINAPI-184 Update README for 2025.4.5, 2026.1.1 and 2026.2 compati… by @​emma44-m in #​282
• PLUGINAPI-185 Update README for 2025.4.6, 2026.1.2 and 2026.2.1 and 2… by @​emma44-m in #​283
• PLUGINAPI-186 Deprecate PropertyDefinitions by @​antoine-vinot-sonarsource in #​284
• SC-45756 Migrate to dateless headers by @​claire-villard-sonarsource in #​285
• PLUGINAPI-187 SubmitReview: Use Vault token by @​pavel-mikula-sonarsource in #​287
• PLUGINAPI-189 Add new metrics by @​OrlovAlexander85 in #​289
• PLUGINAPI-189 Add mapper from Severities by @​OrlovAlexander85 in #​291
• PLUGINAPI-188 Update README for sqcb 26.5 by @​emma44-m in #​288

New Contributors

• @​hatem-amairi-sonarsource made their first contribution in #​281
• @​emma44-m made their first contribution in #​282

Full Changelog: SonarSource/sonar-plugin-api@13.5.0.4319...13.6.0.4371

v13.5.0.4319

What's Changed

• PLUGINAPI-178 Move the plugin manifest tooling to the sonar-plugin-api repo by @​henryju in #​274
• PLUGINAPI-180 New API for issue resolution by @​ericg138 in #​276
• PLUGINAPI-181 Update publishing info by @​ericg138 in #​278

Full Changelog: SonarSource/sonar-plugin-api@13.4.3.4290...13.5.0.4319

v13.4.3.4290

Compare Source

What's Changed

• PLUGINAPI-174 Revert upgrade of logback by @​ericg138 in #​270

Full Changelog: SonarSource/sonar-plugin-api@13.4.2.4284...13.4.3.4290

v13.4.2.4284

Compare Source

What's Changed

• NO-JIRA Update branch env variable name by @​aleksandra-bozhinoska-sonarsource in #​265
• NO-JIRA Update remaining branch env variable name by @​aleksandra-bozhinoska-sonarsource in #​266
• NO-JIRA Fix signing plugin config by @​aleksandra-bozhinoska-sonarsource in #​267

Full Changelog: SonarSource/sonar-plugin-api@13.4.1.4276...13.4.2.4284

v13.4.1.4276

Compare Source

What's Changed

• PLUGINAPI-168 NO-JIRA Prepare next dev iteration (13.5) by @​henryju in #​256
• PLUGINAPI-169 Update README for SQ:CB and SQ:S by @​nquinquenel in #​257
• PLUGINAPI-167 Update license header from Sonarsource SA to SonarSource Sàrl by @​pierre-guillot-gh in #​258
• PLUGINAPI-152 Migrate to GitHub Actions by @​claire-villard-sonarsource in #​260
• NO-JIRA Bump logback and guava versions by @​ericg138 in #​261
• NO-JIRA Bump logback and commons-lang3 versions by @​ericg138 in #​262
• PLUGINAPI-172 NO-JIRA Fix deprecated usage SQ issues by @​aleksandra-bozhinoska-sonarsource in #​263
• NO-JIRA Fix releasability check; no tickets for NO-JIRA commits by @​aleksandra-bozhinoska-sonarsource in #​264

Full Changelog: SonarSource/sonar-plugin-api@13.4.0.3221...13.4.1.4276

v13.4.0.3221

Compare Source

What's Changed

• PLUGINAPI-162 New API to store the analysis context by @​henryju in #​253

Full Changelog: SonarSource/sonar-plugin-api@13.3.0.3209...13.4.0.3221

v13.3.0.3209

Compare Source

What's Changed

• PLUGINAPI-160 Update commons-validator to 1.10.0 by @​antoine-vinot-sonarsource in #​252
• PLUGINAPI-159 Add Security Standards OWASP LLM Top 10 2025, OWASP Top 10 2025, ASVS 5.0, STIG ASD_V6, MASVS 2 by @​nicolas-gauthier-sonarsource in #​251
• PLUGINAPI-164 Introduce support for feature availability checks by @​matteo-mara-sonarsource in #​247

New Contributors

• @​nicolas-gauthier-sonarsource made their first contribution in #​251

Full Changelog: SonarSource/sonar-plugin-api@13.2.0.3137...13.3.0.3209

SonarSource/sonarqube (org.sonarsource.sonarqube:sonar-testing-harness)

v26.10.0.133078

Compare Source

See details in the community announcement, and more in the release notes.

v26.10.0.132816

Compare Source

v26.9.0.129388

Compare Source

See details in the community announcement, and more in the release notes.

v26.8.0.126808

Compare Source

See details in the community announcement, and more in the release notes.

v26.7.0.124771

Compare Source

See details in the community announcement, and more in the release notes.

v26.6.0.123539

See details in the community announcement, and more in the release notes.

v26.4.0.121862

Compare Source

See details in the community announcement, and more in the release notes.

v26.3.0.120487

Compare Source

See details in the community announcement, and more in the release notes.

v26.2.0.119303

See details in the community announcement, and more in the release notes.

v26.1.0.118079

Compare Source

See details in the community announcement, and more in the release notes.

v25.12.0.117093

See details in the community announcement, and more in the release notes.

v25.11.0.114957

Compare Source

See details in the community announcement, and more in the release notes.

v25.10.0.114319

Compare Source

See details in the community announcement, and more in the release notes.

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Summary by Gitar

• New build enforcement:
  • Added maven-enforcer-plugin rule in lib/pom.xml checking bootstrap dependency bytecode against maven.compiler.release
• Dependency pinning:
  • Restricted de.siegmar:fastcsv to 3.x via allowedVersions in renovate.json for Java 11 compatibility

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: SCANJLIB-339

[zglicz]

gitar unblock

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
1 Dependency risk
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

✅ Code review updated (blocking issues remain unresolved).

_{Configure merge blocking}

[gitar-bot]

✅ @zglicz force-unblocked this PR.

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Upgrading the scanner engine and API while enforcing dependency bytecode levels could expose compatibility regressions or make builds fail.

Updates Maven dependencies including FastCSV, sonar-plugin-api, sonar-testing-harness, and sonar-scanner-engine, with a new enforcer rule checking bootstrap dependency bytecode against the supported Java version and renovate.json restricting FastCSV to 3.x for Java 11 compatibility. No open issues found. The FastCSV 4.x upgrade is closed without a fix in this PR because it requires Java 17 while this library still targets Java 11.

✅ 1 closed

Closed: Bug: fastcsv 4.x needs Java 17, but this library still targets Java 11

📄 pom.xml:120 📄 pom.xml:53
The root POM still sets <maven.compiler.release>11</maven.compiler.release>, so the library is published as Java 11 compatible. FastCSV 4.0.0 made Java 17 a hard requirement, listed as a breaking change in its v4.0.0 release notes, and 4.4.0 compiles with release 17. fastcsv is a compile-scope dependency of lib, and lib-shaded relocates it into the shipped artifact. HttpConfig.parseExtraHeaders calls CsvReader.builder().ofCsvRecord(...), so a consumer on Java 11 (for example a Scanner for Maven/Gradle/Ant user) who sets sonar.scanner.http.extraHeaders gets UnsupportedClassVersionError at runtime. The QA matrix in build.yml only runs Java 17 and 21, so CI won't catch this. Fix: keep fastcsv on 3.x (add a Renovate rule to block major updates for it), or raise the library's minimum Java to 17 on purpose as a documented breaking change.

Verification Rules 1/1 met PRs 1 inspected

Functional validation No results

Rules 1 passed 2 not applicable

✅ Repository license compliance

Broader impact PRs 1 inspected

Cross-PR 1 PR inspected 0 open impacts

PR #320: Update Maven dependencies Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}