[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.jetbrains.kotlin:kotlin-stdlib (source)	2.4.21 → 2.5.20-dev-3282

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: SONARXML-531

[gitar-bot]

Code Review ⚠️ Changes requested 🟡 Medium risk 0 closed / 1 findings

Updating the Kotlin standard library to a development build may introduce compatibility or runtime behavior changes across compiled project components.

Bumps the pinned kotlin.version in pom.xml from the stable 2.4.21 to the JetBrains dev build 2.5.20-dev-3282. Changes requested: the dev build is not a release, is not published to Maven Central, and may be removed or rebuilt, so the IT classpath could break or become non-reproducible. Keep 2.4.21 or move to the latest stable Kotlin release, and add a Renovate rule in renovate.json that ignores -dev- versions of org.jetbrains.kotlin.

⚠️ Bug: Kotlin pinned to an unstable dev build (2.5.20-dev-3282)

📄 pom.xml:71-73 📄 pom.xml:136-141

This PR changes the pinned kotlin.version from the stable 2.4.21 to 2.5.20-dev-3282. That is a JetBrains internal dev build, not a release, beta or RC. JetBrains normally publishes these builds to its own dev repository rather than Maven Central. This pom declares no <repositories>, so resolution depends on whatever the SonarSource parent or repox proxies, and such builds can be removed or rebuilt at any time.

The comment above the property (pom.xml:71-72) says this version is pinned on purpose so that sonar-orchestrator's okhttp3 gets a compatible kotlin-stdlib. A dev snapshot gives no compatibility guarantee for that, so the IT classpath could break or become non-reproducible.

Fix: keep 2.4.21 or move to the latest stable Kotlin release. Also add a Renovate rule to renovate.json that ignores -dev- versions of org.jetbrains.kotlin, so this PR doesn't come back.

Stay on a stable Kotlin release (or bump to the newest stable one).

<kotlin.version>2.4.21</kotlin.version>

Add to renovate.json so Renovate skips Kotlin dev/pre-release builds.

"packageRules": [
  {
    "matchPackageNames": ["org.jetbrains.kotlin:**"],
    "allowedVersions": "!/-dev-|-Beta|-RC/"
  }
]

🤖 Prompt for agents

Code Review: Bumps the pinned `kotlin.version` in `pom.xml` from the stable `2.4.21` to the JetBrains dev build `2.5.20-dev-3282`. Changes requested: the dev build is not a release, is not published to Maven Central, and may be removed or rebuilt, so the IT classpath could break or become non-reproducible. Keep `2.4.21` or move to the latest stable Kotlin release, and add a Renovate rule in `renovate.json` that ignores `-dev-` versions of `org.jetbrains.kotlin`.

1. ⚠️ Bug: Kotlin pinned to an unstable dev build (2.5.20-dev-3282)
   Files: pom.xml:71-73, pom.xml:136-141

   This PR changes the pinned `kotlin.version` from the stable `2.4.21` to `2.5.20-dev-3282`. That is a JetBrains internal dev build, not a release, beta or RC. JetBrains normally publishes these builds to its own dev repository rather than Maven Central. This pom declares no `<repositories>`, so resolution depends on whatever the SonarSource parent or repox proxies, and such builds can be removed or rebuilt at any time.
   
   The comment above the property (pom.xml:71-72) says this version is pinned on purpose so that sonar-orchestrator's okhttp3 gets a compatible kotlin-stdlib. A dev snapshot gives no compatibility guarantee for that, so the IT classpath could break or become non-reproducible.
   
   Fix: keep `2.4.21` or move to the latest stable Kotlin release. Also add a Renovate rule to `renovate.json` that ignores `-dev-` versions of `org.jetbrains.kotlin`, so this PR doesn't come back.

   Fix (Stay on a stable Kotlin release (or bump to the newest stable one).):
   <kotlin.version>2.4.21</kotlin.version>

   Fix (Add to renovate.json so Renovate skips Kotlin dev/pre-release builds.):
   "packageRules": [
     {
       "matchPackageNames": ["org.jetbrains.kotlin:**"],
       "allowedVersions": "!/-dev-|-Beta|-RC/"
     }
   ]

Verification Rules 2/2 met Repos 4 inspected

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Broader impact Repos 4 inspected

Cross-repo 4 repositories inspected 0 open impacts

SonarSource/sonarlint-vscode Inspected
SonarSource/sonarlint-eclipse Inspected
SonarSource/sonarlint-intellij Inspected
SonarSource/sonarqube Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.
Unblock → Override a blocking verdict and allow merging.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact	Unblock
gitar auto-apply:on	gitar display:verbose	gitar unblock

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

⚠️ Bug: Kotlin pinned to an unstable dev build (2.5.20-dev-3282)

This PR changes the pinned kotlin.version from the stable 2.4.21 to 2.5.20-dev-3282. That is a JetBrains internal dev build, not a release, beta or RC. JetBrains normally publishes these builds to its own dev repository rather than Maven Central. This pom declares no <repositories>, so resolution depends on whatever the SonarSource parent or repox proxies, and such builds can be removed or rebuilt at any time.

The comment above the property (pom.xml:71-72) says this version is pinned on purpose so that sonar-orchestrator's okhttp3 gets a compatible kotlin-stdlib. A dev snapshot gives no compatibility guarantee for that, so the IT classpath could break or become non-reproducible.

Fix: keep 2.4.21 or move to the latest stable Kotlin release. Also add a Renovate rule to renovate.json that ignores -dev- versions of org.jetbrains.kotlin, so this PR doesn't come back.

_{Was this helpful? React with 👍 / 👎}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[vdiez]

Auto-approved: Renovate dependency update.