[dependabot]

Bumps global.namespace.truelicense:truelicense-spi from 4.0.3 to 4.1.4.

Release notes

Sourced from global.namespace.truelicense:truelicense-spi's releases.

v4.1.4

A single fix on top of 4.1.3, whose notes cover everything since 4.0.3.

The @Obfuscate annotation processor no longer warns on newer source levels

ObfuscateProcessor declared @SupportedSourceVersion(RELEASE_8), so javac reported it as lagging behind the language level in every application compiled for a newer release:

warning: Supported source version 'RELEASE_8' from annotation processor
'global.namespace.truelicense.obfuscate.processor.ObfuscateProcessor' less than -source '17'

The processor only inspects the constant value and the modifiers of annotated fields, so no language feature can put it out of its depth and the fixed version was never meaningful. It now reports the latest version supported by the compiler running it, and the warning is gone — verified on JDK 17 and JDK 25.

This was a warning only. It never affected the generated code, the obfuscation itself, or the compiler's output in any other way, so upgrading is optional and changes nothing but your build log. Resolves #40.

Nothing else changed: 4.1.4 is otherwise identical to 4.1.3, and existing license keys are unaffected.

Full Changelog: christian-schlichtherle/truelicense@v4.1.3...v4.1.4

v4.1.3

This release collects everything since 4.0.3 and supersedes 4.1.0, 4.1.1 and 4.1.2 — upgrade straight to 4.1.3.

Existing license keys are unaffected. Nothing in the runtime code changed: the only edits to truelicense-api since 4.0.3 are Javadoc, and the license key pipeline, its codecs and its formats are untouched. Keys generated by any version continue to install and verify.

Constant string obfuscation was silently disabled in this project's own artifacts — fixed

This never affected application code. truelicense-maven-plugin obfuscated your classes exactly as configured in every 4.0.x release; the defect was in TrueLicense's own root POM and its only consequence is that the constants inside the published TrueLicense jars — algorithm names, keystore types, message keys — were left in the clear. Nothing to check or redo in your build.

4.0.1 and 4.0.3 shipped with no obfuscated constants at all, and 4.0.0 only partially. This was not a bad commit but a defect in the build: the obfuscate-main-classes execution was declared inside <pluginManagement>, which binds nothing on its own, and Maven 3.6.x — the version those releases were built with — does not merge such an execution into a plugin declaration that carries no <executions> of its own. The goal never ran and the build stayed green. Independently of that, five modules (truelicense-core, -jax-rs, -jsf, plus the build-time build-tasks and maven-plugin) never declared the plugin at all and were therefore never obfuscated in any 4.0.x release.

Both causes are gone. Obfuscation is now wired centrally and is opt-out, so every module with main sources is covered; a prepare-package check fails the build if a module's classes carry no evidence of obfuscation; and Maven 3.9.16 is enforced, so an untested Maven cannot produce a release.

... (truncated)

Commits

• cbb1d2d Document that the obfuscation regression spared applications
• 2e9c895 Support any source version in the @​Obfuscate processor
• ef812df Build with the 4.1.3 plugin
• a4557bb Point the README badges at durable URLs [skip ci]
• 7b21b03 Build with the 4.1.3-rc2 plugin
• d5759cf Stage the platform classes on JDKs that ship no jmods
• fc82031 Document the LicenseManagementException thrown by the manager operations
• 1512771 Build with the 4.1.3-rc1 plugin
• 1d9fe9e Bump the bootstrap plugin pin to 4.1.2
• e14ba36 Replace Neuron DI with plain Java in the build-time modules
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 86489b03-0d12-4c1e-ba3d-9ada39e3af2a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.